I downloaded the recent update (Cryptomator-1.5.8) and I’m trying to validate the integrity of the file signatures, but I’m confused in regards to the steps/files required.
I have the following files:
Cryptomator-1.5.8.dmg
Cryptomator-1.5.8.dmg.asc
And on the download page I see:
SHA256 Signature
8d7a06bedb59aff79a7041b5ab4b94394468ea6b497a75d35686ca71ba7137c9
and
PGP Signature
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBF87cLUBEAC9LI5h18uHyUyZRp7JuVepN5qmtHps3HCXeNK01g64zPmsnB5K
baOB5RDPvoAGPv5B29sObbfsqXlkwwEcuKLozVTUwh5+UJgOxHfED2X7cU3jObjt
RcGuxmzWPeuESkCDmk+UTZeRaArFP5szY2TUwbK77fGyXDWw18bIx/0a+bK0Pxnw
01ZoFk8FZ26hDQKb/6Fo6hvzU2R1pCFChT3rcw19g8Oe5W3hWwhFTovU0SGcXt1p
HmAjncQ0ZhtrNACWMsyBO+a7yiyYile/8Pm6OLqK8auJnGWZEmnr2T7pZlP/zLvY
gtCipXoZMICawxng0sAOGiWdN5FzAJiGPO3bph7AXO13LAWzBQrEV//hw7/BhQ9U
20eN19UfXtiUAimC9oPj3xcGvjkpq33FYOoPL2vCddZzDOuOJhFAiFb8f9jGdNnl
/7W2htAfxhEc7EXJ7n2jU9/fGg39+7VBZK8dBcJD6VRq5/s0kf93+xoX7PJt4uYT
lkMvyyT+zjiqvsSb1Jzgv/ZsIdotenOMOoX0KGeqIcmMRSBnYaKvhx0oLqx7sk8T
s6yV7c+Kb8pYqyBVNDOWGEPTz4YwJrFgbc5kQoFzhERKS6t3WuLiV4Kh06K0/jRW
LCspIwnFJsc+WzcLAQuVSBlubw7/N3mYAhGCljV3pp1BG+s36Wd/wkJ36QARAQAB
tCRDcnlwdG9ib3QgPHJlbGVhc2VzQGNyeXB0b21hdG9yLm9yZz6JAlQEEwEIAD4W
IQRYEXr6H4Wz7sFUZ31hXUSf5uaiNQUCXztwtQIbAwUJE4HyAAULCQgHAgYVCgkI
CwIEFgIDAQIeAQIXgAAKCRBhXUSf5uaiNQ4hEAC1YXMgdXvCDVGsaWty0TKxCMi0
+JC+4UntjT74agNXpx/YfRUadtYS1goWanwP9QW8BY8skrpf+0zZGnb4ln5eb60a
tcLsuu94ttRL2e6/9kI5iKkeFB7Y9i9W/bFldYJBmjb9SEIbiw/gFdFCj9AELsJY
zjhKgNMv6MbmF2yBN+qVV+8ztbj/rMAlmrcKGeTTOoXkIYRS1Cu/BFthTin4S+o9
EdPbw1+MJqsPu/ZKI74BpXowLY3OwzTlL0nEbbSFq57C/AoXtt4Gun19HUZxDdXC
Q4C/SIXA0YxovDJZTPjsSg6gi+VHZbPztMJh+zniVtLdX63DUvHqtdZpOGY4AJ9b
0zBwnjCHDQeBP7kynrNGVTTVQkBrnsBkcqucBXIgyAkRhLYUtuYShxIJhVk/mjpn
PkZuidnKqtzlmMY2S4djYj8DAS2dLTSvRD8+6gN44KZic4mJfo5QJUIw8U65Hizj
R6SFiaCthM5sdNsIw+r5u7qy4uTRT7s5mP7lC7JNKBMPxwiVdS0Lzbq4pJEiWgAG
7bFnHK8ZEH9DuIHWylrWcP9er9jzHxAG2equgCyh2xvS0FeIsQTN8YQzhOFNupcB
DzD6U01G/CV5VcbzSJ3AOJxGKz1WR0+sSEy8/7a4fDcN1zxtYVEpOZQm4/D7WYgj
oEszsZd0nLnY4+p43IkCMwQQAQgAHRYhBMvCRgt7uPnmVPXdvGZ7hm6oJAoJBQJf
O3DiAAoJEGZ7hm6oJAoJXocQAKYVqQz/Q5xot9pUIZRBmfRGHZbvxLztSV0d2MtL
y/TR8cxSleJ0ruc5hXzMQpBTKIzCGa4+eEkupPC3a0Vm687Bzon60EW3Uh56EfQs
S11STg03VBdFPfG5wdYxZI+pDrwXtHqm8XazqryWfg4xu3YxsTddPaB9M7Zwgod1
HoYpe65tRiWnXF+2y2iz9u0Ggh4bTbNp/NmW9L0Mm8wXySqJWs1G7JpKGnrXtrPM
zgzXmSQo2f4ToXJ4oncLWPXKfnNHiIxSGGonizRaOzsVhQJveEn3a0wqS6ERU1KR
d2ruwlXSqBgQKGZmo7cP+jzXOqDvNb3P+2U6kn+HnYZcd1F5CcoyzfdvkWOWi7Hl
PVRKIUnqcnu3c4J6Sh695I5/Jua5mA4cA8mB9yQyY+Q1UmuyyyoR4g23+FdnuLR3
Xbf7oMSRiXYty3I7W2oKqrZzS4OMZjWh/+goiW6YKKSQDoq6xlw6aWzeEnBnyJTH
Aq9QAsq403MsEMSUVZIhZ0cz3xLkNrtx4HyMvVFrdwleYEVVu8I+t4lkOuubBzBm
Cb5ZsFT7vHjutVw6o/2tMdZ11BS/cRB9dTcEeIpDH87CzWwM1irXIWJuFztElJyW
9ZqkQwUeuxQItSUBFg1negK16d5TfuA8pkw2lDmK3S+fwSQQWKggdPycGEOIkWSM
Ylv9
=MfOo
-----END PGP PUBLIC KEY BLOCK-----
which appears to be different than the contents of the .asc file I downloaded,
as well as
Fingerprint: 58117AFA1F85B3EEC154677D615D449FE6E6A235
I installed GnuPG on my Mac and ran:
gpg --verify Cryptomator-1.5.8.dmg.asc Cryptomator-1.5.8.dmg
gpg: Signature made Mon Aug 31 08:13:07 2020 EDT
gpg: using RSA key 615D449FE6E6A235
gpg: Can’t check signature: No public key
So I tried:
$ gpg --receive-keys 615D449FE6E6A235
gpg: key 615D449FE6E6A235: public key "Cryptobot <releases@cryptomator.org>" imported
gpg: Total number processed: 1
gpg: imported: 1
$ gpg --verify Cryptomator-1.5.8.dmg.asc Cryptomator-1.5.8.dmg
gpg: Signature made Mon Aug 31 08:13:07 2020 EDT
gpg: using RSA key 615D449FE6E6A235
gpg: checking the trustdb
gpg: marginals needed: 3 completes needed: 1 trust model: pgp
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: Good signature from "Cryptobot <releases@cryptomator.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 5811 7AFA 1F85 B3EE C154 677D 615D 449F E6E6 A235
which appears to present an issue.
What am I doing wrong, if at all?
Thank you!