[arch-dev-public] sign packages on alderaan

[Ionut Biru]

On 11/12/2011 01:43 AM, Ray Rashif wrote:
> On 12 November 2011 07:35, Dan McGee <dpmcgee at gmail.com> wrote:
>> On Fri, Nov 11, 2011 at 5:31 PM, Ray Rashif <schiv at archlinux.org> wrote:
>>> On 31 October 2011 02:06, Florian Pritz <bluewind at xinu.at> wrote:
>>>> So far the only solution is to download the finished package, sign it
>>>> locally using gpg --detach-sign <file> and then uploading the signature
>>>> back to pkgbuild.com so commitpkg will find it.
>>>
>>> Did something change WRT this workflow now? I'm getting
>>> signature-incorrect from commitpkg. I did sign like this 2 times
>>> before (opencv and cinelerra-cv), so it did work recently. gpg
>>> --verify outputs:
>>>
>>> gpg: Can't check signature: public key not found
>>>
>>> But this is normal, and the public key was not there for the previous
>>> 2 times. Or was gpg --verify not there in commitpkg before? Do I now
>>> need to import my public key on alderaan?
>>
>> Is your key in your keychain on alderaan? Probably not from what this
>> looks like. Easy to check- `gpg --list-keys 0xfoobar`.
>>
>> -Dan
>>
> 
> Nope. That was what I was asking - whether I need to add it. The last
> 2 times that I pushed signed packages from alderaan I didn't do
> anything gpg-related remotely.
> 
> Anyway, imported the key now so all is good again.
> 
> 
> --
> GPG/PGP ID: C0711BF1

don't import any key on alderaan.

is a devtools requirement that a signature must exist to enforce
packagers to sign their packages. Imo we should try to do that
optionally on alderaan or even better, use svn commit and commitpkg only
locally after copying the packages.


-- 
Ionuț

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 554 bytes
Desc: OpenPGP digital signature
URL: <http://mailman.archlinux.org/pipermail/arch-dev-public/attachments/20111112/1e091cff/attachment.asc>