Topic on Project:Support desk/Flow

gpg verification of the 1.32.0 signature fails

4 comments • 23:33, 13 January 2019 5 years ago

4

46.18.107.153 (talkcontribs)

When running the following:

># gpg --verify mediawiki-1.32.0.tar.gz.sig

gpg: Signature made Fri 11 Jan 2019 02:26:26 GMT using RSA key ID 875BE862

gpg: Can't check signature: No public key

>#

I get the following:

gpg: Signature made Fri 11 Jan 2019 02:26:26 GMT using RSA key ID 875BE862

gpg: Can't check signature: No public key

Reply 14:14, 12 January 2019 5 years ago

AKlapper (WMF) (talkcontribs)

Thanks for reporting. This should be fixed now in https://phabricator.wikimedia.org/T213521

Reply 20:54, 12 January 2019 5 years ago

MarkAHershberger (talkcontribs)

The key is given on the keys page and you can download it using gpg --recv 875BE862

$ gpg --recv-key 875BE862
gpg: key 131910E01605D9AA: "Mukunda Modell (WMF) <mmodell@wikimedia.org>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
$ gpg --list-key 875BE862
pub   rsa4096 2016-01-08 [SC] [expires: 2020-07-31]
      C83A8E4D3C8FEB7C8A3A1998131910E01605D9AA
uid           [  undef ] Mukunda Modell (WMF) <mmodell@wikimedia.org>
uid           [ unknown] Mukunda Modell <twentyafterfour@gmail.com>
uid           [  undef ] [jpeg image of size 2928]
sub   rsa4096 2018-12-25 [A] [expires: 2020-12-24]
sub   rsa4096 2018-12-25 [E] [expires: 2020-12-24]
sub   rsa4096 2018-12-26 [S] [expires: 2019-12-26]
$ gpg --verify mediawiki-1.32.0-rc.0.tar.gz.sig 
gpg: assuming signed data in 'mediawiki-1.32.0-rc.0.tar.gz'
gpg: Signature made Fri 09 Nov 2018 03:52:36 PM EST
gpg:                using RSA key 131910E01605D9AA
gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: classic
gpg: depth: 0  valid:   4  signed:  25  trust: 0-, 0q, 0n, 0m, 0f, 4u
gpg: depth: 1  valid:  23  signed:  33  trust: 22-, 0q, 0n, 1m, 0f, 0u
gpg: next trustdb check due at 2019-01-29
gpg: Good signature from "Mukunda Modell (WMF) <mmodell@wikimedia.org>" [full]
gpg:                 aka "Mukunda Modell <twentyafterfour@gmail.com>" [unknown]
gpg:                 aka "[jpeg image of size 2928]" [full]

I trust Modell's key because it is signed by Grossmeier's and Gossmeier and I have signed each other's keys in person.

Reply 20:54, 12 January 2019 5 years ago

46.18.107.153 (talkcontribs)

I think thats the problem the keys page does not contain that key. When I import from the keys page I get the following:

gpg: key 1605D9AA: "Mukunda Modell (WMF) <mmodell@wikimedia.org>" not changed

Reply 23:33, 13 January 2019 5 years ago

Reply to "gpg verification of the 1.32.0 signature fails"