Differing sigining key of latest 0.9.76 release

[sebix]

Previous releases have been signed by this key:

pub   rsa2048 2014-11-05 [SC]
      F951164995F5C4006A73411E2CCB36ADFC5849A7
uid           netblue (firejail key) <netblue30@yahoo.com>
sub   rsa2048 2014-11-05 [E]

The release 0.9.76 is now signed by

pub   rsa4096 2020-12-05 [SC]
      6395FC9911EDCD6158712DF7BADFCABDDBF5B694
uid           [ unknown] Divested Release Signing (2020 #1) <support+releasesigning@divested.dev>

I couldn't find a mention of it in the changelog and the readme.
EDIT: Also https://firejail.wordpress.com/download-2/ only mentions the netblue30@yahoo.com key

Is the new key legit? What's the role of divested.dev?

[kmk3]

The 0.9.76 release has been signed by @SkewedZeppelin; see the following
discussion:

• Release 0.9.76 discussion #6691 (comment)

[SkewedZeppelin]

we can delete those artifacts if you want?
or just wait for @netblue30 to replace the signature in the future

we can also amend the release notes of the github release to note the difference for this release?

something like?

@kmk3 and myself (@SkewedZeppelin ) chose to draft a new release in order to fix numerous bugs that were impacting 0.9.74 since @netblue30 appears unavailable. As a result it is signed by @SkewedZeppelin instead of @netblue30.

[kmk3]

we can delete those artifacts if you want? or just wait for @netblue30 to
replace the signature in the future

I don't know what would be the protocol in this case and you can remove them if
you think it would be better, but it seems fine to me to leave them as is.

If people are stopped by signing errors during packaging and decide to
investigate it, that sounds like the system is working as intended.

we can also amend the release notes of the github release to note the
difference for this release?

something like?

@kmk3 and myself (@SkewedZeppelin ) chose to draft a new release in order
to fix numerous bugs that were impacting 0.9.74 since @netblue30 appears
unavailable. As a result it is signed by @SkewedZeppelin instead of
@netblue30.

That's a good idea.

It would be nice to note it in an Announcement in the discussions, but I don't
have the neccessary permissions to do so (it seems to require the "maintainer"
repository role).

Anyway, I added a bit more detail and appended it to the GitHub Release notes

• https://github.com/netblue30/firejail/releases/tag/0.9.76

Feel free to edit it further if you want.

Reproduced below for reference:

---

A note about the different signing key:

Due to an xorg change, many/most xorg programs were rendered completely broken
when running under 0.9.74:

• xkeyboard-config 2.45: cannot start many programs (new /usr/share path) #6773

This was fixed in 0.9.76:

• profiles: wusc: add /usr/share/xkeyboard-config-2 #6775

Usually the releases are created by @netblue30, but we could not get in contact
with @netblue30 for over a month, so to avoid leaving firejail in a broken
state for many common programs for too long (and since the release contains
mostly bugfixes), we (@kmk3 and @SkewedZeppelin) chose to release 0.9.76.

As a result, this release is signed by @SkewedZeppelin instead of @netblue30.

For details, see the following discussions:

• Release 0.9.76 discussion #6691 (comment)
• Differing sigining key of latest 0.9.76 release #6847

[sebix]

If people are stopped by signing errors during packaging and decide to
investigate it, that sounds like the system is working as intended.

Yeah, I noticed it during packaging, and I agree the signing works as intended - When someone else signed the release, that's for sure a change which needs a manual check. Otherwise the signature wouldn't fulfil its role.