Open notetiene opened 5 months ago
The Debian testing is not affected since its key is expiring in 2026-05-04.
It seems that only download repository key has expired:
╭─[2024-03-10 20:12:41] ~/Downloads
╰─$ gpg --show-keys Release.key
pub rsa2048 2017-08-05 [SC] [expired: 2024-03-08]
B480802BB6D332447F99FC169CBE063CAB8FE1F1
uid shells:zsh-users:zsh-completions OBS Project <shells:zsh-users:zsh-completions@build.opensuse.org>
The configured signing key seems to be valid:
╭─[2024-03-10 20:12:46] ~/Downloads
╰─$ gpg --show-keys shells_zsh-users_zsh-completions_key.gpg
pub rsa2048 2017-08-05 [SC] [expires: 2026-05-04]
B480802BB6D332447F99FC169CBE063CAB8FE1F1
uid shells:zsh-users:zsh-completions OBS Project <shells:zsh-users:zsh-completions@build.opensuse.org>
My assumption is that the key has been updated, however the actual built package has not been updated with new signature. The last build seems to have happened on 2022:
[ 0s] lamb02 started "build debian.dsc" at Sat Aug 13 17:05:44 UTC 2022.
EDIT:
I see @nicoulaj being listed as the maintainer of the build service. Not sure how else to contact them, the IRC channel doesn't look active and the only names I see listed are: diaspora3, phy1729 and eggbean.
It does seem that the OpenSuse build service has expired GPG keys.
When downloading (any Debian/Ubuntu) keys:
Edit: it looks all repositories are affected:
Do maintainers have direct access to the build service?