Re: [Announce] GnuPG 2.1.17 released

2016-12-20 Thread Christoph Moench-Tegeder
## Christoph Moench-Tegeder (c...@burggraben.net):

> This fails:
> gpg: Signature made Tue Dec 20 11:33:11 2016 CET

Since then, this has been fixed:
gpg: Signature made Tue Dec 20 14:59:50 2016 CET
gpg:using RSA key D8692123C4065DEA5E0F3AB5249B39D24F25E3B6
gpg: Good signature from "Werner Koch (dist sig)" [unknown]

Note the newer timestamp. Also, HTTP reports that the signature has been
replaced: "Last-Modified: Tue, 20 Dec 2016 14:05:28 GMT"

(Almost) everything is fine,
Christoph

-- 
Spare Space

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users


Re: [Announce] GnuPG 2.1.17 released

2016-12-20 Thread Christoph Moench-Tegeder
Hi,

I believe there's something wrong with the signature of the latest
release.

## Werner Koch (w...@gnupg.org):

>  * If you already have a version of GnuPG installed, you can simply
>verify the supplied signature.  For example to verify the signature
>of the file gnupg-2.1.17.tar.bz2 you would use this command:
> 
>  gpg --verify gnupg-2.1.17.tar.bz2.sig gnupg-2.1.17.tar.bz2

This fails:
gpg: Signature made Tue Dec 20 11:33:11 2016 CET
gpg:using RSA key D8692123C4065DEA5E0F3AB5249B39D24F25E3B6
gpg: BAD signature from "Werner Koch (dist sig)" [unknown]

But the SHA1 hash of the release tarball matches the one in the
release announcement.
I downloaded directly from gnupg.org. For reference, the hashes of
the release file and the signature (as downloaded here) are:

SHA1 (gnupg-2.1.17.tar.bz2) = d83ab893faab35f37ace772ca29b939e6a5aa6a7
SHA1 (gnupg-2.1.17.tar.bz2.sig) = 34cea3e6d139cb340bf14f04ff217cb6960cf36d

Or is that just me and a local issue?

Regards,
Christoph

-- 
Spare Space

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users


Re: Different SHA1 Checksum using Microsoft file checksum integrity verifier

2016-01-24 Thread Christoph Moench-Tegeder
## W Wong (wwongwong2...@gmail.com):

> 4a88f90a01b0ba8e3eb0073f7b6a4bfb ..\..\downloads\gpg4win-2.3.0.exe

That is the MD5 checksum of the gpg4win-2.3.0.exe file, which has
the SHA1 checksum 88d90ee9a1ea3e66b198ea866063140b882444d5.

Regards,
Christoph

-- 
Spare Space

___
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users