How to handle .sig

[zen0bit]

For example:

Guix GNU Linux #768 comes with qcow2 files which are signed.

.sig files are provided, but not any shsums.

How to check qcow2/ISO files against .sig

[zen0bit]

wget 'https://sv.gnu.org/people/viewgpg.php?user_id=15145' -qO - | gpg --import -
gpg: key 090B11993D9AEBB5: 127 signatures not checked due to missing keys
gpg: /home/zen/.gnupg/trustdb.gpg: trustdb created
gpg: key 090B11993D9AEBB5: public key "Ludovic Courtès [email protected]" imported
gpg: Total number processed: 1
gpg: imported: 1
gpg: no ultimately trusted keys found

gpg --verify guix-system-vm-image-1.4.0.x86_64-linux.qcow2.sig
gpg: assuming signed data in 'guix-system-vm-image-1.4.0.x86_64-linux.qcow2'
gpg: Signature made Sun 18 Dec 2022 10:09:33 PM CET
gpg: using RSA key 3CE464558A84FDC69DB40CFB090B11993D9AEBB5
gpg: Good signature from "Ludovic Courtès [email protected]" [unknown]
gpg: aka "Ludovic Courtès [email protected]" [unknown]
gpg: aka "Ludovic Courtès (Inria) [email protected]" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5