How am I supposed to verify gcc-4.8.0 download when you provide no .sig file?...

[Tobias Burnus]

Am 29.04.2013 22:14, schrieb Scott Baldwin:
> Just downloaded 4.8.0 from one of your mirror sites listed at
> [http://gcc.gnu.org/mirrors.html] and would like to verify the file with
> GPG.
>
> Your site says "The archives there will be signed by one of the following
> GnuPG keys...", but I see no .sig/.asc file on the mirror sites (or in the
> package itself), so how am I supposed to verify the file, exactly?

Interestingly, the .sig files are only on the GNU server, e.g.
   http://ftp.gnu.org/gnu/gcc/gcc-4.8.0/
but not on the GCC server, e.g.
   ftp://gcc.gnu.org/pub/gcc/releases/gcc-4.8.0/

As the latter is used by the mirrors, it is also not available on the 
mirrors.

Tobias