taskSavannah Administration - Tasks: task #15140, Automatically updating GPG keys...


task #15140: Automatically updating GPG keys when expired

Submitter:  Tim Ruehsen <rockdaboot>
Submitted:  Thu 03 Jan 2019 09:13:43 AM UTC
Should Start On:  Wed 02 Jan 2019 11:00:00 PM UTC Should be Finished on:  Wed 02 Jan 2019 11:00:00 PM UTC
Category:  System Priority:  * 5 - Normal
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
* Mandatory Fields

Add a New Comment Rich Markup

Jump to the original submission

  Spam posted by _154060
Tue 02 Jul 2019 11:34:03 AM UTC, comment #6: 

Keyservers go out of fashion.  I think we could setup a cron job to notify people whose keys expire, after we upgrade to GnuPG 2.2.

BTW, should we do anything about revocations?

Ineiev <ineiev>
Site Administrator
Sat 02 Feb 2019 06:24:08 AM UTC, comment #5: 

> I wonder if it would be possible to update keys from the key servers automatically.

Before we do such things, it would be reasonable if we run GnuPG 2.2 on frontend0 (if we don't, the feature won't work with ECC), and that means upgrading the operating system.

Ineiev <ineiev>
Site Administrator
Mon 07 Jan 2019 06:59:36 AM UTC, comment #4: 

Thank you for filling in the details of how the warning came about.  I wonder if it would be possible to update keys from the key servers automatically.

Bob Proulx <rwp>
Site Administrator
Sat 05 Jan 2019 06:10:25 PM UTC, comment #3: 

> curl https://ftp.gnu.org/gnu/gnu-keyring.gpg | gpg --import

Hmm.. strictly speaking, Savannah admins don't maintain that file. I wonder how that file could be uploaded to ftp.gnu.org; what do -email is unavailable- say?

On GPG keys stored in users' preferences: first, as far as I know we don't run any cron jobs (Bob will correct me if I'm wrong); then, we currently don't parse those GPG keys. once I looked through them, and I found out that people uploaded quite various things as their GPG keys, including public SSH keys, GPG key fingerprints, whole public keyrings and even their private GPG keys.

Ineiev <ineiev>
Site Administrator
Fri 04 Jan 2019 11:32:39 AM UTC, comment #2: 

The report was "wget-1.20.1.tar.gz signed with expired key" and had the following message:

I was rather surprised to see that the key used to sign a release on December 26 expired on July 12. Is it legit?

$ curl https://ftp.gnu.org/gnu/gnu-keyring.gpg | gpg --import
$ gpg --verify wget-1.20.1.tar.gz.sig
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information
gpg: Signature made December 26, 2018 at 08:12:51 PM UTC using RSA key ID A2670428
gpg: Good signature from "Tim Rühsen <tim.ruehsen@gmx.de>"
gpg: Note: This key has expired!
Primary key fingerprint: 1CB2 7DBC 9861 4B2D 5841  646D 0830 2DB6 A267 0428

$ gpg --list-key A2670428
gpg: WARNING: using insecure memory!
gpg: please see http://www.gnupg.org/faq.html for more information
pub   4096R/A2670428 2014-06-26 [expired: 2018-06-12]
uid                  Tim Rühsen <tim.ruehsen@gmx.de>

So my key wasn't expired since 2016 but since 2018-06-12.

A possible quick solution would be to have a crontab daily/weekly checking for soon-to-expire keys and to inform those people via an automated email (including steps on how to update expiration date and how to upload to key servers and how to update to Savannah).

Then a second crontab could check all GPG keys on a public key server. And download those keys whose expiration date has been changed (e.g. it could be that someone changed the expiration date from 'never' to a concrete future date).

Tim Ruehsen <rockdaboot>
Fri 04 Jan 2019 04:54:31 AM UTC, comment #1: 

Thanks for the report.  A question about one detail.  What was the bug report for wget that related to the gpg key stored at savannah being expired?  I don't understand the relationship there.

I agree with what you have said.  I don't know what the best solution for it would be however.

Bob Proulx <rwp>
Site Administrator
Thu 03 Jan 2019 09:13:43 AM UTC, original submission:  

Manually refreshing/updating one's GPG key at Savannah is a manual process and easily forgotten.
I wonder if there is any security impact to automatically fetch expired GPG keys from a public keyserver. Given that the key itself didn't change and isn't revoked.

E.g. my GPG key expires every 2 years. Shortly before it does I refresh the expire time and upload the key to the keyserver infrastructure. It is tedious to remember all the sites that need a manual update as well (like Savannah). It took a bug report against GNU Wget to update my key today - it was expired since 2016 !

Tim Ruehsen <rockdaboot>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by _154060 (Posted a comment)
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by rockdaboot (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-01-09 ineiev CategoryApproved Projects to be Reviewed System
    2019-01-04 rwp CategoryNone Approved Projects to be Reviewed

    Back to the top

    Powered by Savane 3.12