Create a binary detached signature for release.tar.xz in release.tar.xz.sig without changing the archive itself.
Which command is appropriate?
gpg --detach-sign FILE creates a signature separate from the content. Verification requires the signature, data, and signer public key.
Detailed explanation
gpg --encrypt release.tar.xzIncorrect. --encrypt creates ciphertext rather than a signature.
Incorrect. --encrypt creates ciphertext rather than a signature.
gpg --clearsign release.tar.xzIncorrect. --clearsign is a cleartext signature format for text, not a detached binary file.
Incorrect. --clearsign is a cleartext signature format for text, not a detached binary file.
gpg --output release.tar.xz.sig --detach-sign release.tar.xzCorrect. It writes the detached signature to the requested file.
Correct. It writes the detached signature to the requested file.
gpg --verify release.tar.xzIncorrect. --verify checks an existing signature.
Incorrect. --verify checks an existing signature.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s
' '--detach-sign=data stays separate from signature' '--output release.tar.xz.sig=signature file'Expected result
--detach-sign=data stays separate from signature
--output release.tar.xz.sig=signature fileKey points
- Keep the signature separate
- Use the signer's private key
- Different from encryption
Notes
- Environment: GnuPG signing構文（署名なし）
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.