From b7c4755934bf27ae96fba5ba549df91b3d3a392c Mon Sep 17 00:00:00 2001 From: ziggie Date: Thu, 12 Feb 2026 18:43:21 +0100 Subject: [PATCH] scripts: log failing signature details in verify-install When gpg --verify fails, include the signature filename, username, and full GPG output in the error message. Previously only a generic "Invalid signature!" was printed, making it hard to identify which signer's signature was invalid. --- scripts/verify-install.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/scripts/verify-install.sh b/scripts/verify-install.sh index a1f84eded..f1b747a71 100755 --- a/scripts/verify-install.sh +++ b/scripts/verify-install.sh @@ -159,7 +159,12 @@ function verify_signatures() { # Run the actual verification. gpg --homedir "$TEMP_DIR" --no-default-keyring --keyring "$KEYRING" --status-fd=1 \ --verify "$TEMP_DIR/$signature" "$TEMP_DIR/$MANIFEST" \ - > "$STATUS_FILE" 2>&1 || { echo "ERROR: Invalid signature!"; exit 1; } + > "$STATUS_FILE" 2>&1 || { + echo "ERROR: Invalid signature $signature from user $USERNAME!" + echo " GPG output:" + cat "$STATUS_FILE" | sed 's/^/ /' + exit 1 + } echo "Verifying $signature of user $USERNAME against key ring $KEYRING" if grep -q "Good signature" "$STATUS_FILE"; then