Niklas Gustavsson wrote:
On Mon, Jul 7, 2008 at 2:32 AM, Valient Gough [EMAIL PROTECTED] wrote:
Guys, your responses have been completely unhelpful. I see no JIRA
link on the Mina homepage, nor in the FAQ, nor any link for reporting
bugs. If you want people to use JIRA, a link would be helpful.
So in the mean time it has been weeks and the hash/signatures still do
not match. Here is an easy way to reproduce the problem:
Visit the Mina download site: http://mina.apache.org/downloads
right-click and save mina-2.0.0-M1.tar.bz2. Now do the same for the
asc file just to the right. In another window run gpg on the asc
file, and it will inform you: BAD signature from Mike Heath
[EMAIL PROTECTED]
Here are the links that I see from the home page (right-click
copy-link-location for both the .bz2 and the .asc files):
http://mina.apache.org/dyn/closer.cgi/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2
http://www.apache.org/dist/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2.asc
Seeing how easy it is to verify the problem, it is silly to hear
Tuure's vague assertions of user error.
WHile being no expert at GPG, I did just what you described above. Of
course, you can't right-click and download MINA from the link you gave
as it will only give you the mirror selection page (as pointed out by
Tuure). However, choosing a mirror and downloading the file and the
signature gave me files that check out fine:
$ gpg --keyserver pgp.mit.edu --recv-keys 92E29412
gpg: requesting key 92E29412 from hkp server pgp.mit.edu
gpg: key 92E29412: public key Mike Heath [EMAIL PROTECTED] imported
gpg: Total number processed: 1
gpg: imported: 1
$ gpg mina-2.0.0-M1.tar.bz2.asc
Detached signature.
Please enter name of data file: /media/big/download/mina-2.0.0-M1.tar.bz2
gpg: Signature made Tue 19 Feb 2008 06:55:41 PM CET using DSA key ID 92E29412
gpg: Good signature from Mike Heath [EMAIL PROTECTED]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: C457 B28D B5D7 7D8A 9596 9126 EA5E B0D2 92E2 9412
What mirror did you pick? Maybe there's an issue with the mirror
fiddling with the file before downloading? The mirror I used was:
http://apache.jumper.nu/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2
I don't get the same result :
[EMAIL PROTECTED]:~/Desktop$ gpg mina-2.0.0-M1.tar.bz2.asc
Detached signature.
Please enter name of data file: mina-2.0.0-M1.tar.bz2
gpg: Signature made Tue 19 Feb 2008 06:55:41 PM CET using DSA key ID
92E29412
gpg: Can't check signature: public key not found
[EMAIL PROTECTED]:~/Desktop$ cat mina-2.0.0-M1.tar.bz2.asc
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQBHuxgd6l6w0pLilBIRAo69AKCV9KP+KhwI4gO6pSANkyV+zBpV2wCfST6N
bopYxnsNW1s0QKnVQo+YdnI=
=2Q/v
-END PGP SIGNATURE-
[EMAIL PROTECTED]:~/Desktop$
Obviously, something is wrong, and obviously, we have to fix it. It may
depends on the mirror, but that would means that we are not the only one
project being impacted.
Tuure, can you please post the exact sequence of commands you are using
and the mirror you are downloading files from ?
All that said, why doesn't MINA have a KEYS file? At least I failed to find one.
Really ? Too bad that I have a limited network access with my $*µ%!
ISP, but I was pretty sure there were KEYS somewhere for MINA. Will
check that tomorrow. If it's missing, then we have to create this file.
Thanks Niklas !
--
--
cordialement, regards,
Emmanuel Lécharny
www.iktek.com
directory.apache.org
