emacs-25.2-x86_64.zip signed by ???

emacs-25.2-x86_64.zip signed by ???

[Rostislav Svoboda]

Hi,

according to Download & installation instructions from
https://www.gnu.org/software/emacs/download.html#windows the
emacs-25.2-x86_64.zip should be signed by Nicolas Petton. To me (if my
interpretation of gpg --verify is correct) it looks likes it is signed by
Phillip Lord.

Would you please clarify this to me, or correct the instructions?

Thanks Bost


$ wget https://ftp.gnu.org/gnu/gnu-keyring.gpg && gpg --import gnu-keyring.gpg
gpg: starting migration from earlier GnuPG versions
gpg: porting secret keys from '/home/rsvoboda/.gnupg/secring.gpg' to gpg-agent
gpg: migration succeeded
gpg: key 09DF2DC9BE216115: "Francesco Potortì <pot@potorti.it>" not changed
[..]
gpg: key 233587A47C207910: public key "Nicolas Petton
<petton.nicolas@gmail.com>" imported
[..]
gpg: key 969C3BE389DDA6EB: public key "Shigio YAMAGUCHI
<shigio@gnu.org>" imported
gpg: Total number processed: 506
gpg:     skipped PGP-2 keys: 10
gpg:               imported: 131
gpg:              unchanged: 355
gpg:           new user IDs: 9
gpg:            new subkeys: 19
gpg:         new signatures: 689
gpg: no ultimately trusted keys found

$ wget http://gnu.xl-mirror.nl/emacs/windows/emacs-25.2-x86_64.zip
[..]

$ wget http://gnu.xl-mirror.nl/emacs/windows/emacs-25.2-x86_64.zip.sig
[..]

$ gpg --verify emacs-25.2-x86_64.zip.sig emacs-25.2-x86_64.zip
gpg: Signature made Di 25 Apr 2017 18:19:43 CEST
gpg:                using RSA key AC6DD3FFD1D046BD
gpg: Good signature from "Phillip Lord <phillip.lord@newcastle.ac.uk>" [unknown]
gpg:                 aka "Phillip Lord <phillip.lord@russet.org.uk>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 8493 0FFB 79B6 45F7 DEA2  9AD0 AC6D D3FF D1D0 46BD

Re: emacs-25.2-x86_64.zip signed by ???

[Nicolas Petton]

[-- Attachment #1: Type: text/plain, Size: 468 bytes --]

Rostislav Svoboda <rostislav.svoboda@gmail.com> writes:

> Hi,

Hi Rostislav,

> according to Download & installation instructions from
> https://www.gnu.org/software/emacs/download.html#windows the
> emacs-25.2-x86_64.zip should be signed by Nicolas Petton. To me (if my
> interpretation of gpg --verify is correct) it looks likes it is signed by
> Phillip Lord.

I'm signing the release tarballs, but the Windows builds are done and
signed by Phillip.

Cheers,
Nico

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 472 bytes --]

Re: emacs-25.2-x86_64.zip signed by ???

[Phillip Lord]

Nicolas Petton <nicolas@petton.fr> writes:

> Rostislav Svoboda <rostislav.svoboda@gmail.com> writes:
>
>> Hi,
>
> Hi Rostislav,
>
>> according to Download & installation instructions from
>> https://www.gnu.org/software/emacs/download.html#windows the
>> emacs-25.2-x86_64.zip should be signed by Nicolas Petton. To me (if my
>> interpretation of gpg --verify is correct) it looks likes it is signed by
>> Phillip Lord.
>
> I'm signing the release tarballs, but the Windows builds are done and
> signed by Phillip.


Can we update the website? If I remember we were going to do this
before, but I was in the process of changing my key.

Phil

Re: emacs-25.2-x86_64.zip signed by ???

[Nicolas Petton]

[-- Attachment #1: Type: text/plain, Size: 237 bytes --]

Phillip Lord <phillip.lord@russet.org.uk> writes:

> Can we update the website? If I remember we were going to do this
> before, but I was in the process of changing my key.

Sure thing!

Can you give the your fingerprint?

Cheers,
Nico

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 472 bytes --]

Re: emacs-25.2-x86_64.zip signed by ???

[Rostislav Svoboda]

Oh, BTW is it necessary to have the name of the person building the
tarball or zip file on the website or anywhere else?

I mean, it doesn't play any role if the content comes from friend or
foe if the checksum is the same as the one on the installation
website, right?

Cheers Bost


2017-05-22 17:37 GMT+02:00 Nicolas Petton <nicolas@petton.fr>:
> Phillip Lord <phillip.lord@russet.org.uk> writes:
>
>> Can we update the website? If I remember we were going to do this
>> before, but I was in the process of changing my key.
>
> Sure thing!
>
> Can you give the your fingerprint?
>
> Cheers,
> Nico