Verifying a mirror

The desk article on verification. Every serious entry in this directory signs its mirror list with a PGP key, and checking that signature is how you know a published address came from the market and not from an impersonator.

What a signature proves

A PGP signature over a message proves two things at once. That the message was signed by the holder of a specific private key, and that not one byte has changed since. For a mirror list, the addresses inside provably came from whoever holds the market key, and nobody edited them in transit.

The trust anchor

The check is only as good as the key you check against. Fetch the market's public key once, from at least two independent places, cross-check the fingerprint, and import it. After that, every future list verifies against the same key. Do not re-fetch the key each time, because that is another chance to be handed the wrong one.

Running the check

Save the signed list to a file and run the verify with GnuPG. Look for the line that says the signature is good and names the market key. That line is the whole result. A warning that you have not certified the key is normal. A bad-signature line means the list was altered, and you trust none of the addresses in it.

Then compare

Once the signature checks out, compare the addresses in the list against the one in your bar. The signature and the address check are two different defences. Running both closes more than either alone. Cross-reference the security topic.