| Summary: | Portage snapshots no longer GPG signed after 2007-11-23, Signing Key expired ! | ||
|---|---|---|---|
| Product: | Gentoo Release Media | Reporter: | Thomas Sachau <tommy> |
| Component: | Everything | Assignee: | Gentoo Release Team <releng> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | infra-bugs, zmedico |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://gentoo.osuosl.org/snapshots/ | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
|
Description
Thomas Sachau
2007-11-24 14:04:59 UTC
Who's responsible for the portage signing key? I've only got the release key. a new key, or updating the expiry time of the existing key. portage team: how is the existing key bundled with Portage? If I update it, can you send out a new release with it right away? The key isn't bundled in portage at all. We have a patch from bug 130039 to add gpg verification support to emerge-webrsync. It doesn't check which key the snapshot is signed with, only that it has a "trusted" signature. I suppose we should have a config option that will force it to use a specific key. The new signing key is 0x239C75C4. It has been exported to several PGP keyserver networks. The old keys D8BA32AA (expired 2005/Nov/11), and 7DDAD20D (expired 2007/11/23) have been marked as revoked, with the revocation messages directing users to the new keys. Was there anywhere in CVS that we distributed the public side of these keys? Is this one fixed then? well - the critical part got fixed. anything left to be done? (In reply to comment #3) > I suppose we > should have a config option that will force it to use a specific key. Anything done on this side? (In reply to comment #4) > The new signing key is 0x239C75C4. It has been exported to several PGP > keyserver networks. The old keys D8BA32AA (expired 2005/Nov/11), and 7DDAD20D > (expired 2007/11/23) have been marked as revoked, with the revocation messages > directing users to the new keys. > > Was there anywhere in CVS that we distributed the public side of these keys? > If there is no such place, perhaps add it somewhere? (In reply to comment #7) > (In reply to comment #3) > > I suppose we > > should have a config option that will force it to use a specific key. > > Anything done on this side? Looking at the gpg manpage, I don't see any documented option that allows a specific key to be specified. I guess it doesn't matter as long as the signature is from a trusted key. The keys are now documented on this page: http://www.gentoo.org/proj/en/releng/ I also updated the expiry date of the current snapshot key, so it's good for another 2 years from the previous date. |
