the autobuild gpg key expired!

the autobuild gpg key expired!

[Sage Weil]

Hi all-

For some silly reason I made the GPG key used to sign autobuild packages 
from git expire after 1 year... a year ago today.  Which broke the builds 
this afternoon, and may be causing warnings from anyone using those 
packages.  (Note that official release packages are not affected!)

The Ubuntu keys that sign cd images and such have no expiry; the Debian 
keys expire after 15-20 years.  Since these packages are only 
quasi-trusted (they are automatically built from branches in git, after 
all), just setting no expiry is simplest.  Our future selves exactly N 
years in an alternate timeline will surely agree.

The key in question is

pub   1024D/03C3951A 2011-02-08
uid                  Ceph automated package build (Ceph automated package build) <sage@newdream.net>
sub   4096g/2E457B51 2011-02-08

If you previously installed this as a trusted key on your system, the 
key can be updated (or newly installed) with

 wget -q -O- https://raw.github.com/ceph/ceph/master/keys/autobuild.asc | sudo apt-key add -

If you only install *release* packages (not bleeding edge code), you can 
ignore all of this; *that* key (17ED316D) has no expiry:

pub   4096R/17ED316D 2012-05-20
uid                  Ceph Release Key <sage@newdream.net>

sage

Re: the autobuild gpg key expired!

[Christopher Kunz]

Am 08.02.13 07:46, schrieb Sage Weil:
>  wget -q -O- https://raw.github.com/ceph/ceph/master/keys/autobuild.asc | sudo apt-key add -

This doesn't work because raw.github.com uses a certificate issued to CN
= *.a.ssl.fastly.net
for whatever reason, and wget will complain.

It complains rightly, because there is no way to verifiy that this is
*actually* github.com we're speaking to. If you want the key regardless,
you can use this line:

wget --no-check-certificate -q -O-
https://raw.github.com/ceph/ceph/master/keys/autobuild.asc | sudo
apt-key add -

Regards,

--ck

Re: the autobuild gpg key expired!

[Sage Weil]

On Fri, 8 Feb 2013, Christopher Kunz wrote:
> Am 08.02.13 07:46, schrieb Sage Weil:
> >  wget -q -O- https://raw.github.com/ceph/ceph/master/keys/autobuild.asc | sudo apt-key add -
> 
> This doesn't work because raw.github.com uses a certificate issued to CN
> = *.a.ssl.fastly.net
> for whatever reason, and wget will complain.
> 
> It complains rightly, because there is no way to verifiy that this is
> *actually* github.com we're speaking to. If you want the key regardless,
> you can use this line:
> 
> wget --no-check-certificate -q -O-
> https://raw.github.com/ceph/ceph/master/keys/autobuild.asc | sudo
> apt-key add -

We're setting up https on ceph.com so that we can publish these securely, 
and will follow up with another email (and an update to the docs).

Thanks!
sage

Re: the autobuild gpg key expired!

[Sage Weil]

On Fri, 8 Feb 2013, Sage Weil wrote:
> On Fri, 8 Feb 2013, Christopher Kunz wrote:
> > Am 08.02.13 07:46, schrieb Sage Weil:
> > >  wget -q -O- https://raw.github.com/ceph/ceph/master/keys/autobuild.asc | sudo apt-key add -
> > 
> > This doesn't work because raw.github.com uses a certificate issued to CN
> > = *.a.ssl.fastly.net
> > for whatever reason, and wget will complain.
> > 
> > It complains rightly, because there is no way to verifiy that this is
> > *actually* github.com we're speaking to. If you want the key regardless,
> > you can use this line:
> > 
> > wget --no-check-certificate -q -O-
> > https://raw.github.com/ceph/ceph/master/keys/autobuild.asc | sudo
> > apt-key add -
> 
> We're setting up https on ceph.com so that we can publish these securely, 
> and will follow up with another email (and an update to the docs).

Ceph.com how has SSL and the docs are updated with new locations for the 
signing keys.

For official releases:

 wget -q -O- 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/release.asc' | sudo apt-key add -

For autobuilt packages:

 wget -q -O- 'https://ceph.com/git/?p=ceph.git;a=blob_plain;f=keys/autobuild.asc' | sudo apt-key add -

sage