Page 1 of 1
Source file won't verify: why?
Posted: Fri Dec 23, 2011 9:13 pm
by wrathpod
[IRCdDIR@fraction ~ 15:52:58]$ wget
http://www.unrealircd.com/downloads/Unreal3.2.9.tar.gz
--2011-12-23 15:53:08--
http://www.unrealircd.com/downloads/Unreal3.2.9.tar.gz
Resolving
http://www.unrealircd.com... 80.69.83.213
Connecting to http://www.unrealircd.com|80.69.83.213|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3064571 (2.9M) [application/x-gzip]
Saving to: `Unreal3.2.9.tar.gz'
100%[=======================================================================================================================================>] 3,064,571 494K/s in 6.5s
2011-12-23 15:53:15 (464 KB/s) - `Unreal3.2.9.tar.gz' saved [3064571/3064571]
[IRCdDIR@fraction ~ 15:53:18]$ gpg --keyserver keys.gnupg.net --recv-keys 0x9FF03937
gpg: requesting key 9FF03937 from hkp server keys.gnupg.net
gpg: key 9FF03937: "UnrealIRCd Distribution Verification Key (for verification of software downloads only!) <
[email protected]>" not changed
gpg: Total number processed: 1
gpg: unchanged: 1
[IRCdDIR@fraction ~ 15:53:43]$ gpg --verify Unreal3.2.9.tar.gz.asc Unreal3.2.9.tar.gz
gpg: can't open `Unreal3.2.9.tar.gz.asc'
gpg: verify signatures failed: file open error
Re: Source file won't verify: why?
Posted: Fri Dec 23, 2011 11:16 pm
by katsklaw
Confirmed, I get the same error.
Alternately, you can verify with md5. The sums are on the download page. or
http://www.unrealircd.com/downloads/checksums
[katsklaw@freebsd ~]$ md5 Unreal3.2.9.tar.gz
MD5 (Unreal3.2.9.tar.gz) = bde023695347969f545ce5f2a9ac9aed
Re: Source file won't verify: why?
Posted: Sat Dec 24, 2011 12:55 am
by wrathpod
katsklaw wrote:Confirmed, I get the same error.
Alternately, you can verify with md5. The sums are on the download page. or
http://www.unrealircd.com/downloads/checksums
[katsklaw@freebsd ~]$ md5 Unreal3.2.9.tar.gz
MD5 (Unreal3.2.9.tar.gz) = bde023695347969f545ce5f2a9ac9aed
Yeah, I get the same string. Obviously the source file is unaltered. But you'd think someone would have complained about this before and as a result it would have been fixed by now. File authenticity is pretty important these days :>
Thanks much
Re: Source file won't verify: why?
Posted: Sat Dec 24, 2011 1:37 am
by katsklaw
Actually I think it's more of the fact that most people blindly download files. Some people, like myself, just use ol' trusty checksums ;P I'm not opposed to new technology, just sometimes "Old School" is best
Glad I could help
Re: Source file won't verify: why?
Posted: Sat Dec 24, 2011 12:50 pm
by Jobe
Did you remember to download the .asc file too? The reason I ask is because the signature successfully verifies for me (note: I had already imported and signed the key):
Code: Select all
[jobe@alpha ~/working]$ wget http://www.unrealircd.com/downloads/Unreal3.2.9.tar.gz
--2011-12-24 12:46:44-- http://www.unrealircd.com/downloads/Unreal3.2.9.tar.gz
Resolving http://www.unrealircd.com... 80.69.83.213
Connecting to http://www.unrealircd.com|80.69.83.213|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3064571 (2.9M) [application/x-gzip]
Saving to: `Unreal3.2.9.tar.gz'
100%[=====================================================================================================>] 3,064,571 1.12M/s in 2.6s
2011-12-24 12:46:46 (1.12 MB/s) - `Unreal3.2.9.tar.gz' saved [3064571/3064571]
[jobe@alpha ~/working]$ wget http://www.unrealircd.com/downloads/Unreal3.2.9.tar.gz.asc
--2011-12-24 12:46:50-- http://www.unrealircd.com/downloads/Unreal3.2.9.tar.gz.asc
Resolving http://www.unrealircd.com... 80.69.83.213
Connecting to http://www.unrealircd.com|80.69.83.213|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 194 [text/plain]
Saving to: `Unreal3.2.9.tar.gz.asc'
100%[=====================================================================================================>] 194 --.-K/s in 0s
2011-12-24 12:46:50 (5.02 MB/s) - `Unreal3.2.9.tar.gz.asc' saved [194/194]
[jobe@alpha ~/working]$ gpg --verify Unreal3.2.9.tar.gz.asc
gpg: Signature made Sat 5 Nov 09:29:13 2011 GMT using DSA key ID 9FF03937
gpg: Good signature from "UnrealIRCd Distribution Verification Key (for verification of software downloads only!) <[email protected]>"
Re: Source file won't verify: why?
Posted: Sat Dec 24, 2011 5:00 pm
by Syzop
Indeed, you need to download the corresponding .asc file, hence the 'file open error' if you don't have it.
I've rephrased the instructions on the download page, hope it's more clear now
If, in the future you find a mismatch or verification error, then please send an email (
[email protected]) or file a bugreport. Preferably ASAP.
Unfortunately one can no longer assume that 'it's probably ok' these days ;/
When I replace a file for any reason (such as a fixed release), then I'll always re-sign and re-publish the .asc file, so verification should always succeed.