Signing key has expired for Emacs for windows zip archive (?)

Signing key has expired for Emacs for windows zip archive (?)

[ISHIKAWA,chiaki]

Hi,

I tried to download Emacs for Windows, based on the description of
https://www.gnu.org/software/emacs/documentation.html

Unfortunately, it seems that the signing key for the zip archive either 
has expired (or revoked?)
or worse some serious issue might have crept in.

The desription:


      Windows

GNU Emacs for Windows can be downloaded from a nearby GNU mirror 
<http://ftpmirror.gnu.org/emacs/windows>; or the main GNU FTP server 
<http://ftp.gnu.org/gnu/emacs/windows/>.
Unzip the zip file preserving the directory structure, and run 
|bin\runemacs.exe|. Alternatively, create a desktop shortcut to 
|bin\runemacs.exe|, and start Emacs by double-clicking on that 
shortcut's icon.

The Windows binaries are signed by Phillip Lord |8E64 B119 FE4B AC58 
C767 D5EC E095 C1A6 3FB1 EAD2|.


Well, I got the following error when I tried to verify the integrity of 
the archive.

I could not figure out how to change the gpg's output changed into 
English, but
it says the key was revoked by the owner.

gpg: 08/30/19 22:04:16 東京 (標準時)に施された署名

gpg: RSA鍵84930FFB79B645F7DEA29AD0AC6DD3FFD1D046BDを使用

gpg: "Phillip Lord <phillip.lord@newcastle.ac.uk>"からの正しい署名 
[期限切れ]

gpg: 別名"Phillip Lord <phillip.lord@russet.org.uk>" [期限切れ]

gpg: *警告*: この鍵は所有者によって失効されています!

gpg: 署名が偽物なこともある、ということです。

gpg: 失効理由: 理由は指定されていません

gpg: 失効のコメント: Revocation Certification produced at generation time

gpg: 注意: この鍵は期限切れです!

主鍵フィンガープリント: 8493 0FFB 79B6 45F7 DEA2 9AD0 AC6D D3FF D1D0 46BD

I am not sure what is going on, and could not resolve the issue after 
trying to update the key, etc.
Note that the "8E64 B119 ..." is different from the GPG's message. It is 
possible that the old archive signed in August was
signed with a different key, but somehow when I looked around "I got 
this "8493 0FFB ..." fingerprint.

I think whoever maintains the archive ought to be aware of the issue.

TIA

Chiaki

Re: Signing key has expired for Emacs for windows zip archive (?)

[Jakub Jankiewicz]

[-- Attachment #1: Type: text/plain, Size: 521 bytes --]

> I tried to download Emacs for Windows, based on the description of
> https://www.gnu.org/software/emacs/documentation.html
> 
> Unfortunately, it seems that the signing key for the zip archive either 
> has expired (or revoked?)
> or worse some serious issue might have crept in.

On Windows Box I'm using GNU Emacs from [choco][1]. After installing choco
installing GNU Emacs is easy. You can try that if just want to run Emacs.

[1]: https://chocolatey.org/docs/installation

I hope this will be usefull

[-- Attachment #2: Podpis cyfrowy OpenPGP --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: Signing key has expired for Emacs for windows zip archive (?)

[Phillip Lord]

Yes, I didn't anticipate this when my key expired. I am working out what
to do about it, but the key has not been compromised.

Phil

"ISHIKAWA,chiaki" <ishikawa@yk.rim.or.jp> writes:

> Hi,
>
> I tried to download Emacs for Windows, based on the description of
> https://www.gnu.org/software/emacs/documentation.html
>
> Unfortunately, it seems that the signing key for the zip archive
> either has expired (or revoked?)
> or worse some serious issue might have crept in.
>
> The desription:
>
>
>      Windows
>
> GNU Emacs for Windows can be downloaded from a nearby GNU mirror
> <http://ftpmirror.gnu.org/emacs/windows>; or the main GNU FTP server 
> <http://ftp.gnu.org/gnu/emacs/windows/>.
> Unzip the zip file preserving the directory structure, and run
> |bin\runemacs.exe|. Alternatively, create a desktop shortcut to 
> |bin\runemacs.exe|, and start Emacs by double-clicking on that
>  shortcut's icon.
>
> The Windows binaries are signed by Phillip Lord |8E64 B119 FE4B AC58
> C767 D5EC E095 C1A6 3FB1 EAD2|.
>
>
> Well, I got the following error when I tried to verify the integrity
> of the archive.
>
> I could not figure out how to change the gpg's output changed into
> English, but
> it says the key was revoked by the owner.
>
> gpg: 08/30/19 22:04:16 東京 (標準時)に施された署名
>
> gpg: RSA鍵84930FFB79B645F7DEA29AD0AC6DD3FFD1D046BDを使用
>
> gpg: "Phillip Lord <phillip.lord@newcastle.ac.uk>"からの正しい署名 [期
> 限切れ]
>
> gpg: 別名"Phillip Lord <phillip.lord@russet.org.uk>" [期限切れ]
>
> gpg: *警告*: この鍵は所有者によって失効されています!
>
> gpg: 署名が偽物なこともある、ということです。
>
> gpg: 失効理由: 理由は指定されていません
>
> gpg: 失効のコメント: Revocation Certification produced at generation time
>
> gpg: 注意: この鍵は期限切れです!
>
> 主鍵フィンガープリント: 8493 0FFB 79B6 45F7 DEA2 9AD0 AC6D D3FF D1D0 46BD
>
> I am not sure what is going on, and could not resolve the issue after
> trying to update the key, etc.
> Note that the "8E64 B119 ..." is different from the GPG's message. It
> is possible that the old archive signed in August was
> signed with a different key, but somehow when I looked around "I got
> this "8493 0FFB ..." fingerprint.
>
> I think whoever maintains the archive ought to be aware of the issue.
>
> TIA
>
> Chiaki