At 22:19 10-12-2008, LuKreme wrote:
I ssh to the server and then I sudo su (so I am sure I have discarded
my own login environment, I do not normally do this)
mail# gpg --list-keys /etc/mail/spamassassin/sa-update-keys/pubring.gpg
gpg: error reading key: No public key
gpg --no-default-keyring --keyring
/etc/mail/spamassassin/sa-update-keys/pubring.gpg
At least on my FreeBSD, there's no man page for gpg, and the --help
man gpg works for me.
Riiight, but the public key I put in the keychain does all that, no?
I'm still unclear on how the --gpgkey makes it more secure. If the
file is signed, the signature is checked against the public key that I
have in pubring.gpg. What does the gpgkey do?
There may be several keys in a keyring. When running an automated
process to verify a file, you also have to validate who signed the
file. That's where the gpgkey comes in. Simply checking the
signature is not enough.
Regards,
-sm
