Re: Update key expiration date for [email protected]

Uwe Kleine-König <[email protected]> Sat, 12 Apr 2025 08:47:22 +0200

Newsgroups	org.kernel.linux.keys
Message-ID	<qt4t3up5kuyfi4hb3wwmgelw44tcupkbr6shlvx5wuyrow6wg6@jhshs4gaeg43>

Hello Ted,

On Fri, Apr 11, 2025 at 11:01:53AM -0400, Theodore Ts'o wrote:
> On Thu, Apr 10, 2025 at 05:40:28PM +0200, Uwe Kleine-König wrote:
> > On Thu, Apr 10, 2025 at 10:43:14AM -0400, Konstantin Ryabitsev wrote:
> > > On Thu, Apr 10, 2025 at 10:34:55AM -0400, Theodore Ts'o wrote:
> > > 
> > > Updated, thanks.
> > 
> > This is rather odd. The commit you created indeed updated the expiry
> > date on the key, but it also dropped lots of signatures. If I repeat
> > importing Theodore's key, the keys are not dropped for me. (And that's
> > even though I use a gpg version that is affected by
> > https://dev.gnupg.org/T7583.)
> > 
> > The graph before the import was just "Linus -> tytso", now it's
> > https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/graphs/D36F769BC11804F0.svg?id=3dab90be2abbe5e36edbad698070ff390ea3f886
> 
> Yeah, that's a ltitle unfortunate, since I was originally one of the
> initial 4 "trusted introducers" when we were setting up the kernel
> keyring.  So dropping the signatures might affect some folks being
> considered trusted by some GPG configs.  I imagine that's much less
> important these days, though....

For someone who already has your key in their local keyring from an
earlier revision of the kernel keyring, the update does the right thing,
i.e. it just updates the expiry date for your key. So this is only an
issue for someone who newly imports your key now.

Also there is no key in the keyring that gets it's trustpath length over
the needed length of 4 due to your change.

Still I think we should fix your import or at least understand the
issue.

Best regards
Uwe

signature.asc (application/pgp-signature, 488 B)