How to verify package signatures in readme.txt.asc (v1.6.2)?

[yinso]

Hi,
I am trying to verify the package signature for opensnitch_1.6.2-1_amd64.deb on Ubuntu 22.04.

$ sha1sum opensnitch_1.6.2-1_amd64.deb
88cdec1bd2f193bcd2298e225c0c03f39b7fe0e7  opensnitch_1.6.2-1_amd64.deb

which is different from the checksum in the corresponding readme.txt.asc

338b8effbab3d33d4ab345c4b2f1796af1a8eca4  bins/opensnitch_1.6.2-1_amd64.deb

Please let me know if I am doing something incorrectly, thanks.

[RyanZim]

Same result here; and it seems you're following the correct process, as this works correctly for v1.6.1 and v.1.6.3 (UI).

[yinso]

Thanks @RyanZim - does that mean the readme.txt/asc files should be updated?

[RyanZim]

Seems like there's a problem with them, yes.

[RyanZim]

https://github.com/evilsocket/opensnitch/releases/tag/v1.6.2 now has a note:

[updated 07/10/2023]
readme.txt.asc updated to reflect the correct checksums. The .deb/.rpm files are signed individually after being built, thus the checksums changes.

The readme.txt.asc has been updated, and now lists 88cdec1bd2f193bcd2298e225c0c03f39b7fe0e7 as the correct hash.