You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@mina.apache.org by Valient Gough <va...@gmail.com> on 2008/07/07 02:32:25 UTC
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Guys, your responses have been completely unhelpful. I see no JIRA
link on the Mina homepage, nor in the FAQ, nor any link for reporting
bugs. If you want people to use JIRA, a link would be helpful.
So in the mean time it has been weeks and the hash/signatures still do
not match. Here is an easy way to reproduce the problem:
Visit the Mina download site: http://mina.apache.org/downloads
right-click and save mina-2.0.0-M1.tar.bz2. Now do the same for the
"asc" file just to the right. In another window run gpg on the asc
file, and it will inform you: BAD signature from "Mike Heath
<mh...@apache.org>"
Here are the links that I see from the home page (right-click
copy-link-location for both the .bz2 and the .asc files):
http://mina.apache.org/dyn/closer.cgi/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2
http://www.apache.org/dist/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2.asc
Seeing how easy it is to verify the problem, it is silly to hear
Tuure's vague assertions of user error.
Valient
> From: Emmanuel Lecharny <el...@...>
> Subject: Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
> Newsgroups: gmane.comp.apache.mina.user
> Date: 2008-06-19 09:18:29 GMT (2 weeks, 3 days, 14 hours and 55 minutes ago)
>
> Thanks guys, for the initial report and also for Tuure response.
>
> For such a problem, even if it's a no-problem, can you fill a JIRA ?
> This will help to keep a track on what is ok and what needs to be fixed.
> Mails just vanish after a few days, JIRAs stays for ever, or at leat
> until they are closed !
>
> Thanks !
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Emmanuel Lecharny <el...@apache.org>.
Valient Gough wrote:
> Guys, your responses have been completely unhelpful. I see no JIRA
> link on the Mina homepage, nor in the FAQ, nor any link for reporting
> bugs. If you want people to use JIRA, a link would be helpful.
>
Hmmm. Site need to be improved, that's for sure !
Here is the link :
http://issues.apache.org/jira/browse/DIRMINA
It can be found on the http://mina.apache.org/contact.html page (not the
best place for such a link, I have to agree with you :/ )
I have created the issue :
https://issues.apache.org/jira/browse/DIRMINA-606
I also have tested the problem, and you are right, there is a problem
(and no, you don't download the html page when you do a wget
http://www.apache.org/dist/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2.asc. :)
Thanks for your patience, Valient !
> So in the mean time it has been weeks and the hash/signatures still do
> not match. Here is an easy way to reproduce the problem:
>
> Visit the Mina download site: http://mina.apache.org/downloads
> right-click and save mina-2.0.0-M1.tar.bz2. Now do the same for the
> "asc" file just to the right. In another window run gpg on the asc
> file, and it will inform you: BAD signature from "Mike Heath
> <mh...@apache.org>"
>
> Here are the links that I see from the home page (right-click
> copy-link-location for both the .bz2 and the .asc files):
>
> http://mina.apache.org/dyn/closer.cgi/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2
> http://www.apache.org/dist/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2.asc
>
> Seeing how easy it is to verify the problem, it is silly to hear
> Tuure's vague assertions of user error.
>
> Valient
>
>
>
>> From: Emmanuel Lecharny <el...@...>
>> Subject: Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
>> Newsgroups: gmane.comp.apache.mina.user
>> Date: 2008-06-19 09:18:29 GMT (2 weeks, 3 days, 14 hours and 55 minutes ago)
>>
>> Thanks guys, for the initial report and also for Tuure response.
>>
>> For such a problem, even if it's a no-problem, can you fill a JIRA ?
>> This will help to keep a track on what is ok and what needs to be fixed.
>> Mails just vanish after a few days, JIRAs stays for ever, or at leat
>> until they are closed !
>>
>> Thanks !
>>
>
>
--
--
cordialement, regards,
Emmanuel Lécharny
www.iktek.com
directory.apache.org
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Niklas Gustavsson <ni...@protocol7.com>.
On Mon, Jul 14, 2008 at 10:22 AM, <jv...@archean.fr> wrote:
> perhaps we can delete it and replace the link on the website to a link to
> the svn file ?
Yes, that would probably be a better solution.
/niklas
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Emmanuel Lecharny <el...@gmail.com>.
> perhaps we can delete it and replace the link on the website to a link to
> the svn file ?
> Julien
>
Seems like a good idea, but the problem is that svn is not mirrored. I
know that almost nobody check the jars, but I would hate being nailed by
infra because svn is loaded by thousands of uer trying to get the KEYS
file on svn.
wdyt ?
--
--
cordialement, regards,
Emmanuel Lécharny
www.iktek.com
directory.apache.org
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by jv...@archean.fr.
> On Fri, Jul 11, 2008 at 10:37 PM, Emmanuel Lecharny
> <el...@apache.org> wrote:
>> Yes, they have to be in sync. Make me realize that I didn't added my key
>> in
>> this file :)
>
> I've updated the KEYS file in www.apache.org/dist/mina and added a
> note to the file to remind future updaters to do the same.
>
> /niklas
>
perhaps we can delete it and replace the link on the website to a link to
the svn file ?
Julien
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Niklas Gustavsson <ni...@protocol7.com>.
On Fri, Jul 11, 2008 at 10:37 PM, Emmanuel Lecharny
<el...@apache.org> wrote:
> Yes, they have to be in sync. Make me realize that I didn't added my key in
> this file :)
I've updated the KEYS file in www.apache.org/dist/mina and added a
note to the file to remind future updaters to do the same.
/niklas
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Emmanuel Lecharny <el...@apache.org>.
Niklas Gustavsson wrote:
> On Tue, Jul 8, 2008 at 11:03 AM, Niklas Gustavsson <ni...@protocol7.com> wrote:
>
>> Yeah, and it should really be in SVN. And if it's already in there, be
>> moved to the root of the MINA SVN for everyone to find.
>>
>
> I added the KEYS file to out SVN repos in order for new commiters to
> easily add their public key. Please do if you plan on releasing
> anything within the MINA project.
>
> I guess we then have to publish the KEYS file on the web site at any
> update to it.
>
Yes, they have to be in sync. Make me realize that I didn't added my key
in this file :)
thanks !
--
--
cordialement, regards,
Emmanuel Lécharny
www.iktek.com
directory.apache.org
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Niklas Gustavsson <ni...@protocol7.com>.
On Tue, Jul 8, 2008 at 11:03 AM, Niklas Gustavsson <ni...@protocol7.com> wrote:
> Yeah, and it should really be in SVN. And if it's already in there, be
> moved to the root of the MINA SVN for everyone to find.
I added the KEYS file to out SVN repos in order for new commiters to
easily add their public key. Please do if you plan on releasing
anything within the MINA project.
I guess we then have to publish the KEYS file on the web site at any
update to it.
/niklas
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Emmanuel Lecharny <el...@apache.org>.
Niklas Gustavsson wrote:
> On Tue, Jul 8, 2008 at 11:00 AM, Julien Vermillard
> <jv...@archean.fr> wrote:
>
>> KEYS file is here :
>> http://www.apache.org/dist/mina/KEYS
>>
>> Wen need to add a link on main download page perhaps.
>>
>
> Yeah, and it should really be in SVN. And if it's already in there, be
> moved to the root of the MINA SVN for everyone to find.
>
> /niklas
>
>
Sounds like a good idea. Not all the project does that, though...
--
--
cordialement, regards,
Emmanuel Lécharny
www.iktek.com
directory.apache.org
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Niklas Gustavsson <ni...@protocol7.com>.
On Tue, Jul 8, 2008 at 11:00 AM, Julien Vermillard
<jv...@archean.fr> wrote:
> KEYS file is here :
> http://www.apache.org/dist/mina/KEYS
>
> Wen need to add a link on main download page perhaps.
Yeah, and it should really be in SVN. And if it's already in there, be
moved to the root of the MINA SVN for everyone to find.
/niklas
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Julien Vermillard <jv...@archean.fr>.
On Tue, 8 Jul 2008 10:55:40 +0200
"Niklas Gustavsson" <ni...@protocol7.com> wrote:
> On Tue, Jul 8, 2008 at 1:14 AM, Emmanuel Lecharny
> <el...@apache.org> wrote:
> > I don't get the same result :
> >
> > elecharny@elecharny-laptop:~/Desktop$ gpg mina-2.0.0-M1.tar.bz2.asc
> > Detached signature.
> > Please enter name of data file: mina-2.0.0-M1.tar.bz2
> > gpg: Signature made Tue 19 Feb 2008 06:55:41 PM CET using DSA key ID
> > 92E29412
> > gpg: Can't check signature: public key not found
> > elecharny@elecharny-laptop:~/Desktop$ cat mina-2.0.0-M1.tar.bz2.asc
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.4.6 (GNU/Linux)
> >
> > iD8DBQBHuxgd6l6w0pLilBIRAo69AKCV9KP+KhwI4gO6pSANkyV+zBpV2wCfST6N
> > bopYxnsNW1s0QKnVQo+YdnI=
> > =2Q/v
> > -----END PGP SIGNATURE-----
> > elecharny@elecharny-laptop:~/Desktop$
> >
> > Obviously, something is wrong, and obviously, we have to fix it. It
> > may depends on the mirror, but that would means that we are not the
> > only one project being impacted.
>
> Yeah, you skipped the step above where I imported Mikes key:
> >> $ gpg --keyserver pgp.mit.edu --recv-keys 92E29412
> >> gpg: requesting key 92E29412 from hkp server pgp.mit.edu
> >> gpg: key 92E29412: public key "Mike Heath <mh...@apache.org>"
> >> imported gpg: Total number processed: 1
> >> gpg: imported: 1
>
> This should really come from the KEYS files, but lacking that I
> imported it by hand.
>
> /niklas
KEYS file is here :
http://www.apache.org/dist/mina/KEYS
Wen need to add a link on main download page perhaps.
Julien
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Niklas Gustavsson <ni...@protocol7.com>.
On Tue, Jul 8, 2008 at 1:14 AM, Emmanuel Lecharny <el...@apache.org> wrote:
> I don't get the same result :
>
> elecharny@elecharny-laptop:~/Desktop$ gpg mina-2.0.0-M1.tar.bz2.asc
> Detached signature.
> Please enter name of data file: mina-2.0.0-M1.tar.bz2
> gpg: Signature made Tue 19 Feb 2008 06:55:41 PM CET using DSA key ID
> 92E29412
> gpg: Can't check signature: public key not found
> elecharny@elecharny-laptop:~/Desktop$ cat mina-2.0.0-M1.tar.bz2.asc
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
>
> iD8DBQBHuxgd6l6w0pLilBIRAo69AKCV9KP+KhwI4gO6pSANkyV+zBpV2wCfST6N
> bopYxnsNW1s0QKnVQo+YdnI=
> =2Q/v
> -----END PGP SIGNATURE-----
> elecharny@elecharny-laptop:~/Desktop$
>
> Obviously, something is wrong, and obviously, we have to fix it. It may
> depends on the mirror, but that would means that we are not the only one
> project being impacted.
Yeah, you skipped the step above where I imported Mikes key:
>> $ gpg --keyserver pgp.mit.edu --recv-keys 92E29412
>> gpg: requesting key 92E29412 from hkp server pgp.mit.edu
>> gpg: key 92E29412: public key "Mike Heath <mh...@apache.org>" imported
>> gpg: Total number processed: 1
>> gpg: imported: 1
This should really come from the KEYS files, but lacking that I
imported it by hand.
/niklas
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Emmanuel Lecharny <el...@apache.org>.
Niklas Gustavsson wrote:
> On Mon, Jul 7, 2008 at 2:32 AM, Valient Gough <va...@gmail.com> wrote:
>
>> Guys, your responses have been completely unhelpful. I see no JIRA
>> link on the Mina homepage, nor in the FAQ, nor any link for reporting
>> bugs. If you want people to use JIRA, a link would be helpful.
>>
>> So in the mean time it has been weeks and the hash/signatures still do
>> not match. Here is an easy way to reproduce the problem:
>>
>> Visit the Mina download site: http://mina.apache.org/downloads
>> right-click and save mina-2.0.0-M1.tar.bz2. Now do the same for the
>> "asc" file just to the right. In another window run gpg on the asc
>> file, and it will inform you: BAD signature from "Mike Heath
>> <mh...@apache.org>"
>>
>> Here are the links that I see from the home page (right-click
>> copy-link-location for both the .bz2 and the .asc files):
>>
>> http://mina.apache.org/dyn/closer.cgi/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2
>> http://www.apache.org/dist/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2.asc
>>
>> Seeing how easy it is to verify the problem, it is silly to hear
>> Tuure's vague assertions of user error.
>>
>
> WHile being no expert at GPG, I did just what you described above. Of
> course, you can't right-click and download MINA from the link you gave
> as it will only give you the mirror selection page (as pointed out by
> Tuure). However, choosing a mirror and downloading the file and the
> signature gave me files that check out fine:
>
> $ gpg --keyserver pgp.mit.edu --recv-keys 92E29412
> gpg: requesting key 92E29412 from hkp server pgp.mit.edu
> gpg: key 92E29412: public key "Mike Heath <mh...@apache.org>" imported
> gpg: Total number processed: 1
> gpg: imported: 1
> $ gpg mina-2.0.0-M1.tar.bz2.asc
> Detached signature.
> Please enter name of data file: /media/big/download/mina-2.0.0-M1.tar.bz2
> gpg: Signature made Tue 19 Feb 2008 06:55:41 PM CET using DSA key ID 92E29412
> gpg: Good signature from "Mike Heath <mh...@apache.org>"
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg: There is no indication that the signature belongs to the owner.
> Primary key fingerprint: C457 B28D B5D7 7D8A 9596 9126 EA5E B0D2 92E2 9412
>
> What mirror did you pick? Maybe there's an issue with the mirror
> fiddling with the file before downloading? The mirror I used was:
> http://apache.jumper.nu/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2
>
I don't get the same result :
elecharny@elecharny-laptop:~/Desktop$ gpg mina-2.0.0-M1.tar.bz2.asc
Detached signature.
Please enter name of data file: mina-2.0.0-M1.tar.bz2
gpg: Signature made Tue 19 Feb 2008 06:55:41 PM CET using DSA key ID
92E29412
gpg: Can't check signature: public key not found
elecharny@elecharny-laptop:~/Desktop$ cat mina-2.0.0-M1.tar.bz2.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQBHuxgd6l6w0pLilBIRAo69AKCV9KP+KhwI4gO6pSANkyV+zBpV2wCfST6N
bopYxnsNW1s0QKnVQo+YdnI=
=2Q/v
-----END PGP SIGNATURE-----
elecharny@elecharny-laptop:~/Desktop$
Obviously, something is wrong, and obviously, we have to fix it. It may
depends on the mirror, but that would means that we are not the only one
project being impacted.
Tuure, can you please post the exact sequence of commands you are using
and the mirror you are downloading files from ?
> All that said, why doesn't MINA have a KEYS file? At least I failed to find one.
>
Really ? Too bad that I have a limited network access with my $*µ%!
ISP, but I was pretty sure there were KEYS somewhere for MINA. Will
check that tomorrow. If it's missing, then we have to create this file.
Thanks Niklas !
--
--
cordialement, regards,
Emmanuel Lécharny
www.iktek.com
directory.apache.org
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Emmanuel Lecharny <el...@apache.org>.
Niklas Gustavsson wrote:
> On Tue, Jul 8, 2008 at 1:17 PM, Emmanuel Lecharny <el...@apache.org> wrote:
>
>>> Agreed, is that page generated from Confluence or some other way?
>>>
>> Yep.
>>
>
> I guess that means Confluence :-) Where can I find the corresponding
> Confluence page? I've browsed through the DS spaces and tried
> searching for phrases on that page, but no avail.
>
Sorry, my bad. It's not a confluence generated page, it's a static HTML
page, on /www/directory.apache.org/apacheds/1.5/download directory (on
people.apache.org)
--
--
cordialement, regards,
Emmanuel Lécharny
www.iktek.com
directory.apache.org
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Niklas Gustavsson <ni...@protocol7.com>.
On Tue, Jul 8, 2008 at 1:17 PM, Emmanuel Lecharny <el...@apache.org> wrote:
>> Agreed, is that page generated from Confluence or some other way?
>
> Yep.
I guess that means Confluence :-) Where can I find the corresponding
Confluence page? I've browsed through the DS spaces and tried
searching for phrases on that page, but no avail.
/niklas
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Emmanuel Lecharny <el...@apache.org>.
Niklas Gustavsson wrote:
> On Tue, Jul 8, 2008 at 1:04 PM, Emmanuel Lecharny <el...@apache.org> wrote:
>
>> I agree. What we could also do is to improve the pages we have on MINA to
>> give explicit instructions on how to check the signatures. Here is an
>> exemple on what Pierre-Arnaud Marcelot did for Directory :
>> http://directory.apache.org/apacheds/1.5/download/download-linux-bin.html
>>
>> It's really cool, and helpful.
>>
>
> Agreed, is that page generated from Confluence or some other way?
>
Yep.
> Btw, there's a minor typo on that page :-D
>
> Apache Directory Server for Windows requires at least:
>
> * a recent Linux distribution
>
It was intended ;)
Thanks for pointing this !
> /niklas
>
>
--
--
cordialement, regards,
Emmanuel Lécharny
www.iktek.com
directory.apache.org
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Emmanuel Lecharny <el...@apache.org>.
Niklas Gustavsson wrote:
> On Tue, Jul 8, 2008 at 1:04 PM, Emmanuel Lecharny <el...@apache.org> wrote:
>
>> I agree. What we could also do is to improve the pages we have on MINA to
>> give explicit instructions on how to check the signatures. Here is an
>> exemple on what Pierre-Arnaud Marcelot did for Directory :
>> http://directory.apache.org/apacheds/1.5/download/download-linux-bin.html
>>
>> It's really cool, and helpful.
>>
>
> Agreed, is that page generated from Confluence or some other way?
>
Sorry, this is static HTML. You can find the pages on people.apache.org
here :
/www/directory.apache.org/apacheds/1.5/download
--
--
cordialement, regards,
Emmanuel Lécharny
www.iktek.com
directory.apache.org
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Niklas Gustavsson <ni...@protocol7.com>.
On Tue, Jul 8, 2008 at 1:04 PM, Emmanuel Lecharny <el...@apache.org> wrote:
> I agree. What we could also do is to improve the pages we have on MINA to
> give explicit instructions on how to check the signatures. Here is an
> exemple on what Pierre-Arnaud Marcelot did for Directory :
> http://directory.apache.org/apacheds/1.5/download/download-linux-bin.html
>
> It's really cool, and helpful.
Agreed, is that page generated from Confluence or some other way?
Btw, there's a minor typo on that page :-D
Apache Directory Server for Windows requires at least:
* a recent Linux distribution
/niklas
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Emmanuel Lecharny <el...@apache.org>.
Niklas Gustavsson wrote:
> On Tue, Jul 8, 2008 at 10:58 AM, Emmanuel Lecharny <el...@apache.org> wrote:
>
>> I checked, MINA has a KEYS file, on people.apache.org :
>>
>> /www/www.apache.org/dist/mina/KEYS
>>
>
> Now, with the KEYS file found, I reran the verification of both the M1
> and M2 releases and they both pass just fine. I think we can close
> this issue as long as Valient could confirm that this is not an issue
> with the mirror he used.
>
I agree. What we could also do is to improve the pages we have on MINA
to give explicit instructions on how to check the signatures. Here is an
exemple on what Pierre-Arnaud Marcelot did for Directory :
http://directory.apache.org/apacheds/1.5/download/download-linux-bin.html
It's really cool, and helpful.
--
--
cordialement, regards,
Emmanuel Lécharny
www.iktek.com
directory.apache.org
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Niklas Gustavsson <ni...@protocol7.com>.
On Tue, Jul 8, 2008 at 10:58 AM, Emmanuel Lecharny <el...@apache.org> wrote:
> I checked, MINA has a KEYS file, on people.apache.org :
>
> /www/www.apache.org/dist/mina/KEYS
Now, with the KEYS file found, I reran the verification of both the M1
and M2 releases and they both pass just fine. I think we can close
this issue as long as Valient could confirm that this is not an issue
with the mirror he used.
$ wget http://apache.jumper.nu/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2
--12:58:34-- http://apache.jumper.nu/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2
=> `mina-2.0.0-M1.tar.bz2'
Resolving apache.jumper.nu... 80.67.2.2
Connecting to apache.jumper.nu|80.67.2.2|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2,148,107 (2.0M) [application/x-bzip2]
100%[====================================>] 2,148,107 1.11M/s
12:58:36 (1.11 MB/s) - `mina-2.0.0-M1.tar.bz2' saved [2148107/2148107]
$ wget http://www.apache.org/dist/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2.asc
--12:58:43-- http://www.apache.org/dist/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2.asc
=> `mina-2.0.0-M1.tar.bz2.asc'
Resolving www.apache.org... 192.87.106.226
Connecting to www.apache.org|192.87.106.226|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 189 [text/plain]
100%[====================================>] 189 --.--K/s
12:58:44 (26.33 MB/s) - `mina-2.0.0-M1.tar.bz2.asc' saved [189/189]
$ wget http://www.apache.org/dist/mina/KEYS
--12:53:21-- http://www.apache.org/dist/mina/KEYS
=> `KEYS'
Resolving www.apache.org... 192.87.106.226
Connecting to www.apache.org|192.87.106.226|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 8,539 (8.3K) [text/plain]
100%[====================================>] 8,539 --.--K/s
12:53:21 (241.55 KB/s) - `KEYS' saved [8539/8539]
$ gpg --import KEYS
gpg: key 0255ECA6: public key "Trustin Lee (http://gleamynode.net/)
<tr...@apache.org>" imported
gpg: key 3F3E8060: public key "Julien Vermillard (CODE SIGNING KEY)
<jv...@apache.org>" imported
gpg: key 92E29412: "Mike Heath <mh...@apache.org>" not changed
gpg: Total number processed: 3
gpg: imported: 2
gpg: unchanged: 1
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 1 signed: 25 trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1 valid: 25 signed: 1 trust: 25-, 0q, 0n, 0m, 0f, 0u
gpg: next trustdb check due at 2008-12-31
$ gpg --verify mina-2.0.0-M1.tar.bz2.asc mina-2.0.0-M1.tar.bz2
gpg: Signature made Tue 19 Feb 2008 06:55:41 PM CET using DSA key ID 92E29412
gpg: Good signature from "Mike Heath <mh...@apache.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: C457 B28D B5D7 7D8A 9596 9126 EA5E B0D2 92E2 9412
/niklas
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Emmanuel Lecharny <el...@apache.org>.
Niklas Gustavsson wrote:
> All that said, why doesn't MINA have a KEYS file? At least I failed to find one.
>
I checked, MINA has a KEYS file, on people.apache.org :
/www/www.apache.org/dist/mina/KEYS
> /niklas
>
>
--
--
cordialement, regards,
Emmanuel Lécharny
www.iktek.com
directory.apache.org
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Niklas Gustavsson <ni...@protocol7.com>.
On Mon, Jul 7, 2008 at 2:32 AM, Valient Gough <va...@gmail.com> wrote:
> Guys, your responses have been completely unhelpful. I see no JIRA
> link on the Mina homepage, nor in the FAQ, nor any link for reporting
> bugs. If you want people to use JIRA, a link would be helpful.
>
> So in the mean time it has been weeks and the hash/signatures still do
> not match. Here is an easy way to reproduce the problem:
>
> Visit the Mina download site: http://mina.apache.org/downloads
> right-click and save mina-2.0.0-M1.tar.bz2. Now do the same for the
> "asc" file just to the right. In another window run gpg on the asc
> file, and it will inform you: BAD signature from "Mike Heath
> <mh...@apache.org>"
>
> Here are the links that I see from the home page (right-click
> copy-link-location for both the .bz2 and the .asc files):
>
> http://mina.apache.org/dyn/closer.cgi/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2
> http://www.apache.org/dist/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2.asc
>
> Seeing how easy it is to verify the problem, it is silly to hear
> Tuure's vague assertions of user error.
WHile being no expert at GPG, I did just what you described above. Of
course, you can't right-click and download MINA from the link you gave
as it will only give you the mirror selection page (as pointed out by
Tuure). However, choosing a mirror and downloading the file and the
signature gave me files that check out fine:
$ gpg --keyserver pgp.mit.edu --recv-keys 92E29412
gpg: requesting key 92E29412 from hkp server pgp.mit.edu
gpg: key 92E29412: public key "Mike Heath <mh...@apache.org>" imported
gpg: Total number processed: 1
gpg: imported: 1
$ gpg mina-2.0.0-M1.tar.bz2.asc
Detached signature.
Please enter name of data file: /media/big/download/mina-2.0.0-M1.tar.bz2
gpg: Signature made Tue 19 Feb 2008 06:55:41 PM CET using DSA key ID 92E29412
gpg: Good signature from "Mike Heath <mh...@apache.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: C457 B28D B5D7 7D8A 9596 9126 EA5E B0D2 92E2 9412
What mirror did you pick? Maybe there's an issue with the mirror
fiddling with the file before downloading? The mirror I used was:
http://apache.jumper.nu/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2
All that said, why doesn't MINA have a KEYS file? At least I failed to find one.
/niklas
Re: MINA 1.1.7 MD5 and SHA1 hashes do not match downloads
Posted by Tuure Laurinolli <tu...@indagon.com>.
Valient Gough wrote:
> Guys, your responses have been completely unhelpful.
I don't think so. In my original reply I told you why one of your
command sequences was erroneous and asked you to check if that might
also have been the problem with the other files. You never responded.
> http://mina.apache.org/dyn/closer.cgi/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2
As I mentioned in my original reply, this gets you the mirror selection
page, not the actual tarball.
> Seeing how easy it is to verify the problem, it is silly to hear
> Tuure's vague assertions of user error.
How was I vague? I quite clearly stated that the only complete command
sequence you mentioned in your original post would download the mirror
selection page, and not teh actual tarball, and thus your original test
was erronous.