On Mon, Jul 7, 2008 at 2:32 AM, Valient Gough <[EMAIL PROTECTED]> wrote: > Guys, your responses have been completely unhelpful. I see no JIRA > link on the Mina homepage, nor in the FAQ, nor any link for reporting > bugs. If you want people to use JIRA, a link would be helpful. > > So in the mean time it has been weeks and the hash/signatures still do > not match. Here is an easy way to reproduce the problem: > > Visit the Mina download site: http://mina.apache.org/downloads > right-click and save mina-2.0.0-M1.tar.bz2. Now do the same for the > "asc" file just to the right. In another window run gpg on the asc > file, and it will inform you: BAD signature from "Mike Heath > <[EMAIL PROTECTED]>" > > Here are the links that I see from the home page (right-click > copy-link-location for both the .bz2 and the .asc files): > > http://mina.apache.org/dyn/closer.cgi/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2 > http://www.apache.org/dist/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2.asc > > Seeing how easy it is to verify the problem, it is silly to hear > Tuure's vague assertions of user error.
WHile being no expert at GPG, I did just what you described above. Of course, you can't right-click and download MINA from the link you gave as it will only give you the mirror selection page (as pointed out by Tuure). However, choosing a mirror and downloading the file and the signature gave me files that check out fine: $ gpg --keyserver pgp.mit.edu --recv-keys 92E29412 gpg: requesting key 92E29412 from hkp server pgp.mit.edu gpg: key 92E29412: public key "Mike Heath <[EMAIL PROTECTED]>" imported gpg: Total number processed: 1 gpg: imported: 1 $ gpg mina-2.0.0-M1.tar.bz2.asc Detached signature. Please enter name of data file: /media/big/download/mina-2.0.0-M1.tar.bz2 gpg: Signature made Tue 19 Feb 2008 06:55:41 PM CET using DSA key ID 92E29412 gpg: Good signature from "Mike Heath <[EMAIL PROTECTED]>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: C457 B28D B5D7 7D8A 9596 9126 EA5E B0D2 92E2 9412 What mirror did you pick? Maybe there's an issue with the mirror fiddling with the file before downloading? The mirror I used was: http://apache.jumper.nu/mina/2.0.0-M1/mina-2.0.0-M1.tar.bz2 All that said, why doesn't MINA have a KEYS file? At least I failed to find one. /niklas
