[packman] Packman signing keys will expire...

[Manfred Hollstein]

Moin,

now that the keys have expired, rpm complains loudly:

  # rpm -qa > /dev/null
  error: Key 9045a0016946124b (Essentials OBS Project <Essentials at packman.links2linux.de>) expired on 2025-06-29 18:03:43
  ...

As I wrote below, I pull the packages directly from pmbs.links2linux.de,
not from the mirrors. Either way, someone may need to generate new keys.

TIA, cheers.

l8er
manfred

On Tue, 17 Jun 2025, 21:21:36 +0200, Manfred Hollstein wrote:
> Hi Stefan,
> 
> On Tue, 17 Jun 2025, 20:25:08 +0200, Stefan Seyfried wrote:
> > Hi Manfred,
> > 
> > Am 17.06.25 um 14:05 schrieb Manfred Hollstein:
> > > Hi there,
> > > 
> > > $ sudo zypper ref
> > > ...
> > > The gpg key signing file 'repomd.xml' will expire in 14 days.
> > >    Repository:       packman-multimedia.obs
> > >    Key Fingerprint:  5302 7CA5 85A8 0281 6CB3 B2C3 CB78 7E2A 6058 7B34
> > >    Key Name:         Multimedia OBS Project <Multimedia at packman.links2linux.de>
> > >    Key Algorithm:    RSA 2048
> > >    Key Created:      Mon Apr 24 12:51:59 2023
> > >    Key Expires:      Wed Jul  2 12:51:59 2025 (expires in 14 days)
> > >    Rpm Name:         gpg-pubkey-60587b34-64465f4f
> > > ...
> > > The gpg key signing file 'repomd.xml' will expire in 12 days.
> > >    Repository:       packman.obs
> > >    Key Fingerprint:  52B1 F263 223D 311D 1FD0 4140 9045 A001 6946 124B
> > >    Key Name:         Essentials OBS Project <Essentials at packman.links2linux.de>
> > >    Key Algorithm:    RSA 2048
> > >    Key Created:      Fri Apr 21 18:03:43 2023
> > >    Key Expires:      Sun Jun 29 18:03:43 2025 (expires in 12 days)
> > >    Rpm Name:         gpg-pubkey-6946124b-6442b3df
> > > 
> > > Dunno who can update the keys, but thought I'd report this.
> > 
> > Obs auto-extends these keys normally, and at least the essentials key seems
> > to be extended already:
> > 
> > $ posc signkey Essentials|gpg
> > gpg: WARNING: no command supplied.  Trying to guess what you mean ...
> > pub   rsa2048 2014-05-15 [SC] [expires: 2027-08-25]
> >       52B1F263223D311D1FD041409045A0016946124B
> > uid           Essentials OBS Project <Essentials at packman.links2linux.de>
> > 
> > Multimedia is not yet:
> > $ posc signkey Multimedia|gpg
> > gpg: WARNING: no command supplied.  Trying to guess what you mean ...
> > pub   rsa2048 2014-05-15 [SC] [expires: 2025-07-02]
> >       53027CA585A802816CB3B2C3CB787E2A60587B34
> > uid           Multimedia OBS Project <Multimedia at packman.links2linux.de>
> 
> OK, this is really good!
> 
> > But what repo URLs do you use to get the "raw" packman repos? Normally the
> > repos (and packages) are re-sigened with this key:
> 
> http://pmbs.links2linux.de:8080/Essentials/$releasever/
> http://pmbs.links2linux.de:8080/Multimedia/$releasever/
> http://pmbs.links2linux.de:8080/Extra/$releasever/
> 
> > pub   rsa4096 2006-09-18 [SC] [expires: 2026-09-03]
> >       F8875B880D518B6B8C530D1345A1D0671ABD1AFB
> > uid           PackMan Project (signing key) <packman at links2linux.de>
> > 
> > before being sent to the mirrors...
> 
> Yep, I pull the stuff directly from PMBS...
> 
> > Best regards,
> > -- 
> > Stefan Seyfried
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.links2linux.de/pipermail/packman/attachments/20250702/60ef33a1/attachment.sig>