On 22 April 2014 14:31, Stefan Hajnoczi <[email protected]> wrote: > On Wed, Apr 02, 2014 at 05:40:23PM -0700, Alex Davis wrote: >> and where is their gpg key? > > Michael Roth <[email protected]> is doing releases: > > http://pgp.mit.edu/pks/lookup?op=vindex&search=0x3353C9CEF108B584 > > $ gpg --verify qemu-2.0.0.tar.bz2.sig > gpg: Signature made Thu 17 Apr 2014 03:49:55 PM CEST using RSA key ID > F108B584 > gpg: Good signature from "Michael Roth <[email protected]>" > gpg: aka "Michael Roth <[email protected]>" > gpg: aka "Michael Roth <[email protected]>"
NB that this is different from the key used to sign the 2.0 release tags in git; that's expected since I did the tagging and Michael did the tarballs. thanks -- PMM
