Signature for newly released iptables-1.8.11 package

Signature for newly released iptables-1.8.11 package

[Guido Trentalancia]

The newly released iptables version 1.8.11 source package has been
signed using a new gpg key 8C5F7146A1757A65E2422A94D70D1A666ACF2B21.

Unfortunately it seems that such key has not been published yet on
public keyservers.

Can someone please publish the new gpg key used to sign newer iptables
releases ?

Thanks,

Guido

Re: Signature for newly released iptables-1.8.11 package

[Jeremy Sowden]

[-- Attachment #1: Type: text/plain, Size: 449 bytes --]

On 2025-03-07, at 17:40:01 +0100, Guido Trentalancia wrote:
> The newly released iptables version 1.8.11 source package has been
> signed using a new gpg key 8C5F7146A1757A65E2422A94D70D1A666ACF2B21.
> 
> Unfortunately it seems that such key has not been published yet on
> public keyservers.
> 
> Can someone please publish the new gpg key used to sign newer iptables
> releases ?

It's here: https://netfilter.org/about.html#gpg.

J.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 931 bytes --]

Re: Signature for newly released iptables-1.8.11 package

[Guido Trentalancia]

Thanks Jeremy.

Ideally the key should be also published on public keyserver for
maximum efficacy and security.

Regards,

Guido

On Fri, 07/03/2025 at 16.49 +0000, Jeremy Sowden wrote:
> On 2025-03-07, at 17:40:01 +0100, Guido Trentalancia wrote:
> > The newly released iptables version 1.8.11 source package has been
> > signed using a new gpg key
> > 8C5F7146A1757A65E2422A94D70D1A666ACF2B21.
> > 
> > Unfortunately it seems that such key has not been published yet on
> > public keyservers.
> > 
> > Can someone please publish the new gpg key used to sign newer
> > iptables
> > releases ?
> 
> It's here: https://netfilter.org/about.html#gpg.
> 
> J.

Re: Signature for newly released iptables-1.8.11 package

[Pablo Neira Ayuso]

Hi,

On Fri, Mar 07, 2025 at 04:49:48PM +0000, Jeremy Sowden wrote:
> On 2025-03-07, at 17:40:01 +0100, Guido Trentalancia wrote:
> > The newly released iptables version 1.8.11 source package has been
> > signed using a new gpg key 8C5F7146A1757A65E2422A94D70D1A666ACF2B21.
> > 
> > Unfortunately it seems that such key has not been published yet on
> > public keyservers.
> > 
> > Can someone please publish the new gpg key used to sign newer iptables
> > releases ?
> 
> It's here: https://netfilter.org/about.html#gpg.

I just post the new keys again to PGP servers, if it does not show up,
please let me know.

Thanks.

Re: Signature for newly released iptables-1.8.11 package

[Pablo Neira Ayuso]

Hi,

On Wed, Mar 12, 2025 at 12:49:20PM +0100, Guido Trentalancia wrote:
> Hello Pablo this is off-list.
> 
> By the way, there is a patch that seems to be stuck on the basis of the
> fact that an existing feature such as hostname-based iptables rules are
> presumably unsafe.
> 
> I am referring to the following patch:
> 
> https://lore.kernel.org/netfilter-devel/1741369231.5380.37.camel@trenta
> lancia.com/T/#m5e68fc86c299f9d7d372813397253dcda1086170
> 
> The comments have just been looping on the assumption that hostname-
> based filtering is unsafe and should not be used, while circumstances
> might vary, the feature is not necessarily unsafe and in any case the
> real problem of possible DNS failures, which might cause the dropping
> of all rules (leaving the system in a truly unsafe state), is not being
> addressed.
> 
> I hope this helps.

Thanks for your feedback.

I agree with what has been said on this already on the mailing list,
you should not rely on filter by name