[Help] cargo init error

[jartai]

cargo init
error: signature verification failed for '/Users/nemo/.cargo/sources.json.new'

help

[catamorphism]

I noticed that I got the same error message because I didn't have gpg installed. Did you install gpg with your package manager? (For example, brew install gpg on a Mac.)

[jartai]

thanks.
I run the command 'brew install gpg', I have installed gpg. But it is error.

[catamorphism]

Can you try RUST_LOG=cargo cargo init and paste all of the output? Thanks.

[jartai]

nemo:~ nemo$ RUST_LOG=cargo
nemo:~ nemo$ cargo init
error: signature verification failed for '/Users/nemo/.cargo/sources.json.new'

[jartai]

nemo:~ nemo$ brew install gpg
Error: gnupg-1.4.12 already installed
nemo:~ nemo$

[catamorphism]

It has to be all on one line, like:

$ RUST_LOG=cargo cargo init

For example, what I see when I do that is:

rust: ~"search_tbl: none, comp 0, hash 12395399173495374636, idx 12"
rust: ~"source: central"
rust: ~"search_tbl: present, comp 1, hash 12395399173495374636, idx 12"
rust: ~"loading source: central"
rust: ~"search_tbl: present, comp 1, hash 12395399173495374636, idx 12"
info: initialized .cargo in /Users/tchevalier/.cargo
rust: ~"insert fresh (~\"url\"->String(~\"https://raw.github.com/mozilla/cargo-central/master/packages.json\")) at idx 28, hash 9718257161845832348"
rust: ~"insert fresh (~\"method\"->String(~\"curl\")) at idx 5, hash 14776354518509055973"
rust: ~"insert fresh (~\"central\"->Object(~{ k0: 3322355308880591525, k1: 11694309806094837824, resize_at: 24, size: 2, buckets: ~[ None, None, None, None, None, Some({ hash: 14776354518509055973, key: ~\"method\", value: String(~\"curl\") }), None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, None, Some({ hash: 9718257161845832348, key: ~\"url\", value: String(~\"https://raw.github.com/mozilla/cargo-central/master/packages.json\") }), None, None, None ] })) at idx 2, hash 15053320695082579362"

[jartai]

I run all .

nemo:~ nemo$ RUST_LOG=cargo cargo init
error: signature verification failed for '/Users/nemo/.cargo/sources.json.new'
nemo:~ nemo$ RUST_LOG=cargo
nemo:~ nemo$ cargo init
error: signature verification failed for '/Users/nemo/.cargo/sources.json.new'

[z0w0]

What does gpg --version output? Can you rm -R ~/.cargo and then try again?

[martindemello]

same issue here. latest rust from git (release-0.5 tag):

$ gpg --version
gpg (GnuPG) 2.0.19
libgcrypt 1.5.0
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: ~/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA
Cipher: 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, 
        CAMELLIA192, CAMELLIA256
Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

$ rm -rf ~/.cargo

$ RUST_LOG=cargo cargo init
error: signature verification failed for '/home/martin/.cargo/sources.json.new'

[martindemello]

okay. was a simple error in pgp.rs. patch sent.

@@ -102,9 +103,10 @@ fn verify(root: &Path, data: &Path, sig: &Path) -> bool {
     let path = root.push("gpg");
     let res = gpgv(~[~"--homedir", path.to_str(),
                   ~"--keyring", ~"pubring.gpg",
-                  ~"--verbose",
+                  ~"--verify",
                  sig.to_str(), data.to_str()]);

[jartai]

thanks .

[xasmx]

Experiencing the same error with cargo compiled from master. For me, the above patch is what is breaking 'cargo init'. I reverted the patch and now 'cargo init' is working.

If executing 'gpgv' here, it supports '--verbose' but does not know of a '--verify' option:

gpgv --help
gpgv (GnuPG) 1.4.13
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Syntax: gpgv [options] [files]
Check signatures against known trusted keys

Options:

-v, --verbose verbose
-q, --quiet be somewhat more quiet
--keyring take the keys from this keyring
--ignore-time-conflict make timestamp conflicts only a warning
--status-fd FD write status info to this FD

[martindemello]

gpgv seems to be the same as gpg --verify.

looking back through the git logs, i'm not sure why that patch fixed cargo init for me; it has always been calling gpgv rather than gpg. will dig some more into this.

[martindemello]

okay. i see the problem. on archlinux, gpgv is symlinked to gpg2, rather than to gpgv2. i'll file a bug with arch, but in the mean time it might be stabler to use gpg --verify rather than gpgv.

[z0w0]

It's fixed in incoming, afaik. Build from that instead.

[z0w0]

Closing because Cargo is obsolete as of version 0.6 and it's also fixed anyway.