[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]



Wednesday January 17 2018

the official cd_dvd amd64 stable/stretch are not authentic/can't be
authentified : BAD


- LIVE DVD : idem

you published the keys/iso without have checked before their
validity/compatibility ?

gpg --verify sums512.sign sums512
gpg: Signature made Sun 10 Dec 2017 03:58:21 CET
gpg:                using RSA key DF9B9C49EAA9298432589D76DA87E80D6294BE9B
gpg: Can't check signature: No public key

gpg --keyserver keyring.debian.org --recv-key
gpg: key DA87E80D6294BE9B: public key "Debian CD signing key
<debian-cd@lists.debian.org>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1

Signature made Sun 10 Dec 2017 03:58:21 CET
gpg:                using RSA key DF9B9C49EAA9298432589D76DA87E80D6294BE9B
gpg: BAD signature from "Debian CD signing key
<debian-cd@lists.debian.org>" [un

gpg --verify MD5SUMS.sign MD5SUMS
gpg: Signature made Sat 09 Dec 2017 09:58:24 PM EST
it sounds that these errors compromise apt-transport-https_sks ,
trusted.gpg.d (missing keys) _ sources.list.save & maybe gpg but i am not
certain of that.

*keys have changed new Sun 10 Dec 2017_old Sat 09 Dec 2017.

it is bizarre that before the linux security update the signature made Sat
09 Dec 2017 was good but today , it is bad.
does not an updated-key remember its revoked-key one (same cd-key) ?
should not it be written revoked instead of bad ?
is something wrong in the keyring ?
stolen-falsified keys/hacked site ?
a segment-fault on a server ?
fake debian.org site (i verified the cert(green) with the help of the
calomel-addon & i did not notice something wrong.)?

9.0. is not available (9.3 only ! ).
could you put on line asap the debian 9.0.0. stretch stable or update
9.3.0. with the right keys ?


*or my gtkhash/cli is broken and reporting this is a big error but in case
of doubt i do it , sorry.


[To make life easier for users, here are the fingerprints for the keys
that have been used for releases in recent years:]

pub   4096R/64E6EA7D 2009-10-03
      Key fingerprint = 1046 0DAD 7616 5AD8 1FBC  0CE9 9880 21A9 64E6 EA7D
uid                  Debian CD signing key <debian-cd@lists.debian.org>

pub   4096R/6294BE9B 2011-01-05
      Key fingerprint = DF9B 9C49 EAA9 2984 3258  9D76 DA87 E80D 6294 BE9B
uid                  Debian CD signing key <debian-cd@lists.debian.org>
sub   4096R/11CD9819 2011-01-05

pub   4096R/09EA8AC3 2014-04-15
      Key fingerprint = F41D 3034 2F35 4669 5F65  C669 4246 8F40 09EA 8AC3
uid                  Debian Testing CDs Automatic Signing Key
sub   4096R/6BD05CFB 2014-04-15

Reply to: