On 6. 10. 2026 10:57, Ivan Zhakov wrote:
On Mon, 5 Oct 2026 at 19:42, Branko Čibej <[email protected]> wrote:
On 24. 9. 2026 13:21, Evgeny Kotkov via dev wrote:
The 1.15.0 release artifacts are now available for testing/signing.
Please get the tarballs from
https://dist.apache.org/repos/dist/dev/subversion
and add your signatures there.
Note: 1.15.0 tarballs should be functionally identical to 1.15.0-rc4 (they
are built from the same revision r1937767), with the only difference being
in the version number.
Thanks!
I have an issue with the signatures for the .zip file:
gpg: assuming signed data in 'dev/subversion-1.15.0.zip'
... skipped sig from Evgeny
gpg: Signature made Fri Sep 25 12:54:09 2026 CEST
gpg: using RSA key D6678482E2ED5750E28B69292FB22D0D4ADC662A
gpg: key 2FB22D0D4ADC662A: new key but contains no user ID - skipped
gpg: Can't check signature: No public key
I have the key in my keyring, but a public key without a user ID
isn't valid. Could whoever owns this key add an ID and upload the
updated key, please? Ivan, I think that's your new key, given what
I see in the logs?
It's my key.
It's the same key that I used to sign Subversion 1.15.0-rc4.
It's available on people.apache.org <http://people.apache.org>:
https://people.apache.org/keys/committer/ivan
And PGP keyservers:
https://keyserver.ubuntu.com/pks/lookup?search=D667+8482+E2ED+5750+E28B++6929+2FB2+2D0D+4ADC+662A&fingerprint=on&op=index
<https://keyserver.ubuntu.com/pks/lookup?search=D667+8482+E2ED+5750+E28B++6929+2FB2+2D0D+4ADC+662A&fingerprint=on&op=index>
https://keys.openpgp.org/vks/v1/by-fingerprint/D6678482E2ED5750E28B69292FB22D0D4ADC662A
I also see it in the subversion-1.15.0.KEYS file.
[[[
ASF ID: ivan
LDAP PGP key: D667 8482 E2ED 5750 E28B 6929 2FB2 2D0D 4ADC 662A
pub rsa4096/2FB22D0D4ADC662A 2026-07-14 [SC]
Key fingerprint = D667 8482 E2ED 5750 E28B 6929 2FB2 2D0D 4ADC 662A
uid [ unknown] Ivan Zhakov (CODE SIGNING KEY)
<[email protected]>
sub rsa4096/C62470648595D168 2026-07-14 [E]
Key fingerprint = 9F3F 4DF5 6E1A EF95 73AB F318 C624 7064 8595 D168
....
]]]
May be I am missing something?
Or maybe I am. I didn't see this key in my rc4 tests, because I did the
signature check before you signed. Could it be gpg somehow got an
incomplete copy of it? That would be a huge bug, but I guess it's
possible. Let me check ...
... so it turns out that your key did not propagate correctly to
keys.openpgp.org which I use by default, this is what I get:
$ gpg --keyserver hkps://keys.openpgp.org --recv-keys 2FB22D0D4ADC662A
gpg: key 2FB22D0D4ADC662A: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg: w/o user IDs: 1
but I can retrieve it from keyserver.ubuntu.com:
$ gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 2FB22D0D4ADC662A
gpg: key 2FB22D0D4ADC662A: public key "Ivan Zhakov (CODE SIGNING
KEY)<[email protected]>" imported
gpg: Total number processed: 1
gpg: imported: 1
I did not expect this at all. You should probably look into it.
-- Brane
