LX0-104 · Question #405
You have downloaded a file named file.tgz along with a signature file named file.tgz.asc. Which commands can be used to verify that file.tgz has not been tampered with since the file creator created…
The correct answer is A. gpg verify file.tgz.asc file.tgz C. gpg verify file.tgz.asc E. gpgv file.tgz.asc. When a file is accompanied by a detached signature, GPG provides commands to verify the file's integrity and authenticity against that signature.
Question
Options
- Agpg verify file.tgz.asc file.tgz
- Bgpg verify file.tgz
- Cgpg verify file.tgz.asc
- Dgpgv verify file.tgz.asc
- Egpgv file.tgz.asc
How the community answered
(30 responses)- A93% (28)
- B3% (1)
- D3% (1)
Why each option
When a file is accompanied by a detached signature, GPG provides commands to verify the file's integrity and authenticity against that signature.
gpg --verify file.tgz.asc file.tgz explicitly instructs GPG to verify the signature in 'file.tgz.asc' against the content of 'file.tgz'.
gpg verify file.tgz is incomplete; GPG needs to know which signature file to use for verification.
gpg --verify file.tgz.asc implicitly tells GPG to look for a corresponding data file (e.g., 'file.tgz') in the same directory to verify the signature against, based on common naming conventions.
gpgv verify file.tgz.asc is redundant; 'gpgv' does not require the 'verify' subcommand, as verification is its primary function when given a signature file.
gpgv file.tgz.asc utilizes the 'gpgv' utility, a specialized version of GPG focused on verification, to check the detached signature 'file.tgz.asc' against its implied data file 'file.tgz'.
Concept tested: GPG detached signature verification
Source: https://man7.org/linux/man-pages/man1/gpgv.1.html
Topics
Community Discussion
No community discussion yet for this question.