Problem: Checking .asc files under windows is painful.
There's certainly a need for it.
Background: Some developers sign theier software with PGP or GPG.
GPG is a command line tool and there fore requires some typing.
Normal work flow:
- Download software and signature file. (Lets asume to C:\Download)
- Open CMD
- type "C:\Program Files\Gnu\GnuPg\gpg.exe --verify C:\Download\Installer.exe.asc C:\Download\Installer.exe (note it's C:\Program Files (x86) for 64bit systems)
Technical background:
- gpg.exe require the public key of the signer
- gpg.exe checks the checksum of installer.exe and the signature, both have to be vaild
- gpg.exe returns:
gpg: Signature made TTT MMM YYYY hh:mm:ss AM/PM EDT using RSA key ID [ID]
gpg: Good signature from "[Name] <[email]>"
gpg: aka "[Name] <[email]>" {if any, can be more than one}
gpg: WARNING: This key is not certified with a trusted signature! {whenever it's a known key, but no trust level is set}
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: HXHX HXKX HXHX HXHX HXHX HXHX HXHX HXHX HXHX HXHX {hex fingerprint}
when everything is OK.
A tool should make this easier.
The tool should allow selection of an .asc file (one at a time seems to be OK) and the corresponding signed download (can be anything, and maybe is not named) and pass those information to gpg.exe and return the results to the user. It's a GUI for gpg.exe, I think. Well not a fully GUI, just for the verification function. The tool just passes everything to gpg.exe and does not do any cryptographically related work.
Requirements:
- Allow path selection for singature file (.asc)
- Allow path selection for signed file
- Return the results
Optional:
- Allow selection of the path where gpg.exe is installed
- Interpret the results and give user-friendly feedback*
- portable
- or a shell extension (right click menu)
- Whenever the tools parses/interprets the results it would be cool when it could remember the ID and the fingerprint and warn when both don't match on the next check.
* E.g.
"[Signed file] was signed at TT MM YYYY hh:mm:ss AM/PM with key [ID] by [Name] [email]! The signature is vaild! Key Fingerprint: [HXHX .....]. Details"
Where details is a button or link, that shows the full results.
"The key [ID] is not know." or "The key [ID] is not in your keyring. Please add it to your keyring." Whenever the public key of the signer is not know to gpg.exe
