Hi Daniel,<div><br></div><div>Really appreciate your help and give me an idea how to get the key from the pgp server.. I only used Ken's key for my last installed version 2.3.16</div><div><br></div><div><div>gpg --verify cyrus-imapd-2.3.16.tar.gz.sig </div>
<div>gpg: Signature made Mon 21 Dec 2009 09:34:05 PM HKT using DSA key ID 6581B5F1</div><div>gpg: Good signature from "Kenneth S Murchison <<a href="mailto:murch@andrew.cmu.edu">murch@andrew.cmu.edu</a>>"</div>
<div>gpg: WARNING: This key is not certified with a trusted signature!</div><div>gpg: There is no indication that the signature belongs to the owner.</div><div>Primary key fingerprint: 11C3 B2A6 BF9C F06C 216F 76E7 D0AB 95C1 6581 B5F1</div>
<div><br></div><div>It is hard to find those latest information regarding verification of the software integrity. Thanks.</div><div><br></div><div>B/R</div><div>Gene Leung </div><div><br></div><br><div class="gmail_quote">
On Thu, Mar 21, 2013 at 7:26 AM, Daniel O'Connor <span dir="ltr"><<a href="mailto:doconnor@gsoft.com.au" target="_blank">doconnor@gsoft.com.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
On 20/03/2013, at 11:53, Gene Leung <<a href="mailto:geneleung818@gmail.com">geneleung818@gmail.com</a>> wrote:<br>
> It seems no one care about the public key. Then, why still put the signature file there for download? Or any other way for verify the integrity of the download.<br>
<br>
</div>The key is available from <a href="http://gpg.mit.edu" target="_blank">gpg.mit.edu</a><br>
<br>
[midget 9:53] ~ >gpg --recv-keys 9342BF08<br>
gpg: WARNING: using insecure memory!<br>
gpg: please see <a href="http://www.gnupg.org/documentation/faqs.html" target="_blank">http://www.gnupg.org/documentation/faqs.html</a> for more information<br>
gpg: requesting key 9342BF08 from hkp server <a href="http://pgp.mit.edu" target="_blank">pgp.mit.edu</a><br>
gpg: key 9342BF08: public key "Jeroen van Meeuwen (kanarip) <<a href="mailto:kanarip@kanarip.com">kanarip@kanarip.com</a>>" imported<br>
gpg: 3 marginal(s) needed, 1 complete(s) needed, classic trust model<br>
gpg: depth: 0 valid: 1 signed: 3 trust: 0-, 0q, 0n, 0m, 0f, 1u<br>
gpg: depth: 1 valid: 3 signed: 0 trust: 0-, 0q, 0n, 3m, 0f, 0u<br>
gpg: Total number processed: 1<br>
gpg: imported: 1<br>
[midget 9:55] ~ >gpg --verify cyrus-imapd-2.4.17.tar.gz.sig cyrus-imapd-2.4.17.tar.gz<br>
gpg: WARNING: using insecure memory!<br>
gpg: please see <a href="http://www.gnupg.org/documentation/faqs.html" target="_blank">http://www.gnupg.org/documentation/faqs.html</a> for more information<br>
gpg: Signature made Sun 2 Dec 06:33:32 2012 CST using DSA key ID 9342BF08<br>
gpg: Good signature from "Jeroen van Meeuwen (kanarip) <<a href="mailto:kanarip@kanarip.com">kanarip@kanarip.com</a>>"<br>
gpg: aka "Jeroen van Meeuwen (GMail) <<a href="mailto:kanarip@gmail.com">kanarip@gmail.com</a>>"<br>
gpg: aka "Jeroen van Meeuwen (OGD) <<a href="mailto:j.van.meeuwen@ogd.nl">j.van.meeuwen@ogd.nl</a>>"<br>
gpg: aka "Jeroen van Meeuwen (XS4All) <<a href="mailto:kanarip@xs4all.nl">kanarip@xs4all.nl</a>>"<br>
gpg: aka "Jeroen van Meeuwen (GameDrome) <<a href="mailto:kanarip@gamedrome.com">kanarip@gamedrome.com</a>>"<br>
gpg: aka "Jeroen van Meeuwen (PC Zone Clan) <<a href="mailto:kanarip@pczone-clan.nl">kanarip@pczone-clan.nl</a>>"<br>
gpg: aka "Jeroen van Meeuwen (Fedora Unity) <<a href="mailto:kanarip@fedoraunity.org">kanarip@fedoraunity.org</a>>"<br>
gpg: aka "Jeroen van Meeuwen (Fedora Project) <<a href="mailto:kanarip@fedoraproject.org">kanarip@fedoraproject.org</a>>"<br>
gpg: aka "Jeroen van Meeuwen (Kolab Systems) (Kolab Systems AG) <<a href="mailto:vanmeeuwen@kolabsys.com">vanmeeuwen@kolabsys.com</a>>"<br>
gpg: aka "Jeroen van Meeuwen (Ergo Project) (Ergo Project) <<a href="mailto:jeroen.van.meeuwen@ergo-project.org">jeroen.van.meeuwen@ergo-project.org</a>>"<br>
gpg: WARNING: This key is not certified with a trusted signature!<br>
gpg: There is no indication that the signature belongs to the owner.<br>
Primary key fingerprint: C6B0 7FB4 43E6 CDDA D258 F70B 28DE 9FDA 9342 BF08<br>
<br>
--<br>
Daniel O'Connor software and network engineer<br>
for Genesis Software - <a href="http://www.gsoft.com.au" target="_blank">http://www.gsoft.com.au</a><br>
"The nice thing about standards is that there<br>
are so many of them to choose from."<br>
-- Andrew Tanenbaum<br>
GPG Fingerprint - 5596 B766 97C0 0E94 4347 295E E593 DC20 7B3F CE8C<br>
<br>
<br>
<br>
<br>
<br>
<br>
</blockquote></div><br></div>