[Enigmail] Signature and download files for 0.94.4 do not correspond.....

[Olav Seyfarth]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear Bo,

Bo Berglund schrieb:
> I am a newbie on this list....

Welcome!
If you subscribe, your posts will not need to wait for moderator approval.

> downloaded EM 0.94.4 for TB 1.5 from http://enigmail.mozdev.org/download.html
> XPI       -> https://addons.mozilla.org/[...]-0.94.4-tb+sm.xpi
> Signature -> http://www.mozilla-enigmail.org/[...]-0.94.4-win+lin+mac.xpi.asc

On Jun 13 09:07:27 2007 UTC Patrick modified the download links to point to
addons.mozilla.org instead of www.mozilla-enigmail.org due to this advisory:
http://paranoia.dubfire.net/2007/05/remote-vulnerability-in-firefox.html

> gpg --verify enigmail-0.94.4-win+lin+mac.xpi.asc yields an error

To work that easy, the filename of the file to be verified needs to be the
filename of the signature minus the ".asc/.gpg" extension. If GnuPG d doesn't
find a matching file , it usually asks for the name of the file to verify.

We are aware of the current file name inconsistency: as we provide packages
for many systems, we use a naming-convention that includes the target OS.
However, Mozilla Update doesn't include OS but Mozilla platform in their XPI
names. Unfortunately, addons.mozilla.org still does not support to send
packages along with detached signatures. On the other hand, dropping the OS
in the filename would confront us with support questions like "I downloaded
Enigmail but it crashes my TB." - and that seems to be worse than non-hasslefree
signature checking.

> gpg: no signed data
> gpg: can't hash datafile: file open error

Thank you for your hint! There is a problem with downloading signature files.
If you check the content of your enigmail-0.94.4-win+lin+mac.xpi.asc, you most
probably see that it actually isn't a signature file but a HTML error page:
"403 You don't have permission to access enigmail-0.94.4-win+lin+mac.xpi.asc"
Unfortunately I cannot fix it immediately but we will fix it tomorrow.

> And what can I do?

Please try to download the signature again on Thursday.

Olav
- --
Jabber: nursoda at jabber.org

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQCVAwUBRpQbj/3SdHpORjpqAQLXAgP/d3NNpfFCxzWDawn5ADlleYjN9Ias7Utx
r6OW9qnKPyw062+yjatUkP0LumQWgxBI7GSZfTBpK8MCIfUKzL771zblxNU42Sf+
BuAkiQdTg/MLfBuoR48kE6gpKa5Io2T3Evc8PGELJd++OTSCxXEvrbrw7oF4B1+W
YBCzo8nclhs=
=5z38
-----END PGP SIGNATURE-----