On 05/09/2011 06:44, carpe_diem wrote: > Upon running the detached signature file through PGP it reports the file > setup.exe was signed on 12/7/2010 with an "Invalid Key". Could you > confirm the origin and safety of setup.exe posted on > http://cygwin.com/install.html ? The file downloaded has the following > MD5: 2ece86924bf59c82b3c1936760ef4631
Verification works for me: > $ gpg --verify setup.exe.sig > gpg: WARNING: using insecure memory! > gpg: please see http://www.gnupg.org/faq.html for more information > gpg: Signature made Tue Dec 7 06:10:02 2010 GMTST using DSA key ID 676041BA > gpg: Good signature from "Cygwin <cygwin AT cygwin.com>" > > $ md5sum setup.exe > 2ece86924bf59c82b3c1936760ef4631 *setup.exe > > $ I would guess you didn't download and install the public key (http://cygwin.com/key/pubring.asc) into your gpg keyring yet. cheers, DaveK -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
