Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

Does slapt-get support the GPG/PGP signature verification?

April 26, 2017GPG PGP signature slapt-get support verification

0

10 Posted

Does slapt-get support the GPG/PGP signature verification?

1 Answer

0

10 Posted

Yes, as of 0.9.12 slapt-get can be built with gpgme support that allows slapt-get to verify the signature of the CHECKSUMS file on each mirror. This requires the presence of the signature file and the GPG-KEY file on the package source. The GPG-KEY is imported into the local keychain using the –add-keys option. When running –update, the signature file for the CHECKSUMS listing is downloaded and verification is attempted. If the key is not present slapt-get mentions this and continues on. slapt-get only halts if verification failed.