linux-kernel - Re: [GIT PULL] arch/h8300 update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Aug 2018 06:36:53 -0700
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Yoshinori Sato <ysato@...rs.sourceforge.jp>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [GIT PULL] arch/h8300 update

On Wed, Aug 22, 2018 at 5:47 AM Yoshinori Sato
<ysato@...rs.sourceforge.jp> wrote:
>
> I fixed it.

Thanks.

However:

>   git://git.sourceforge.jp/gitroot/uclinux-h8/linux.git tags/for-4.19

Sorry to be such a worry-wart, but that tag is signed by a key I've
never seen before.

It looks like you used some truly ancient key of yours for the signing
- the new tag is signed with this:

  1024D/DC21AAD1 2004-10-18

while the previous tags I have from you are signed with

  4096R/0B28399C 2015-06-25

and the two keys don't even have any shared signatures.

I *suspect* you've just changed machines and that your old key is your
real key, and the one for 2015 you created just for kernel signing and
you forgot about it.

And I've pulled the code, but I would ask that if  you have both keys
available, please at least cross-sign them with each other.

Thanks,

                 Linus