#185 Bad signature on https://cloud.centos.org/centos/8-stream/x86_64/images/CHECKSUM
Closed: Fixed by carlwgeorge. Opened by oseibertsys11.

Hi there!

I wanted to download your cloud image in https://cloud.centos.org/centos/8-stream/x86_64/images/. When I verified the signature on the CHECKSUM file, it was reported as BAD.

Can you please re-verify the integrity of the downloadable files and then re-sign?

Thanks.

Transcript:

$ wget https://cloud.centos.org/centos/8-stream/x86_64/images/CHECKSUM
--2021-01-08 13:22:30--https://cloud.centos.org/centos/8-stream/x86_64/images/CHECKSUM
Resolving cloud.centos.org (cloud.centos.org)... 94.130.67.19,2a01:4f8:10b:30ac::1
Connecting to cloud.centos.org (cloud.centos.org)|94.130.67.19|:443...
connected.
HTTP request sent, awaiting response... 200 OK
Length: 2488 (2.4K)
Saving to: CHECKSUM

CHECKSUM
100%[============================================================================>]
  2.43K  --.-KB/s    in 0s

2021-01-08 13:22:31 (83.5 MB/s) - CHECKSUM saved [2488/2488]

$ wget https://cloud.centos.org/centos/8-stream/x86_64/images/CHECKSUM.asc
--2021-01-08 13:22:32--https://cloud.centos.org/centos/8-stream/x86_64/images/CHECKSUM.asc
Resolving cloud.centos.org (cloud.centos.org)... 94.130.67.19,2a01:4f8:10b:30ac::1
Connecting to cloud.centos.org (cloud.centos.org)|94.130.67.19|:443...
connected.
HTTP request sent, awaiting response... 200 OK
Length: 812 [text/plain]
Saving to: CHECKSUM.asc

CHECKSUM.asc
100%[============================================================================>]
    812  --.-KB/s    in 0s

2021-01-08 13:22:33 (27.0 MB/s) - CHECKSUM.asc saved [812/812]

$ gpg --verify ./CHECKSUM.asc ./CHECKSUM
gpg: Signature made Tue Dec 22 10:23:34 2020 UTC
gpg:                using RSA key 05B555B38483C65D
gpg: BAD signature from "CentOS (CentOS Official Signing Key)<security@centos.org>" [unknown]

Metadata Update from @arrfab:
- Issue assigned to bstinson
- Issue priority set to: Waiting on Reporter (was: Needs Review)
- Issue tagged with: low-trouble, medium-gain

Metadata Update from @arrfab:
- Issue tagged with: centos-build-pipeline

I don't know when it happened, but this appears to be resolved now.

$ curl -s https://cloud.centos.org/centos/8-stream/x86_64/images/CHECKSUM.asc | gpg --verify
gpg: Signature made Thu Feb 11 20:30:42 2021 UTC
gpg:                using RSA key 05B555B38483C65D
gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: Good signature from "CentOS (CentOS Official Signing Key) <security@centos.org>" [ultimate]

Metadata Update from @carlwgeorge:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

Log in to comment on this ticket.

Metadata