It looks like your signing key is expired, and tag verification fails:
$ mkdir /tmp/foo
$ export GNUPGHOME=/tmp/foo
$ git cat-file blob junio-gpg-pub | gpg --import
gpg: WARNING: unsafe permissions on homedir '/tmp/foo'
gpg: keybox '/tmp/foo/pubring.kbx' created
gpg: key 20D04E5A713660A7: 27 signatures not checked due to missing keys
gpg: /tmp/foo/trustdb.gpg: trustdb created
gpg: key 20D04E5A713660A7: public key "Junio C Hamano [off-list ref]" imported
gpg: Total number processed: 1
gpg: imported: 1
gpg: no ultimately trusted keys found
$ git tag -v v2.33.0
object 225bc32a989d7a22fa6addafd4ce7dcd04675dbf
type commit
tag v2.33.0
tagger Junio C Hamano [off-list ref] 1629141357 -0700
Git 2.33
gpg: WARNING: unsafe permissions on homedir '/tmp/foo'
gpg: Signature made Mon Aug 16 15:15:57 2021 EDT
gpg: using RSA key E1F036B1FEE7221FC778ECEFB0B5E88696AFE6CB
gpg: Good signature from "Junio C Hamano [off-list ref]" [unknown]
gpg: aka "Junio C Hamano [off-list ref]" [unknown]
gpg: aka "Junio C Hamano [off-list ref]" [unknown]
gpg: Note: This key has expired!
Primary key fingerprint: 96E0 7AF2 5771 9559 80DA D100 20D0 4E5A 7136 60A7
Subkey fingerprint: E1F0 36B1 FEE7 221F C778 ECEF B0B5 E886 96AF E6CB
$ echo $?
1
Have you extended the expiration on it? I wasn't able to find any
updates on the keyservers I checked. But regardless, we should probably
ship an updated one via the tag.
-Peff
On Tue, Sep 07, 2021 at 02:12:53PM -0400, Jeff King wrote:
Have you extended the expiration on it? I wasn't able to find any
updates on the keyservers I checked. But regardless, we should probably
ship an updated one via the tag.
You can get it from here:
https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/20D04E5A713660A7.asc
-K
On Tue, Sep 07, 2021 at 02:20:42PM -0400, Konstantin Ryabitsev wrote:
On Tue, Sep 07, 2021 at 02:12:53PM -0400, Jeff King wrote:
quoted
Have you extended the expiration on it? I wasn't able to find any
updates on the keyservers I checked. But regardless, we should probably
ship an updated one via the tag.
You can get it from here:
https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/20D04E5A713660A7.asc
Thanks! That fixes my problem. I do think we should update the in-repo
tag. :)
-Peff
On Tue, Sep 07 2021, Jeff King wrote:
On Tue, Sep 07, 2021 at 02:20:42PM -0400, Konstantin Ryabitsev wrote:
quoted
On Tue, Sep 07, 2021 at 02:12:53PM -0400, Jeff King wrote:
quoted
Have you extended the expiration on it? I wasn't able to find any
updates on the keyservers I checked. But regardless, we should probably
ship an updated one via the tag.
You can get it from here:
https://git.kernel.org/pub/scm/docs/kernel/pgpkeys.git/plain/keys/20D04E5A713660A7.asc
Thanks! That fixes my problem. I do think we should update the in-repo
tag. :)
Note though that when the in-repo tag is updated anyone fetching it will
need to update with --force, and anyone doing fetches of git.git will
see a non-zero exit code on their pulls and fetches without that.
This is due to my 0bc8d71b99e (fetch: stop clobbering existing tags
without --force, 2018-08-31). That change was meant to error on pretty
much this exact scenario...
But to be more gentle does anything rely on that specific name, or would
it perhaps be better to push a new junio-gpg-pub-2021?