GPG key for 2.1.28 signature

[atsampson]

cyrus-sasl-2.1.28.tar.gz.sig is signed with a different private key from previous releases - presumably @quanah's.

There's no mention of the change in the release notes, and no indication of where to get the corresponding public key from in the tarball download instructions, so it's not possible to verify this signature at the moment. Would it be possible to add a keyring (or a reference to an external keyserver) somewhere?

[quanah]

Hello,

The public key is in the MIT keyserver. Is there another public keyserver for GPG keys you think would be good to use?

Personally, I prefer having a project GPG key rather than individual keys.

[quanah]

I've added it to the ubuntu keyserver as well

[atsampson]

Thanks - I've got the key now and can verify it. But it'd be best if the download guidance said explicitly which keys are allowed to sign releases - if you just rely on people downloading whatever key it happened to be signed with, then that doesn't protect you against someone else signing a fake release.

[anthraxx]

I'm unfortunately facing this issue as well and find myself in a stuck position to update the distro package as the chain of trust is broken.

I would like to kindly ask if it would be possible of the key owner of 829F339F8C296FE80F409D93E3D7C118C7B9F46A (Partha Susarla [email protected] @ajaysusarla) to clear-text sign the following message and attach it here? This would allow us to preserve the chain of trust and trust the newly used key.

I hereby confirm that the PGP key DEA1999F0CDB1AAEBA001E0DBEE3E3B4D2F06546
is allowed to sign the cyrus-sasl release 2.1.29 and any future release afterwards.

[ajaysusarla]

Hello @anthraxx, apologies for this confusion. Here's the signed clear-text of the message

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

I hereby confirm that the PGP key DEA1999F0CDB1AAEBA001E0DBEE3E3B4D2F06546
is allowed to sign the cyrus-sasl release 2.1.29 and any future release afterwards.
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEgp8zn4wpb+gPQJ2T49fBGMe59GoFAmJGF4YACgkQ49fBGMe5
9Grr1Q/+OgY/qAKLnbczv5g2lwzyhyvqR+K4YE9+lDsElpSuae1r9hIS26prReQ3
kqP1fvd9YdPc2DHGZjQckqMOtY6fY3/j0Ld8FaQnfbh5EKgw1aOU/7Umr4uAZsyB
Pe4ofCJQyWUwkqFPKDbJOyk251fTkAbYDnZdvjrBQx8n+I7rhNffa3SkJXY7yk3e
kHtl0tUPKgbBW3wvomJvNuTd4V+8c177aGvuZ9dmi2QXJlcy9fvDcb3lwuI8/ZQD
68+lp0pSdegKeJuUlPnmLoLzxUU/wfpfS2x2aoFsYayBxK+DmnodrbMxOgMkoUrM
v1j61XBQtQrzMpRyeTEI72/7Zs0tsIpGT1WxehfVfS3T6j5TL34OYhYcIMTyF7uY
yzMaRVlH0REtCynQk59a33uVhhAZ6TwD/sYs87D5Zsu4HMUfkDnDmdCujGHSNO5P
N65Nhh5z5ugXm/p3/JP26aqiUNE7sosrJsWGFhMT/CoygzmjFYhYrqHnna4ys1a7
6WE4BrnviQ+f0oiMcPUdQ78vCFTMtFJlWeiQ9ghaNeTpJhl5KUl2GWRw+3/aayXA
PR8I0aJgEBIcEz8Z6f8PeNXzIY9qn6z+JJYN0B7oVTIbY9/feEYjZcCHUmyaB19q
XodW9WYvd41WCOCq2MxqlP6dCG87wELGGTw13v86VKhFRpglHrU=
=DsqH
-----END PGP SIGNATURE-----

[anthraxx]

@ajaysusarla Thank you very much for preserving the chain of trust, I can proceed with the upgrade now 🐱

[winner658]

Is this question now fixed? Has a PR been submitted? Or did you say that after the plan, the plan was modified?