FAQ

How to use GPG to verify signed release?

To perform the verification, you need the following:

• Signed file – for example edge-home-orchestration-go-v1.0.0.tar.gz
• Signature file – accompanying file with “.asc” extension (Ex. edge-home-orchestration-go-v1.0.0.tar.gz.asc)
• Public key – downloaded from a key server

Getting the public key key-ID from the signature file

$ gpg --with-fingerprint <signature file>

Download public key from key server

$ gpg --keyserver pgp.mit.edu --recv-keys <key-ID>

Verification signed file

$ gpg --verify <signature file> <signed file>