[SM-Discuss] gnupg 1.4.8 is stricter

Eric Sandall eric at sandall.us
Fri Dec 21 20:02:06 EST 2007


On Friday 21 December 2007 08:11:06 Jaka Kranjc wrote:
> Baro complained that findutils and some other spells (ghostscript-fonts-std
> and ghostscript-fonts-other) suddenly fail their source verification. It
> was nailed down to yesterday's update of gnupg. From their changelog [0];
<snip>

Personally, I would prefer we go with the "strict" option, but then 
that "breaks" keys which used to work. Since it's an easy fix for fixing the 
key[0] I would like us to be good netizens and continue with the new 
strictness and, politely, inform the key authors.

-sandalle

[0] If you have been pointed to this page by someone who received a warning 
when verifying one of your signatures, your key does not contain a subkey 
cross-certification. You can easily add this cross-certification using GnuPG 
1.4.3 or later. To do this, simply run "gpg --edit-key (yourkey)" and then 
enter "cross-certify". You'll need to type your passphrase, and GnuPG will 
add the necessary cross-certification. Once this is done, you should 
distribute your key however you like (send it to a keyserver, post on a web 
page, etc). If you have already done this and people are still receiving the 
warning, make sure they have updated their copy of your key from the 
keyserver or web page.

-- 
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric at sandall.us PGP: 0xA8EFDD61  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  http://counter.li.org/  #196285
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part.
Url : http://lists.ibiblio.org/pipermail/sm-discuss/attachments/20071221/58cafd35/attachment.bin 


More information about the SM-Discuss mailing list