[
https://issues.apache.org/jira/browse/RNG-193?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18093175#comment-18093175
]
Alex Herbert commented on RNG-193:
----------------------------------
Is this referring to: [https://downloads.apache.org/commons/KEYS]?
The attached log report contains this:
{noformat}
--- 0785B3EFF60B1B1BEA94E0BB7C25280EAE63EBE5.pgpdump 2026-07-02
09:33:00.600954081 +0200
+++ 0785B3EFF60B1B1BEA94E0BB7C25280EAE63EBE5.pgpdump.new 2026-07-02
09:33:00.603987519 +0200
@@ -8,69 +8,101 @@
DSA y(1023 bits) - ...
Old: User ID Packet(tag 13)(32 bytes)
User ID - Oleg Kalnichevski <[email protected]>
-Old: Signature Packet(tag 2)(91 bytes)
+Old: Signature Packet(tag 2)(96 bytes)
+ Ver 4 - new
+ Sig type - Certification revocation signature(0x30).
+ Pub alg - DSA Digital Signature Algorithm(pub 17)
+ Hash alg - SHA512(hash 10)
+ Hashed Sub: issuer fingerprint(sub 33)(21 bytes)
+ v4 - Fingerprint - 07 85 b3 ef f6 0b 1b 1b ea 94 e0 bb 7c 25 28 0e
ae 63 eb e5
+ Hashed Sub: signature creation time(sub 2)(4 bytes)
+ Time - Sat Sep 3 18:23:50 CEST 2022
+ Hashed Sub: reason for revocation(sub 29)(1 bytes)
+ Reason - User ID information is no longer valid
+ Comment -
{noformat}
So IIUC the key has been revoked.
The headers in the KEYS file states:
{noformat}
DO NOT DELETE A KEY FROM THIS FILE if
it has ever been used for signing/counter-signing a Commons release
{noformat}
I cannot know if this key has been used to sign a commons release. But it
should remain for traceability.
> The KEYS file needs update
> --------------------------
>
> Key: RNG-193
> URL: https://issues.apache.org/jira/browse/RNG-193
> Project: Commons RNG
> Issue Type: Bug
> Reporter: Volkmar W. Pogatzki
> Priority: Major
>
> The KEYS file fails on Gentoo.
> updates available for PGP key: 0785B3EFF60B1B1BEA94E0BB7C25280EAE63EBE5
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
