From: Jon Turney <jon.turney@dronecode.org.uk>
To: Greg Williamson <greg.williamson45@gmail.com>,
The Cygwin Mailing List <cygwin@cygwin.com>
Subject: Re: Unable to Verify 64 bit Installer on Windows
Date: Thu, 30 Dec 2021 23:38:52 +0000 [thread overview]
Message-ID: <46fb394d-66dd-8648-b961-4a13411cc7ed@dronecode.org.uk> (raw)
In-Reply-To: <CAPwDAhA1mFg9=QkU6OU_1BFC_Sz500yJ2+YpQgzf1p-i2Lyabw@mail.gmail.com>
On 30/12/2021 21:24, Greg Williamson wrote:
> Hello,
>
> While attempting to verify the installer found here:
> https://cygwin.com/install.html
>
> GPG verification for "setup-x86_64.exe" failed with "BAD signature from
> "Cygwin <cygwin@cygwin.com>". I also created a SHA512 hash of the installer
> and it did not match the one posted here:
> https://cygwin.com/sha512.sum
>
> As a sanity check I attempted to verify the 32bit version "setup-x86.exe".
> The SHA512 matched and the GPG signature verification succeeded.
>
> I thought I'd report here in case there was a security issue. Thank you in
> advance for your assistance!
>
At 2021-Dec-30 19:14 UTC I downgraded the setup executables being served
to a previous version, to give some more time to investigate an issue
reported with setup 2.911.
I'm going to guess that was the reason for this.
However, please note that some caching outside of our control must have
occurred, as at all times, the signatures and hashes presented were
consistent and correct.
prev parent reply other threads:[~2021-12-30 23:38 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-30 21:24 Greg Williamson
2021-12-30 21:51 ` Hamish McIntyre-Bhatty
2021-12-30 22:58 ` Brian Inglis
2021-12-30 23:38 ` Jon Turney [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=46fb394d-66dd-8648-b961-4a13411cc7ed@dronecode.org.uk \
--to=jon.turney@dronecode.org.uk \
--cc=cygwin@cygwin.com \
--cc=greg.williamson45@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).