From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: Commits signed by key not registered on Savannah Date: Sat, 11 Feb 2017 15:35:21 +0100 Message-ID: <87lgtc3idy.fsf@gnu.org> References: <20170210161608.9175.4763@vcs0.savannah.gnu.org> <20170210161610.BD4DB21058@vcs0.savannah.gnu.org> <8760kh3uvb.fsf_-_@netris.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:54058) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ccYlu-0008Ko-4b for guix-devel@gnu.org; Sat, 11 Feb 2017 09:35:31 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ccYlo-0000nI-Vy for guix-devel@gnu.org; Sat, 11 Feb 2017 09:35:30 -0500 In-Reply-To: (David Craven's message of "Sat, 11 Feb 2017 14:49:29 +0100") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: David Craven Cc: guix-devel David Craven skribis: >> According to "git log --show-signature" on my machine, several recent >> commits by you (including this one) were signed with a different key >> than the one you have registered on Savannah. Savannah has key >> C5E051C79C0BECDB, but your recent commits were signed with key >> 33B9E9FDE28D2C23. How are we to confirm the authenticity of this key >> and of these commits? > > Hi Mark, > > I revoked my old key and published a new one to mit.edu. I mentioned > it in an email that I lost access to my previous key - I know - shame > on me - and if it was ok to simply regenerate a key and start signing > with it. I did not get a reply and assumed that keys expire and are > revoked from time to time so it must be ok. Please let me know what I > can do to remedy this issue. I don=E2=80=99t remember seeing that message. We still have little infrastructure in place around signed commits, but we should definitely have a process for changing keys. When switching to a new key, we should make sure to let everyone else know. Ludo=E2=80=99.