issue 4587: Verifying multiple OpenPGP signatures on a release

For issue 4587: Verifying multiple OpenPGP signatures on a release
The following splits and verifies all signatures:
csplit --elide-empty-files --prefix=sig --suffix-format=%0d2.asc subversion-1.9.0.tar.bz2.asc '/^-----BEGIN PGP SIGNATURE-----$/' '{*}'
for X in sig*.asc; do gpg --verify $X subversion-1.9.0.tar.bz2; done

The same could be done in awk.

In 2013 gpg was noted to not support multiple signatures if the signing keys differ in type/digest:
http://www.eyrie.org/~eagle/journal/2013-01/011.html

Andreas
Received on 2015-08-13 12:29:12 CEST