Re: [Gnu-arch-users] possible bug in signature verification

[Tom Lord]

    > From: "Victor V. Shkamerda" <address@hidden>

    > I've just noticed that tla did not verify signatures for revisions 
    > cached in archive, e.g. continuation revision. I suppose nobody noticed 
    > this yet because they are using revision libraries and therefore are 
    > getting these revisions from there instead. Try for example "tla get 
    > tla--devo" without your revision library. I'm getting a nice "INVALID 
    > SIGNATURE ON REVISION!... checksum file: checksum... trouble reading 
    > checksum file for address@hidden/tla--devo--1.2--base-0" despite the 
    > fact that it's there, but in file checksum.cacherev.

Thanks for the heads up and to other people who have reported this problem.

Your diagnosis isn't quite right.   The checksum file for that
specific revision was bogus --- on purpose.   I screwed it up by hand
(deliberately) some time ago while testing the checksum stuff and then
never got around to fixing it.

It's fixed now in my mirrors.   If you were reading the mirror
directly, that should work now.   If you have a local mirror of my
mirror, the quickest fix is to edit the checksum file of that revision
and delete the last two lines by hand.

Sorry about the confusion.


-t