Check whether a received file's digital signature can be verified with the corresponding public key.
Which command is appropriate?
gpg --verify checks a signature against the signed data using the corresponding public key.
Detailed explanation
gpg --verify file.sig file.txtCorrect. --verify checks the signature and the signed data.
Correct. --verify checks the signature and the signed data.
gpg --symmetric file.sigIncorrect. --symmetric performs symmetric encryption.
Incorrect. --symmetric performs symmetric encryption.
gpg --decrypt file.sigIncorrect. Decryption is different from verifying authenticity.
Incorrect. Decryption is different from verifying authenticity.
gpg --export file.sigIncorrect. --export writes keys and does not verify signatures.
Incorrect. --export writes keys and does not verify signatures.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s\n' 'gpg --verify file.sig file.txt'Expected result
gpg --verify file.sig file.txtKey points
- --verify
- Signature
- Public key
Notes
- Environment: GnuPGのコマンド役割確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.