Expired key C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC

[pzygielo]

$ gpg net/datafaker/datafaker/2.4.2/datafaker-2.4.2.jar.asc
gpg: Signature made Tue 19 Nov 2024 03:36:53 CET
gpg:                using EDDSA key C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC
gpg: Good signature from ... [expired]
gpg: Note: This key has expired!

$ gpg --list-public-keys C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC
pub   ed25519 2021-12-30 [SC] [expired: 2023-12-30]
      C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC
uid           [ expired] ...
sub   cv25519 2021-12-30 [E] [expired: 2023-12-30]

Key expired: 2023-12-30
BUT
Signature made: 2024-11-19 (which is: later).

I suppose the updated key was not distributed to keyservers.
Can you publish the current version please?

[asolntsev]

@pzygielo Wasn't it already solved?

At least command mvn org.simplify4u.plugins:pgpverify-maven-plugin:check shows OK result for me:

[INFO] net.datafaker:datafaker:jar:2.4.4 PGP Signature OK
KeyId: 0xC164CF5D76B509A6DB8E2F7E8B028A668EFF11CC UserIds: [Erik Pragt <erik.pragt@gmail.com>]

[pzygielo]

Wasn't it already solved?

Not for me.

Please let me know where I can get updated key from.

• https://keyserver.ubuntu.com/pks/lookup?search=C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC&fingerprint=on&op=index
• https://keys.openpgp.org/search?q=8B028A668EFF11CC
• https://pgpkeys.eu/pks/lookup?search=8B028A668EFF11CC&fingerprint=on&op=index
• https://pgp.surfnet.nl/pks/lookup?search=8B028A668EFF11CC&fingerprint=on&op=index

all serve expired key.

At least command mvn org.simplify4u.plugins:pgpverify-maven-plugin:check shows OK result for me:

[INFO] net.datafaker:datafaker:jar:2.4.4 PGP Signature OK
KeyId: 0xC164CF5D76B509A6DB8E2F7E8B028A668EFF11CC UserIds: [Erik Pragt <erik.pragt@gmail.com>]

I don't know if that plugin checks dates consistency, but I do. And it's still the case for 2.4.4 release:

$ gpg --verify net/datafaker/datafaker/2.4.4/datafaker-2.4.4.jar.asc net/datafaker/datafaker/2.4.4/datafaker-2.4.4.jar
gpg: Signature made Sun 13 Jul 2025 08:24:45 CEST
gpg:                using EDDSA key C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC
gpg: Good signature from "Erik Pragt <erik.pragt@gmail.com>" [expired]
gpg: Note: This key has expired!
Primary key fingerprint: C164 CF5D 76B5 09A6 DB8E  2F7E 8B02 8A66 8EFF 11CC

$ gpg --list-public-keys C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC
pub   ed25519 2021-12-30 [SC] [expired: 2023-12-30]
      C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC
uid           [ expired] Erik Pragt <erik.pragt@gmail.com>
sub   cv25519 2021-12-30 [E] [expired: 2023-12-30]

The published key expired 2023-12-30 while datafaker-2.4.4.jar.asc was made after that date.

[bodiam]

That's just me, I have no idea how PGP works, and what you're trying to do. If you can give me a pointer on how to fix this, happy to update the build.

[pzygielo]

I have no idea what you're trying to do.

Is it due to my bad wording?

I'm validating release published to Maven Central. It was signed with key, which had been expired at the moment the signature was made. Thus I'm trying to establish if the key was updated (locally, at the place it's used to make signatures) and not re-published or compromised (as it's still being used).

If you can give me a pointer on how to fix this, happy to update the build.

With

datafaker/.github/workflows/release-from-tag.yml

Line 42 in 4345fc0

gpg-private-key: ${{ secrets.GPG_SIGNING_KEY }}

it looks the key is stored as actions secret.

At the place where it is used - could it be checked that the key there is updated with new expiration date? What is the result of:

gpg --list-public-keys C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC

Then - if it is something else than in this issue summary (i.e. if it's not expired there) - please publish to keyserver of your choice, for example:

gpg --keyserver keyserver.ubuntu.com --send-keys C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC

I presume, there is no other copy of the key. Then maybe on: [workflow_dispatch] workflow, set up with the same secret, could be created to do that on demand?

[bodiam]

I have no idea what you're trying to do.

Is it due to my bad wording?

No no, absolutely not. It's due to my lack of understanding what GPG in the context of Java libraries is used for, I don't think that in my 20 years of experience I've done that, so I really don't know what you're doing.

I'm validating release published to Maven Central. It was signed with key, which had been expired at the moment the signature was made. Thus I'm trying to establish if the key was updated (locally, at the place it's used to make signatures) and not re-published or compromised (as it's still being used).

Right. It's not compromised, it's just me doing something silly I think.

If you can give me a pointer on how to fix this, happy to update the build.

With

datafaker/.github/workflows/release-from-tag.yml

Line 42 in 4345fc0
gpg-private-key: ${{ secrets.GPG_SIGNING_KEY }}

it looks the key is stored as actions secret.

Yes, that's correct, it is.

At the place where it is used - could it be checked that the key there is updated with new expiration date? What is the result of:

gpg --list-public-keys C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC

pub   ed25519 2021-12-30 [SC] [expired: 2023-12-30]
      C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC
uid           [ expired] Erik Pragt <erik.pragt@gmail.com>

Looks like it's indeed expired. I've asked Claude what to do, and it tells me the best course of action is to extend the expiry:

gpg --edit-key C164CF5D76B509A6DB8E2F7E8B028A668EFF11CC

and

> expire

I'll do that, when I have access to the machine with the private key.

If I can't access that machine, I'll create a new key, would that work?

[pzygielo]

If I can't access that machine, I'll create a new key, would that work?

For next releases - sure it would.

[pzygielo]

Looks like it's indeed expired. I've asked Claude what to do, and it tells me the best course of action is to extend the expiry:

If you manage to do it - please send updated key to keyserver, for public to import it.