Chapter 2 Installing and Upgrading MySQL

2.1.4.2 Signature Checking Using GnuPG使用GnuPG进行签名检查

~~Another method of verifying the integrity and authenticity of a package is to use cryptographic signatures. This is more reliable than using MD5 checksums, but requires more work.~~另一种验证包的完整性和真实性的方法是使用加密签名。这比使用MD5校验和更可靠，但需要更多的工作。

~~We sign MySQL downloadable packages with GnuPG (GNU Privacy Guard).~~ 我们使用GnuPG（GNU Privacy Guard)签署MySQL可下载包。GnuPG ~~is an Open Source alternative to the well-known Pretty Good Privacy (PGP) by Phil Zimmermann.~~ 是Phil Zimmermann著名的Pretty Good Privacy（PGP)的开源替代方案。~~Most Linux distributions ship with GnuPG installed by default.~~ 大多数Linux发行版默认安装GnuPG。~~Otherwise, see http://www.gnupg.org/ for more information about GnuPG and how to obtain and install it.~~否则，请参阅http://www.gnupg.org/以了解有关GnuPG以及如何获取和安装它的更多信息。

~~To verify the signature for a specific package, you first need to obtain a copy of our public GPG build key, which you can download from http://pgp.mit.edu/.~~ 要验证特定包的签名，您首先需要获得公共GPG构建密钥的副本，您可以从http://pgp.mit.edu/下载到。~~The key that you want to obtain is named mysql-build@oss.oracle.com.~~ 您要获得的密钥名为mysql-build@oss.oracle.com。~~Alternatively, you can copy and paste the key directly from the following text:~~或者，您可以直接从以下文本中复制并粘贴密钥：

~~To import the build key into your personal public GPG keyring, use gpg --import.~~ 要将构建密钥导入到您的个人公共GPG密钥环中，请使用gpg --import。~~For example, if you have saved the key in a file named mysql_pubkey.asc, the import command looks like this:~~例如，如果已将密钥保存在名为mysql_pubkey.asc的文件中，则import命令如下所示：

shell> gpg --import mysql_pubkey.asc
gpg: key 5072E1F5: public key "MySQL Release Engineering
<mysql-build@oss.oracle.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no ultimately trusted keys found

~~You can also download the key from the public keyserver using the public key id, 5072E1F5:~~您也可以使用公钥id 5072E1F5从公钥服务器下载密钥：

shell> gpg --recv-keys 5072E1F5
gpg: requesting key 5072E1F5 from hkp server keys.gnupg.net
gpg: key 5072E1F5: "MySQL Release Engineering <mysql-build@oss.oracle.com>"
1 new user ID
gpg: key 5072E1F5: "MySQL Release Engineering <mysql-build@oss.oracle.com>"
53 new signatures
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:           new user IDs: 1
gpg:         new signatures: 53

~~If you want to import the key into your RPM configuration to validate RPM install packages, you should be able to import the key directly:~~如果您想将密钥导入到您的RPM配置中以验证RPM安装包，您应该能够直接导入密钥：

shell> rpm --import mysql_pubkey.asc

~~If you experience problems or require RPM specific information, see Section 2.1.4.4, “Signature Checking Using RPM”.~~如果您遇到问题或需要RPM特定信息，请参阅第2.1.4.4节，“使用RPM进行签名检查”。

~~After you have downloaded and imported the public build key, download your desired MySQL package and the corresponding signature, which also is available from the download page.~~ 下载并导入公共构建密钥后，下载所需的MySQL包和相应的签名，也可以从下载页面获得。~~The signature file has the same name as the distribution file with an .asc extension, as shown by the examples in the following table.~~签名文件与扩展名为.asc的分发文件具有相同的名称，如下表中的示例所示。

Table 2.1 ~~MySQL Package and Signature Files for Source files~~MySQL包和源文件的签名文件

File Type	File Name
Distribution file	`mysql-standard-8.0.25-linux-i686.tar.gz`
Signature file	`mysql-standard-8.0.25-linux-i686.tar.gz.asc`

~~Make sure that both files are stored in the same directory and then run the following command to verify the signature for the distribution file:~~确保两个文件都存储在同一目录中，然后运行以下命令验证分发文件的签名：

shell> gpg --verify package_name.asc

~~If the downloaded package is valid, you should see a Good signature message similar to this:~~如果下载的软件包有效，您应该会看到类似于以下内容的Good signature消息：

shell> gpg --verify mysql-standard-8.0.25-linux-i686.tar.gz.asc
gpg: Signature made Tue 01 Feb 2011 02:38:30 AM CST using DSA key ID 5072E1F5
gpg: Good signature from "MySQL Release Engineering <mysql-build@oss.oracle.com>"

~~The Good signature message indicates that the file signature is valid, when compared to the signature listed on our site.~~ Good signature消息表明，与我们网站上列出的签名相比，文件签名是有效的。~~But you might also see warnings, like so:~~但你也可能会看到警告，比如：

shell> gpg --verify mysql-standard-8.0.25-linux-i686.tar.gz.asc
gpg: Signature made Wed 23 Jan 2013 02:25:45 AM PST using DSA key ID 5072E1F5
gpg: checking the trustdb
gpg: no ultimately trusted keys found
gpg: Good signature from "MySQL Release Engineering <mysql-build@oss.oracle.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: A4A9 4068 76FC BD3C 4567  70C8 8C71 8D3B 5072 E1F5

~~That is normal, as they depend on your setup and configuration. Here are explanations for these warnings:~~这很正常，因为它们取决于您的设置和配置。以下是对这些警告的解释：

gpg~~: no ultimately trusted keys found~~：未找到最终受信任的密钥~~: This means that the specific key is not "ultimately trusted" by you or your web of trust, which is okay for the purposes of verifying file signatures.~~：这意味着特定密钥不受您或您的信任网络的“最终信任”，这对于验证文件签名来说是可以的。
~~WARNING: This key is not certified with a trusted signature! There is no indication that the signature belongs to the owner.~~警告：此密钥未使用可信签名进行认证！没有迹象表明签名属于所有者。~~: This refers to your level of trust in your belief that you possess our real public key.~~ ：这是指您对自己拥有我们真正公钥的信任程度。~~This is a personal decision.~~ 这是个人的决定。~~Ideally, a MySQL developer would hand you the key in person, but more commonly, you downloaded it. Was the download tampered with?~~ 理想情况下，MySQL开发人员会亲自把密钥交给你，但更常见的是，你下载了它。下载被篡改了吗？~~Probably not, but this decision is up to you. Setting up a web of trust is one method for trusting them.~~也许不会，但这个决定取决于你。建立信任网是信任他们的一种方法。

~~See the GPG documentation for more information on how to work with public keys.~~有关如何使用公钥的更多信息，请参阅GPG文档。