On Tue, 6 Oct 2026 at 13:42, Branko Čibej <[email protected]> wrote: > On 6. 10. 2026 10:57, Ivan Zhakov wrote: > > On Mon, 5 Oct 2026 at 19:42, Branko Čibej <[email protected]> wrote: > >> On 24. 9. 2026 13:21, Evgeny Kotkov via dev wrote: >> >> The 1.15.0 release artifacts are now available for testing/signing. >> Please get the tarballs from >> https://dist.apache.org/repos/dist/dev/subversion >> and add your signatures there. >> >> Note: 1.15.0 tarballs should be functionally identical to 1.15.0-rc4 (they >> are built from the same revision r1937767), with the only difference being >> in the version number. >> >> Thanks! >> >> >> I have an issue with the signatures for the .zip file: >> >> gpg: assuming signed data in 'dev/subversion-1.15.0.zip' >> ... skipped sig from Evgeny >> gpg: Signature made Fri Sep 25 12:54:09 2026 CEST >> gpg: using RSA key D6678482E2ED5750E28B69292FB22D0D4ADC662A >> gpg: key 2FB22D0D4ADC662A: new key but contains no user ID - skipped >> gpg: Can't check signature: No public key >> >> >> I have the key in my keyring, but a public key without a user ID isn't >> valid. Could whoever owns this key add an ID and upload the updated key, >> please? Ivan, I think that's your new key, given what I see in the logs? >> >> It's my key. > > It's the same key that I used to sign Subversion 1.15.0-rc4. > > It's available on people.apache.org: > https://people.apache.org/keys/committer/ivan > > And PGP keyservers: > > https://keyserver.ubuntu.com/pks/lookup?search=D667+8482+E2ED+5750+E28B++6929+2FB2+2D0D+4ADC+662A&fingerprint=on&op=index > > https://keys.openpgp.org/vks/v1/by-fingerprint/D6678482E2ED5750E28B69292FB22D0D4ADC662A > > I also see it in the subversion-1.15.0.KEYS file. > [[[ > ASF ID: ivan > LDAP PGP key: D667 8482 E2ED 5750 E28B 6929 2FB2 2D0D 4ADC 662A > > pub rsa4096/2FB22D0D4ADC662A 2026-07-14 [SC] > Key fingerprint = D667 8482 E2ED 5750 E28B 6929 2FB2 2D0D 4ADC 662A > uid [ unknown] Ivan Zhakov (CODE SIGNING KEY) < > [email protected]> > sub rsa4096/C62470648595D168 2026-07-14 [E] > Key fingerprint = 9F3F 4DF5 6E1A EF95 73AB F318 C624 7064 8595 D168 > .... > ]]] > > May be I am missing something? > > > Or maybe I am. I didn't see this key in my rc4 tests, because I did the > signature check before you signed. Could it be gpg somehow got an > incomplete copy of it? That would be a huge bug, but I guess it's possible. > Let me check ... > > > ... so it turns out that your key did not propagate correctly to > keys.openpgp.org which I use by default, this is what I get: > > $ gpg --keyserver hkps://keys.openpgp.org --recv-keys 2FB22D0D4ADC662A > gpg: key 2FB22D0D4ADC662A: new key but contains no user ID - skipped > gpg: Total number processed: 1 > gpg: w/o user IDs: 1 > > > Well, it's strange because the key is on keys.openpgp.org: https://keys.openpgp.org/vks/v1/by-fingerprint/D6678482E2ED5750E28B69292FB22D0D4ADC662A
-- Ivan Zhakov
