gpg --verify is giving me a bad signatures more often than I'd expect. Just this week, two libraries have given me "BAD signature" warnings - Libsodium and chruby. I followed all the instructions on the chruby README and yet still I get a bad signature warning.

Are there some things I should check about my installation? Any help is much appreciated.

$ gpg --version
gpg (GnuPG/MacGPG2) 2.0.17
libgcrypt 1.4.6

Mac OSX 10.6.6

$ gpg --verify libsodium-0.2.tar.gz.sig
gpg: Signature made Tue 29 Jan 05:47:53 2013 GMT using DSA key ID 1CDEA439
gpg: BAD signature from "Jedi/Sector One <j@pureftpd.org>"

The chruby problem was fixed by using a different download method, the verification failed with a cURL download but using the Github website's links the file I downloaded worked. Tried the same with libsodium and it still fails, so maybe it's just libsodium's file?

  • 1
    Please add the exact warning you're getting. – Jens Erat Feb 21 '13 at 11:28
  • @JensErat done. – Iain Feb 21 '13 at 11:32
  • Fetching both files using wget and then verifying the signature worked fine for me. I'm using the exactly same version of gpg. Try again using wget: wget http://download.dnscrypt.org/libsodium/releases/libsodium-0.2.tar.gz; wget http://download.dnscrypt.org/libsodium/releases/libsodium-0.2.tar.gz.sig; gpg --verify libsodium-0.2.tar.gz.sig. md5 hashes of these files: 621890d23a09049b6f54a720e082b642 for the tarball and 496c2f7d883b342b324b6d7da0e27681 for the signature. – Jens Erat Feb 21 '13 at 11:41
  • @JensErat I had to install wget, and once I did, it worked. Verifying files downloaded via Safari, Chrome and cURL gives the warning - very strange! Thanks for the help, it's much appreciated. If you'd like to post your comment as an answer I'll accept it. – Iain Feb 21 '13 at 12:20
  • Somehow the other clients seem to have fiddled somehow with the files, probably the tarball. You could try to use diff to trace that if you're interested. How did you invoke curl? – Jens Erat Feb 21 '13 at 12:28

It works for me (same version of GnuPG). Probably your HTTP client somehow fiddled with the files. Try using wget which I used.

wget http://download.dnscrypt.org/libsodium/releases/libsodium-0.2.tar.gz
wget http://download.dnscrypt.org/libsodium/releases/libsodium-0.2.tar.gz.sig
gpg --verify libsodium-0.2.tar.gz.sig
  • I haven't ever seen HTTP clients fiddling with files (other than translating Unix to Windows text line endings). Perhaps a compromised server? Re-check, please. And it would be interesting to compare the tampered file with the pristine one to find out what happened, please offer help to upstream in this. – vonbrand Feb 21 '13 at 13:31
  • 1
    Translating line endings is enough fiddling for breaking checksums. That why I asked for diffing it in a comment above. Opening the signature file with some text editor could (but probably shouldn't) have the same effect. – Jens Erat Feb 21 '13 at 13:50
  • 1
    "Probably your HTTP client somehow fiddled with the files" Yep, that happened to me; I used rsync and GPG verification succeeded. – Geremia Jan 21 '17 at 3:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.