Trying To Verify A Programme

[anonprivate]

I am trying to verify a programme using its signature file.

What am I doing wrong?

andrew@andrew-Dell-DM061:~/Downloads$ gpg --verify master-pdf-editor-hash-SHA1.sig master-pdf-editor-3.5.81_i386.deb
gpg: can't open `master-pdf-editor-hash-SHA1.sig'
gpg: verify signatures failed: file open error
andrew@andrew-Dell-DM061:~/Downloads$

Thank you

[vinnywright]

try

openssl dgst -sha1  master-pdf-editor-3.5.81_i386.deb

and check the output aginst the SHA1 # on the site

VINNY

[Snowhog]

You can simplify even that. In a console just type sha1sum master-pdf-editor-3.5.81_i386.deb and compare the output to the value on the site.

[anonprivate]

Thank you

sha1sum works

Why did my gpg command not work?

Out of interest. I am wondering about the use of the hash tags.

If someone creates a programme that does harm, produces the hash tag, and then puts both files on a webiste making claims for the programme; then anyone testing the hash in the programme against the hash tag will see a match, yet the programme may do more harm that good.

Best wishes.

[Snowhog]

The sums don't guarantee a packages safety to ones system. The sum merely ensures that the package hasn't been tampered with after it was summed by the packager. Could an evil developer create a package with the intent to do harm to others? It isn't out of the realm of possibility, but it is highly unlikely.