1

The MacPorts installation guide says:

  1. Download the latest MacPorts-2.3.1-....pkg installer from the MacPorts download directory. [...]

  2. Double-click the downloaded package installer to perform the default “easy” install.

In between steps 1 and 2, however, a user may wish to verify the integrity of the downloaded package, using the PGP signature file also found in the Macports download directory.

If SIGNATURE_FILE is the name of the signature file, I get the following result:

$ gpg --verify SIGNATURE_FILE
gpg: Signature made Thu 26 Jun 00:37:12 2014 BST using DSA key ID B4AAE6CD
gpg: Can't check signature: public key not found

Where can I find the public key? Google doesn't seem to know.

Improve this question

1 Answer 1

Reset to default
0

The key ID is B4AAE6CD, from your command output. You need to search and retrieve the key from a keyserver: 

gpg --recv-keys B4AAE6CD

Then your verify command should work.

Improve this answer
4
  • Please check the address of the keyserver, seems to be wrong.
    – nohillside ♦
    Aug 26, 2014 at 13:13
  • @Michael, thanks. Using gpg --recv-keys --keyserver wwwkeys.pgp.net B4AAE6CD as you suggested produces gpgkeys: key B4AAE6CD not found on keyserver gpg: no valid OpenPGP data found. On the plus side, $ gpg --recv-keys B4AAE6CD yields a key that can be used to check the integrity of the downloaded file, so I've edited your answer accordingly in order to be able to mark it "accepted".
    – user5798
    Aug 26, 2014 at 13:29
  • (Using that key to verify the signature produces a warning message: WARNING: This key is not certified with a trusted signature! There is no indication that the signature belongs to the owner. However, this is correct GnuPG behaviour, as explained here and here.)
    – user5798
    Aug 26, 2014 at 13:29
  • It is actually in the original keyserver I posted if you look at the web interface. (all the public ones synchronize with each other) It worked when I tried yesterday. They may be having issues as I can't even connect to it now. Since most gpg installs come with a default keyserver set, it's not strictly necessary to specify one anyways, so thanks for fixing it.
    – Michael D. M. Dryden
    Aug 26, 2014 at 20:56

You must log in to answer this question.