youthlosa.blogg.se

The current issue of those keys are available for download from the PuTTY website, and are also available on PGP keyservers using the key IDs listed below. The Master Key signs all the other keys, and other GPG users have signed it in turn. Used to tie all the above keys into the GPG web of trust. Used to sign manually released versions of PuTTY.Īn encryption-capable key suitable for people to send confidential messages to the PuTTY team, e.g. Used to sign routine development builds of PuTTY: nightly snapshots, pre-releases, and sometimes also custom diagnostic builds we send to particular users.

We maintain multiple keys, stored with different levels of security due to being used in different ways. (Note that none of the keys, signatures, etc mentioned here have anything to do with keys used with SSH - they are purely for verifying the origin of files distributed by the PuTTY team.) The keys used for that are different, and are not covered here. This description is provided as both a web page on the PuTTY site, and an appendix in the PuTTY manual.Īs of release 0.58, all of the PuTTY executables contain fingerprint material (usually accessed via the -pgpfp command-line option), such that if you have an executable you trust, you can use it to establish a trust path, for instance to a newer version downloaded from the Internet.Īs of release 0.67, the Windows executables and installer also contain built-in signatures that are automatically verified by Windows' own mechanism (‘ Authenticode’). Here we identify our public keys, and explain our signature policy so you can have an accurate idea of what each signature guarantees. We create GPG signatures for all the PuTTY files distributed from our web site, so that users can be confident that the files have not been tampered with.