[Xenomai] Gpg signatures of releases

[Xenomai] Gpg signatures of releases

[Leopold Palomo-Avellaneda]

Hi,

who sig 

http://download.gna.org/xenomai/stable/latest/*.sig

?


Leopold


-- 
--
Linux User 152692     GPG: 05F4A7A949A2D9AA
Catalonia
-------------------------------------
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing in e-mail?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part.
URL: <http://xenomai.org/pipermail/xenomai/attachments/20150601/d243f192/attachment.sig>

Re: [Xenomai] Gpg signatures of releases

[Paul]

On Sunday 31 May 2015, Leopold Palomo-Avellaneda wrote:
> who sig
>
> http://download.gna.org/xenomai/stable/latest/*.sig

Perhaps this will answer your question: 
https://www.gnupg.org/download/integrity_check.html

The *.sig file helps to confirm that the associated tarball has not been 
tampered with.

Re: [Xenomai] Gpg signatures of releases

[Gilles Chanteperdrix]

On Mon, Jun 01, 2015 at 12:11:03AM +0200, Leopold Palomo-Avellaneda wrote:
> Hi,
> 
> who sig 
> 
> http://download.gna.org/xenomai/stable/latest/*.sig
> 
> ?

I do. There used to be a readme file that said so, but it seems it
is no longer displayed by gna. In any case, if you go to the gna
interface you should find the keys of all the project members,
including mine (in fact, gna quarantines an upload if it is not
signed by a project member, or at least is used to). I use the same
key to sign that mail.

-- 
					    Gilles.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 811 bytes
Desc: not available
URL: <http://xenomai.org/pipermail/xenomai/attachments/20150601/695395ef/attachment.sig>

Re: [Xenomai] Gpg signatures of releases

[Leopold Palomo-Avellaneda]

El Dilluns, 1 de juny de 2015, a les 12:17:06, Gilles Chanteperdrix va 
escriure:
> On Mon, Jun 01, 2015 at 12:11:03AM +0200, Leopold Palomo-Avellaneda wrote:
> > Hi,
> > 
> > who sig
> > 
> > http://download.gna.org/xenomai/stable/latest/*.sig
> > 
> > ?
> 
> I do. There used to be a readme file that said so, but it seems it
> is no longer displayed by gna. In any case, if you go to the gna
> interface you should find the keys of all the project members,
> including mine (in fact, gna quarantines an upload if it is not
> signed by a project member, or at least is used to). I use the same
> key to sign that mail.

When I try to download the keyring I get a 0 bytes long file from here:

http://gna.org/project/memberlist-gpgkeys.php?group=xenomai

I found that the file was signed by this key with this id A9BF7DBA,
but I have not found who is the proprietary.

gpg: using character set `utf-8'
:signature packet: algo 17, keyid 1A972013A9BF7DBA
	version 3, created 1411642226, md5len 5, sigclass 0x00
	digest algo 2, begin of digest 95 30
	data: [158 bits]
	data: [158 bits]
gpg: Nombre total processat: 0

Any idea?

Leopold


-- 
--
Linux User 152692     GPG: 05F4A7A949A2D9AA
Catalonia
-------------------------------------
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing in e-mail?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part.
URL: <http://xenomai.org/pipermail/xenomai/attachments/20150601/255dfe28/attachment.sig>

Re: [Xenomai] Gpg signatures of releases

[Gilles Chanteperdrix]

On Mon, Jun 01, 2015 at 10:52:27PM +0200, Leopold Palomo-Avellaneda wrote:
> El Dilluns, 1 de juny de 2015, a les 12:17:06, Gilles Chanteperdrix va 
> escriure:
> > On Mon, Jun 01, 2015 at 12:11:03AM +0200, Leopold Palomo-Avellaneda wrote:
> > > Hi,
> > > 
> > > who sig
> > > 
> > > http://download.gna.org/xenomai/stable/latest/*.sig
> > > 
> > > ?
> > 
> > I do. There used to be a readme file that said so, but it seems it
> > is no longer displayed by gna. In any case, if you go to the gna
> > interface you should find the keys of all the project members,
> > including mine (in fact, gna quarantines an upload if it is not
> > signed by a project member, or at least is used to). I use the same
> > key to sign that mail.
> 
> When I try to download the keyring I get a 0 bytes long file from here:
> 
> http://gna.org/project/memberlist-gpgkeys.php?group=xenomai
> 
> I found that the file was signed by this key with this id A9BF7DBA,
> but I have not found who is the proprietary.
> 
> gpg: using character set `utf-8'
> :signature packet: algo 17, keyid 1A972013A9BF7DBA
> 	version 3, created 1411642226, md5len 5, sigclass 0x00
> 	digest algo 2, begin of digest 95 30
> 	data: [158 bits]
> 	data: [158 bits]
> gpg: Nombre total processat: 0
> 
> Any idea?

1- as I told you the key was mine, you can download the key from my
account:
http://gna.org/users/gch

2- have you tried gpg --recv-keys ?

I believe this key expired though, my new key is 7F392711, but of
course the xenomai archives are not signed with it yet.

-- 
					    Gilles.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 811 bytes
Desc: not available
URL: <http://xenomai.org/pipermail/xenomai/attachments/20150601/69a2f56e/attachment.sig>

Re: [Xenomai] Gpg signatures of releases

[Leopold Palomo-Avellaneda]

El Dilluns, 1 de juny de 2015, a les 23:21:54, Gilles Chanteperdrix va 
escriure:
> On Mon, Jun 01, 2015 at 10:52:27PM +0200, Leopold Palomo-Avellaneda wrote:
> > El Dilluns, 1 de juny de 2015, a les 12:17:06, Gilles Chanteperdrix va
> > 
> > escriure:
> > > On Mon, Jun 01, 2015 at 12:11:03AM +0200, Leopold Palomo-Avellaneda 
wrote:
> > > > Hi,
> > > > 
> > > > who sig
> > > > 
> > > > http://download.gna.org/xenomai/stable/latest/*.sig
> > > > 
> > > > ?
> > > 
> > > I do. There used to be a readme file that said so, but it seems it
> > > is no longer displayed by gna. In any case, if you go to the gna
> > > interface you should find the keys of all the project members,
> > > including mine (in fact, gna quarantines an upload if it is not
> > > signed by a project member, or at least is used to). I use the same
> > > key to sign that mail.
> > 
> > When I try to download the keyring I get a 0 bytes long file from here:
> > 
> > http://gna.org/project/memberlist-gpgkeys.php?group=xenomai
> > 
> > I found that the file was signed by this key with this id A9BF7DBA,
> > but I have not found who is the proprietary.
> > 
> > gpg: using character set `utf-8'
> > 
> > :signature packet: algo 17, keyid 1A972013A9BF7DBA
> > :
> > 	version 3, created 1411642226, md5len 5, sigclass 0x00
> > 	digest algo 2, begin of digest 95 30
> > 	data: [158 bits]
> > 	data: [158 bits]
> > 
> > gpg: Nombre total processat: 0
> > 
> > Any idea?
> 
> 1- as I told you the key was mine, you can download the key from my
> account:
> http://gna.org/users/gch

in that place, there's only the 7F392711, that it seems the new one.

> 
> 2- have you tried gpg --recv-keys ?

Ok, that was the point. I got it, but it was expired.

> I believe this key expired though, my new key is 7F392711, but of
> course the xenomai archives are not signed with it yet.

The 2.6.4 released was signed with the old one.

Anyway, the xenomai keyring at gna is void. Please could you check it?


Leopold

-- 
--
Linux User 152692     GPG: 05F4A7A949A2D9AA
Catalonia
-------------------------------------
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
A: Top-posting.
Q: What is the most annoying thing in e-mail?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: This is a digitally signed message part.
URL: <http://xenomai.org/pipermail/xenomai/attachments/20150601/40eaa09d/attachment.sig>

Re: [Xenomai] Gpg signatures of releases

[Gilles Chanteperdrix]

On Mon, Jun 01, 2015 at 11:51:33PM +0200, Leopold Palomo-Avellaneda wrote:
> El Dilluns, 1 de juny de 2015, a les 23:21:54, Gilles Chanteperdrix va 
> escriure:
> > On Mon, Jun 01, 2015 at 10:52:27PM +0200, Leopold Palomo-Avellaneda wrote:
> > > El Dilluns, 1 de juny de 2015, a les 12:17:06, Gilles Chanteperdrix va
> > > 
> > > escriure:
> > > > On Mon, Jun 01, 2015 at 12:11:03AM +0200, Leopold Palomo-Avellaneda 
> wrote:
> > > > > Hi,
> > > > > 
> > > > > who sig
> > > > > 
> > > > > http://download.gna.org/xenomai/stable/latest/*.sig
> > > > > 
> > > > > ?
> > > > 
> > > > I do. There used to be a readme file that said so, but it seems it
> > > > is no longer displayed by gna. In any case, if you go to the gna
> > > > interface you should find the keys of all the project members,
> > > > including mine (in fact, gna quarantines an upload if it is not
> > > > signed by a project member, or at least is used to). I use the same
> > > > key to sign that mail.
> > > 
> > > When I try to download the keyring I get a 0 bytes long file from here:
> > > 
> > > http://gna.org/project/memberlist-gpgkeys.php?group=xenomai
> > > 
> > > I found that the file was signed by this key with this id A9BF7DBA,
> > > but I have not found who is the proprietary.
> > > 
> > > gpg: using character set `utf-8'
> > > 
> > > :signature packet: algo 17, keyid 1A972013A9BF7DBA
> > > :
> > > 	version 3, created 1411642226, md5len 5, sigclass 0x00
> > > 	digest algo 2, begin of digest 95 30
> > > 	data: [158 bits]
> > > 	data: [158 bits]
> > > 
> > > gpg: Nombre total processat: 0
> > > 
> > > Any idea?
> > 
> > 1- as I told you the key was mine, you can download the key from my
> > account:
> > http://gna.org/users/gch
> 
> in that place, there's only the 7F392711, that it seems the new one.
> 
> > 
> > 2- have you tried gpg --recv-keys ?
> 
> Ok, that was the point. I got it, but it was expired.

Can you not download it anyway ?

> 
> > I believe this key expired though, my new key is 7F392711, but of
> > course the xenomai archives are not signed with it yet.
> 
> The 2.6.4 released was signed with the old one.
> 
> Anyway, the xenomai keyring at gna is void. Please could you check it?

No, I do not really care about that.

-- 
					    Gilles.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 811 bytes
Desc: not available
URL: <http://xenomai.org/pipermail/xenomai/attachments/20150601/831c776c/attachment.sig>

Re: [Xenomai] Gpg signatures of releases

[Philippe Gerum]

On 06/01/2015 11:51 PM, Leopold Palomo-Avellaneda wrote:
> 
> Anyway, the xenomai keyring at gna is void. Please could you check it?
> 

GNA only hosts our download area these days, we have been using our own
infrastructure for years now for all the rest. At some point, we'll move
the tarballs to the xenomai.org server as well.

-- 
Philippe.