* bug#20298: Missing public key for 24.5
@ 2015-04-10 20:25 Mehmet Atif Ergun
2015-04-11 10:57 ` Nicolas Petton
` (2 more replies)
0 siblings, 3 replies; 19+ messages in thread
From: Mehmet Atif Ergun @ 2015-04-10 20:25 UTC (permalink / raw
To: 20298
Hi,
I tried to verify the new (emacs-24.5) release but the public key that
signed the file is missing in the gnu keyring. The 24.4 had the same
problem (the signature for 24.4 belonged to a @gnu.org address. This
one belongs to a gmail address (Nicolas Petton
<petton.nicolas@gmail.com>, see below).)
The file:
https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz
The signature:
https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz.sig
The keyring:
https://ftp.gnu.org/gnu/gnu-keyring.gpg
The output:
$ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.4.tar.xz.sig
gpg: Signature made Mon 20 Oct 2014 02:58:21 PM EDT
gpg: using RSA key 0x6592E9A3A0B0F199
gpg: Can't check signature: public key not found
$ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.5.tar.xz.sig
gpg: Signature made Fri 10 Apr 2015 12:57:02 PM EDT
gpg: using RSA key 0x233587A47C207910
gpg: Can't check signature: public key not found
The output I was expecting was along the lines of:
gpg: Good signature from .....
Thanks,
Mehmet.
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-10 20:25 bug#20298: Missing public key for 24.5 Mehmet Atif Ergun
@ 2015-04-11 10:57 ` Nicolas Petton
2015-04-11 11:33 ` Nicolas Petton
2015-04-24 19:14 ` Glenn Morris
2 siblings, 0 replies; 19+ messages in thread
From: Nicolas Petton @ 2015-04-11 10:57 UTC (permalink / raw
To: Mehmet Atif Ergun; +Cc: 20298
[-- Attachment #1: Type: text/plain, Size: 1188 bytes --]
Mehmet Atif Ergun writes:
> Hi,
>
> I tried to verify the new (emacs-24.5) release but the public key that
> signed the file is missing in the gnu keyring. The 24.4 had the same
> problem (the signature for 24.4 belonged to a @gnu.org address. This
> one belongs to a gmail address (Nicolas Petton
> <petton.nicolas@gmail.com>, see below).)
>
> The file:
> https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz
>
> The signature:
> https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz.sig
>
> The keyring:
> https://ftp.gnu.org/gnu/gnu-keyring.gpg
>
> The output:
> $ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.4.tar.xz.sig
> gpg: Signature made Mon 20 Oct 2014 02:58:21 PM EDT
> gpg: using RSA key 0x6592E9A3A0B0F199
> gpg: Can't check signature: public key not found
>
> $ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.5.tar.xz.sig
> gpg: Signature made Fri 10 Apr 2015 12:57:02 PM EDT
> gpg: using RSA key 0x233587A47C207910
> gpg: Can't check signature: public key not found
>
> The output I was expecting was along the lines of:
> gpg: Good signature from .....
I'll try to see if I have the access rights to update the keyring with
my pubkey.
Nico
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 512 bytes --]
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-10 20:25 bug#20298: Missing public key for 24.5 Mehmet Atif Ergun
2015-04-11 10:57 ` Nicolas Petton
@ 2015-04-11 11:33 ` Nicolas Petton
2015-04-11 14:07 ` Stefan Monnier
2015-04-24 19:14 ` Glenn Morris
2 siblings, 1 reply; 19+ messages in thread
From: Nicolas Petton @ 2015-04-11 11:33 UTC (permalink / raw
To: Mehmet Atif Ergun; +Cc: 20298
[-- Attachment #1: Type: text/plain, Size: 860 bytes --]
Mehmet Atif Ergun writes:
> Hi,
>
> I tried to verify the new (emacs-24.5) release but the public key that
> signed the file is missing in the gnu keyring. The 24.4 had the same
> problem (the signature for 24.4 belonged to a @gnu.org address. This
> one belongs to a gmail address (Nicolas Petton
> <petton.nicolas@gmail.com>, see below).)
>
> The file:
> https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz
>
> The signature:
> https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz.sig
>
> The keyring:
> https://ftp.gnu.org/gnu/gnu-keyring.gpg
I have updated gnu-keyring.gpg locally on my computer, but unfortunately
I don't know how to upload it to the FTP server. I don't think I have
write access.
Stefan, do you know how I should proceed to get my pubkey added to this
keyring?
Nico
--
Nicolas Petton
http://nicolas-petton.fr
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 512 bytes --]
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-11 11:33 ` Nicolas Petton
@ 2015-04-11 14:07 ` Stefan Monnier
2015-04-11 17:52 ` Mehmet Atif Ergun
0 siblings, 1 reply; 19+ messages in thread
From: Stefan Monnier @ 2015-04-11 14:07 UTC (permalink / raw
To: Nicolas Petton; +Cc: 20298, Mehmet Atif Ergun
> I have updated gnu-keyring.gpg locally on my computer, but unfortunately
> I don't know how to upload it to the FTP server. I don't think I have
> write access.
Indeed, I'd expect that access to this is more strictly controlled.
I think you'll need to contact the sysadmins at the FSF (maybe opening
a ticket on savannah is a good way to do that).
> Stefan, do you know how I should proceed to get my pubkey added to this
> keyring?
I think it should have been updated "automatically" when they gave you
access, so it's probably an oversight on the part of the one who gave
you access. If you still have his/her email, you might like to contact
him/her directly.
Stefan
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-11 14:07 ` Stefan Monnier
@ 2015-04-11 17:52 ` Mehmet Atif Ergun
2015-04-11 18:36 ` Nicolas Petton
0 siblings, 1 reply; 19+ messages in thread
From: Mehmet Atif Ergun @ 2015-04-11 17:52 UTC (permalink / raw
To: Stefan Monnier; +Cc: Nicolas Petton, 20298
[-- Attachment #1: Type: text/plain, Size: 964 bytes --]
Hi,
Something like this seems to have happened before. Does this help at all:
http://lists.gnu.org/archive/html/bug-gnu-emacs/2012-04/msg00917.html
Thanks,
Mehmet.
On Apr 11, 2015 10:07 AM, "Stefan Monnier" <monnier@iro.umontreal.ca> wrote:
> > I have updated gnu-keyring.gpg locally on my computer, but unfortunately
> > I don't know how to upload it to the FTP server. I don't think I have
> > write access.
>
> Indeed, I'd expect that access to this is more strictly controlled.
> I think you'll need to contact the sysadmins at the FSF (maybe opening
> a ticket on savannah is a good way to do that).
>
> > Stefan, do you know how I should proceed to get my pubkey added to this
> > keyring?
>
> I think it should have been updated "automatically" when they gave you
> access, so it's probably an oversight on the part of the one who gave
> you access. If you still have his/her email, you might like to contact
> him/her directly.
>
>
> Stefan
>
[-- Attachment #2: Type: text/html, Size: 1444 bytes --]
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-10 20:25 bug#20298: Missing public key for 24.5 Mehmet Atif Ergun
2015-04-11 10:57 ` Nicolas Petton
2015-04-11 11:33 ` Nicolas Petton
@ 2015-04-24 19:14 ` Glenn Morris
2015-04-24 21:32 ` Mehmet Atif Ergun
` (2 more replies)
2 siblings, 3 replies; 19+ messages in thread
From: Glenn Morris @ 2015-04-24 19:14 UTC (permalink / raw
To: Mehmet Atif Ergun; +Cc: 20298
Mehmet Atif Ergun wrote:
> I tried to verify the new (emacs-24.5) release but the public key that
> signed the file is missing in the gnu keyring. The 24.4 had the same
> problem (the signature for 24.4 belonged to a @gnu.org address.
Nobody here can do anything about that, it's a GNU sysadmin issue.
If you want to verify the signatures, both keys are available from
standard keyservers, eg pgp.mit.edu. Though since you have never met
either of us, you have no idea how trustworthy we are. :)
(I don't see what the value of a keyring that is stored on the same ftp
server as the file you want to download is. Especially since the process
for updating it, which should be automatic, seems to break a lot.)
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-24 19:14 ` Glenn Morris
@ 2015-04-24 21:32 ` Mehmet Atif Ergun
2015-04-25 14:33 ` Stefan Monnier
2015-04-25 17:03 ` Richard Stallman
2015-04-29 13:25 ` Nicolas Petton
2 siblings, 1 reply; 19+ messages in thread
From: Mehmet Atif Ergun @ 2015-04-24 21:32 UTC (permalink / raw
To: Glenn Morris; +Cc: 20298
On Fri, Apr 24, 2015 at 3:14 PM, Glenn Morris <rgm@gnu.org> wrote:
>> I tried to verify the new (emacs-24.5) release but the public key that
>> signed the file is missing in the gnu keyring. The 24.4 had the same
>> problem (the signature for 24.4 belonged to a @gnu.org address.
>
> Nobody here can do anything about that, it's a GNU sysadmin issue.
>
> If you want to verify the signatures, both keys are available from
> standard keyservers, eg pgp.mit.edu. Though since you have never met
> either of us, you have no idea how trustworthy we are. :)
>
> (I don't see what the value of a keyring that is stored on the same ftp
> server as the file you want to download is. Especially since the process
> for updating it, which should be automatic, seems to break a lot.)
In that case, please remove the .sig files and the keyring file from
the server, along with the instructions on how to check the integrity
of the source code from the README file. :)
On a serious note, though, could you please forward the bug report to GNU
sysadmins so that this can be resolved? I do not know whom that would
be.
Thank you,
Mehmet.
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=20298
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-24 21:32 ` Mehmet Atif Ergun
@ 2015-04-25 14:33 ` Stefan Monnier
2015-04-25 14:36 ` Nicolas Petton
0 siblings, 1 reply; 19+ messages in thread
From: Stefan Monnier @ 2015-04-25 14:33 UTC (permalink / raw
To: Mehmet Atif Ergun; +Cc: 20298
> In that case, please remove the .sig files and the keyring file from
> the server, along with the instructions on how to check the integrity
> of the source code from the README file. :)
The sig files are useful, it's the keyring that's less valuable.
> On a serious note, though, could you please forward the bug report to GNU
> sysadmins so that this can be resolved?
We did it already a while ago, but the response time for such requests
is pretty bad.
> I do not know whom that would be.
I think Nicolas sent it to ftp-admin@gnu.org, but you can also try to
open a ticket on savannah.gnu.org.
Stefan
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-25 14:33 ` Stefan Monnier
@ 2015-04-25 14:36 ` Nicolas Petton
2015-04-25 18:20 ` Glenn Morris
0 siblings, 1 reply; 19+ messages in thread
From: Nicolas Petton @ 2015-04-25 14:36 UTC (permalink / raw
To: Stefan Monnier; +Cc: 20298, Mehmet Atif Ergun
[-- Attachment #1: Type: text/plain, Size: 722 bytes --]
Stefan Monnier writes:
>> In that case, please remove the .sig files and the keyring file from
>> the server, along with the instructions on how to check the integrity
>> of the source code from the README file. :)
>
> The sig files are useful, it's the keyring that's less valuable.
>
>> On a serious note, though, could you please forward the bug report to GNU
>> sysadmins so that this can be resolved?
>
> We did it already a while ago, but the response time for such requests
> is pretty bad.
Indeed, I asked them twice already. Last time I had a request for them
they answered me but it took a bit of time, so I will just wait a bit
more.
Nico
--
Nicolas Petton
http://nicolas-petton.fr
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 512 bytes --]
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-25 14:36 ` Nicolas Petton
@ 2015-04-25 18:20 ` Glenn Morris
0 siblings, 0 replies; 19+ messages in thread
From: Glenn Morris @ 2015-04-25 18:20 UTC (permalink / raw
To: Nicolas Petton; +Cc: 20298, Mehmet Atif Ergun
Nicolas Petton wrote:
> Indeed, I asked them twice already. Last time I had a request for them
> they answered me but it took a bit of time, so I will just wait a bit
> more.
I don't know what you asked them, but when they reply please ask them to
review the whole system, not just add your key. Eg mine doesn't seem to
be there either, which implies the system has been busted for years.
I assume the file is supposed to be an automatically generated list of
everyone who can upload to ftp.gnu.org. If it's too much work to
maintain it, they might like to stop bothering and just update
ftp://ftp.gnu.org/README to refer to standard public key servers.
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-24 19:14 ` Glenn Morris
2015-04-24 21:32 ` Mehmet Atif Ergun
@ 2015-04-25 17:03 ` Richard Stallman
2015-04-25 21:58 ` Nicolas Petton
2015-04-29 13:25 ` Nicolas Petton
2 siblings, 1 reply; 19+ messages in thread
From: Richard Stallman @ 2015-04-25 17:03 UTC (permalink / raw
To: Glenn Morris; +Cc: 20298, mehmetaergun
[[[ To any NSA and FBI agents reading my email: please consider ]]]
[[[ whether defending the US Constitution against all enemies, ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]
Would people please report such problems to sysadmin@gnu.org?
--
Dr Richard Stallman
President, Free Software Foundation
51 Franklin St
Boston MA 02110
USA
www.fsf.org www.gnu.org
Skype: No way! See stallman.org/skype.html.
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-24 19:14 ` Glenn Morris
2015-04-24 21:32 ` Mehmet Atif Ergun
2015-04-25 17:03 ` Richard Stallman
@ 2015-04-29 13:25 ` Nicolas Petton
2015-04-29 14:13 ` Stefan Monnier
2015-04-29 15:55 ` Glenn Morris
2 siblings, 2 replies; 19+ messages in thread
From: Nicolas Petton @ 2015-04-29 13:25 UTC (permalink / raw
To: Glenn Morris; +Cc: 20298-done, Mehmet Atif Ergun
[-- Attachment #1: Type: text/plain, Size: 486 bytes --]
Glenn Morris writes:
> Mehmet Atif Ergun wrote:
>
>> I tried to verify the new (emacs-24.5) release but the public key that
>> signed the file is missing in the gnu keyring. The 24.4 had the same
>> problem (the signature for 24.4 belonged to a @gnu.org address.
>
> Nobody here can do anything about that, it's a GNU sysadmin issue.
My key has been added to the keyring on the FTP server. I'm closing
this issue.
Nico
--
Nicolas Petton
http://nicolas-petton.fr
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 512 bytes --]
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-29 13:25 ` Nicolas Petton
@ 2015-04-29 14:13 ` Stefan Monnier
2015-04-29 15:55 ` Glenn Morris
1 sibling, 0 replies; 19+ messages in thread
From: Stefan Monnier @ 2015-04-29 14:13 UTC (permalink / raw
To: 20298; +Cc: nicolas, mehmetaergun
> My key has been added to the keyring on the FTP server. I'm closing
> this issue.
Thank you Nicolas,
Stefan
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-29 13:25 ` Nicolas Petton
2015-04-29 14:13 ` Stefan Monnier
@ 2015-04-29 15:55 ` Glenn Morris
2015-04-29 16:02 ` Nicolas Petton
1 sibling, 1 reply; 19+ messages in thread
From: Glenn Morris @ 2015-04-29 15:55 UTC (permalink / raw
To: Nicolas Petton; +Cc: 20298, Mehmet Atif Ergun
Nicolas Petton wrote:
> My key has been added to the keyring on the FTP server.
Have you verified that?
Because it's not in the version of the file I just now downloaded.
File:gnu-keyring.gpg 1032 KB 04/29/2015 03:22:00 PM
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-29 15:55 ` Glenn Morris
@ 2015-04-29 16:02 ` Nicolas Petton
2015-04-29 17:02 ` Glenn Morris
2016-08-10 0:20 ` npostavs
0 siblings, 2 replies; 19+ messages in thread
From: Nicolas Petton @ 2015-04-29 16:02 UTC (permalink / raw
To: Glenn Morris; +Cc: Nicolas Petton, 20298, 20298-reopen, Mehmet Atif Ergun
[-- Attachment #1: Type: text/plain, Size: 409 bytes --]
Glenn Morris writes:
> Nicolas Petton wrote:
>
>> My key has been added to the keyring on the FTP server.
>
> Have you verified that?
> Because it's not in the version of the file I just now downloaded.
No I haven't. I naively thought that it was true when a GNU sysadmin
told me that it had just been added.
I'll recontact them then.
Nico
--
Nicolas Petton
http://nicolas-petton.fr
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 512 bytes --]
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-29 16:02 ` Nicolas Petton
@ 2015-04-29 17:02 ` Glenn Morris
2016-08-10 0:20 ` npostavs
1 sibling, 0 replies; 19+ messages in thread
From: Glenn Morris @ 2015-04-29 17:02 UTC (permalink / raw
To: Nicolas Petton; +Cc: 20298, Mehmet Atif Ergun
Maybe it will appear tomorrow, or the next time some cron job runs...
^ permalink raw reply [flat|nested] 19+ messages in thread
* bug#20298: Missing public key for 24.5
2015-04-29 16:02 ` Nicolas Petton
2015-04-29 17:02 ` Glenn Morris
@ 2016-08-10 0:20 ` npostavs
1 sibling, 0 replies; 19+ messages in thread
From: npostavs @ 2016-08-10 0:20 UTC (permalink / raw
To: Nicolas Petton; +Cc: 20298, 20298-reopen, Mehmet Atif Ergun
tags 20298 fixed
close 20298
quit
Nicolas Petton <nicolas@petton.fr> writes:
> Glenn Morris writes:
>
>> Nicolas Petton wrote:
>>
>>> My key has been added to the keyring on the FTP server.
>>
>> Have you verified that?
>> Because it's not in the version of the file I just now downloaded.
>
> No I haven't. I naively thought that it was true when a GNU sysadmin
> told me that it had just been added.
>
It's there now:
$ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.5.tar.xz.sig
gpg: assuming signed data in 'emacs-24.5.tar.xz'
gpg: Signature made Fri 10 Apr 2015 12:57:02 PM EDT using RSA key ID 7C207910
gpg: Good signature from "Nicolas Petton <petton.nicolas@gmail.com>" [unknown]
gpg: aka "Nicolas Petton <nicolas@petton.fr>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 28D3 BED8 51FD F3AB 57FE F93C 2335 87A4 7C20 7910
^ permalink raw reply [flat|nested] 19+ messages in thread
end of thread, other threads:[~2016-08-10 0:20 UTC | newest]
Thread overview: 19+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-04-10 20:25 bug#20298: Missing public key for 24.5 Mehmet Atif Ergun
2015-04-11 10:57 ` Nicolas Petton
2015-04-11 11:33 ` Nicolas Petton
2015-04-11 14:07 ` Stefan Monnier
2015-04-11 17:52 ` Mehmet Atif Ergun
2015-04-11 18:36 ` Nicolas Petton
2015-04-24 19:14 ` Glenn Morris
2015-04-24 21:32 ` Mehmet Atif Ergun
2015-04-25 14:33 ` Stefan Monnier
2015-04-25 14:36 ` Nicolas Petton
2015-04-25 18:20 ` Glenn Morris
2015-04-25 17:03 ` Richard Stallman
2015-04-25 21:58 ` Nicolas Petton
2015-04-29 13:25 ` Nicolas Petton
2015-04-29 14:13 ` Stefan Monnier
2015-04-29 15:55 ` Glenn Morris
2015-04-29 16:02 ` Nicolas Petton
2015-04-29 17:02 ` Glenn Morris
2016-08-10 0:20 ` npostavs
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.