Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

gpg --verify is giving me a bad signatures more often than I'd expect. Just this week, two libraries have given me "BAD signature" warnings - Libsodium and chruby. I followed all the instructions on the chruby README and yet still I get a bad signature warning.

Are there some things I should check about my installation? Any help is much appreciated.

$ gpg --version
gpg (GnuPG/MacGPG2) 2.0.17
libgcrypt 1.4.6

Mac OSX 10.6.6

$ gpg --verify libsodium-0.2.tar.gz.sig
gpg: Signature made Tue 29 Jan 05:47:53 2013 GMT using DSA key ID 1CDEA439
gpg: BAD signature from "Jedi/Sector One <>"

The chruby problem was fixed by using a different download method, the verification failed with a cURL download but using the Github website's links the file I downloaded worked. Tried the same with libsodium and it still fails, so maybe it's just libsodium's file?

share|improve this question
Please add the exact warning you're getting. – Jens Erat Feb 21 '13 at 11:28
@JensErat done. – Iain Feb 21 '13 at 11:32
Fetching both files using wget and then verifying the signature worked fine for me. I'm using the exactly same version of gpg. Try again using wget: wget; wget; gpg --verify libsodium-0.2.tar.gz.sig. md5 hashes of these files: 621890d23a09049b6f54a720e082b642 for the tarball and 496c2f7d883b342b324b6d7da0e27681 for the signature. – Jens Erat Feb 21 '13 at 11:41
@JensErat I had to install wget, and once I did, it worked. Verifying files downloaded via Safari, Chrome and cURL gives the warning - very strange! Thanks for the help, it's much appreciated. If you'd like to post your comment as an answer I'll accept it. – Iain Feb 21 '13 at 12:20
Somehow the other clients seem to have fiddled somehow with the files, probably the tarball. You could try to use diff to trace that if you're interested. How did you invoke curl? – Jens Erat Feb 21 '13 at 12:28
up vote 0 down vote accepted

It works for me (same version of GnuPG). Probably your HTTP client somehow fiddled with the files. Try using wget which I used.

gpg --verify libsodium-0.2.tar.gz.sig
share|improve this answer
I haven't ever seen HTTP clients fiddling with files (other than translating Unix to Windows text line endings). Perhaps a compromised server? Re-check, please. And it would be interesting to compare the tampered file with the pristine one to find out what happened, please offer help to upstream in this. – vonbrand Feb 21 '13 at 13:31
Translating line endings is enough fiddling for breaking checksums. That why I asked for diffing it in a comment above. Opening the signature file with some text editor could (but probably shouldn't) have the same effect. – Jens Erat Feb 21 '13 at 13:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .