Skip to content

doc: ensure that GPG key used to sign the latest LTS release (12.6.1), as well as 13.12.0, & 8.16.0 - #32565

Closed
haqer1 wants to merge 1 commit into
nodejs:masterfrom
haqer1:signing-key-fixup-alternative-approach
Closed

doc: ensure that GPG key used to sign the latest LTS release (12.6.1), as well as 13.12.0, & 8.16.0 #32565
haqer1 wants to merge 1 commit into
nodejs:masterfrom
haqer1:signing-key-fixup-alternative-approach

Conversation

@haqer1

Copy link
Copy Markdown
Contributor

… is mentioned in README(.md) (alternative approach (just in case decision-makers want to keep C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8 key listed higher (as current) & 0EFFE1BCEFD9C84E3D098152933B01F40B5CA946 lower (as older)))

Update README.md.

Fixes: #32559

Checklist

… is mentioned in README(.md) (alternative approach)
Update README.md.
Fixes: nodejs#32559

@MylesBorinsMylesBorins left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PTAL at #32560 (comment) as to why I don't think this should land

@haqer1

Copy link
Copy Markdown
ContributorAuthor

Just in case, i'm also listing the error the user gets at present in French:

$ gpg --verify SHASUMS256.txt.sig SHASUMS256.txt
gpg: Signature faite le ...
gpg: avec la clef RSA 0EFFE1BCEFD9C84E3D098152933B01F40B5CA946
gpg: Impossible de vérifier la signature : Pas de clef publique

IMHO, because
0EFFE1BCEFD9C84E3D098152933B01F40B5CA946
is not listed in
https://github.com/nodejs/node/blob/master/README.md
either this PR or #32560 should land.

P.S. IMHO, users shouldn't be required to spend extra time on this (for whatever reason this has happened), while there is a section in README(.md) which is specifically made to facilitate signature verification. So at present (assumingly) all the keys for (assumingly) all the releases are listed there, except this 1 key for this 1 LTS release. Which is why i've spent some time to ask for it to be corrected.

@haqer1

Copy link
Copy Markdown
ContributorAuthor

The same stuff as in #32560 (comment), but preserving spaces (& in French):

.../nodejs/8.16.0$ gpg --verify SHASUMS256.txt.sig SHASUMS256.txt
gpg: Signature faite le <date/>
gpg: avec la clef RSA 0EFFE1BCEFD9C84E3D098152933B01F40B5CA946
gpg: Impossible de vérifier la signature : Pas de clef publique
.../nodejs/13.12.0$ gpg --verify SHASUMS256.txt.sig SHASUMS256.txt
gpg: Signature faite le <date/>
gpg: avec la clef RSA 0EFFE1BCEFD9C84E3D098152933B01F40B5CA946
gpg: Impossible de vérifier la signature : Pas de clef publique

The fact that users see 0EFFE1BCEFD9C84E3D098152933B01F40B5CA946 for (at least) 3 releases, IMHO, is an argument in favor of landing #32560 (as opposed to this PR).

@haqer1haqer1 changed the title doc: ensure that GPG key used to sign the latest LTS release (12.6.1)…doc: ensure that GPG key used to sign the latest LTS release (12.6.1), as well as 13.12.0, & 8.16.0 Apr 1, 2020
@MylesBorins

Copy link
Copy Markdown
Contributor

Landed #32591 instead

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docIssues and PRs related to the documentations.

Projects

None yet

3 participants

@haqer1@MylesBorins@nodejs-github-bot