bugfindutils - Bugs: bug #23510, gpg signing subkey for release...

 
 

bug #23510: gpg signing subkey for release 4.4.0 not cross-certified

Submitter:  cfr <cfr>
Submitted:  Sat 07 Jun 2008 12:07:09 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Wont Fix
Privacy:  Public Assigned to:  jay
Originator Name:  cfr Open/Closed:  Closed
Release:  4.4.0 Fixed Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 07 Jun 2008 02:57:07 PM UTC, comment #4: 

Would you accept alternate verification of this release, such as a gpg signed email asserting the SHA1 sum of the primary tarball, using a newer key to sign the mail?

That would be fine with me as long as I can verify the signature.

It's possible (albeit a bit more difficult) to update the .sig on the FTP site; do we need to look into taking the action of posting a replacement .sig with a newer key?

As far as I'm concerned, no. The alternative method sounds fine.

I would wait for the next release but I've been trying to help a user in a support forum and that user has tried updating to the current version of findutils because we thought that would solve the problem. If I can update, too, it would help us narrow the problem down.

Thanks for your help.

cfr <cfr>
Sat 07 Jun 2008 01:37:15 PM UTC, comment #3: 

Would you accept alternate verification of this release, such as a gpg signed email asserting the SHA1 sum of the primary tarball, using a newer key to sign the mail?

It's possible (albeit a bit more difficult) to update the .sig on the FTP site; do we need to look into taking the action of posting a replacement .sig with a newer key?

Eric Blake <ericb>
Group administrator
Sat 07 Jun 2008 12:34:54 PM UTC, comment #2: 

Does that mean that even though this release cannot be verified, future releases will be verifiable because they will presumably be signed with a different key? I just don't like to install software without verifying the package if possible so I'd rather wait for the next release if necessary.

Thanks.

cfr <cfr>
Sat 07 Jun 2008 08:37:39 AM UTC, comment #1: 

Unfortunately I no longer have that key anyway, following a disastrous problem with a PATA controller about a month ago.  So I'm not in a position to cross-sign the key any more.

James Youngman <jay>
Group administrator
Sat 07 Jun 2008 12:07:09 AM UTC, original submission:  

The command:

gpg --verify findutils-4.4.0.tar.gz.sig

yields the following error:

gpg: Signature made Sat Mar 15 12:55:50 2008 GMT using DSA key ID 13141C36
gpg: WARNING: signing subkey 13141C36 is not cross-certified
gpg: please see http://www.gnupg.org/faq/subkey-cross-certify.html for more information
gpg: Can't check signature: general error

The gpg page referenced by this error indicates that I should refer the key's owner there and ask that cross-certification be added (using at least version 1.4.3 of gpg) and the key redistributed.

If I've misunderstood something and this is my fault, I apologise in advance. I barely understand even the little gpg I use. But after trying various things, including updating all my keys and downloading the keyring from here and elsewhere, I started to think that this might be a problem with the key and not just a matter of my ignorance.

Thanks,
cfr

cfr <cfr>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #15818:  new.findutils-4.4.0.tar.gz.sig added by jay (152B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ericb (Posted a comment)
  • -email is unavailable- added by jay (Posted a comment)
  • -email is unavailable- added by cfr (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2008-06-08 jay Attached File- Added new.findutils-4.4.0.tar.gz.sig, #15818
    2008-06-07 jay StatusNone Wont Fix
        Assigned toNone jay
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code