scripts: log failing signature details in verify-install
What the developer wrote
Authored by ziggie
scripts: log failing signature details in verify-install
When gpg --verify fails, include the signature filename, username,
and full GPG output in the error message. Previously only a generic
"Invalid signature!" was printed, making it hard to identify which
signer's signature was invalid.
What changed, and why it matters
This commit improves an error message in a release-verification script. When a GPG signature check fails, it now prints the signature filename, the username, and the full GPG output instead of just a generic 'Invalid signature!' message. This is a usability/debugging improvement, not a security fix.
No security action required. Treat as a normal usability/debugging improvement.
Security signals we found
No vulnerability class present
Diagnostic-only change
No change to trust model or signature validation logic
Evidence from the diff
The change is in scripts/verify-install.sh inside the verify_signatures() function. The failure branch of a gpg –verify command is expanded to emit more diagnostic context (signature file, signer username, and the captured GPG status/output). No cryptographic logic, trust checks, or command behavior is altered; only the diagnostics printed on failure are enhanced.
Changed components
scripts/verify-install.shInspect captured patch +6 / −1
diff --git a/scripts/verify-install.sh b/scripts/verify-install.sh
index a1f84ed..f1b747a 100755
--- a/scripts/verify-install.sh
+++ b/scripts/verify-install.sh
@@ -159,7 +159,12 @@ function verify_signatures() {
# Run the actual verification.
gpg --homedir "$TEMP_DIR" --no-default-keyring --keyring "$KEYRING" --status-fd=1 \
--verify "$TEMP_DIR/$signature" "$TEMP_DIR/$MANIFEST" \
- > "$STATUS_FILE" 2>&1 || { echo "ERROR: Invalid signature!"; exit 1; }
+ > "$STATUS_FILE" 2>&1 || {
+ echo "ERROR: Invalid signature $signature from user $USERNAME!"
+ echo " GPG output:"
+ cat "$STATUS_FILE" | sed 's/^/ /'
+ exit 1
+ }
echo "Verifying $signature of user $USERNAME against key ring $KEYRING"
if grep -q "Good signature" "$STATUS_FILE"; then
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.