Validating Integrity and Authenticity of Encompass-0.5.0-OSX_Installer.pkg

[mazaclub]

Validating Integrity and Authenticity of Encompass-0.5.0-OSX_Installer.pkg

[skaht]

Noticing the same issue with:

% gpg --verify Electrum-DASH-Installer_2.4.1_beta1.pkg.asc

gpg: assuming signed data in `Electrum-DASH-Installer_2.4.1_beta1.pkg'
gpg: Signature made Tue Oct 27 23:39:29 2015 EDT using RSA key ID 986FF288
gpg: requesting key 986FF288 from hkps server hkps.pool.sks-keyservers.net
gpgkeys: HTTP fetch error 60: SSL certificate problem: Invalid certificate chain
gpg: DBG: armor-keys-failed (KEY 0xBABFF6FC986FF288 BEGIN
) ->0
gpg: DBG: armor-keys-failed (KEY 0xBABFF6FC986FF288 FAILED 1
) ->1
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0
gpg: keyserver communications error: keyserver helper internal error
gpg: keyserver communications error: general error
gpg: Can't check signature: public key not found

Will wait until brew is supported.

We are working this week to change the build system to use Homebrew instead of macports - This will have the added benefit of allowing our build system to execute on Travis-CI infrastructure, providing build automation.

[skaht]

1. After loading GPG key ID CBFFB73C into my keychain, some degree of checking of the integrity & authenticity of Encompass-0.5.0-OSX_Installer.pkg for "mazaclub code signing key (mazaclub code releases) [email protected]" resulted.

% gpg --verify Encompass-0.5.0-OSX_Installer.pkg.asc

gpg: assuming signed data in `Encompass-0.5.0-OSX_Installer.pkg'
gpg: Signature made Thu Apr 30 05:08:27 2015 EDT using RSA key ID CBFFB73C
gpg: Good signature from "mazaclub code signing key (mazaclub code releases) <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 71FA FCB7 1F0A 961B 23E7  D7EF 0A02 0276 CBFF B73C

2. After loading GPG key ID 986FF288 into my keychain, some degree of checking of the integrity & authenticity of lectrum-DASH-Installer_2.4.1_beta1.pkg for "Evan Duffield [email protected]" resulted.

% gpg --verify Electrum-DASH-Installer_2.4.1_beta1.pkg.asc

gpg: assuming signed data in `Electrum-DASH-Installer_2.4.1_beta1.pkg'
gpg: Signature made Tue Oct 27 23:39:29 2015 EDT using RSA key ID 986FF288
gpg: Good signature from "Evan Duffield <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: C226 7E44 74EA 2EE9 D739  4900 BABF F6FC 986F F288