The bad tarball is (sha256sum): 2a4bb16562e0d594c37b4dd3b426cb012aa8457151d4718a5abd226cef9be3a5 vsftpd-2.3.4.tar.gz.asc. GPG signature notices:. (GPG) (GPS) GPG: Bad signature from “Chris Evans https://scarybeastsecurity.blogspot.com/2011/07/alert-vsftpd-download-backdoored.html