Re: Signing key has expired for Emacs for windows zip archive (?)

[Phillip Lord]

Yes, I didn't anticipate this when my key expired. I am working out what
to do about it, but the key has not been compromised.

Phil

"ISHIKAWA,chiaki" <ishikawa@yk.rim.or.jp> writes:

> Hi,
>
> I tried to download Emacs for Windows, based on the description of
> https://www.gnu.org/software/emacs/documentation.html
>
> Unfortunately, it seems that the signing key for the zip archive
> either has expired (or revoked?)
> or worse some serious issue might have crept in.
>
> The desription:
>
>
>      Windows
>
> GNU Emacs for Windows can be downloaded from a nearby GNU mirror
> <http://ftpmirror.gnu.org/emacs/windows>; or the main GNU FTP server 
> <http://ftp.gnu.org/gnu/emacs/windows/>.
> Unzip the zip file preserving the directory structure, and run
> |bin\runemacs.exe|. Alternatively, create a desktop shortcut to 
> |bin\runemacs.exe|, and start Emacs by double-clicking on that
>  shortcut's icon.
>
> The Windows binaries are signed by Phillip Lord |8E64 B119 FE4B AC58
> C767 D5EC E095 C1A6 3FB1 EAD2|.
>
>
> Well, I got the following error when I tried to verify the integrity
> of the archive.
>
> I could not figure out how to change the gpg's output changed into
> English, but
> it says the key was revoked by the owner.
>
> gpg: 08/30/19 22:04:16 東京 (標準時)に施された署名
>
> gpg: RSA鍵84930FFB79B645F7DEA29AD0AC6DD3FFD1D046BDを使用
>
> gpg: "Phillip Lord <phillip.lord@newcastle.ac.uk>"からの正しい署名 [期
> 限切れ]
>
> gpg: 別名"Phillip Lord <phillip.lord@russet.org.uk>" [期限切れ]
>
> gpg: *警告*: この鍵は所有者によって失効されています!
>
> gpg: 署名が偽物なこともある、ということです。
>
> gpg: 失効理由: 理由は指定されていません
>
> gpg: 失効のコメント: Revocation Certification produced at generation time
>
> gpg: 注意: この鍵は期限切れです!
>
> 主鍵フィンガープリント: 8493 0FFB 79B6 45F7 DEA2 9AD0 AC6D D3FF D1D0 46BD
>
> I am not sure what is going on, and could not resolve the issue after
> trying to update the key, etc.
> Note that the "8E64 B119 ..." is different from the GPG's message. It
> is possible that the old archive signed in August was
> signed with a different key, but somehow when I looked around "I got
> this "8493 0FFB ..." fingerprint.
>
> I think whoever maintains the archive ought to be aware of the issue.
>
> TIA
>
> Chiaki