[OPENMEETINGS-1901] gpg validation of zip file download failed with BAD signature

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Cannot Reproduce
• Affects Version/s: 4.0.4
• Component/s: Builds
• Labels: security
• Assignee: Steve R Wagner
• Reporter: Patrick Simon
• Created: 08/Jul/18 19:09
• Updated: 18/Jul/18 01:55
• Resolved: 18/Jul/18 01:55

Description

verification of download zip file failed

I followed the instructions on the download page to verify apache-openmeetings-4.0.4.zip.

steps and environment details:

all files downloaded from site through firefox on Windows 10
KEYS file saved as apache-openmeetings-KEYS
all other files saved as named on the download site

verification attempted using the following commands from bash on ubuntu on Windows 10 in the folder where all files located

$ gpg --import apache-openmeetings-KEYS
gpg: directory `/home/xxx/.gnupg' created
gpg: new configuration file `/home/xxxx/.gnupg/gpg.conf' created
gpg: WARNING: options in `/home/xxxx/.gnupg/gpg.conf' are not yet active during this run
gpg: keyring `/home/xxxx/.gnupg/secring.gpg' created
gpg: keyring `/home/xxxx/.gnupg/pubring.gpg' created
gpg: /home/psimon/.gnupg/trustdb.gpg: trustdb created
gpg: key 93A30395: public key "Sebastian Wagner <[e-mail]>" imported
gpg: key D27B0B59: public key "Eugen Schwert (CODE SIGNING KEY) <[e-mail]>" imported
gpg: key C467526E: public key "Maxim Solodovnik (solomax) <[e-mail]>" imported
gpg: key C1D03D7A: public key "German Grekhov <[e-mail]>" imported
gpg: Total number processed: 4
gpg: imported: 4 (RSA: 4)

$ gpg --verify apache-openmeetings-4.0.4.zip.asc apache-openmeetings-4.0.4.zip
gpg: Signature made Fri 25 May 2018 12:22:55 PM DST using RSA key ID C467526E
gpg: BAD signature from "Maxim Solodovnik (solomax) <[e-mail]>"