On the downloads page
http://openvpn.net/index.php/open-source/downloads.html the Windows 64-bit installer
http://swupdate.openvpn.org/community/releases/openvpn-install-2.3.2-I003-x86_64.exe was signed on August 22, 2013 with pgp key
samuli.seppanen@gmail.com, but the verification instructions on this page
http://openvpn.net/index.php/open-source/documentation/sig.html say that the signing key should be
samuli@openvpn.net.
So it looks like wrong key was used to sign. Has the 64-bit Windows installer package been compromised? If the key that was used is OK, then perhaps the openvpn.net page that explains how to verify the file signature should be updated to include that key.
After importing key for
samuli@openvpn.net, gpg verification fails.
gpg -v --verify openvpn-install-2.3.2-i003-x86_64.exe.asc
gpg: armor header: Version: GnuPG v1.4.12 (GNU/Linux)
gpg: assuming signed data in `openvpn-install-2.3.2-i003-x86_64.exe'
gpg: Signature made 08/22/13 09:01:47 Central Daylight Time using DSA key ID 198D22A3
gpg: Can't check signature: No public key
After importing key for
samuli.seppanen@gmail.com, gpg verification successful.
gpg -v --verify openvpn-install-2.3.2-i003-x86_64.exe.asc
gpg: armor header: Version: GnuPG v1.4.12 (GNU/Linux)
gpg: assuming signed data in `openvpn-install-2.3.2-i003-x86_64.exe'
gpg: Signature made 08/22/13 09:01:47 Central Daylight Time using DSA key ID 198D22A3
gpg: using PGP trust model
gpg: Good signature from "Samuli Seppänen <samuli.seppanen@gmail.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 0330 0E11 FED1 6F59 715F 9996 C29D 97ED 198D 22A3
gpg: binary signature, digest algorithm SHA1
