GNU bug report logs - #20298
Missing public key for 24.5

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 20298 in the body.
You can then email your comments to 20298 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
To: bug-gnu-emacs <at> gnu.org
Subject: Missing public key for 24.5
Date: Fri, 10 Apr 2015 16:25:45 -0400

Hi,

I tried to verify the new (emacs-24.5) release but the public key that
signed the file is missing in the gnu keyring. The 24.4 had the same
problem (the signature for 24.4 belonged to a @gnu.org address. This
one belongs to a gmail address (Nicolas Petton
<petton.nicolas <at> gmail.com>, see below).)

The file:
https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz

The signature:
https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz.sig

The keyring:
https://ftp.gnu.org/gnu/gnu-keyring.gpg

The output:
$ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.4.tar.xz.sig
gpg: Signature made Mon 20 Oct 2014 02:58:21 PM EDT
gpg:                using RSA key 0x6592E9A3A0B0F199
gpg: Can't check signature: public key not found

$ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.5.tar.xz.sig
gpg: Signature made Fri 10 Apr 2015 12:57:02 PM EDT
gpg:                using RSA key 0x233587A47C207910
gpg: Can't check signature: public key not found

The output I was expecting was along the lines of:
gpg: Good signature from .....

Thanks,
Mehmet.

Message #8 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Monnier <monnier <at> IRO.UMontreal.CA>
To: Nicolas Petton <nicolas <at> petton.fr>
Cc: 20298 <at> debbugs.gnu.org, Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Subject: Re: bug#20298: Missing public key for 24.5
Date: Sat, 11 Apr 2015 10:07:51 -0400

> I have updated gnu-keyring.gpg locally on my computer, but unfortunately
> I don't know how to upload it to the FTP server.  I don't think I have
> write access.

Indeed, I'd expect that access to this is more strictly controlled.
I think you'll need to contact the sysadmins at the FSF (maybe opening
a ticket on savannah is a good way to do that).

> Stefan, do you know how I should proceed to get my pubkey added to this
> keyring?

I think it should have been updated "automatically" when they gave you
access, so it's probably an oversight on the part of the one who gave
you access.  If you still have his/her email, you might like to contact
him/her directly.


        Stefan

Message #11 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Nicolas Petton <nicolas <at> petton.fr>
To: Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Cc: 20298 <at> debbugs.gnu.org
Subject: Re: bug#20298: Missing public key for 24.5
Date: Sat, 11 Apr 2015 12:57:17 +0200

[Message part 1 (text/plain, inline)]

Mehmet Atif Ergun writes:

> Hi,
>
> I tried to verify the new (emacs-24.5) release but the public key that
> signed the file is missing in the gnu keyring. The 24.4 had the same
> problem (the signature for 24.4 belonged to a @gnu.org address. This
> one belongs to a gmail address (Nicolas Petton
> <petton.nicolas <at> gmail.com>, see below).)
>
> The file:
> https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz
>
> The signature:
> https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz.sig
>
> The keyring:
> https://ftp.gnu.org/gnu/gnu-keyring.gpg
>
> The output:
> $ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.4.tar.xz.sig
> gpg: Signature made Mon 20 Oct 2014 02:58:21 PM EDT
> gpg:                using RSA key 0x6592E9A3A0B0F199
> gpg: Can't check signature: public key not found
>
> $ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.5.tar.xz.sig
> gpg: Signature made Fri 10 Apr 2015 12:57:02 PM EDT
> gpg:                using RSA key 0x233587A47C207910
> gpg: Can't check signature: public key not found
>
> The output I was expecting was along the lines of:
> gpg: Good signature from .....

I'll try to see if I have the access rights to update the keyring with
my pubkey.

Nico

[signature.asc (application/pgp-signature, inline)]

Message #14 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Nicolas Petton <nicolas <at> petton.fr>
To: Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Cc: 20298 <at> debbugs.gnu.org, Stefan Monnier <monnier <at> iro.umontreal.ca>
Subject: Re: bug#20298: Missing public key for 24.5
Date: Sat, 11 Apr 2015 13:33:59 +0200

[Message part 1 (text/plain, inline)]

Mehmet Atif Ergun writes:

> Hi,
>
> I tried to verify the new (emacs-24.5) release but the public key that
> signed the file is missing in the gnu keyring. The 24.4 had the same
> problem (the signature for 24.4 belonged to a @gnu.org address. This
> one belongs to a gmail address (Nicolas Petton
> <petton.nicolas <at> gmail.com>, see below).)
>
> The file:
> https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz
>
> The signature:
> https://ftp.gnu.org/gnu/emacs/emacs-24.5.tar.xz.sig
>
> The keyring:
> https://ftp.gnu.org/gnu/gnu-keyring.gpg

I have updated gnu-keyring.gpg locally on my computer, but unfortunately
I don't know how to upload it to the FTP server. I don't think I have
write access.

Stefan, do you know how I should proceed to get my pubkey added to this
keyring?

Nico
-- 
Nicolas Petton
http://nicolas-petton.fr

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
To: Stefan Monnier <monnier <at> iro.umontreal.ca>
Cc: Nicolas Petton <nicolas <at> petton.fr>, 20298 <at> debbugs.gnu.org
Subject: Re: bug#20298: Missing public key for 24.5
Date: Sat, 11 Apr 2015 13:52:57 -0400

[Message part 1 (text/plain, inline)]

Hi,

Something like this seems to have happened before. Does this help at all:
http://lists.gnu.org/archive/html/bug-gnu-emacs/2012-04/msg00917.html

Thanks,
Mehmet.
On Apr 11, 2015 10:07 AM, "Stefan Monnier" <monnier <at> iro.umontreal.ca> wrote:

> > I have updated gnu-keyring.gpg locally on my computer, but unfortunately
> > I don't know how to upload it to the FTP server.  I don't think I have
> > write access.
>
> Indeed, I'd expect that access to this is more strictly controlled.
> I think you'll need to contact the sysadmins at the FSF (maybe opening
> a ticket on savannah is a good way to do that).
>
> > Stefan, do you know how I should proceed to get my pubkey added to this
> > keyring?
>
> I think it should have been updated "automatically" when they gave you
> access, so it's probably an oversight on the part of the one who gave
> you access.  If you still have his/her email, you might like to contact
> him/her directly.
>
>
>         Stefan
>

[Message part 2 (text/html, inline)]

Message #20 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Nicolas Petton <nicolas <at> petton.fr>
To: Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Cc: Nicolas Petton <nicolas <at> petton.fr>, 20298 <at> debbugs.gnu.org,
 Stefan Monnier <monnier <at> iro.umontreal.ca>
Subject: Re: bug#20298: Missing public key for 24.5
Date: Sat, 11 Apr 2015 20:36:44 +0200

[Message part 1 (text/plain, inline)]

Mehmet Atif Ergun writes:

> Hi,
>
> Something like this seems to have happened before. Does this help at all:
> http://lists.gnu.org/archive/html/bug-gnu-emacs/2012-04/msg00917.html
>

I sent an email to the ftp admins.  I'm waiting for their answer.

Nico
-- 
Nicolas Petton
http://nicolas-petton.fr

[signature.asc (application/pgp-signature, inline)]

Message #23 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Cc: 20298 <at> debbugs.gnu.org
Subject: Re: bug#20298: Missing public key for 24.5
Date: Fri, 24 Apr 2015 15:14:36 -0400

Mehmet Atif Ergun wrote:

> I tried to verify the new (emacs-24.5) release but the public key that
> signed the file is missing in the gnu keyring. The 24.4 had the same
> problem (the signature for 24.4 belonged to a @gnu.org address.

Nobody here can do anything about that, it's a GNU sysadmin issue.

If you want to verify the signatures, both keys are available from
standard keyservers, eg pgp.mit.edu. Though since you have never met
either of us, you have no idea how trustworthy we are. :)

(I don't see what the value of a keyring that is stored on the same ftp
server as the file you want to download is. Especially since the process
for updating it, which should be automatic, seems to break a lot.)

Message #26 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
To: Glenn Morris <rgm <at> gnu.org>
Cc: 20298 <at> debbugs.gnu.org
Subject: Re: bug#20298: Missing public key for 24.5
Date: Fri, 24 Apr 2015 17:32:13 -0400

On Fri, Apr 24, 2015 at 3:14 PM, Glenn Morris <rgm <at> gnu.org> wrote:
>> I tried to verify the new (emacs-24.5) release but the public key that
>> signed the file is missing in the gnu keyring. The 24.4 had the same
>> problem (the signature for 24.4 belonged to a @gnu.org address.
>
> Nobody here can do anything about that, it's a GNU sysadmin issue.
>
> If you want to verify the signatures, both keys are available from
> standard keyservers, eg pgp.mit.edu. Though since you have never met
> either of us, you have no idea how trustworthy we are. :)
>
> (I don't see what the value of a keyring that is stored on the same ftp
> server as the file you want to download is. Especially since the process
> for updating it, which should be automatic, seems to break a lot.)


In that case, please remove the .sig files and the keyring file from
the server, along with the instructions on how to check the integrity
of the source code from the README file. :)

On a serious note, though, could you please forward the bug report to GNU
sysadmins so that this can be resolved? I do not know whom that would
be.

Thank you,
Mehmet.
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=20298

Message #29 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Monnier <monnier <at> IRO.UMontreal.CA>
To: Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Cc: Glenn Morris <rgm <at> gnu.org>, 20298 <at> debbugs.gnu.org
Subject: Re: bug#20298: Missing public key for 24.5
Date: Sat, 25 Apr 2015 10:33:01 -0400

> In that case, please remove the .sig files and the keyring file from
> the server, along with the instructions on how to check the integrity
> of the source code from the README file. :)

The sig files are useful, it's the keyring that's less valuable.

> On a serious note, though, could you please forward the bug report to GNU
> sysadmins so that this can be resolved?

We did it already a while ago, but the response time for such requests
is pretty bad.

>  I do not know whom that would be.

I think Nicolas sent it to ftp-admin <at> gnu.org, but you can also try to
open a ticket on savannah.gnu.org.


        Stefan

Message #32 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Nicolas Petton <nicolas <at> petton.fr>
To: Stefan Monnier <monnier <at> IRO.UMontreal.CA>
Cc: 20298 <at> debbugs.gnu.org, Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Subject: Re: bug#20298: Missing public key for 24.5
Date: Sat, 25 Apr 2015 16:36:54 +0200

[Message part 1 (text/plain, inline)]

Stefan Monnier writes:

>> In that case, please remove the .sig files and the keyring file from
>> the server, along with the instructions on how to check the integrity
>> of the source code from the README file. :)
>
> The sig files are useful, it's the keyring that's less valuable.
>
>> On a serious note, though, could you please forward the bug report to GNU
>> sysadmins so that this can be resolved?
>
> We did it already a while ago, but the response time for such requests
> is pretty bad.

Indeed, I asked them twice already.  Last time I had a request for them
they answered me but it took a bit of time, so I will just wait a bit
more.

Nico
-- 
Nicolas Petton
http://nicolas-petton.fr

[signature.asc (application/pgp-signature, inline)]

Message #35 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Richard Stallman <rms <at> gnu.org>
To: Glenn Morris <rgm <at> gnu.org>
Cc: 20298 <at> debbugs.gnu.org, mehmetaergun <at> gmail.com
Subject: Re: bug#20298: Missing public key for 24.5
Date: Sat, 25 Apr 2015 13:03:02 -0400

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

Would people please report such problems to sysadmin <at> gnu.org?

-- 
Dr Richard Stallman
President, Free Software Foundation
51 Franklin St
Boston MA 02110
USA
www.fsf.org  www.gnu.org
Skype: No way! See stallman.org/skype.html.

Message #38 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: Nicolas Petton <nicolas <at> petton.fr>
Cc: 20298 <at> debbugs.gnu.org, Stefan Monnier <monnier <at> IRO.UMontreal.CA>,
 Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Subject: Re: bug#20298: Missing public key for 24.5
Date: Sat, 25 Apr 2015 14:20:08 -0400

Nicolas Petton wrote:

> Indeed, I asked them twice already.  Last time I had a request for them
> they answered me but it took a bit of time, so I will just wait a bit
> more.

I don't know what you asked them, but when they reply please ask them to
review the whole system, not just add your key. Eg mine doesn't seem to
be there either, which implies the system has been busted for years.
I assume the file is supposed to be an automatically generated list of
everyone who can upload to ftp.gnu.org. If it's too much work to
maintain it, they might like to stop bothering and just update
ftp://ftp.gnu.org/README to refer to standard public key servers.

Message #41 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Nicolas Petton <nicolas <at> petton.fr>
To: rms <at> gnu.org
Cc: Glenn Morris <rgm <at> gnu.org>, 20298 <at> debbugs.gnu.org, mehmetaergun <at> gmail.com
Subject: Re: bug#20298: Missing public key for 24.5
Date: Sat, 25 Apr 2015 23:58:06 +0200

[Message part 1 (text/plain, inline)]

Richard Stallman writes:

> [[[ To any NSA and FBI agents reading my email: please consider    ]]]
> [[[ whether defending the US Constitution against all enemies,     ]]]
> [[[ foreign or domestic, requires you to follow Snowden's example. ]]]
>
> Would people please report such problems to sysadmin <at> gnu.org?

I will do that.

Cheers,
Nico
-- 
Nicolas Petton
http://nicolas-petton.fr

[signature.asc (application/pgp-signature, inline)]

Message #46 received at 20298-done <at> debbugs.gnu.org (full text, mbox):

From: Nicolas Petton <nicolas <at> petton.fr>
To: Glenn Morris <rgm <at> gnu.org>
Cc: 20298-done <at> debbugs.gnu.org, Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Subject: Re: bug#20298: Missing public key for 24.5
Date: Wed, 29 Apr 2015 15:25:51 +0200

[Message part 1 (text/plain, inline)]

Glenn Morris writes:

> Mehmet Atif Ergun wrote:
>
>> I tried to verify the new (emacs-24.5) release but the public key that
>> signed the file is missing in the gnu keyring. The 24.4 had the same
>> problem (the signature for 24.4 belonged to a @gnu.org address.
>
> Nobody here can do anything about that, it's a GNU sysadmin issue.

My key has been added to the keyring on the FTP server.  I'm closing
this issue.

Nico
-- 
Nicolas Petton
http://nicolas-petton.fr

[signature.asc (application/pgp-signature, inline)]

Message #49 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Monnier <monnier <at> iro.umontreal.ca>
To: 20298 <at> debbugs.gnu.org
Cc: nicolas <at> petton.fr, mehmetaergun <at> gmail.com
Subject: Re: bug#20298: Missing public key for 24.5
Date: Wed, 29 Apr 2015 10:13:57 -0400

> My key has been added to the keyring on the FTP server.  I'm closing
> this issue.

Thank you Nicolas,


        Stefan

Message #52 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: Nicolas Petton <nicolas <at> petton.fr>
Cc: 20298 <at> debbugs.gnu.org, Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Subject: Re: bug#20298: Missing public key for 24.5
Date: Wed, 29 Apr 2015 11:55:28 -0400

Nicolas Petton wrote:

> My key has been added to the keyring on the FTP server.

Have you verified that?
Because it's not in the version of the file I just now downloaded.

File:gnu-keyring.gpg 1032 KB     04/29/2015  03:22:00 PM

Message #55 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Nicolas Petton <nicolas <at> petton.fr>
To: Glenn Morris <rgm <at> gnu.org>
Cc: Nicolas Petton <nicolas <at> petton.fr>, 20298 <at> debbugs.gnu.org,
 20298-reopen <at> debbugs.gnu.org, Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Subject: Re: bug#20298: Missing public key for 24.5
Date: Wed, 29 Apr 2015 18:02:53 +0200

[Message part 1 (text/plain, inline)]

Glenn Morris writes:

> Nicolas Petton wrote:
>
>> My key has been added to the keyring on the FTP server.
>
> Have you verified that?
> Because it's not in the version of the file I just now downloaded.

No I haven't.  I naively thought that it was true when a GNU sysadmin
told me that it had just been added.

I'll recontact them then.

Nico
-- 
Nicolas Petton
http://nicolas-petton.fr

[signature.asc (application/pgp-signature, inline)]

Message #60 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: Nicolas Petton <nicolas <at> petton.fr>
Cc: 20298 <at> debbugs.gnu.org, Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Subject: Re: bug#20298: Missing public key for 24.5
Date: Wed, 29 Apr 2015 13:02:49 -0400

Maybe it will appear tomorrow, or the next time some cron job runs...

Message #65 received at 20298 <at> debbugs.gnu.org (full text, mbox):

From: npostavs <at> users.sourceforge.net
To: Nicolas Petton <nicolas <at> petton.fr>
Cc: Glenn Morris <rgm <at> gnu.org>, 20298 <at> debbugs.gnu.org,
 20298-reopen <at> debbugs.gnu.org, Mehmet Atif Ergun <mehmetaergun <at> gmail.com>
Subject: Re: bug#20298: Missing public key for 24.5
Date: Tue, 09 Aug 2016 20:20:29 -0400

tags 20298 fixed
close 20298 
quit

Nicolas Petton <nicolas <at> petton.fr> writes:

> Glenn Morris writes:
>
>> Nicolas Petton wrote:
>>
>>> My key has been added to the keyring on the FTP server.
>>
>> Have you verified that?
>> Because it's not in the version of the file I just now downloaded.
>
> No I haven't.  I naively thought that it was true when a GNU sysadmin
> told me that it had just been added.
>

It's there now:

$ gpg --verify --keyring ./gnu-keyring.gpg emacs-24.5.tar.xz.sig 
gpg: assuming signed data in 'emacs-24.5.tar.xz'
gpg: Signature made Fri 10 Apr 2015 12:57:02 PM EDT using RSA key ID 7C207910
gpg: Good signature from "Nicolas Petton <petton.nicolas <at> gmail.com>" [unknown]
gpg:                 aka "Nicolas Petton <nicolas <at> petton.fr>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 28D3 BED8 51FD F3AB 57FE  F93C 2335 87A4 7C20 7910

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.