Re: How to verify header signed (tinews.pl) posts?

Urs Janßen wrote:
> On Sun, Oct 17, 2004 at 01:08:37PM +0200, Michael Heiming wrote:
[..]

>>Looks as if news.tin.org would be read-only trough nntp.;(
> 
> 
> yes and this is intentional.

Yup, thought so.;)



>>How can one verify those posts, preferable in tin?
> 
> 
> via pgpverify(1)
> <http://www.eyrie.org/~eagle/software/inn/docs/pgpverify.html>
> (e.g. "|""pgpverify"
> 
> 
>>Is the whole post "protected" through gpg, from a closer view at
>>tines.pl it looks like or just the header?
> 
> 
> which is sufficant as you can't reuse the article as Message-ID and
> Date are singed (and servers keep the ID for some time and afterwards
> tend to reject postings which do have a date header long time in the
> past).
> 
> urs

Hi Urs!

Thx for your fast answer, after configuring, pgpverify seems to work,
with gpg but alas my test post can't be verified correctly:


$ ./pgpverify -test < /var/spool/news/alt/test/468
-----MESSAGE-----
X-Signed-Headers: From,Newsgroups,Subject,Date,Message-ID
From: Michael Heiming <[email protected]>
Newsgroups: alt.test
Subject: hs test2
Date: Sun, 17 Oct 2004 11:36:07 +0200
Message-ID: <[email protected]>

blah, blah

--
Michael Heiming (GPG-Key ID: 0xEDD27B94)
mail: echo [email protected] | perl -pe 'y/a-z/n-za-m/'

-----END MESSAGE-----

-----SIGNATURE-----
iD8DBQFBcj0LAkPEju3Se5QRAryUAJ9F8BUF8EXpNAZtzOiPpBZu/MQsswCfSRcH
JZiA5NSbJd0XrJT4STD0pjg=
=dJmG
-----SIGNATURE-----

gpgv: Signature made Sun Oct 17 11:36:11 2004 CEST using DSA key ID EDD27B94
[GNUPG:] BADSIG 0243C48EEDD27B94 Michael Heiming (Remove +SIGNS and www. 
to contact me!) <[email protected]>
gpgv: BAD signature from "Michael Heiming (Remove +SIGNS and www. to 
contact me!) <[email protected]>"


Anymore insights what the culprit might be?

"Body" signed post verfiy fine, as shown below, using tin "^g" with the 
same key?


Reading config file...
gpg: Signature made Sun Oct 17 08:26:45 2004 CEST using DSA key ID EDD27B94
gpg: Good signature from "Michael Heiming (Remove +SIGNS and www. to 
contact me!) <[email protected]>"
gpg:                 aka "Michael Heiming (Remove *SIGNS and www to 
contact me!) <[email protected]>"


Best Regards

Michael Heiming