A signature leaves the file readable and attaches a proof that it came from a particular key and has not been altered. This set covers making a key, signing with gpg, and telling a good signature from a bad one when the file has changed.
Each one is marked as you go, and the explanation arrives straight after, which is
the part worth reading.
4 questions, marked as you go.
Tasks
These need your own device. Run the command in Termux, then paste what it printed.
The marking looks at what the output means, so spacing, version numbers and
ordering do not matter. If you have not installed anything yet, the
lesson covers the setup.
Sign a file, then verify it before and after a change
This makes a demo key, signs a file, verifies it, then changes the file and verifies again. Watch the two verdicts at the end: one says Good and the other says BAD.
Run this in Termux
On your own device. Nothing on this page executes it. The command runs in
your terminal, and this box only reads what you paste back.
The signature file is written once and never changes. The first verify is against the original file and the second is against a changed copy, so the two verdicts differ.
the untouched file verifies
the changed file fails to verify
the sign and both verifications are shown
the commands actually ran
What a good answer looks like
Several lines from gpg, ending in two verdicts. The first verify is against the file exactly as it was signed, and it prints gpg: Good signature from followed by the name and email you gave the key. The second verify is against a copy whose contents were changed, and it prints gpg: BAD signature from the same name. The signature itself never changed, so the difference comes entirely from the file. If the second verdict were Good, the file would not really have been altered.
Marking your own work
Both halves of this are checked in your browser, with no server involved, so nothing
stops you from pasting output you did not run. The tasks are written so that the
easiest way to pass one is to actually do it and read the result, which is the whole
intention.