<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">My apologies. I got this completely wrong.<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 19 Apr 2023, at 12:28 pm, Peter West via macports-users <<a href="mailto:macports-users@lists.macports.org" class="">macports-users@lists.macports.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">It is not easy to find the GPG signature. I just had a look around and couldn’t find it.<div class=""><br class=""></div><div class=""><div class="">
<meta charset="UTF-8" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="text-align: start; text-indent: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-transform: none; white-space: normal; word-spacing: 0px; text-decoration: none; -webkit-text-stroke-width: 0px;" class="">—<br class="">Peter West<br class=""><a href="mailto:pbw@pbw.id.au" class="">pbw@pbw.id.au</a></div><div class="">“Put your finger here, and see my hands; and put out your hand, and place it in my side. Do not disbelieve, but believe.” Thomas answered him, “My Lord and my God!”</div></div></div></div></div></div></div></div></div></div></div>
</div>
<div class=""><br class=""><blockquote type="cite" class=""><div class="">On 19 Apr 2023, at 11:33 am, Sriranga Veeraraghavan <<a href="mailto:sriranga@berkeley.edu" class="">sriranga@berkeley.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Dave,<br class=""><br class="">In my experience, you shouldn't need anything more than GnuPG 2.x to verify a signature stored in a .asc file. You should be able to verify the signature stored in a .asc file as follows:<br class=""><br class="">gpg --verify [.asc file] [.dmg file]<br class=""><br class="">This assumes that you have the relevant public key in your GnuPG keychain. If you do not have the relevant key in your keychain, you will need to download it and import it:<br class=""><br class="">gpg --import [key file]<br class=""><br class="">Best,<br class=""><br class="">-ranga<br class=""><br class=""><blockquote type="cite" class="">On Apr 18, 2023, at 17:08, dave c via macports-users <<a href="mailto:macports-users@lists.macports.org" class="">macports-users@lists.macports.org</a>> wrote:<br class=""><br class="">I want to verify an installer .dmg file’s signature. I downloaded both files (installer and signature) from the developer’s site.<br class=""><br class="">I installed gpg tools and discovered that gpg is looking for a .sig file, but the signature file available from the developer is an .asc file.<br class=""><br class="">I won’t describe the rabbit hole I went down of installing other packages so to install apt-get which requires other packages be installed first… <br class=""><br class="">I’m not ignorant nor inexperienced using terminal but this time it was just too far.<br class=""><br class="">Looking for help to the shortest distance to my goal of verifying a signature.<br class=""><br class="">Thanks,<br class="">Dave<br class="">macOS 10.12.6 Sierra<br class=""></blockquote><br class=""></div></div></blockquote></div><br class=""></div></div></div></blockquote></div><br class=""></body></html>