Verifying PGP (Pretty Good Privacy) signatures on Linux is essential for ensuring the authenticity and integrity of files and messages. However, users often encounter various errors during verification that can be confusing, especially for those new to GnuPG or PGP tools. This list covers common verification errors, their causes, and practical fixes, aimed at Linux users, system administrators, and anyone relying on PGP for secure communication or software validation.
1. “No Public Key” Error
This error occurs when GnuPG cannot find the public key needed to verify the signature in your keyring. It happens if you haven’t imported the signer’s public key or if the key ID is incorrect. The fix is to obtain the correct public key (e.g., from a keyserver like keys.openpgp.org or a trusted source) and import it using gpg --import keyfile.asc. After importing, retry verification.
2. “Signature Made by Unknown Key” Warning
GnuPG can verify the cryptographic validity of a signature but warns if the key used is not trusted locally. This does not mean the signature is invalid but that the key is not fully trusted or verified by you. To fix this, you should check the key’s fingerprint against a known source and then sign the key locally with gpg --sign-key KEYID or set its ownertrust with gpg --edit-key KEYID and the trust command.
3. “Bad Signature” Error
This error means the signature does not match the file or message content, indicating possible tampering or corruption. It can also occur if the file was modified after signing or if the file encoding changed (e.g., line endings converted between Windows and Linux). To fix it, ensure you have the exact original file and verify that it has not been altered or corrupted during transfer.
4. “Can’t Check Signature: No Public Key” in Detached Signatures
Detached signatures are separate files from the data they sign. If you get this error, it means GnuPG cannot verify the signature because it lacks the signer’s public key. Unlike inline signatures, you must have both the original file and the detached signature file, plus the public key. Import the public key as mentioned above, then run gpg --verify signature.sig file.
5. Incorrect File or Signature Usage
Users sometimes attempt to verify a signature without specifying the correct files or confuse which file is the signature and which is the data. For example, running gpg --verify file on a signed file with no embedded signature will fail. Always verify with the proper syntax: inline signatures require only the signed file, detached signatures require both the signature and the data file.
6. Expired or Revoked Key Errors
If the signer’s public key has expired or been revoked, GnuPG will warn or refuse to verify the signature fully. This is a security feature to prevent trusting compromised or outdated keys. To resolve this, check if the key has a valid update or replacement. If the key is legitimately revoked, contact the signer to get a new key or verify authenticity through another channel.
7. Incorrect GPG Version or Configuration
Older versions of GnuPG might not support newer algorithms or key types, leading to verification failures. Additionally, custom configurations in ~/.gnupg/gpg.conf can interfere with verification. Updating to the latest stable GnuPG version (currently 2.3.x series) and resetting configuration to defaults can often fix unexplained verification problems.
8. Keyserver Connectivity Issues
When importing keys, network problems or blocked ports can cause failure to retrieve public keys from keyservers. This prevents verification if the key isn’t locally available. To fix this, try alternative keyservers (e.g., hkps://keys.openpgp.org), check firewall rules, or manually download and import keys.
9. Problem with Line Endings or File Encoding
Transferring signed files between Windows and Linux can alter line endings from LF to CRLF or vice versa, corrupting the signature verification. Using binary-safe file transfer methods (like scp or rsync) avoids this issue. If you suspect line ending problems, use tools like dos2unix to normalize the file before verifying.
10. Confusion Between ASCII-Armored and Binary Signatures
PGP signatures can be ASCII-armored (text-based) or binary. Trying to verify a binary signature as if it were ASCII-armored (or vice versa) can cause errors. Use the correct file for verification and don’t rename files to change their format. GnuPG automatically detects the format when you run gpg --verify, but corrupted or truncated files cause failures.
How to Choose
When troubleshooting PGP signature verification errors on Linux, the most important factors are understanding the error message, ensuring you have the correct public key, and verifying that the files involved are unaltered and properly formatted. Prioritize confirming the authenticity and trustworthiness of the public key before trusting a signature. Using updated GnuPG versions and reliable keyservers also improves success rates. Always verify commands and file paths carefully to avoid simple mistakes.
Frequently Asked Questions
Q: How do I import a public key from a keyserver?
Use gpg --keyserver hkps://keys.openpgp.org --recv-keys KEYID replacing KEYID with the actual key ID.
Q: What does “signature made by unknown key” mean?
It means the signature is cryptographically valid but the key is not locally trusted. You should verify and trust the key manually.
Q: Can I verify a signature if the key is expired?
You can verify, but GnuPG will warn that the key is expired, indicating you should be cautious about trusting the signature.
Q: Why does GnuPG say “Bad signature” even though the file looks fine?
Possible file corruption, modification after signing, or line ending changes can cause this. Always use the exact original file.
Q: How do I check the fingerprint of a public key?
Run gpg --fingerprint KEYID to display the key fingerprint for manual verification.
Q: What is the difference between inline and detached signatures?
Inline signatures are embedded in the signed file or message; detached signatures are separate files, requiring both the data and signature file to verify.
Final Thoughts
PGP signature verification on Linux can be straightforward once you understand the common errors and their fixes. Most issues boil down to missing or untrusted public keys, file corruption, or usage mistakes. Keeping your GnuPG installation updated, verifying key authenticity carefully, and using proper commands will make your verification process reliable and secure. With these practices, you can confidently validate software downloads, emails, and documents using PGP signatures.
Related
- Coping with Shower Avoidance Without Therapy: 10 Practical Tips
- Effects of Long Term Shower Avoidance: What You Need to Know
- Qingshan Lake Hangzhou No Entrance Fee Days Guide