Re: Sign a summary with multiple GPG keys

[Ryan Rueth <rrueth gmail com>]

Hi Colin,

I believe that my co-worker was able to track this back to a bug within OSTree.  I'll have to check in with him about the context around the bug.  I don't think he got around to trying to create a patch.

In our case we were essentially trying to rotate keys.  Is there a better method for doing the key rotation?

Thanks,

Ryan

On Wed, Mar 21, 2018 at 3:06 PM Colin Walters <walters verbum org> wrote:

On Wed, Mar 7, 2018, at 7:28 PM, Ryan Rueth wrote:
>
> But, if I had done `gpg-import <key_id_2>` instead of <key_id_1>, then it
> will work.  Does anyone know how to sign a summary with multiple GPG keys?

Hmmm...it certainly seems this is intended to work, although we don't have much
test coverage of multiple key scenarios.

Stepping back a bit, what's your goal with multiple signatures?  Key rotation?
Having a "developer key" as well as a "distributor key"?  Something else?

I'll see if I can add a unit test for this.
_______________________________________________
ostree-list mailing list
ostree-list gnome org
https://mail.gnome.org/mailman/listinfo/ostree-list