Subject: bug#20788: 24.4; Nicolas Petton's key not included in GNU keyring

From: William G. Gardella <[email-masked]>
Date: Thu, 11 Jun 2015 21:50:32 +0000

Glenn Morris <[email-masked]> writes:

> This is a duplicate of http://debbugs.gnu.org/20298.
>
> I repeat my comment from http://debbugs.gnu.org/20298#23:

Sorry for duplicating the issue; I should have checked
for the existing open bug.

> Nobody here can do anything about this, it's a GNU sysadmin issue.
> It's been reported to them, nothing seems to have happened.
>
> If you want to verify the signature, the key is available from standard
> keyservers, eg pgp.mit.edu. I don't see the value of a keyring that is
> stored on the same ftp server as the file you want to download.

I disagree that it's of no value; anybody can upload any key to any
keyserver, but the GNU keyring can be obtained from an HTTPS server with
a certificate signed by Gandi according to their policies, which,
while not great, are at least better than the nonexistent verification
provided by a keyserver.

I will send the report to sysadmin, as apparently no action has been taken
since late April, when Nicolas's key was supposedly uploaded.