Re: Possible error re Savannah in "Information for Maintainers of GNU Software"

[Alfred M. Szmidt]

   I'm writing to report an apparent contradiction in Section 11.6.1 
   ("Automated Upload Registration") of the Information for Maintainers of 
   GNU Software guide at 
   
<https://www.gnu.org/prep/maintain/maintain.html#Automated-Upload-Registration>.

Thanks!

   The second list item in this section instructs developers to upload 
   their GPG package signing key "In the 'My Account Conf' page on 
   savannah".  However, that page (visible at 
   <https://savannah.gnu.org/my/admin/> for logged-in users) has an "Edit 
   GPG Key" section which seems to instructs developers that the proper 
   place to upload their signing keys is elsewhere:

    > Keys for signing releases are registered in the "Public Information"
    > area of your group.

It depends on _where_ you upload, so both are true, the "Public
Information" key is used for non-GNU project uploads to Savannah.  GNU
projects need to submit the key to ftp-upload@gnu.org to be able to
upload to ftp.gnu.org.

   Even more confusingly, following the "Edit GPG Key" link takes you to a 
   form, <https://savannah.gnu.org/my/admin/change.php?item=gpgkey>, that 
   seems to accept signing keys:

    > For GNU maintainers: If these keys are to be used for GNU uploads,
    > you must also email them to ftp-upload@gnu.org. There is no automatic
    > propagation. See the GNU Maintainer Information, node Automated Upload
    > Registration.

   The last three words in that message link back to Section 11.6.1 of the 
   aforementioned guide.

I am not sure what is confusing?

If you wish to upload to Savannah, you need to upload your key to
"Public Information".

If you wish to upload to ftp.gnu.org, you need to send your key to
ftp-upload@gnu.org.