Re: New commit signing key?

[Ludovic Courtès]

Hi Julien,

Julien Lepiller <address@hidden> skribis:

> Le Mon, 27 Jan 2020 14:17:52 +0100,
> Ludovic Courtès <address@hidden> a écrit :
>
>> Hello Julien!
>> 
>> Unless I’m mistaken, starting from commit
>> 2cbede5935eb6a40173bbdf30a9ad22bf7574c22 you started signing with key:
>> 
>>   1EFB 0909 1F17 D28C CBF9  B13A 53D4 57B2 D636 EE82
>> 
>> instead of:
>> 
>>   B5FA E628 5B41 3728 B2A0  FAED 4311 1F45 2008 6A0C
>> 
>> Could you confirm that this is the case so we can update
>> ‘build-aux/git-authenticate.scm’ accordingly?  (Currently “make
>> authenticate” barfs.)
>> 
>> Preferably, reply with a message signed with your previous key stating
>> that the new fingerprint above is indeed yours.  Make sure to revoke
>> your previous key and send the revoked key (and the new one) to key
>> servers.
>> 
>> If you lost control of the old key, please state it (in a message
>> signed with the new key.)  I see
>> <https://savannah.gnu.org/users/roptat> contains the new key already.
>>  The old one is due to expire on 2020-03-27 anyway.
>> 
>> Thanks in advance!
>> 
>> Ludo’.
>
> Hi Ludo,
>
> not sure if signing this message will help prove anything, but well...

Yeah, though like I wrote, the person who did it was able to log in to
Savannah, so there are chances that it’s really the Julien we know.

> I accidentally destroyed the only copy of my previous key (hardware
> issue...), so I don't think I can recover it. I don't have a way to
> revoke it, so I'll let it expire.

OK, no problem.

Note that going forward we’ll have to be careful, because the goal is
for ‘guix pull’ to bail out with an error in such a situation.  So we
must get used to updating the list of authorized keys before using a new
key.

Anyhow, thanks for your reply!

Ludo’.