Jonathan Ryshpan:
> gpg: WARNING: This key is not certified with a trusted
signature!
> gpg: There is no indication that the signature belongs to the owner.
> Primary key fingerprint: E641 850B 77DF 4353 78D1 D7E2 812A 6B4B 64DA B85D
Todd Zullinger:
The warning here is telling you that gpg can't say with any
certainty
that the key which made the good signature is a key you trust, because
the fedora key isn't signed by you or someone you have told gpg you
trust.
This warning is, IMO, something which is completely reasonable to
ignore in this particular case. (It is an entirely valid warning and
in many other cases where you'd be verifying a gpg signature it would
be important inoformation that should affect your trust of a
signature.)
Your trust in the fedora gpg key is intended to come from the fact
that you've downloaded it via https directly from the fedora site (as
opposed to getting it from a keyserver or a mirror). All trust starts
somewhere, after all. :)
This is where you want to find a fingerprint of the key on the Fedora
website, so you can do a check on the check of the checksum... ;-)
You're hoping that if someone has actually managed to insert a forged
GPG key, that they can't *also* upload a forged checksum (what you're
using as a double-check) onto the website.
Personally, I think this kind of thing is a bit of a failing. Trying to
verify everything isn't the easiest of things to do, and it's not helped
by having to search through a website for the information and
instructions. On top of that, I feel that for something as important as
the fingerprint of the GPG key, that ought to get displayed on the
homepage, where someone is quickly going to notice if it changed.
--
[tim@localhost ~]$ uname -rsvp
Linux 3.9.10-100.fc17.x86_64 #1 SMP Sun Jul 14 01:31:27 UTC 2013 x86_64
(always current details of the computer that I'm writing this email on)
Boilerplate: All mail to my mailbox is automatically deleted, there is
no point trying to privately email me, I only get to see the messages
posted to the mailing list.
This email tagline has been Australianised. Bloody oath...