You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@netbeans.apache.org by Ernie Rael <er...@raelity.com> on 2023/01/11 02:37:44 UTC

nb16 source verification

Just downloaded source from https://netbeans.apache.org/download/nb16/

I'm getting verification failures with both sha and gpg.

I have to figure it out every time, could be cockpit error; but this 
seems like a real failure.

-ernie


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists

Re: nb16 source verification

Posted by Ernie Rael <er...@raelity.com>.
On 23/01/10 11:26 PM, Svata Dedic wrote:
> Hi,
>
> downloaded right now - SHA512 seems correct

Thanks for checking.

> (did you checked by sha512, not sha1 :) ?)

Even better than that (probably 'cause I couldn't find sha1), on the 
main download page I did right context on netbeans-16-source.zip "Save 
Link As..." and then after my first attempt to verify failed, /*instead 
of examining*//*the downloaded "zip" file*/ I tried the other 
verification technique which also failed.

-ernie

> , and even the GPG signature is OK - but Neil's signing key expired 
> just today (signed on 21. Nov 2022)
>
> Maybe the release should be signed next time by a key which is at 
> least 6 months before expiration or something like that, so it 
> survives to the next release.
>
> -S.
>
> On 11. 01. 23 3:37, Ernie Rael wrote:
>> Just downloaded source from https://netbeans.apache.org/download/nb16/
>>
>> I'm getting verification failures with both sha and gpg.
>>
>> I have to figure it out every time, could be cockpit error; but this 
>> seems like a real failure.
>>
>> -ernie
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
>> For additional commands, e-mail: dev-help@netbeans.apache.org
>>
>> For further information about the NetBeans mailing lists, visit:
>> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>>
>>
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
> For additional commands, e-mail: dev-help@netbeans.apache.org
>
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>
>
>

Re: nb16 source verification

Posted by Michael Bien <mb...@gmail.com>.
On 11.01.23 08:26, Svata Dedic wrote:
> Hi,
>
> downloaded right now - SHA512 seems correct (did you checked by 
> sha512, not sha1 :) ?), and even the GPG signature is OK - but Neil's 
> signing key expired just today (signed on 21. Nov 2022)

gonna put this on my notes since this is something which should be 
checked in an automated fashion by CI too once/if we add a workflow 
which checks release artifacts.

-mbien
>
> Maybe the release should be signed next time by a key which is at 
> least 6 months before expiration or something like that, so it 
> survives to the next release.
>
> -S.
>
> On 11. 01. 23 3:37, Ernie Rael wrote:
>> Just downloaded source from https://netbeans.apache.org/download/nb16/
>>
>> I'm getting verification failures with both sha and gpg.
>>
>> I have to figure it out every time, could be cockpit error; but this 
>> seems like a real failure.
>>
>> -ernie
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
>> For additional commands, e-mail: dev-help@netbeans.apache.org
>>
>> For further information about the NetBeans mailing lists, visit:
>> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>>
>>
>>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
> For additional commands, e-mail: dev-help@netbeans.apache.org
>
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
>
>
>


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists

Re: nb16 source verification

Posted by Ernie Rael <er...@raelity.com>.
On 23/01/11 2:05 AM, Neil C Smith wrote:
> Unless we've ended up in mid-2025 without me noticing, could you try
> importing a recent KEYS file and check again?

Was getting expired, imported KEYS, got rid of expired.

-ernie


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists

Re: nb16 source verification

Posted by Neil C Smith <ne...@apache.org>.
On Wed, 11 Jan 2023 at 07:33, Svata Dedic <sv...@gmail.com> wrote:
> downloaded right now - SHA512 seems correct (did you checked by sha512,
> not sha1 :) ?), and even the GPG signature is OK - but Neil's signing
> key expired just today (signed on 21. Nov 2022)

Unless we've ended up in mid-2025 without me noticing, could you try
importing a recent KEYS file and check again?  Let me know if you
still have an issue.

The key that was used was extended, and KEYS updated, last June.  Not
sure why it shows as expired today?!

Best wishes,

Neil

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists

Re: nb16 source verification

Posted by Svata Dedic <sv...@gmail.com>.
Hi,

downloaded right now - SHA512 seems correct (did you checked by sha512, 
not sha1 :) ?), and even the GPG signature is OK - but Neil's signing 
key expired just today (signed on 21. Nov 2022)

Maybe the release should be signed next time by a key which is at least 
6 months before expiration or something like that, so it survives to the 
next release.

-S.

On 11. 01. 23 3:37, Ernie Rael wrote:
> Just downloaded source from https://netbeans.apache.org/download/nb16/
> 
> I'm getting verification failures with both sha and gpg.
> 
> I have to figure it out every time, could be cockpit error; but this 
> seems like a real failure.
> 
> -ernie
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
> For additional commands, e-mail: dev-help@netbeans.apache.org
> 
> For further information about the NetBeans mailing lists, visit:
> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
> 
> 
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@netbeans.apache.org
For additional commands, e-mail: dev-help@netbeans.apache.org

For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists