nPth signature

[Kosuke Kaizuka]

Hi,
On 2023/08/12 11:45, Daniel Rostovtsev via Gnupg-users wrote:
> I think that nPth is might be signed with an expired signature.
> 
> Is this a problem?

No problem.

> I downloaded from https://gnupg.org/ftp/gcrypt/npth/npth-1.6.tar.bz2 
> <https://gnupg.org/ftp/gcrypt/npth/npth-1.6.tar.bz2> and 
> https://gnupg.org/ftp/gcrypt/npth/npth-1.6.tar.bz2.sig 
> <https://gnupg.org/ftp/gcrypt/npth/npth-1.6.tar.bz2.sig>
> 
> 
> This is what I see when I run
> 
> 
>  > gpg —-verify npth-1.6.tar.bz2.sig
> 
> 
> When I run with a trusted gpg.
> 
> 
> 
> gpg: assuming signed data in 'npth-1.6.tar.bz2'
> 
> gpg: Signature made Mon Jul 16 07:37:23 2018 UTC
> 
> gpg:                using RSA key D8692123C4065DEA5E0F3AB5249B39D24F25E3B6
> 
> gpg: Good signature from "Werner Koch (dist sig)" [expired]
> 
> gpg: Note: This key has expired!
> 
> Primary key fingerprint: D869 2123 C406 5DEA 5E0F  3AB5 249B 39D2 4F25 E3B6

The release date of nPth 1.6 is 2018-07-16 and the files were signed on 
the same day.
On 2018-07-16, the key D8692123C4065DEA5E0F3AB5249B39D24F25E3B6 was 
valid and not expired yet.

-- 
Kosuke Kaizuka <cai.0407 at gmail.com>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 236 bytes
Desc: OpenPGP digital signature
URL: <https://lists.gnupg.org/pipermail/gnupg-users/attachments/20230812/ea262960/attachment-0001.sig>