Hello,

I have created a few customized Linux ISO image CDs. Now I would like to upload them on my web server so that users can download it. I was able to generate MD5SUMS file which contains the MD5SUM checksum of all the ISO CDs. However I have also noticed on some Linux mirrors that there is another file called MD5SUMS.sign. For example on the Debian mirror:
http://cdimage.debian.org/debian-cd/4.0_r3/i386/iso-cd/

you can see the MD5SUMS.sign file. How can I create that?

By digitally signing the MD5SUMS file using GnuPG.

Hi there,

I thought I would just provide you with a bit more explicit information on this:

First set up gpg by running:

Go with the defaults they should be fine for your needs and then enter your details.

Now export your key, distribute this widely so that it can be verified. If you only place it on your website then it may be hard to verify that it hasn't been replaced and a new key used to sign the file.

Now sign the file:

A new file will be created called my.sum.asc, which is the ascii armours, i.e. human readable format of the signed md5sum.