Configuring the OpenPGP Public Key
Prerequisites
- The public keys are configured by the installation user.
- The GnuPG tool is installed on Linux.
Verification method:
- Run the gpg --version command in the shell to check whether the GnuPG tool is installed. If the GnuPG tool is installed, the following information is displayed:
gpg (GnuPG) 1.4.20 Copyright (C) 2015 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: ~/.gnupg Supported algorithms: Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2
- If the GnuPG tool is not installed, install the tool by following instructions on the official GnuPG website http://www.gnupg.org/.
- Run the gpg --version command in the shell to check whether the GnuPG tool is installed. If the GnuPG tool is installed, the following information is displayed:
Configuring a Public Key
- Obtain the public key file.
Go to the OpenPGP download page and click the download link, as shown in Figure 5-1. The file download page is displayed.
The KEYS.txt file is the public key file, as shown in Figure 5-2.
If you want to switch to the English interface, click
in the upper right corner.
- Upload the downloaded KEYS.txt file to the Linux OS where the installation package is located.
For example, upload the file to /home/test/openpgp/keys.
- Import the public key file.
Run the following command to go to the directory that contains the KEYS.txt public key file.
# gpg --import "/home/test/openpgp/keys/KEYS.txt"
The command output is as follows:
gpg: /root/.gnupg/trustdb.gpg: trustdb created gpg: key 27A74824: public key "OpenPGP signature key for Huawei software (created on 30th Dec,2013) <support@huawei.com>" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1)
/home/test/openpgp/keys is the absolute path of the KEYS.txt public key file. Change it to the actual path.
- Run the following command to view the import result:
# gpg --fingerprint
The command output is as follows:
/root/.gnupg/pubring.gpg ------------------------ pub 2048R/27A74824 2013-12-30 Key fingerprint = B100 0AC3 8C41 525A 19BD C087 99AD 81DF 27A7 4824 uid OpenPGP signature key for Huawei software (created on 30th Dec,2013) <support@huawei.com> - Verify the public key.
- The validity of the OpenPGP public key must be verified based on the public key ID, fingerprint, UID, and the publisher of the public key. The OpenPGP public key information is as follows:
- Public key ID: 27A74824
- Public key fingerprint: B100 0AC3 8C41 525A 19BD C087 99AD 81DF 27A74824
- UID: OpenPGP signature key for Huawei software (created on 30th Dec,2013)<support@huawei.com>
After the information is verified, you can set the trust level of the public key.
- Run the following command to set the trust level of the public key:
# gpg --edit-key "OpenPGP signature key for Huawei" trust
Information similar to the following is displayed (you need to manually configure the information in bold). Enter 5 after Your decision?, which indicates I trust ultimately. Enter y after Do you really want to set this key to ultimate trust? (y/N).
The command output is as follows:
gpg (GnuPG) 1.4.20; Copyright (C) 2015 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. pub 2048R/27A74824 created: 2013-12-30 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). OpenPGP signature key for Huawei software (created on 30th Dec,2013) <support@huawei.com> pub 2048R/27A74824 created: 2013-12-30 expires: never usage: SC trust: unknown validity: unknown [ unknown] (1). OpenPGP signature key for Huawei software (created on 30th Dec,2013) <support@huawei.com> Please decide how far you trust this user to correctly verify other users' keys (by looking at passports, checking fingerprints from different sources, etc.) 1 = I don't know or won't say 2 = I do NOT trust 3 = I trust marginally 4 = I trust fully 5 = I trust ultimately m = back to the main menu Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y pub 2048R/27A74824 created: 2013-12-30 expires: never usage: SC trust: ultimate validity: unknown[ unknown] (1). OpenPGP signature key for Huawei software (created on 30th Dec,2013) <support@huawei.com> Please note that the shown key validity is not necessarily correctunless you restart the program. gpg> quit
- The validity of the OpenPGP public key must be verified based on the public key ID, fingerprint, UID, and the publisher of the public key. The OpenPGP public key information is as follows:
in the upper right corner.- Run the quit command to exit.
