butane v0.23.0 uses Fedora 40 GPG key

[aminvakil]

Although stated in https://github.com/coreos/butane/releases/tag/v0.23.0 which it's using Fedora 41 GPG key, it's still using Fedora 40 GPG key.

[aminvakil]

$ curl -OL "https://github.com/coreos/butane/releases/download/v0.23.0/butane-x86_64-unknown-linux-gnu"
$ curl -OL "https://github.com/coreos/butane/releases/download/v0.23.0/butane-x86_64-unknown-linux-gnu.asc"
$ gpg butane-x86_64-unknown-linux-gnu.asc 
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
gpg: assuming signed data in 'butane-x86_64-unknown-linux-gnu'
gpg: Signature made Fri 20 Dec 2024 09:00:19 PM +0330
gpg:                using RSA key 115DF9AEF857853EE8445D0A0727707EA15B79CC
gpg: Good signature from "Fedora (40) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 115D F9AE F857 853E E844  5D0A 0727 707E A15B 79CC

[travier]

Thanks for reporting this.

We indeed asked in https://pagure.io/releng/issue/12492 to have this release signed with the F40 key but the release states that it is signed with the F41 one. See: #550

This happened as we created the issue for signing (https://pagure.io/releng/issue/12492) before we updated the script (b59d35f).

The next release should be signed with the F41 key.

[travier]

I've edited the release to note that issue. As this is still a valid signature and the next release should be signed with the right key, I'll close this.

Thanks!

[aminvakil]

Great, thanks!