search

opencog / link-grammar

The CMU Link Grammar natural language parser
GNU Lesser General Public License v2.1
389 stars 119 forks source link

Tarball for 5.12.4 reports a bad GPG signature #1521

Closed serebit closed 6 months ago

serebit commented 6 months ago

Steps to reproduce

wget https://www.gnucash.org/link-grammar/5.12.4/link-grammar-5.12.4.tar.gz{,.asc}
gpg --verify link-grammar-5.12.4.tar.gz.asc

This outputs the following on my machine after recving the keys:

gpg: assuming signed data in 'link-grammar-5.12.4.tar.gz'
gpg: Signature made Fri 29 Mar 2024 12:48:40 AM EDT
gpg:                using RSA key B358F136279EEEB11AA553ECB77349050F548D3F
gpg: BAD signature from "Linas Vepstas (current active email; others are inactive) <email redacted>" [unknown]

I'm also getting a bad signature for 5.12.3, also from gnucash.org.

linas commented 6 months ago

Gahh!

linas commented 6 months ago

I get this;

$ gpg --verify link-grammar-5.12.4.tar.gz.asc
gpg: assuming signed data in 'link-grammar-5.12.4.tar.gz'
gpg: Signature made Thu 28 Mar 2024 11:48:40 PM CDT
gpg:                using RSA key B358F136279EEEB11AA553ECB77349050F548D3F
gpg: Good signature from "Linas Vepstas (current active email; others are inactive) <linasvepstas@gmail.com>" [ultimate]
gpg:                 aka "Linas Vepstas (Labas!) <linas@linas.org>" [ultimate]
gpg:                 aka "[jpeg image of size 7210]" [ultimate]

This has several additional lines, including a small jpeg image ... which suggests your version of the key is older than mine? On the other hand, my understanding is that even old versions should work fine.

How good are you with gpg? I'm not sure how to debug this.

Is it possible your asc is corrupted? Mine is 833 bytes long: copied below, for link-grammar-5.12.4.tar.gz.asc

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEs1jxNiee7rEapVPst3NJBQ9UjT8FAmYGSCgACgkQt3NJBQ9U
jT8sEQ/+PbCvW8mj/cFBXZGDSfCSHg0561yuOUaLSFRCV7bVcN1+MFtuV/vl3HMm
UyKZb93rEz1957xR5F9S30lNc4jQ1tdEjmRKKd6qyB/2odT4+3AnqQ5iZ3LDkEuc
3AESdT8f4VJZ3mnarrYrFEOJTjoPf1mKwNLg9aCGc2rILbKOXXZxQOR90cA/UIPb
O+66JDnoYqAXCWDxHXCikYkEaWyADYi+a9Uqijr5ur8bF1YaQL3DCO8PGo5oJLPO
UQCf/wUSftvPbzEBWChsk3u+P9jm+OKKOXGKQ8JmZ7ZvK6dL8LHBtcguaoKGwoW0
Pamy+T4vodEsPYdLB5jwpa1sXFsfdSaiENfb8MHBp2FIKOJUzu9tS8BxT43+0nQJ
Pj7IumFpDd0GizEGxRcxrHRC2do7UKi34K7h2lXlRpqfqlnQdqvuv/SMg2T59775
k8hmoMWyq3HuhpEKusyFXE5+oaTx74CnXqFMbilrdvoKqbFGTBpUJHg1O6M1ASWP
M45qtDFjYnBpgwBMXd70g2Pjufk3yM+sM5bZP3vHQeAnE4e45KyREf1WuGWLHSYi
b6UEV1J7lrcqSux8xtMbwtqBqBqM3ldqUunAsDYlH+Qe2FWQm6uZz40SVUdXj1Gx
DkOVo2iPzsxsCOAqRG2mcLH5QhSa+RNSEUKyywbQb/Wm022TdPk=
=umdU
-----END PGP SIGNATURE-----
linas commented 6 months ago

Oh. Hah:

wget https://www.gnucash.org/link-grammar/5.12.4/link-grammar-5.12.4.tar.gz{,.asc}
--2024-05-07 10:22:58-- 
2024-05-07 10:22:58 ERROR 404: Not Found.

Try this:

wget https://www.gnucash.org/link-grammar/downloads/5.12.4/link-grammar-5.12.4.tar.gz{,.asc}
serebit commented 6 months ago

Oh. Hah:

wget https://www.gnucash.org/link-grammar/5.12.4/link-grammar-5.12.4.tar.gz{,.asc}
--2024-05-07 10:22:58-- 
2024-05-07 10:22:58 ERROR 404: Not Found.

Try this:

wget https://www.gnucash.org/link-grammar/downloads/5.12.4/link-grammar-5.12.4.tar.gz{,.asc}

Tried again with a redownloaded tar and asc, and despite not having changed anything on my end, it works now (and gives the GPG key output that you posted above). I'll just chalk this up to either download corruption or PEBKAC. Sorry about that!

linas commented 6 months ago

fyi, a 5.12.5 is planed for "any day now" ... so maybe a few weeks??