Validating Emacs Downloads

As a long time Emacs fan, I finally broke down and decided to go through the hoops of installing emacs on my work PC (Windows). I went here [https://www.gnu.org/software/emacs/download.html](https://www.gnu.org/software/emacs/download.html) and scrolled down to the "Windows" section. (as a side note, the FTP web interface links default to http, but you can also manually enter https. Not sure what's up with that.) Under the FTP links I noticed a helpful little hint if you'd like to validate the downloads. >The Windows binaries are signed by Corwin Brust > >ECE7 7CF4 17C7 6C1A CFCE 7C2B 5B61 3551 1580 F007 The .sig files provided along side each download file reference this same fingerprint, but after hours of searching... I can't figure out how to get the public GPG key with this fingerprint. I figured out the commands I would use to validate the downloads if I could find the key, but that doesn't help me much. It seems like a fairly large security oversight to leave this information to the imagination of the reader. Does anyone know how to resolve this issue? I might just need the server address that I can pass to `gpg --keyserver "<address>" --receive-keys <fingerprint>` .

Like this: gpg --keyserver hkp://pgp.mit.edu:80 --recv-keys ECE77CF417C76C1ACFCE7C2B5B6135511580F007 (The assumption is that people who are security-minded already know how to import keys.)

Thanks for the help. I assumed I was security minded when I immediately understood everything I was looking at, what it meant, why I needed it, and the command I needed to make progress... When I looked around for it I did come across [pgp.mit.edu](https://pgp.mit.edu) however, when I search for that fingerprint via the web interface, I get "No Results Found" and running that gpg command simply times out the connection for me on my work PC, so I assumed maybe there was a different keyserver I needed. I did however try your command on my personal computer just now and successfully acquired the key, so I guess the problem is in fact solved. Thanks again.

Excuse me for being (partly) irrelevant to your post, but IMO it would be just simpler if the GNU project also publishes MD5 (or another algorithm) checksum in addition to the public key.

I have heard that those SKS servers can be a bit finnicky.

I agree. Security is only effective if the average user can reasonably follow the security steps. Gnu doesn't seem to fully appreciate how uninformed the average computer user actually is. I can absolutely see people just skipping the validation step entirely because they don't want to spend potentially hours figuring out what to do it. It would also make sense for the links they supply to use https instead of http, but hey, what do I know?

I think RMS don’t like servers, but because people searches for his name instead of a fingerprint. Edit to add: This is RMS’s way to tell people about the need to understand PKI instead of just you know… just blindly downloading keys without certainty about who the issuer is.

From bug#55666, > The Windows precompiled binaries are produced by volunteers who are > only loosely associated with the Emacs project. The project releases > Emacs as source tarballs, and the SHA checksums for that are in the > announcement. I've CC'ed Corwin, who produced the latest binaries of > Emacs 28.1.

Hi, this created the result below. `$ gpg --keyserver hkp://pgp.mit.edu:80 --recv-keys ECE77CF417C76C1ACFCE7C2B5B6135511580F007` `gpg: directory '/home/user/.gnupg' created` `gpg: keybox '/home/user/.gnupg/pubring.kbx' created` `gpg: keyserver receive failed: No data` Tried again, and generated this result: `$ gpg --keyserver hkp://pgp.mit.edu:80 --recv-keys ECE77CF417C76C1ACFCE7C2B5B6135511580F007` `gpg: keyserver receive failed: No keyserver available`

To whom it may concern, so I followed instructions on this link below [https://superuser.com/questions/1250681/why-am-i-unable-to-fetch-pgp-keys-from-commandline](https://superuser.com/questions/1250681/why-am-i-unable-to-fetch-pgp-keys-from-commandline) and then hit `$ gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys ECE77CF417C76C1ACFCE7C2B5B6135511580F007` Now I received the key `gpg: /home/user/.gnupg/trustdb.gpg: trustdb created` `gpg: key 5B6135511580F007: public key "Corwin Brust <corwin@bru.st>" imported` `gpg: Total number processed: 1` `gpg: imported: 1`

u/eli-zaretskii could you please explain the rest of the process for a person who uses WSL and/or Win10? How to verify the exe file with gpg public key?

So when I hit this: `gpg --verify /user/Desktop/emacs-28.1-installer.exe.sig /user/Downloads/Programs/emacs-28.1-installer.exe` I received this message: `gpg: Signature made Thu 21 Apr 2022 11:11:02 PM +03` `gpg: using RSA key ECE77CF417C76C1ACFCE7C2B5B6135511580F007` `gpg: Good signature from "Corwin Brust <corwin@bru.st>" [unknown]` `gpg: WARNING: This key is not certified with a trusted signature!` `gpg: There is no indication that the signature belongs to the owner.` `Primary key fingerprint: ECE7 7CF4 17C7 6C1A CFCE 7C2B 5B61 3551 1580 F007` I think this is a legit exe file, isn't it?

Like this: gpg --verify emacs-28.2.zip

Yes.

Thanks for validation.