Great, thanks for your help. All is well now. For all others who want to quickly check signatures and sha, here is a little script. I included MD5 checking as well, maybe its of use later (md5 is pretty common at the asf too). Please note, KEYS must be imported to succeed this. Also download locations needs to be adjusted
#!/bin/sh wget https://people.apache.org/~al/wave_rc/0.4-rc3/apache-wave-bin-0.4-incubating.tar.bz2 wget https://people.apache.org/~al/wave_rc/0.4-rc3/apache-wave-bin-0.4-incubating.tar.bz2.asc wget https://people.apache.org/~al/wave_rc/0.4-rc3/apache-wave-bin-0.4-incubating.tar.bz2.sha wget https://people.apache.org/~al/wave_rc/0.4-rc3/apache-wave-bin-0.4-incubating.zip wget https://people.apache.org/~al/wave_rc/0.4-rc3/apache-wave-bin-0.4-incubating.zip.asc wget https://people.apache.org/~al/wave_rc/0.4-rc3/apache-wave-bin-0.4-incubating.zip.sha wget https://people.apache.org/~al/wave_rc/0.4-rc3/apache-wave-src-0.4-incubating.tar.bz2 wget https://people.apache.org/~al/wave_rc/0.4-rc3/apache-wave-src-0.4-incubating.tar.bz2.asc wget https://people.apache.org/~al/wave_rc/0.4-rc3/apache-wave-src-0.4-incubating.tar.bz2.sha wget https://people.apache.org/~al/wave_rc/0.4-rc3/apache-wave-src-0.4-incubating.zip wget https://people.apache.org/~al/wave_rc/0.4-rc3/apache-wave-src-0.4-incubating.zip.asc wget https://people.apache.org/~al/wave_rc/0.4-rc3/apache-wave-src-0.4-incubating.zip.sha checksum () { echo "Checking file: $1" echo "Using $2 file: $1.$2" file1=`openssl $2 $1 | awk -F " " '{print $2}'` file2=`cut -d* -f1 $1.$2` echo "FILE1 " $file1 echo "FILE2 " $file2 if [ $file1 = $file2 ] then echo "$2 checksums OK" else echo "$2 sums mismatch" fi } check_sha () { echo "Checking file: $1" echo "Using $2 file: $1.$2" file1=`gpg --print-md SHA512 $1 | cut -d : -f2 | tr -d ' ' | tr -d '\n'` file2=`cut -d : -f2 $1.$2 | tr -d ' ' | tr -d '\n' ` echo "File 1: START" $file1 "END" echo "File 2: START" $file2 "END" if [[ $file1 == $file2 ]] then echo "$2 checksums OK" else echo "$2 sums mismatch" fi echo " " } if [ -n "$1" ] then root_dir=$1 else root_dir=. fi for file in $root_dir/*.tar.bz2 $root_dir/*.zip; do # checksum $file 'md5' check_sha $file 'sha' echo "GPG verification output" gpg --verify $file.asc $file echo "~~~~~~~~~~~~~~~~~~~~~~~" done
