search

zsh-users / zsh-completions

Additional completion definitions for Zsh.
Other
6.86k stars 712 forks source link

Builder repositories key expired #1073

Open notetiene opened 5 months ago

notetiene commented 5 months ago

It does seem that the OpenSuse build service has expired GPG keys.

When downloading (any Debian/Ubuntu) keys:

wget https://download.opensuse.org/repositories/shells:zsh-users:zsh-completions/Debian_11/Release.key
gpg Release.key
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2017-08-05 [SC] [expired: 2024-03-08]
      B480802BB6D332447F99FC169CBE063CAB8FE1F1
uid           shells:zsh-users:zsh-completions OBS Project <shells:zsh-users:zsh-completions@build.opensuse.org>

Edit: it looks all repositories are affected:

wget https://download.opensuse.org/repositories/shells:/zsh-users:/zsh-completions/CentOS_8_Stream/repodata/repomd.xml.key
gpg repomd.xml.key
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2017-08-05 [SC] [expirée : 2024-03-08]
      B480802BB6D332447F99FC169CBE063CAB8FE1F1
uid           shells:zsh-users:zsh-completions OBS Project <shells:zsh-users:zsh-completions@build.opensuse.org>

Do maintainers have direct access to the build service?

notetiene commented 5 months ago

The Debian testing is not affected since its key is expiring in 2026-05-04.

driuba commented 5 months ago

It seems that only download repository key has expired:

╭─[2024-03-10 20:12:41] ~/Downloads 
╰─$ gpg --show-keys Release.key
pub   rsa2048 2017-08-05 [SC] [expired: 2024-03-08]
      B480802BB6D332447F99FC169CBE063CAB8FE1F1
uid                      shells:zsh-users:zsh-completions OBS Project <shells:zsh-users:zsh-completions@build.opensuse.org>

The configured signing key seems to be valid:

╭─[2024-03-10 20:12:46] ~/Downloads 
╰─$ gpg --show-keys shells_zsh-users_zsh-completions_key.gpg
pub   rsa2048 2017-08-05 [SC] [expires: 2026-05-04]
      B480802BB6D332447F99FC169CBE063CAB8FE1F1
uid                      shells:zsh-users:zsh-completions OBS Project <shells:zsh-users:zsh-completions@build.opensuse.org>

My assumption is that the key has been updated, however the actual built package has not been updated with new signature. The last build seems to have happened on 2022:

[    0s] lamb02 started "build debian.dsc" at Sat Aug 13 17:05:44 UTC 2022.

EDIT:
I see @nicoulaj being listed as the maintainer of the build service. Not sure how else to contact them, the IRC channel doesn't look active and the only names I see listed are: diaspora3, phy1729 and eggbean.