linux-kernel - [PATCH] pgpkeys: use full keyid to trust Linus' key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230716-keyid-v1-1-bf14426a8279@weissschuh.net>
Date:   Sun, 16 Jul 2023 21:42:36 +0200
From:   Thomas Weißschuh <linux@...ssschuh.net>
To:     Konstantin Ryabitsev <konstantin@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org,
        Thomas Weißschuh <linux@...ssschuh.net>
Subject: [PATCH] pgpkeys: use full keyid to trust Linus' key

It's possible for fingerprints to collide.
To avoid that people accidentally trust an impersonated key document the
full key fingerprint.

Signed-off-by: Thomas Weißschuh <linux@...ssschuh.net>
---
 source/pgpkeys.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source/pgpkeys.rst b/source/pgpkeys.rst
index 78ba703ff42b..d036686c51dc 100644
--- a/source/pgpkeys.rst
+++ b/source/pgpkeys.rst
@@ -41,7 +41,7 @@ First, you should assign full trust to Linus's key (after importing it
 into your keyring)::
 
     $ gpg --import keys/79BE3E4300411886.asc
-    $ gpg --edit-key 79BE3E4300411886
+    $ gpg --edit-key ABAF11C65A2970B130ABE3C479BE3E4300411886
     gpg> trust
     gpg> 4
     gpg> q

---
base-commit: 8196a3c298d9b1f11be305c87eb890f44f7c8cc5
change-id: 20230716-keyid-8b0f50689d23

Best regards,
-- 
Thomas Weißschuh <linux@...ssschuh.net>