On Thu, Sep 26, 2019 at 12:29:02AM +0200, José Luis Blanco-Claraco wrote:
> I'm the maintainer of the upstream library, and have just released
> upstream bug-fix release (v1.5.8) which also comes with an updated
> debian/control per this original bug report.
> It would be great if some of you could sponsor its upload so this bug
> gets fixed asap...
>
> The new package for version 1.5.8 has been tested with pbuilder to
> build cleanly and to be lintian clean on "sid".
> However, I uploaded it twice today to mentors.debian.net without any
> error but it won't show on the web... so I'll leave a copy here:
> 
> https://ingmec.ual.es/~jlblanco/downloads/mrpt_1.5.8-1.dsc

The key this is signed with isn't one of the 3 keys in:

mrpt-1.5.6/debian/upstream/signing-key.asc

key 9AA38DCD55BE302B: "Debian Archive Automatic Signing Key (5.0/lenny) 
<ftpmas...@debian.org>"
key 4F9946354E9CFF4E: "Spotify Public Repository Signing Key 
<operati...@spotify.com>"
key D443304FBD70A641: "Jose Luis Blanco (University of Malaga)
<joseluisblan...@gmail.com>"

(I also wonder if the first two should be there at all...)

I'm afraid this is too big a change for me to be comfortable sponsoring
without any sort of trust path.  I'm happy to NMU just the update that's
actually needed to fix this bug though.

Cheers,
    Olly

Reply via email to