X-Recipient:	archive-cygwin AT delorie DOT com
X-Original-To:	cygwin AT cygwin DOT com
Delivered-To:	cygwin AT cygwin DOT com
DMARC-Filter:	OpenDMARC Filter v1.4.1 sourceware.org 542EC3858D39
Authentication-Results:	sourceware.org; dmarc=none (p=none dis=none)
	header.from=dronecode.org.uk
Authentication-Results:	sourceware.org; spf=none smtp.mailfrom=dronecode.org.uk
Authentication-Results:	btinternet.com;
	auth=pass (PLAIN) smtp.auth=jonturney AT btinternet DOT com;
	bimi=skipped
X-SNCR-Rigid:	613A901C0EE84DAB
X-Originating-IP:	[81.129.146.209]
X-OWM-Source-IP:	81.129.146.209 (GB)
X-OWM-Env-Sender:	jonturney AT btinternet DOT com
X-VadeSecure-score:	verdict=clean score=0/300, class=clean
X-RazorGate-Vade:	gggruggvucftvghtrhhoucdtuddrgedvuddruddvgedguddvucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuueftkffvkffujffvgffngfevqffopdfqfgfvnecuuegrihhlohhuthemuceftddunecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjughrpefkffggfgfuvfhfhfgjtgfgsehtjeertddtfeejnecuhfhrohhmpeflohhnucfvuhhrnhgvhicuoehjohhnrdhtuhhrnhgvhiesughrohhnvggtohguvgdrohhrghdruhhkqeenucggtffrrghtthgvrhhnpeehudeuveeujeeujeegueefhedttdekvedtudeileefteetfeefjeejudekfefggfenucffohhmrghinheptgihghifihhnrdgtohhmnecukfhppeekuddruddvledrudegiedrvddtleenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhephhgvlhhopegludelvddrudeikedruddruddtfegnpdhinhgvthepkedurdduvdelrddugeeirddvtdelpdhmrghilhhfrhhomhepjhhonhdrthhurhhnvgihsegurhhonhgvtghouggvrdhorhhgrdhukhdprhgtphhtthhopegthihgfihinhestgihghifihhnrdgtohhmpdhrtghpthhtohepghhrvghgrdifihhllhhirghmshhonhegheesghhmrghilhdrtghomh
X-RazorGate-Vade-Verdict:	clean 0
X-RazorGate-Vade-Classification:	clean
Message-ID:	<46fb394d-66dd-8648-b961-4a13411cc7ed@dronecode.org.uk>
Date:	Thu, 30 Dec 2021 23:38:52 +0000
MIME-Version:	1.0
User-Agent:	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
	Thunderbird/91.4.1
Subject:	Re: Unable to Verify 64 bit Installer on Windows
To:	Greg Williamson <greg DOT williamson45 AT gmail DOT com>,
	The Cygwin Mailing List <cygwin AT cygwin DOT com>
References:	<CAPwDAhA1mFg9=QkU6OU_1BFC_Sz500yJ2+YpQgzf1p-i2Lyabw AT mail DOT gmail DOT com>
From:	Jon Turney <jon DOT turney AT dronecode DOT org DOT uk>
In-Reply-To:	<CAPwDAhA1mFg9=QkU6OU_1BFC_Sz500yJ2+YpQgzf1p-i2Lyabw@mail.gmail.com>
X-Spam-Status:	No, score=-1193.4 required=5.0 tests=BAYES_00, FORGED_SPF_HELO,
	KAM_DMARC_STATUS, KAM_LAZY_DOMAIN_SECURITY, NICE_REPLY_A, RCVD_IN_DNSWL_NONE,
	RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, SPF_HELO_PASS, SPF_NONE,
	TXREP autolearn=ham autolearn_force=no version=3.4.4
X-Spam-Checker-Version:	SpamAssassin 3.4.4 (2020-01-24) on
	server2.sourceware.org
X-BeenThere:	cygwin AT cygwin DOT com
X-Mailman-Version:	2.1.29
List-Id:	General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe:	<https://cygwin.com/mailman/options/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive:	<https://cygwin.com/pipermail/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe:	<https://cygwin.com/mailman/listinfo/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
Errors-To:	cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com
Sender:	"Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>

On 30/12/2021 21:24, Greg Williamson wrote:
> Hello,
> 
> While attempting to verify the installer found here:
> https://cygwin.com/install.html
> 
> GPG verification for "setup-x86_64.exe" failed with "BAD signature from
> "Cygwin <cygwin AT cygwin DOT com>". I also created a SHA512 hash of the installer
> and it did not match the one posted here:
> https://cygwin.com/sha512.sum
> 
> As a sanity check I attempted to verify the 32bit version "setup-x86.exe".
> The SHA512 matched and the GPG signature verification succeeded.
> 
> I thought I'd report here in case there was a security issue. Thank you in
> advance for your assistance!
> 

At 2021-Dec-30 19:14 UTC I downgraded the setup executables being served 
to a previous version, to give some more time to investigate an issue 
reported with setup 2.911.

I'm going to guess that was the reason for this.

However, please note that some caching outside of our control must have 
occurred, as at all times, the signatures and hashes presented were 
consistent and correct.

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

- Raw text -