You are viewing a plain text version of this content. The canonical link for it is here.
Posted to log4j-user@logging.apache.org by Daniel Savard <da...@gmail.com> on 2021/12/13 16:51:52 UTC
log4j 2.15.0 signature and sha512 hash
Hi everyone,
I am trying to authenticate the log4j-2.15 code downloaded from the
apache.org site and the sha512 file doesn't contain a sha512 hash at all
and the signature file (.asc) failed to authenticate the parent file.
Anyone can fix this? I cannot patch our system with unauthenticated code.
Please, provide correct files and authentication files.
Regards,
-----------------
Daniel Savard
Re: log4j 2.15.0 signature and sha512 hash
Posted by Daniel Savard <da...@gmail.com>.
Le lun. 13 déc. 2021 à 12:23, Matt Sicker <bo...@gmail.com> a écrit :
> Did you import the keys from our keys file? That should make the
> signatures authenticate.
>
Of course.
-----------------
Daniel Savard
Re: log4j 2.15.0 signature and sha512 hash
Posted by Matt Sicker <bo...@gmail.com>.
Did you import the keys from our keys file? That should make the
signatures authenticate.
On Mon, Dec 13, 2021 at 10:52 AM Daniel Savard <da...@gmail.com> wrote:
>
> Hi everyone,
>
> I am trying to authenticate the log4j-2.15 code downloaded from the
> apache.org site and the sha512 file doesn't contain a sha512 hash at all
> and the signature file (.asc) failed to authenticate the parent file.
>
> Anyone can fix this? I cannot patch our system with unauthenticated code.
> Please, provide correct files and authentication files.
>
> Regards,
> -----------------
> Daniel Savard
---------------------------------------------------------------------
To unsubscribe, e-mail: log4j-user-unsubscribe@logging.apache.org
For additional commands, e-mail: log4j-user-help@logging.apache.org
Re: log4j 2.15.0 signature and sha512 hash
Posted by Matt Sicker <bo...@gmail.com>.
Thanks for confirming!
--
Matt Sicker
> On Dec 13, 2021, at 20:02, Daniel Savard <da...@gmail.com> wrote:
>
> Le lun. 13 déc. 2021 à 13:35, Daniel Savard <da...@gmail.com> a
> écrit :
>
>>
>> -----------------
>> Daniel Savard
>>
>>
>> Le lun. 13 déc. 2021 à 13:28, Gary Gregory <ga...@gmail.com> a
>> écrit :
>>
>>> On Mon, Dec 13, 2021 at 1:22 PM Daniel Savard <da...@gmail.com>
>>> wrote:
>>>
>>>> Le lun. 13 déc. 2021 à 12:34, Gary Gregory <ga...@gmail.com> a
>>>> écrit :
>>>>
>>>>> Works for me:
>>>>>
>>>>> gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
>>>>>
>>>>
>>>> Here is the content of the asc file:
>>>>
>>>> -----BEGIN PGP SIGNATURE-----
>>>>
>>>> iQIzBAABCgAdFiEEU8k1ghqmp1W9M321NZU5XrPY4boFAmGySd0ACgkQNZU5XrPY
>>>> 4bqQtQ/+KXQi3+6LZ13HyEefNsnBm84krCXK/nAIlRnerbV+Wj1g0xU7cC8l3m+n
>>>> UHw2/BIIurGnOKU4bvGUOc5UYDTED4LPadkvXYW0NMvBGla0fvR1lyEMypS2E2nz
>>>> 0g3sqHC0T4ZEGEIO7jmUVQJEpPya33VlztfnoNQPcqv6PCOilIVK1EmoewEBvnsd
>>>> SVAJPhJtD43mUPLsIMIc4k7IM56FssN+2+46mba6YH39C4Z4NheGBUK9UXWYKQd3
>>>> 3DKHoIoLb2hKXLdxHHz5u4dbkYPiHyGR4iX0wjq7W4eUX/4v+czsjrs8vQ5Gvhba
>>>> slg6RfUeu+fkMJfQUgRLT2HRSIKsuUd2QMppxW1GKRnfpx0yzAUWMfFfPcxuEa/u
>>>> em4YCsz1/a0AtfgtI6+Lne0yWsxORVVutquVOyF0ddjySQccPNYaOyOjx6jASM2A
>>>> LxkdCko0+2rSuIWcLMpWaoeRedao4L6O3azdU0IcN7/BVyXczM2t5cYB4QDdXvSc
>>>> UKJ6q6dQLngIwYqo6Q/d1XeKatWuhSPz0+mAoGAWvllvzWKb1/YbC/jZk/vxVqzR
>>>> K/mHB24pPWfcWiQNfbHrOVVUzv783u1RkEqDCGbBNBUr+ud1Fvte0i1x6WIhGXS7
>>>> qb5OTuljDicQ1L2mAKgvzl4XnOUsFmuBagZHYk58n19ZlxfBlyw=
>>>> =gA3i
>>>>
>>>> -----END PGP SIGNATURE-----
>>>>
>>>> This results in a bad signature.
>>>>
>>>
>>> What happens when you run:
>>>
>>> gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
>>>
>>> ?
>>>
>>
>> $ gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
>> gpg: keyserver option 'honor-http-proxy' is unknown
>> gpg: les données signées sont supposées être dans «
>> apache-log4j-2.15.0-bin.tar.gz »
>> gpg: Signature faite le jeu 09 déc 2021 13:24:29 EST
>> gpg: avec la clef RSA
>> 53C935821AA6A755BD337DB53595395EB3D8E1BA
>> gpg: MAUVAISE signature de « Ralph Goers (CODE SIGNING KEY) <
>> rgoers@apache.org> » [inconnu]
>>
>> MAUVAISE=BAD
>>
>>
>>> Gary
>>>
>>
>>
> apache-log4j-2.16.0 is out and this time signature and hash validation work
> perfectly.
>
> -----------------
> Daniel Savard
---------------------------------------------------------------------
To unsubscribe, e-mail: log4j-user-unsubscribe@logging.apache.org
For additional commands, e-mail: log4j-user-help@logging.apache.org
Re: log4j 2.15.0 signature and sha512 hash
Posted by Daniel Savard <da...@gmail.com>.
Le lun. 13 déc. 2021 à 13:35, Daniel Savard <da...@gmail.com> a
écrit :
>
> -----------------
> Daniel Savard
>
>
> Le lun. 13 déc. 2021 à 13:28, Gary Gregory <ga...@gmail.com> a
> écrit :
>
>> On Mon, Dec 13, 2021 at 1:22 PM Daniel Savard <da...@gmail.com>
>> wrote:
>>
>> > Le lun. 13 déc. 2021 à 12:34, Gary Gregory <ga...@gmail.com> a
>> > écrit :
>> >
>> > > Works for me:
>> > >
>> > > gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
>> > >
>> >
>> > Here is the content of the asc file:
>> >
>> > -----BEGIN PGP SIGNATURE-----
>> >
>> > iQIzBAABCgAdFiEEU8k1ghqmp1W9M321NZU5XrPY4boFAmGySd0ACgkQNZU5XrPY
>> > 4bqQtQ/+KXQi3+6LZ13HyEefNsnBm84krCXK/nAIlRnerbV+Wj1g0xU7cC8l3m+n
>> > UHw2/BIIurGnOKU4bvGUOc5UYDTED4LPadkvXYW0NMvBGla0fvR1lyEMypS2E2nz
>> > 0g3sqHC0T4ZEGEIO7jmUVQJEpPya33VlztfnoNQPcqv6PCOilIVK1EmoewEBvnsd
>> > SVAJPhJtD43mUPLsIMIc4k7IM56FssN+2+46mba6YH39C4Z4NheGBUK9UXWYKQd3
>> > 3DKHoIoLb2hKXLdxHHz5u4dbkYPiHyGR4iX0wjq7W4eUX/4v+czsjrs8vQ5Gvhba
>> > slg6RfUeu+fkMJfQUgRLT2HRSIKsuUd2QMppxW1GKRnfpx0yzAUWMfFfPcxuEa/u
>> > em4YCsz1/a0AtfgtI6+Lne0yWsxORVVutquVOyF0ddjySQccPNYaOyOjx6jASM2A
>> > LxkdCko0+2rSuIWcLMpWaoeRedao4L6O3azdU0IcN7/BVyXczM2t5cYB4QDdXvSc
>> > UKJ6q6dQLngIwYqo6Q/d1XeKatWuhSPz0+mAoGAWvllvzWKb1/YbC/jZk/vxVqzR
>> > K/mHB24pPWfcWiQNfbHrOVVUzv783u1RkEqDCGbBNBUr+ud1Fvte0i1x6WIhGXS7
>> > qb5OTuljDicQ1L2mAKgvzl4XnOUsFmuBagZHYk58n19ZlxfBlyw=
>> > =gA3i
>> >
>> > -----END PGP SIGNATURE-----
>> >
>> > This results in a bad signature.
>> >
>>
>> What happens when you run:
>>
>> gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
>>
>> ?
>>
>
> $ gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
> gpg: keyserver option 'honor-http-proxy' is unknown
> gpg: les données signées sont supposées être dans «
> apache-log4j-2.15.0-bin.tar.gz »
> gpg: Signature faite le jeu 09 déc 2021 13:24:29 EST
> gpg: avec la clef RSA
> 53C935821AA6A755BD337DB53595395EB3D8E1BA
> gpg: MAUVAISE signature de « Ralph Goers (CODE SIGNING KEY) <
> rgoers@apache.org> » [inconnu]
>
> MAUVAISE=BAD
>
>
>> Gary
>>
>
>
apache-log4j-2.16.0 is out and this time signature and hash validation work
perfectly.
-----------------
Daniel Savard
Re: log4j 2.15.0 signature and sha512 hash
Posted by Daniel Savard <da...@gmail.com>.
-----------------
Daniel Savard
Le lun. 13 déc. 2021 à 13:28, Gary Gregory <ga...@gmail.com> a
écrit :
> On Mon, Dec 13, 2021 at 1:22 PM Daniel Savard <da...@gmail.com>
> wrote:
>
> > Le lun. 13 déc. 2021 à 12:34, Gary Gregory <ga...@gmail.com> a
> > écrit :
> >
> > > Works for me:
> > >
> > > gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
> > >
> >
> > Here is the content of the asc file:
> >
> > -----BEGIN PGP SIGNATURE-----
> >
> > iQIzBAABCgAdFiEEU8k1ghqmp1W9M321NZU5XrPY4boFAmGySd0ACgkQNZU5XrPY
> > 4bqQtQ/+KXQi3+6LZ13HyEefNsnBm84krCXK/nAIlRnerbV+Wj1g0xU7cC8l3m+n
> > UHw2/BIIurGnOKU4bvGUOc5UYDTED4LPadkvXYW0NMvBGla0fvR1lyEMypS2E2nz
> > 0g3sqHC0T4ZEGEIO7jmUVQJEpPya33VlztfnoNQPcqv6PCOilIVK1EmoewEBvnsd
> > SVAJPhJtD43mUPLsIMIc4k7IM56FssN+2+46mba6YH39C4Z4NheGBUK9UXWYKQd3
> > 3DKHoIoLb2hKXLdxHHz5u4dbkYPiHyGR4iX0wjq7W4eUX/4v+czsjrs8vQ5Gvhba
> > slg6RfUeu+fkMJfQUgRLT2HRSIKsuUd2QMppxW1GKRnfpx0yzAUWMfFfPcxuEa/u
> > em4YCsz1/a0AtfgtI6+Lne0yWsxORVVutquVOyF0ddjySQccPNYaOyOjx6jASM2A
> > LxkdCko0+2rSuIWcLMpWaoeRedao4L6O3azdU0IcN7/BVyXczM2t5cYB4QDdXvSc
> > UKJ6q6dQLngIwYqo6Q/d1XeKatWuhSPz0+mAoGAWvllvzWKb1/YbC/jZk/vxVqzR
> > K/mHB24pPWfcWiQNfbHrOVVUzv783u1RkEqDCGbBNBUr+ud1Fvte0i1x6WIhGXS7
> > qb5OTuljDicQ1L2mAKgvzl4XnOUsFmuBagZHYk58n19ZlxfBlyw=
> > =gA3i
> >
> > -----END PGP SIGNATURE-----
> >
> > This results in a bad signature.
> >
>
> What happens when you run:
>
> gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
>
> ?
>
$ gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
gpg: keyserver option 'honor-http-proxy' is unknown
gpg: les données signées sont supposées être dans «
apache-log4j-2.15.0-bin.tar.gz »
gpg: Signature faite le jeu 09 déc 2021 13:24:29 EST
gpg: avec la clef RSA
53C935821AA6A755BD337DB53595395EB3D8E1BA
gpg: MAUVAISE signature de « Ralph Goers (CODE SIGNING KEY) <
rgoers@apache.org> » [inconnu]
MAUVAISE=BAD
> Gary
>
-----------------------
Daniel Savard
Re: log4j 2.15.0 signature and sha512 hash
Posted by Gary Gregory <ga...@gmail.com>.
On Mon, Dec 13, 2021 at 1:22 PM Daniel Savard <da...@gmail.com>
wrote:
> Le lun. 13 déc. 2021 à 12:34, Gary Gregory <ga...@gmail.com> a
> écrit :
>
> > Works for me:
> >
> > gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
> >
>
> Here is the content of the asc file:
>
> -----BEGIN PGP SIGNATURE-----
>
> iQIzBAABCgAdFiEEU8k1ghqmp1W9M321NZU5XrPY4boFAmGySd0ACgkQNZU5XrPY
> 4bqQtQ/+KXQi3+6LZ13HyEefNsnBm84krCXK/nAIlRnerbV+Wj1g0xU7cC8l3m+n
> UHw2/BIIurGnOKU4bvGUOc5UYDTED4LPadkvXYW0NMvBGla0fvR1lyEMypS2E2nz
> 0g3sqHC0T4ZEGEIO7jmUVQJEpPya33VlztfnoNQPcqv6PCOilIVK1EmoewEBvnsd
> SVAJPhJtD43mUPLsIMIc4k7IM56FssN+2+46mba6YH39C4Z4NheGBUK9UXWYKQd3
> 3DKHoIoLb2hKXLdxHHz5u4dbkYPiHyGR4iX0wjq7W4eUX/4v+czsjrs8vQ5Gvhba
> slg6RfUeu+fkMJfQUgRLT2HRSIKsuUd2QMppxW1GKRnfpx0yzAUWMfFfPcxuEa/u
> em4YCsz1/a0AtfgtI6+Lne0yWsxORVVutquVOyF0ddjySQccPNYaOyOjx6jASM2A
> LxkdCko0+2rSuIWcLMpWaoeRedao4L6O3azdU0IcN7/BVyXczM2t5cYB4QDdXvSc
> UKJ6q6dQLngIwYqo6Q/d1XeKatWuhSPz0+mAoGAWvllvzWKb1/YbC/jZk/vxVqzR
> K/mHB24pPWfcWiQNfbHrOVVUzv783u1RkEqDCGbBNBUr+ud1Fvte0i1x6WIhGXS7
> qb5OTuljDicQ1L2mAKgvzl4XnOUsFmuBagZHYk58n19ZlxfBlyw=
> =gA3i
>
> -----END PGP SIGNATURE-----
>
> This results in a bad signature.
>
What happens when you run:
gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
?
Gary
>
>
> >
> > gpg: assuming signed data in 'apache-log4j-2.15.0-bin.tar.gz'
> > gpg: Signature made Thu Dec 9 13:24:29 2021 EST
> > gpg: using RSA key
> 53C935821AA6A755BD337DB53595395EB3D8E1BA
> > gpg: Good signature from "Ralph Goers (CODE SIGNING KEY) <
> > rgoers@apache.org>"
> > [unknown]
> > gpg: WARNING: This key is not certified with a trusted signature!
> > gpg: There is no indication that the signature belongs to the
> > owner.
> > Primary key fingerprint: 53C9 3582 1AA6 A755 BD33 7DB5 3595 395E B3D8
> E1BA
> >
> > shasum -a512 apache-log4j-2.15.0-bin.tar.gz
> >
> >
> >
> c0e2d704d720bffc99520e5dfbf860ba3cb7f8a34c16a1caa8ce35618370ff06c19e3dc64fc258ad45d4308690551bf34b3ecb7acc0848aa12615f46398cda4a
> > apache-log4j-2.15.0-bin.tar.gz
> >
> > is the same as the data in
> >
> >
> https://downloads.apache.org/logging/log4j/2.15.0/apache-log4j-2.15.0-bin.tar.gz.sha512
> >
> >
> Here is the content of the file when I download it:
>
> apache-log4j-2.15.0-bin.tar.gz: C0E2D704 D720BFFC 99520E5D FBF860BA
> 3CB7F8A3
> 4C16A1CA A8CE3561 8370FF06 C19E3DC6
> 4FC258AD
> 45D43086 90551BF3 4B3ECB7A CC0848AA
> 12615F46
>
> 398CDA4A
>
>
> Obviously not a sha512 hash.
>
>
>
> >
> > Gary
> >
> >
> -----------------
> Daniel Savard
>
Re: log4j 2.15.0 signature and sha512 hash
Posted by Daniel Savard <da...@gmail.com>.
Le lun. 13 déc. 2021 à 12:34, Gary Gregory <ga...@gmail.com> a
écrit :
> Works for me:
>
> gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
>
Here is the content of the asc file:
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEU8k1ghqmp1W9M321NZU5XrPY4boFAmGySd0ACgkQNZU5XrPY
4bqQtQ/+KXQi3+6LZ13HyEefNsnBm84krCXK/nAIlRnerbV+Wj1g0xU7cC8l3m+n
UHw2/BIIurGnOKU4bvGUOc5UYDTED4LPadkvXYW0NMvBGla0fvR1lyEMypS2E2nz
0g3sqHC0T4ZEGEIO7jmUVQJEpPya33VlztfnoNQPcqv6PCOilIVK1EmoewEBvnsd
SVAJPhJtD43mUPLsIMIc4k7IM56FssN+2+46mba6YH39C4Z4NheGBUK9UXWYKQd3
3DKHoIoLb2hKXLdxHHz5u4dbkYPiHyGR4iX0wjq7W4eUX/4v+czsjrs8vQ5Gvhba
slg6RfUeu+fkMJfQUgRLT2HRSIKsuUd2QMppxW1GKRnfpx0yzAUWMfFfPcxuEa/u
em4YCsz1/a0AtfgtI6+Lne0yWsxORVVutquVOyF0ddjySQccPNYaOyOjx6jASM2A
LxkdCko0+2rSuIWcLMpWaoeRedao4L6O3azdU0IcN7/BVyXczM2t5cYB4QDdXvSc
UKJ6q6dQLngIwYqo6Q/d1XeKatWuhSPz0+mAoGAWvllvzWKb1/YbC/jZk/vxVqzR
K/mHB24pPWfcWiQNfbHrOVVUzv783u1RkEqDCGbBNBUr+ud1Fvte0i1x6WIhGXS7
qb5OTuljDicQ1L2mAKgvzl4XnOUsFmuBagZHYk58n19ZlxfBlyw=
=gA3i
-----END PGP SIGNATURE-----
This results in a bad signature.
>
> gpg: assuming signed data in 'apache-log4j-2.15.0-bin.tar.gz'
> gpg: Signature made Thu Dec 9 13:24:29 2021 EST
> gpg: using RSA key 53C935821AA6A755BD337DB53595395EB3D8E1BA
> gpg: Good signature from "Ralph Goers (CODE SIGNING KEY) <
> rgoers@apache.org>"
> [unknown]
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg: There is no indication that the signature belongs to the
> owner.
> Primary key fingerprint: 53C9 3582 1AA6 A755 BD33 7DB5 3595 395E B3D8 E1BA
>
> shasum -a512 apache-log4j-2.15.0-bin.tar.gz
>
>
> c0e2d704d720bffc99520e5dfbf860ba3cb7f8a34c16a1caa8ce35618370ff06c19e3dc64fc258ad45d4308690551bf34b3ecb7acc0848aa12615f46398cda4a
> apache-log4j-2.15.0-bin.tar.gz
>
> is the same as the data in
>
> https://downloads.apache.org/logging/log4j/2.15.0/apache-log4j-2.15.0-bin.tar.gz.sha512
>
>
Here is the content of the file when I download it:
apache-log4j-2.15.0-bin.tar.gz: C0E2D704 D720BFFC 99520E5D FBF860BA 3CB7F8A3
4C16A1CA A8CE3561 8370FF06 C19E3DC6 4FC258AD
45D43086 90551BF3 4B3ECB7A CC0848AA 12615F46
398CDA4A
Obviously not a sha512 hash.
>
> Gary
>
>
-----------------
Daniel Savard
Re: log4j 2.15.0 signature and sha512 hash
Posted by Gary Gregory <ga...@gmail.com>.
Works for me:
gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
gpg: assuming signed data in 'apache-log4j-2.15.0-bin.tar.gz'
gpg: Signature made Thu Dec 9 13:24:29 2021 EST
gpg: using RSA key 53C935821AA6A755BD337DB53595395EB3D8E1BA
gpg: Good signature from "Ralph Goers (CODE SIGNING KEY) <rg...@apache.org>"
[unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the
owner.
Primary key fingerprint: 53C9 3582 1AA6 A755 BD33 7DB5 3595 395E B3D8 E1BA
shasum -a512 apache-log4j-2.15.0-bin.tar.gz
c0e2d704d720bffc99520e5dfbf860ba3cb7f8a34c16a1caa8ce35618370ff06c19e3dc64fc258ad45d4308690551bf34b3ecb7acc0848aa12615f46398cda4a
apache-log4j-2.15.0-bin.tar.gz
is the same as the data in
https://downloads.apache.org/logging/log4j/2.15.0/apache-log4j-2.15.0-bin.tar.gz.sha512
shasum --check -a512 apache-log4j-2.15.0-bin.tar.gz.sha512
I had to edit my local copy to match the format expected by shasum.
You can also use OpenSSL:
openssl dgst -sha512 apache-log4j-2.15.0-bin.tar.gz
SHA512(apache-log4j-2.15.0-bin.tar.gz)=
c0e2d704d720bffc99520e5dfbf860ba3cb7f8a34c16a1caa8ce35618370ff06c19e3dc64fc258ad45d4308690551bf34b3ecb7acc0848aa12615f46398cda4a
Gary
On Mon, Dec 13, 2021 at 11:52 AM Daniel Savard <da...@gmail.com>
wrote:
> Hi everyone,
>
> I am trying to authenticate the log4j-2.15 code downloaded from the
> apache.org site and the sha512 file doesn't contain a sha512 hash at all
> and the signature file (.asc) failed to authenticate the parent file.
>
> Anyone can fix this? I cannot patch our system with unauthenticated code.
> Please, provide correct files and authentication files.
>
> Regards,
> -----------------
> Daniel Savard
>