Ok, I got confused because that pubkey is listed as "Security mailing list
GPG key".
I didn't even think that it would be used to sign the installers too.
2017-12-30 19:41 GMT+02:00 David Sommerseth <
[email protected]>:
> On 30/12/17 12:28, hammered hammered wrote:
> > The 2.4.4 is gpg signed with a key whose ID is 8CC2B034.
> > This Key ID isn't listed on the site under "File Signatures".
> >
> > Is this a valid pub key?
> This sounds right.
>
> $ wget https://swupdate.openvpn.org/community/releases/openvpn-
> install-2.4.4-I601.exe
> $ wget https://swupdate.openvpn.org/community/releases/openvpn-
> install-2.4.4-I601.exe.asc
> $ gpg gpg -v openvpn-install-2.4.4-I601.exe.asc
> Version: GnuPG v1
> gpg: armor header:
> gpg: assuming signed data in `openvpn-install-2.4.4-I601.exe'
> gpg: Signature made Tue 26 Sep 2017 15:19:55 CEST
> gpg: using RSA key 0xD72AF3448CC2B034
> gpg: using subkey 0xD72AF3448CC2B034 instead of primary key
> 0x12F5F7B42F2B01E7
> gpg: using PGP trust model
> gpg: Good signature from "OpenVPN - Security Mailing List <
> [email protected]>"
> gpg: binary signature, digest algorithm SHA1
>
> This key should be accessible publicly. We're using sub-keys,
> so that's probably what's causing the confusion.
>
>
> --
> kind regards,
>
> David Sommerseth
> OpenVPN Inc
>
>
>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
