6:11 p.m.
Following info on https://getfedora.org/en/security/
gpgv --keyring ./fedora.gpg *-CHECKSUM
gpgv: not a detached signature
I think a little correction is warranted.
AV
9:33 p.m.
On 11/18/22 16:11, AV via test wrote:
Following info on https://getfedora.org/en/security/
gpgv --keyring ./fedora.gpg *-CHECKSUM
gpgv: not a detached signature
I think a little correction is warranted.
You need to give more specific information about what exactly you tried.
I followed the instructions there and it worked as expected.
$ gpgv --keyring ./fedora.gpg *-CHECKSUM
gpgv: Signature made Thu 10 Nov 2022 11:56:12 AM PST
gpgv: using RSA key ACB5EE4E831C74BB7C168D27F55AD3FB5323552A
gpgv: Good signature from "Fedora (37)
<fedora-37-primary(a)fedoraproject.org>"
5:18 p.m.
On Sat, 2022-11-19 at 19:33 -0800, Samuel Sieb wrote:
On 11/18/22 16:11, AV via test wrote:
> Following info on https://getfedora.org/en/security/
>
> gpgv --keyring ./fedora.gpg *-CHECKSUM
> gpgv: not a detached signature
>
> I think a little correction is warranted.
You need to give more specific information about what exactly you
tried.
I followed the instructions there and it worked as expected.
I discovered today what happened. I had downloaded both
Fedora-Workstation and Fedora-Everything together with
their CHECKSUMS into the same folder.
If you then try "gpgv --keyring ./fedora.gpg *-CHECKSUM"
it results in this error message.
Remove one of the two from the folder and it works as
expected.
But as yet it is not clear to me why this error message
meant for another situation.
AV
1:20 a.m.
On Mon, 2022-11-21 at 00:18 +0100, AV via test wrote:
On Sat, 2022-11-19 at 19:33 -0800, Samuel Sieb wrote:
> On 11/18/22 16:11, AV via test wrote:
> > Following info on https://getfedora.org/en/security/
> >
> > gpgv --keyring ./fedora.gpg *-CHECKSUM
> > gpgv: not a detached signature
> >
> > I think a little correction is warranted.
>
> You need to give more specific information about what exactly you
> tried.
> I followed the instructions there and it worked as expected.
I discovered today what happened. I had downloaded both
Fedora-Workstation and Fedora-Everything together with
their CHECKSUMS into the same folder.
If you then try "gpgv --keyring ./fedora.gpg *-CHECKSUM"
it results in this error message.
Remove one of the two from the folder and it works as
expected.
But as yet it is not clear to me why this error message
meant for another situation.
I think this is probably the explanation, from `man gpgv`:
EXAMPLES
gpgv pgpfile
gpgv sigfile [datafile]
Verify the signature of the file. The second form is used for detached
signatures, where sigfile is the detached signature (either ASCII-armored or binary) and
datafile
contains the signed data; if datafile is "-" the signed data is
expected on stdin; if datafile is not given the name of the file holding the signed data
is constructed by
cutting off the extension (".asc", ".sig" or
".sign") from sigfile.
The command given in the instructions uses the wildcard (*-CHECKSUM)
because we don't know exactly what the file will be called. It's
expecting that wildcard to match just one file, the one we want to
check. But because you downloaded two to the same directory, the
wildcard matches both of them, so now you're passing two files to gpgv.
As the above says, passing two files makes it think you're giving it
one file with the signature only and one file with the signed data -
but then it parses the first file and realizes it *isn't* just a
signature, so it errors out.
--
Adam Williamson
Fedora QA
IRC: adamw | Twitter: adamw_ha
https://www.happyassassin.net
2:39 a.m.
On Mon, Nov 21, 2022 at 12:18 AM AV via test <test(a)lists.fedoraproject.org>
wrote:
On Sat, 2022-11-19 at 19:33 -0800, Samuel Sieb wrote:
> On 11/18/22 16:11, AV via test wrote:
> > Following info on https://getfedora.org/en/security/
> >
> > gpgv --keyring ./fedora.gpg *-CHECKSUM
> > gpgv: not a detached signature
> >
> > I think a little correction is warranted.
>
> You need to give more specific information about what exactly you
> tried.
> I followed the instructions there and it worked as expected.
I discovered today what happened. I had downloaded both
Fedora-Workstation and Fedora-Everything together with
their CHECKSUMS into the same folder.
If you then try "gpgv --keyring ./fedora.gpg *-CHECKSUM"
it results in this error message.
Remove one of the two from the folder and it works as
expected.
But as yet it is not clear to me why this error message
meant for another situation.
Can you file a bug or a pull request at
https://pagure.io/fedora-web/websites/ ? I think the command should be
modified to:
$ gpgv --keyring ./fedora.gpg CHECKSUM_FILE
and the description should state to replace CHECKSUM_FILE with an actual
checksum file name. I agree that currently it's confusing because it looks
like it can handle processing multiple checksum files together (which is
the case for sha256sum, but not for gpgv).
Thanks!
11:24 a.m.
On Mon, 2022-11-21 at 09:39 +0100, Kamil Paral wrote:
On Mon, Nov 21, 2022 at 12:18 AM AV via test
<test(a)lists.fedoraproject.org>
wrote:
> On Sat, 2022-11-19 at 19:33 -0800, Samuel Sieb wrote:
> > On 11/18/22 16:11, AV via test wrote:
> > > Following info on https://getfedora.org/en/security/
> > >
> > > gpgv --keyring ./fedora.gpg *-CHECKSUM
> > > gpgv: not a detached signature
> > >
> > > I think a little correction is warranted.
> >
> > You need to give more specific information about what exactly you
> > tried.
> > I followed the instructions there and it worked as expected.
>
> I discovered today what happened. I had downloaded both
> Fedora-Workstation and Fedora-Everything together with
> their CHECKSUMS into the same folder.
> If you then try "gpgv --keyring ./fedora.gpg *-CHECKSUM"
> it results in this error message.
> Remove one of the two from the folder and it works as
> expected.
> But as yet it is not clear to me why this error message
> meant for another situation.
>
Can you file a bug or a pull request at
https://pagure.io/fedora-web/websites/ ? I think the command should be
modified to:
$ gpgv --keyring ./fedora.gpg CHECKSUM_FILE
and the description should state to replace CHECKSUM_FILE with an actual
checksum file name. I agree that currently it's confusing because it looks
like it can handle processing multiple checksum files together (which is
the case for sha256sum, but not for gpgv).
Well, the point of the asterisk is to make it so you can just copy-and-
paste and run the command and it will find whatever (assumed single)
CHECKSUM file is present - it saves the user having to manually modify
the command.
--
Adam Williamson
Fedora QA
IRC: adamw | Twitter: adamw_ha
https://www.happyassassin.net
2:28 a.m.
On Mon, Nov 21, 2022 at 6:34 PM Adam Williamson <adamwill(a)fedoraproject.org>
wrote:
Well, the point of the asterisk is to make it so you can just
copy-and-
paste and run the command and it will find whatever (assumed single)
CHECKSUM file is present - it saves the user having to manually modify
the command.
That's a good point, but I think it's the wrong thing to do there. The
important goal as I see it is that people can verify their images (in all
cases, even if they download multiple), and saving a few seconds for a
command which is likely to work mostly but not always is not a good
tradeoff, in my view. Man pages are also written clearly.
514
days inactive
517
days old
6 comments
4 participants
participants (4)
-
Adam Williamson -
AV -
Kamil Paral -
Samuel Sieb