Where are the checksums as verified by GPG signed message for the current Augur App binaries?
Please include instructions to verify the above GPG signature and checksums on Linux
You can download the signed message including checksums for Linux, Mac, and Windows here:
786f6604c36e010a590d32b4a88428760ed0f947d2b25c8ec176ea1bb3a16f6e linux-Augur-1.3.2.AppImage 781a4c48af0c6c502d66c27a7f59a49faa9cd092e2b275e8499d1bf2e914fe72 linux-Augur-1.3.2.deb
You can import augur's public pgp key by running:
gpg --search-keys firstname.lastname@example.org
Then verify release-checksums.txt with:
gpg --verify release-checksums.txt
Should say it was signed by Forecast Foundation's key on Aug 20, 2018.
(This is for v1.3.2, the latest release at the time I'm writing this answer. If a newer one has been released by the time you read this, obviously the url to the checksum-release.txt file will be slightly different and it will have a more recent signature.)
The checksums themselves are SHA-256 sums. You can verify them with:
shasum -a 256 linux-Augur-1.3.2.AppImage
shasum -a 256 linux-Augur-1.3.2.deb
For current ( 20th september 2018 ) linux-Augur-1.5.1.AppImage there seems to be a problem.
shasum -a 256 linux-Augur-1.5.1.AppImage aae4d6a9452c4a7a0d77251101f9774d1e7d03387ec694eb9b9bdf0d496a08c2 linux-Augur-1.5.1.AppImage
this is what can be found in linux-Augur-1.5.1.AppImage.sha256 but not within release-checksum-v1.5.1.txt which contains line
what is checksum indicated on github release page ...
which one is the good one ? is it really sha256 ?
notes that gpg is ok :
LANG=US gpg --verify release-checksum-v1.5.1.txt
gpg: Signature made Tue Sep 18 20:10:48 2018 CEST gpg: using RSA key 787ABE89C20F65BA gpg: Good signature from "Forecast Foundation <email@example.com>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: EB30 2BC7 5B66 4F74 D2F0 E9F6 424E 0F4D 4ABB BBE0 Subkey fingerprint: B66E CD43 8E2D B764 C793 804A 787A BE89 C20F 65BA