BAD Signature verifying the SHA1SUMS for the latest weekly release (2016-12-04)

[ghost404]

Hello all,

Was following the referred steps for downloading and verifying the downloaded ISO and SHA1SUMS file with the hashes. I tried downloading twice the files from http://cdimage.kali.org/kali-weekly/ (SHA1SUMS, SHA1SUMS.gpg and the ISO) and running gpg --verify SHA1SUMS.gpg SHA1SUMS which outputs the following message:
gpg: Signature made Sun 04 Dec 2016 08:04:45 AM WET
gpg: using RSA key ED444FF07D8D0BF6
gpg: BAD signature from "Kali Linux Repository <[email protected]>" [unknown]

Running the sha1sum on kali-linux-2016-W49-i386.iso I do get the following hash 8102154fc6c7e33e5cb635e34c93f8a0e0852bc5 (which matches the one on the SHA1SUMS file, but with a BAD signature, how can I actually verify that this hash I'm matching against isn't bogus?

Kind regards

[ghost404]

Quick note: actually the SHA1SUMS file I was downloading was from https://archive.kali.org/kali-images...eekly/SHA1SUMS and not from http://cdimage.kali.org/kali-weekly/
The one from http://cdimage.kali.org/kali-weekly/ does get a Good signature.
The one from https://archive.kali.org/kali-images...eekly/SHA1SUMS (as instructed on the main download page) gets the Bad signature.

I guess the files can then be verified, but nevertheless may be worth checking out why both SHA1SUMS file aren't matching.
Cheers

[tjc]

I get the same unknown when running gpg --list-keys --with-fingerprint 7D8D0BF6

pub 4096R/7D8D0BF6 2012-03-05 [expires: 2018-02-02]
Key fingerprint = 44C6 513A 8E4F B3D3 0875 F758 ED44 4FF0 7D8D 0BF6
uid [ unknown] Kali Linux Repository <[email protected]>
sub 4096R/FC0D0DCB 2012-03-05 [expires: 2018-02-02]