Four Mirrors, One Real Release: Verify the Signature

A vendor release was pulled from four mirrors into /root/downloads/, one directory per mirror. Each mirror serves the same four files: the tarball, a SHA256SUMS manifest, a detached signature over that manifest (SHA256SUMS.sig), and a signing-key.gpg it says is the vendor's key. Only one of these copies is what the vendor actually published.

The vendor's real public key reached you out of band, with the support contract: it is /root/case/vendor-keyring.gpg, and /root/case/brief.txt prints its fingerprint. The product, the mirrors and the keys differ per session. This box has gpgv, GnuPG's verify-only tool; gpg itself is not installed.

1. Write the name of the mirror whose copy is genuine to /root/case/genuine.txt. Genuine means both checks pass: the manifest's signature is good under the vendor's key, and the tarball matches the manifest.

2. Some copies would pass a checksum-only check (sha256sum -c prints OK) even though their manifest was not signed by the vendor. Write those mirrors' names to /root/case/hash-only.txt, one per line.

3. Get every copy that is not genuine out of /root/downloads, either by deleting it or by moving it to /root/quarantine/. Leave the genuine mirror's files where they are.

The checks read your two answer files and the files left in /root/downloads, so any method that reaches the right end state passes.