[FFmpeg-devel] [RFC] git and signing commits and tags

[Michael Niedermayer]

On Tue, Aug 09, 2022 at 12:36:53AM +0200, Michael Niedermayer wrote:
> On Mon, Aug 08, 2022 at 09:26:52PM +0200, Lynne wrote:
> > Aug 8, 2022, 16:50 by michael at niedermayer.cc:
> > 
> > > Given the recent server issues, i wonder if we should suggest/recommand
> > > and document signing commits and tags
> > >
> > > i tried to push such commit to github and it nicely says "verified"
> > > https://github.com/michaelni/FFmpeg/commit/75f196acd16fb0c0ca7a94f0c66072e7c6f736bf
> > >
> > > Ive generated a new gpg key for this experiment as i dont have my
> > > main key on the box used for git development and also using more
> > > modern eliptic curve stuff (smaller keys & sigs)
> > > i will upload this key to the keyservers in case it becomes the
> > > one i use for git.
> > >
> > 
> > I sign all of my commits, 
> 
> I didnt notice, but thats good as it also proofs it works with no ill
> sideeffects
> 
> Where can i find your public key ? it seems its not on the keyservers i checked

Your key seems only on openpgp.org but that strips userids unless the owner approves it 
(i presume for GDPR) making the key not work

gpg --keyserver hkps://keys.openpgp.org --recv-keys FE50139C680572CAFD521F8DA2FEA5F03F034464
gpg: key A2FEA5F03F034464: no user ID
gpg: Total number processed: 1

gpg --list-keys FE50139C680572CAFD521F8DA2FEA5F03F034464
gpg: error reading key: No public key

gpg --recv-keys FE50139C680572CAFD521F8DA2FEA5F03F034464
gpg: keyserver receive failed: No data


[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Homeopathy is like voting while filling the ballot out with transparent ink.
Sometimes the outcome one wanted occurs. Rarely its worse than filling out
a ballot properly.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20220809/499d4912/attachment.sig>