2

gpg --verify is giving me a bad signatures more often than I'd expect. Just this week, two libraries have given me "BAD signature" warnings - Libsodium and chruby. I followed all the instructions on the chruby README and yet still I get a bad signature warning.

Are there some things I should check about my installation? Any help is much appreciated.

$ gpg --version
gpg (GnuPG/MacGPG2) 2.0.17
libgcrypt 1.4.6

Mac OSX 10.6.6

$ gpg --verify libsodium-0.2.tar.gz.sig
gpg: Signature made Tue 29 Jan 05:47:53 2013 GMT using DSA key ID 1CDEA439
gpg: BAD signature from "Jedi/Sector One <[email protected]>"

The chruby problem was fixed by using a different download method, the verification failed with a cURL download but using the Github website's links the file I downloaded worked. Tried the same with libsodium and it still fails, so maybe it's just libsodium's file?

Improve this question
8
  • 1
    Please add the exact warning you're getting.
    – Jens Erat
    Feb 21, 2013 at 11:28
  • @JensErat done.
    – ian
    Feb 21, 2013 at 11:32
  • Fetching both files using wget and then verifying the signature worked fine for me. I'm using the exactly same version of gpg. Try again using wget: wget http://download.dnscrypt.org/libsodium/releases/libsodium-0.2.tar.gz; wget http://download.dnscrypt.org/libsodium/releases/libsodium-0.2.tar.gz.sig; gpg --verify libsodium-0.2.tar.gz.sig. md5 hashes of these files: 621890d23a09049b6f54a720e082b642 for the tarball and 496c2f7d883b342b324b6d7da0e27681 for the signature.
    – Jens Erat
    Feb 21, 2013 at 11:41
  • @JensErat I had to install wget, and once I did, it worked. Verifying files downloaded via Safari, Chrome and cURL gives the warning - very strange! Thanks for the help, it's much appreciated. If you'd like to post your comment as an answer I'll accept it.
    – ian
    Feb 21, 2013 at 12:20
  • Somehow the other clients seem to have fiddled somehow with the files, probably the tarball. You could try to use diff to trace that if you're interested. How did you invoke curl?
    – Jens Erat
    Feb 21, 2013 at 12:28

1 Answer 1

Reset to default
4

It works for me (same version of GnuPG). Probably your HTTP client somehow fiddled with the files. Try using wget which I used.

wget http://download.dnscrypt.org/libsodium/releases/libsodium-0.2.tar.gz
wget http://download.dnscrypt.org/libsodium/releases/libsodium-0.2.tar.gz.sig
gpg --verify libsodium-0.2.tar.gz.sig
Improve this answer
3
  • I haven't ever seen HTTP clients fiddling with files (other than translating Unix to Windows text line endings). Perhaps a compromised server? Re-check, please. And it would be interesting to compare the tampered file with the pristine one to find out what happened, please offer help to upstream in this.
    – vonbrand
    Feb 21, 2013 at 13:31
  • 1
    Translating line endings is enough fiddling for breaking checksums. That why I asked for diffing it in a comment above. Opening the signature file with some text editor could (but probably shouldn't) have the same effect.
    – Jens Erat
    Feb 21, 2013 at 13:50
  • 1
    "Probably your HTTP client somehow fiddled with the files" Yep, that happened to me; I used rsync and GPG verification succeeded.
    – Geremia
    Jan 21, 2017 at 3:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .