You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@logging.apache.org by "Thorsten Schöning (JIRA)" <lo...@logging.apache.org> on 2019/01/16 11:09:00 UTC
[jira] [Comment Edited] (LOGCXX-503) Checksums/Signatures don't
match for log4cxx binaries
[ https://issues.apache.org/jira/browse/LOGCXX-503?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16743876#comment-16743876 ]
Thorsten Schöning edited comment on LOGCXX-503 at 1/16/19 11:08 AM:
--------------------------------------------------------------------
I verified the MD5 checksums using a tool called jacksum and those match in my cases. The binaries didn't change according to the SVN-logs as well, so there shouldn't be any differences to the MD5-hashes in theory. I suggest rechecking those.
As for the resign, I updated the site to mention [~jvz] now and replaced MD5 with SHA512, if it's available already.
was (Author: tschoening):
I verified the MD5 checksums using a tool called jacksum and those match in my cases. The binaries didn't change according to the SVN-logs as well, so there shouldn't be any differences to the MD5-hashes in theory. I suggest rechecking those.
As for the resign, I updated the site to mention Matt Sicker now and replaced MD5 with SHA512, if it's available already.
> Checksums/Signatures don't match for log4cxx binaries
> -----------------------------------------------------
>
> Key: LOGCXX-503
> URL: https://issues.apache.org/jira/browse/LOGCXX-503
> Project: Log4cxx
> Issue Type: Bug
> Affects Versions: 0.10.0
> Reporter: Matt Youngblut
> Assignee: Thorsten Schöning
> Priority: Major
> Fix For: 0.10.0
>
>
> If you download the tar or the zip and the associated checksum or signatures from:
> [https://logging.apache.org/log4cxx/latest_stable/download.html]
> You will end up with a mismatch.
>
> On that page, it states that "apache-log4cxx-0.10.0 is signed by Curt Arnold". When you attempt to verify the signature, you get mismatches:
>
> gpg --verify apache-log4cxx-0.10.0.tar.gz.asc apache-log4cxx-0.10.0.tar.gz
> gpg: Signature made Sat 10 Nov 2018 08:25:02 PM UTC using RSA key ID B62BABE8
> gpg: Good signature from "Matt Sicker (Apache Software Foundation) <ma...@apache.org>" [unknown]
> gpg: aka "Matthew Sicker (Signing Key) <ma...@apache.org>" [unknown]
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg: There is no indication that the signature belongs to the owner.
> Primary key fingerprint: 748F 15B2 CF9B A8F0 2415 5E6E D7C9 2B70 FA1C 814D
> Subkey fingerprint: 9D0A 56AA A0D6 0E0C 0C7D CCC0 B4C7 0893 B62B ABE8
>
>
> It looks like the signatures were updated on 10 November 2018 as well, but there was no corresponding change to the binaries.
> https://archive.apache.org/dist/logging/log4cxx/0.10.0/
>
>
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)