Hi!

I was reviewing the list of items at https://savannah.nongnu.org/task/?group=administration as suggested by the https://savannah.gnu.org/maintenance/HowToBecomeASavannahHacker/ page, and I noticed this one. It seems to be dormant - is it dead, or just resting? I'm not sure how it can be addressed without access to the servers in question, but I'm happy to take pointers in a suitable direction. :-)

Thanks
Paul

Keyservers go out of fashion.  I think we could setup a cron job to notify people whose keys expire, after we upgrade to GnuPG 2.2.

BTW, should we do anything about revocations?

Thank you for filling in the details of how the warning came about.  I wonder if it would be possible to update keys from the key servers automatically.

The report was "wget-1.20.1.tar.gz signed with expired key" and had the following message:

I was rather surprised to see that the key used to sign a release on December 26 expired on July 12. Is it legit?

$ curl https://ftp.gnu.org/gnu/gnu-keyring.gpg | gpg --import
...
$ gpg --verify wget-1.20.1.tar.gz.sig
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information
gpg: Signature made December 26, 2018 at 08:12:51 PM UTC using RSA key ID A2670428
gpg: Good signature from "Tim Rühsen <tim.ruehsen@gmx.de>"
gpg: Note: This key has expired!
Primary key fingerprint: 1CB2 7DBC 9861 4B2D 5841  646D 0830 2DB6 A267 0428

$ gpg --list-key A2670428
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information
pub   4096R/A2670428 2014-06-26 [expired: 2018-06-12]
uid                  Tim Rühsen <tim.ruehsen@gmx.de>

So my key wasn't expired since 2016 but since 2018-06-12.

A possible quick solution would be to have a crontab daily/weekly checking for soon-to-expire keys and to inform those people via an automated email (including steps on how to update expiration date and how to upload to key servers and how to update to Savannah).

Then a second crontab could check all GPG keys on a public key server. And download those keys whose expiration date has been changed (e.g. it could be that someone changed the expiration date from 'never' to a concrete future date).

Manually refreshing/updating one's GPG key at Savannah is a manual process and easily forgotten.
I wonder if there is any security impact to automatically fetch expired GPG keys from a public keyserver. Given that the key itself didn't change and isn't revoked.

E.g. my GPG key expires every 2 years. Shortly before it does I refresh the expire time and upload the key to the keyserver infrastructure. It is tedious to remember all the sites that need a manual update as well (like Savannah). It took a bug report against GNU Wget to update my key today - it was expired since 2016 !