gcc14-libcxx: Failed to verify signature for archive!

[sfsiegel (Stephen Siegel)]

Hello, I've just installed MacPorts on my new MacBook Air but I keep hitting a wall when trying to install the port gcc14-libcxx. (I hit this when trying to install ports emacs, mpich, and others). Any ideas? Here is debug output...

iegel@wifi-roaming-128-4-185-198 ~ % sudo port install -d gcc14-libcxx
DEBUG: Opening port in directory: /opt/local/var/macports/sources/rsync.macports.org/macports/release/tarballs/ports/lang/gcc14
DEBUG: OS darwin/24.6.0 (macOS 15.6) arch arm
DEBUG: Sourcing PortGroup select 1.0 from /opt/local/var/macports/sources/rsync.macports.org/macports/release/tarballs/ports/_resources/port1.0/group/select-1.0.tcl
DEBUG: Sourcing PortGroup active_variants 1.1 from /opt/local/var/macports/sources/rsync.macports.org/macports/release/tarballs/ports/_resources/port1.0/group/active_variants-1.1.tcl
DEBUG: Sourcing PortGroup conflicts_build 1.0 from /opt/local/var/macports/sources/rsync.macports.org/macports/release/tarballs/ports/_resources/port1.0/group/conflicts_build-1.0.tcl
DEBUG: PortGroup active_variants 1.1 included previously, not sourcing again
DEBUG: GCC versions for Darwin 24 arm - 14 devel
DEBUG: Clang versions for Darwin 24 arm - 13 14 15 16 17 18 19 20 devel
DEBUG: Sourcing PortGroup compilers 1.0 from /opt/local/var/macports/sources/rsync.macports.org/macports/release/tarballs/ports/_resources/port1.0/group/compilers-1.0.tcl
DEBUG: Compiler clang34 not available for Darwin24 arm
DEBUG: Compiler clang35 not available for Darwin24 arm
DEBUG: Compiler clang36 not available for Darwin24 arm
DEBUG: Compiler clang37 not available for Darwin24 arm
DEBUG: Compiler clang50 not available for Darwin24 arm
DEBUG: Compiler clang60 not available for Darwin24 arm
DEBUG: Compiler clang70 not available for Darwin24 arm
DEBUG: Compiler clang80 not available for Darwin24 arm
DEBUG: Compiler clang90 not available for Darwin24 arm
DEBUG: universal_variant is false, so not adding the default universal variant
DEBUG: Executing variant clang18 provides clang18
DEBUG: Running callback portconfigure::add_automatic_compiler_dependencies
DEBUG: Finished running callback portconfigure::add_automatic_compiler_dependencies
DEBUG: Running callback portbuild::add_automatic_buildsystem_dependencies
DEBUG: Finished running callback portbuild::add_automatic_buildsystem_dependencies
DEBUG: Running callback portstartupitem::add_notes
DEBUG: Finished running callback portstartupitem::add_notes
DEBUG: Running callback compilers::add_fortran_legacy_support
DEBUG: Finished running callback compilers::add_fortran_legacy_support
DEBUG: dropping privileges: euid changed to 502, egid changed to 501.
DEBUG: Starting logging for gcc14-libcxx @14.2.0_3+clang18
DEBUG: macOS 15.6 (darwin/24.6.0) arch arm
DEBUG: MacPorts 2.11.4
DEBUG: Xcode 16.4, CLT 16.4.0.0.1.1747106510
DEBUG: SDK 15
DEBUG: MACOSX_DEPLOYMENT_TARGET: 15.0
DEBUG: Checking if gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2 exists at https://packages.macports.org/
DEBUG: gcc14-libcxx has no conflicts
DEBUG: Executing org.macports.main (gcc14-libcxx)
DEBUG: dropping privileges: euid changed to 502, egid changed to 501.
DEBUG: Privilege de-escalation not attempted as not running as root.
DEBUG: archivefetch phase started at Tue Aug  5 13:46:32 EDT 2025
--->  Fetching archive for gcc14-libcxx
DEBUG: Executing proc-pre-org.macports.archivefetch-archivefetch-0
DEBUG: Executing org.macports.archivefetch (gcc14-libcxx)
DEBUG: euid/egid changed to: 0/0
DEBUG: chowned /opt/local/var/macports/incoming to macports
DEBUG: euid/egid changed to: 502/501
--->  gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2 doesn't seem to exist in /opt/local/var/macports/incoming/verified
--->  Attempting to fetch gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2 from https://packages.macports.org/gcc14-libcxx
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  794k  100  794k    0     0  9252k      0 --:--:-- --:--:-- --:--:-- 9349k
--->  Attempting to fetch gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2.rmd160 from https://packages.macports.org/gcc14-libcxx
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   512  100   512    0     0  55937      0 --:--:-- --:--:-- --:--:-- 56888
DEBUG: Invoking /usr/bin/openssl dgst -ripemd160 -verify /opt/local/share/macports/macports-pubkey.pem -signature /opt/local/var/macports/incoming/gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2.rmd160 /opt/local/var/macports/incoming/gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2.TMP to verify signature
DEBUG: /opt/local/var/macports/incoming/gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2.TMP failed to verify with public key /opt/local/share/macports/macports-pubkey.pem
DEBUG: openssl output: Verification Failure
child process exited abnormally
Warning: Failed to verify signature for archive!
Error: Failed to archivefetch gcc14-libcxx: version @14.2.0_3+clang18
DEBUG: Error code: NONE
DEBUG: Backtrace: version @14.2.0_3+clang18
    while executing
"error "version @${version}_${revision}${portvariants}""
    (procedure "portarchivefetch::fetchfiles" line 165)
    invoked from within
"portarchivefetch::fetchfiles"
    (procedure "portarchivefetch::archivefetch_main" line 5)
    invoked from within
"$procedure $targetname"
DEBUG: dropping privileges: euid changed to 502, egid changed to 501.
Error: See /opt/local/var/macports/logs/_opt_local_var_macports_sources_rsync.macports.org_macports_release_tarballs_ports_lang_gcc14/gcc14-libcxx/main.log for details.
Error: Follow https://guide.macports.org/#project.tickets if you believe there
is a bug.
Error: Processing of port gcc14-libcxx failed

[ryandesign (Ryan Carsten Schmidt)]

Is it only this port that fails?

[sfsiegel (Stephen Siegel)]

So far, yes, this is the only port failing. (But many other ports depend on it so they fail too when they try to install this one.)

[jmroot (Joshua Root)]

The signature verified OK for me after downloading from the same URLs:

% curl -LO 'https://packages.macports.org/gcc14-libcxx/gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2'
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  794k  100  794k    0     0   319k      0  0:00:02  0:00:02 --:--:--  319k
% curl -LO 'https://packages.macports.org/gcc14-libcxx/gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2.rmd160'
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   512  100   512    0     0    461      0  0:00:01  0:00:01 --:--:--   461
% /usr/bin/openssl dgst -ripemd160 -verify /opt/local/share/macports/macports-pubkey.pem -signature ./gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2.rmd160 ./gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2
Verified OK

I guess the possibilities are that one or both of the files were corrupted on the specific CDN node that you connected to, or that they were corrupted in transit somehow, or that they were corrupted on your local storage medium. If the files still exist in /opt/local/var/macports/incoming, you can compare their hashes to those of the files I got:

% openssl dgst -sha256 gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2{,.rmd160}
SHA2-256(gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2)= 476c18276990c651552b4885d6461d2c7789c28fc04fa72360606e2ef36b6e00
SHA2-256(gcc14-libcxx-14.2.0_3+clang18.any_any.noarch.tbz2.rmd160)= d03a1452330085410c829dd75a37ec1efe47a4743bd072a103870121d47c0a71

You could also try downloading the files by different methods or from different mirrors and see if the result changes.