title: How do I verify a gpg signature matches a public key file?
body: <p>I know how to use gpg verify like this:</p>
  
  <pre><code>$ gpg --verify somefile.sig
  gpg: Signature made Tue 23 Jul 2013 13:20:02 BST using RSA key ID E1B768A0
  gpg: Good signature from "Richard W.M. Jones &lt;rjones@redhat.com&gt;"
  gpg:                 aka "Richard W.M. Jones &lt;rich@annexia.org&gt;"
  gpg: WARNING: This key is not certified with a trusted signature!
  gpg:          There is no indication that the signature belongs to the owner.
  Primary key fingerprint: F777 4FB1 AD07 4A7E 8C87  67EA 9173 8F73 E1B7 68A0
  </code></pre>
  
  <p>But what I really want to do is to verify the file against a specific public key file.</p>
  
  <p>The motivation is as part of a program that downloads large files from a website and needs to verify they haven't been tampered with before it uses them.  The website will contain the files and the signatures.  The program will ship with the GPG public key.  When I upload the files to the website I will sign them with the corresponding private key (not distributed obviously).  It seems like the program should be able to do something like:</p>
  
  <pre><code>gpg --no-default-keyring --verify file.sig \
      --is-signed-with /usr/share/program/goodkey.asc
  </code></pre>
  
  <p>But <code>gpg</code> has no option like this.  It looks like the only way to do it would be to parse the printed output of the <code>gpg</code> command which seems very unsafe (it contains text controlled by the attacker).</p>
  
  <p>Edit: I don't know what the etiquette is around here for answering ones own questions, but the answer I found was to use the --status-fd flag.  This flag generates nicely parsable output which I can check for the desired fingerprint:</p>
  
  <pre><code>gpg --status-fd &lt;N&gt; --verify file.sig
  </code></pre>
  
  <p>produces on fd N:</p>
  
  <pre><code>[GNUPG:] SIG_ID rpG8ATxU8yZr9SHL+VC/WQbV9ac 2013-07-23 1374582002
  [GNUPG:] GOODSIG 91738F73E1B768A0 Richard W.M. Jones &lt;rjones@redhat.com&gt;
  [GNUPG:] VALIDSIG F7774FB1AD074A7E8C8767EA91738F73E1B768A0 2013-07-23 1374582002 0 4 0 1 2 00 F7774FB1AD074A7E8C8767EA91738F73E1B768A0
  [GNUPG:] TRUST_UNDEFINED
  </code></pre>
  
  <p>This is how, for example, perl's GnuPG library works.</p>