<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:10pt"><div class="" style=""><span class="" style="">Hello,</span></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class=""><span class="" style=""><br class="" style=""></span></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class="">I have downloaded bind-9.10.0.tar.gz from the ISC download site, imported in the pgpkey2013.txt located at: <a href="https://www.isc.org/downloads/software-support-policy/openpgp-key/" class=""
style="">https://www.isc.org/downloads/software-support-policy/openpgp-key/</a> , and can't seem to get any of the signature files to pass the verify test using gpg :</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class=""><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class=""><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class=""><br class="" style=""></div><div style="background-color: transparent" class="">gpg --import
pgpkey2013.txt </div><div style="background-color: transparent" class="">gpg: WARNING: using insecure memory!</div><div style="background-color: transparent" class="">gpg: please see http://www.gnupg.org/faq.html for more information</div><div style="background-color: transparent" class="">gpg: key 189CDBC5: public key "Internet Systems Consortium, Inc. (Signing key, 2013) <codesign@isc.org>" imported</div><div style="background-color: transparent" class="">gpg: Total number processed: 1</div><div style="background-color: transparent" class="">gpg: imported: 1 (RSA: 1)</div><div class="" style=""><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class=""><br class="" style=""></div><div style="color: rgb(0, 0, 0);
font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class=""><br class="" style=""></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal" class=""><br class="" style=""></div><div style="background-color: transparent" class="">gpg --verify bind-9.10.0.tar.gz.asc bind-9.10.0.tar.gz</div><div style="background-color: transparent" class="">gpg: WARNING: using insecure memory!</div><div style="background-color: transparent" class="">gpg: please see http://www.gnupg.org/faq.html for more information</div><div style="background-color: transparent" class="">gpg: Signature made Tue Apr 29 16:12:28 2014 EDT using RSA key ID 189CDBC5</div><div style="background-color: transparent" class="">gpg: BAD signature from
"Internet Systems Consortium, Inc. (Signing key, 2013) <codesign@isc.org>"</div><div class="" style=""><br class="" style=""></div><div class="" style=""><br class="" style=""></div><div class="" style=""><div class="" style="">gpg --verify bind-9.10.0.tar.gz.sha512.asc bind-9.10.0.tar.gz</div><div class="" style="">gpg: WARNING: using insecure memory!</div><div class="" style="">gpg: please see http://www.gnupg.org/faq.html for more information</div><div class="" style="">gpg: Signature made Tue Apr 29 16:12:25 2014 EDT using RSA key ID 189CDBC5</div><div class="" style="">gpg: BAD signature from "Internet Systems Consortium, Inc. (Signing key, 2013) <codesign@isc.org>"</div><div class="" style=""><br class="" style=""></div><div class="" style=""><br class="" style=""></div><div class="" style=""><div class="" style="">gpg --verify bind-9.10.0.tar.gz.sha256.asc bind-9.10.0.tar.gz</div><div class="" style="">gpg: WARNING: using insecure
memory!</div><div class="" style="">gpg: please see http://www.gnupg.org/faq.html for more information</div><div class="" style="">gpg: Signature made Tue Apr 29 16:12:26 2014 EDT using RSA key ID 189CDBC5</div><div class="" style="">gpg: BAD signature from "Internet Systems Consortium, Inc. (Signing key, 2013) <codesign@isc.org>"</div><div class="" style=""><br class="" style=""></div><div class="" style=""><br class="" style=""></div><div class="" style=""><br class="" style=""></div><div class="" style="">I am sure its a user error mistake, but wanted to verify other bind users are able to verify the downloaded files correctly, before digging any deeper into the problem. If anyone has been able to verify the latest stable release using the posted keys, please let me know.</div><div class="" style=""><br></div><div class="" style="">Thanks,</div></div><div class="" style=""><br class="" style=""></div></div><div class="" style=""><br
class="" style=""></div><div class="" style=""></div><div class="" style=""> </div><div class="" style="">*****The content of this message is my personal opinion only, and should not be construed as anything that has been through rigorous scrutiny of the professional groups who devote their life and work to the topics being discussed********</div></div></body></html>