fedora-websites

#502 Provide a way to verify the pgp keys (web of trust)
Closed: Invalid Opened by genodeftest.

Closed: Invalid
Reopen Issue

The pgp keys on https://getfedora.org/verify

    8E1431D5 - Fedora 22
    A29CB19C - Fedora 22 secondary arches (aarch64, PPC64, PPC64le, s390 and s390x)
    95A43F54 - Fedora 21
    A0A7BADB - Fedora 21 secondary arches (aarch64, PPC64, PPC64le, s390 and s390x)
    246110C1 - Fedora 20
    EFE550F5 - Fedora 20 secondary arches (ARM, PPC64, s390)
    FB4B18E6 - Fedora 19
    BA094068 - Fedora 19 secondary arches (ARM, PPC64, s390)

are not online on any known key server. There is currently no way to check their validity (no way to retrieve signatures). I don't even know who generated them. As of now it is just as there were no pgp signatures at all.
Ideally the keys were online e.g. on the sks keyservers pool [1] and signed by people I can build a trust path via web of trust.

[1] https://sks-keyservers.net/

Sorry, something went wrong.

The keys are online at keys.gnupg.net and fedoraproject.org. There is no way to find a trust path for most pgp users. E.g. the F21 primary key is only signed by:
1. Guillaume Poirier-Morency (self-signed key, no other signatures)
2. Petr Pisar. This is the only useful signature on this key.

This has come up before, I believe on the websites or rel-eng list. The Fedora signing keys are role keys. The only real person in a position to sign the key with meaning is the person who generated it. Others who have signed the key almost certainly could not have done any proper verification of the key, and thus their signatures do nothing more than devalue that individuals signature(s) on other keys (as their signing policies are weak).

The trust path, IMO, is that the keys are served up via SSL/TLS from Fedora's official site. All trust starts somewhere, and this is where I think trust for role keys like Fedora's signing keys should start (and end, personally; but others are free to sign the key as a way of letting me know that they sign things they should not sign ;).

Thanks tmz for clarifying, this is also a releng question, but I also remember it was there some time ago.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.