Hi,
recently, I refreshed some keys of my GnuPG public keyring, did a check
and learned that
1) the RSA key 46925553 Debian Archive Automatic Signing Key (7.0/wheezy)
<ftpmas...@debian.org> has been revoked [output translated into English in
square brackets].
gpg2 --edit-key 0x46925553
pub 4096R/46925553 erzeugt[created]: 2012-04-27 verfällt[expires]:
2020-04-25 Aufruf[call/invocation]: SC
Vertrauen[trust]: unbekannt[unknown]
Gültigkeit[validity]:unbekannt[unknown]
Der folgende Schlüssel wurde am 2014-03-17 von RSA Schlüssel 46925553
Debian Archive Automatic Signing Key (7.0/wheezy) <ftpmas...@debian.org>
widerrufen [The following key has been revoked by RSA key 46925553 Debian
Archive Automatic Signing Key (7.0/wheezy) <ftpmas...@debian.org> on
2014-03-17]
sub 4096R/ADD6B7E2 erzeugt: 2012-04-27 widerrufen: 2014-03-17 Aufruf:
E
[ unbek.] (1). Debian Archive Automatic Signing Key (7.0/wheezy)
<ftpmas...@debian.org>
gpg> fpr
pub 4096R/46925553 2012-04-27 Debian Archive Automatic Signing Key
(7.0/wheezy) <ftpmas...@debian.org>
Haupt-Fingerabdruck [Key Fingerprint] = A1BD 8E9D 78F7 FE5C 3E65 D8AF
8B48 AD62 4692 5553
2) Moreover, I learned that the RSA key 2B90D010 Debian Archive Automatic
Signing Key (8/jessie) <ftpmas...@debian.org> may (may?) have been revoked
by, well, I am not sure by which key, as gpg's output is as follows:
gpg2 --edit-key 0x2B90D010
Dieser Schlüssel könnte durch RSA mit Schlüssel CA1CF964 [?] widerrufen
worden sein
[This key may have been revoked by RSA key CA1CF964 [?]]
Dieser Schlüssel könnte durch RSA mit Schlüssel B12525C4 [?] widerrufen
worden sein
Dieser Schlüssel könnte durch RSA mit Schlüssel 15B0FD82 [?] widerrufen
worden sein
pub 4096R/2B90D010 erzeugt: 2014-11-21 verfällt: 2022-11-19 Aufruf: SC
Vertrauen: unbekannt Gültigkeit: unbekannt
[ unbek.] (1). Debian Archive Automatic Signing Key (8/jessie)
<ftpmas...@debian.org>
gpg> fpr
pub 4096R/2B90D010 2014-11-21 Debian Archive Automatic Signing Key
(8/jessie) <ftpmas...@debian.org>
Haupt-Fingerabdruck [Key Fingerprint] = 126C 0D24 BD8A 2942 CC7D F8AC
7638 D044 2B90 D010
As to 1) the expiration date seems to be quite a while ago, but what
struck me is the fact that there seems to be no way of getting the new
key. I guess, there has to be a new one, as wheezy still is among the
living.
3) So I checked apt-key (list) and the keyrings listed in there, namely
/usr/share/keyrings/debian-archive-removed-keys.gpg Nothing. Hmm, I
thought it was supposed to be listed there automatically as a consequence
of some archive keyring update performed in the past.
4) I read the apt-key manpage. Unfortunately, the "net-update" option that
might have resolved the issue is not available in Debian but only in
Ubuntu. I did an "update" but none of the keys has changed.
gpg: Schlüssel 46925553: "Debian Archive Automatic Signing Key
(7.0/wheezy) <ftpmas...@debian.org>" nicht geändert [unchanged]
gpg: Schlüssel 2B90D010: "Debian Archive Automatic Signing Key (8/jessie)
<ftpmas...@debian.org>" nicht geändert
...some more keys...
5) I checked if apt indicated the availbility of a new
debian-archive-keyring version, but no, 2014.3~deb7u1 not marked as
updatable.
I have to remove the revoked key from apt-key, fine, but what else can I
do for getting the new one? And will the removal affect my oldstable
system in terms of security/secure updates? Have I disregarded something
important?
As to 2)
What kind of ambiguous output is "may" and "?" I hold gpg to be a program
that would not be vague, and maybe it isn't, and it's just me who does not
understand. But what on earth might be the reason for giving an output
like that? What does it mean? How can I check further if it actually has
been revoked?
Thanks in advance for any helpful input. And forgive me if I can't see the
wood for the trees!
Stebe
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-users
