Verify authenticity

Posts marked "OpenPGP-signed" are signed with my personal OpenPGP key. That lets you prove the text is unchanged and really came from me - no matter which server or mirror you got it from.

What gets signed is the source (the .mdx file), not the HTML rendered in your browser. So you're checking the original text the page is built from.

Three steps

Replace <slug> with the post's filename (the last part of the post URL, e.g. ha-backup-restore-cli). This page is signed too - use verify as the slug to check it against itself:

curl -O https://michael-dickmann.net/pgp/<slug>.mdx
curl -O https://michael-dickmann.net/pgp/<slug>.mdx.asc
gpg --verify <slug>.mdx.asc <slug>.mdx

A Good signature message with my fingerprint means the post is genuine and unchanged.

Importing my key

Download the public key and import it:

curl -O https://michael-dickmann.net/pgp-key.asc
gpg --import pgp-key.asc

Or find it on keys.openpgp.org.

Fingerprint:

ADCF 4805 7790 8904 60DF  8ECB 84BE B27C 77B9 700F

Always compare this fingerprint against the one gpg --verify shows you - that's the only way to be sure it's really my key.