Re: log4j 2.15.0 signature and sha512 hash

On Mon, Dec 13, 2021 at 1:22 PM Daniel Savard <[email protected]>
wrote:

> Le lun. 13 déc. 2021 à 12:34, Gary Gregory <[email protected]> a
> écrit :
>
> > Works for me:
> >
> > gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc
> >
>
> Here is the content of the asc file:
>
> -----BEGIN PGP SIGNATURE-----
>
> iQIzBAABCgAdFiEEU8k1ghqmp1W9M321NZU5XrPY4boFAmGySd0ACgkQNZU5XrPY
> 4bqQtQ/+KXQi3+6LZ13HyEefNsnBm84krCXK/nAIlRnerbV+Wj1g0xU7cC8l3m+n
> UHw2/BIIurGnOKU4bvGUOc5UYDTED4LPadkvXYW0NMvBGla0fvR1lyEMypS2E2nz
> 0g3sqHC0T4ZEGEIO7jmUVQJEpPya33VlztfnoNQPcqv6PCOilIVK1EmoewEBvnsd
> SVAJPhJtD43mUPLsIMIc4k7IM56FssN+2+46mba6YH39C4Z4NheGBUK9UXWYKQd3
> 3DKHoIoLb2hKXLdxHHz5u4dbkYPiHyGR4iX0wjq7W4eUX/4v+czsjrs8vQ5Gvhba
> slg6RfUeu+fkMJfQUgRLT2HRSIKsuUd2QMppxW1GKRnfpx0yzAUWMfFfPcxuEa/u
> em4YCsz1/a0AtfgtI6+Lne0yWsxORVVutquVOyF0ddjySQccPNYaOyOjx6jASM2A
> LxkdCko0+2rSuIWcLMpWaoeRedao4L6O3azdU0IcN7/BVyXczM2t5cYB4QDdXvSc
> UKJ6q6dQLngIwYqo6Q/d1XeKatWuhSPz0+mAoGAWvllvzWKb1/YbC/jZk/vxVqzR
> K/mHB24pPWfcWiQNfbHrOVVUzv783u1RkEqDCGbBNBUr+ud1Fvte0i1x6WIhGXS7
> qb5OTuljDicQ1L2mAKgvzl4XnOUsFmuBagZHYk58n19ZlxfBlyw=
> =gA3i
>
> -----END PGP SIGNATURE-----
>
> This results in a bad signature.
>

What happens when you run:

gpg --verify apache-log4j-2.15.0-bin.tar.gz.asc

?

Gary

>
>
> >
> > gpg: assuming signed data in 'apache-log4j-2.15.0-bin.tar.gz'
> > gpg: Signature made Thu Dec  9 13:24:29 2021 EST
> > gpg:                using RSA key
> 53C935821AA6A755BD337DB53595395EB3D8E1BA
> > gpg: Good signature from "Ralph Goers (CODE SIGNING KEY) <
> > [email protected]>"
> > [unknown]
> > gpg: WARNING: This key is not certified with a trusted signature!
> > gpg:          There is no indication that the signature belongs to the
> > owner.
> > Primary key fingerprint: 53C9 3582 1AA6 A755 BD33  7DB5 3595 395E B3D8
> E1BA
> >
> > shasum -a512 apache-log4j-2.15.0-bin.tar.gz
> >
> >
> >
> c0e2d704d720bffc99520e5dfbf860ba3cb7f8a34c16a1caa8ce35618370ff06c19e3dc64fc258ad45d4308690551bf34b3ecb7acc0848aa12615f46398cda4a
> >  apache-log4j-2.15.0-bin.tar.gz
> >
> > is the same as the data in
> >
> >
> https://downloads.apache.org/logging/log4j/2.15.0/apache-log4j-2.15.0-bin.tar.gz.sha512
> >
> >
> Here is the content of the file when I download it:
>
> apache-log4j-2.15.0-bin.tar.gz: C0E2D704 D720BFFC 99520E5D FBF860BA
> 3CB7F8A3
>                                 4C16A1CA A8CE3561 8370FF06 C19E3DC6
> 4FC258AD
>                                 45D43086 90551BF3 4B3ECB7A CC0848AA
> 12615F46
>
>                                 398CDA4A
>
>
> Obviously not a sha512 hash.
>
>
>
> >
> > Gary
> >
> >
> -----------------
> Daniel Savard
>