[ovirt-users] GPG key <infra@ovirt.org> expired since April ?
Hi,
According to output pasted below it seems that the GPG key used to sign installation media
has expired 2021-04-03. Why is new installation ISO signed 7 days ago with a key that has
been expired for almost 6 months? Is this correct?
My main question though is if this iso is authentic?
$ ll -h ovirt-node-ng-installer-4.4.8-2021090310.el8.iso*
-rw-r--r--. 1 fredde fredde 1.9G Oct 1 14:48
ovirt-node-ng-installer-4.4.8-2021090310.el8.iso
-rw-r--r--. 1 fredde fredde 32 Oct 1 14:48
ovirt-node-ng-installer-4.4.8-2021090310.el8.iso.md5sum
-rw-r--r--. 1 fredde fredde 490 Oct 1 14:48
ovirt-node-ng-installer-4.4.8-2021090310.el8.iso.md5sum.sig
$ gpg --list-keys oVirt
pub rsa2048 2014-03-30 [SC] [expired: 2021-04-03]
31A5D7837FAD7CB286CD3469AB8C4F9DFE590CB7
uid [ expired] oVirt <infra(a)ovirt.org>
$ gpg --verify-files *.sig
gpg: assuming signed data in
'ovirt-node-ng-installer-4.4.8-2021090310.el8.iso.md5sum'
gpg: Signature made Thu 23 Sep 2021 02:41:24 PM CEST
gpg: using RSA key AB8C4F9DFE590CB7
gpg: Good signature from "oVirt <infra(a)ovirt.org>" [expired]
gpg: Note: This key has expired!
Primary key fingerprint: 31A5 D783 7FAD 7CB2 86CD 3469 AB8C 4F9D FE59 0CB7
$ cat *.md5sum
e75ac6f671c666140a205e6eab3d0c4a
$ md5sum ovirt-node-ng-installer-4.4.8-2021090310.el8.iso
e75ac6f671c666140a205e6eab3d0c4a ovirt-node-ng-installer-4.4.8-2021090310.el8.iso
BR
/F