Tools · Cryptography and passwords in practice · 24 / 24
A good signature is this file and this key
A verification line that says the signature is good applies to the file you passed and the key that verified. A second file in the folder was not checked. Write the path and the key id, and do not spread the result to neighbors.
The result names a pair
A verify command takes a signature and a file, and it uses a key. A good result means that signature matched that file under that key. Change the file and you have a different check. Change the key and you have a different check.
The words “good signature” are not a property of the folder. They are the output of the command you ran.
The key still has to be the one you meant
The result names the key the tool used. Whether that key is the publisher you expected is a separate note: the fingerprint you compared, and where you got it. A good result under an unexpected key is a good result for that key, not for a different publisher.
If the output does not name the key, write “key not in the output.”
What to write down
File the file path, the signature path, the key id or fingerprint from the output, and the good or bad word. For any other file, write “not the file that was verified.”
Lab: one signed archive and a neighbor
gpg reports a good signature from lab-key on release-a.tar.gz. release-b.tar.gz is in the same directory and was not an argument. A draft says both archives are signed because the signature file is in the folder.
The note quotes the good result for release-a.tar.gz and lab-key. release-b.tar.gz was not verified. The folder does not inherit the result.
verified file: release-a.tar.gz key in the output: lab-key result: good signature release-b.tar.gz: not an argument write: this file and this key not: the folder is signed
Diagram
The file that was checked and the one that was not
A good result does not spread sideways.
File. The path you passed
Key. The key the output names
Result. Good or not, for that pair
Was checked. No
Inherits the result. No
Write. Not the file that was verified
Check yourself
1. Verify says good signature from lab-key on release-a.tar.gz. What was checked?
2. release-b.tar.gz sits next to the signed file and was not an argument. What is its status?
3. The output says good but does not name a key. What do you write?