[OPENMEETINGS-2720] Bad signatures and checksums

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Implemented
• Affects Version/s: 6.2.0
• Component/s: Release
• Labels: newbie security

Language

English

• Assignee: Sebastian Wagner
• Reporter: Georg Pfuetzenreuter
• Created: 07/Feb/22 19:27
• Updated: 14/Feb/22 04:40
• Resolved: 14/Feb/22 04:40

Description

Hi,

Hoping this has not already been discussed in a ticket my search query did not cover.

I noticed all the SHA512 sums do not match the archive files, and the signatures all verify as BAD - besides the SHA512 files not being formatted properly:

 

## TAR binary
$ sha512sum -c apache-openmeetings-6.2.0.tar.gz               
sha512sum: apache-openmeetings-6.2.0.tar.gz: no properly formatted SHA512 checksum lines found

$ cat apache-openmeetings-6.2.0.tar.gz.sha512               
37a42ce7b4ee954013c09820e6501f8996d357327cebeff1e8b125ba3dc74f86f961d2175c81ec7951ce30b255ec833f3118465b838aa543dac3b7a9f85452ca                                                                                    
$ sha512sum apache-openmeetings-6.2.0.tar.gz
69373cf1bb1c2a7344a0e8554bccdb999dd360dda0c6fe653c0936a38c3e4a7c62c95a0a33734d0a88e01bf53930fd5d38efaadce42f88ce57dbb88572f82dda  apache-openmeetings-6.2.0.tar.gz

$ gpg --verify apache-openmeetings-6.2.0.tar.gz.asc apache-openmeetings-6.2.0.tar.gz               
gpg: Signature made Thu 21 Oct 2021 10:20:02 AM CEST
gpg:                using RSA key BF13CF11F9C90CBE441309AB005516BF93A30395
gpg: BAD signature from "Sebastian Wagner <[e-mail]>" [unknown]

## ZIP binary
$ sha512sum -c apache-openmeetings-6.2.0.zip.sha512               
sha512sum: apache-openmeetings-6.2.0.zip.sha512: no properly formatted SHA512 checksum lines found
$ cat apache-openmeetings-6.2.0.zip.sha512               
95271a35856ea2f80795f30a032f4677f2e5232dcf329ad727897ff48144a31fccfd320b250c4f9ce147c5b7c31f8d437fe487e29df9eb4e3181c36a3546d585                                                                                    
$ sha512sum apache-openmeetings-6.2.0.zip
7270b3c006d2a1000caa1c1e4f1cc850c74631a821343b8433d81605d048907742b5ced76db02154cad0a215726335ebbb1fc55e741b9474c6d4a09eb51bf645  apache-openmeetings-6.2.0.zip

$ gpg --verify apache-openmeetings-6.2.0.zip.asc apache-openmeetings-6.2.0.zip               
gpg: Signature made Thu 21 Oct 2021 10:20:04 AM CEST
gpg:                using RSA key BF13CF11F9C90CBE441309AB005516BF93A30395
gpg: BAD signature from "Sebastian Wagner <[e-mail]>" [unknown]

## TAR SOURCE
$ sha512sum -c apache-openmeetings-6.2.0-src.tar.gz.sha512               
sha512sum: apache-openmeetings-6.2.0-src.tar.gz.sha512: no properly formatted SHA512 checksum lines found

$ cat apache-openmeetings-6.2.0-src.tar.gz.sha512               
dc93c6ea409a560c588babac09d0eea3008ce0c4656061c10b8a0b10ed6a832dea010a7855df8f238dfaf80fdf8b13f57966b7c169952ada8063baaa5f3779c9

$ sha512sum apache-openmeetings-6.2.0-src.tar.gz               
7debb392b67eec85c6444dd64d0ca3ecc3753025a2bf96cac8224085caded9cfac016c0844f420a280676bdf366daecc01d1fd4377f42d8ad8e8025b42427f83  apache-openmeetings-6.2.0-src.tar.gz

$ gpg --verify apache-openmeetings-6.2.0-src.tar.gz.asc apache-openmeetings-6.2.0-src.tar.gz               
gpg: Signature made Thu 21 Oct 2021 10:20:04 AM CEST
gpg:                using RSA key BF13CF11F9C90CBE441309AB005516BF93A30395
gpg: BAD signature from "Sebastian Wagner <[e-mail]>" [unknown]

##ZIP SOURCE
$ sha512sum -c apache-openmeetings-6.2.0-src.zip.sha512               
sha512sum: apache-openmeetings-6.2.0-src.zip.sha512: no properly formatted SHA512 checksum lines found

$ cat apache-openmeetings-6.2.0-src.zip.sha512               
86f1ee26f0edd3ee3c4de078380951e634e2c207b1e3653ea6f3b0c4569320effc8d195e7afb8353401a6e8cba6be3d6dcda58c4bfcffef41de7889d778098d5

$ gpg --verify apache-openmeetings-6.2.0-src.zip.asc apache-openmeetings-6.2.0-src.zip               
gpg: Signature made Thu 21 Oct 2021 10:20:04 AM CEST
gpg:                using RSA key BF13CF11F9C90CBE441309AB005516BF93A30395
gpg: BAD signature from "Sebastian Wagner <[e-mail]>" [unknown]

I acquired the files and the public keys using the links on this page:
https://openmeetings.apache.org/downloads.html

Given that it shows the same behavior on all files I assume the issue is not on my end.

Is this project still maintained?
If so, it would be fantastic if the signatures and checksums could be repaired.
If not, I suggest placing a notice on the download page.

Thanks for your great work with this software!

Best,
Georg