Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

Quoting Jaka Kranjc <lynx AT mages.ath.cx>:
> I agree, but I just wanted to hear some more opinions first.
>
> I ran this on test and committed the result:
> find -name "*.gpg" |
> while read kr; do
>   gpg --no-default-keyring --keyring $kr --refresh-keys;
> gpg --no-default-keyring --keyring $kr --list-keys |
>   grep -o "/[^ ]*" | cut -d/ -f2 |
>   xargs -I I -- gpg --no-default-keyring --keyring $kr  --edit-key I clean
> save;
> done
>
> It refreshed all the keys in all the keyrings then cleaned them up (removed
> unusable signatures and more). Crosscertification was done automatically it
> seems, that code alone fixed findutils. I didn't check any of the others.
>
> If nothing is wrong, I'll run it over other grimoires once I get back home.
>
> LP; Happy Holidays!

It seems you need the secret key to cross-certify GPG keys, we can't  
go and clean up others'.

For Bug #14212[0] (ghostscript-fonts-{std,other} failing GPG check) I  
tried to cross-certify the key used, but ran into the following:

# gpg --no-default-keyring --keyring ./gurus.gpg --edit-key 1C3593C7
gpg (GnuPG) 1.4.8; Copyright (C) 2007 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

pub  1024D/1C3593C7  created: 2004-08-20  expires: never       usage: SCA
                     trust: unknown       validity: unknown
sub  1024g/ABF14576  created: 2004-08-20  expires: never       usage: E
sub  2048R/D3125DC1  created: 2005-09-13  expires: never       usage: S
[ unknown] (1). Jason Flatt (Source Mage GNU/Linux:  
http://www.sourcemage.org/ - IRC nick: Oadae) <jflatt AT sourcemage.org>

Command> cross-certify
Need the secret key to do this.

Shall we verify (non-strict) the tarball still matches the GPG and  
then re-sign with a cross-certified key?

-sandalle

[0] http://bugs.sourcemage.org/show_bug.cgi?id=14212

--
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  http://counter.li.org/  #196285