New signing key

New signing key

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 181 bytes --]

Hello,

I'm changing my Guix signing key from
B0515948F1E7D3C1B98038A02646FA30BACA7F08 to
6840722EEEE4D3A64EE53EAC6AAC1963757F47FF.

Patches to follow. Testing is appreciated!

Leo

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[bug#67790] New signing key

[Leo Famulari]

[-- Attachment #1.1: Type: text/plain, Size: 95 bytes --]

Here are the patches.

One of them is for the 'keyring' branch, and the other is for 'master'.

[-- Attachment #1.2: 0001-Add-lfam-s-new-key.patch --]
[-- Type: text/plain, Size: 4322 bytes --]

From 935e3c9e93548a566cf3b3039b0822d4179974e4 Mon Sep 17 00:00:00 2001
Message-ID: <935e3c9e93548a566cf3b3039b0822d4179974e4.1702342270.git.leo@famulari.name>
From: Leo Famulari <leo@famulari.name>
Date: Sat, 12 Aug 2023 02:04:58 -0400
Subject: [PATCH] Add lfam's new key.

* lfam-BACA7F08.key: Rename to ...
* lfam (old)-BACA7F08.key: ... this
* lfam-757F47FF.key: New file.

Change-Id: If11df36d868cdc77830041ddcc7b9570e02db237
---
 lfam-BACA7F08.key => lfam (old)-BACA7F08.key |  0
 lfam-757F47FF.key                            | 51 ++++++++++++++++++++
 2 files changed, 51 insertions(+)
 rename lfam-BACA7F08.key => lfam (old)-BACA7F08.key (100%)
 create mode 100644 lfam-757F47FF.key

diff --git a/lfam-BACA7F08.key b/lfam (old)-BACA7F08.key
similarity index 100%
rename from lfam-BACA7F08.key
rename to lfam (old)-BACA7F08.key
diff --git a/lfam-757F47FF.key b/lfam-757F47FF.key
new file mode 100644
index 0000000000..46825381a3
--- /dev/null
+++ b/lfam-757F47FF.key
@@ -0,0 +1,51 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGTXIH0BEAC37VLFalC3SaTC2thkolDRRsoIfTa4LyMZVCRAMAO+/xmtUz4y
+VlqOu/Sah3hbOEWuqVwTEqhSAUguEa95yzXs2RhhDpkJSXXWj4fREeOhv1pBon7l
+b92DHORbkTKQLZaY0QB3KzLTX5V+ZtnvdKDoU4j3cv9nOLpsdZkR4HvxtiBbMrnT
+KPQ/zHpE+sZr1p23T84y20wbQggkoB9GjguKXV04kJgknjun/0RC0E1AFsIqB79D
+hsxPCYgvG0qJgbTDYnt1WsdA6yJbfQ/iG6zZmXlMQumQvxX4pm8PKtfwDVcrz1LJ
+Cg7/TMWA+DaSaOxXnSn9+gttdAYA+HDn2WxgcKt1uxUe7L5EMsQNG5l6pWyAlMNv
+fjxOJc7vTVCUT83RP8mRRtxTEJg6+BXV2gyqn+vBCfZU4uR2LLFYJABC8whAJ/Jt
+G72n5e3dpIN/o2gZ/dPuwG+hXOBHgKQVIDQq0aCAkAPqwoZzLDHlV5maG0nju2Mv
+v8bDpnIP6khkXKPOKu7Xor2NvfPO0rdNtQDSAxX8OV7zfvMuEAHPAfL51jKRFfaz
+BEUdwXerEhGw9R+V7ZTFV7K/GdlTjibTuCQzuH9IsdjV6iF4noZnsV/rWuHK7oj5
+42+eIYFF0lDDtHSs3FhYN4LkzKextTHt2t7PyXT60VMVVf90omhp3J9pHQARAQAB
+tCBMZW8gRmFtdWxhcmkgPGxlb0BmYW11bGFyaS5uYW1lPokCTgQTAQgAOBYhBGhA
+ci7u5NOmTuU+rGqsGWN1f0f/BQJk1yB9AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4B
+AheAAAoJEGqsGWN1f0f/y/4P/1kIclG0fUu/18OK5hsr1Kt0/wuwF4FmWS4kkODp
+FVf4/yxAuGh6zgEZmnqCL+uEkDso7mX1QXk9RQbB3tP2AMOL9UXXXgF46kH1ZB8E
+0R+bsjd75MhAsXzo/Yyjund7gcmC/d4IgA0JCkUMgWh7xScp7Zcb0x3uZU8R7zkr
+T8whSpSXDB0m8c7GbzZ789G3vQyFjkQyuBXcxGsG4dlQR3TpC0a4JiSUStzsf98W
+1IYh41VZaZY3aRCED4YImpW2T+JkVCvgP1QGTV6P5KNYY1cmSkzL9YY6SVLnjF22
+NqQwYcp4/jK4o8+QZkQ39ilIeH/9cKecd6DbkjZllcRlTnfFW3p5wRspa/Ia2Fgh
++L/UltW374ffKU5qkK58CTUuzIDM2lnY6hbd5CAqcGaimF+bqRY1Tcp+jrxNI84E
+VysAX9JPyLCXgDSu59A1CaAkT209gVZ1F4m6jvJIWmpc6TamFzG+Sc7MG95bGlyp
+tC7pGFzYE8boX3AR6eyv53BABzPduWv9ndlEH6W6vpQOLdAciEfPvpqL8rH2Zim3
+AGfZThPONsnwYTIPczqRG9hTVU8YW5y4DD/g78n2QgxaadsA/r8hTpKty6n1ciIe
+tLHpZEuKasQO7qRT5n0vVjjhTgvtI1coiNkv5S4l80CmhYJbhiZgTRCT3iNORWBp
+YGEHuQINBGTXIH0BEACpWvsFHVnO/+hhePxoub+fLO0zOZUtUSBY9IiLfUv3AUX5
+Be5LgD5dHitEj87F+WDXp8zNn/GdT/ru0chpGBNzX2PeRUtmkaNHGvQrUP6xon86
+aKOqxUpsoVs74B5/M3Ml0VMr0TPJbBXSYfY8I9i/RZHpoZ2xmFCTqajrN0mXu6jM
+GklV7IwUNqPykjrQplpkuDZrAJlop2MdxsY/65FELvpPjJeZRxKhCD6/w1GUrQep
+uTCVt3r51QwJ6e1VEb5sQpY6HXRY8sJFjhYKzxLAsIaDrJm3+FHhplJYzdeJ9QUO
+Xati+P9htX3fIfjKxx/1ksVthVpHXNKUTRp5EUMpFE/9QU287P37gU/NbKTP3AyH
+44o7WHKOTUpaXiM7TAFyhPcfjHQkrW4bNmDyQI920YM3ewCybFfTcrWiNIMFmSC2
+yJ5u1IglHhXPy5icbIyuMLfRPd47XDjmV0yZx8EMSdar7P6xnkMR8R1iO5Azj1uf
+dcGnQTfOSyu9mOTXa2Z8I9I4tKfZ0EpIZnFrPEbZNkQVJ4G2WFKT1783s6GjMrID
+24JA4iCldrRqHV8n9s7AJouvco0XJTS9/pkTBmU6Ey6J39jrt4MF25xO38axgzs6
+1PkVq3EX9am7rVlO2ISVx3WiBxSUEbsUUwS4Fy60NropZy7XJuCKGiF60vZJpQAR
+AQABiQI2BBgBCAAgFiEEaEByLu7k06ZO5T6saqwZY3V/R/8FAmTXIH0CGwwACgkQ
+aqwZY3V/R/+1pRAAssyNXXp2G/pgI1KDIU1mx4H2pKPMH0y/HYOheWdZ7+nRmtlm
+bAySRm3fyOyK1JWfqosHMuPSuhcWkWqoKcyxmJU2WFIOTL4nqce90M1er2y70zCx
+L2cye9xul8FHKMqnkXnQSUy+wxWbY8SrJM+Jl12shz7JF9JDU6rHCT7/CyrTZCl8
+URH24pI1ggHv3DoO7VDrE4w0CKnooA6/FiSwFj1By68B2YOHEGCgI/wwErdYrZ54
+fuvAmNDrilNP5g7Df7zQl9nNT8MbBilLDlXHMmBQojwHn7Eca9GNlHSjoVp7vOLV
+O2CPVIQiH83e8fOgZX9CeZReGGn/dWOH4y3bTfVzkUEHdZ+Scfo9lhtA0M+SBFjZ
+UyU/eTQ2MueMmFOztvmSMnnP0FuHzsDMpQSH//7HG7+N0mP3YduqfPdNCqBhECwY
+WNdrReb+XkLAdxO/1IhDGK0Pvkjd1KZdRxYnAg0l06eis/Ij2fDYpaSA8vvQRlNg
+hNs4XAJsuBXb3B+IZyADs6zAPYJFZxRle3ev6t/vqoASo07VfVQKfLQWzjp17rUF
+yXh1rL4qCVh4QvhZuVauCuKRw4bahIchCmUQ+xjrbRcmRwX/waoXeFv3EcJdilpa
+nJ39oBAJwAmZQ087PDZF6EcdB+OtMMrTLcIEzS0aUVyHD95E3cBCKW7ej08=
+=g8yq
+-----END PGP PUBLIC KEY BLOCK-----

base-commit: c3db650680f995f0556d3ddce567cdc1c33e4603
-- 
2.41.0


[-- Attachment #1.3: 0001-.guix-authorizations-Update-lfam-s-key.patch --]
[-- Type: text/plain, Size: 1137 bytes --]

From 24e4c74585a6bdbbca724942438d889ecdabda80 Mon Sep 17 00:00:00 2001
Message-ID: <24e4c74585a6bdbbca724942438d889ecdabda80.1702342362.git.leo@famulari.name>
From: Leo Famulari <leo@famulari.name>
Date: Sat, 12 Aug 2023 02:10:51 -0400
Subject: [PATCH] .guix-authorizations: Update lfam's key.

* .guix-authorizations: Update lfam's signing key fingerprint.

Change-Id: Ic34f364dfc46e403e1d431e5860a63b36143b6f3
---
 .guix-authorizations | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.guix-authorizations b/.guix-authorizations
index bac49f71a9..c2e043d414 100644
--- a/.guix-authorizations
+++ b/.guix-authorizations
@@ -62,8 +62,7 @@
    (name "lbraun"))
   ("ACC2 3BA0 59F7 CCF4 08F0  43AD 442A 84B8 C70E 2F87"
    (name "lilyp"))
-  (;; primary: "4F71 6F9A 8FA2 C80E F1B5  E1BA 5E35 F231 DE1A C5E0"
-   "B051 5948 F1E7 D3C1 B980  38A0 2646 FA30 BACA 7F08"
+  ("6840 722E EEE4 D3A6 4EE5  3EAC 6AAC 1963 757F 47FF"
    (name "lfam"))
   ("BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA"
    (name "mbakke"))

base-commit: 5df4084ecdd5f33a8083bc05850f85c5e3eaae44
-- 
2.41.0


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: New signing key

[Maxim Cournoyer]

Hi,

Leo Famulari <leo@famulari.name> writes:

> Hello,
>
> I'm changing my Guix signing key from
> B0515948F1E7D3C1B98038A02646FA30BACA7F08 to
> 6840722EEEE4D3A64EE53EAC6AAC1963757F47FF.
>
> Patches to follow. Testing is appreciated!

Thanks for the heads-up!

-- 
Thanks,
Maxim

Re: bug#67790: New signing key

[Maxim Cournoyer]

Hi,

Maxim Cournoyer <maxim.cournoyer@gmail.com> writes:

> Hi,
>
> Leo Famulari <leo@famulari.name> writes:
>
>> Hello,
>>
>> I'm changing my Guix signing key from
>> B0515948F1E7D3C1B98038A02646FA30BACA7F08 to
>> 6840722EEEE4D3A64EE53EAC6AAC1963757F47FF.
>>
>> Patches to follow. Testing is appreciated!
>
> Thanks for the heads-up!

Note that I believe you can simply update to your new key yourself.
You'll want to add your new key to the keyring branch, then adjust the
.guix-authorizations file with its new keygrip.

Your new key will become mandated after your .guix-authorizations change
is pushed.

-- 
Thanks,
Maxim

bug#67790: New signing key

[Leo Famulari]

[-- Attachment #1: Type: text/plain, Size: 395 bytes --]

On Tue, Dec 12, 2023 at 12:02:33PM -0500, Maxim Cournoyer wrote:
> Note that I believe you can simply update to your new key yourself.
> You'll want to add your new key to the keyring branch, then adjust the
> .guix-authorizations file with its new keygrip.

Thanks, I pushed to 'keyring' as
935e3c9e93548a566cf3b3039b0822d4179974e4, and to 'master' as
4c4222f32a2906b7bcab74fab70ff2c2f152e8eb.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[bug#67790] New signing key

[John Kehayias via Guix-patches via]

On Wed, Dec 13, 2023 at 09:10 PM, Leo Famulari wrote:

> On Tue, Dec 12, 2023 at 12:02:33PM -0500, Maxim Cournoyer wrote:
>> Note that I believe you can simply update to your new key yourself.
>> You'll want to add your new key to the keyring branch, then adjust the
>> .guix-authorizations file with its new keygrip.
>
> Thanks, I pushed to 'keyring' as
> 935e3c9e93548a566cf3b3039b0822d4179974e4, and to 'master' as
> 4c4222f32a2906b7bcab74fab70ff2c2f152e8eb.
>

Just saw, thanks for the update.

And I assume all this was just to use a new key (did I see some
mention of subkeys on #guix? that's what I use) and not because of
something bad happening to the old one right?

John

Re: bug#67790: New signing key

[Leo Famulari]

On Wed, Dec 13, 2023, at 22:17, John Kehayias wrote:
> And I assume all this was just to use a new key (did I see some
> mention of subkeys on #guix? that's what I use) and not because of
> something bad happening to the old one right?

I don't know if anything bad happened to the old key. That's fundamentally unknowable. But I decided to start using a new key.

Re: bug#67790: New signing key

[John Kehayias]

On Thu, Dec 14, 2023 at 11:16 AM, Leo Famulari wrote:

> On Wed, Dec 13, 2023, at 22:17, John Kehayias wrote:
>> And I assume all this was just to use a new key (did I see some
>> mention of subkeys on #guix? that's what I use) and not because of
>> something bad happening to the old one right?
>
> I don't know if anything bad happened to the old key. That's
> fundamentally unknowable. But I decided to start using a new key.

I suppose I should have been more specific than "something bad" :) I
merely meant this wasn't an actual security issue of losing control of
a private key, but merely moving to a new one for other reasons.

In any event, this is a good reminder (to myself) to have backups of
private keys somewhere safe!

Re: bug#67790: New signing key

[Leo Famulari]

On Fri, Dec 15, 2023 at 06:06:26AM +0000, John Kehayias wrote:
> I suppose I should have been more specific than "something bad" :) I
> merely meant this wasn't an actual security issue of losing control of
> a private key, but merely moving to a new one for other reasons.

The old key "expired" last summer. I had been faking the date for months
to work around that. I did not feel motivated to change the expiration
date or to remove the expiration date either :)

It was easier to make a new key.