I've made https://github.com/emilianbold/check-netbeans-integrity which downloads and checks the integrity.
Upon executing that GitHub Action on their infra I see this: ./Apache-NetBeans-12.4-bin-linux-x64.sh: OK [...] gpg: Signature made Wed May 19 11:03:21 2021 UTC gpg: using RSA key 8FE1C26F15E0320E740BAED84A2601CEDA9382F3 gpg: Good signature from "Eric Barboni (Signing Key) <sk...@apache.org>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 8FE1 C26F 15E0 320E 740B AED8 4A26 01CE DA93 82F3 So this confirms to me that at least the GitHub VM also doesn't get corrupted bits. --emi On Mon, Aug 23, 2021 at 5:02 PM Emilian Bold <emilian.b...@gmail.com> wrote: > > Maybe you yourself are being targeted or your disk / RAM is corrupting data. > > --emi > > On Mon, Aug 23, 2021 at 4:46 PM Christian Kruggel <christ...@kruggel.de> > wrote: > > > > Thanks for your feedback. After I droped all GPG-Keys by hand an > > reimported https://downloads.apache.org/netbeans/KEYS I still cann't > > verify Apache-NetBeans-12.4-bin-linux-x64.sh > > > > The sha512 differs for all downloads I had this far (a bit of a miracle > > to me as I assumed that the file is the same throughout all mirrors) and > > like to know, how I can get a dedicated download that uses the file Emi > > managed to verify via sha512 for I'd like to do so too. > > > > Am 22.08.21 um 19:57 schrieb Emilian Bold: > > > Just tested: > > > > > > $ shasum -c Apache-NetBeans-12.4-bin-linux-x64.sh.sha512.txt > > > ./Apache-NetBeans-12.4-bin-linux-x64.sh: OK > > > > > > Not sure which server the CDN pointed me to. Maybe your mirror is > > > corrupted. > > > > > > > > > --emi > > > > > > On Sun, Aug 22, 2021 at 4:41 PM Christian Kruggel <christ...@kruggel.de> > > > wrote: > > >> > > >> Hello everyone, > > >> > > >> I downloaded Apache-NetBeans-12.4-bin-linux-x64.sh from > > >> https://netbeans.apache.org/download/nb124/nb124.html several times and > > >> tried to verify integrity the way that's described here > > >> https://www.apache.org/dyn/closer.cgi#verify > > >> > > >> However I can not verify any download and my fail goes like this (pls > > >> excuse nasty German in between): > > >> > > >> gpg --import KEYS.txt > > >> > > >> gpg: Schlüssel B4C1940FEA9364F1: "Jan Lahoda (Key for signing Apache > > >> NetBeans & co. releases.) <jlah...@apache.org>" nicht geändert > > >> gpg: Schlüssel 13E9F7AE3A4FD551: "geert...@apache.org (Key for signing > > >> Apache NetBeans & co. releases.) <geert...@apache.org>" nicht geändert > > >> gpg: Schlüssel CF7BA0AB1CCF4647: "Emilian Marius Bold <e...@apache.org>" > > >> nicht geändert > > >> gpg: Schlüssel B2BF814FA145CB2D: "Laszlo Kishalmi (CODE SIGNING KEY) > > >> <lkisha...@apache.org>" nicht geändert > > >> gpg: Schlüssel 4A2601CEDA9382F3: "Eric Barboni (Signing Key) > > >> <sk...@apache.org>" nicht geändert > > >> gpg: Schlüssel 3703AC389A12A9D4: "Neil C Smith <neilcsm...@apache.org>" > > >> nicht geändert > > >> gpg: Schlüssel 57D5896CD86C1320: "Reema Taneja (Code Signing Key) > > >> <rtan...@apache.org>" nicht geändert > > >> gpg: Schlüssel E860B148D27236F9: "Jaroslav Tulach (Key for signing > > >> Apache NetBeans & co. releases.) <jtul...@apache.org>" nicht geändert > > >> gpg: Schlüssel 6FA863B0C32A18B1: "Arunava Sinha (CODE SIGNING KEY) > > >> <arusi...@apache.org>" nicht geändert > > >> gpg: Schlüssel 3ED477750C09D18D: "John McDonnell (CODE SIGNING KEY) > > >> <johnmcdonn...@apache.org>" nicht geändert > > >> gpg: Schlüssel 5CDA98F97CD37A42: "Anton Epple <toni.ep...@eppleton.de>" > > >> nicht geändert > > >> gpg: Schlüssel 13548D7CCAFAE80D: "Jaroslav Tulach (2nd key for signing > > >> NetBeans releases) <jtul...@apache.org>" nicht geändert > > >> gpg: Schlüssel 7022397A0BFA52E9: "Geertjan Wielenga > > >> <geert...@apache.org>" nicht geändert > > >> gpg: Anzahl insgesamt bearbeiteter Schlüssel: 13 > > >> gpg: unverändert: 13 > > >> > > >> gpg --verify Apache-NetBeans-12.4-bin-linux-x64.sh.asc > > >> Apache-NetBeans-12.4-bin-linux-x64.sh > > >> > > >> gpg: Signatur vom Mi 19 Mai 2021 13:03:21 CEST > > >> gpg: mittels RSA-Schlüssel > > >> 8FE1C26F15E0320E740BAED84A2601CEDA9382F3 > > >> gpg: FALSCHE Signatur von "Eric Barboni (Signing Key) > > >> <sk...@apache.org>" [unbekannt] > > >> > > >> diff -u Apache-NetBeans-12.4-bin-linux-x64.sh.sha512 <(sha512sum > > >> Apache-NetBeans-12.4-bin-linux-x64.sh) > > >> > > >> --- Apache-NetBeans-12.4-bin-linux-x64.sh.sha512 2021-08-21 > > >> 10:08:34.242825939 +0200 > > >> +++ /dev/fd/63 2021-08-21 10:22:04.844541870 +0200 > > >> @@ -1 +1 @@ > > >> -4866f7bcc0fcc42eb5d00f3ff153b669d84e4b59ba32c776628757d03255d19fff85be364ec1ba9a3559872838103f7074d94d52e6de2039d49208f84b1c59d5 > > >> ./Apache-NetBeans-12.4-bin-linux-x64.sh > > >> +7cf418e70ed85c6ab52b79091178a343be9fedb094f1d29538a353cf22ed1f8f62e955ee0ab3d1b09e2be679148c9fc4898bc23eacfdf8262db739bd519676c0 > > >> Apache-NetBeans-12.4-bin-linux-x64.sh > > >> > > >> Is the file Apache-NetBeans-12.4-bin-linux-x64.sh indeed corrupted or am > > >> I missing something very basic again? > > >> > > >> Any help / hint is highly appreciated. > > >> > > >> Chris > > >> > > >> --------------------------------------------------------------------- > > >> To unsubscribe, e-mail: users-unsubscr...@netbeans.apache.org > > >> For additional commands, e-mail: users-h...@netbeans.apache.org > > >> > > >> For further information about the NetBeans mailing lists, visit: > > >> https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists > > >> > > > > > > --------------------------------------------------------------------- > > > To unsubscribe, e-mail: users-unsubscr...@netbeans.apache.org > > > For additional commands, e-mail: users-h...@netbeans.apache.org > > > > > > For further information about the NetBeans mailing lists, visit: > > > https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists > > > > > > > > --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@netbeans.apache.org For additional commands, e-mail: users-h...@netbeans.apache.org For further information about the NetBeans mailing lists, visit: https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
