Where is the LibreOffice.org gpg public key?

users
#1

Greetings,

I keep running into a brick wall with this and I shouldn't be. I searched high and low for a place to download the LibreOffice.org gpg Public Key file to no avail. My searches of past threads regarding the subject were not successful. Since the download files on the LO website have the gpg check files (.asc), I must assume the Public Key resides somewhere and it should be easy to find, not kept secret. In fact, the location should be advertised along with the files to download or in a relevant and prominent web page location. I need it to verify the files I download are not corrupt or insecure. Does any one here know where I can get the LO.o gpg Public Key?

Girvin Herr

#2

The MirrorBrain meta page for each build has a link to the GPG public
signature, as well as MD5, SHA1, SHA256 HASH

This as applied to 5.0.2.4

http://downloadarchive.documentfoundation.org/libreoffice/old/5.2.0.4/win/x86_64/LibreOffice_5.2.0.4_Win_x64.msi.asc

This is the link to the meta page for the Windows x64 build of 5.2.0.4

http://downloadarchive.documentfoundation.org/libreoffice/old/5.2.0.4/win/x86_64/LibreOffice_5.2.0.4_Win_x64.msi.mirrorlist

And you can find similar for all builds in the project archive.

http://downloadarchive.documentfoundation.org/libreoffice/old/

#3

Piet,

I tried this and got:

502:$gpg2 --verify libreoffice-translations-5.0.6.3.tar.xz.asc
gpg: Signature made Wed 04 May 2016 03:22:04 PM PDT using RSA key ID AFEEAEA3
gpg: Can't check signature: No public key

This is what I have been getting each time I try to check the LO files. "...No public key" is my problem. I need the public key to import to my gpg to complete the check. I tried the:

504:$gpg --keyserver hkp://subkeys.pgp.net --search-keys libreoffice.org
gpg: searching for "libreoffice.org" from hkp server subkeys.pgp.net
gpg: keyserver timed out
gpg: keyserver search failed: keyserver error

I just tried it again using documentfoundation.org but got the same timeout result.

I need to find the libreoffice.org public key to unlock the check process.

Thanks.
Girvin Herr

#4

I am aware of this. These are the public check files (.asc), not the Public Key file. I need the Public Key to import into gpg to allow it to use the ".asc" check files. Both are needed to verify the downloaded file. The Public Key file could be something like "Libreoffice-gpg-key", but it could be named anything. For example, I have the following public key files:

Slackware-gpg-key
slackbuilds.org.GPG-KEY

I use these to check software updates from those sites. I need to do the same for libreoffice. If LO.o is supplying the public check files, it must have the public key available somewhere.

Thanks.
Girvin Herr

#5

Girvin,

gpg2 --keyserver hkp://keys.gnupg.net --recv-keys AFEEAEA3

C:\Program Files (x86)\GNU\GnuPG>.\gpg2.exe --keyserver hkp://keys.gnupg.net
--recv-keys AFEEAEA3
gpg: requesting key AFEEAEA3 from hkp server keys.gnupg.net
gpg: key AFEEAEA3: public key "LibreOffice Build Team (CODE SIGNING KEY)
<build@documentfoundation.org>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)

or you can open the archive and copy text to a file with .asc
extension--then import the certificate.

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xF434A1EFAFEEAEA3

Same record of key AFEEAEA3

Stuart

=-ref-=
http://nabble.documentfoundation.org/Where-are-the-file-checksums-tc4100881.html

#6

Piet,

That was it! I changed the keyserver and used the ID and gpg found the key and imported it. The check with the .asc file now works. For some reason, my gpg will not automatically fetch the key from the .asc file. I must manually import it. It may be that way for security reasons.

Thank you very much.
Girvin

#7

Stuart,
I got it! Per Piet's suggestion, similar to yours, I changed the keyserver and used the key ID rather than the org and my gpg was successful in getting and importing the public key. Now the check with the .asc file is successful. Thanks to all who have helped in this.

Now, how can we get this procedure on the website so others don't have to go through what I had to do to get the key?

Thanks for your help.
Girvin