Skip to contentSkip to conversation

Linux 3.0.7 now on kernel.org

DISCUSSION Greg KH 4 participants 5 messages Oct 23, 2011

lore
Share & tools
lore

Greg KH

author
#0 lore raw

I wanted to let people know that the 3.0.7 release is now downloadable in patch and full-tarball form from kernel.org:

	http://www.kernel.org/pub/linux/kernel/v3.0/
as well as the incremental patches in the incr/ subdir:
	http://www.kernel.org/pub/linux/kernel/v3.0/incr/

ftp.kernel.org also works for those of you using that protocol.

You will note that the files are signed with my new kernel release signing key, and that the .tar file is signed, and then compressed, so there is not signatures for the individual compressed files.

For those of you caring and wanting to verify things, the fingerprint of my signing key is:

	4096R/6092693E 2011-09-23
	Key fingerprint = 647F 2865 4894 E3BD 4571  99BE 38DB BDC8 6092 693E
	Greg Kroah-Hartman (Linux kernel stable release signing key) <[email protected]>

The 3.0.5 and 3.0.6 releases are there as well if people want them.

I'll work on the older releases as we get time, that shouldn't be that pressing of an issue at the moment.

Thanks so much to John and hpa for working hard on the tools and backend configuration to make this possible.

thanks,

greg k-h

#1 lore raw
Quoted 3 lines · Greg KH

You will note that the files are signed with my new kernel release signing key, and that the .tar file is signed, and then compressed, so there is not signatures for the individual compressed files.

And why is that? It's less handy.

Signature · 4 lines
- Jaka jest największa anomalia fizjologiczno-polityczna?
- Członek wysunięty z ramienia na czoło.
NP: Caligula's Horse - Equally Flawed
NB: 3.1.0-rc3
author
#2 lore raw
Quoted 7 lines · Piotr Hosowicz
Quoted 3 lines · Greg KH

You will note that the files are signed with my new kernel release signing key, and that the .tar file is signed, and then compressed, so there is not signatures for the individual compressed files.

And why is that? It's less handy.

I'll let hpa answer that one, he changed it for a good reason that I can't recall at the moment :)

hpa?

thanks,

greg k-h

#3 lore raw
Quoted 7 lines · Greg KH
Quoted 6 lines · Piotr Hosowicz
Quoted 3 lines · Greg KH

You will note that the files are signed with my new kernel release signing key, and that the .tar file is signed, and then compressed, so there is not signatures for the individual compressed files.

Quoted 7 lines
Quoted 1 line

And why is that? It's less handy.

I'll let hpa answer that one, he changed it for a good reason that I can't recall at the moment :)

hpa?

Signing the compressed file makes the compression "precious". It also means that the developer has to sign each.

It's not significantly "more handy" either... you can do something like:

	xz -cd file.xz | gpg --verify file.sign -

	-hpa
#4 lore raw
Quoted 6 lines · H. Peter Anvin

[...]
Signing the compressed file makes the compression "precious". It also means that the developer has to sign each.

It's not significantly "more handy" either... you can do something like:

	xz -cd file.xz | gpg --verify file.sign -

On the other hand, it forces someone to decompress an untrustworthy file in order to check its signature. Should there ever be a security exploit in any of these decompressors, this practice would aid triggering it.

- FChE