Help about GnuPG 1.4.9

[Pete Stephenson]

On 9/14/2014 11:05 PM, bonneau at sanboa.info wrote:
> Hello,
> 
> I'm a completly new possible user of macgpg.
> I want to use it but somme security questions don't be resolved :
> I've a Mac with Mac OS 10.5.8 Intel Core 2 duo with AppleMail 3.6 and
> want to download the free software.

Welcome! Hopefully we can get you straightened out!

> I've falled on this site : http://macgpg.sourceforge.net/fr/index.html
> which lets download this :
> /GNU Privacy Guard/ - pour Mac OS X 10.1 (et suivantes)
> 
>   * Pour Mac OS X 10.4.x et plus nouveau
>       o GnuPG v2.x
>         <https://sourceforge.net/project/showfiles.php?group_id=248469>,
>         now a separate project.
>       o 1.4.9
>         <http://prdownloads.sourceforge.net/macgpg/GnuPG1.4.9.dmg?download>,
>         MD5: 36d9eb482a98774521bfd7bb73e4ad06    
> 
> I've choosen 1.4.9 

GnuPG 1.4.9 is a bit out of date. https://gpgtools.org/ should have a
more recent version, but it seems that it will only work back to Mac OS
X 10.6, not 10.5.

Can you upgrade to a newer version of Mac OS X? 10.5 is quite old and
reached end-of-life in 2011.

You might find
http://support.gpgtools.org/discussions/problems/10783-gpgtools-for-mac-osx-1058
to be of some interest.

> But after,  I've read : *Never use a GnuPG version you just downloaded
> to check the integrity of the source* - use an existing GnuPG installation. 
> on : https://www.gnupg.org/download/integrity_check.html
> and that's the problem for me :
> _how can I know if the software downloaded is secure or not ?_
> 
> I followed the advices :
> 
> gpg --verify 1.4.9
> 
> sha1sum 1.4.9
> 
> etc., on Terminal.app

It's possible that Mac OS X 10.5 does not have gpg, openssl, or sha1sum
installed. I'm not familiar with systems that old.

However, it appears that the system does have a means of calculating MD5
checksums. You should be able to run the following command from a terminal:

/sbin/md5 /Users/alain1/Desktop/GnuPG1.4.9.dmg

Alternatively, if the Mac has GPG installed already (I know that newer
versions of Mac OS X do, but I'm not sure about 10.5), you can run the
following from the terminal:

gpg --print-md MD5 /Users/alain1/Desktop/GnuPG1.4.9.dmg

> but never appeared the good suite MD5 of numbers and letters !
> history:
> 'openssl md5 [nomDeFichier]'Last login: Sun Aug 16 17:52:58 on console
> Ordinateur-839:~ alain1$ 'openssl md5
> [/Users/alain1/Desktop/GnuPG1.4.9.dmg ]'-bash: openssl md5
> [/Users/alain1/Desktop/GnuPG1.4.9.dmg ]: No such file or directory
> Ordinateur-839:~ alain1$ 'openssl md5 [GnuPG1.4.9]'
> -bash: openssl md5 [GnuPG1.4.9]: command not found
> Ordinateur-839:~ alain1$ openssl md5 [/Users/alain1/Desktop/GnuPG1.4.9.dmg]'

What happens if you run the command without the square brackets ([]) or
the single quotes (')?

For example,

openssl md5 /Users/alain1/Desktop/GnuPG1.4.9.dmg

>  Thus, my second question :
> _With which application can I check that the software downloaded is
> secure (writing "openssl md5…")_

OpenSSL is installed in newer Mac OS X systems, but might not be
installed on 10.5. If it's not installed, you could install it but
that's typically not a trivial thing to do.

Check if it's installed by running:

openssl version

from the terminal.

As for your other questions, I'm not sure. Hopefully someone else can
answer.

Cheers!
-Pete

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: </pipermail/attachments/20140915/5a27052a/attachment.sig>