[MacPorts] #49233: selfupdate fails with "Failed to verify signature for MacPorts source"

[MacPorts]

#49233: selfupdate fails with "Failed to verify signature for MacPorts source"
--------------------------+--------------------------------
  Reporter:  n.gilbert@…  |      Owner:  macports-tickets@…
      Type:  defect       |     Status:  new
  Priority:  High         |  Milestone:
 Component:  base         |    Version:  2.3.3
Resolution:               |   Keywords:  selfupdate
      Port:               |
--------------------------+--------------------------------

Comment (by mherdeg@…):

 This problem repros for me using OS X 10.11 and the latest stable
 "MacPorts-2.3.4-10.11".

 {{{port -d -v selfupdate
 DEBUG: Copying /Users/mherdeg/Library/Preferences/com.apple.dt.Xcode.plist
 to /opt/local/var/macports/home/Library/Preferences
 DEBUG: MacPorts sources location:
 /opt/local/var/macports/sources/rsync.macports.org/release/tarballs
 --->  Updating MacPorts base sources using rsync
 receiving file list ... done

 sent 36 bytes  received 69 bytes  70.00 bytes/sec
 total size is 27013120  speedup is 257267.81
 receiving file list ... done

 sent 36 bytes  received 76 bytes  74.67 bytes/sec
 total size is 512  speedup is 4.57
 DEBUG: failed verification with key /opt/local/share/macports/macports-
 pubkey.pem
 DEBUG: openssl output: Verification Failure
 child process exited abnormally
 DEBUG: Failed to verify signature for MacPorts source!
     while executing
 "macports::selfupdate [array get global_options] base_updated"
 Error: Failed to verify signature for MacPorts source!
 To report a bug, follow the instructions in the guide:
     http://guide.macports.org/#project.tickets
 Error: /opt/local/bin/port: port selfupdate failed: Failed to verify
 signature for MacPorts source!
 }}}

 Here's all I see happening "under the hood" with the verification step --
 nothing very exciting --
 {{{
 openssl dgst  -rmd160 -verify /opt/local/share/macports/macports-
 pubkey.pem -signature ./base.tar.rmd160 base.tar
 Verification Failure
 }}}

 Here's what the files look like:
 {{{
 MD5 /opt/local/share/macports/macports-pubkey.pem
 MD5 (/opt/local/share/macports/macports-pubkey.pem) =
 78d4677826f684ece21c7527c65cc38b

 MD5
 /opt/local/var/macports/sources/rsync.macports.org/release/tarballs/base.tar.rmd160
 MD5
 (/opt/local/var/macports/sources/rsync.macports.org/release/tarballs/base.tar.rmd160)
 = 9dac68c55f5b4a3db73a5ac6ac1ab4d5

 MD5
 /opt/local/var/macports/sources/rsync.macports.org/release/tarballs/base.tar
 MD5
 (/opt/local/var/macports/sources/rsync.macports.org/release/tarballs/base.tar)
 = d34533dd1a9f3a5a75a58074e12844ae

 ls -lrt /opt/local/share/macports/macports-pubkey.pem
 /opt/local/var/macports/sources/rsync.macports.org/release/tarballs/base.tar.rmd160
 /opt/local/var/macports/sources/rsync.macports.org/release/tarballs/base.tar
 -r--r--r--  1 root  admin       800 Oct  1 15:42 /opt/local/share/macports
 /macports-pubkey.pem
 -rw-r--r--  1 root  admin       512 Oct 11 16:07
 /opt/local/var/macports/sources/rsync.macports.org/release/tarballs/base.tar.rmd160
 -rw-r--r--  1 root  admin  27013120 Oct 11 16:34
 /opt/local/var/macports/sources/rsync.macports.org/release/tarballs/base.tar
 }}}

-- 
Ticket URL: <https://trac.macports.org/ticket/49233#comment:1>
MacPorts <https://www.macports.org/>
Ports system for OS X