Your message dated Tue, 19 Jan 2016 14:44:30 +0100
with message-id <[email protected]>
and subject line confusing warning gone
has caused the Debian Bug report #756193,
regarding improve validation output, it _seems_ not to properly verify downloads
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
756193: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756193
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
package: torbrowser-launcher
severity: important
tags: upstream
Hi,
when running torbrowser-launcher I just saw this:
Running task: download_tarball
Downloading https://www.torproject.org/dist/torbrowser/3.6.3/tor-browser-
linux64-3.6.3_en-US.tar.xz
Updating over Tor
Finished receiving body: Response body fully received
Running task: verify
Verifying signature
gpg: Signature made Thu Jul 24 10:45:33 2014 CEST using RSA key ID 0E3A92E4
gpg: Good signature from "Mike Perry (Regular use key)
<[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: C963 C21D 6356 4E2B 10BB 335B 2984 6B3C 6836 86CC
Subkey fingerprint: D734 B622 C7B5 D164 D665 0CB8 717F 1F13 0E3A 92E4
Running task: extract
Extracting tor-browser-linux64-3.6.3_en-US.tar.xz
Running task: run
Running /home/foo/.torbrowser/tbb/x86_64/tor-browser_en-US/start-tor-browser
So it _seems_ there gpg cannot verify the download!
If that's really the case, it's horrible. If it's just a wrong warning, it
still should be fixed as we dont want to train users to ignore security
warnings :-/
cheers,
Holger
signature.asc
Description: This is a digitally signed message part.
--- End Message ---
--- Begin Message ---
version: 0.1.9-1+deb8u3
Hi,
the confusing warning is gone, thus closing.
cheers,
Holger
signature.asc
Description: This is a digitally signed message part.
--- End Message ---
