Re: Cygwin setup signing public key update

[Jon Turney <jon.turney@dronecode.org.uk>]

On 13/03/2020 16:13, Jon Turney wrote:
> This is an announcement of an update to the key used to sign (i)
> Cygwin setup executables, and (ii) the (compressed) setup.ini package
> manifest.

If you just run setup, and update it when it tells you to update it, no 
action is required, and this message chain will be of limited interest 
to you.

This update is following the policy announced at [1]:

 > On 05/08/2008 14:30, Dave Korn wrote:
 >> If we, from time to time, need to change this key, we will release
 >> a new version of setup.exe and make announcements on the cygwin
 >> and cygwin-announce mailing lists, and on the cygwin.com website.

Also see that post for further discussion of the technicals details of 
setup signing.

The transition period, during which signatures are made using both keys 
will probably be approx. 90 days, circumstances permitting.

Note that due to technical limitations in old versions of setup, the 
form of signature we use on setup.ini is one that gpg can make, but 
cannot verify for both keys. This is only an issue if you manually 
verify setup.ini with gpg, rather than letting setup do it. (See [2])

[1] https://cygwin.com/ml/cygwin-announce/2008-08/msg00001.html
[2] https://dev.gnupg.org/T1462