LinuxQuestions.org - How to verify download of LibreWolf web browser?

- Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)

- - How to verify download of LibreWolf web browser? (https://www.linuxquestions.org/questions/linux-software-2/how-to-verify-download-of-librewolf-web-browser-4175689596/)

How to verify download of LibreWolf web browser?

Hi.

I downloaded LibreWolf-84.0.2-2.x86_64.AppImage and LibreWolf-84.0.2-2.x86_64.AppImage.sig. I can't see a way to verify it.

I tried this so far:

Code:

gpg --verify LibreWolf-84.0.2-2.x86_64.AppImage.sig LibreWolf-84.0.2-2.x86_64.AppImage

Output:

Code:

gpg: Signature made Wed 20 Jan 2021 23:19:46 GMT

gpg:                using EDDSA key A98C3D1364D8C16408143C2E2954CC8585E27A3F

gpg: Can't check signature: No public key

I take it that these are key? [pun intended]
https://librewolf-community.gitlab.io/keys/

Is this method correct?

Input:

Code:

gpg --recv-keys A98C3D1364D8C16408143C2E2954CC8585E27A3F

Output:

Code:

gpg: keyserver receive failed: No name

I'm stumped. I don't see why the verification process is not more obvious.

Anyone know what to do next?

Thanks.

Try

Code:

gpg --recv-keys 0xA98C3D1364D8C16408143C2E2954CC8585E27A3F

I do not understand the nuances and why sometimes it works without 0x and sometimes only with 0x. Without it, I wait an enormous time for the response, and sometimes it does not come. There should be no difference.

First I thought you could use the same syntax for User-IDs, but this turns out to be bull. Sorry to those who read my previous comment, which was just downright ... yeah (--search-keys followed by --recv-keys works).

Also, in ~/.gnupg/gpg.conf I use keyserver hkp://keys.gnupg.net.

As there are now several generations of keyservers implementing several technologies, and I have not yet sorted out what you must, what you can and what must be avoided, I recommend to use this same keyserver-setting.

Subscribed to the gnupg users mailing-list, which I have not read for several years, I stopped understanding anything a long time ago and find the exchanges rather frustrating nowadays.

If someone could add some background to all the aspects of retrieving keys with gpg --recv-keys I would be happy.