Gentoo Archives: gentoo-dev-announce

From: "Michał Górny" <mgorny@g.o>
To: gentoo-dev-announce <gentoo-dev-announce@l.g.o>
Cc: gentoo-dev <gentoo-dev@l.g.o>
Subject: [gentoo-dev-announce] Gentoo sync mirror commits are now OpenPGP-signed
Date: Sat, 27 Jan 2018 18:55:23
Message-Id: 1517062905.3816.10.camel@gentoo.org
1 Hi, everyone.
2
3 Just a quick announcement: I have enabled experimental signatures
4 on gentoo-mirror commits for gentoo.git. The server now verifies
5 developer signatures from gentoo.git (using fingerprints from LDAP)
6 and if everything looks fine pushes a signed mirror commit.
7
8 $ git log --show-signature -1 | cat
9 commit ec25012d1f9e8c795d8822810970127b13adf2c1
10 gpg: Signature made Sat Jan 27 14:48:54 2018 CET
11 gpg: using RSA key F265B6A01DEF32748C6184C79FA394EB86CB7342
12 gpg: Good signature from "Repository Mirror & CI project (automated signing key) <repo-qa-checks@g.o>" [unknown]
13 gpg: WARNING: This key is not certified with a trusted signature!
14 gpg: There is no indication that the signature belongs to the owner.
15 Primary key fingerprint: C5DF ACC4 F05D 47E4 383C E4C2 403B C085 18DA F97B
16 Subkey fingerprint: F265 B6A0 1DEF 3274 8C61 84C7 9FA3 94EB 86CB 7342
17 Author: Repository QA checks <repo-qa-checks@g.o>
18 Date: Sat Jan 27 14:48:54 2018
19
20 2018-01-27 13:48:53 UTC
21
22
23 The appropriate public key has been pushed to SKS keyservers.
24 The current fingerprints can be found on the project page [1]. I will
25 work on Portage integration later on.
26
27 [1]:https://wiki.gentoo.org/wiki/Project:Repository_mirror_and_CI
28
29 --
30 Best regards,
31 Michał Górny