<div dir="ltr"><div>Hi all</div><div><br></div><div>I've been working with John Soo on this and have been asked to continue where John left off.</div><div><br></div><div><font face="arial, sans-serif">Using 2.5.17, I tried verifying the same signature 100 times via a script and got a bad signature on each attempt. Here's how I ran such a test. Let me know whether or not this is a valid test run.</font></div><div><font face="arial, sans-serif"><br></font></div><div><span style="font-family:arial,sans-serif">To ease the ability to build 2.5.17 from source, I </span><span style="font-family:arial,sans-serif">used Homebrew to get the dependencies I needed. </span><span style="color:rgb(0,0,0);font-family:arial,sans-serif">See `configuration-output.txt` for build-related output information.</span><font face="arial, sans-serif"><br></font></div><div><font face="arial, sans-serif"><br></font><span style="color:rgb(0,0,0);font-family:arial,sans-serif">Steps I took to build 2.5.17 and run the test</span><br><font face="monospace">```<br></font><span style="color:rgb(0,0,0)">cd gnupg-w32-2.5.17<br>mkdir build<br>cd build<br></span><font face="monospace">.<span style="color:rgb(0,0,0)">./configure --enable-all-tests \</span></font></div><div><pre style="line-height:normal;margin:0px;color:rgb(0,0,0)"> --with-libgpg-error-prefix=/opt/homebrew/Cellar/libgpg-error/1.58 \
--with-libgcrypt-prefix=/opt/homebrew/Cellar/libgcrypt/1.12.0 \
--with-libassuan-prefix=/opt/homebrew/Cellar/libassuan/3.0.2 \
--with-libksba-prefix=/opt/homebrew/Cellar/libksba/1.6.7 \
--with-npth-prefix=/opt/homebrew/Cellar/npth/1.8
make
make check
sudo make install
# Verified path's gpg was 2.5.17
gpg --version
# Renamed old `.gnupg` folder to ensure it didn't conflict
# with newer gpg version
cd ~
mv .gnupg .old-gnupg
gpgconf --kill all
# Reimported original key
gpg --import
# Ran the code sign test
cd code-sign-test
./debug.sh</pre></div><div><font face="monospace">```</font></div><div><font face="arial, sans-serif"><br></font></div><div><span style="color:rgb(0,0,0)"><font face="arial, sans-serif">configuration-output.txt</font></span></div><div><font face="monospace">```</font></div><div><span style="color:rgb(0,0,0)"><font face="monospace">configure: WARNING:</font></span></div><div><pre style="line-height:normal;margin:0px;color:rgb(0,0,0)">***
*** The config script "/opt/homebrew/bin/gpgrt-config --libdir=/opt/homebrew/lib gpg-error" was
*** built for aarch64-apple-darwin25.1.0 and thus may not match the
*** used host aarch64-apple-darwin25.2.0.
*** You may want to use the configure option --with-libgpg-error-prefix
*** to specify a matching config script or use $SYSROOT.
***
configure: WARNING:
***
*** The config script "/opt/homebrew/bin/gpgrt-config --libdir=/opt/homebrew/lib libassuan" was
*** built for aarch64-apple-darwin25.0.0 and thus may not match the
*** used host aarch64-apple-darwin25.2.0.
*** You may want to use the configure option --with-libassuan-prefix
*** to specify a matching config script.
***
configure: WARNING:
***
*** The config script "/opt/homebrew/bin/gpgrt-config --libdir=/opt/homebrew/lib ksba" was
*** built for aarch64-apple-darwin25.0.0 and thus may not match the
*** used host aarch64-apple-darwin25.2.0.
*** You may want to use the configure option --with-libksba-prefix
*** to specify a matching config script.
***
configure: WARNING:
***
*** The config script "/opt/homebrew/bin/gpgrt-config --libdir=/opt/homebrew/lib npth" was
*** built for aarch64-apple-darwin25.0.0 and thus may not match the
*** used host aarch64-apple-darwin25.2.0.
*** You may want to use the configure option --with-npth-prefix
*** to specify a matching config script.
***
GnuPG v2.5.17 has been configured as follows:
Revision: 17b514596 (6069)
Platform: Darwin (aarch64-apple-darwin25.2.0)
OpenPGP: yes
S/MIME: yes
Agent: yes
Smartcard: yes (without internal CCID driver)
TPM: no
G13: no
Dirmngr: no
Keyboxd: no
Gpgtar: yes
WKS tools: yes
Protect tool: (default)
LDAP wrapper: (default)
Default agent: (default)
Default pinentry: (default)
Default scdaemon: (default)
Default keyboxd: (default)
Default tpm2daemon: (default)
Default dirmngr: (default)
Dirmngr auto start: yes
Readline support: no
LDAP support: n/a
TLS support: no
TOFU support: no
Tor support: only .onion
Warning: Mismatches between the target platform and the
to be used libraries have been detected for:
libgpg-error
Please check above for more warning messages.</pre></div><div><font face="monospace">```</font></div><div><font face="arial, sans-serif"><br></font></div><div><font face="arial, sans-serif">`debug.sh` script:</font></div><div><font face="monospace">```</font></div><div><pre style="line-height:normal;margin:0px;color:rgb(0,0,0)">#!/usr/bin/env bash
echo "" > git-trace.txt
rm data.txt.asc *-dbgmd-00001.sign *-dbgmd-00001.verify *-dbgmd-00002.unknown
echo "GPG version"
gpg --version | sed '8c\
Home: /Users/<user>/.gnupg'
echo ""
for i in {1..100}; do
echo "loop ${i}"
rm data.txt.asc
echo "data was"
echo "$(cat data.txt)"
gpg --verbose --debug hashing -bsau 6E628CC4145FD2ED data.txt
echo ""
echo "signature was"
echo "$(cat data.txt.asc)"
echo ""
echo "verification was"
if ! gpg --verify --verbose --debug hashing data.txt.asc data.txt; then
echo "result: failed"
echo "gpg verify failed for ${i}"
mv dbgmd-00001.sign bad-dbgmd-00001.sign
mv dbgmd-00001.verify bad-dbgmd-00001.verify
mv dbgmd-00002.unknown bad-dbgmd-00002.unknown
echo ""
echo "Starting loop to verify signature multiple times"
for j in {1..100}; do
echo "Verify loop ${j}"
if ! gpg --verify --verbose --debug hashing data.txt.asc data.txt; then
echo "Verify loop failed for ${j}"
else
echo "Verify loop succeeded for ${j}"
break;
fi
echo ""
echo ""
done
break;
else
echo "result: succeeded"
echo "gpg verify passed for ${i}"
mv dbgmd-00001.sign good-dbgmd-00001.sign
mv dbgmd-00001.verify good-dbgmd-00001.verify
mv dbgmd-00002.unknown good-dbgmd-00002.unknown
fi
echo ""
echo ""
done</pre></div><div><font face="monospace">```</font></div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Mon, Feb 23, 2026 at 9:25 AM John Soo <<a href="mailto:john.soo%2Bgnupg-users@arista.com">john.soo+gnupg-users@arista.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr">cc'ing Jordan who is debugging this, too.</div></div>
</blockquote></div><div><br clear="all"></div><div><br></div><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div>Blessings,</div><div>Jordan<br></div></div></div>