Question

29

How do I verify an asc key fingerprint?

rated 0 times [ 29] [ 0] / answers: 1 / hits: 41719 / 2 Years ago, sat, june 18, 2022, 4:53:18

At the moment, I'm trying to check the fingerprint of the oracle_vbox.asc key that I downloaded from http://www.virtualbox.org/wiki/Linux_Downloads: they provide the key and the fingerprint but no instructions for reviewing this information myself.

How do I show the fingerprint of the key I just downloaded?

apt-key finger oracle_vbox.asc shows the fingerprints of all trusted keys, which isn't what I want.

Answers

Only authorized users can answer the question. Please sign in first, or register a free account.

tonhorn

Add To Favorites

Follow

Total Points: 196

Total Questions: 118

Total Answers: 95

Location: Vanuatu

Member since Fri, May 13, 2022

2 Years ago

tonhorn questions

1 Cannot install docker-desktop on ubuntu 22.04

Tue, May 10, 22, 12:01, 2 Years ago

1 SGX disabled by BIOS in Ubuntu 22.04

Sat, Dec 18, 21, 06:23, 2 Years ago

1 How to install GEOS on Ubuntu 20.04

Thu, Jun 16, 22, 04:03, 2 Years ago

1 dependency not found

Fri, Apr 1, 22, 05:23, 2 Years ago

1 20.04 with I217-LM driverversion=3.8.7-NAPI won't take address

Tue, Jan 18, 22, 18:56, 2 Years ago

View All

answered 2 Years ago restlerfin · Accepted Answer

Get the key:

$ wget http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc

Print the key fingerprint with GPG version 1:

$ gpg --with-fingerprint oracle_vbox.asc 

pub  1024D/98AB5139 2010-05-18 Oracle Corporation

                      (VirtualBox archive signing key) <[email protected]>

      Key fingerprint = 7B0F AB3A 13B9 0743 5925  D9C9 5442 2A4B 98AB 5139

sub  2048g/281DDC4B 2010-05-18

      Key fingerprint = 27B0 97CF 8257 4209 C434  8D42 B674 8A65 281D DC4B

Note that the 2nd fingeprint is just the fingerprint of the sub-key.

Print the fingerprint with GPG version 2:

$ gpg2 -n -q --import --import-options import-show  oracle_vbox.asc   

pub   dsa1024 2010-05-18 [SC]

      7B0FAB3A13B907435925D9C954422A4B98AB5139

uid   Oracle Corporation (VirtualBox archive signing key) <[email protected]>

sub   elg2048 2010-05-18 [E]

Note that -n is an alias for --dry-run, i.e. the key isn't actually imported.

Alternatively, to just display the fingerprints:

$ gpg2 -nq --import --import-options import-show --with-colons oracle_vbox.asc 

     | awk -F: '$1 == "fpr" { print $10 }'

7B0FAB3A13B907435925D9C954422A4B98AB5139

27B097CF82574209C4348D42B6748A65281DDC4B