Source file won't verify: why?

[wrathpod]

[IRCdDIR@fraction ~ 15:52:58]$ wget http://www.unrealircd.com/downloads/Unreal3.2.9.tar.gz
--2011-12-23 15:53:08-- http://www.unrealircd.com/downloads/Unreal3.2.9.tar.gz
Resolving http://www.unrealircd.com... 80.69.83.213
Connecting to http://www.unrealircd.com|80.69.83.213|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3064571 (2.9M) [application/x-gzip]
Saving to: `Unreal3.2.9.tar.gz'

100%[=======================================================================================================================================>] 3,064,571 494K/s in 6.5s

2011-12-23 15:53:15 (464 KB/s) - `Unreal3.2.9.tar.gz' saved [3064571/3064571]
[IRCdDIR@fraction ~ 15:53:18]$ gpg --keyserver keys.gnupg.net --recv-keys 0x9FF03937
gpg: requesting key 9FF03937 from hkp server keys.gnupg.net
gpg: key 9FF03937: "UnrealIRCd Distribution Verification Key (for verification of software downloads only!) <[email protected]>" not changed
gpg: Total number processed: 1
gpg: unchanged: 1
[IRCdDIR@fraction ~ 15:53:43]$ gpg --verify Unreal3.2.9.tar.gz.asc Unreal3.2.9.tar.gz
gpg: can't open `Unreal3.2.9.tar.gz.asc'
gpg: verify signatures failed: file open error

[katsklaw]

Confirmed, I get the same error.

Alternately, you can verify with md5. The sums are on the download page. or http://www.unrealircd.com/downloads/checksums

[katsklaw@freebsd ~]$ md5 Unreal3.2.9.tar.gz
MD5 (Unreal3.2.9.tar.gz) = bde023695347969f545ce5f2a9ac9aed

[wrathpod]

Confirmed, I get the same error.

Alternately, you can verify with md5. The sums are on the download page. or http://www.unrealircd.com/downloads/checksums

[katsklaw@freebsd ~]$ md5 Unreal3.2.9.tar.gz
MD5 (Unreal3.2.9.tar.gz) = bde023695347969f545ce5f2a9ac9aed

Yeah, I get the same string. Obviously the source file is unaltered. But you'd think someone would have complained about this before and as a result it would have been fixed by now. File authenticity is pretty important these days :>

Thanks much

[katsklaw]

Actually I think it's more of the fact that most people blindly download files. Some people, like myself, just use ol' trusty checksums ;P I'm not opposed to new technology, just sometimes "Old School" is best

Glad I could help

[Jobe]

Did you remember to download the .asc file too? The reason I ask is because the signature successfully verifies for me (note: I had already imported and signed the key):

Code: Select all

[jobe@alpha ~/working]$  wget http://www.unrealircd.com/downloads/Unreal3.2.9.tar.gz
--2011-12-24 12:46:44--  http://www.unrealircd.com/downloads/Unreal3.2.9.tar.gz
Resolving http://www.unrealircd.com... 80.69.83.213
Connecting to http://www.unrealircd.com|80.69.83.213|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3064571 (2.9M) [application/x-gzip]
Saving to: `Unreal3.2.9.tar.gz'

100%[=====================================================================================================>] 3,064,571   1.12M/s   in 2.6s

2011-12-24 12:46:46 (1.12 MB/s) - `Unreal3.2.9.tar.gz' saved [3064571/3064571]

[jobe@alpha ~/working]$  wget http://www.unrealircd.com/downloads/Unreal3.2.9.tar.gz.asc
--2011-12-24 12:46:50--  http://www.unrealircd.com/downloads/Unreal3.2.9.tar.gz.asc
Resolving http://www.unrealircd.com... 80.69.83.213
Connecting to http://www.unrealircd.com|80.69.83.213|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 194 [text/plain]
Saving to: `Unreal3.2.9.tar.gz.asc'

100%[=====================================================================================================>] 194         --.-K/s   in 0s

2011-12-24 12:46:50 (5.02 MB/s) - `Unreal3.2.9.tar.gz.asc' saved [194/194]

[jobe@alpha ~/working]$ gpg --verify Unreal3.2.9.tar.gz.asc
gpg: Signature made Sat  5 Nov 09:29:13 2011 GMT using DSA key ID 9FF03937
gpg: Good signature from "UnrealIRCd Distribution Verification Key (for verification of software downloads only!) <[email protected]>"

[Syzop]

Indeed, you need to download the corresponding .asc file, hence the 'file open error' if you don't have it.
I've rephrased the instructions on the download page, hope it's more clear now

If, in the future you find a mismatch or verification error, then please send an email ([email protected]) or file a bugreport. Preferably ASAP.
Unfortunately one can no longer assume that 'it's probably ok' these days ;/

When I replace a file for any reason (such as a fixed release), then I'll always re-sign and re-publish the .asc file, so verification should always succeed.