Code of Conduct 1.0.1 signatures not accepted

[Pete Savage]

When users try to submit a signed code of conduct, they get an error if they sign the 1.0.1 CoC, since its text does not match the 1.0 CoC.

Signatures for the CoC 1.0.1 should be accepted, and new CoC 1.0 signatures should probably be rejected (and users shouldn't be prompted to sign that CoC).

[James Henstridge (jamesh)]

Where abouts did you add the white space? The verification code should ignore differences where white space changes (e.g. spaces to multiple spaces, spaces to newlines, etc).

It won't accept changes that break up words or similar.

[Pete Savage (petesavage)]

James Henstridge wrote:
> Where abouts did you add the white space? The verification code should ignore differences where white space changes (e.g. spaces to multiple spaces, spaces to newlines, etc).
>
> It won't accept changes that break up words or similar.
Spaces were after words, or at the beginnings of lines

[Asheesh Laroia (paulproteus)]

I just tried to sign the Code of Conduct myself, but the web form tells me:

"An error occured.

str: The signed text does not match the Code of Conduct. Make sure that you signed the correct text (white space differences are acceptable)."

http://paulproteus.acm.jhu.edu/tmp/signed.asc has my signed code of conduct.

I wonder, is this related to http://lists.gnupg.org/pipermail/gnupg-announce/2006q1/000216.html ?

[James Henstridge (jamesh)]

Asheesh: that gpg bug should not affect us -- if anything, it would cause things that shouldn't be accepted to be accepted.

From the look of it, I think the 1.0.1 version of the CoC is not being accepted. Could you try signing and submitting the following version instead:
    https://launchpad.net/codeofconduct/1.0/+download

If that works, then that's the bug.

[Pete Savage (petesavage)]

It indeed does work. It's the new CoC that is causing the issue. Confirmed

[Loïc Minier (lool)]

It always compare to the version 1.0 of the CoC:
1/ sign CoC 1.0
2/ go to signature page for CoC 1.0.1
3/ reupload the signature for CoC 1.0, it works

Lots of bugs here:
a/ does not check against the correct CoC.txt version
b/ permits uploading twice the exact same signature
c/ no way to distinguish signatures in the list of signatures: does not list what CoC.txt is signed by each signature nor a precise date (only day, I signed both on the same day...)

[Bjorn Tipling (bjorn-ambientchill)]

I encountered this bug as well. I had to use the 1.0 version of the CoC.

[the_tiger (ben-pygall)]

Same problem for me. Same solution

[Sascha Herres (saschaherres)]

The CoC-Signing for 1.0.1 is rejected even with an unaltered CoC-Text.

1.0 works perfectly...

[zimbatm (zimbatm)]

Same here, even with unaltered CoC

[Peter Whittaker (pwwnow)]

I signed the 1.0 some time ago and wanted to test the status of this bug signing the 1.0.1; I'll surfed the relevant pages, including https://launchpad.net/codeofconduct (where I'm told I've signed 1.0, so far so good) and https://launchpad.net/codeofconduct/1.0.1, but I've not found any way to upload a signature on 1.0.1.

Has this feature been disabled pending resolution of this bug, or have I missed something basic?

[Diogo Matsubara (matsubara)]

Hi Peter,

if you have already signed 1.0 you don't need to sign 1.0.1; it's just a minor textual update. That's why you're not prompted to sign it again.

[Peter Whittaker (pwwnow)]

On Fri, 2006-01-12 at 19:27 +0000, Diogo Matsubara wrote:

> if you have already signed 1.0 you don't need to sign 1.0.1; it's just a
> minor textual update. That's why you're not prompted to sign it again.

Diego, I realize that it is a minor textual update and that my signature is not necessary: As noted in my Q, I wanted to test if this bug (39547) had been resolved, since a) it is marked as 'Fix Released', and b) there have been no updates recently to suggest that the fix "took".

I agree that it is not necessary for me to re-sign; refer to my comments in https://launchpad.net/products/launchpad/+bug/3952/comments/13

However, I would suggest that the lack of indication to this effect is itself a bug! The page that indicates I've signed the CoC indicates that a new CoC is available, and gives me a URL to 'read or sign new version', but then does not give me any opportunity to do so. This is very confusing (I can read it, I can download, where's the upload button?), hence my Q.

There are really only 3 correct options: 1) the "congrats, you've signed the CoC page" should say "There is a new CoC, but the changes are editorial only, you do not need to re-sign. Click here to review the changes for your own peace of mind"; 2) the "read and sign new version" page can say "changes are editorial only, you do not need to re-sign. Click here to review the changes for your own peace of mind"; or 3) the user can be allowed to sign the new version, for their own peace of mind.

Of course, #3 requires that this bug be fixed....

[Matthew Paul Thomas (mpt)]

Peter, I have reported the problem for 1.0 signatories as bug 74447.

[Jai Harrison (jai)]

I do find Launchpad quite confusing however I believe the last update on this was around 3 years ago? It also says fix released but I'm getting this problem when trying to sign the Code of Conduct now.

I'm also signing version 1.0.1 and have tried twice:

1) The first time I tried with added line breaks and white space outside of words (as I believe it is meant to accept).

2) The second time I tried with just added white space outside of words and still no luck.

I get the following in 2 error boxes (as separated in white space below) but I believe that's what everyone gets/got?

"There is 1 error.

The signed text does not match the Code of Conduct. Make sure that you signed the correct text (white space differences are acceptable)."

In the interests of testing I also tried to sign the 1.0 CoC but that was, correctly, rejected.

Am I missing something?

[Jai Harrison (jai)]

Well I signed it without any form of additional whitespace and it accepted that fine. I hope this hasn't compromised my key.

Regardless there seems to be something wrong with the system.