On Tue, 2014-11-11 at 11:47 +0100, Patrick Ohly wrote: > Hello! > > I've set up signing of the syncevolution.org repos. The key that I am > using is not signed by anyone, so one has to trust that the initial > download and fingerprint have not been tampered with. At least once that > is done and worked, further manipulations will raise alarms. > > To ensure that apt trusts the new key, use (as root): > apt-key adv --keyserver keyserver.ubuntu.com --recv-keys B2EC3981 > > To verify the key, compare the fingerprint: > > apt-key finger > ... > pub 4096R/B2EC3981 2014-11-11 > Key fingerprint = 5B77 1F15 FA70 1B73 A7DE 180D AE84 A13C B2EC 3981 > uid SyncEvolution <[email protected]> > sub 4096R/2A54FB85 2014-11-11 > sub 4096R/5E4ABB95 2014-11-11 [expires: 2015-11-11] > ... > > Note that I chose to set an expiry date one year from now for the > sub-key that actually gets used to sign the repos. My current > understanding is that one year from now I will have to create a new > sub-key, re-sign the repos and all users must refresh the key from the > key server. Is that too much trouble? Should I rather replace the > sub-key with a permanent one now, before many users add the expiring > one?
As there has been no response and the "experimental" solution is now already over two months old, I'm going to stick with it. I'd also like to announce that all SyncEvolution downloads are now mirrored at: https://download.01.org/syncevolution/ That is the content delivery network used by Intel's 01.org, which should be faster for everyone than the single download server used so far. http://downloads.syncevolution.org is still around, but users are encouraged to update their apt source entry so that we might eventually phase out downloads.syncevolution.org. -- Best Regards, Patrick Ohly The content of this message is my personal opinion only and although I am an employee of Intel, the statements I make here in no way represent Intel's position on the issue, nor am I authorized to speak on behalf of Intel on this matter. _______________________________________________ SyncEvolution mailing list [email protected] https://lists.syncevolution.org/mailman/listinfo/syncevolution
