Add a New Comment (Rich Markup)
( Jump to the original submission )
Keyservers go out of fashion. I think we could setup a cron job to notify people whose keys expire, after we upgrade to GnuPG 2.2. BTW, should we do anything about revocations?
> I wonder if it would be possible to update keys from the key servers automatically.
Before we do such things, it would be reasonable if we run GnuPG 2.2 on frontend0 (if we don't, the feature won't work with ECC), and that means upgrading the operating system.
Thank you for filling in the details of how the warning came about. I wonder if it would be possible to update keys from the key servers automatically.
> curl https://ftp.gnu.org/gnu/gnu-keyring.gpg | gpg --import
Hmm.. strictly speaking, Savannah admins don't maintain that file. I wonder how that file could be uploaded to ftp.gnu.org; what do -email is unavailable- say? On GPG keys stored in users' preferences: first, as far as I know we don't run any cron jobs (Bob will correct me if I'm wrong); then, we currently don't parse those GPG keys. once I looked through them, and I found out that people uploaded quite various things as their GPG keys, including public SSH keys, GPG key fingerprints, whole public keyrings and even their private GPG keys.
The report was "wget-1.20.1.tar.gz signed with expired key" and had the following message:
I was rather surprised to see that the key used to sign a release on December 26 expired on July 12. Is it legit? $ curl https://ftp.gnu.org/gnu/gnu-keyring.gpg | gpg --import ... $ gpg --verify wget-1.20.1.tar.gz.sig gpg: WARNING: using insecure memory! gpg: please see http://www.gnupg.org/faq.html for more information gpg: Signature made December 26, 2018 at 08:12:51 PM UTC using RSA key ID A2670428 gpg: Good signature from "Tim Rühsen <tim.ruehsen@gmx.de>" gpg: Note: This key has expired! Primary key fingerprint: 1CB2 7DBC 9861 4B2D 5841 646D 0830 2DB6 A267 0428 $ gpg --list-key A2670428 gpg: WARNING: using insecure memory! gpg: please see http://www.gnupg.org/faq.html for more information pub 4096R/A2670428 2014-06-26 [expired: 2018-06-12] uid Tim Rühsen <tim.ruehsen@gmx.de>
So my key wasn't expired since 2016 but since 2018-06-12. A possible quick solution would be to have a crontab daily/weekly checking for soon-to-expire keys and to inform those people via an automated email (including steps on how to update expiration date and how to upload to key servers and how to update to Savannah). Then a second crontab could check all GPG keys on a public key server. And download those keys whose expiration date has been changed (e.g. it could be that someone changed the expiration date from 'never' to a concrete future date).
Thanks for the report. A question about one detail. What was the bug report for wget that related to the gpg key stored at savannah being expired? I don't understand the relationship there. I agree with what you have said. I don't know what the best solution for it would be however.
Manually refreshing/updating one's GPG key at Savannah is a manual process and easily forgotten. I wonder if there is any security impact to automatically fetch expired GPG keys from a public keyserver. Given that the key itself didn't change and isn't revoked. E.g. my GPG key expires every 2 years. Shortly before it does I refresh the expire time and upload the key to the keyserver infrastructure. It is tedious to remember all the sites that need a manual update as well (like Savannah). It took a bug report against GNU Wget to update my key today - it was expired since 2016 !
(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)
Attach Files: Comment:
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Only logged-in users can vote.
Please enter the title of George Orwell's famous dystopian book (it's a date):
Follow 2 latest changes.
Copyright © 2023 Free Software Foundation, Inc. Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved. The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team. Source Code
Powered by Savane 3.11