GPG signature incorrect for Vivid's SHA1SUMS

Aliz 'Randomdude' randomdude at gmail.com
Mon Aug 17 21:23:03 UTC 2015


Hi list.

I'm unable to validate the gpg signature located at
http://releases.ubuntu.com/vivid/SHA1SUMS.gpg correctly, though I can
validate SHA256SUMS and MD5SUMS files.

user at box:~$ gpg --verify SHA1SUMS.gpg SHA1SUMS
gpg: Signature made Mon 03 Aug 2015 05:52:38 PM BST using DSA key ID FBB75451
gpg: BAD signature from "Ubuntu CD Image Automatic Signing Key
<cdimage at ubuntu.com>"

Other files verify correctly.

user at box:~$ gpg --verify SHA256SUMS.gpg SHA256SUMS
gpg: Signature made Mon 03 Aug 2015 05:52:04 PM BST using DSA key ID FBB75451
gpg: Good signature from "Ubuntu CD Image Automatic Signing Key
<cdimage at ubuntu.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: C598 6B4F 1257 FFA8 6632  CBA7 4618 1433 FBB7 5451
user at box:~$ gpg --verify MD5SUMS.gpg MD5SUMS
gpg: Signature made Mon 03 Aug 2015 05:52:04 PM BST using DSA key ID FBB75451
gpg: Good signature from "Ubuntu CD Image Automatic Signing Key
<cdimage at ubuntu.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: C598 6B4F 1257 FFA8 6632  CBA7 4618 1433 FBB7 5451

The hashes themselves seem to be correct:

user at box:~$ cat SHA1SUMS | sha1sum -c
ubuntu-15.04-desktop-amd64.iso: OK
[ other output omitted ]

Am I doing something dumb here? I almost didn't send this email - I'm
going to look so stupid if I've got a misconfiguration somewhere! I've
tried this on different boxes, from different internet connections,
and even gotten my internet friends to try it -

Hashes of the files themselves:

user at box:~$ sha256sum *
5e697c5f2f72c6262dfa6b9aa7d029026fd9b1163ab795ad84a01e17b19ee221  MD5SUMS
6e8496eaa18930b5123f3bdb92bc59c9a9dfcba54eec5c248649cbc443885d54  MD5SUMS.gpg
2eb2cb49df34c79975974172f6c4db8ff2df62108e751ba72fa7206403a37516  SHA1SUMS
1f6396906f928ee26a4a6f698c3cb6ee7791fabe541b0e79c54e638da3c79183  SHA1SUMS.gpg
14dd3d068a5e7db6d4bed18017d936655f7e0ea9f7c7862835cbd699e85feac4  SHA256SUMS
ee3505e09b73bff08389846efedc86f3c06be860220a6569825c33e3544e8d57  SHA256SUMS.gpg

Relevant file sizes:
user at box:~$ ls -l SHA1SUMS SHA1SUMS.gpg
-rw-rw-r-- 1 user user 612 Aug  3 17:52 SHA1SUMS
-rw-rw-r-- 1 user user 198 Aug  3 17:52 SHA1SUMS.gpg

The signature I'm unable to verify:
user at box:~$ cat SHA1SUMS.gpg
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEABECAAYFAlW/nFYACgkQRhgUM/u3VFE76gCfXUS9L+mJyRkhdGNNyQWi4A8J
naEAnjS722DJQuhpNvVIFr1DifrRFkfU
=AnSp
-----END PGP SIGNATURE-----



More information about the Ubuntu-release mailing list