GPG key expired 21 Jun 2024

[bwcorey]

Description

Using the directions at https://docs.gitea.com/installation/install-from-binary the build verifies but warns about the key expiry.

# gpg --verify gitea-1.21.11-linux-amd64.asc gitea-1.21.11-linux-amd64
gpg: Signature made Mon 15 Apr 2024 11:43:42 PM EDT
gpg:                using RSA key CC64B1DB67ABBEECAB24B6455FC346329753F4B0
gpg: Good signature from "Teabot <[email protected]>" [expired]
gpg: Note: This key has expired!
Primary key fingerprint: 7C9E 6815 2594 6888 62D6  2AF6 2D9A E806 EC15 92E2
     Subkey fingerprint: CC64 B1DB 67AB BEEC AB24  B645 5FC3 4632 9753 F4B0

# gpg --list-keys
/root/.gnupg/pubring.kbx
------------------------
pub   rsa4096 2018-06-24 [SC] [expired: 2024-06-21]
      7C9E68152594688862D62AF62D9AE806EC1592E2
uid           [ expired] Teabot <[email protected]>

Gitea Version

1.21.11-linux-amd64

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Installing Gitea from binary v1.21.11

Database

None

[a1012112796]

gitea/SECURITY.md

Lines 19 to 27 in 24f4ebb

	```
	Key ID: 6FCD2D5B
	Key Type: RSA
	Expires: 6/24/2024
	Key Size: 4096/4096
	Fingerprint: 3DE0 3D1E 144A 7F06 9359 99DC AAFD 2381 6FCD 2D5B
	```
	UserID: Gitea Security <[email protected]>

[lunny]

Please verify it again after upgrading the key from a public key server.

[lunny]

gitea/SECURITY.md

Lines 19 to 27 in 24f4ebb

	```
	Key ID: 6FCD2D5B
	Key Type: RSA
	Expires: 6/24/2024
	Key Size: 4096/4096
	Fingerprint: 3DE0 3D1E 144A 7F06 9359 99DC AAFD 2381 6FCD 2D5B
	```
	UserID: Gitea Security <[email protected]>

The security documentation looks like needs to be updated.

[a1012112796]

Please verify it again after upgrading the key from a public key server.

@lunny which server?

[bwcorey]

No change.

# gpg --refresh-keys
gpg: refreshing 1 key from hkps:https://keys.openpgp.org
gpg: key 2D9AE806EC1592E2: "Teabot <[email protected]>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

# gpg --verify gitea-1.21.11-linux-amd64.asc gitea-1.21.11-linux-amd64
gpg: Signature made Mon 15 Apr 2024 11:43:42 PM EDT
gpg:                using RSA key CC64B1DB67ABBEECAB24B6455FC346329753F4B0
gpg: Good signature from "Teabot <[email protected]>" [expired]
gpg: Note: This key has expired!
Primary key fingerprint: 7C9E 6815 2594 6888 62D6  2AF6 2D9A E806 EC15 92E2
     Subkey fingerprint: CC64 B1DB 67AB BEEC AB24  B645 5FC3 4632 9753 F4B0

[lunny]

No change.

# gpg --refresh-keys
gpg: refreshing 1 key from hkps:https://keys.openpgp.org
gpg: key 2D9AE806EC1592E2: "Teabot <[email protected]>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

# gpg --verify gitea-1.21.11-linux-amd64.asc gitea-1.21.11-linux-amd64
gpg: Signature made Mon 15 Apr 2024 11:43:42 PM EDT
gpg:                using RSA key CC64B1DB67ABBEECAB24B6455FC346329753F4B0
gpg: Good signature from "Teabot <[email protected]>" [expired]
gpg: Note: This key has expired!
Primary key fingerprint: 7C9E 6815 2594 6888 62D6  2AF6 2D9A E806 EC15 92E2
     Subkey fingerprint: CC64 B1DB 67AB BEEC AB24  B645 5FC3 4632 9753 F4B0

Please try again. Now the keys will be sent to

• keyserver.ubuntu.com
• pgp.mit.edu
• keys.openpgp.org