Re: Spamassassin 3.0.4 releases with BAD GPG check

[Justin Mason <jm...@jmason.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Philip Shuman writes:
> It looks like the tgz, bz2, and zip releases of 3.0.4 have BAD gpg 
> signatures on them. I've tested it with both GPG and PGP8 and both report 
> BAD signatures. Please check this out.
> 
> http://spamassassin.apache.org/downloads.cgi?update 0506061100
> 
> http://apache.seekmeup.com/spamassassin/source/Mail-SpamAssassin-3.0.4.tar.bz2
> http://www.apache.org/dist/spamassassin/source/Mail-SpamAssassin-3.0.4.tar.bz2.asc

This is apparently a bug in certain releases of GPG and PGP. Try with
other releases of GPG, and they should pass.

FWIW, we were using incorrect flags when signing -- this problem should no
longer crop up with any of the 3.1.0 releases.  But those signatures
do pass anyway with more recent GPG and PGP releases.

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFDBOQoMJF5cimLx9ARAtVlAKCwGdrwAQe1T6Tez7YGjjQN4nFfJgCgkhAV
wb014kJinMCql/oEBlbKQpA=
=EO/l
-----END PGP SIGNATURE-----