安装wget:如何验证wget源代码未被更改？

Question

我无法找到md5或沙-1代码来验证wget在http://www.gnu.org/software/wget/上的下载。在.sig下载旁边有一个http://ftp.gnu.org/gnu/wget/文件

...
wget-1.16.tar.gz
wget-1.16.tar.gz.sig
...

所以我下载了这两个文件，但是我不能打开.sig文件。

为了使用.sig文件验证wget的源代码下载，我安装了GPGSuite (对于MacOSX10.10.2)，然后我安装了：

$ gpg ~/Downloads/wget-1.16.tar.gz.sig 
gpg: assuming signed data in '/Users/7stud/Downloads/wget-1.16.tar.gz'
gpg: Signature made Mon Oct 27 03:04:05 2014 MDT using RSA key ID E163E1EA
gpg: requesting key E163E1EA from hkps server hkps.pool.sks-keyservers.net
gpg: key E163E1EA: public key "Giuseppe Scrivano <giuseppe@scrivano.org>" imported
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   2  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 2u
gpg: next trustdb check due at 2018-08-19
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)
gpg: Good signature from "Giuseppe Scrivano <giuseppe@scrivano.org>" [unknown]
gpg:                 aka "Giuseppe Scrivano <gscrivano@gnu.org>" [unknown]
gpg:                 aka "Giuseppe Scrivano <gscrivan@redhat.com>" [unknown]
gpg:                 aka "Giuseppe Scrivano <gscrivano@gmail.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: AC40 4C1C 0BF7 35C6 3FF4  D562 263D 6DF2 E163 E1EA

但是这个警告让我觉得我没有证实任何事情。

不是有md5或沙-1代码某处吗？

回复评论：

~/Downloads$ gpg --verify wget-1.16.tar.gz.sig wget-1.16.tar.gz
gpg: Signature made Mon Oct 27 03:04:05 2014 MDT using RSA key ID E163E1EA
gpg: Good signature from "Giuseppe Scrivano <giuseppe@scrivano.org>" [unknown]
gpg:                 aka "Giuseppe Scrivano <gscrivano@gnu.org>" [unknown]
gpg:                 aka "Giuseppe Scrivano <gscrivan@redhat.com>" [unknown]
gpg:                 aka "Giuseppe Scrivano <gscrivano@gmail.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: AC40 4C1C 0BF7 35C6 3FF4  D562 263D 6DF2 E163 E1EA

Answer 1

我在这里发布了我的GPG密钥：http://pgp.mit.edu/pks/lookup?op=vindex&search=0x263D6DF2E163E1EA

遗憾的是，它还没有很多签名，因为我更改了多年来用于签名的旧签名(1024位)：http://pgp.mit.edu/pks/lookup?op=vindex&search=0x0791AF8CC03363F4