Search code examples
gnupgtortoisegitpgpverify

Verify TortoiseGit-2.8.0.0-64bit.msi with gpg2

I want to download and verify TortoiseGit-2.8.0.0-64bit.msi

I use gnupg2 (in Cygwin)

The TortoiseGit download page provides these files:

TortoiseGit-2.8.0.0-64bit.msi
TortoiseGit-2.8.0.0-64bit.msi.rsa.asc

I did the below to verify a download (but got: No public key):

$ gpg2 --auto-key-locate keyserver --keyserver-options auto-key-retrieve -- 
verify TortoiseGit-2.8.0.0-64bit.msi.rsa.asc TortoiseGit-2.8.0.0-64bit.msi
gpg: Signature made Thu, Feb 28, 2019  4:34:13 PM EST
gpg:                using RSA key 74A21AE301B3CA5BD8072F5EF7F17B3F9DD9539E
gpg: requesting key F7F17B3F9DD9539E from hkp server keys.gnupg.net
gpg: Can't check signature: No public key

Since I don't have a .sig I tried and got:

$ gpg2 --import TortoiseGit-2.8.0.0-64bit.msi.rsa.asc
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

I can't understand how then to properly verify this download -- if anyone can show the correct method it would be greatly appreciated!

Thank you!

Solution

  • The key is available here: https://download.tortoisegit.org/keys.

    As the MSI files are also signed using AuthentiCode, there is no real need for the GPG signatures for end users. - The GPG signatures are used by the auto-updater in order to verify the integrity of the update packages (despite the fact that those are also downloaded using HTTPs).

    If you need another trust root, you can call TortoiseGitProc.exe /command:pgpfp in order to display the GPG fingerprint.