Kali AMD64 bit sha1 Checksum Mismatch

Hey there, just wanted to let anybody who cares to know that I got a bad checksum while I was verifying the direct ISO for Kali Linux 64 bit v1.1.0a from the main site (https://www.kali.org/downloads/). First download, I checked it with fciv and got:

Quote:

---

E:\Images>ls
kali-linux-1.1.0a-amd64.iso

E:\Images>fciv kali-linux-1.1.0a-amd64.iso -sha1
//
// File Checksum Integrity Verifier version 2.05.
//
5804cdc0d11d44d4e2b16008f6716ba22438401f kali-linux-1.1.0a-amd64.iso

---

This was in comparison to the sha1 in the official the directory that claimed it should be:

Quote:

---

2b8d2db20e2709c5e9e0f9f9bbd8606c9b9e729f kali-linux-1.1.0a-amd64.iso

---

So, to double check, I grabbed the torrent instead and it downloaded much faster. I ran the checksum on the torrent and got this:

Quote:

---

E:\Images>ls
kali-linux-1.1.0a-amd64.iso kali-linux-1.1.0a-amd64.txt.sha1sum
kali-linux-1.1.0a-amd64.torrent

E:\Images>fciv kali-linux-1.1.0a-amd64.iso -sha1
//
// File Checksum Integrity Verifier version 2.05.
//
2b8d2db20e2709c5e9e0f9f9bbd8606c9b9e729f kali-linux-1.1.0a-amd64.iso

---

This matches the previously listed sha1 checksum and also the listed checksum in the file 'kali-linux-1.1.0a-amd64.txt.sha1sum'.


If you have gotten "5804cdc0d11d44d4e2b16008f6716ba22438401f kali-linux-1.1.0a-amd64.iso", please chime in. If it was a one-time mistake during transfer, awesome. If it's a fake mirror, that'd suck mega *****. Good thing I checked myself before I wrecked myself though.

But as always,
Safe cracking everybody!

Which mirror are you using?
http://cdimage.kali.org/README.mirrorlist

You should see something like:

Quote:

---

Mirrors

List of best mirrors for IP address xx.yy.zz.abc, located at 12.334567,-0.987654 in United Kingdom (GB).

Map showing the closest mirrors

Found 1 mirror which handle this country (GB)

http://ftp.hands.com/kali-images/README (gb, prio 100)

Found 7 mirrors in other countries, but same continent (EU)
...

---

As you can see, the UK only has one mirror (currently): ftp.hands.com

Checking the checksum can be found here: http://docs.kali.org/introduction/do...i-linux-images


Windows: http://www.microsoft.com/en-us/downl....aspx?id=11533 or http://www.implbits.com/HashTab/HashTabWindows.aspx
OSX/*Nix: 'sha1 <filename>' or 'sha1sum <filename >' or 'shasum <filename>' or 'openssl sha1 <filename>'

I used gpg to check the sha1sum against the one provided in the downloads server. Returned `gpg: Signature made Fri 13 Mar 2015 10:41:29 AM EDT using RSA key ID 7D8D0BF6
gpg: BAD signature from "Kali Linux Repository <[email protected]>"` I kinda thought I was just doing it wrong, but now I wonder if I also have a bad copy. How did you do the checksum?