Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 484946

Summary: Gentoo Linux Release Engineering (Automated Weekly Release Key) expired
Product: Gentoo Release Media Reporter: Nedko Arnaudov <nedko>
Component: EverythingAssignee: Gentoo Release Team <releng>
Status: VERIFIED INVALID    
Severity: major CC: adborden, alex_y_xu, dschridde+gentoobugs, walter
Priority: High    
Version: autobuild   
Hardware: All   
OS: Linux   
See Also: https://bugs.gentoo.org/show_bug.cgi?id=277319
https://bugs.gentoo.org/show_bug.cgi?id=453620
Whiteboard:
Package list:
Runtime testing required: ---

Description Nedko Arnaudov 2013-09-14 21:37:27 UTC
The key 0xBB572E0E2D182910 is listed at https://www.gentoo.org/proj/en/releng/index.xml with expiration date 2015/08/24 but it actually expired in August 24th 2013. So there are two issues: incorrect documentation and no good key (since August 24th) for signing automated stuff like stage3 builds.
Comment 1 Alex Xu (Hello71) 2013-09-14 22:00:03 UTC
$ gpg --recv-keys BB572E0E2D182910
gpg: requesting key 2D182910 from hkp server pgp.mit.edu
gpg: key 2D182910: public key "Gentoo Linux Release Engineering (Automated Weekly Release Key) <releng@gentoo.org>" imported
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2014-04-14
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)

$ gpg -k BB572E0E2D182910
pub   4096R/2D182910 2009-08-25 [expires: 2015-08-24]
uid                  Gentoo Linux Release Engineering (Automated Weekly Release Key) <releng@gentoo.org>

lgtm.
Comment 2 Nedko Arnaudov 2013-09-14 22:04:42 UTC
Now this is strange:

[Sun Sep 15 01:02:34] nedko@mobix32 /tmp/gentoo
# gpg --fin BB572E0E2D182910
pub   4096R/2D182910 2009-08-25 [expired: 2013-08-24]
      Key fingerprint = 13EB BDBE DE7A 1277 5DFD  B1BA BB57 2E0E 2D18 2910
uid                  Gentoo Linux Release Engineering (Automated Weekly Release Key) <releng@gentoo.org>

[Sun Sep 15 01:02:36] nedko@mobix32 /tmp/gentoo
# date -u
Sat Sep 14 22:02:41 UTC 2013

Also note that this matches what is recorded in https://bugs.gentoo.org/show_bug.cgi?id=277319#c6
Comment 3 Nedko Arnaudov 2013-09-14 22:09:05 UTC
Ah, I got it. There is key renewal.
Comment 4 Jorge Manuel B. S. Vicetto (RETIRED) Gentoo Infrastructure gentoo-dev 2014-09-18 03:59:45 UTC
*** Bug 523084 has been marked as a duplicate of this bug. ***
Comment 5 Jorge Manuel B. S. Vicetto (RETIRED) Gentoo Infrastructure gentoo-dev 2015-05-26 15:24:02 UTC
*** Bug 550472 has been marked as a duplicate of this bug. ***