New signing key

New signing key

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 181 bytes --]

Hello,

I'm changing my Guix signing key from
B0515948F1E7D3C1B98038A02646FA30BACA7F08 to
6840722EEEE4D3A64EE53EAC6AAC1963757F47FF.

Patches to follow. Testing is appreciated!

Leo

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: New signing key

[Maxim Cournoyer]

Hi,

Leo Famulari <leo@famulari.name> writes:

> Hello,
>
> I'm changing my Guix signing key from
> B0515948F1E7D3C1B98038A02646FA30BACA7F08 to
> 6840722EEEE4D3A64EE53EAC6AAC1963757F47FF.
>
> Patches to follow. Testing is appreciated!

Thanks for the heads-up!

-- 
Thanks,
Maxim

Re: bug#67790: New signing key

[Maxim Cournoyer]

Hi,

Maxim Cournoyer <maxim.cournoyer@gmail.com> writes:

> Hi,
>
> Leo Famulari <leo@famulari.name> writes:
>
>> Hello,
>>
>> I'm changing my Guix signing key from
>> B0515948F1E7D3C1B98038A02646FA30BACA7F08 to
>> 6840722EEEE4D3A64EE53EAC6AAC1963757F47FF.
>>
>> Patches to follow. Testing is appreciated!
>
> Thanks for the heads-up!

Note that I believe you can simply update to your new key yourself.
You'll want to add your new key to the keyring branch, then adjust the
.guix-authorizations file with its new keygrip.

Your new key will become mandated after your .guix-authorizations change
is pushed.

-- 
Thanks,
Maxim

bug#67790: New signing key

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 395 bytes --]

On Tue, Dec 12, 2023 at 12:02:33PM -0500, Maxim Cournoyer wrote:
> Note that I believe you can simply update to your new key yourself.
> You'll want to add your new key to the keyring branch, then adjust the
> .guix-authorizations file with its new keygrip.

Thanks, I pushed to 'keyring' as
935e3c9e93548a566cf3b3039b0822d4179974e4, and to 'master' as
4c4222f32a2906b7bcab74fab70ff2c2f152e8eb.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[bug#67790] New signing key

[John Kehayias via Guix-patches via]

On Wed, Dec 13, 2023 at 09:10 PM, Leo Famulari wrote:

> On Tue, Dec 12, 2023 at 12:02:33PM -0500, Maxim Cournoyer wrote:
>> Note that I believe you can simply update to your new key yourself.
>> You'll want to add your new key to the keyring branch, then adjust the
>> .guix-authorizations file with its new keygrip.
>
> Thanks, I pushed to 'keyring' as
> 935e3c9e93548a566cf3b3039b0822d4179974e4, and to 'master' as
> 4c4222f32a2906b7bcab74fab70ff2c2f152e8eb.
>

Just saw, thanks for the update.

And I assume all this was just to use a new key (did I see some
mention of subkeys on #guix? that's what I use) and not because of
something bad happening to the old one right?

John

Re: bug#67790: New signing key

[Leo Famulari]

On Wed, Dec 13, 2023, at 22:17, John Kehayias wrote:
> And I assume all this was just to use a new key (did I see some
> mention of subkeys on #guix? that's what I use) and not because of
> something bad happening to the old one right?

I don't know if anything bad happened to the old key. That's fundamentally unknowable. But I decided to start using a new key.

Re: bug#67790: New signing key

[John Kehayias]

On Thu, Dec 14, 2023 at 11:16 AM, Leo Famulari wrote:

> On Wed, Dec 13, 2023, at 22:17, John Kehayias wrote:
>> And I assume all this was just to use a new key (did I see some
>> mention of subkeys on #guix? that's what I use) and not because of
>> something bad happening to the old one right?
>
> I don't know if anything bad happened to the old key. That's
> fundamentally unknowable. But I decided to start using a new key.

I suppose I should have been more specific than "something bad" :) I
merely meant this wasn't an actual security issue of losing control of
a private key, but merely moving to a new one for other reasons.

In any event, this is a good reminder (to myself) to have backups of
private keys somewhere safe!

Re: bug#67790: New signing key

[Leo Famulari]

On Fri, Dec 15, 2023 at 06:06:26AM +0000, John Kehayias wrote:
> I suppose I should have been more specific than "something bad" :) I
> merely meant this wasn't an actual security issue of losing control of
> a private key, but merely moving to a new one for other reasons.

The old key "expired" last summer. I had been faking the date for months
to work around that. I did not feel motivated to change the expiration
date or to remove the expiration date either :)

It was easier to make a new key.