From unknown Wed Jun 18 00:22:12 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#25572 <25572@debbugs.gnu.org> To: bug#25572 <25572@debbugs.gnu.org> Subject: Status: Signatures on Emacs windows .zip files Reply-To: bug#25572 <25572@debbugs.gnu.org> Date: Wed, 18 Jun 2025 07:22:12 +0000 retitle 25572 Signatures on Emacs windows .zip files reassign 25572 emacs submitter 25572 Richard Kettlewell severity 25572 minor thanks From debbugs-submit-bounces@debbugs.gnu.org Sun Jan 29 12:44:48 2017 Received: (at submit) by debbugs.gnu.org; 29 Jan 2017 17:44:48 +0000 Received: from localhost ([127.0.0.1]:50404 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cXtWx-00033Z-00 for submit@debbugs.gnu.org; Sun, 29 Jan 2017 12:44:47 -0500 Received: from eggs.gnu.org ([208.118.235.92]:45170) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cXnyu-0004tu-9M for submit@debbugs.gnu.org; Sun, 29 Jan 2017 06:49:16 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cXnyo-0002SZ-BV for submit@debbugs.gnu.org; Sun, 29 Jan 2017 06:49:11 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50 autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:52827) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cXnyo-0002SV-8G for submit@debbugs.gnu.org; Sun, 29 Jan 2017 06:49:10 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36134) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cXnym-0004Wd-R4 for bug-gnu-emacs@gnu.org; Sun, 29 Jan 2017 06:49:09 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cXnyj-0002Qn-Nw for bug-gnu-emacs@gnu.org; Sun, 29 Jan 2017 06:49:08 -0500 Received: from mantic.terraraq.uk ([46.235.226.39]:44428) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1cXnyj-0002PJ-I2 for bug-gnu-emacs@gnu.org; Sun, 29 Jan 2017 06:49:05 -0500 Received: from cpc91220-cmbg18-2-0-cust198.5-4.cable.virginm.net ([81.104.142.199] helo=araminta.anjou.terraraq.org.uk) by mantic.terraraq.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1cXnyb-00031B-UB for bug-gnu-emacs@gnu.org; Sun, 29 Jan 2017 11:48:57 +0000 Received: from tsais.anjou.terraraq.org.uk ([2001:470:1f09:11ed::42]) by araminta.anjou.terraraq.org.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1cXnyb-0000rE-5f for bug-gnu-emacs@gnu.org; Sun, 29 Jan 2017 11:48:57 +0000 To: bug-gnu-emacs@gnu.org From: Richard Kettlewell Subject: Signatures on Emacs windows .zip files Message-ID: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> Date: Sun, 29 Jan 2017 11:48:55 +0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: submit X-Mailman-Approved-At: Sun, 29 Jan 2017 12:44:45 -0500 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) Hi, According to https://www.gnu.org/software/emacs/download.html: Since the 24.5 release, tarballs are signed with the GPG key from Nicolas Petton 7C207910, fingerprint 28D3 BED8 51FD F3AB 57FE F93C 2335 87A4 7C20 7910, which can be found in the GNU keyring. However the windows .zip files on http://ftp.gnu.org/gnu/emacs are signed with some other key: $ gpg2 --verify emacs-25.1-2-x86_64-w64-mingw32.zip.sig gpg: Signature made 11/29/16 19:54:09 GMT Standard Time using DSA key ID 60C3B396 gpg: Good signature from "Phillip Lord " gpg: aka "Phillip Lord " gpg: aka "Phillip Lord " gpg: aka "Phillip Lord " gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 8352 2404 7598 ECBC 61A1 DA34 5FE9 658D 60C3 B396 ttfn/rjk From debbugs-submit-bounces@debbugs.gnu.org Sun Jan 29 15:14:33 2017 Received: (at 25572) by debbugs.gnu.org; 29 Jan 2017 20:14:33 +0000 Received: from localhost ([127.0.0.1]:50434 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cXvrp-0006T7-E3 for submit@debbugs.gnu.org; Sun, 29 Jan 2017 15:14:33 -0500 Received: from eggs.gnu.org ([208.118.235.92]:49596) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cXvrn-0006Sv-Pg for 25572@debbugs.gnu.org; Sun, 29 Jan 2017 15:14:28 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cXvrd-0003cT-Ex for 25572@debbugs.gnu.org; Sun, 29 Jan 2017 15:14:22 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-3.2 required=5.0 tests=BAYES_40,RP_MATCHES_RCVD autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:49941) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cXvrd-0003cN-Bq; Sun, 29 Jan 2017 15:14:17 -0500 Received: from 84.94.185.246.cable.012.net.il ([84.94.185.246]:3461 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1cXvrc-0007VO-42; Sun, 29 Jan 2017 15:14:17 -0500 Date: Sun, 29 Jan 2017 22:14:08 +0200 Message-Id: <83d1f5y67j.fsf@gnu.org> From: Eli Zaretskii To: Richard Kettlewell In-reply-to: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> (message from Richard Kettlewell on Sun, 29 Jan 2017 11:48:55 +0000) Subject: Re: bug#25572: Signatures on Emacs windows .zip files References: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -8.2 (--------) X-Debbugs-Envelope-To: 25572 Cc: 25572@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Eli Zaretskii Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -8.2 (--------) > From: Richard Kettlewell > Date: Sun, 29 Jan 2017 11:48:55 +0000 > > According to https://www.gnu.org/software/emacs/download.html: > > Since the 24.5 release, tarballs are signed with the GPG key from > Nicolas Petton 7C207910, fingerprint 28D3 BED8 51FD F3AB 57FE > F93C 2335 87A4 7C20 7910, which can be found in the GNU keyring. > > However the windows .zip files on http://ftp.gnu.org/gnu/emacs are > signed with some other key: > > $ gpg2 --verify emacs-25.1-2-x86_64-w64-mingw32.zip.sig > gpg: Signature made 11/29/16 19:54:09 GMT Standard Time using DSA key ID > 60C3B396 > gpg: Good signature from "Phillip Lord " > gpg: aka "Phillip Lord " > gpg: aka "Phillip Lord " > gpg: aka "Phillip Lord " > gpg: WARNING: This key is not certified with a trusted signature! > gpg: There is no indication that the signature belongs to the > owner. > Primary key fingerprint: 8352 2404 7598 ECBC 61A1 DA34 5FE9 658D 60C3 B396 That's because the zip files with Windows binaries were produced by Phillip. Why is that a bug? From debbugs-submit-bounces@debbugs.gnu.org Sun Jan 29 15:56:13 2017 Received: (at 25572) by debbugs.gnu.org; 29 Jan 2017 20:56:13 +0000 Received: from localhost ([127.0.0.1]:50455 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cXwWD-0007PB-K2 for submit@debbugs.gnu.org; Sun, 29 Jan 2017 15:56:13 -0500 Received: from mailgw.mycpanelcloud.co.uk ([185.116.214.125]:36843) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cXwWB-0007P2-Hd for 25572@debbugs.gnu.org; Sun, 29 Jan 2017 15:56:12 -0500 Received: from localhost (localhost [127.0.0.1]) by mailgw.mycpanelcloud.co.uk (Postfix) with ESMTP id 56F9CC57CB for <25572@debbugs.gnu.org>; Sun, 29 Jan 2017 20:55:45 +0000 (GMT) X-Virus-Scanned: by SpamTitan at mycpanelcloud.co.uk Received: from mailgw.mycpanelcloud.co.uk (localhost [127.0.0.1]) by mailgw.mycpanelcloud.co.uk (Postfix) with ESMTP id 09C79C5935 for <25572@debbugs.gnu.org>; Sun, 29 Jan 2017 20:55:43 +0000 (GMT) Received: from cloud103.planethippo.com (cloud103.planethippo.com [31.216.48.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mailgw.mycpanelcloud.co.uk (Postfix) with ESMTPS id CD194C58F0 for <25572@debbugs.gnu.org>; Sun, 29 Jan 2017 20:55:42 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=russet.org.uk; s=default; h=Content-Transfer-Encoding:Content-Type: MIME-Version:Cc:To:From:Subject:Date:References:In-Reply-To:Message-ID:Sender :Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=3kDU82LbY7l31m1yN6TaI4IoEOyYqQg/wQvPf+q/5Ho=; b=dy+oR9+WLVsNK+zzWXG2mdZQQj Le2EcPpkGiTT5Q/ikxLpdhJtfkbAxX8G8BqdRrX079X9L86Nv4T78DoVOJ5dMNKoszx5Atk1DKWh2 VxSvQwBfa/akLvqCzGpRJcAYOE0AGS7+Eci0gZg/gVb1kGWaurqSxZhmEuCtNmBHnYrKtW0T6+mFU uXaljoN6OwtohxAk35TTrwC7LKyoPLUuCtGRBCATbbK4H6L8ThMxEmEhEqv7VgN7xpL/TUGRhg5eX cyHYtFvM424q1ISzo7aiZ7DT0Szmee+L0axFXySf1N1cpyzmVRcFxnjsNQLBdiqwYzj8UUWY2KGJK lQhIb+Cg==; Received: from [127.0.0.1] (port=47222 helo=cloud103.planethippo.com) by cloud103.planethippo.com with esmtpa (Exim 4.87) (envelope-from ) id 1cXwW6-001FMz-6H; Sun, 29 Jan 2017 20:56:06 +0000 Received: from 92.238.179.168 ([92.238.179.168]) (SquirrelMail authenticated user phillip.lord@russet.org.uk) by cloud103.planethippo.com with HTTP; Sun, 29 Jan 2017 20:56:06 -0000 Message-ID: In-Reply-To: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> References: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> Date: Sun, 29 Jan 2017 20:56:06 -0000 Subject: Re: bug#25572: Signatures on Emacs windows .zip files From: "Phillip Lord" To: "Richard Kettlewell" User-Agent: SquirrelMail/1.5.2 [SVN] MIME-Version: 1.0 Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: 8bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - cloud103.planethippo.com X-AntiAbuse: Original Domain - debbugs.gnu.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - russet.org.uk X-Get-Message-Sender-Via: cloud103.planethippo.com: authenticated_id: phillip.lord@russet.org.uk X-Authenticated-Sender: cloud103.planethippo.com: phillip.lord@russet.org.uk X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 25572 Cc: 25572@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.0 (/) On Sun, January 29, 2017 11:48 am, Richard Kettlewell wrote: > According to https://www.gnu.org/software/emacs/download.html: > > > Since the 24.5 release, tarballs are signed with the GPG key from > Nicolas Petton 7C207910, fingerprint 28D3 BED8 51FD F3AB 57FE > F93C 2335 87A4 7C20 7910, which can be found in the GNU keyring. > > > However the windows .zip files on http://ftp.gnu.org/gnu/emacs are > signed with some other key: > > $ gpg2 --verify emacs-25.1-2-x86_64-w64-mingw32.zip.sig > gpg: Signature made 11/29/16 19:54:09 GMT Standard Time using DSA key ID > 60C3B396 > gpg: Good signature from "Phillip Lord " > gpg: aka "Phillip Lord " > gpg: aka "Phillip Lord " > gpg: aka "Phillip Lord " > gpg: WARNING: This key is not certified with a trusted signature! > gpg: There is no indication that the signature belongs to the > owner. Primary key fingerprint: 8352 2404 7598 ECBC 61A1 DA34 5FE9 658D > 60C3 B396 Thanks for pointing this out. The key is mine. I didn't know about that statement on the website, and you are correct that it is rather asymmetric. I need to update the key anyway, and will get the website updated after that. Phil From debbugs-submit-bounces@debbugs.gnu.org Sun Jan 29 16:14:56 2017 Received: (at 25572) by debbugs.gnu.org; 29 Jan 2017 21:14:56 +0000 Received: from localhost ([127.0.0.1]:50461 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cXwoK-0007oc-96 for submit@debbugs.gnu.org; Sun, 29 Jan 2017 16:14:56 -0500 Received: from mailgw.mycpanelcloud.co.uk ([185.116.214.213]:59714) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cXwoI-0007oO-CZ for 25572@debbugs.gnu.org; Sun, 29 Jan 2017 16:14:54 -0500 Received: from localhost (localhost [127.0.0.1]) by mailgw.mycpanelcloud.co.uk (Postfix) with ESMTP id AC963C57D8 for <25572@debbugs.gnu.org>; Sun, 29 Jan 2017 21:14:24 +0000 (GMT) X-Virus-Scanned: by SpamTitan at mycpanelcloud.co.uk Received: from mailgw.mycpanelcloud.co.uk (localhost [127.0.0.1]) by mailgw.mycpanelcloud.co.uk (Postfix) with ESMTP id 64713C5891 for <25572@debbugs.gnu.org>; Sun, 29 Jan 2017 21:14:23 +0000 (GMT) Received: from cloud103.planethippo.com (cloud103.planethippo.com [31.216.48.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mailgw.mycpanelcloud.co.uk (Postfix) with ESMTPS id 50926C570A for <25572@debbugs.gnu.org>; Sun, 29 Jan 2017 21:14:23 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=russet.org.uk; s=default; h=Content-Transfer-Encoding:Content-Type: MIME-Version:Cc:To:From:Subject:Date:References:In-Reply-To:Message-ID:Sender :Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=zDGv7z+Z61JGw/pIXC5z13DPaDtPJ1G36NbHuMzsHFg=; b=SsMJT7lktKGAMoEPogQbYtUhJ0 /bnUw0Tgg7cM9BG97Z9AxCX8oPIz+0Q2kjyof6BBbefeH9sEWra9CEIE+7mwE2+W3IOV5K176iksD 8pnaSZposda4QHhnfJiCW1/x7o9roBnOs2Q8G1ONI0pC4cATmyNuU0bjug00Vy3tfXjhGXQo8d5WP HULNe2NwvvZSrTB0iwsWwHTGHAVuwq2v0kwmje1TjoggDeVgNOqpc+aTQ5S+URy4x01IfUZTura4W DRohVDW7NFCD5Lo9Q+d/FRHFJAHT/SKAa25gZC2cyFy1YzOW/u0ZBI3O4n2ntiA8JtWr18vEf0d8V dR21mAfQ==; Received: from [127.0.0.1] (port=48930 helo=cloud103.planethippo.com) by cloud103.planethippo.com with esmtpa (Exim 4.87) (envelope-from ) id 1cXwoA-001MW6-UJ; Sun, 29 Jan 2017 21:14:47 +0000 Received: from 92.238.179.168 ([92.238.179.168]) (SquirrelMail authenticated user phillip.lord@russet.org.uk) by cloud103.planethippo.com with HTTP; Sun, 29 Jan 2017 21:14:46 -0000 Message-ID: <41759f91c06b857e642d6a5394db2de0.squirrel@cloud103.planethippo.com> In-Reply-To: <83d1f5y67j.fsf@gnu.org> References: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> <83d1f5y67j.fsf@gnu.org> Date: Sun, 29 Jan 2017 21:14:46 -0000 Subject: Re: bug#25572: Signatures on Emacs windows .zip files From: "Phillip Lord" To: "Eli Zaretskii" User-Agent: SquirrelMail/1.5.2 [SVN] MIME-Version: 1.0 Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: 8bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - cloud103.planethippo.com X-AntiAbuse: Original Domain - debbugs.gnu.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - russet.org.uk X-Get-Message-Sender-Via: cloud103.planethippo.com: authenticated_id: phillip.lord@russet.org.uk X-Authenticated-Sender: cloud103.planethippo.com: phillip.lord@russet.org.uk X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 25572 Cc: Richard Kettlewell , 25572@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.0 (/) On Sun, January 29, 2017 8:14 pm, Eli Zaretskii wrote: >> From: Richard Kettlewell >> Date: Sun, 29 Jan 2017 11:48:55 +0000 >> >> >> $ gpg2 --verify emacs-25.1-2-x86_64-w64-mingw32.zip.sig >> gpg: Signature made 11/29/16 19:54:09 GMT Standard Time using DSA key ID >> 60C3B396 >> gpg: Good signature from "Phillip Lord " >> gpg: aka "Phillip Lord " >> gpg: aka "Phillip Lord " >> gpg: aka "Phillip Lord " >> gpg: WARNING: This key is not certified with a trusted signature! >> gpg: There is no indication that the signature belongs to the >> owner. Primary key fingerprint: 8352 2404 7598 ECBC 61A1 DA34 5FE9 658D >> 60C3 B396 >> > > That's because the zip files with Windows binaries were produced by > Phillip. > > > Why is that a bug? > I think it's a flaw with the website. It needs both our keys on. From debbugs-submit-bounces@debbugs.gnu.org Sun Jan 29 19:53:13 2017 Received: (at 25572) by debbugs.gnu.org; 30 Jan 2017 00:53:13 +0000 Received: from localhost ([127.0.0.1]:50543 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cY0DY-0007hN-UN for submit@debbugs.gnu.org; Sun, 29 Jan 2017 19:53:13 -0500 Received: from mantic.terraraq.uk ([46.235.226.39]:46080) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cXwCw-0006y6-PL for 25572@debbugs.gnu.org; Sun, 29 Jan 2017 15:36:19 -0500 Received: from cpc91220-cmbg18-2-0-cust198.5-4.cable.virginm.net ([81.104.142.199] helo=araminta.anjou.terraraq.org.uk) by mantic.terraraq.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1cXwCw-0005gh-8m; Sun, 29 Jan 2017 20:36:18 +0000 Received: from tsais.anjou.terraraq.org.uk ([2001:470:1f09:11ed::42]) by araminta.anjou.terraraq.org.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1cXwCv-0001IR-Fc; Sun, 29 Jan 2017 20:36:17 +0000 Subject: Re: bug#25572: Signatures on Emacs windows .zip files To: Eli Zaretskii References: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> <83d1f5y67j.fsf@gnu.org> From: Richard Kettlewell Message-ID: Date: Sun, 29 Jan 2017 20:36:15 +0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: <83d1f5y67j.fsf@gnu.org> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit X-Spam-Score: -3.2 (---) X-Debbugs-Envelope-To: 25572 X-Mailman-Approved-At: Sun, 29 Jan 2017 19:53:12 -0500 Cc: 25572@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.2 (---) On 2017-01-29 20:14, Eli Zaretskii wrote: >> According to https://www.gnu.org/software/emacs/download.html: >> >> Since the 24.5 release, tarballs are signed with the GPG key from >> Nicolas Petton 7C207910, fingerprint 28D3 BED8 51FD F3AB 57FE >> F93C 2335 87A4 7C20 7910, which can be found in the GNU keyring. >> >> However the windows .zip files on http://ftp.gnu.org/gnu/emacs are >> signed with some other key: >> >> $ gpg2 --verify emacs-25.1-2-x86_64-w64-mingw32.zip.sig >> gpg: Signature made 11/29/16 19:54:09 GMT Standard Time using DSA key ID >> 60C3B396 >> gpg: Good signature from "Phillip Lord " >> gpg: aka "Phillip Lord " >> gpg: aka "Phillip Lord " >> gpg: aka "Phillip Lord " >> gpg: WARNING: This key is not certified with a trusted signature! >> gpg: There is no indication that the signature belongs to the >> owner. >> Primary key fingerprint: 8352 2404 7598 ECBC 61A1 DA34 5FE9 658D 60C3 B396 > > That's because the zip files with Windows binaries were produced by > Phillip. Thankyou for replying. The point is: how do I verify that I have a legitimate download of the GNU Emacs Windows binaries? I have an informal trust path to 28D3BED851FDF3AB57FEF93C233587A47C207910 because https://www.gnu.org mentions it. No such statement exists about 835224047598ECBC61A1DA345FE9658D60C3B396. > Why is that a bug? The web page told me to send comments to bug-gnu-emacs@gnu.org, and so here we are. Is there some more appropriate reporting channel? ttfn/rjk From debbugs-submit-bounces@debbugs.gnu.org Sun Jan 29 19:53:14 2017 Received: (at 25572) by debbugs.gnu.org; 30 Jan 2017 00:53:14 +0000 Received: from localhost ([127.0.0.1]:50545 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cY0DZ-0007hQ-R9 for submit@debbugs.gnu.org; Sun, 29 Jan 2017 19:53:13 -0500 Received: from mantic.terraraq.uk ([46.235.226.39]:46102) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cXxAI-0008LT-4I for 25572@debbugs.gnu.org; Sun, 29 Jan 2017 16:37:38 -0500 Received: from cpc91220-cmbg18-2-0-cust198.5-4.cable.virginm.net ([81.104.142.199] helo=araminta.anjou.terraraq.org.uk) by mantic.terraraq.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1cXxAH-0005zZ-AJ; Sun, 29 Jan 2017 21:37:37 +0000 Received: from tsais.anjou.terraraq.org.uk ([2001:470:1f09:11ed::42]) by araminta.anjou.terraraq.org.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1cXxAG-0003KR-IB; Sun, 29 Jan 2017 21:37:36 +0000 Subject: Re: bug#25572: Signatures on Emacs windows .zip files To: Phillip Lord References: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> From: Richard Kettlewell Message-ID: Date: Sun, 29 Jan 2017 21:37:35 +0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Spam-Score: -3.2 (---) X-Debbugs-Envelope-To: 25572 X-Mailman-Approved-At: Sun, 29 Jan 2017 19:53:12 -0500 Cc: 25572@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.2 (---) On 2017-01-29 20:56, Phillip Lord wrote: > Thanks for pointing this out. The key is mine. I didn't know about that > statement on the website, and you are correct that it is rather > asymmetric. > > I need to update the key anyway, and will get the website updated after that. Thanks! ttfn/rjk From debbugs-submit-bounces@debbugs.gnu.org Mon Jan 30 17:33:40 2017 Received: (at 25572) by debbugs.gnu.org; 30 Jan 2017 22:33:40 +0000 Received: from localhost ([127.0.0.1]:51445 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cYKW3-0005Kl-PF for submit@debbugs.gnu.org; Mon, 30 Jan 2017 17:33:39 -0500 Received: from eggs.gnu.org ([208.118.235.92]:58230) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cYKW2-0005KJ-DB for 25572@debbugs.gnu.org; Mon, 30 Jan 2017 17:33:38 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cYKVw-0003OB-Eh for 25572@debbugs.gnu.org; Mon, 30 Jan 2017 17:33:33 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=BAYES_40,RP_MATCHES_RCVD autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:37146) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cYKUy-000334-MK; Mon, 30 Jan 2017 17:32:32 -0500 Received: from rgm by fencepost.gnu.org with local (Exim 4.82) (envelope-from ) id 1cYKUx-0008GE-Eu; Mon, 30 Jan 2017 17:32:31 -0500 From: Glenn Morris To: "Phillip Lord" Subject: Re: bug#25572: Signatures on Emacs windows .zip files References: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> <83d1f5y67j.fsf@gnu.org> <41759f91c06b857e642d6a5394db2de0.squirrel@cloud103.planethippo.com> X-Spook: Biological Axis of Evil Car bomb Uzbekistan Calderon X-Ran: ilQ%@9FpSDL-ug'!p( (Phillip Lord's message of "Sun, 29 Jan 2017 21:14:46 -0000") Message-ID: <3nk29cch6o.fsf@fencepost.gnu.org> User-Agent: Gnus (www.gnus.org), GNU Emacs (www.gnu.org/software/emacs/) MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -8.2 (--------) X-Debbugs-Envelope-To: 25572 Cc: Richard Kettlewell , Eli Zaretskii , 25572@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -8.2 (--------) "Phillip Lord" wrote: > I think it's a flaw with the website. It needs both our keys on. It is it actually useful to list gpg keys on https://www.gnu.org/software/emacs/download.html, or is it just another place that's likely to get out-of-date? Historically, the "GNU keyring" has frequently been outdated and hard to get updated (it should be automatic but clearly isn't), so I don't know if linking to that is a good idea. (Personally I fail to see much value in a keyring stored on the same ftp server as the files. If a Bad Person can mess with the latter, why not the former?) From debbugs-submit-bounces@debbugs.gnu.org Mon Feb 06 05:37:35 2017 Received: (at 25572) by debbugs.gnu.org; 6 Feb 2017 10:37:36 +0000 Received: from localhost ([127.0.0.1]:57193 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cagfv-0006ri-Nu for submit@debbugs.gnu.org; Mon, 06 Feb 2017 05:37:35 -0500 Received: from mailgw.mycpanelcloud.co.uk ([185.116.214.125]:54550) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cagfu-0006ra-1b for 25572@debbugs.gnu.org; Mon, 06 Feb 2017 05:37:34 -0500 Received: from localhost (localhost [127.0.0.1]) by mailgw.mycpanelcloud.co.uk (Postfix) with ESMTP id 9D14BC82C2 for <25572@debbugs.gnu.org>; Mon, 6 Feb 2017 10:37:08 +0000 (GMT) X-Virus-Scanned: by SpamTitan at mycpanelcloud.co.uk Received: from mailgw.mycpanelcloud.co.uk (localhost [127.0.0.1]) by mailgw.mycpanelcloud.co.uk (Postfix) with ESMTP id 4D963C811C for <25572@debbugs.gnu.org>; Mon, 6 Feb 2017 10:37:07 +0000 (GMT) Received: from cloud103.planethippo.com (cloud103.planethippo.com [31.216.48.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mailgw.mycpanelcloud.co.uk (Postfix) with ESMTPS id 4326EC7F8B for <25572@debbugs.gnu.org>; Mon, 6 Feb 2017 10:37:07 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=russet.org.uk; s=default; h=Content-Type:MIME-Version:Message-ID: In-Reply-To:Date:References:Subject:Cc:To:From:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=7JQPOd1a98bMBDcPH2maoPkismNq7QmtCuFL0c0uCTM=; b=3R3opqYKCUNrmMol275jv+IPL BvanSnDux+xt1ON/NdtELLmZV2Zf8VCs9WIJCgWIDzrOo9sfeP2C00qUo/+arqm6sJNsKbPvxX5ux lcruVr/aBN/4MQSenxiAV2GTnS05CkdF6777uXCLEfTQ+NR6Srr27pBXTFyqlMTDABsXi/MurfDKy bK5WybI8NOioD99xxHM9Y2AuIv2thbpkIMivRZ88XbITveMsHSXyJoiATXyi79Wak3odWyfOlDiTf tYbEGjCoDxTRQtod02a8OUzg0oWIqmOtF+DzViS6pv5pWru7Osizzez50wMh7D2cWXttwai+Gnv0S TH0yyWgNg==; Received: from [176.12.107.140] (port=58216 helo=russet.org.uk) by cloud103.planethippo.com with esmtpsa (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128) (Exim 4.87) (envelope-from ) id 1cagfq-002ULG-P8; Mon, 06 Feb 2017 10:37:31 +0000 From: phillip.lord@russet.org.uk (Phillip Lord) To: Glenn Morris Subject: Re: bug#25572: Signatures on Emacs windows .zip files References: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> <83d1f5y67j.fsf@gnu.org> <41759f91c06b857e642d6a5394db2de0.squirrel@cloud103.planethippo.com> <3nk29cch6o.fsf@fencepost.gnu.org> Date: Mon, 06 Feb 2017 10:37:23 +0000 In-Reply-To: <3nk29cch6o.fsf@fencepost.gnu.org> (Glenn Morris's message of "Mon, 30 Jan 2017 17:32:31 -0500") Message-ID: <87efzbzjto.fsf@russet.org.uk> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - cloud103.planethippo.com X-AntiAbuse: Original Domain - debbugs.gnu.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - russet.org.uk X-Get-Message-Sender-Via: cloud103.planethippo.com: authenticated_id: phillip.lord@russet.org.uk X-Authenticated-Sender: cloud103.planethippo.com: phillip.lord@russet.org.uk X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 25572 Cc: Richard Kettlewell , Eli Zaretskii , 25572@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.0 (/) Glenn Morris writes: > "Phillip Lord" wrote: > >> I think it's a flaw with the website. It needs both our keys on. > > It is it actually useful to list gpg keys on > https://www.gnu.org/software/emacs/download.html, or is it just another > place that's likely to get out-of-date? > > Historically, the "GNU keyring" has frequently been outdated and hard to > get updated (it should be automatic but clearly isn't), so I don't know > if linking to that is a good idea. (Personally I fail to see much value > in a keyring stored on the same ftp server as the files. If a Bad Person > can mess with the latter, why not the former?) I don't mind either way, but probably is Nicolas' is on there for the source tarball, we should have one for the windows downloads. You are correct that keeping this uptodate adds load. Phil From debbugs-submit-bounces@debbugs.gnu.org Mon Feb 06 08:04:27 2017 Received: (at 25572) by debbugs.gnu.org; 6 Feb 2017 13:04:27 +0000 Received: from localhost ([127.0.0.1]:57256 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1caiy2-0003Yo-3V for submit@debbugs.gnu.org; Mon, 06 Feb 2017 08:04:26 -0500 Received: from petton.fr ([89.234.186.68]:58764) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1caiy0-0003Ya-Qr for 25572@debbugs.gnu.org; Mon, 06 Feb 2017 08:04:25 -0500 From: Nicolas Petton To: Phillip Lord , Richard Kettlewell Subject: Re: bug#25572: Signatures on Emacs windows .zip files In-Reply-To: References: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> Date: Mon, 06 Feb 2017 14:04:16 +0100 Message-ID: <87h9478o8f.fsf@petton.fr> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=petton.fr; s=mail; t=1486386258; bh=iMCsFDrMhYA6Zc5QHbE1Cy/R06Q4OH5MzUk27ZxWB/g=; h=From:To:Cc:Subject:In-Reply-To:References:Date:Message-ID:MIME-Version:Content-Type; b=RH+MN5s8AK7adprqvMuYuvGZlp40xJWt1Aa9E59r7i+Af79i1520QK9FL5Mm53fVyOsUneMuDZMkFH4b3gkb2stpmQSjQjFHXbuy81WTmqbE6x1MAOyWYDnQRW5xKXFxQz4sEaq+jEM/bGI15934QJtNU+P7SWhKTF8G8wHh5GU= X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 25572 Cc: 25572@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.0 (/) --=-=-= Content-Type: text/plain Phillip Lord writes: > I need to update the key anyway, and will get the website updated > after that. You can send me the fingerprint of the key once you have it updated if you want me to update that page. Cheers, Nico --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJYmHRQAAoJECM1h6R8IHkQkr4IAKqDj74etQRxy4wLqNmwOeH7 fkYlciWQnfnB4Y5fEz74oIxhUG3a4rDOXy9ftIc4jbHXy6EdWPiEQjMi01NqpLR3 FYi9uRwyl7AvFoD6vMqVD71kNjUgdni5a4GSJqZBejwsvUM6rMXwKQwVhqUp4Xox pJGsAyHRbzEst+AogJTka+mpO7PdD2RjBM+TI2s+u8QUv2uOCt/A26BuL/eK2Vxs /LpQCUWs7RgGrtmQXfpM2g97ExkrPHY5+meVLrKF/b0gvkLf+rnBTUQ+hDT5Fs3k e2vgGcui7241Z+7ijF5fTUmwOrJVp0xXAelloIq+Rz4pkHmTO+AJJ2fJKh4FwMk= =0SUi -----END PGP SIGNATURE----- --=-=-=-- From debbugs-submit-bounces@debbugs.gnu.org Mon Feb 06 08:09:11 2017 Received: (at 25572) by debbugs.gnu.org; 6 Feb 2017 13:09:11 +0000 Received: from localhost ([127.0.0.1]:57260 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1caj2d-0003h8-4f for submit@debbugs.gnu.org; Mon, 06 Feb 2017 08:09:11 -0500 Received: from petton.fr ([89.234.186.68]:58853) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1caj2b-0003gw-BX for 25572@debbugs.gnu.org; Mon, 06 Feb 2017 08:09:10 -0500 From: Nicolas Petton To: Glenn Morris , Phillip Lord Subject: Re: bug#25572: Signatures on Emacs windows .zip files In-Reply-To: <3nk29cch6o.fsf@fencepost.gnu.org> References: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> <83d1f5y67j.fsf@gnu.org> <41759f91c06b857e642d6a5394db2de0.squirrel@cloud103.planethippo.com> <3nk29cch6o.fsf@fencepost.gnu.org> Date: Mon, 06 Feb 2017 14:09:01 +0100 Message-ID: <87efzb8o0i.fsf@petton.fr> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=petton.fr; s=mail; t=1486386543; bh=9JOdDLoFk2iwDcb9NJ3lRedF5DNN5ocq9gd9FU3l/C0=; h=From:To:Cc:Subject:In-Reply-To:References:Date:Message-ID:MIME-Version:Content-Type; b=ZPmINDZt09OfPd3+HUZlfDLG1k8pp9oEw5ZlquVzuge9hn8ErVNJCYbg/baIEAnJPv/H5+qSw69uK4kYrEz58LxLYlFLNHHowQpTvxCWqtZpMNmwhgBDYqLYsMpEJzafIbKyFNJFkDGR0RPbmvk0oLhln3GKftXvP0azKGdrMpM= X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 25572 Cc: Richard Kettlewell , 25572@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.0 (/) --=-=-= Content-Type: text/plain Glenn Morris writes: > "Phillip Lord" wrote: > >> I think it's a flaw with the website. It needs both our keys on. > > It is it actually useful to list gpg keys on > https://www.gnu.org/software/emacs/download.html, or is it just another > place that's likely to get out-of-date? I'm trying to keep the website up-to-date :) Several users asked for the fingerprint to be added somewhere on the Emacs website, and I thought it was a good idea, as the GNU keyring is not up-to-date and it looks like most users don't use it. > Historically, the "GNU keyring" has frequently been outdated and hard to > get updated (it should be automatic but clearly isn't) Indeed, it was very hard for me to get my key on this keyring, it took ages. Cheers, Nico --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJYmHVtAAoJECM1h6R8IHkQqTMH/i/Z/TnguojymUNhLbUcfEcX z5HscDUxzOANsQHur1lQwihyZFtu/rmJknIoXzF34ds90xy7LsdsDqsWiuFU2yi6 7VOGwQ+xLeyfSuk4R3kw4HnKwHjNEGwkgOxnXFuhlwLJWKyypCCYoJmMwlWh2l/d I5DqIHuIuUbAReq7ZUonB+epJEQqIARGrwN2Dmx54UhhIsOgnflOFBxiAMrLGIcG /owbaD2lqORlRNyWqBZZDEJHMqNdYHh7+oeSYCsrx6owdSHUAHMrFQkG8w+QSBke 3vqoobBQHsM0+7katq7Y3rdle+qjw8BUb3ahDlq0aSD06sDq+derVs9rL2r3uoc= =dYxE -----END PGP SIGNATURE----- --=-=-=-- From debbugs-submit-bounces@debbugs.gnu.org Mon Feb 06 23:38:30 2017 Received: (at 25572) by debbugs.gnu.org; 7 Feb 2017 04:38:30 +0000 Received: from localhost ([127.0.0.1]:58227 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1caxXy-0008OD-Lh for submit@debbugs.gnu.org; Mon, 06 Feb 2017 23:38:30 -0500 Received: from eggs.gnu.org ([208.118.235.92]:48231) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1caxXw-0008O0-JZ for 25572@debbugs.gnu.org; Mon, 06 Feb 2017 23:38:28 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1caxXq-0004lv-Mn for 25572@debbugs.gnu.org; Mon, 06 Feb 2017 23:38:23 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=BAYES_40,RP_MATCHES_RCVD autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:59633) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1caxWs-000496-BC; Mon, 06 Feb 2017 23:37:22 -0500 Received: from rgm by fencepost.gnu.org with local (Exim 4.82) (envelope-from ) id 1caxWr-0007ga-Nf; Mon, 06 Feb 2017 23:37:21 -0500 From: Glenn Morris To: Nicolas Petton Subject: Re: bug#25572: Signatures on Emacs windows .zip files References: <92b7e28f-8e37-21f4-ca46-0d4ca9429c4a@terraraq.uk> <83d1f5y67j.fsf@gnu.org> <41759f91c06b857e642d6a5394db2de0.squirrel@cloud103.planethippo.com> <3nk29cch6o.fsf@fencepost.gnu.org> <87efzb8o0i.fsf@petton.fr> X-Spook: SAPO H5N1 Plot mindwar IDEA Airport kibo bootleg X-Ran: A6.:'O,Ie=g,nK9"=Toyi,nSVAJ-rt$]Kd/J4',=~$|{+R\~J3<;9D6lggHczl'=8ZmB'I X-Hue: cyan X-Debbugs-No-Ack: yes X-Attribution: GM Date: Mon, 06 Feb 2017 23:37:21 -0500 In-Reply-To: <87efzb8o0i.fsf@petton.fr> (Nicolas Petton's message of "Mon, 06 Feb 2017 14:09:01 +0100") Message-ID: User-Agent: Gnus (www.gnus.org), GNU Emacs (www.gnu.org/software/emacs/) MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: 25572 Cc: Richard Kettlewell , 25572@debbugs.gnu.org, Phillip Lord X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) Nicolas Petton wrote: >> Historically, the "GNU keyring" has frequently been outdated and hard to >> get updated (it should be automatic but clearly isn't) > > Indeed, it was very hard for me to get my key on this keyring, it took > ages. That's why I don't like seeing the GNU keyring advertised on the Emacs page. :) It clearly doesn't work properly, so let's not draw attention to it. I'd suggest you put the Emacs keys in a plain text file on the Emacs web site, and have the download page link to it. That way it is easier to update. From debbugs-submit-bounces@debbugs.gnu.org Sun Nov 19 09:11:34 2017 Received: (at 25572) by debbugs.gnu.org; 19 Nov 2017 14:11:35 +0000 Received: from localhost ([127.0.0.1]:46858 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1eGQJq-00052K-Mg for submit@debbugs.gnu.org; Sun, 19 Nov 2017 09:11:34 -0500 Received: from mantic.terraraq.uk ([46.235.226.39]:35609) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1eGQJo-000524-Bq for 25572@debbugs.gnu.org; Sun, 19 Nov 2017 09:11:33 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=terraraq.uk ; s=20170701; h=Content-Transfer-Encoding:Content-Type:MIME-Version:Date: Message-ID:Subject:From:To:Sender:Reply-To:Cc:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=baSTklrrKXGDXKAibkh01SFFp7DxqWyYlKheHaa7HHI=; b=SKYc4GgFVqwR6Za7DE4F6ZzBsY kN15hPCiLhj+t53txExv3iMnkOrclOoZTcNzJ2i+PYpYcZUabmgwVKn4KFHhIPi3EAutZe4XuDTO6 fYOKD748eNgJQ1UcR59V2sZgMqPAE2qwRNGE+IQ6IoIyKo3DaJFNA1sDvOe+hvyjQM2o8Rtv/fa7n f0apj491SxL2/WgDEY8PWKBTz4GCXbD/t70rCUxkFrp5cns20iPKiG4F+Qyfpz8FrS/JYHoVlf9gQ 1uMfXp6WC1O3nmHP/WgOUp41X4q57+9cKRA+K0bPs388JqogqY3hsu6ebuDjVC/5bCSeUAB6089qm hUhavckA==; Received: from cpc91220-cmbg18-2-0-cust198.5-4.cable.virginm.net ([81.104.142.199] helo=araminta.anjou.terraraq.org.uk) by mantic.terraraq.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1eGQJn-0000bt-Ke for 25572@debbugs.gnu.org; Sun, 19 Nov 2017 14:11:31 +0000 Received: from [2001:470:1f09:11ed:b003:8d90:dc55:581f] by araminta.anjou.terraraq.org.uk with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.89) (envelope-from ) id 1eGQJn-00032Q-AF for 25572@debbugs.gnu.org; Sun, 19 Nov 2017 14:11:31 +0000 To: 25572@debbugs.gnu.org From: Richard Kettlewell Subject: Signatures on Emacs windows .zip files Message-ID: Date: Sun, 19 Nov 2017 14:11:30 +0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.4.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 25572 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.0 (/) The situation does not seem to have improved in the last ~10 months. The Windows Emacs zipfiles are still signed with a key not mentioned anywhere on https://www.gnu.org/software/emacs/download.html. ttfn/rjk From debbugs-submit-bounces@debbugs.gnu.org Wed Nov 21 13:10:09 2018 Received: (at control) by debbugs.gnu.org; 21 Nov 2018 18:10:10 +0000 Received: from localhost ([127.0.0.1]:40048 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gPWwz-0002SK-PM for submit@debbugs.gnu.org; Wed, 21 Nov 2018 13:10:09 -0500 Received: from eggs.gnu.org ([208.118.235.92]:47044) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1gPWwx-0002Rq-0C for control@debbugs.gnu.org; Wed, 21 Nov 2018 13:10:08 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1gPWwq-0001VM-LK for control@debbugs.gnu.org; Wed, 21 Nov 2018 13:10:01 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:53566) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1gPWwq-0001VG-IH for control@debbugs.gnu.org; Wed, 21 Nov 2018 13:10:00 -0500 Received: from rgm by fencepost.gnu.org with local (Exim 4.82) (envelope-from ) id 1gPWwq-0003HV-EU for control@debbugs.gnu.org; Wed, 21 Nov 2018 13:10:00 -0500 Subject: control message for bug 33456 To: X-Mailer: mail (GNU Mailutils 2.99.98) Message-Id: From: Glenn Morris Date: Wed, 21 Nov 2018 13:10:00 -0500 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -6.0 (------) forcemerge 25572 33456 From unknown Wed Jun 18 00:22:12 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Fri, 21 Dec 2018 12:24:05 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator