Re: [FFmpeg-devel] [RFC] git and signing commits and tags

From: Michael Niedermayer <michael@niedermayer.cc>
To: FFmpeg development discussions and patches <ffmpeg-devel@ffmpeg.org>
Subject: Re: [FFmpeg-devel] [RFC] git and signing commits and tags
Date: Tue, 9 Aug 2022 12:59:52 +0200
Message-ID: <20220809105952.GY2088045@pb2> (raw)
In-Reply-To: <20220808223653.GX2088045@pb2>

[-- Attachment #1.1: Type: text/plain, Size: 1782 bytes --]

On Tue, Aug 09, 2022 at 12:36:53AM +0200, Michael Niedermayer wrote:
> On Mon, Aug 08, 2022 at 09:26:52PM +0200, Lynne wrote:
> > Aug 8, 2022, 16:50 by michael@niedermayer.cc:
> > 
> > > Given the recent server issues, i wonder if we should suggest/recommand
> > > and document signing commits and tags
> > >
> > > i tried to push such commit to github and it nicely says "verified"
> > > https://github.com/michaelni/FFmpeg/commit/75f196acd16fb0c0ca7a94f0c66072e7c6f736bf
> > >
> > > Ive generated a new gpg key for this experiment as i dont have my
> > > main key on the box used for git development and also using more
> > > modern eliptic curve stuff (smaller keys & sigs)
> > > i will upload this key to the keyservers in case it becomes the
> > > one i use for git.
> > >
> > 
> > I sign all of my commits, 
> 
> I didnt notice, but thats good as it also proofs it works with no ill
> sideeffects
> 
> Where can i find your public key ? it seems its not on the keyservers i checked

Your key seems only on openpgp.org but that strips userids unless the owner approves it 
(i presume for GDPR) making the key not work

gpg --keyserver hkps://keys.openpgp.org --recv-keys FE50139C680572CAFD521F8DA2FEA5F03F034464
gpg: key A2FEA5F03F034464: no user ID
gpg: Total number processed: 1

gpg --list-keys FE50139C680572CAFD521F8DA2FEA5F03F034464
gpg: error reading key: No public key

gpg --recv-keys FE50139C680572CAFD521F8DA2FEA5F03F034464
gpg: keyserver receive failed: No data

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Homeopathy is like voting while filling the ballot out with transparent ink.
Sometimes the outcome one wanted occurs. Rarely its worse than filling out
a ballot properly.

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".