Getting bad signature when GPG Verify

[nomadme]

Installed the copilot cli from https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Copilot.html

and when verifying with GPG, getting BAD signature.

gpg: Signature made Fri May  6 18:09:42 2022 CDT
gpg:                using RSA key DE3CBD61ADAF8B8E
gpg: BAD signature from "Amazon ECS <[email protected]>" [unknown]

Platform: MacOs 12.3 Architecture: M1 copilot version: v1.18.0

[huanjani]

Hi @nomadme!

Thanks for providing your architecture. My teammate, @dannyrandall, noticed that the signature provided for copying-and-pasting in Step 6 of the docs you linked to are for the non-ARM binary, and you have the ARM version of the binary for your M1 machine.

We'll look into getting that fixed in the AWS docs! Sorry about that. Also see the Copilot docs: https://aws.github.io/copilot-cli/.

[dannyrandall]

While we work on fixing the docs, can you see if this works on your M1 mac instead?

1. Install copilot:

brew install aws/tap/copilot-cli

2. Download the darwin-arm64 signature:

curl -Lo copilot.asc https://github.com/aws/copilot-cli/releases/latest/download/copilot-darwin-arm64.asc

3. Verify copilot:

gpg --verify copilot.asc /usr/local/bin/copilot

[java-alpha]

brew install aws/tap/copilot-cli
==> Fetching aws/tap/copilot-cli ==> Downloading https://github.com/aws/copilot-cli/releases/download/v1.27.0/copilot_1.27.0_macOS_amd64.tar.gz Already downloaded: /Users/gordon.zhang/Library/Caches/Homebrew/downloads/a9ba05a48696c480bc47637366498111bc46b463fd6d99712eadfe4ee48c2bfb--copilot_1.27.0_macOS_amd64.tar.gz ==> Installing copilot-cli from aws/tap ==> Downloading https://formulae.brew.sh/api/cask.jws.json #=#=- # # ==> Caveats zsh completions have been installed to: /usr/local/share/zsh/site-functions ==> Summary 🍺 /usr/local/Cellar/copilot-cli/1.27.0: 5 files, 49.2MB, built in 5 seconds ==> Runningbrew cleanup copilot-cli... Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP. Hide these hints with HOMEBREW_NO_ENV_HINTS (see man brew).

curl -Lo copilot.asc https://github.com/aws/copilot-cli/releases/latest/download/copilot-darwin-arm64.asc

% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 100 821 100 821 0 0 1301 0 --:--:-- --:--:-- --:--:-- 1301

gpg --verify copilot.asc /usr/local/bin/copilot

gpg: Signature made Mon Mar 27 18:53:01 2023 EDT gpg: using RSA key DE3CBD61ADAF8B8E gpg: BAD signature from "Amazon ECS <[email protected]>" [unknown]

[huanjani]

Hi @java-alpha. Looks like you're not on an ARM machine, so try this instead: curl -Lo copilot.asc https://github.com/aws/copilot-cli/releases/latest/download/copilot-darwin.asc

[bac]

I'm on a macOS ARM laptop and ran into this problem. The current documentation still has a few problems.

• sudo curl to grab the signatures does not need sudo.
• On ARM Macs the home-brew installation location is /opt/homebrew/bin/copilot. You should replace the path with which copilot.
• The merge request shown above did not get applied to this repo, so a different download for copilot-darwin-arm64.asc is still needed.

[huanjani]

Thanks so much for alerting us those instructions in the AWS docs haven't been updated. Unfortunately, the Copilot team doesn't own them the way we do https://aws.github.io/copilot-cli/. It looks like the repo I had tried to edit previously is no longer maintained. I have now submitted a feedback form to AWS Docs; hopefully we'll see that change soon, and folks will stop facing that issue. Thanks again!

[github-actions[bot]]

This issue is stale because it has been open 60 days with no response activity. Remove the stale label, add a comment, or this will be closed in 14 days.

[github-actions[bot]]

This issue is closed due to inactivity. Feel free to reopen the issue if you have any further questions!