2020-02-21 15:13 AEST by Arthur Barrett - linux RPM's signed, but for RH5 we ship the wrong public key

The Linux RHEL5 RPM's are signed with e999528e but we include the public key B5A8AC09

The SLES9/RH9 RPM's are signed with B5A8AC09 and we correctly include that public key for them.

Note: Ubuntu builds are signed with ECEF7A0A and is available on the public keyserver:

  gpg --keyserver wwwkeys.net.uk.pgp.net --recv-keys ECEF7A0A
  gpg --export -a ECEF7A0A | sudo apt-key add -


We should also make all the public keys available to download separately from the customer downloads area 
of the web site, and maybe also from the trial page.  The correct public key should certainly be included in 
the tar.gz file...

2020-02-24 12:14 AEST by Arthur Barrett - RHEL7:


[abarrett@rhel7dev ~]$ rpm -v --checksig rpm/*.rpm
rpm/cvsnt-2.8.01.7343-1.i686.rpm:
    Header V4 RSA/SHA1 Signature, key ID e999528e: OK
    Header SHA1 digest: OK (6c53f3c041eea68f9361c80ca88d078c06297feb)
    V4 RSA/SHA1 Signature, key ID e999528e: OK
    MD5 digest: OK (cc4936f955862e8cd3e9b8b25e8f2234)
rpm/cvsnt-database-mysql-2.8.01.7343-1.i686.rpm:
    Header V4 RSA/SHA1 Signature, key ID e999528e: OK
    Header SHA1 digest: OK (560df8d11318246d46c1241d8e517536d9bc4a41)
    V4 RSA/SHA1 Signature, key ID e999528e: OK
    MD5 digest: OK (ea9dba73ac6546da85e1926ac32ec9d9)
rpm/cvsnt-database-odbc-2.8.01.7343-1.i686.rpm:
    Header V4 RSA/SHA1 Signature, key ID e999528e: OK
    Header SHA1 digest: OK (293291200e6cc0737de084312444ca87ac1c7ef4)
    V4 RSA/SHA1 Signature, key ID e999528e: OK
    MD5 digest: OK (1490e42d66f11700e132f93157fadf07)
rpm/cvsnt-database-oracle-2.8.01.7343-1.i686.rpm:
    Header V4 RSA/SHA1 Signature, key ID e999528e: OK
    Header SHA1 digest: OK (00d0ffa80c7bd3cb3dbb0d180eaed00c2736f7e6)
    V4 RSA/SHA1 Signature, key ID e999528e: OK
    MD5 digest: OK (ba3d191b14112e06684f2fe000ed416c)
rpm/cvsnt-database-sqlite-2.8.01.7343-1.i686.rpm:
    Header V4 RSA/SHA1 Signature, key ID e999528e: OK
    Header SHA1 digest: OK (6637944915742437a150d8817f41399aaa1a63b7)
    V4 RSA/SHA1 Signature, key ID e999528e: OK
    MD5 digest: OK (6a79c2c88ff2a9c897de3e6e770e85f1)
rpm/cvsnt-protocol-gserver-2.8.01.7343-1.i686.rpm:
    Header V4 RSA/SHA1 Signature, key ID e999528e: OK
    Header SHA1 digest: OK (fa448946da39719905c6de1f0997354104fc7246)
    V4 RSA/SHA1 Signature, key ID e999528e: OK
    MD5 digest: OK (06f137cb00a7ffddcb9830fdc9ad64f9)
rpm/cvsnt-protocol-sserver-2.8.01.7343-1.i686.rpm:
    Header V4 RSA/SHA1 Signature, key ID e999528e: OK
    Header SHA1 digest: OK (28876f9a3e9d5f41490017fce605f3285c40a304)
    V4 RSA/SHA1 Signature, key ID e999528e: OK
    MD5 digest: OK (ada5f861f0aa86a9d9491c36622f9e22)
rpm/cvsnt-protocol-sync-2.8.01.7343-1.i686.rpm:
    Header V4 RSA/SHA1 Signature, key ID e999528e: OK
    Header SHA1 digest: OK (cf42c396361a805e6c95857121338cfd8417772e)
    V4 RSA/SHA1 Signature, key ID e999528e: OK
    MD5 digest: OK (66f015b478942e2eee9f637f0a534b95)



RHEL5:


[abarrett@acer64rhel5 ~]$ rpm -v --checksig rpm/*.rpm
rpm/cvsnt-2.8.01.7343-1.i386.rpm:
    Header V3 RSA/SHA1 signature: OK, key ID e999528e
    Header SHA1 digest: OK (27e02491a91b9fb48f15183d6ed3bcc8c0ee3ce2)
    V3 RSA/SHA1 signature: OK, key ID e999528e
    MD5 digest: OK (3626e9a157b532778be79271dd1cd330)
rpm/cvsnt-database-mysql-2.8.01.7343-1.i386.rpm:
    Header V3 RSA/SHA1 signature: OK, key ID e999528e
    Header SHA1 digest: OK (8e891d0aad371de7e9a3695ac350fc70b9ad52b9)
    V3 RSA/SHA1 signature: OK, key ID e999528e
    MD5 digest: OK (061f327168aa52a064d58fc70d22f943)
rpm/cvsnt-database-odbc-2.8.01.7343-1.i386.rpm:
    Header V3 RSA/SHA1 signature: OK, key ID e999528e
    Header SHA1 digest: OK (172d04622ca898de6af7dc5b0cd7188cf6b52471)
    V3 RSA/SHA1 signature: OK, key ID e999528e
    MD5 digest: OK (4b310accea2af7a5767571aa2e48b5e6)
rpm/cvsnt-database-oracle-2.8.01.7343-1.i386.rpm:
    Header V3 RSA/SHA1 signature: OK, key ID e999528e
    Header SHA1 digest: OK (e7bf492c531b96edd853e88a9fe0c9e7f1cb7613)
    V3 RSA/SHA1 signature: OK, key ID e999528e
    MD5 digest: OK (8e2dc9795bcd1cd37f012f7231875cd9)
rpm/cvsnt-database-sqlite-2.8.01.7343-1.i386.rpm:
    Header V3 RSA/SHA1 signature: OK, key ID e999528e
    Header SHA1 digest: OK (d7fbc53c699b88877143c4796ad57ff614effd9d)
    V3 RSA/SHA1 signature: OK, key ID e999528e
    MD5 digest: OK (595780111dcf407d88b2d65f936c7c3e)
rpm/cvsnt-protocol-gserver-2.8.01.7343-1.i386.rpm:
    Header V3 RSA/SHA1 signature: OK, key ID e999528e
    Header SHA1 digest: OK (2407feb0ab11656ee72afe7d5671de10792e6381)
    V3 RSA/SHA1 signature: OK, key ID e999528e
    MD5 digest: OK (feec1d9c6e65240fa09ba3b20bb17492)
rpm/cvsnt-protocol-sserver-2.8.01.7343-1.i386.rpm:
    Header V3 RSA/SHA1 signature: OK, key ID e999528e
    Header SHA1 digest: OK (a8201a8c6da7236e03cae5bee6b9cf83f3ac0e14)
    V3 RSA/SHA1 signature: OK, key ID e999528e
    MD5 digest: OK (cd1c1b75027024384cc17032d5842422)
rpm/cvsnt-protocol-sync-2.8.01.7343-1.i386.rpm:
    Header V3 RSA/SHA1 signature: OK, key ID e999528e
    Header SHA1 digest: OK (e9b29566bc823e86286f4693198f734023132c4d)
    V3 RSA/SHA1 signature: OK, key ID e999528e
    MD5 digest: OK (e8996a1a010c84c7573bff91ee32b7fb)


RH9:


[abarrett@acer64redhat abarrett]$ rpm -v --checksig rpm/*.rpm
rpm/cvsnt-2.8.01.7343-1.i386.rpm:
    Header V3 DSA signature: OK, key ID b5a8ac09
    Header SHA1 digest: OK (1b32b2b2623920329d050358d8dd5d1f39e70125)
    MD5 digest: OK (82e59e03f32fd0734016eb195bd208b4)
    V3 DSA signature: OK, key ID b5a8ac09
rpm/cvsnt-database-mysql-2.8.01.7343-1.i386.rpm:
    Header V3 DSA signature: OK, key ID b5a8ac09
    Header SHA1 digest: OK (29b1f4eb96b74f2a357116f69c0e285da6def87b)
    MD5 digest: OK (996f96dffd5a3c27aec5c6eca9ad49be)
    V3 DSA signature: OK, key ID b5a8ac09
rpm/cvsnt-database-odbc-2.8.01.7343-1.i386.rpm:
    Header V3 DSA signature: OK, key ID b5a8ac09
    Header SHA1 digest: OK (e68ba7eb2028cacc0fd2f7b8e85c2d96c7e19244)
    MD5 digest: OK (bd1159a793882da508238771713816d2)
    V3 DSA signature: OK, key ID b5a8ac09
rpm/cvsnt-database-oracle-2.8.01.7343-1.i386.rpm:
    Header V3 DSA signature: OK, key ID b5a8ac09
    Header SHA1 digest: OK (dd9793fc070bab53b0f1d3bcf9a15d18b090851c)
    MD5 digest: OK (901138a3d948b797ecc2d25edaea4667)
    V3 DSA signature: OK, key ID b5a8ac09
rpm/cvsnt-database-sqlite-2.8.01.7343-1.i386.rpm:
    Header V3 DSA signature: OK, key ID b5a8ac09
    Header SHA1 digest: OK (5ed2a89d6f3c48b3df8c139b981b9733119152f4)
    MD5 digest: OK (d20ba1f6736d02f1c84b6fcfda961220)
    V3 DSA signature: OK, key ID b5a8ac09
rpm/cvsnt-protocol-gserver-2.8.01.7343-1.i386.rpm:
    Header V3 DSA signature: OK, key ID b5a8ac09
    Header SHA1 digest: OK (1fe836a8d74252e89310493ce74ea8d64af168ad)
    MD5 digest: OK (35a0459c85a434699ece0182bb089572)
    V3 DSA signature: OK, key ID b5a8ac09
rpm/cvsnt-protocol-sserver-2.8.01.7343-1.i386.rpm:
    Header V3 DSA signature: OK, key ID b5a8ac09
    Header SHA1 digest: OK (afbd01376e9ef6536dc00e35ffa0d55e8107d5b8)
    MD5 digest: OK (19856c43bfdad29a855f2d43dff11d9c)
    V3 DSA signature: OK, key ID b5a8ac09
rpm/cvsnt-protocol-sync-2.8.01.7343-1.i386.rpm:
    Header V3 DSA signature: OK, key ID b5a8ac09
    Header SHA1 digest: OK (0f5e6f44b709b1a0ba676b4ebcef9d825b3c5126)
    MD5 digest: OK (9ea18ee72c8015dbbde9798cd87872e3)
    V3 DSA signature: OK, key ID b5a8ac09

2020-02-28 15:25 AEST by Arthur Barrett - We probably need to upgrade to rsa 4096 bit signing keys.

Compare the keys here on Ubuntu 18.04:

abarrett@Ubuntu-x64-Bionic-Test2:~$ sudo apt-key list 
/etc/apt/trusted.gpg
--------------------
pub   dsa1024 2010-03-05 [SC]
      FE42 9EF1 258B C560 2F36  AFCA B27E 0A8A ECEF 7A0A
uid           [ unknown] March Hare Software Ltd <support@march-hare.com>
sub   elg2048 2010-03-05 [E]

/etc/apt/trusted.gpg.d/ubuntu-keyring-2012-archive.gpg
------------------------------------------------------
pub   rsa4096 2012-05-11 [SC]
      790B C727 7767 219C 42C8  6F93 3B4F E6AC C0B2 1F32
uid           [ unknown] Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>

/etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg
------------------------------------------------------
pub   rsa4096 2012-05-11 [SC]
      8439 38DF 228D 22F7 B374  2BC0 D94A A3F0 EFE2 1092
uid           [ unknown] Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>

2020-02-28 15:40 AEST by Arthur Barrett - I think the DSA 1024 bit key is considered invalid by Ubuntu 18.04

Err:2 http://www.unifacecm.de/webtools/bo/ubuntu trusty InRelease                                       
  The following signatures were invalid: FE429EF1258BC5602F36AFCAB27E0A8AECEF7A0A