{"action":"created","issue":{"url":"https://api.github.com/repos/commercialhaskell/stack/issues/2773","repository_url":"https://api.github.com/repos/commercialhaskell/stack","labels_url":"https://api.github.com/repos/commercialhaskell/stack/issues/2773/labels{/name}","comments_url":"https://api.github.com/repos/commercialhaskell/stack/issues/2773/comments","events_url":"https://api.github.com/repos/commercialhaskell/stack/issues/2773/events","html_url":"https://github.com/commercialhaskell/stack/issues/2773","id":188636210,"number":2773,"title":"gpg: BAD signature from \"Commercial Haskell all-cabal-files ...\"","user":{"login":"creichert","id":526560,"avatar_url":"https://avatars.githubusercontent.com/u/526560?v=3","gravatar_id":"","url":"https://api.github.com/users/creichert","html_url":"https://github.com/creichert","followers_url":"https://api.github.com/users/creichert/followers","following_url":"https://api.github.com/users/creichert/following{/other_user}","gists_url":"https://api.github.com/users/creichert/gists{/gist_id}","starred_url":"https://api.github.com/users/creichert/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/creichert/subscriptions","organizations_url":"https://api.github.com/users/creichert/orgs","repos_url":"https://api.github.com/users/creichert/repos","events_url":"https://api.github.com/users/creichert/events{/privacy}","received_events_url":"https://api.github.com/users/creichert/received_events","type":"User","site_admin":false},"labels":[{"id":371676945,"url":"https://api.github.com/repos/commercialhaskell/stack/labels/component:%20signing","name":"component: signing","color":"bfdadc","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/commercialhaskell/stack/milestones/8","html_url":"https://github.com/commercialhaskell/stack/milestone/8","labels_url":"https://api.github.com/repos/commercialhaskell/stack/milestones/8/labels","id":1208081,"number":8,"title":"Support","description":"Issues without clear work items for the codebase","creator":{"login":"snoyberg","id":49415,"avatar_url":"https://avatars.githubusercontent.com/u/49415?v=3","gravatar_id":"","url":"https://api.github.com/users/snoyberg","html_url":"https://github.com/snoyberg","followers_url":"https://api.github.com/users/snoyberg/followers","following_url":"https://api.github.com/users/snoyberg/following{/other_user}","gists_url":"https://api.github.com/users/snoyberg/gists{/gist_id}","starred_url":"https://api.github.com/users/snoyberg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/snoyberg/subscriptions","organizations_url":"https://api.github.com/users/snoyberg/orgs","repos_url":"https://api.github.com/users/snoyberg/repos","events_url":"https://api.github.com/users/snoyberg/events{/privacy}","received_events_url":"https://api.github.com/users/snoyberg/received_events","type":"User","site_admin":false},"open_issues":23,"closed_issues":218,"state":"open","created_at":"2015-07-14T20:38:48Z","updated_at":"2016-12-08T18:14:39Z","due_on":null,"closed_at":null},"comments":10,"created_at":"2016-11-10T22:29:49Z","updated_at":"2016-12-08T19:11:38Z","closed_at":"2016-12-08T18:14:39Z","body":"I'm getting gpg \"Bad signature\" errors on my local machine and on CI. \r\n\r\n```\r\ngpg: Signature made Thu 10 Nov 2016 03:41:42 PM CST using RSA key ID D6CF60FD\r\ngpg: BAD signature from \"Commercial Haskell all-cabal-files Travis job (Used exclusively on: https://github.com/commercialhaskell/all-cabal-files) <michael+all-cabal-files@snoyman.com>\"\r\nerror: could not verify the tag 'current-hackage'\r\n```\r\n\r\nI'm not certain if this is something I'm doing wrong so i'll be happy to try out any suggestions.\r\n\r\n### Steps to reproduce\r\n\r\nFor example:\r\n\r\n1. relevant stack.yaml\r\n\r\n```\r\n$ cat stack.yaml\r\n[...]\r\npackage-indices:\r\n  - name: hackage\r\n    download-prefix: https://s3.amazonaws.com/hackage.fpcomplete.com/package/\r\n    git: https://github.com/commercialhaskell/all-cabal-hashes.git\r\n    http: https://s3.amazonaws.com/hackage.fpcomplete.com/00-index.tar.gz\r\n    gpg-verify: true\r\n    require-hashes: true\r\n```\r\n\r\n2. receive gpg key\r\n\r\n```\r\n$ gpg --recv-key --keyserver keyserver.ubuntu.com D6CF60FD\r\ngpg: requesting key D6CF60FD from hkp server keyserver.ubuntu.com\r\ngpg: key D6CF60FD: \"Commercial Haskell all-cabal-files Travis job (Used exclusively on: https://github.com/commercialhaskell/all-cabal-files) <michael+all-cabal-files@snoyman.com>\" not changed\r\ngpg: Total number processed: 1\r\ngpg:              unchanged: 1\r\n```\r\n\r\n3. \r\n\r\n```\r\n$ gpg --edit D6CF60FD\r\ngpg (GnuPG) 1.4.20; Copyright (C) 2015 Free Software Foundation, Inc.\r\nThis is free software: you are free to change and redistribute it.\r\nThere is NO WARRANTY, to the extent permitted by law.\r\n\r\n\r\npub  2048R/D6CF60FD  created: 2015-04-16  expires: never       usage: SC  \r\n                     trust: marginal      validity: unknown\r\nsub  2048R/4EB79513  created: 2015-04-16  expires: never       usage: E   \r\n[ unknown] (1). Commercial Haskell all-cabal-files Travis job (Used exclusively on: https://github.com/commercialhaskell/all-cabal-files) <michael+all-cabal-files@snoyman.com>\r\n\r\ngpg> trust\r\npub  2048R/D6CF60FD  created: 2015-04-16  expires: never       usage: SC  \r\n                     trust: marginal      validity: unknown\r\nsub  2048R/4EB79513  created: 2015-04-16  expires: never       usage: E   \r\n[ unknown] (1). Commercial Haskell all-cabal-files Travis job (Used exclusively on: https://github.com/commercialhaskell/all-cabal-files) <michael+all-cabal-files@snoyman.com>\r\n\r\nPlease decide how far you trust this user to correctly verify other users' keys\r\n(by looking at passports, checking fingerprints from different sources, etc.)\r\n\r\n  1 = I don't know or won't say\r\n  2 = I do NOT trust\r\n  3 = I trust marginally\r\n  4 = I trust fully\r\n  5 = I trust ultimately\r\n  m = back to the main menu\r\n\r\nYour decision? 5\r\nDo you really want to set this key to ultimate trust? (y/N) y\r\n\r\npub  rsa2048/E40D74D6D6CF60FD\r\n     created: 2015-04-16  expires: never       usage: SC  \r\n     trust: ultimate      validity: ultimate\r\nsub  rsa2048/449FF4B24EB79513\r\n     created: 2015-04-16  expires: never       usage: E   \r\n[ultimate] (1). Commercial Haskell all-cabal-files Travis job (Used exclusively on: https://github.com/commercialhaskell/all-cabal-files) <michael+all-cabal-files@snoyman.com>\r\n\r\ngpg> quit\r\n```\r\n\r\n4. run `stack update` or `stack install`\r\n\r\n```\r\n$ stack update\r\nFetched package index.                                                                                    \r\nRunning /usr/bin/git --git-dir=.git tag -v current-hackage in directory /home/christopher/.stack/indices/hackage/git-update/all-cabal-hashes/ exited with ExitFailure 1\r\n\r\nobject 4023c9095acf550a30d7c24036ba337568372bb8\r\ntype commit\r\ntag current-hackage\r\ntagger all-cabal-tool <michael+all-cabal-files@snoyman.com> 1479942071 +0000\r\n\r\nUpdate from Hackage at 2016-11-23T22:58:55Z\r\n\r\ngpg: Signature made Wed 23 Nov 2016 05:01:11 PM CST\r\ngpg:                using RSA key E40D74D6D6CF60FD\r\ngpg: BAD signature from \"Commercial Haskell all-cabal-files Travis job (Used exclusively on: https://github.com/commercialhaskell/all-cabal-files) <michael+all-cabal-files@snoyman.com>\" [ultimate]\r\n\r\nSignature verification failed. \r\nPlease ensure you've set up your\r\nGPG keychain to accept the D6CF60FD signing key.\r\nFor more information, see:\r\nhttps://github.com/fpco/stackage-update#readme\r\n```\r\n\r\n\r\n### Stack version\r\n\r\n```\r\n$ stack --version\r\nVersion 1.1.3, Git revision 7669717b38b6cb9d54bc839c5583819095de3cb8 x86_64 hpack-0.14.0\r\n```\r\n\r\nI've also tested w/ latest from `git`:\r\n\r\n```\r\n$ ~/.local/bin/stack --version\r\nVersion 1.2.1, Git revision 5985b11143a4d3fc57cda67a5d3e77bd15c2f74f x86_64 hpack-0.14.1\r\n```\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/commercialhaskell/stack/issues/comments/265826929","html_url":"https://github.com/commercialhaskell/stack/issues/2773#issuecomment-265826929","issue_url":"https://api.github.com/repos/commercialhaskell/stack/issues/2773","id":265826929,"user":{"login":"lehins","id":2333894,"avatar_url":"https://avatars.githubusercontent.com/u/2333894?v=3","gravatar_id":"","url":"https://api.github.com/users/lehins","html_url":"https://github.com/lehins","followers_url":"https://api.github.com/users/lehins/followers","following_url":"https://api.github.com/users/lehins/following{/other_user}","gists_url":"https://api.github.com/users/lehins/gists{/gist_id}","starred_url":"https://api.github.com/users/lehins/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lehins/subscriptions","organizations_url":"https://api.github.com/users/lehins/orgs","repos_url":"https://api.github.com/users/lehins/repos","events_url":"https://api.github.com/users/lehins/events{/privacy}","received_events_url":"https://api.github.com/users/lehins/received_events","type":"User","site_admin":false},"created_at":"2016-12-08T19:11:38Z","updated_at":"2016-12-08T19:11:38Z","body":"Tag signing in [all-cabal-tool](https://github.com/commercialhaskell/all-cabal-tool) was fixed, so this tag signature validation error should now be gone.\r\nOn that note I would also like to comment on the warning mentioned by @creichert :\r\n\r\n> `Populating index cache ...Package index hackage is configured to require package hashes, but no hash is available for hermes-1.3.4.3`\r\n\r\nThat problem is actually related to hackage itself. Package version `hermes-1.3.4.3` exists on hackage, so `hermes.cabal` file is available for that version, but the actual source code distribution was removed, hence hash values of the package cannot be computed: commercialhaskell/all-cabal-hashes#1 Even hackage blows up with [HTTP 500 error](https://hackage.haskell.org/package/hermes-1.3.4.3) on that package."}}
{"actor":{"display_login":"lehins"}}