|
|
| Reporter | stevko | Assigned To | rhertzog | |
|---|
| Priority | normal | Severity | minor | Reproducibility | have not tried |
|---|
| Status | resolved | Resolution | fixed | |
|---|
| Product Version | 1.0.9 | |
|---|
|
|
| Summary | 0001855: There are two versions of kali-linux-1.0.9a-amd64.iso, both with signed SHA1SUMS |
|---|
| Description | Depending on a mirror, one can get two different versions of kali-linux-1.0.9a-amd64.iso. One of them has sha1sum as seen on webpage (2744d50f56c3d6332bc75e676f36aad3058d0aad) the other one has different (0fd0cbaedc0daa7a9af5d3e76f9991bba5b0e3bd). The different one can be obtained e.g. from http://kali.solaraservers.com/kali-images/kali-1.0.9a/) There are also two different versions of SHA1SUMS file and even two versions of SHA1SUMS.gpg (for each iso). The interesting thing is that both of these signatures verify with the same kali key (44C6 513A 8E4F B3D3 0875 F758 ED44 4FF0 7D8D 0BF6). |
|---|
| Steps To Reproduce | Download kali iso, sha1sums and sha1sums.gpg from this mirror: http://kali.solaraservers.com/kali-images/kali-1.0.9a/ and also from some other mirror. Observe that files differ, but SHA1SUMS are both signed with Kali key. |
|---|
| Additional Information | stevko@napo ~/tmp$ find
.
./1
./1/SHA1SUMS.gpg
./1/SHA1SUMS
./2
./2/SHA1SUMS.gpg
./2/SHA1SUMS
stevko@napo ~/tmp$ LANG=C gpg --verify 1/SHA1SUMS.gpg 1/SHA1SUMS
gpg: Signature made So 27. september 2014, 21:40:24 CEST using RSA key ID 7D8D0BF6
gpg: Good signature from "Kali Linux Repository <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 44C6 513A 8E4F B3D3 0875 F758 ED44 4FF0 7D8D 0BF6
stevko@napo ~/tmp$ LANG=C gpg --verify 2/SHA1SUMS.gpg 2/SHA1SUMS
gpg: Signature made Št 2. október 2014, 15:26:04 CEST using RSA key ID 7D8D0BF6
gpg: Good signature from "Kali Linux Repository <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 44C6 513A 8E4F B3D3 0875 F758 ED44 4FF0 7D8D 0BF6
stevko@napo ~/tmp$ cat 1/SHA1SUMS
0fd0cbaedc0daa7a9af5d3e76f9991bba5b0e3bd kali-linux-1.0.9a-amd64.iso
9fb803924bb5feea5b7ebf6c8ccb74cee3858dff kali-linux-1.0.9a-i386.iso
5e98e48a26c877fa3ab288bcc62eb6993c4c2139 kali-linux-1.0.9a-armel.img.xz
06a849d325e397e1703b8e2769c472a7f215311c kali-linux-1.0.9a-armhf.img.xz
stevko@napo ~/tmp$ cat 2/SHA1SUMS
2744d50f56c3d6332bc75e676f36aad3058d0aad kali-linux-1.0.9a-amd64.iso
89acef59694abc6858da681bb466355f6a31fdb6 kali-linux-1.0.9a-i386.iso
5e98e48a26c877fa3ab288bcc62eb6993c4c2139 kali-linux-1.0.9a-armel.img.xz
06a849d325e397e1703b8e2769c472a7f215311c kali-linux-1.0.9a-armhf.img.xz
stevko@napo ~/tmp$ |
|---|
|
|
