{"thread":{"id":"56454","subject":"expired key in junio-gpg-pub","startedAt":"2021-09-07T18:12:55Z","lastAt":"2021-09-07T20:41:04Z","messageCount":7,"participants":["Jeff King","Konstantin Ryabitsev","Ævar Arnfjörð Bjarmason","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"434904","messageId":"YTerpXCxYx+f+8ws@coredump.intra.peff.net","threadId":"56454","inReplyTo":null,"subject":"expired key in junio-gpg-pub","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2021-09-07T18:12:53Z","receivedAt":"2021-09-07T18:12:55Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"It looks like your signing key is expired, and tag verification fails:\n\n $ mkdir /tmp/foo\n $ export GNUPGHOME=/tmp/foo\n $ git cat-file blob junio-gpg-pub | gpg --import\n gpg: WARNING: unsafe permissions on homedir '/tmp/foo'\n gpg: keybox '/tmp/foo/pubring.kbx' created\n gpg: key 20D04E5A713660A7: 27 signatures not checked due to missing keys\n gpg: /tmp/foo/trustdb.gpg: trustdb created\n gpg: key 20D04E5A713660A7: public key \"Junio C Hamano \" imported\n gpg: Total number processed: 1\n gpg: imported: 1\n gpg: no ultimately trusted keys found\n\n $ git tag -v v2.33.0\n object 225bc32a989d7a22fa6addafd4ce7dcd04675dbf\n type commit\n tag v2.33.0\n tagger Junio C Hamano 1629141357 -0700\n\n Git 2.33\n gpg: WARNING: unsafe permissions on homedir '/tmp/foo'\n gpg: Signature made Mon Aug 16 15:15:57 2021 EDT\n gpg: using RSA key E1F036B1FEE7221FC778ECEFB0B5E88696AFE6CB\n gpg: Good signature from \"Junio C Hamano \" [unknown]\n gpg: aka \"Junio C Hamano \" [unknown]\n gpg: aka \"Junio C Hamano \" [unknown]\n gpg: Note: This key has expired!\n Primary key fingerprint: 96E0 7AF2 5771 9559 80DA D100 20D0 4E5A 7136 60A7\n Subkey fingerprint: E1F0 36B1 FEE7 221F C778 ECEF B0B5 E886 96AF E6CB\n\n $ echo $?\n 1\n\nHave you extended the expiration on it? I wasn't able to find any\nupdates on the keyservers I checked. But regardless, we should probably\nship an updated one via the tag.\n\n-Peff\n"},{"id":"434906","messageId":"20210907182042.3ugoaicjt4e3h4fp@meerkat.local","threadId":"56454","inReplyTo":"YTerpXCxYx+f+8ws@coredump.intra.peff.net","subject":"Re: expired key in junio-gpg-pub","fromName":"Konstantin Ryabitsev","fromEmail":"konstantin@linuxfoundation.org","sentAt":"2021-09-07T18:20:42Z","receivedAt":"2021-09-07T18:20:48Z","isPatch":false,"sender":{"key":"konstantin@linuxfoundation.org","avatar":"https://gravatar.com/avatar/7cb8827c6de56e1bd2dea16508c6708aa43feed3bf3813bcdacecdf96ceadd79?d=mp&s=160"},"body":"On Tue, Sep 07, 2021 at 02:12:53PM -0400, Jeff King wrote:\n> Have you extended the expiration on it? I wasn't able to find any\n> updates on the keyservers I checked. But regardless, we should probably\n> ship an updated one via the tag.\n\nYou can get it from here:\nhttps://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/20D04E5A713660A7.asc\n\n-K\n"},{"id":"434911","messageId":"YTe77RPYavw9HAfZ@coredump.intra.peff.net","threadId":"56454","inReplyTo":"20210907182042.3ugoaicjt4e3h4fp@meerkat.local","subject":"Re: expired key in junio-gpg-pub","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2021-09-07T19:22:21Z","receivedAt":"2021-09-07T19:22:25Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Tue, Sep 07, 2021 at 02:20:42PM -0400, Konstantin Ryabitsev wrote:\n\n> On Tue, Sep 07, 2021 at 02:12:53PM -0400, Jeff King wrote:\n> > Have you extended the expiration on it? I wasn't able to find any\n> > updates on the keyservers I checked. But regardless, we should probably\n> > ship an updated one via the tag.\n> \n> You can get it from here:\n> https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/20D04E5A713660A7.asc\n\nThanks! That fixes my problem. I do think we should update the in-repo\ntag. :)\n\n-Peff\n"},{"id":"434918","messageId":"87bl54kw1d.fsf@evledraar.gmail.com","threadId":"56454","inReplyTo":"YTe77RPYavw9HAfZ@coredump.intra.peff.net","subject":"Re: expired key in junio-gpg-pub","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2021-09-07T19:44:46Z","receivedAt":"2021-09-07T19:47:31Z","isPatch":false,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"\nOn Tue, Sep 07 2021, Jeff King wrote:\n\n> On Tue, Sep 07, 2021 at 02:20:42PM -0400, Konstantin Ryabitsev wrote:\n>\n>> On Tue, Sep 07, 2021 at 02:12:53PM -0400, Jeff King wrote:\n>> > Have you extended the expiration on it? I wasn't able to find any\n>> > updates on the keyservers I checked. But regardless, we should probably\n>> > ship an updated one via the tag.\n>> \n>> You can get it from here:\n>> https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/20D04E5A713660A7.asc\n>\n> Thanks! That fixes my problem. I do think we should update the in-repo\n> tag. :)\n\nNote though that when the in-repo tag is updated anyone fetching it will\nneed to update with --force, and anyone doing fetches of git.git will\nsee a non-zero exit code on their pulls and fetches without that.\n\nThis is due to my 0bc8d71b99e (fetch: stop clobbering existing tags\nwithout --force, 2018-08-31). That change was meant to error on pretty\nmuch this exact scenario...\n\nBut to be more gentle does anything rely on that specific name, or would\nit perhaps be better to push a new junio-gpg-pub-2021?\n"},{"id":"434919","messageId":"xmqqbl54b1zn.fsf@gitster.g","threadId":"56454","inReplyTo":"YTerpXCxYx+f+8ws@coredump.intra.peff.net","subject":"Re: expired key in junio-gpg-pub","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2021-09-07T19:49:00Z","receivedAt":"2021-09-07T19:49:06Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Jeff King writes:\n\n> It looks like your signing key is expired, and tag verification fails:\n>\n> $ mkdir /tmp/foo\n> $ export GNUPGHOME=/tmp/foo\n> $ git cat-file blob junio-gpg-pub | gpg --import\n> gpg: WARNING: unsafe permissions on homedir '/tmp/foo'\n> gpg: keybox '/tmp/foo/pubring.kbx' created\n> gpg: key 20D04E5A713660A7: 27 signatures not checked due to missing keys\n> gpg: /tmp/foo/trustdb.gpg: trustdb created\n> gpg: key 20D04E5A713660A7: public key \"Junio C Hamano \" imported\n> gpg: Total number processed: 1\n> gpg: imported: 1\n> gpg: no ultimately trusted keys found\n>\n> $ git tag -v v2.33.0\n> object 225bc32a989d7a22fa6addafd4ce7dcd04675dbf\n> type commit\n> tag v2.33.0\n> tagger Junio C Hamano 1629141357 -0700\n>\n> Git 2.33\n> gpg: WARNING: unsafe permissions on homedir '/tmp/foo'\n> gpg: Signature made Mon Aug 16 15:15:57 2021 EDT\n> gpg: using RSA key E1F036B1FEE7221FC778ECEFB0B5E88696AFE6CB\n> gpg: Good signature from \"Junio C Hamano \" [unknown]\n> gpg: aka \"Junio C Hamano \" [unknown]\n> gpg: aka \"Junio C Hamano \" [unknown]\n> gpg: Note: This key has expired!\n> Primary key fingerprint: 96E0 7AF2 5771 9559 80DA D100 20D0 4E5A 7136 60A7\n> Subkey fingerprint: E1F0 36B1 FEE7 221F C778 ECEF B0B5 E886 96AF E6CB\n>\n> $ echo $?\n> 1\n>\n> Have you extended the expiration on it? I wasn't able to find any\n> updates on the keyservers I checked. But regardless, we should probably\n> ship an updated one via the tag.\n\nI am reasonably sure that I've done update with pgp.mit.edu when I\nrefreshed the expiration last time, but apparently I didn't update\nthe in-tree copy. I doubt that it is a good practice to ship the\npublic key used to sign things in the repository in the repository\nitself, but if are not dropping the tag, I agree I should keep it up\nto date.\n\nThanks.\n\n\n"},{"id":"434932","messageId":"YTfL/eLKOiJdpH1c@coredump.intra.peff.net","threadId":"56454","inReplyTo":"xmqqbl54b1zn.fsf@gitster.g","subject":"Re: expired key in junio-gpg-pub","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2021-09-07T20:30:53Z","receivedAt":"2021-09-07T20:30:57Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Tue, Sep 07, 2021 at 12:49:00PM -0700, Junio C Hamano wrote:\n\n> > Have you extended the expiration on it? I wasn't able to find any\n> > updates on the keyservers I checked. But regardless, we should probably\n> > ship an updated one via the tag.\n> \n> I am reasonably sure that I've done update with pgp.mit.edu when I\n> refreshed the expiration last time, but apparently I didn't update\n> the in-tree copy. I doubt that it is a good practice to ship the\n> public key used to sign things in the repository in the repository\n> itself, but if are not dropping the tag, I agree I should keep it up\n> to date.\n\nYeah, I agree that the is potentially problematic: it's a circular\ndependency, plus updating tags is awkward, per Ævar's other message.\n\nPerhaps we should replace it with instructions on getting the key?\n\nI tried a blind \"gpg --recv-keys\" and came up with an old version (\"not\nchanged\" according to GPG). That hits keys.openpgp.org by default. A lot\nof the keyservers used to peer with each other, but I've heard that\nthere's less of that these days due to key-spamming attacks (but it's\nnot really something I keep up with).\n\nI admit that I never actually verify git.git's tags anyway (why would I?\nI'm fetching unsigned branch tips from your repo constantly anyway). I\nonly noticed because I was looking fora bug in \"git tag -verify\n--format\". :)\n\n-Peff\n"},{"id":"434934","messageId":"20210907204100.ptapvn4wrqn3qrzq@meerkat.local","threadId":"56454","inReplyTo":"YTfL/eLKOiJdpH1c@coredump.intra.peff.net","subject":"Re: expired key in junio-gpg-pub","fromName":"Konstantin Ryabitsev","fromEmail":"konstantin@linuxfoundation.org","sentAt":"2021-09-07T20:41:00Z","receivedAt":"2021-09-07T20:41:04Z","isPatch":false,"sender":{"key":"konstantin@linuxfoundation.org","avatar":"https://gravatar.com/avatar/7cb8827c6de56e1bd2dea16508c6708aa43feed3bf3813bcdacecdf96ceadd79?d=mp&s=160"},"body":"On Tue, Sep 07, 2021 at 04:30:53PM -0400, Jeff King wrote:\n> > I am reasonably sure that I've done update with pgp.mit.edu when I\n> > refreshed the expiration last time, but apparently I didn't update\n> > the in-tree copy. I doubt that it is a good practice to ship the\n> > public key used to sign things in the repository in the repository\n> > itself, but if are not dropping the tag, I agree I should keep it up\n> > to date.\n> \n> Yeah, I agree that the is potentially problematic: it's a circular\n> dependency, plus updating tags is awkward, per Ævar's other message.\n\nIt's not really as circular as it would appear at the outset -- at least not\nany more circular than any other situation, in reality. E.g. my favourite\nexample:\n\n1. you should verify the checksum of your distro's ISO before installing it\n2. the checksum is available over a trusted https:// connection\n3. the trust anchors for that https verification come with the browser package\n4. which was installed from the ISO you downloaded the last time\n5. goto 1\n\nBootstrapping trust is a hard problem and no matter how you look at it, at\nsome point you have to just close your eyes and hope that the adversary isn't\none step ahead of you.\n\nSo, I'd say putting the key into the git repository itself is fine. After all,\nit gets imported into the local PGP keyring on someone's workstation, where it\ngets a separate life of its own.\n\n-K\n"}]}