From da27f27026d92841e3ea91e100608ed9854ac013 Mon Sep 17 00:00:00 2001 From: Jonas Nick Date: Mon, 31 Aug 2026 08:12:01 +0000 Subject: [PATCH] fetch-release: fix signature verification! `gpg --verify nar-hash.txt.asc` with a single argument lets gpg pick the verification mode from the file's packet structure. For a real detached signature it hashes the sibling nar-hash.txt, but for an inline signed message it verifies the payload embedded in the .asc itself, never reads nar-hash.txt, prints "not a detached signature; file was NOT verified!" and still exits 0. The `&> /dev/null` hid that warning. --- helper/fetch-release | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helper/fetch-release b/helper/fetch-release index 7b447a0..8567812 100755 --- a/helper/fetch-release +++ b/helper/fetch-release @@ -31,7 +31,7 @@ curl -fsS -L -O "$baseUrl/nar-hash.txt" curl -fsS -L -O "$baseUrl/nar-hash.txt.asc" # Verify signature for nar-hash -gpg --verify nar-hash.txt.asc &> /dev/null || { +gpg --verify nar-hash.txt.asc nar-hash.txt &> /dev/null || { >&2 echo "Error: Signature verification failed. Please open an issue in the project repository." exit 1 }