Updated signing key for libguestfs-related packages
I've started to sign new release tarballs with an updated public key that uses only SHA512 hashes: https://download.libguestfs.org/rich@annexia.org-pubkey.txt The previous one that was used to sign packages had SHA1 hashes and was therefore judged to be insecure. It is still available here [actually as a GPG binary key ring, for reasons]: https://download.libguestfs.org/libguestfs.keyring Hopefully this all works, but as always with GPG stuff it's very obscure and could have gone wrong. Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-builder quickly builds VMs from scratch http://libguestfs.org/virt-builder.1.html
On Fri, Oct 30, 2026 at 02:43:56PM +0000, Richard W.M. Jones wrote:
I've started to sign new release tarballs with an updated public key that uses only SHA512 hashes:
SHA256, not SHA512! Rich.
https://download.libguestfs.org/rich@annexia.org-pubkey.txt
The previous one that was used to sign packages had SHA1 hashes and was therefore judged to be insecure. It is still available here [actually as a GPG binary key ring, for reasons]:
https://download.libguestfs.org/libguestfs.keyring
Hopefully this all works, but as always with GPG stuff it's very obscure and could have gone wrong.
Rich.
-- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com virt-builder quickly builds VMs from scratch http://libguestfs.org/virt-builder.1.html
participants (2)
-
Richard W.M. Jones -
Richard W.M. Jones