0.10.4 signature

[puni2k]

Currently running into some issues on my Manjaro system with updating the xorgxrdp AUR package to 0.10.4
It's complaining of not finding a PGP signature.

So i downloaded the 0.10.3 and 0.10.4 binaries from the github release page and tried to verify the packages manually

Doing
gpg --verify xorgxrdp-0.10.4.tar.gz.asc xorgxrdp-0.10.4.tar.gz
results in
gpg: not a detached signature

while
gpg --verify xorgxrdp-0.10.3.tar.gz.asc xorgxrdp-0.10.3.tar.gz
looks much better

gpg:                using RSA key 18AB838A907167745914871903993B4065E7193B
gpg: Good signature from "Koichiro IWAO <meta@vmeta.jp>" [unknown]
gpg:                 aka "Koichiro Iwao <meta@almalinux.org>" [unknown]
gpg:                 aka "Koichiro Iwao <meta@FreeBSD.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 61EC EABB F2BB 40E3 A35D  F30A 9F72 CDBC 01BF 10EB
     Subkey fingerprint: 18AB 838A 9071 6774 5914  8719 0399 3B40 65E7 193B

Also xorgxrdp-0.10.3.tar.gz.asc is just 833 Bytes while xorgxrdp-0.10.4.tar.gz.asc is 690 KB

Is this intentional or am I doing something wrong here?

[metalefty]

Sorry about that. That was a mistake when I signed the tarball. I forgot to make a "detached" signature. Can you try this? It it looks good to you, I will update the signature on the release page.

xorgxrdp-0.10.4.tar.gz.asc.txt

[puni2k]

lgtm

[puni@manjaro ~]$ gpg --verify xorgxrdp-0.10.4.tar.gz.asc.txt xorgxrdp-0.10.4.tar.gz
gpg: Signature made Di 01 Apr 2025 09:43:10 CEST
gpg:                using RSA key 18AB838A907167745914871903993B4065E7193B
gpg:                issuer "meta@vmeta.jp"
gpg: Good signature from "Koichiro IWAO <meta@vmeta.jp>" [unknown]
gpg:                 aka "Koichiro Iwao <meta@almalinux.org>" [unknown]
gpg:                 aka "Koichiro Iwao <meta@FreeBSD.org>" [unknown]
gpg: WARNING: The key's User ID is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 61EC EABB F2BB 40E3 A35D  F30A 9F72 CDBC 01BF 10EB
     Subkey fingerprint: 18AB 838A 9071 6774 5914  8719 0399 3B40 65E7 193B

Thanks for the quick reply.

[metalefty]

Updated the signature on the release page: https://github.com/neutrinolabs/xorgxrdp/releases/tag/v0.10.4