I believe this one was my fault, letting a winter cold affect my under-the-gun troubleshooting here (and having a bit of "trouble" with your mirroring scheme, as presented on the website). I would not worry about it unless you get additional reports.
Thank you for your die-diligence, and sorry to waste your time. Regards, Russell -- Russell M. Van Tassell [email protected] / [email protected] Google Voice: 408/DUG-UNIX (408/384-8649) This message was sent from my wireless handheld device™ ----- Reply message ----- From: "Deng Ching" <[email protected]> To: "Van Tassell, Russell -c" <[email protected]> Cc: "[email protected]" <[email protected]> Subject: Archiva Failing Basic Authenticity Checks Date: Sun, Dec 18, 2011 7:32 pm Hi Russell, Sorry for the late reply, I was away the entire weekend and wasn't able to check my mail. I'll take a look at the problem you've encountered though I haven't received any emails from Henk (who regularly checks the Apache releases repo for bad checksums) regarding these problems with 1.3.5. Thanks, Deng On Sat, Dec 17, 2011 at 7:19 AM, Van Tassell, Russell -c <[email protected]<mailto:[email protected]>> wrote: Note: I have since obtained a “good” copy of the binary. (/grumble) From: Van Tassell, Russell -c Sent: Friday, December 16, 2011 2:51 PM To: '[email protected]<mailto:[email protected]>' Subject: FW: Archiva Failing Basic Authenticity Checks Importance: High FYI – Please let me know if there are better contact addresses, here. Regards, Russell From: Van Tassell, Russell -c Sent: Friday, December 16, 2011 2:19 PM To: 'Maria Odea Ching' Subject: Archiva Failing Basic Authenticity Checks Importance: High Maria – I am contacting you because you seem to own the signing key for the Apache Archiva distribution. So, right now (and earlier this week), it appears as though the Archiva package downloads are failing basic checksums and signature checks… this can’t be good. Note that the *.zip file has also changed a couple of times, recently (as-though it’s being actively replaced on one or more mirrors, or the master). Help? Regards, Russell rvantassell@maven { ~/pub/archiva }$ ls -l total 156 -rw-r--r-- 1 rvantassell unixadm 29186 Dec 16 14:03 apache-archiva-1.3.5-bin.tar.gz -rw-r--r-- 1 rvantassell unixadm 194 Nov 2 18:06 apache-archiva-1.3.5-bin.tar.gz.asc -rw-r--r-- 1 rvantassell unixadm 32 Nov 2 18:06 apache-archiva-1.3.5-bin.tar.gz.md5 -rw-r--r-- 1 rvantassell unixadm 28890 Dec 12 16:21 apache-archiva-1.3.5-bin.zip -rw-r--r-- 1 rvantassell unixadm 28864 Dec 16 14:03 apache-archiva-1.3.5-bin.zip.1 -rw-r--r-- 1 rvantassell unixadm 194 Nov 2 18:06 apache-archiva-1.3.5-bin.zip.asc -rw-r--r-- 1 rvantassell unixadm 194 Nov 2 18:06 apache-archiva-1.3.5-bin.zip.asc.1 -rw-r--r-- 1 rvantassell unixadm 32 Nov 2 18:06 apache-archiva-1.3.5-bin.zip.md5 -rw-r--r-- 1 rvantassell unixadm 32 Nov 2 18:06 apache-archiva-1.3.5-bin.zip.md5.1 -rw-r--r-- 1 rvantassell unixadm 28456 Dec 12 16:21 apache-archiva-1.3.5.war -rw-r--r-- 1 rvantassell unixadm 194 Nov 2 18:06 apache-archiva-1.3.5.war.asc -rw-r--r-- 1 rvantassell unixadm 32 Nov 2 18:06 apache-archiva-1.3.5.war.md5 rvantassell@maven { ~/pub/archiva }$ gpg apache-archiva-1.3.5-bin.tar.gz.asc gpg: Signature made Mon 16 May 2011 11:51:14 PM PDT using DSA key ID C625BAFB gpg: BAD signature from "Maria Odea Ching <[email protected]<mailto:[email protected]>>" rvantassell@maven { ~/pub/archiva }$ gpg apache-archiva-1.3.5-bin.zip.asc gpg: Signature made Mon 16 May 2011 11:51:15 PM PDT using DSA key ID C625BAFB gpg: BAD signature from "Maria Odea Ching <[email protected]<mailto:[email protected]>>" rvantassell@maven { ~/pub/archiva }$ gpg apache-archiva-1.3.5.war.asc gpg: Signature made Mon 16 May 2011 11:49:01 PM PDT using DSA key ID C625BAFB gpg: BAD signature from "Maria Odea Ching <[email protected]<mailto:[email protected]>>" rvantassell@maven { ~/pub/archiva }$ md5sum apache-archiva-1.3.5-bin.tar.gz apache-archiva-1.3.5-bin.zip apache-archiva-1.3.5-bin.zip.1 apache-archiva-1.3.5.war 6ccaf69a42997e2bde9ee3b6909ee36d apache-archiva-1.3.5-bin.tar.gz 86c5cc5a4da177aa4856b59afc6ccd1f apache-archiva-1.3.5-bin.zip 6d5b0d62c58353ac5e2c0c1eda190f80 apache-archiva-1.3.5-bin.zip.1 53dc199fc24c88e3134ea10ed5f8fa3a apache-archiva-1.3.5.war { ~/pub/archiva }$ more *md5 :::::::::::::: apache-archiva-1.3.5-bin.tar.gz.md5 :::::::::::::: bc1e6ca2254ade72194bad1d1e24af3d :::::::::::::: apache-archiva-1.3.5-bin.zip.md5 :::::::::::::: a0eb9d888cfb159d7283931d8b439838 :::::::::::::: apache-archiva-1.3.5.war.md5 :::::::::::::: a0725b284cf428dda117b6138f6d8412 rvantassell@maven { ~/pub/archiva }$
