This is the mail archive of the
gcc@gcc.gnu.org
mailing list for the GCC project.
Re: How am I supposed to verify gcc-4.8.0 download when you provide no .sig file?...
- From: Gerald Pfeifer <gerald at pfeifer dot com>
- To: Larry Evans <cppljevans at suddenlink dot net>
- Cc: gcc at gcc dot gnu dot org
- Date: Sun, 2 Jun 2013 20:15:50 +0200 (CEST)
- Subject: Re: How am I supposed to verify gcc-4.8.0 download when you provide no .sig file?...
- References: <01ec01ce4516$256ab3f0$70401bd0$ at com> <517EF358 dot 7070206 at net-b dot de> <01f301ce453a$9c2938d0$d47baa70$ at com> <kmdqg6$te$1 at ger dot gmane dot org>
On Wed, 8 May 2013, Larry Evans wrote:
> the verification command and result are:
>
> ~/download/gcc/4.8 $ gpg --verify --keyring ./gnu-keyring.gpg
> ./gcc-4.8.0.tar.bz2.sig
> gpg: Signature made Fri Mar 22 08:32:18 2013 CDT using DSA key ID C3C45C06
> gpg: Good signature from "Jakub Jelinek <jakub@redhat.com>"
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg: There is no indication that the signature belongs to the
> owner.
> Primary key fingerprint: 33C2 35A3 4C46 AA3F FB29 3709 A328 C3A2 C3C4 5C06
> ~/download/gcc/4.8 $
>
> Should I be worried about the gpg: WARNING?
Not unless you are paranoid. :-) This means that there is not path in
the web of trust (https://en.wikipedia.org/wiki/Web_of_trust) between
Jakub and you. That's not ideal in terms of security, but not a drama.
Gerald