Devuan bug report logs - #891
devuan-keyring: New signing key needed?

Package: devuan-keyring; Maintainer for devuan-keyring is Devuan Developers <devuan-dev@lists.dyne.org>; Source for devuan-keyring is src:devuan-keyring.

Reported by: Martin <Martin@lichtvoll.de>

Date: Mon, 26 May 2025 15:18:01 UTC

Severity: normal

Found in version devuan-keyring/2023.10.07

Full log

Message #13 received at 891@bugs.devuan.org (full text, mbox, reply):

Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=103.168.172.145; helo=fout-a2-smtp.messagingengine.com; envelope-from=sawbona@xsmail.com; receiver=<UNKNOWN> 
Feedback-ID: ife904084:Fastmail
From: sawbona@xsmail.com
To: Mark Hindley <mark@hindley.org.uk>,
              891@bugs.devuan.org,
              devuan developers internal list <devuan-dev@lists.dyne.org>,
              "devuan-dev" <devuan-dev@lists.dyne.org>
Date: Mon, 02 Jun 2025 16:03:32 -0300
MIME-Version: 1.0
Subject: Re: [devuan-dev] bug#891: devuan-keyring: New signing key needed?
Message-ID: <683DF584.3035.47930B@sawbona.xsmail.com>
Priority: normal
In-reply-to: <aD3LbBatRfW-nivX@hindley.org.uk>
References: <12678847.O9o76ZdvQC@lichtvoll.de>, <aD3LbBatRfW-nivX@hindley.org.uk>
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Content-description: Mail message body

Hello:

On 2 Jun 2025 at 17:03, Mark Hindley wrote:

> ... end up in a chicken and egg cycle with the new key being used
> but apt refusing to update the devuan-keyring package because it
> can't verify the key.
> 
> ... good idea how to resolve that?

Just thinking out loud, not to be taken *too* seriously.

I live in a building with 10 stories and 66 flats.
When someone loses their keys to the front door, the lock is changed 
asap and 66 new keys are made and distributed.

When someone without a new key wants to get into the building, they 
are met with a sign saying that they should contact the building's 
admin and ask for their key. 

In a loosely analogous manner, a *sleeper* devuan-keyring metapackage 
could be used.

I would be pushed out to everyone updating and once installed it 
would lie waiting to detect when / if the user wanting to update / 
upgrade or install anything is unable to do so because of the old 
key.

At that point, it would inform them of the situation and instruct 
them to extract [c]sleeper.sh[/c] from the metapackage.

[c]sleeper.sh[/c] would unpackage, install the new key and ask the 
user to try their update / upgrade again.

If the update / upgrade or installation went ahead as expected, the 
*sleeper* devuan-keyring metapackage would then rm itself.

Just an idea.
I am aware that this may potentially have some security issues.

Best,

A.

Send a report that this bug log contains spam.

Devuan bug report logs - #891 devuan-keyring: New signing key needed?

Devuan bug report logs - #891
devuan-keyring: New signing key needed?