public inbox for goredo-devel@lists.stargrave.org
Atom feed
From: "Sergey Matveev (stargrave=stargrave.org) via" <goredo-devel@lists.stargrave.org>
To: goredo-devel@lists.stargrave.org
Cc: hendry@iki•fi
Subject: Re: Authenticating the tarballs and website
Date: Sat, 17 Oct 2026 10:02:32 +0300 [thread overview]
Message-ID: <atMdiOjqqUxYhQU3@stargrave.org> (raw)
In-Reply-To: <DM6NBWBCW5EN.29HPS0MMGSVZZ@ser1.net>
[-- Attachment #1: Type: text/plain, Size: 1839 bytes --]
*** "Sean E. Russell" [2026-10-16 16:20]:
>Sergey, your PGP key in the public keystores does not include anything but your
>self-sign. You might want to refresh it, especially if you have a signature from
>Stallman.
Ooops, indeed everything is missing on two keyservers I checked.
According to https://keys.openpgp.org/about/faq/ third-party signatures
are not included by default because of spam. Indeed I remember that there
were serious issues with that. Well... that means that keyservers are
useless now for full public keys distribution. Completely forgot about that.
So the only option is to download it via WKD (which URL is included in
my mail headers): http://openpgpkey.stargrave.org/.well-known/openpgpkey/stargrave.org/hu/s8kd45yyt8ymu6uttefkjkngyagsui5x.asc
Actually WKD requires the use of HTTPS, but one suppose to have common
trust anchors in that world? In my opinion that was very short-sighted
decision.
>Sergey, I can't verify your tarball sig with openssh 10.6p1, which is what Arch
>users have. I get an unknown or unsupported key type. If your sigs require a newer
>ssh than that, they won't be useful for software distributed through AUR for now.
My bad, I forgot to re-sign all tarballs with the latest OpenSSH key,
which was updated 2026-10-09 from ssh-mldsa44-ed25519@openssh•com to
ssh-mldsa44-ed25519 algorithm. Currently it was not included in any
tarballs, as no releases were made since that time. Just reuploaded all
*.sig files. OpenSSH 10.6p1 is exactly the minimal version to check them.
That key can be got either from Git repository, or
http://www.goredo.stargrave.org/PUBKEY-SSH.pub
http://www.goredo.stargrave.org/PUBKEY-SSH.pub.asc
(as described on http://www.goredo.stargrave.org/Integrity.html)
--
* Origin: Stargrave's homepage http://www.stargrave.org/
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 265 bytes --]
prev parent reply other threads:[~2026-10-17 7:02 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-13 16:02 [PATCH] REDO_SHELL sets which shell goredo uses ser.goredo=ser1.net via
2026-10-13 16:02 ` [PATCH] REDO_SHELL sets which shell goredo uses. Some OSes change which shell /bin/sh points to; on Arch, it's bash. On Debian (on some forks, at least), it's dash. These shells are incompatible, esp about topics like variable expansion. With REDO_SHELL, users can set which shell goredo forks and ensure builds run ser.goredo=ser1.net via
2026-10-14 14:05 ` [PATCH] REDO_SHELL sets which shell goredo uses Sergey Matveev (stargrave=stargrave.org) via
2026-10-14 16:08 ` "Sean E. Russell" (ser.goredo=ser1.net) via
2026-10-16 8:43 ` Sergey Matveev (stargrave=stargrave.org) via
2026-10-16 9:37 ` Authenticating the tarballs and website Sergey Matveev (stargrave=stargrave.org) via
2026-10-16 23:20 ` "Sean E. Russell" (ser=ser1.net) via
2026-10-17 7:02 ` Sergey Matveev (stargrave=stargrave.org) via [this message]