497690 - Renew GPG key before it expires

Status: RESOLVED FIXED

(Release Engineering :: General, defect, P2)

Description

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

During FF3.0.11 release, catlee noticed this GPG key will expire in July (16th?). We need to renew the key before it expires.

Comment 1

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

Got sidetracked with FF3.5.0 and Q2/Q3 goals. Suddenly its now 08july. Bumping priority.

Comment 2

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

Found bug#377781, where I did this two years ago, last time the key expired.

Comment 3

[[e-mail] (:bhearsum)]

FYI:
According to http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/3.5.1-candidates/build1/KEY, it does expire on the 16th.

I just finished signing 3.5.1 so we made the cut off there

Comment 4

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

(In reply to comment #3)
> FYI:
> According to
> http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/3.5.1-candidates/build1/KEY,
> it does expire on the 16th.
> 
> I just finished signing 3.5.1 so we made the cut off there

....so we *just* made the cutoff! Phew! Thanks Ben.

Comment 5

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

Attachment: new public key with added header text

dveditz and I looked over this together in person, but posting here for the record.

Comment 6

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

New private key now on signing machine, Lukas is trying it now. Stay tuned.

Meanwhile, should I checkin this new public key into the repo, just like we did for bug#377781? Or has this now moved to a new hg-based location?

Comment 7

[Philippe M. Chiasson (:gozer)]

(In reply to comment #6)
> [...]
> Meanwhile, should I checkin this new public key into the repo, just like we did
> for bug#377781? Or has this now moved to a new hg-based location?

That's a very good question, and one I am asking similarly for the new comm-central signing keys in bug 499709 comment #1. Any insight/opinions would be most welcome as to where would a good place be to stick these trusted public keys.

Comment 8

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

nthomas did an additional manual test, which looks good too:

-bash-3.00$ gpg --verify firefox-3.0.12.tar.bz2.asc firefox-3.0.12.tar.bz2
gpg: Signature made Mon 20 Jul 2009 05:53:54 PM PDT using DSA key ID 17785FE8
gpg: Good signature from "Mozilla Software Releases <[e-mail]>"
gpg: checking the trustdb
gpg: checking at depth 0 signed=1 ot(-/q/n/m/f/u)=0/0/0/0/0/3
gpg: checking at depth 1 signed=0 ot(-/q/n/m/f/u)=1/0/0/0/0/0
gpg: next trustdb check due at 2011-07-20

Comment 9

[[e-mail] (:bhearsum)]

(In reply to comment #6)
> Meanwhile, should I checkin this new public key into the repo, just like we did
> for bug#377781? Or has this now moved to a new hg-based location?

CVS mofo is still the right place for this.

Comment 10

[Nick Thomas [:nthomas] (UTC+12)]

Comment on attachment 389589 [details]
new public key with added header text

Updated the public key in the mofo repo.

Comment 11

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

We used this new key on FF3.0.12, which we shipped yesterday. Now tidying up bugs.

Posted renewed public key, and verified, on:
pgp.mit.edu
pgpkeys.mit.edu

Skipped the following keymasters because of errors:
keyserver.veridis.com redirects to keyserver.veridis.com:11371/disabled.jsp.
wwwkeys.pgp.net redirects to http://wwwkeys.pgp.net/apache2-default.

Thats it for another 2 years, so closing.