[jira] (MNG-5746) Obsolete instructions in http://maven.apache.org/developers/release/pmc-gpg-keys.html

["Tibor Digana (JIRA)" <ji...@codehaus.org>]

Tibor Digana created MNG-5746:
---------------------------------

             Summary: Obsolete instructions in http://maven.apache.org/developers/release/pmc-gpg-keys.html
                 Key: MNG-5746
                 URL: https://jira.codehaus.org/browse/MNG-5746
             Project: Maven
          Issue Type: Bug
          Components: Documentation:  General
         Environment: GnuPG
            Reporter: Tibor Digana
            Priority: Critical


Me as a new Committer had to register public GnuPG key. Few parts of this documentation were not maintained as it seems.
http://maven.apache.org/developers/release/pmc-gpg-keys.html

The DSA algorithm is nowadays considered not secure enough. Therefore RSA should be chosen:
(1) DSA and Elgamal (default)
Your selection? 1
DSA keypair will have 1024 bits.


DSA Key size is nowadays too short even for RSA and should be 4096:
What keysize do you want? (2048) 2048
Requested keysize is 2048 bits


Password was not entered. Here we have different opinions. From my PoV no password might be ok for signature verification. The Committers use to keep their keys in .gpg folder on their private laptops and they do not distribute them in CI systems.

You need a Passphrase to protect your secret key.

You don't want a passphrase - this is probably a *bad* idea!
I will do it anyway.  You can change your passphrase at any time,
using this program with the option "--edit-key".



--
This message was sent by Atlassian JIRA
(v6.1.6#6162)