Sometimes you get downloads that have been signed using PGP

This is a pain in the ass.

To verify the file you downloaded, you need to:

1. Get the signature file (usually ends in .asc)
2. run gpg –verify <signature file> - In the output from gpg, look for the Key ID that was used to create the file - Import that public key into your key ring:
3. Run gpg –verify <signature file> again
4. You should see “gpg: Good signature from blah blah”
5. You can choose to ignore the warning about the key not being signed by someone you trust.

http://httpd.apache.org/dev/verification.html

No bookmarks tagged gpg AND openpgp