Bugzilla – Bug 14783
Subject: [SM-Discuss] python gpg check
Last modified: 2008-10-05 10:35:35 UTC
From: Treeve Jelbert <treeve@scarlet.be> Organization: Knowhow scrl To: sm-discuss@lists.ibiblio.org Date: Sat, 4 Oct 2008 09:55:19 +0200 User-Agent: KMail/1.10.1 (Linux/2.6.26; KDE/4.1.2; i686; ; ) Subject: [SM-Discuss] python gpg check Preparing python GPG checking source file Python-2.6.tar.bz2... gpg: armor header: Version: GnuPG v1.4.6 (GNU/Linux) gpg: Signature made Thu Oct 2 19:05:34 2008 CEST using DSA key ID EA5BBD71 gpg: BAD signature from "Barry A. Warsaw <barry@warsaw.us>" gpg: binary signature, digest algorithm SHA1 Failure to verify gpg signature -- Regards, Treeve _______________________________________________ SM-Discuss mailing list SM-Discuss@lists.ibiblio.org http://lists.ibiblio.org/mailman/listinfo/sm-discuss
Can't reproduce. Used downloaded sources (right after the commit of 2.6 to the grimoires) and re-downloaded ones. gpg: armor header: Version: GnuPG v1.4.6 (GNU/Linux) gpg: assuming signed data in `Python-2.6.tar.bz2' gpg: Signature made Thu 02 Oct 2008 01:05:34 PM AST using DSA key ID EA5BBD71 gpg: Good signature from "Barry A. Warsaw <barry@warsaw.us>" gpg: aka "Barry A. Warsaw <barry@wooz.org>" gpg: aka "Barry A. Warsaw <barry@python.org>" gpg: aka "Barry A. Warsaw <barry@canonical.com>" gpg: aka "Barry Warsaw (GNU Mailman) <barry@list.org>" gpg: aka "Barry A. Warsaw <barry.warsaw@canonical.com>" gpg: binary signature, digest algorithm SHA1
its ok for me root@sourcemage-chroot:/var/lib/sorcery/codex/grimoire# delve PRE_BUILD python DEBUG: PRE_BUILD Running state PRE_BUILD Building python GPG checking source file Python-2.6.tar.bz2... Algorithm used: sha1 Allowing new hashsha1 Checking spell level UPSTREAM_KEY Spell level is a new allowed level gpg signature verified! Unpacking source file Python-2.6.tar.bz2 for spell python. root@sourcemage-chroot:/var/lib/sorcery/codex/grimoire# sha512sum /var/spool/sorcery/Python-2.6.tar.bz2* 2e2ebddbcf3477e3447e07c7f38561a3a615c1f837d9b2174e54083822273c198c4c4801041d612e68546277d8e84c79392394a1f30895cba2ac489883eab7db /var/spool/sorcery/Python-2.6.tar.bz2 6425374572dc120fec26f4a6b28f19ecc1b6f879f5261e1336b1aab2ba89335c519f67ac2b9654ed1dad56ad6fe22a4bdb43d808353230ff2a61144bc0780b09 /var/spool/sorcery/Python-2.6.tar.bz2.asc this is with git grimoire branch master at df133bfd019fbbd32eb4542c8d7f28165c16fbe3
In that case it seems to be a problem with my gpg setup? treeve@Gemini-32:~/smgl/git/grimoire/devel/python$ gpg --verify --keyring ./python.gpg /var/spool/sorcery/Python-2.6.tar.bz2.asc gpg: armor header: Version: GnuPG v1.4.6 (GNU/Linux) gpg: assuming signed data in `/var/spool/sorcery/Python-2.6.tar.bz2' gpg: Signature made Thu 02 Oct 2008 19:05:34 CEST using DSA key ID EA5BBD71 gpg: using PGP trust model gpg: BAD signature from "Barry A. Warsaw <barry@warsaw.us>" gpg: binary signature, digest algorithm SHA1
I fetched the python tarball again, and now the gpg is ok $ gpg --verify --keyring ./python.gpg /var/spool/sorcery/Python-2.6.tar.bz2.asc gpg: armor header: Version: GnuPG v1.4.6 (GNU/Linux) gpg: assuming signed data in `/var/spool/sorcery/Python-2.6.tar.bz2' gpg: Signature made Thu 02 Oct 2008 19:05:34 CEST using DSA key ID EA5BBD71 gpg: using PGP trust model gpg: Good signature from "Barry A. Warsaw <barry@warsaw.us>" gpg: aka "Barry A. Warsaw <barry@wooz.org>" gpg: aka "Barry A. Warsaw <barry@python.org>" gpg: aka "Barry A. Warsaw <barry@canonical.com>" gpg: aka "Barry Warsaw (GNU Mailman) <barry@list.org>" gpg: aka "Barry A. Warsaw <barry.warsaw@canonical.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: DBBF 2EEB F925 FAAD CF1F 3FFF D986 6941 EA5B BD71 gpg: binary signature, digest algorithm SHA1