Where are the checksums as verified by GPG signed message for the current Augur App binaries?

Please include instructions to verify the above GPG signature and checksums on Linux

You can download the signed message including checksums for Linux, Mac, and Windows here:

https://github.com/AugurProject/augur-app/releases/download/v1.3.2/release-checksums.txt

786f6604c36e010a590d32b4a88428760ed0f947d2b25c8ec176ea1bb3a16f6e linux-Augur-1.3.2.AppImage
781a4c48af0c6c502d66c27a7f59a49faa9cd092e2b275e8499d1bf2e914fe72 linux-Augur-1.3.2.deb

You can import augur's public pgp key by running:

gpg --search-keys team@augur.net

Then verify release-checksums.txt with:

gpg --verify release-checksums.txt

Should say it was signed by Forecast Foundation's key on Aug 20, 2018.

(This is for v1.3.2, the latest release at the time I'm writing this answer. If a newer one has been released by the time you read this, obviously the url to the checksum-release.txt file will be slightly different and it will have a more recent signature.)

The checksums themselves are SHA-256 sums. You can verify them with:

shasum -a 256 linux-Augur-1.3.2.AppImage

shasum -a 256 linux-Augur-1.3.2.deb

For current ( 20th september 2018 ) linux-Augur-1.5.1.AppImage there seems to be a problem.

shasum -a 256 linux-Augur-1.5.1.AppImage aae4d6a9452c4a7a0d77251101f9774d1e7d03387ec694eb9b9bdf0d496a08c2 linux-Augur-1.5.1.AppImage

this is what can be found in linux-Augur-1.5.1.AppImage.sha256 but not within release-checksum-v1.5.1.txt which contains line

f9946acf53232fe73a3eabc1a51e71be293d4203321c264fdf1ebdd8896a9298 linux-Augur-1.5.1.AppImage

what is checksum indicated on github release page ...

which one is the good one ? is it really sha256 ?

notes that gpg is ok :

LANG=US gpg --verify release-checksum-v1.5.1.txt

gpg: Signature made Tue Sep 18 20:10:48 2018 CEST
gpg:                using RSA key 787ABE89C20F65BA
gpg: Good signature from "Forecast Foundation <team@augur.net>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: EB30 2BC7 5B66 4F74 D2F0  E9F6 424E 0F4D 4ABB BBE0
     Subkey fingerprint: B66E CD43 8E2D B764 C793  804A 787A BE89 C20F 65BA

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.