On Fri, Jul 7, 2023 at 3:58 PM ToddAndMargo via users <users@lists.fedoraproject.org> wrote: > > Hi All, > > I just upgraded to Fedora 38. > > When I went to ask "rpm" what my version of > Xfce was, I got a ton of this scrolling > over my terminal: > > $ rpm -qa xfce4\* > ... > error: Verifying a signature using certificate > 555FD53A996BB0E1029F7AF2AFF47E8B2A31FBDF (@virtmaint-sig_virt-preview > (None) <@virtmaint-sig#virt-prev...@copr.fedorahosted.org>): > 1. Certificiate AFF47E8B2A31FBDF invalid: certificate is not alive > because: The primary key is not live > because: Expired on 2023-04-16T14:42:35Z > 2. Key AFF47E8B2A31FBDF invalid: key is not alive > because: The primary key is not live > because: Expired on 2023-04-16T14:42:35Z > > What the heck?
GnuPG does not handle key management well. I don't know if it is due to the OpenPGP spec or not. The signature is likely good. A signature on something signed in the past is still good even if the key used to apply the signature is now retired. A retired key cannot (should not?) be used to make new signatures once the key expires. That does not look like it is the case here. (See below on timestamp servers). The only time a signature would become invalid is if the private key was compromised. An expired key is not a compromised key. That does not look like it is the case here. And the certificate on the software package would need to include a timestamp from a trusted TS server. Or something like a blockchain that records the signature. I don't believe the key or certificate includes the attestation, so there's no way to tell when the certificate was actually signed. Because there's no timestamp on the package, you get the nonsense above. Jeff _______________________________________________ users mailing list -- users@lists.fedoraproject.org To unsubscribe send an email to users-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
