Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1026150

Bug#892058: debian-keyring: please automatically send reminder emails to people whose keys will expire soon

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Let me think out loud to this bug report...

Jonas Smedegaard dijo [Wed, Sep 23, 2020 at 08:43:03AM +0200]:
> I would certainly appreciate Debian running this kind of service.
> 
> From a recipient PoV I would find it most sensible to receive such 
> notification from the keyring maintainers, but I recognize that it would 
> be an additional task that technically need not be tied to that same 
> team.
> 
> Thanks to Ximin for for the initiative, and to Felix for running a test 
> service from riseup.net: I've been bitten by this in the past, and was 
> happy to receive a warning from Felix.

I too think this would be an important addition, but have been unable
to put the time into this; some of you might have noticed that
starting some months ago, while pushing a keyring update, I send a
mail to everybody whose key is _already_ expired; doing this is quite
easy:

/------------------- https://salsa.debian.org/debian-keyring/keyring/-/blob/master/t/no-expired.t
| #!/bin/sh
| # Looks for expired keys in our active keyrings
| set -e
| 
| find_expired () {
| 	k=$1
| 	gpg --no-options --no-auto-check-trustdb --no-default-keyring \
| 		--keyring "./output/keyrings/$k" --list-keys --with-colons \
| 		| grep -a '^pub' \
| 		| awk -F: -v keyring=$1 \
| 		'$2 == "e" {print keyring ":\t0x" $5 " expired on " strftime("%F %T", $7) " (" $10 ")"}'
| }
| 
| fail=0
| for keyring in debian-keyring.gpg debian-maintainers.gpg \
| 		debian-nonupload.gpg; do
| 	find_expired $keyring
| done
| 
| exit $fail

I suck at awk, so I would rephrase the last command in the pipeline
with:

ruby -r date -n -e 'flds=$_.split(/:/); next unless flds[1] == "e"; \
   exp=Date.strptime(flds[6],"%s"); puts "%s: %s expired on %s" % \
   [ENV["k"], flds[4], exp.strftime("%Y-%m-%d")]'

That (plus exporting k in the shell to the environment) would leave it
functionally equivalent to what we currently have, and would allow us
to replace it with:

ruby -r date -n -e 'flds=$_.split(/:/); today = Date.today; \
    onemonth = today+30; exp=Date.strptime(flds[6],"%s") rescue nil; \
    next if exp.nil? or exp >= onemonth; \
    puts "%s: %s expired on %s" % [ENV["k"], flds[4], \
        exp.strftime("%Y-%m-%d")] if exp <= today; \
    puts "%s: %s will soon expire (%s)" % [ENV["k"], flds[4], \
        exp.strftime("%Y-%m-%d")] if exp > today and exp <= onemonth'

That gives us a nice list that presents expired and soon-to-expire
keys -- Including information potentially useful today, of course!

debian-keyring.gpg: 049B6D88E31734DB expired on 2019-08-17
debian-keyring.gpg: 13EC43EEB9AC8C43 will soon expire (2020-10-02)
debian-keyring.gpg: 17B1CA7D64089528 expired on 2020-06-12
debian-keyring.gpg: 1CFC22F3363DEAE3 expired on 2020-06-17
(...)

...But I have to leave the topic as it is right now, as my family
calls me. From here, this script can be easily modified:

    https://salsa.debian.org/debian-keyring/keyring/-/blob/master/scripts/mail_expired.rb

And we would have everything in place to notify people whose key is
to expire soon.

So, I will try to add this later today (but other keyring-maints, your
input is much appreciated before that!), or falining that... Soon™.

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#892058: debian-keyring: please automatically send reminder emails to people whose keys will expire soon Jonas Smedegaard <dr@jones.dk> - 2020-09-23 08:50 +0200
  Bug#892058: debian-keyring: please automatically send reminder emails to people whose keys will expire soon Gunnar Wolf <gwolf@debian.org> - 2020-09-23 15:40 +0200
    Bug#892058: debian-keyring: please automatically send reminder emails to people whose keys will expire soon David Prévot <taffit@debian.org> - 2020-09-23 17:00 +0200
      Bug#892058: debian-keyring: please automatically send reminder emails to people whose keys will expire soon Gunnar Wolf <gwolf@debian.org> - 2020-09-23 17:40 +0200

csiph-web