Bad Signature (SOLVED)

[Member perknh]

Hi my antiX friends, I’m having a difficult time verifying the signature of my antiX download — even though the SHA-256 hash is correct!

First I imported the key from this source: https://www.antixforum.com/forums/topic/step-by-step-guide-to-install-antix-base/

And I got this result:

***@***:~/Downloads$ gpg –keyserver hkp://keys.gnupg.net –recv-keys 4A0C4F9C
gpg: keyserver receive failed: No name
***@***:~/Downloads$

Then I ran this command from this source: https://mxlinux.org/wiki/system/signed-iso-files/

***@***:~$ gpg –keyserver hkps://keys.openpgp.org –recv-keys 409C71B3BCFDED0A 70938C780679EE98 9B68A1E8B9B6375C 13C74A22892C32F1 A80582E000067FDD
gpg: key A80582E000067FDD: public key “anticapitalista (change of address) <anticapitalista@riseup.net>” imported
gpg: key 13C74A22892C32F1: public key “S*** * P*** <stevopusser@gmail.com>” imported
gpg: key 9B68A1E8B9B6375C: public key “D*** O*** (mxlinux) <dolphinoracle@gmail.com>” imported
gpg: key 70938C780679EE98: public key “A*** <adrian@mxlinux.org>” imported
gpg: key 409C71B3BCFDED0A: public key “M*** P*** <m_pav10-4@thepavs.net.nz>” imported
gpg: Total number processed: 5
gpg: imported: 5
***@***:~$

Finally, I got this response:

***@***:~/Downloads$ gpg –verify antiX-21_x64-full.iso.sig antiX-21_x64-full.iso.sig
gpg: Signature made Sun 31 Oct 2021 06:36:10 AM EDT
gpg: using RSA key 30AA418A0C723D937B50A986A80582E000067FDD
gpg: BAD signature from “anticapitalista (change of address) <anticapitalista@riseup.net>” [unknown]
***@***:~/Downloads$

Ladies and gentlemen, quite frankly, I’m stumped! Any insights concerning this issue would be appreciated. Remember now, the SHA-256 hash is correct.

Thank you,

perknh

P.S

I’ve modified contact names, because the algorithm apparently thinks this is spam — which I assure you it is not!

• This topic was modified 1 year, 3 months ago by perknh.
• This topic was modified 1 year, 3 months ago by perknh.
• This topic was modified 1 year, 3 months ago by perknh.

[Forum Admin Dave]

Helpful

Up

1

::

Not sure on gpg –verify command vs gpgv.
The instructions in the how to read the last command as:
gpgv --keyring pubring.kbx antiX-21_x64-full.iso.sig antiX-21_x64-full.iso.sig
Maybe that command will show correctly, or maybe the same result.
Otherwise anti may have an updated/altered signing key since that post.

• This reply was modified 1 year, 3 months ago by Dave.

Computers are like air conditioners. They work fine until you start opening Windows. ~Author Unknown

[Member perknh]

Helpful

Up

0

::

Hi Dave, and thank you so much.

This is what I get when I run that command:

***@***:~/Downloads$ gpgv –keyring pubring.kbx antiX-21_x64-full.iso.sig antiX-21_x64-full.iso.sig
gpgv: can’t allocate lock for ‘/home/indri/.gnupg/pubring.kbx’
gpgv: Signature made Sun 31 Oct 2021 06:36:10 AM EDT
gpgv: using RSA key 30AA418A0C723D937B50A986A80582E000067FDD
gpgv: BAD signature from “anticapitalista (change of address) <anticapitalista@riseup.net>”
***@***:~/Downloads$

Dave, I got a feeling you put your finger on the issue. Most likely the signing key has been altered or updated. I appreciate your help and insights here.

Thank you,

perknh

[Forum Admin anticapitalista]

Helpful

Up

1

::

I downloaded from here: https://mxlinux.ipacct.com/MX-Linux/ANTIX/Final/antiX-21/

No problems with signature check

gpgv --keyring pubring.kbx antiX-21_x64-full.iso.sig antiX-21_x64-full.iso
gpgv: can't allocate lock for 'xxxxxxxxxxxxxxxxxxxxxxxxxxx'
gpgv: Signature made Sun 31 Oct 2021 12:36:10 PM EET
gpgv:                using RSA key 30AA418A0C723D937B50A986A80582E000067FDD
gpgv: Good signature from "anticapitalista (change of address) <anticapitalista@riseup.net>"
gpgv:                 aka "anticapitalista <antix@operamail.com>"

Philosophers have interpreted the world in many ways; the point is to change it.

antiX with runit - leaner and meaner.

[Member perknh]

Helpful

Up

1

::

anticapitalista wrote:

I downloaded from here: https://mxlinux.ipacct.com/MX-Linux/ANTIX/Final/antiX-21/

No problems with signature check

gpgv --keyring pubring.kbx antiX-21_x64-full.iso.sig antiX-21_x64-full.iso
gpgv: can't allocate lock for 'xxxxxxxxxxxxxxxxxxxxxxxxxxx'
gpgv: Signature made Sun 31 Oct 2021 12:36:10 PM EET
gpgv:                using RSA key 30AA418A0C723D937B50A986A80582E000067FDD
gpgv: Good signature from "anticapitalista (change of address) <anticapitalista@riseup.net>"
gpgv:                 aka "anticapitalista <antix@operamail.com>"

Yes, thank you, anticapitalista. I started over today with new downloads of the full iso file and checksum/sha256 files.

I got this:

~/Downloads$ gpgv –keyring pubring.kbx antiX-21_x64-full.iso.sig antiX-21_x64-full.iso
gpgv: can’t allocate lock for ‘***********************’
gpgv: Signature made Sun 31 Oct 2021 06:36:10 AM EDT
gpgv: using RSA key 30AA418A0C723D937B50A986A80582E000067FDD
gpgv: Good signature from “anticapitalista (change of address) <anticapitalista@*********>”

But now I’m finding that the MD5 and the Sha256 do not match. The numbers I’m using are:

277ec138033ba7426fbad294d3e6e2db antiX-21_x64-full.iso for the MD5

and

8335d67b52f06673740663aeca108f8ce7990e63ba22750e9454ccc65a0d4ee5 antiX-21_x64-full.iso for the sha256.

Am I doing something wrong here?

And, thank you, anticapitalista and Dave. Sorry for being such a pest with this. I guess the old saying is true, “If it ain’t one thing, it’s another!”

perknh

• This reply was modified 1 year, 3 months ago by perknh.
• This reply was modified 1 year, 3 months ago by perknh.

[Forum Admin anticapitalista]

Helpful

Up

1

::

Those checksums are correct according to the info here: https://antixlinux.com/download/

Philosophers have interpreted the world in many ways; the point is to change it.

antiX with runit - leaner and meaner.

[Member perknh]

Helpful

Up

0

::

Thank you anticapitalista and Dave. I found a mirror called easyname in Austria, and I downloaded from there. Now anticapitalista’s signature, md5 sum, and sha256 all match. I’ll soon be up and running with antiX 21. Thank you both so much.

perknh

[Author]

Posts