Add a New Comment (Rich Markup)
Comment Type & Canned Response: None None > Multiple Canned Responses Fixed in CVS Is it reproducible? Fixed in alpha release, please test Fixed in current release
Would you accept alternate verification of this release, such as a gpg signed email asserting the SHA1 sum of the primary tarball, using a newer key to sign the mail?
That would be fine with me as long as I can verify the signature.
It's possible (albeit a bit more difficult) to update the .sig on the FTP site; do we need to look into taking the action of posting a replacement .sig with a newer key?
As far as I'm concerned, no. The alternative method sounds fine.
I would wait for the next release but I've been trying to help a user in a support forum and that user has tried updating to the current version of findutils because we thought that would solve the problem. If I can update, too, it would help us narrow the problem down.
Thanks for your help.
Does that mean that even though this release cannot be verified, future releases will be verifiable because they will presumably be signed with a different key? I just don't like to install software without verifying the package if possible so I'd rather wait for the next release if necessary.
Thanks.
Unfortunately I no longer have that key anyway, following a disastrous problem with a PATA controller about a month ago. So I'm not in a position to cross-sign the key any more.
The command:
gpg --verify findutils-4.4.0.tar.gz.sig
yields the following error:
gpg: Signature made Sat Mar 15 12:55:50 2008 GMT using DSA key ID 13141C36 gpg: WARNING: signing subkey 13141C36 is not cross-certified gpg: please see http://www.gnupg.org/faq/subkey-cross-certify.html for more information gpg: Can't check signature: general error
The gpg page referenced by this error indicates that I should refer the key's owner there and ask that cross-certification be added (using at least version 1.4.3 of gpg) and the key redistributed.
If I've misunderstood something and this is my fault, I apologise in advance. I barely understand even the little gpg I use. But after trying various things, including updating all my keys and downloading the keyring from here and elsewhere, I started to think that this might be a problem with the key and not just a matter of my ignorance.
Thanks, cfr
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Only logged-in users can vote.
Please enter the title of George Orwell's famous dystopian book (it's a date):
Follow 4 latest changes.
Copyright © 2022 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.9