Bad GPG signature

[bcruddy]

Do you want to request a feature or report a bug?
Bug

What is the current behavior?
Yarn install fails on Travis

If the current behavior is a bug, please provide the steps to reproduce.
Invalid GPG signature
https://gist.github.com/bcruddy/f901c0f510352ff14a5c9911007ee723

What is the expected behavior?
Valid GPG signature

Please mention your node.js, yarn and operating system version.
See gist.

[bcruddy]

I couldn't replicate this as I got a valid GPG signature after restarting the build

[akullpp]

Same here building a docker image:

gpg: key 1646B01B86E50310: public key "Yarn Packaging <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.

[skipjack]

We're seeing the same thing over at webpack/webpack.js.org#1251... see this build.

GPG signature for this Yarn release is invalid! This is BAD and may mean the release has been tampered with. It is strongly recommended that you report this to the Yarn developers.

[paulirish]

I got the exact same results as @bcruddy on this travis build. (raw log)

> Verifying integrity...
gpg: key 86E50310: public key "Yarn Packaging <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)
gpg: Signature made Tue 23 May 2017 08:06:30 PM UTC using RSA key ID FD2497F5
gpg: BAD signature from "Yarn Packaging <[email protected]>"
> GPG signature for this Yarn release is invalid! This is BAD and may mean the release has been tampered with. It is strongly recommended that you report this to the Yarn developers.

Unfortunately the build that @skipjack links no longer has the failure text but it's probably the same error as @bcruddy and i.

And it looks like the @akullpp's bug is slightly different as it has no valid OpenPGP data found. vs Signature made [...] using RSA key ID [...]

[skipjack]

Yeah, somehow restarting the build fixed the issue for us. I'll report back if we see it again.

[arcanis]

@Daniel15 Do you think we could add the file size / Nth first bytes / Nth last bytes in the error messages? It could make it easier to detect corrupted downloads

[Daniel15]

no valid OpenPGP data found means that the GPG signature is totally missing for some reason, whereas BAD signature from "Yarn Packaging <[email protected]>" means that the GPG signature file (.asc) is fine but the signature doesn't match the tarball. Usually this means the tarball is somehow corrupted, and redownloading it will fix the problem. If you're hitting that error message, then even without the GPG verification, you'd likely encounter errors extracting the tarball.

@arcanis - That sounds doable. I guess we could use head and tail to get the first/last Nth bytes?

I wonder if the installation script should simply try to redownload the tarball and see if that works? It's possible the download was interrupted somehow, and retrying a second time could work.

[winterbe]

Also got bad signature while installing latest Yarn 1.1.0:

❯ curl -o- -L https://yarnpkg.com/install.sh | bash
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  6875    0  6875    0     0  10053      0 --:--:-- --:--:-- --:--:-- 10051
Installing Yarn!
/Users/winterbe/.yarn/bin/yarn
> Downloading tarball...

[1/2]: https://yarnpkg.com/latest.tar.gz --> /var/folders/fn/dt_1pxlx0kvcj17f93_tmh5m0000gn/T/yarn.tar.gz.XXXXXXXXXX.ovNMWklZ
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    90  100    90    0     0    233      0 --:--:-- --:--:-- --:--:--   233
100   608    0   608    0     0    505      0 --:--:--  0:00:01 --:--:--   505
100  853k  100  853k    0     0   262k      0  0:00:03  0:00:03 --:--:--  446k

[2/2]: https://yarnpkg.com/latest.tar.gz.asc --> /var/folders/fn/dt_1pxlx0kvcj16f98_tmh5m0000gn/T/yarn.tar.gz.XXXXXXXXXX.ovNMWklZ.asc
100    94  100    94    0     0   1577      0 --:--:-- --:--:-- --:--:--  1577
100   612    0   612    0     0   2322      0 --:--:-- --:--:-- --:--:--  597k
100  1028  100  1028    0     0   2447      0 --:--:-- --:--:-- --:--:--  2447
> Verifying integrity...
gpg: Signatur vom So 24 Sep 20:34:20 2017 CEST
gpg:                mittels RSA-Schlüssel 6A010C5166006599AA17F08146C2130DFD2497F5
gpg: Korrekte Signatur von "Yarn Packaging <[email protected]>" [unbekannt]
gpg: WARNUNG: Dieser Schlüssel trägt keine vertrauenswürdige Signatur!
gpg:          Es gibt keinen Hinweis, daß die Signatur wirklich dem vorgeblichen Besitzer gehört.
Haupt-Fingerabdruck  = 72EC F46A 56B4 AD39 C907  BBB7 1646 B01B 86E5 0310
Unter-Fingerabdruck  = 6A01 0C51 6600 6599 AA17  F081 46C2 130D FD24 97F5
> GPG signature looks good
> Extracting to ~/.yarn...
> Adding to $PATH...
> We've added the following to your /Users/winterbe/.zshrc
> If this isn't the profile of your current shell then please add the following to your correct profile:
   
export PATH="$HOME/.yarn/bin:$PATH"

> Successfully installed Yarn 1.1.0! Please open another terminal where the `yarn` command will now be available.

[Daniel15]

@winterbe It looks fine to me?

gpg: Korrekte Signatur von "Yarn Packaging [email protected]" [unbekannt]

This warning just means that you haven't added the Yarn signing key as a trusted key on your computer. It doesn't mean that the signature is invalid:

gpg: WARNUNG: Dieser Schlüssel trägt keine vertrauenswürdige Signatur!
gpg: Es gibt keinen Hinweis, daß die Signatur wirklich dem vorgeblichen Besitzer gehört.

[winterbe]

Oh OK. My fault, thanks for clarifying! 👍 Daniel Lo Nigro <[email protected]> schrieb am Mo. 25. Sep. 2017 um 13:14:

…

@winterbe <https://github.com/winterbe> It looks fine to me? gpg: Korrekte Signatur von "Yarn Packaging ***@***.***" [unbekannt] This warning just means that you haven't added the Yarn signing key as a trusted key on your computer. It doesn't mean that the signature is invalid: gpg: WARNUNG: Dieser Schlüssel trägt keine vertrauenswürdige Signatur! gpg: Es gibt keinen Hinweis, daß die Signatur wirklich dem vorgeblichen Besitzer gehört. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#3547 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAdmqVFJ3UHkeFpk5IerAELCBXADcvMRks5sl4sqgaJpZM4NrqpK> .