1

I note that when cygwin's setup.exe installs packages now, it looks for a file named "setup.zst.sig" first. What's the content and format of this binary file? How to produce a valid "setup.zst.sig"?

This must have been a recent change. Previously it looked for "setup.exe.sig" first. I use the feature (to detect whether "setup.exe.sig" changed) to decide whether my cygwin installation needs to be updated. See also this for an application example.

EDIT: @matzeri:

This is the error message on screen.[1]

1
  • 1
    It is probably the SHA256 hash signature of the file setup.zst. It is used to check that it was downloaded without errors (or MiTM versions). – not2qubit Feb 11 '19 at 7:33
1

setup.zst.sig is not yet used. The "zst" functionality was introduced in the program to eventually replace the previous compression methods of setup.ini and the packages

const std::string setup_exts[] = { "zst", "xz", "bz2", "ini" };

For checking the update of setup-ARCH.exe you need to use the standard signature.

https://cygwin.com/setup-x86.exe.sig 
https://cygwin.com/setup-x86_64.exe.sig

The pop up you shows seems to happen only on FTP mirror server, the HTTP servers do not produce it.

It is clearly a bug in setup
https://cygwin.com/ml/cygwin/2019-02/msg00153.html

5
  • Yes, I do use the setup-ARCH.exe.sig to determine whether to update. However, the absence of setup.zst.sig leads to a pesky error message from setup.exe. So I am thinking of producing a valid (even empty) setup.zst.sig to circumvent that. – Ancora Imparo Feb 11 '19 at 11:13
  • The error message: 550 /cygwin/ARCH/setup.zst.sig No such file or directory – Ancora Imparo Feb 12 '19 at 7:53
  • 1
    It should be 404 and only visible on the /var/log/setup.log. Are you installing from local disk or what ? – matzeri Feb 12 '19 at 15:55
  • I have edited the original question to include a screenshot. I have tried to insert an empty setup.zst.sig in the directory where packages are downloaded but the error message still appears. I did check /var/log/setup.log which says "mbox Internet Error: 550 /cygwin/x86_64/setup.zst.sig: No such file or directory mbox Internet Error: 550 /cygwin/x86_64/setup.zst: No such file or directory" – Ancora Imparo Feb 14 '19 at 9:38
  • 1
    It seems specific of using a FTP mirror. With HTTP mirror there is no pop up and only a log of 404 error – matzeri Feb 14 '19 at 17:42
1

According to the documentation, the .sig files carry a SHA-512 hash of the respective file without that extension, signed with the private key available only to Cygwin the company.

https://www.cygwin.com/faq.html#faq.setup.install-security

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.