Topic: Apache 2.4.25 - key not certified with a trusted signature

[timonroe]

Steps:
* From this page: https://www.apachelounge.com/download/
* Downloaded version 2.4.25 for Win64
* Downloaded the PGP signature file and the public PGP key file
* Ran the gpg utility:
* gpg --import Steffen_Land.asc
* Got the following message:
<<<
gpg: error loading `iconv.dll': The specified module could not be found.
gpg: please see http://www.gnupg.org/download/iconv.html for more information
gpg: key 29C17558: public key "Steffen Land (Apache Lounge) <info@apachelounge.com>" imported
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)
>>>
* gpg --verify httpd-2.4.25-win64-VC14.zip.asc
* Got the following message:
<<<
gpg: error loading `iconv.dll': The specified module could not be found.
gpg: please see http://www.gnupg.org/download/iconv.html for more information
gpg: Signature made 12/20/16 04:01:07 using RSA key ID 29C17558
gpg: Good signature from "Steffen Land (Apache Lounge) <info@apachelounge.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 3D49 885E ADE8 BC39 9F46 D5DD BEE8 8A78 29C1 7558
>>>

Can someone tell me if I'm doing this incorrectly or if there's a problem with the signature.

Thanks for your help.

Tim

[admin]

Have a look how to verify : https://httpd.apache.org/dev/verification.html

[timonroe]

Thanks for pointing me to the document...

I just ran all of the steps listed (including the 'gpg --fingerprint' and 'gpg --list-sigs'), but when I run:
'gpg --verify httpd-2.4.25-win64-VC14.zip.asc httpd-2.4.25-win64-VC14.zip'

I still get the warning message:
<<<
gpg: Signature made 12/20/16 04:01:07 using RSA key ID 29C17558
gpg: Good signature from "Steffen Land (Apache Lounge) <info@apachelounge.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 3D49 885E ADE8 BC39 9F46 D5DD BEE8 8A78 29C1 7558
>>>

The '--fingerprint' command returns:
<<<
pub 4096R/29C17558 2013-12-29
Key fingerprint = 3D49 885E ADE8 BC39 9F46 D5DD BEE8 8A78 29C1 7558
uid Steffen Land (Apache Lounge) <info@apachelounge.com>
sub 4096R/BC11F6FE 2013-12-29
>>>

The '--list-sigs' command returns:
<<<
....
pub 4096R/29C17558 2013-12-29
uid Steffen Land (Apache Lounge) <info@apachelounge.com>
sig 3 29C17558 2013-12-29 Steffen Land (Apache Lounge) <info@apachelounge.com>
sub 4096R/BC11F6FE 2013-12-29
sig 29C17558 2013-12-29 Steffen Land (Apache Lounge) <info@apachelounge.com>
>>>

From the document, I was expecting the '--verify' command to return a "Good signature... " response.

Can you see what I'm doing wrong?

Thanks again.

Tim

[admin]

Please read at above link at heading : Validating Authenticity of a Key

The key is ok, see http://pgp.mit.edu. search with apachlounge