[gentoo-user] OT: latest longterm kernel.org patches are unsigned

[gentoo-user] OT: latest longterm kernel.org patches are unsigned

[Ian Zimmerman]

If you browse this URL:

https://cdn.kernel.org/pub/linux/kernel/v4.x/

you'll see that for each 4.14 patch up to 4.14.58 there is a
cooresponding GPG signature file:

patch-4.14.58.sign 25-Jul-2018 09:28 833
patch-4.14.58.xz 25-Jul-2018 09:28 1M

etc.

But starting with 4.14.59, there are no .sign files.  Why?  Is this a
bug, and if so, where do I report it?

This breaks my lovingly duct-taped kernel update infrastructure ...

-- 
Please don't Cc: me privately on mailing lists and Usenet,
if you also post the followup to the list or newsgroup.
To reply privately _only_ on Usenet and on broken lists
which rewrite From, fetch the TXT record for no-use.mooo.com.

Re: [gentoo-user] OT: latest longterm kernel.org patches are unsigned

[Nils Freydank]

[-- Attachment #1: Type: text/plain, Size: 1390 bytes --]

Hi,

kernel.org won’t provide the signatures anymore. I was politely pointed
to the following site via IRC but got no reason for it.

https://www.kernel.org/category/site-news.html

--- Quote ---
No future PGP signatures on patches and changelogs

For legacy purposes, we will continue to provide pre-generated changelogs and 
patches (both to the previous mainline and incremental patches to previous 
stable). However, from now on they will be generated by automated processes 
and will no longer carry detached PGP signatures. If you require 
cryptographically verified patches, please generate them directly from the 
stable git repository after verifying the PGP signatures on the tags using git 
verify-tag.
--- EOQ ---



Am Freitag, 17. August 2018, 18:07:13 CEST schrieb Ian Zimmerman:
> If you browse this URL:
> 
> https://cdn.kernel.org/pub/linux/kernel/v4.x/
> 
> you'll see that for each 4.14 patch up to 4.14.58 there is a
> cooresponding GPG signature file:
> 
> patch-4.14.58.sign 25-Jul-2018 09:28 833
> patch-4.14.58.xz 25-Jul-2018 09:28 1M
> 
> etc.
> 
> But starting with 4.14.59, there are no .sign files.  Why?  Is this a
> bug, and if so, where do I report it?
> 
> This breaks my lovingly duct-taped kernel update infrastructure ...


-- 
GPG fingerprint: '00EF D31F 1B60 D5DB ADB8 31C1 C0EC E696 0E54 475B'
Nils Freydank

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] OT: latest longterm kernel.org patches are unsigned

[james]

On 8/17/18 12:07 PM, Ian Zimmerman wrote:
> If you browse this URL:
> 
> https://cdn.kernel.org/pub/linux/kernel/v4.x/
> 
> you'll see that for each 4.14 patch up to 4.14.58 there is a
> cooresponding GPG signature file:
> 
> patch-4.14.58.sign 25-Jul-2018 09:28 833
> patch-4.14.58.xz 25-Jul-2018 09:28 1M
> 
> etc.
> 
> But starting with 4.14.59, there are no .sign files.  Why?  Is this a
> bug, and if so, where do I report it?
> 
> This breaks my lovingly duct-taped kernel update infrastructure ...
> 

Ian,

Not sure this is related to your problem but it's an interesting read
about (intel) microcodes and current blocks being enforced by Gentoo,
clandestinely?


https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906158

https://bugs.gentoo.org/664134


Apologies if I research is fragmented or flawed...

hth,
James

Re: [gentoo-user] OT: latest longterm kernel.org patches are unsigned

[J. Roeleveld]

On August 20, 2018 9:33:03 PM UTC, james <garftd@verizon.net> wrote:
>On 8/17/18 12:07 PM, Ian Zimmerman wrote:
>> If you browse this URL:
>> 
>> https://cdn.kernel.org/pub/linux/kernel/v4.x/
>> 
>> you'll see that for each 4.14 patch up to 4.14.58 there is a
>> cooresponding GPG signature file:
>> 
>> patch-4.14.58.sign 25-Jul-2018 09:28 833
>> patch-4.14.58.xz 25-Jul-2018 09:28 1M
>> 
>> etc.
>> 
>> But starting with 4.14.59, there are no .sign files.  Why?  Is this a
>> bug, and if so, where do I report it?
>> 
>> This breaks my lovingly duct-taped kernel update infrastructure ...
>> 
>
>Ian,
>
>Not sure this is related to your problem but it's an interesting read
>about (intel) microcodes and current blocks being enforced by Gentoo,
>clandestinely?
>
>
>https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906158
>
>https://bugs.gentoo.org/664134
>
>
>Apologies if I research is fragmented or flawed...
>
>hth,
>James

Interesting read.
Can't update the bug at the moment, but downloading the microcode file worked and I didn't see any license agreement.

--
Joost
-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.