Bond, Ann Marie wrote:
I’ve downloaded the latest version of the OpenSSL source code here http://www.openssl.org/source/ but I can’t seem to download the associated PGP signature to verify the download. It shows up as an empty file. When I click on the link, there’s nothing there.
The files are actually there - it is just that the web server is reporting that they are gzipped which is confusing the browser somewhat. I must admit I've never fetch those files in a web browser so I hadn't noticed that myself.
You can use tools like wget (or even telnet) to fetch the files to confirm the official release packages.
Tim. ---8<--- wget http://www.openssl.org/source/openssl-0.9.8h.tar.gz.asc [EMAIL PROTECTED] ~> telnet www.openssl.org http Trying 195.30.6.166... Connected to master.openssl.org. Escape character is '^]'. GET /source/openssl-0.9.8h.tar.gz.asc HTTP/1.0 <==== you type this <==== and this (enter) HTTP/1.1 200 OK Date: Tue, 09 Sep 2008 10:06:02 GMT Server: Apache/1.3.33 (OpenPKG/2.5) Last-Modified: Wed, 28 May 2008 07:58:46 GMT ETag: "1ff1407-133-483d10b6" Accept-Ranges: bytes Content-Length: 307 Connection: close Content-Type: text/plain Content-Encoding: x-gzip <==== this is the bit confusing the browser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQCVAwUASD0dkO6tTP1JpWPZAQJMgQQA1uNNsE3glGWl8+fxcmcnrsXbnAe/xIq1 oMa1mHdAMTjgfQV+2SrKD18mQejGy9SlQXiB93kIZk+Z9/KbSS/pMs1iKoYOTG9D GhoGCmWa3VnhZhdW6ErmsENYsXWakt5Lzymh9Smg/JGoVhR17JWAIKfGE9x0PTvW Wx2JWLckQkM= =IEaW -----END PGP SIGNATURE-----
PGP.sig
Description: PGP signature
