Control: tag 1012524 + patch - pending
A patch to match against any authorsied keys is attached.
Without this change uscan will error out when encoutering
future releases not signed with the current key — even if
the key used is authorised for release signatures.
The contents of signing-key.asc can be inspected
and verified with `gpg --list-packets`. Note that
not for all keys, signing and primary key are identical.
MAINTAINERS lists and the output of verification commands
typically shows the former, but both appear in gpg -k
and gpg --list-packets.
Alternatively, the new content can be reproduced by following these steps
(assuming gpg does not fetch additional signatures for the imported
keys from its default keyring or so. If unsure, temporarily rename ~/.gnupg):
alias gpg_t='command gpg --no-default-keyring --keyring /tmp/tmp.keys'
curl https://github.com/astiob.gpg | gpg_t --import -
curl https://github.com/TheOneric.gpg | gpg_t --import -
curl https://github.com/rcombs.gpg | gpg_t --import -
gpg_t --export --export-options export-minimal --armor >
debian/upstream/signing-key.asc
# To verify which keys are included
gpg --list-packets debian/upstream/signing-key.asc
The export options are copied from uscan’s man page.
Cheers
Oneric
From ee09c54c1728e1757608b5160edf66b9a2109245 Mon Sep 17 00:00:00 2001
From: Oneric
Date: Wed, 29 Jun 2022 17:05:40 +0200
Subject: [PATCH] Add alternate signing keys
Upstream's release note for 0.16.0 announced that the release may
be signed with other keys in the future. A list of authorised keys was
included in the MAINTAINERS file of (signed) tarball.
Additionally, the git commit adding this file is also signed by the
same key as the release tarball and future changes are promised to be
signed with an pre-existing key.
Without adding the additional authorised keys, uscan will error out
when encoutering future releases not signed with the current key.
To verify which keys are in signing-key.asc, `gpg --list-packets` can
be used and the output checked against the IDs listed in MAINTAINERS.
---
debian/upstream/signing-key.asc | 137 +++-
1 file changed, 133 insertions(+), 4 deletions(-)
diff --git a/debian/upstream/signing-key.asc b/debian/upstream/signing-key.asc
index 77c8d9f..c611b07 100644
--- a/debian/upstream/signing-key.asc
+++ b/debian/upstream/signing-key.asc
@@ -45,8 +45,137 @@ OtUMRG8I/EfGyhYH+PN2cHa9VGIss//OJWTpCfnAyD3g4qVRcYAnbtK2jVVe9wJS
6zDhMMUJ9QHjMLRFi06f/MHxuES34UhFTmRx1oWv+OUlYCBFWTblI8OXSbgTjsJy
i1zbNywyGrGjUVv0GrrWq7L0b/bukqBObhyeWpl2kED2+/llZb4rn93GB4VSqvkr
jkGWoF8NU7ZhwpVEB3M0j3Z8GsctvQ6NIpFqGf3uNQsk1qngUnMqNZE3zHCnt8Do
-dUi2f9uJDlzXNQ5LAgj2pVnqreUwqIh4BBgRCAAJBQJNlOPMAhsMACEJEIB50Ywh
-qqr/FiEEVFjDEAZx8lKw9MdwgHnRjCGqqv+9QgEAoTdOzovu5crCzIbwpBw62IkC
-oe9yiIkrDfNxun95uWwA/jP6yvA884C98+/WFIl4JPtxpljOYlbtyab0zKhhaZwf
-=EtRt
+dUi2f9uJDlzXNQ5LAgj2pVnqreUwqIhhBBgRCAAJBQJNlOPMAhsMAAoJEIB50Ywh
+qqr/vUIBAKE3Ts6L7uXKwsyG8KQcOtiJAqHvcoiJKw3zcbp/eblsAP4z+srwPPOA
+vfPv1hSJeCT7caZYzmJW7cmm9MyoYWmcH5kCDQRhNOowARAA3MqpsowLf42S6qXe
+h1xrUHNTRMb1v3nEP29uGWx9SjJBB2TKw0U7+nTSQwInU0zHTaiAmbgG3v2sG6sw
+bI28iBPkb9hpF13zsFzlrb8ZSrqKRGyQ3J/O5w8/kcIn+OYeQCE8Up5nwkwWYnl0
+iyEJuoTZyKshm0HaDazxuGvlisQa8FXnT9V/6D99HJQEzVvC5Sghvh8iROW3+J3s
+geCVjGsFYtoM/xKneKUV9g6MD1tELlWTjPayzmbbzQzKGXk27hN1u88I2lY23ohQ
+6V1+jy5jZoJfyQnUFqIx/hGPuHg+frdhYFqD7IVmAaGFRuKJyqG3Re1UYTvTLSle
+kJXuLlfbeE3hTqec3/KLC1EaB5hB/rnGCGVP3muY/nJu3oF+hLheN6OEBH5WY7P0
+TKGINEGSOEJkW/mvsVnPJOCMzkDWvGpkLtmVZqjoa3jaVoQ17JCMAhKQlp038wC4
+/phEDte407EMD+UUVvians6baqSl7J9pkS9n1iPqF/BMc/x7lW5VeSFhVZEDq04T
+uWIzkkdqZERFt4MO71dJG4zf05adFZelz+hKLGr9nHL+vG2rYTj41j1BEMS6MvRH
+DoWwHzRG53SiulGDLVqWvn68YJul/5aByED+dfu6Il0cxFW3oE+C1e7tmdDGWgr8
+1lJtYudt8Q7WlF1/s7K3uNzOsksAEQEAAbQZT25lcmljIDxvbmVyaWNAb25lcmlj
+LmRlPokCVAQTAQgAPhYhBF7mPypxvxMs/jVn4d/+YV8oJMcgBQJhNOowAhsDBQkN
+KGiABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEN/+YV8oJMcgPMAP/RMGUKjx
+MIeiyf0vLnvGpTSdVMX9jdm8A7MmOex44U/AB0UfpQEoYpLX59EPvxsMBhQLMQmA
+zILF1GGRncfLNetRbxaKrXbNSplC2FMFbVnDneX9lzjXsw8MXxT8K0P8D9NDgoUb
+AMn6o1MXyye9TjtgCKOEqXxSUAU0z8sh9ruEt0GKevfhU5OlExxaRRx6E1SSsFHp
+To2qyxRj8uF+vFuKppBlHuhP8sbWRiANgiUdAHGbyLbTJhj9qX6BITt5C9vPqExo
+uJUfUtnQs3C6P1wfYKobEPKodY52eBemE1w4hDAZivN+5AEUsApaYcxwzks4Dr9A
+vBfLDSKGWG+yPobS/LWqoDAOnjGzmEkjVkPwIElBEhitDZdh3WpYFYU848AEpVG+
+m8tic3vp5BleBxjH2WDDVTsHsOaL3loJ3YAluFWHuAp/IKNMO5tnU4x8FbCv1hoe
+H5s/m80aThGcGwJOwN9YGdUIG9KtqufghVfiBvpn2q3XujpKmN52EopauQw3sUda
+0pD2Q7BnXH30ggihOPVuTF64TkLOe4nXLbsrKu0PQfHOZMSbLRYO36/rZD4KRMBF
+RW4Ex7w9ijCjjgPE82Bvrf/T8n5ije+2SqbYl/WMkZd8e6H3wvP9VlbBKE4wDKNY
+U5tjB97pY3fyiCv9/P+kNcUl4EWcDHDqvBQEuQINBGE06sABEADcZCBCxKKF7yMk
+qQjZrZiHOknhUoUOV6rc7CYBji+30MZ9s2ml522OhH5eCsplM1a6Ya04OJBUDJzF
+aAj6zhgMnkJLXv4VIvJvCGbPYDsRm1eRpx7xyXN2LWWSv6gJ2Hl0yRUp5UjSsrjD
+Ym4Om326MbhvqDzKktWB8XDgftzMd8tOkblJl5eLVHtMp/3SPoyRw+NGrf3+m029
+aYovxgcGIDdWZ1n62k5MQ+G4IxYs5SUSPKoYY//h2SrTtOE6eXiBatPnjh8klq1U
+5UOg/rAbzWXCO2gksXDFkEJ1DfkZvdXMBWqfWum8qlHODMuf1cqPdcoMF5EwhV74
