Comment

Comment by tlikonen

With files SHA512SUMS and SHA512SUMS.sign in the current directory the verifying can be as simple as

    gpg --auto-key-retrieve SHA512SUMS.sign

The key is retrieved from user's default keyring or keyservers. The usual keyserver pool (pool.sks-keyservers.net) has the Debian CD signing key. How we can trust that the key is the right one is another matter. It is signed by many Debian developers.

parent tlikonen 9 years ago

Comment by tlikonen

Discussion