The authenticity could not be verified as no signature was found when downloading WordPress 5.8.2

[henry.wright]

When installing 5.8.2 using the button on the update-core.php page, I got this message:

The authenticity of wordpress-5.8.2-no-content.zip could not be verified as no signature was found.

I tried using a different server and I got this message:

The authenticity of wordpress-5.8.2-partial-1.zip could not be verified as no signature was found.

[henry.wright]

The install process was successful in both cases I should add.

[desrosj]

Hi @henrywright,

This is actually intended behavior. [44954] added an experimental way to cryptographically sign WordPress updates as an extra level of security when updating plugins and themes. Because this was an experiment, signature verification was introduced as a "soft" requirement.

Because this has not been finalized, a signature is currently not returned, and that's the reason for the messages you are seeing.

You can read more about this in the tickets linked below, and the related ​developer note that was published when this change was originally made.

Related: #39309, #45806, #49200.

[henry.wright]

Thanks for the explanation @desrosj. If a signature header isn't returned in the response and a signature file isn't made available then there's obviously no way to verify.

Should the "The authenticity of wordpress-5.8.2-no-content.zip could not be verified as no signature was found." message be removed? Not all developers would have read the developer note and in such cases the message could cause confusion

[SergeyBiryukov]

Hi there, thanks for the report!

We're already tracking this issue in #47315, let's continue the discussion there.

[henry.wright]

Sure @SergeyBiryukov