I'm behind a proxy, and dirmngr doesn't seem to honour the http_proxy rules. So i'm doing these steps
- download sha256sums.gpg and sha256sums from ubuntuhashes
- gpg --verify sha256sums.gpg sha256sums
- The key doesn't exist in my keyring, so i go to the pool.sks-keyservers.net and search for the key 0xD94AA3F0EFE21092. The results: http://pool.sks-keyservers.net:11371/pks/lookup?search=0xD94AA3F0EFE21092&op=vindex
- the site returns a page with a set of keys and keyIDs. I select the key that resembles 0xD94AA3F0EFE21092 and copy this pgp key block into a file
- gpg --import returns an invalid packet, read block error.
How do i resolve this error? On my system the apt-key list shows a similar signing key, so importing this from the /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg, i'm able to verify the ubuntu hashes. On the other hand, verifying a file with a key that is distributed with the release doesn't make sense. Using the pgp key that is returned from the sks-keyservers should be the preferred method.
Also, the web search on pool.sks-servers.net returns a page that is not https by default. Is it de rigeur to return results to keys using http?
0 Answers