Hi, David. On Mon, Oct 1, 2018 at 8:59 AM David Sommerseth <[email protected]> wrote: > > On 30/09/18 23:14, Jonathan K. Bullard wrote: > > I downloaded openvpn-2.4.6.tar.gz and the associated GnuPG signature, > > but the signing key seems to have expired before it was signed: > > > > $gpg2 -v --verify openvpn-2.4.6.tar.gz.asc > > gpg: assuming signed data in '/***/openvpn-2.4.6.tar.gz' > > gpg: Signature made Tue Apr 24 03:14:52 2018 EDT > > gpg: using RSA key D518B9BD643CF94DA5ED9970F132B1CBAF131CAE > > gpg: Note: signature key D72AF3448CC2B034 expired Tue Mar 6 07:17:50 2018 > > EST <snip> > The important line is this one: > > > gpg: Good signature from "OpenVPN - Security Mailing List" > > Yes, the signing key we used has expired, as we only have 1 year life time on > them. But we would need to re-sign all packages to get rid of this. Which > would not give anything but removing the warnings that the key used has > expired.
Thanks for your confirmation that the signature is good. But I was not saying that the key has expired *today*. I was saying that the key had already expired at the time it was used to create the signature: the key was used to create the signature several weeks *after* it had expired. Or was the expired key not actually used to create the signature and the note was irrelevant noise from GnuPG? > Also realise that this is just a "Note", not an error. That's one reason why I only got around to asking about this now -- it didn't seem urgent. The other reason was that the key had only expired a few weeks before the signature was created. If it had expired years before I might suspect that the key had been compromised. Best regards, Jon Bullard On Mon, Oct 1, 2018 at 8:59 AM David Sommerseth <[email protected]> wrote: > > On 30/09/18 23:14, Jonathan K. Bullard wrote: > > I downloaded openvpn-2.4.6.tar.gz and the associated GnuPG signature, > > but the signing key seems to have expired before it was signed: > > > > $gpg2 -v --verify openvpn-2.4.6.tar.gz.asc > > gpg: assuming signed data in '/***/openvpn-2.4.6.tar.gz' > > gpg: Signature made Tue Apr 24 03:14:52 2018 EDT > > gpg: using RSA key D518B9BD643CF94DA5ED9970F132B1CBAF131CAE > > gpg: Note: signature key D72AF3448CC2B034 expired Tue Mar 6 07:17:50 2018 > > EST > > gpg: using subkey F132B1CBAF131CAE instead of primary key 12F5F7B42F2B01E7 > > gpg: Note: signature key D72AF3448CC2B034 expired Tue Mar 6 07:17:50 2018 > > EST > > gpg: using pgp trust model > > gpg: Good signature from "OpenVPN - Security Mailing List > > <[email protected]>" [unknown] > > gpg: Note: signature key D72AF3448CC2B034 expired Tue Mar 6 07:17:50 2018 > > EST > > gpg: WARNING: This key is not certified with a trusted signature! > > gpg: There is no indication that the signature belongs to the > > owner. > > Primary key fingerprint: F554 A368 7412 CFFE BDEF E0A3 12F5 F7B4 2F2B 01E7 > > Subkey fingerprint: D518 B9BD 643C F94D A5ED 9970 F132 B1CB AF13 1CAE > > gpg: binary signature, digest algorithm SHA256, key algorithm rsa4096 > > > > Any ideas? > > The important line is this one: > > > gpg: Good signature from "OpenVPN - Security Mailing List" > > Yes, the signing key we used has expired, as we only have 1 year life time on > them. But we would need to re-sign all packages to get rid of this. Which > would not give anything but removing the warnings that the key used has > expired. > > Also realise that this is just a "Note", not an error. > > > -- > kind regards, > > David Sommerseth > OpenVPN Inc > > _______________________________________________ Openvpn-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openvpn-users
