Verify that release.tar.xz.sig is a valid signature for release.tar.xz using the imported signer public key.
Do not modify the files.
Which command is appropriate?
gpg --verify SIGNATURE DATA checks a detached signature against the signed data. Signature validity and trust in the signer are separate decisions.
Detailed explanation
gpg --decrypt release.tar.xz.sig release.tar.xzIncorrect. It requests decryption rather than signature verification.
Incorrect. It requests decryption rather than signature verification.
gpg --sign release.tar.xz.sig release.tar.xzIncorrect. --sign creates a new signature.
Incorrect. --sign creates a new signature.
gpg --import release.tar.xz.sig release.tar.xzIncorrect. --import expects key material, not a data/signature pair.
Incorrect. --import expects key material, not a data/signature pair.
gpg --verify release.tar.xz.sig release.tar.xzCorrect. It verifies the detached signature against the archive.
Correct. It verifies the detached signature against the archive.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s
' '--verify SIGNATURE DATA -> check detached signature against exact data bytes'Expected result
--verify SIGNATURE DATA -> check detached signature against exact data bytesKey points
- Specify signature first
- Compare the data bytes
- Assess key trust separately
Notes
- Environment: GnuPG verification構文（検証なし）
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.