Devuan bug report logs - #705
Update failed due to an invalide signature

Package: amprolla; Severity: critical; Reported by: Klaus Ethgen <[email protected]>; merged with #704; Done: Mark Hindley <[email protected]>; Maintainer for amprolla is (unknown).

Message received at [email protected]:

References: <[email protected]>
 <[email protected]>
 <[email protected]>
 <[email protected]>
 <874jxkvn0n.fsf@quark>
 <[email protected]>
From: Olaf Meeuwissen <[email protected]>
To: Daniel Reurich <[email protected]>
Cc: devuan developers internal list <[email protected]>,
        Klaus Ethgen <[email protected]>, [email protected]
Subject: Re: [devuan-dev] bug#705: Acknowledgement (Update failed due to an
 invalide signature)
In-reply-to: <[email protected]>
Date: Sat, 10 Sep 2022 14:30:47 +0900
Message-ID: <87bkrn94oo.fsf@quark>
MIME-Version: 1.0
Content-Type: text/plain

Hi,

Daniel Reurich writes:

> On 6/09/22 22:02, Olaf Meeuwissen wrote:
>> Hi,
>>
>> Daniel Reurich writes:
>>
>>> Yes the key expired, and I probably noticed first by virtue of living in
>>> the future compared to everyone else.
>>>
>>> We should be adding a new signing key each release for the next future
>>> release, and ensuring it will endure for at least 2 future release.
>>> This should be done immediately following a release.
>>
>> ACK, but predicting how long it will take for the next two releases to
>> see the light of day is not exactly easy because Debian/Devuan release
>> when ready.
>
> I agree, so we err on the side of caution and plan for atleast 2 release
> cycles that way there should always be a working key in every release,
> but the old key carries through long enough if the release cycle time
> suddenly doubles.
>
>> How about uploading a new devuan-keyring package to stable-updates and
>> unstable when the key's validity period has reached roughly 1/3 of its
>> initial value?  So if you start with a key that's valid for the next 3
>> years, you would upload that new devuan-keyring package 2 years later.
>> This is completely independent of the release cycle and should work if
>> I'm not badly mistaken.
>
> I'd been thinking 5 years expiry so it's not really about prediction at
> all.  I'm more concerned about making it a part of the standard release
> cycle rather then letting it be forgotten about causing this current hiccup.

Which is why I suggested putting key renewal on a fixed schedule.  With
5 years (60 months), you'd put out a new key 40 months later.  You could
even put it, or at least a reminder to do so, in a cron job ;-)

>> FTR, this idea is shamelessly stolen from the way cert-manager handles
>> TLS certificates in Kubernetes clusters by default, be it that uses 90
>> days for the certificate's validity period.
>>
>>> This should be part of our "New Release - Devuan Devs guide to managing
>>> the new release process." - if such a document should exist.  (If it
>>> doesn't maybe we should create it.)

--
Olaf Meeuwissen

Acknowledgement sent to Olaf Meeuwissen <[email protected]>:
Extra info received and forwarded to list. Copy sent to Evilham <[email protected]>. Full text available.

Information forwarded to [email protected], Evilham <[email protected]>:
bug#705; Package amprolla. Full text available.

Notification sent to Alter Kim <[email protected]>:
bug acknowledged by developer. Full text available.

Reply sent to Mark Hindley <[email protected]>:
You have taken responsibility. Full text available.

Message received at [email protected]:

Date: Fri, 9 Sep 2022 18:14:39 +0100
From: Mark Hindley <[email protected]>
To: Klaus Ethgen <[email protected]>, [email protected]
Subject: Re: bug#705: Update failed due to an invalide signature
Message-ID: <[email protected]>
References: <[email protected]>
 <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <[email protected]>

On Fri, Sep 09, 2022 at 06:05:38PM +0100, Mark Hindley wrote:
> Thanks. The key used by amprolla has now been changed and upgrades are working
> normally again.

Closing as resolved.

Thanks

Mark

Notification sent to Klaus Ethgen <[email protected]>:
bug acknowledged by developer. Full text available.

Reply sent to Mark Hindley <[email protected]>:
You have taken responsibility. Full text available.

Merged 704 705 Request was from [email protected] to [email protected]. Full text available.

bug reassigned from package 'devuan' to 'amprolla'. Request was from Mark Hindley <[email protected]> to [email protected]. Full text available.