From: Loic Dachary <loic@dachary.org>
To: Martin Palma <martin@palma.bz>
Cc: Ceph Development <ceph-devel@vger.kernel.org>
Subject: GPG signing RPM packages : must not have subkeys
Date: Tue, 15 Mar 2016 18:28:21 +0100 [thread overview]
Message-ID: <56E84635.8080109@dachary.org> (raw)
Hi Martin,
It turns out that the key created by
KEY="$HOME/.ceph-workbench/release-team-key.asc"
if ! test -f $KEY ; then
printf "Key-Type: 1\nKey-Length: 2048\nSubkey-Type: 1\nSubkey-Length: 2048\nName-Real: Release Team\nName-Email: contact@ceph.com\nExpire-Date: 0" | GNUPGHOME=~/.ceph-workbench gpg --batch --gen-key
GNUPGHOME=~/.ceph-workbench gpg --export --armor > $KEY
fi
cannot be used to verify RPM packages: rpm -K on the signed package claims the 69C8876E key is missing. It turns out to be related to the subkey.
--------------------------------------------
pub 2048R/B8F1ACED 2016-03-11
Key fingerprint = 7FEB E845 6F19 153B AAFC 2810 4597 2ACD B8F1 ACED
uid A Contributor <generous@ceph.com>
sub 2048R/69C8876E 2016-03-11
rpm -K complains that the 69C8876E key is not available. After removing the subkey 69C8876E with gpg --edit-key and signing the RPM again, rpm -K is happy. This does not make any sense to me and I suspect there is an expert explanation that justify this behavior. The sensible way out seems to create a passwordless key with no subkey to avoid that problem. Do you happen to know how that can be done ?
Cheers
--
Loïc Dachary, Artisan Logiciel Libre
--
To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next reply other threads:[~2016-03-15 17:28 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-15 17:28 Loic Dachary [this message]
2016-03-15 19:25 ` GPG signing RPM packages : must not have subkeys Martin Palma
2016-03-16 7:55 ` Loic Dachary
2016-03-16 8:10 ` Martin Palma
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56E84635.8080109@dachary.org \
--to=loic@dachary.org \
--cc=ceph-devel@vger.kernel.org \
--cc=martin@palma.bz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.