On Sun, 2 Feb 2025 09:22, Josef Wolf said: >> Does it really need to be that hard to verify signature with a given pubkey?
That is for what gpgv was created for. Use it.
Or use the newer gpg option
--assert-signer fpr_or_file
This option checks whether at least one valid signature on a file
has been made with the specified key. The key is either specified
as a fingerprint or a file listing fingerprints. The fingerprint
must be given or listed in compact format (no colons or spaces in
between). This option can be given multiple times and each
fingerprint is checked against the signing key as well as the
corresponding primary key. If fpr_or_file specifies a file, empty
lines are ignored as well as all lines starting with a hash sign.
With this option gpg is guaranteed to return with an exit code of 0
if and only if a signature has been encountered, is valid, and the
key matches one of the fingerprints given by this option.
But here you need to import the keys first. But you need to
store them anyway and have a way to update them.
Salam-Shalom,
Werner
--
The pioneers of a warless world are the youth that
refuse military service. - A. Einstein
openpgp-digital-signature.asc
Description: PGP signature
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org https://lists.gnupg.org/mailman/listinfo/gnupg-users
