bug#20298: Missing public key for 24.5

bug#20298: Missing public key for 24.5

[Mehmet Atif Ergun]

Hi,

I tried to verify the new (emacs-24.5) release but the public key that
signed the file is missing in the gnu keyring. The 24.4 had the same
problem (the signature for 24.4 belonged to a @gnu.org address. This
one belongs to a gmail address (Nicolas Petton
<petton.nicolas@gmail.com>, see below).)

The file:
https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz

The signature:
https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz.sig

The keyring:
https://ftp.gnu.org/gnu/gnu-keyring.gpg

The output:
$ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.4.tar.xz.sig
gpg: Signature made Mon 20 Oct 2014 02:58:21 PM EDT
gpg:                using RSA key 0x6592E9A3A0B0F199
gpg: Can't check signature: public key not found

$ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.5.tar.xz.sig
gpg: Signature made Fri 10 Apr 2015 12:57:02 PM EDT
gpg:                using RSA key 0x233587A47C207910
gpg: Can't check signature: public key not found

The output I was expecting was along the lines of:
gpg: Good signature from .....

Thanks,
Mehmet.

bug#20298: Missing public key for 24.5

[Nicolas Petton]

[-- Attachment #1: Type: text/plain, Size: 1188 bytes --]


Mehmet Atif Ergun writes:

> Hi,
>
> I tried to verify the new (emacs-24.5) release but the public key that
> signed the file is missing in the gnu keyring. The 24.4 had the same
> problem (the signature for 24.4 belonged to a @gnu.org address. This
> one belongs to a gmail address (Nicolas Petton
> <petton.nicolas@gmail.com>, see below).)
>
> The file:
> https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz
>
> The signature:
> https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz.sig
>
> The keyring:
> https://ftp.gnu.org/gnu/gnu-keyring.gpg
>
> The output:
> $ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.4.tar.xz.sig
> gpg: Signature made Mon 20 Oct 2014 02:58:21 PM EDT
> gpg:                using RSA key 0x6592E9A3A0B0F199
> gpg: Can't check signature: public key not found
>
> $ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.5.tar.xz.sig
> gpg: Signature made Fri 10 Apr 2015 12:57:02 PM EDT
> gpg:                using RSA key 0x233587A47C207910
> gpg: Can't check signature: public key not found
>
> The output I was expecting was along the lines of:
> gpg: Good signature from .....

I'll try to see if I have the access rights to update the keyring with
my pubkey.

Nico

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 512 bytes --]

bug#20298: Missing public key for 24.5

[Nicolas Petton]

[-- Attachment #1: Type: text/plain, Size: 860 bytes --]


Mehmet Atif Ergun writes:

> Hi,
>
> I tried to verify the new (emacs-24.5) release but the public key that
> signed the file is missing in the gnu keyring. The 24.4 had the same
> problem (the signature for 24.4 belonged to a @gnu.org address. This
> one belongs to a gmail address (Nicolas Petton
> <petton.nicolas@gmail.com>, see below).)
>
> The file:
> https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz
>
> The signature:
> https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz.sig
>
> The keyring:
> https://ftp.gnu.org/gnu/gnu-keyring.gpg

I have updated gnu-keyring.gpg locally on my computer, but unfortunately
I don't know how to upload it to the FTP server. I don't think I have
write access.

Stefan, do you know how I should proceed to get my pubkey added to this
keyring?

Nico
-- 
Nicolas Petton
http://nicolas-petton.fr

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 512 bytes --]

bug#20298: Missing public key for 24.5

[Stefan Monnier]

> I have updated gnu-keyring.gpg locally on my computer, but unfortunately
> I don't know how to upload it to the FTP server.  I don't think I have
> write access.

Indeed, I'd expect that access to this is more strictly controlled.
I think you'll need to contact the sysadmins at the FSF (maybe opening
a ticket on savannah is a good way to do that).

> Stefan, do you know how I should proceed to get my pubkey added to this
> keyring?

I think it should have been updated "automatically" when they gave you
access, so it's probably an oversight on the part of the one who gave
you access.  If you still have his/her email, you might like to contact
him/her directly.


        Stefan

bug#20298: Missing public key for 24.5

[Mehmet Atif Ergun]

[-- Attachment #1: Type: text/plain, Size: 964 bytes --]

Hi,

Something like this seems to have happened before. Does this help at all:
http://lists.gnu.org/archive/html/bug-gnu-emacs/2012-04/msg00917.html

Thanks,
Mehmet.
On Apr 11, 2015 10:07 AM, "Stefan Monnier" <monnier@iro.umontreal.ca> wrote:

> > I have updated gnu-keyring.gpg locally on my computer, but unfortunately
> > I don't know how to upload it to the FTP server.  I don't think I have
> > write access.
>
> Indeed, I'd expect that access to this is more strictly controlled.
> I think you'll need to contact the sysadmins at the FSF (maybe opening
> a ticket on savannah is a good way to do that).
>
> > Stefan, do you know how I should proceed to get my pubkey added to this
> > keyring?
>
> I think it should have been updated "automatically" when they gave you
> access, so it's probably an oversight on the part of the one who gave
> you access.  If you still have his/her email, you might like to contact
> him/her directly.
>
>
>         Stefan
>

[-- Attachment #2: Type: text/html, Size: 1444 bytes --]

bug#20298: Missing public key for 24.5

[Nicolas Petton]

[-- Attachment #1: Type: text/plain, Size: 318 bytes --]


Mehmet Atif Ergun writes:

> Hi,
>
> Something like this seems to have happened before. Does this help at all:
> http://lists.gnu.org/archive/html/bug-gnu-emacs/2012-04/msg00917.html
>

I sent an email to the ftp admins.  I'm waiting for their answer.

Nico
-- 
Nicolas Petton
http://nicolas-petton.fr

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 512 bytes --]

bug#20298: Missing public key for 24.5

[Glenn Morris]

Mehmet Atif Ergun wrote:

> I tried to verify the new (emacs-24.5) release but the public key that
> signed the file is missing in the gnu keyring. The 24.4 had the same
> problem (the signature for 24.4 belonged to a @gnu.org address.

Nobody here can do anything about that, it's a GNU sysadmin issue.

If you want to verify the signatures, both keys are available from
standard keyservers, eg pgp.mit.edu. Though since you have never met
either of us, you have no idea how trustworthy we are. :)

(I don't see what the value of a keyring that is stored on the same ftp
server as the file you want to download is. Especially since the process
for updating it, which should be automatic, seems to break a lot.)

bug#20298: Missing public key for 24.5

[Mehmet Atif Ergun]

On Fri, Apr 24, 2015 at 3:14 PM, Glenn Morris <rgm@gnu.org> wrote:
>> I tried to verify the new (emacs-24.5) release but the public key that
>> signed the file is missing in the gnu keyring. The 24.4 had the same
>> problem (the signature for 24.4 belonged to a @gnu.org address.
>
> Nobody here can do anything about that, it's a GNU sysadmin issue.
>
> If you want to verify the signatures, both keys are available from
> standard keyservers, eg pgp.mit.edu. Though since you have never met
> either of us, you have no idea how trustworthy we are. :)
>
> (I don't see what the value of a keyring that is stored on the same ftp
> server as the file you want to download is. Especially since the process
> for updating it, which should be automatic, seems to break a lot.)


In that case, please remove the .sig files and the keyring file from
the server, along with the instructions on how to check the integrity
of the source code from the README file. :)

On a serious note, though, could you please forward the bug report to GNU
sysadmins so that this can be resolved? I do not know whom that would
be.

Thank you,
Mehmet.
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=20298

bug#20298: Missing public key for 24.5

[Stefan Monnier]

> In that case, please remove the .sig files and the keyring file from
> the server, along with the instructions on how to check the integrity
> of the source code from the README file. :)

The sig files are useful, it's the keyring that's less valuable.

> On a serious note, though, could you please forward the bug report to GNU
> sysadmins so that this can be resolved?

We did it already a while ago, but the response time for such requests
is pretty bad.

>  I do not know whom that would be.

I think Nicolas sent it to ftp-admin@gnu.org, but you can also try to
open a ticket on savannah.gnu.org.


        Stefan

bug#20298: Missing public key for 24.5

[Nicolas Petton]

[-- Attachment #1: Type: text/plain, Size: 722 bytes --]


Stefan Monnier writes:

>> In that case, please remove the .sig files and the keyring file from
>> the server, along with the instructions on how to check the integrity
>> of the source code from the README file. :)
>
> The sig files are useful, it's the keyring that's less valuable.
>
>> On a serious note, though, could you please forward the bug report to GNU
>> sysadmins so that this can be resolved?
>
> We did it already a while ago, but the response time for such requests
> is pretty bad.

Indeed, I asked them twice already.  Last time I had a request for them
they answered me but it took a bit of time, so I will just wait a bit
more.

Nico
-- 
Nicolas Petton
http://nicolas-petton.fr

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 512 bytes --]

bug#20298: Missing public key for 24.5

[Glenn Morris]

Nicolas Petton wrote:

> Indeed, I asked them twice already.  Last time I had a request for them
> they answered me but it took a bit of time, so I will just wait a bit
> more.

I don't know what you asked them, but when they reply please ask them to
review the whole system, not just add your key. Eg mine doesn't seem to
be there either, which implies the system has been busted for years.
I assume the file is supposed to be an automatically generated list of
everyone who can upload to ftp.gnu.org. If it's too much work to
maintain it, they might like to stop bothering and just update
ftp://ftp.gnu.org/README to refer to standard public key servers.

bug#20298: Missing public key for 24.5

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

Would people please report such problems to sysadmin@gnu.org?

-- 
Dr Richard Stallman
President, Free Software Foundation
51 Franklin St
Boston MA 02110
USA
www.fsf.org  www.gnu.org
Skype: No way! See stallman.org/skype.html.

bug#20298: Missing public key for 24.5

[Nicolas Petton]

[-- Attachment #1: Type: text/plain, Size: 403 bytes --]


Richard Stallman writes:

> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
>
> Would people please report such problems to sysadmin@gnu.org?

I will do that.

Cheers,
Nico
-- 
Nicolas Petton
http://nicolas-petton.fr

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 512 bytes --]

bug#20298: Missing public key for 24.5

[Nicolas Petton]

[-- Attachment #1: Type: text/plain, Size: 486 bytes --]


Glenn Morris writes:

> Mehmet Atif Ergun wrote:
>
>> I tried to verify the new (emacs-24.5) release but the public key that
>> signed the file is missing in the gnu keyring. The 24.4 had the same
>> problem (the signature for 24.4 belonged to a @gnu.org address.
>
> Nobody here can do anything about that, it's a GNU sysadmin issue.

My key has been added to the keyring on the FTP server.  I'm closing
this issue.

Nico
-- 
Nicolas Petton
http://nicolas-petton.fr

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 512 bytes --]

bug#20298: Missing public key for 24.5

[Stefan Monnier]

> My key has been added to the keyring on the FTP server.  I'm closing
> this issue.

Thank you Nicolas,


        Stefan

bug#20298: Missing public key for 24.5

[Glenn Morris]

Nicolas Petton wrote:

> My key has been added to the keyring on the FTP server.

Have you verified that?
Because it's not in the version of the file I just now downloaded.

File:gnu-keyring.gpg 1032 KB     04/29/2015  03:22:00 PM

bug#20298: Missing public key for 24.5

[Nicolas Petton]

[-- Attachment #1: Type: text/plain, Size: 409 bytes --]


Glenn Morris writes:

> Nicolas Petton wrote:
>
>> My key has been added to the keyring on the FTP server.
>
> Have you verified that?
> Because it's not in the version of the file I just now downloaded.

No I haven't.  I naively thought that it was true when a GNU sysadmin
told me that it had just been added.

I'll recontact them then.

Nico
-- 
Nicolas Petton
http://nicolas-petton.fr

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 512 bytes --]

bug#20298: Missing public key for 24.5

[Glenn Morris]

Maybe it will appear tomorrow, or the next time some cron job runs...

bug#20298: Missing public key for 24.5

[npostavs]

tags 20298 fixed
close 20298 
quit

Nicolas Petton <nicolas@petton.fr> writes:

> Glenn Morris writes:
>
>> Nicolas Petton wrote:
>>
>>> My key has been added to the keyring on the FTP server.
>>
>> Have you verified that?
>> Because it's not in the version of the file I just now downloaded.
>
> No I haven't.  I naively thought that it was true when a GNU sysadmin
> told me that it had just been added.
>

It's there now:

$ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.5.tar.xz.sig 
gpg: assuming signed data in 'emacs-24.5.tar.xz'
gpg: Signature made Fri 10 Apr 2015 12:57:02 PM EDT using RSA key ID 7C207910
gpg: Good signature from "Nicolas Petton <petton.nicolas@gmail.com>" [unknown]
gpg:                 aka "Nicolas Petton <nicolas@petton.fr>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 28D3 BED8 51FD F3AB 57FE  F93C 2335 87A4 7C20 7910