verification/installation

[Charly Avital]

Alejandro Erickson wrote the following on 10/18/09 2:37 PM:
> Hi,
> I'm a little confused about the verification/installation process.
> 
> I have gpg 1.4.7 which came with Mac OS X - assume I trust it.

Hi Alejandro,

I am a little confused by your assertion that "gpg 1.4.7 came with Mac
OS X". GnuPG software is not included in any way in the MacOS X releases.
One has to to actually download the software and either compile it, or
download a binary installer, and install it.

> I want  
> to verify and install gpg 2.  I download gnupg-2.0.13.tar.bz2 and  
> gnupg-2.0.13.tar.bz2.sig and run
> $ gpg --verify gnupg-2.0.13.tar.bz2.sig
> but it tells me public key not found.

Not found in your public keyring, or not found at all?

In my Terminal:
$ gpg --verify gnupg-2.0.13.tar.bz2.sig gnupg-2.0.13.tar.bz2
gpg: Signature made Fri Sep  4 12:35:03 2009 EDT using RSA key ID 1CE0C630
gpg: Good signature from "Werner Koch (dist sig) <dd9jn at gnu.org>"

> I checked on the gnupg website  
> and found the username associated with 1CE0C630 (the public key for  
> the signature on gpg 2).  I can get gpg to list this public key with
> $ gpg --search-keys dd9jn at gnu.org
> but I can't seem to find a command to import it or to search the  
> keyserver when verifying.  I can find the key online and copy/paste  
> into a file and import the key to gpg but I imagine this is automated.

When the key you are searching for, with the command search-key and not
recv-key is found in a keyserver (following your CLI in Terminal), the
Terminal output will display the key information and offer the option to
import it. Once you have imported it into your public keyring, you will
be able to verify the signature. When using the command recv-key, the
key (if found on the keyserver you are using) will be automatically
downloaded and imported into your public keyring.

By the way, if you intend to compile gnupg-2.0.13 in MacOSX, you will
not, I'm afraid, succeed to have a working gpg2 2.0.13 unless you also
download and install the libraries required by gpg2. Even then, the
resulting installation will not "work" because you need to install
gpg-agent and pinentry that are compatible with MacOSX environment.

A binary installer for MacGPG2 2.0.12 is available for download from the
MacGPG2 project at
<http://sourceforge.net/projects/macgpg2/develop>.
I believe a similar installer for MacGPG2 2.0.13 is in the making by Ben
Donnachie, manager and maintainer of the project.

MacGPG2 is a project separate from MacGPG <http://macgpg.sourceforge.net/>

Best regards,
Charly 0xA57A8EFA
MacOSX 10.6.1 32bits MacBook5,1 - Gnupg 1.4.10 - MacGPG2 2.0.12 -
Running Enigmail version 0.97a (20091021-0809)