{"thread":{"id":"28919","subject":"Verifying recent tags in git.git","startedAt":"2011-11-12T16:35:31Z","lastAt":"2011-11-12T19:55:43Z","messageCount":2,"participants":["Ramsay Jones","Stefan Naewe"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"179357","messageId":"4EBEA053.6040109@ramsay1.demon.co.uk","threadId":"28919","inReplyTo":null,"subject":"Verifying recent tags in git.git","fromName":"Ramsay Jones","fromEmail":"ramsay@ramsay1.demon.co.uk","sentAt":"2011-11-12T16:35:31Z","receivedAt":"2011-11-12T16:35:31Z","isPatch":false,"sender":{"key":"ramsay@ramsayjones.plus.com","avatar":"https://avatars.githubusercontent.com/u/33702710?v=4"},"body":"Hi Junio,\n\nI noticed that the v1.7.8-rc1 tag took about 24 hours to appear in the\nkernel.org (and repo.or.cz) repository after you announced it and actually\npushed the branch out.\n\nSo, unusually, I decided to verify the tag when it did appear. However, it\ndid not verify! It seems that ever since v1.7.7 (ie v1.7.7.x and v1.7.8-rcx),\nyou have been signing the release tags with a new key-pair. (I assume that\nyou generated new keys at the beginning of October for use on kernel.org)\nviz:\n\n    ramsay (master)$ git tag -v v1.7.7\n    object 703f05ad5835cff92b12c29aecf8d724c8c847e2\n    type commit\n    tag v1.7.7\n    tagger Junio C Hamano <gitster@pobox.com> 1317417666 -0700\n    \n    Git 1.7.7\n    gpg: Signature made Fri Sep 30 22:21:06 2011 GMTDT using DSA key ID F3119B9A\n    gpg: Good signature from \"Junio C Hamano <gitster@pobox.com>\"\n    gpg:                 aka \"Junio C Hamano <junkio@cox.net>\"\n    gpg:                 aka \"[jpeg image of size 1513]\"\n    gpg:                 aka \"Junio C Hamano <jch@google.com>\"\n    gpg:                 aka \"Junio C Hamano <junio@pobox.com>\"\n    gpg: WARNING: This key is not certified with a trusted signature!\n    gpg:          There is no indication that the signature belongs to the owner.\n    Primary key fingerprint: 3565 2A26 2040 E066 C9A7  4A7D C0C6 D9A4 F311 9B9A\n\n    ramsay (master)$ git tag -v v1.7.8-rc1\n    object 4cb6764227173a6483edbdad09121651bc0b01c3\n    type commit\n    tag v1.7.8-rc1\n    tagger Junio C Hamano <gitster@pobox.com> 1320713324 -0800\n    \n    Git 1.7.8-rc1\n    gpg: Signature made Tue Nov  8 00:48:44 2011 GMTST using RSA key ID 96AFE6CB\n    gpg: Can't check signature: public key not found\n    error: could not verify the tag 'v1.7.8-rc1'\n    \n    ramsay (master)$\n\nNote the key ID 96AFE6CB.\n\nAre you planning to create an junio-gpg-pub-v2 tag? (or are you making it\navailable from a keyserver?)\n\nIf I have missed an announcement on this, then sorry for the noise!\n\nATB,\nRamsay Jones\n"},{"id":"179360","messageId":"loom.20111112T204519-725@post.gmane.org","threadId":"28919","inReplyTo":"4EBEA053.6040109@ramsay1.demon.co.uk","subject":"Re: Verifying recent tags in git.git","fromName":"Stefan Naewe","fromEmail":"stefan.naewe@gmail.com","sentAt":"2011-11-12T19:55:43Z","receivedAt":"2011-11-12T19:55:43Z","isPatch":false,"sender":{"key":"stefan.naewe@gmail.com","avatar":"https://avatars.githubusercontent.com/u/4468?v=4"},"body":"Ramsay Jones <ramsay <at> ramsay1.demon.co.uk> writes:\n\n> \n> Hi Junio,\n> \n> I noticed that the v1.7.8-rc1 tag took about 24 hours to appear in the\n> kernel.org (and repo.or.cz) repository after you announced it and actually\n> pushed the branch out.\n> \n> [...]\n> Note the key ID 96AFE6CB.\n> \n> Are you planning to create an junio-gpg-pub-v2 tag? (or are you making it\n> available from a keyserver?)\n\nWhat about this:\n\n  http://pgp.mit.edu:11371/pks/lookup?search=0x96AFE6CB&op=index&fingerprint=on\n\nStefan\n"}]}