| View previous topic :: View next topic |
| Author |
Message |
busfahrer
n00b
Joined: 18 Sep 2004
Posts: 57
Location: Germany
|
 Posted: Sun Nov 21, 2004 3:00 pm Post subject: Question on GPG |
 |
|
Hi,
I'm beginning to use GPG, and I was wondering this:
When, for example, verifying kernel sources from kernel.org with their public key, I get the following warning:
| Code: |
gpg: Signature made Mon Nov 15 03:20:41 2004 CET using DSA key ID 517D0F0E
gpg: Good signature from "Linux Kernel Archives Verification Key <ftpadmin@kernel.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: C75D C40A 11D7 AF88 9981 ED5B C86B A06A 517D 0F0E
|
Did I understand it correctly that the only way to (properly) get rid of this warning was to meet the person in real life, verify their fingerprint, and then back at home, sign their key in gpg as trusted?
Greetings, Chris
_________________
HOWTO: Removing disks from an LVM volume |
|
| Back to top |
|
 |
JPMRaptor
Guru
Joined: 04 Oct 2002
Posts: 410
Location: Maryland
|
| Posted: Sun Nov 21, 2004 4:15 pm Post subject: |
|
|
You can decide to trust any key you want to. No meeting in person is required. What you realistically want to do is verify through a few separate sources that the fingerprint for the key is correct.
_________________
Underwater photo gallery
New pictures, Oct 2005 |
|
| Back to top |
|
|
busfahrer
n00b
Joined: 18 Sep 2004
Posts: 57
Location: Germany
|
| Posted: Sun Nov 21, 2004 8:51 pm Post subject: |
|
|
| JPMRaptor wrote: | | You can decide to trust any key you want to. No meeting in person is required. What you realistically want to do is verify through a few separate sources that the fingerprint for the key is correct. |
Yes, that's what I meant. Thanks for your answer. 
_________________
HOWTO: Removing disks from an LVM volume |
|
| Back to top |
|
|
sschlueter
Guru
Joined: 26 Jul 2002
Posts: 578
Location: Dortmund, Germany
|
| Posted: Mon Nov 22, 2004 3:10 am Post subject: Re: Question on GPG |
|
|
| busfahrer wrote: | | Did I understand it correctly that the only way to (properly) get rid of this warning was to meet the person in real life, verify their fingerprint, and then back at home, sign their key in gpg as trusted? |
There can also be one or more "intermediate" persons. Google keywords: "web of trust".
http://www.rubin.ch/pgp/weboftrust.de.html in german
http://www.rubin.ch/pgp/weboftrust.en.html in english |
|
| Back to top |
|
|
busfahrer
n00b
Joined: 18 Sep 2004
Posts: 57
Location: Germany
|
|
| Back to top |
|
|
|
Networking & Security
