On Fri, 9 Jan 2004, Stef Caunter wrote:
> TD Keys reimported as posted on invisible-island.net, td.sig
> saved from attached signature with announcement.
> Subsequent verification attempt produces...
>
> $ gpg --import dickey*
> gpg: key F7E48EDB: "Thomas Dickey <[EMAIL PROTECTED]>" not changed
> gpg: key 688E31A6: "Thomas Dickey <[EMAIL PROTECTED]>" not changed
> gpg: key 7C650E87: "Thomas Dickey <[EMAIL PROTECTED]>" not changed
> gpg: Total number processed: 3
> gpg: unchanged: 3
> $ gpg --verify td.sig lynx2.8.5dev.17.tar.gz
> gpg: Signature made Fri Jan 09 19:26:26 2004 EST using DSA key ID 7C650E87
> gpg: BAD signature from "Thomas Dickey <[EMAIL PROTECTED]>"
>
> Signature shows this version of gnupg:
> Version: GnuPG v1.0.6 (SunOS)^M <-- note extra character FWIW
>
> Keys report 1.2.3 gnupg. Signature obviously comes from posted key, however.
>
> Signature made with the "radix" DSA key won't agree with the downloaded distro;
> surely I am simply doing something wrong...
>
> This happens with and without the ^M characters at line end in the signature
> attached (viewed/edited in vi).
well I'm still learning how to set this up (so it's possible I've made an
error). However:
The files on sf1.isc.org are signed with [EMAIL PROTECTED],
but I sent the email from radix.net since sf1.isc.org doesn't have
mutt (and I'm not sure of their policy for setting up that sort of
thing).
My home machine (technically invisible-island.net) won't do since it's
on Comcast's network which is generally on RBL.
And I haven't finished seeing if I can setup this (pine on
his.com) to handle PGP.
So take the email announcement as an indication of where to look, but
validate the tarballs against the signature indicated in their associated
".asc" files.
(I hope this doesn't become an FAQ ;-)
--
Thomas E. Dickey
http://invisible-island.net
ftp://invisible-island.net
; To UNSUBSCRIBE: Send "unsubscribe lynx-dev" to [EMAIL PROTECTED]
