Bug 900893 – app-text/poppler-23.03.0 - PGP signature verification failed

• Product: Gentoo Linux
• Status: RESOLVED FIXED

[Description Toralf Förster 2023-03-11 21:23:54 UTC]

gpg:                using RSA key CA262C6C83DE4D2FB28A332A3A6A4DB839EAA6D7
gpg: Good signature from "Albert Astals Cid <[e-mail]>" [expired]
gpg: Note: This key has expired!
Primary key fingerprint: CA26 2C6C 83DE 4D2F B28A  332A 3A6A 4DB8 39EA A6D7

 * ERROR: app-text/poppler-23.03.0::gentoo failed (unpack phase):
 *   PGP signature verification failed
 * 
 * Call stack:

  -------------------------------------------------------------------

  This is an unstable amd64 chroot image at a tinderbox (==build bot)
  name: 17.1_desktop_plasma_systemd_merged_usr-j5-20230311-164515

  -------------------------------------------------------------------

gcc-config -l:
 [1] x86_64-pc-linux-gnu-12 *
clang/llvm (if any):
/usr/lib/llvm/15
15.0.7
Python 3.10.10
Available Rust versions:
  [1]   rust-bin-1.67.1 *
php cli (if any):

  HEAD of ::gentoo
commit f490623150c29444f28c51148b0cc22a69a44636
Author: Repository mirror & CI <[e-mail]>
Date:   Sat Mar 11 16:31:48 2023 +0000

    2023-03-11 16:31:48 UTC

emerge -qpvO app-text/poppler
[ebuild     U ] app-text/poppler-23.03.0 [23.01.0] USE="boost* cairo curl* cxx introspection jpeg jpeg2k lcms nss* png qt5 utils verify-sig* -cjk -debug -doc -tiff*"

[Comment 1 Toralf Förster 2023-03-11 21:23:54 UTC]

Created attachment 857323 [details]
emerge-info.txt

[Comment 2 Toralf Förster 2023-03-11 21:23:55 UTC]

Created attachment 857325 [details]
app-text:poppler-23.03.0:20230311-195909.log

[Comment 3 Toralf Förster 2023-03-11 21:23:56 UTC]

Created attachment 857327 [details]
emerge-history.txt

[Comment 4 Toralf Förster 2023-03-11 21:23:58 UTC]

Created attachment 857329 [details]
environment

[Comment 5 Toralf Förster 2023-03-11 21:23:59 UTC]

Created attachment 857331 [details]
etc.portage.tar.bz2

[Comment 6 Toralf Förster 2023-03-11 21:23:59 UTC]

Created attachment 857333 [details]
logs.tar.bz2

[Comment 7 Michał Górny 2023-03-12 05:24:36 UTC]

I think this is a bug in ebuild that's been found by the new logic.  Unless gemato gets timestamps wrong here, that is.

If the signature was made after expiration, that means that the key has been prolonged.  Hence, the key package should be updated for that.

[Comment 8 Larry the Git Cow 2023-03-13 20:50:01 UTC]

The bug has been closed via the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=27915be9cfc1625258f42717d70785ed517cc0f9

commit 27915be9cfc1625258f42717d70785ed517cc0f9
Author:     Sam James <[e-mail]>
AuthorDate: 2023-03-13 20:45:51 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-03-13 20:46:02 +0000

    app-text/poppler: update openpgp-keys version
    
    Closes: https://bugs.gentoo.org/900893
    Signed-off-by: Sam James <[e-mail]>

 app-text/poppler/poppler-23.01.0.ebuild | 2 +-
 app-text/poppler/poppler-23.02.0.ebuild | 2 +-
 app-text/poppler/poppler-23.03.0.ebuild | 2 +-
 app-text/poppler/poppler-9999.ebuild    | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bfb206d4ffdb99d8ada148f29dc1455d840a08dd

commit bfb206d4ffdb99d8ada148f29dc1455d840a08dd
Author:     Sam James <[e-mail]>
AuthorDate: 2023-03-13 20:44:46 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-03-13 20:46:01 +0000

    sec-keys/openpgp-keys-aacid: add 20230313
    
    Closes: https://bugs.gentoo.org/900893
    Signed-off-by: Sam James <[e-mail]>

 sec-keys/openpgp-keys-aacid/Manifest                |  1 +
 .../openpgp-keys-aacid-20230313.ebuild              | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+)