From: Loic Dachary <loic@dachary.org>
To: Martin Palma <martin@palma.bz>
Cc: Ceph Development <ceph-devel@vger.kernel.org>
Subject: Re: GPG signing RPM packages : must not have subkeys
Date: Wed, 16 Mar 2016 08:55:53 +0100 [thread overview]
Message-ID: <56E91189.7070306@dachary.org> (raw)
In-Reply-To: <CANMxC7BPoRnHRGYXNNu2QmtcbrVP9HTiu3gtim5=aWW42HoAgw@mail.gmail.com>
Hi Martin,
It works indeed ! Thanks :-)
Cheers
On 15/03/2016 20:25, Martin Palma wrote:
> If I remember it right I read somewhere that verification with
> sub-keys is not implemented in rpm.
>
> To create a passwordless key with no subkey you can simple leave out
> the Subkey-Type and Subkey-Length I think:
>
>
> KEY="$HOME/.ceph-workbench/release-team-key.asc"
> if ! test -f $KEY ; then
> printf "Key-Type: 1\nKey-Length: 2048\nName-Real: Release
> Team\nName-Email: contact@ceph.com\nExpire-Date: 0" |
> GNUPGHOME=~/.ceph-workbench gpg --batch --gen-key
> GNUPGHOME=~/.ceph-workbench gpg --export --armor > $KEY
> fi
>
> Can you verify that?
>
> Best,
> Martin
>
> On Tue, Mar 15, 2016 at 6:28 PM, Loic Dachary <loic@dachary.org> wrote:
>> Hi Martin,
>>
>> It turns out that the key created by
>>
>> KEY="$HOME/.ceph-workbench/release-team-key.asc"
>> if ! test -f $KEY ; then
>> printf "Key-Type: 1\nKey-Length: 2048\nSubkey-Type: 1\nSubkey-Length: 2048\nName-Real: Release Team\nName-Email: contact@ceph.com\nExpire-Date: 0" | GNUPGHOME=~/.ceph-workbench gpg --batch --gen-key
>> GNUPGHOME=~/.ceph-workbench gpg --export --armor > $KEY
>> fi
>>
>> cannot be used to verify RPM packages: rpm -K on the signed package claims the 69C8876E key is missing. It turns out to be related to the subkey.
>>
>> --------------------------------------------
>> pub 2048R/B8F1ACED 2016-03-11
>> Key fingerprint = 7FEB E845 6F19 153B AAFC 2810 4597 2ACD B8F1 ACED
>> uid A Contributor <generous@ceph.com>
>> sub 2048R/69C8876E 2016-03-11
>>
>> rpm -K complains that the 69C8876E key is not available. After removing the subkey 69C8876E with gpg --edit-key and signing the RPM again, rpm -K is happy. This does not make any sense to me and I suspect there is an expert explanation that justify this behavior. The sensible way out seems to create a passwordless key with no subkey to avoid that problem. Do you happen to know how that can be done ?
>>
>> Cheers
>>
>> --
>> Loïc Dachary, Artisan Logiciel Libre
> --
> To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
--
Loïc Dachary, Artisan Logiciel Libre
--
To unsubscribe from this list: send the line "unsubscribe ceph-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2016-03-16 7:55 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-03-15 17:28 GPG signing RPM packages : must not have subkeys Loic Dachary
2016-03-15 19:25 ` Martin Palma
2016-03-16 7:55 ` Loic Dachary [this message]
2016-03-16 8:10 ` Martin Palma
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=56E91189.7070306@dachary.org \
--to=loic@dachary.org \
--cc=ceph-devel@vger.kernel.org \
--cc=martin@palma.bz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.