github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #223] Signature file on sourceforge.net specifies wrong hash #156

New issue

Closed

opened 2026-05-05 05:11:41 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 05:11:41 -06:00

Owner

Originally created by @genodeftest on GitHub (Jan 13, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/223

The signature file firejail-0.9.36.asc from http://sourceforge.net/projects/firejail/files/firejail/ specifies a lineHash: SHA1. This hash is instead a SHA256 hash of the file.

Originally created by @genodeftest on GitHub (Jan 13, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/223 The signature file [firejail-0.9.36.asc](http://sourceforge.net/projects/firejail/files/firejail/firejail-0.9.36.asc) from http://sourceforge.net/projects/firejail/files/firejail/ specifies a line`Hash: SHA1`. This hash is instead a SHA256 hash of the file.

gitea-mirror

2026-05-05 05:11:41 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:11:47 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 14, 2016):

SHA1 line is added by GnuPG in the process of signing the message. I think, when you verify the message it defaults to SHA1 if for some reasons you cannot use the public/private keys.

https://www.gnupg.org/download/integrity_check.html

@netblue30 commented on GitHub (Jan 14, 2016): SHA1 line is added by GnuPG in the process of signing the message. I think, when you verify the message it defaults to SHA1 if for some reasons you cannot use the public/private keys. https://www.gnupg.org/download/integrity_check.html

gitea-mirror commented

2026-05-05 05:11:50 -06:00

Author

Owner

@genodeftest commented on GitHub (Jan 14, 2016):

I don't know how you get to create this hash, but I am unable to reproduce this. The signature file contains SHA256 hashes but states that it has SHA1 hashes. So the hashes are actually valid SHA256 hashes, but they are incorrectly labeled.

What I see here is what's described in https://bugzilla.redhat.com/show_bug.cgi?id=493126 though.

@genodeftest commented on GitHub (Jan 14, 2016): I don't know how you get to create this hash, but I am unable to reproduce this. The signature file contains SHA256 hashes but states that it has SHA1 hashes. So the hashes are actually valid SHA256 hashes, but they are incorrectly labeled. What I see here is what's described in https://bugzilla.redhat.com/show_bug.cgi?id=493126 though.

gitea-mirror commented

2026-05-05 05:11:52 -06:00

Author

Owner

@netblue30 commented on GitHub (Jan 14, 2016):

"--digest-algo SHA256" fixed it, thanks for the Fedora link! Next release it will be with SHA256.

@netblue30 commented on GitHub (Jan 14, 2016): "--digest-algo SHA256" fixed it, thanks for the Fedora link! Next release it will be with SHA256.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#156

No description provided.

Rows
Columns