linux-kernel - Re: Linux 5.2.10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 26 Aug 2019 06:33:28 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Sasha Levin <sashal@...nel.org>
Cc:     Jörg-Volker Peetz <jvpeetz@....de>,
        stable@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: Linux 5.2.10

On Sun, Aug 25, 2019 at 06:35:38PM -0400, Sasha Levin wrote:
> Thanks for looking into this!
> 
> On Sun, Aug 25, 2019 at 05:26:37PM +0200, Jörg-Volker Peetz wrote:
> > Where can I find your public gpg key and it's fingerprint?
> > It's not yet documented on https://www.kernel.org/category/signatures.html .
> 
> You're right, I'll send a patch to add my fingerprint as well.
> 
> > I'm asking because the "gpg --locate-keys" method does not work for me.
> 
> I can confirm this, and this is weird... I see a kernel.org UID on the
> key, and gpg seems to confirm that as well:
> 
> $ gpg --quick-add-uid DEA66FF797772CDC 'Sasha Levin <sashal@...nel.org>'
> gpg: Such a user ID already exists on this key!
> 
> Let me contact kernel.org support to see what I'm doing wrong...

Looks like everything is correct from my end:

$ git tag -v v5.2.10
object f7d5b3dc4792a5fe0a4d6b8106a8f3eb20c3c24c
type commit
tag v5.2.10
tagger Sasha Levin <sashal@...nel.org> 1566742490 -0400

This is the 5.2.10 stable release
gpg: Signature made Sun 25 Aug 2019 04:14:50 PM CEST
gpg:                using RSA key E27E5D8A3403A2EF66873BBCDEA66FF797772CDC
gpg: Good signature from "Sasha Levin <sashal@...nel.org>" [unknown]
gpg:                 aka "Sasha Levin <sasha.levin@...cle.com>" [undefined]
gpg:                 aka "Sasha Levin <alexander.levin@...izon.com>" [unknown]
gpg:                 aka "Sasha Levin <alexander.levin@...rosoft.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: E27E 5D8A 3403 A2EF 6687  3BBC DEA6 6FF7 9777 2CDC

I'll go add yours and Ben's fingerprints to the kernel.org website so
that others can verify it there.

thanks,

greg k-h