I understand that the detached signature is generated by the signer's private key and that you use the signer's public key to verify the downloaded file.
e.g.
gpg --verify package_name.asc
The signature is verified by using the signer's public key, but how does gpg know that the signature belongs to the package downloaded? Am I missing something?
gpg will automatically verify detached signatures against the same file name, without .asc or .sig enxtension. From man gpg:
--verify
Assume that the first argument is a signed file or a detached signature and
verify it without generating any output. With no arguments, the signature
packet is read from STDIN. If only a sigfile is given, it may be a complete
signature or a detached signature, in which case the signed stuff is expected
in a file without the ".sig" or ".asc" extension. With more than 1 argument,
the first should be a detached signature and the remaining files are the
signed stuff. To read the signed stuff from STDIN, use '-' as the second
filename. For security reasons a detached signature cannot read the signed
material from STDIN without denoting it in the above way.
Thus, gpg --verify package_name.asc expects the signed file to be available as package_name. If it isn't (or at another location), also give the path to this file:
gpg --verify detached_siganture.asc signed_file
OpenPGP does not expect the file name (or any other identifier) to be stored in the signature. But: the signature is the hash sum of the signed file, encrypted with the signer's private key, so it can be decrypted with his public key. If the decrypted hash sum does not match the one of the file used to verify against, you know the file isn't the same that was signed (but cannot tell whether it is the wrong file because of selecting the wrong, or it was tampered).
