[Replicant] 6.0 0004: unrecognised image signature, and dead link for recovery image

[Luca Saiu]

Hello, and thanks for your work on this.

I had an older 6.0-0004-rc4 installed on my Galaxy Note 2 (n7100); as I
am now trying to upgrade it to the released 6.0-0004 I have managed to
upgrade it to rc5-transition , which works, but then installing the
6.0-0004 image fails.

Details follow.

First problem: missing recovery image on the web site.

The page
  https://redmine.replicant.us/projects/replicant/wiki/Images
has a dead link for the recovery image for 6.0-0004 on the n7100:
The following URLs give fail with 404:
  https://ftp-osl.osuosl.org/pub/replicant/images/replicant-6.0/0004/images/n7100/recovery-n7100.img.asc
  https://ftp-osl.osuosl.org/pub/replicant/images/replicant-6.0/0004/images/n7100/recovery-n7100.img
(I have not checked all the images for the other models; you might want
to.)

So instead I tried using the image found here
  https://ftp-osl.osuosl.org/pub/replicant/images/replicant-6.0/0004-transition/images/n7100/
which look recent, along with the other versions I had.

Second problem: installing the new 6.0-0004 image over ADB fails as
shown here:
  https://ageinghacker.net/scratch/install-failed.jpg

The image looks correct, but...
    [luca at moore ~/replicant/installation-backup/6.0-0004]$ gpg --verify replicant-6.0-0004-n7100.zip.asc  replicant-6.0-0004-n7100.zip
    gpg: Signature made Fri 21 Jan 2022 12:04:48 AM CET
    gpg:                using RSA key 782F9DDBE36BA7F3D4DE49065F5DFCC14177E263
    gpg: Good signature from "Denis 'GNUtoo' Carikli <GNUtoo at cyberdimension.org>" [expired]
    gpg:                 aka "Denis 'GNUtoo' Carikli <GNUtoo at no-log.org>" [expired]
    gpg:                 aka "Denis 'GNUtoo' Carikli <GNUtoo at riseup.net>" [expired]
    gpg:                 aka "Denis 'GNUtoo' Carikli <GNUtoo at makefreedom.org>" [expired]
    gpg: Note: This key has expired!
    Primary key fingerprint: FB31 DBA3 AB8D B76A 4157  329F 7651 568F 8037 4459
         Subkey fingerprint: 782F 9DDB E36B A7F3 D4DE  4906 5F5D FCC1 4177 E263

On 2022-06-03 at 09:56 +0000, WordPress via Replicant wrote:
> Even if we released the images back in January 2022, we didn’t
> announce it officially at the time  ^^^^^^^^^^^^^^^

This might be the problem: as gpg says above, the key has since expired.
Could that be the reason why the image verification fails?  Or maybe
the recovery system I am using simply lacks the correct key.

Thanks in advance,

-- 
Luca Saiu
* My personal web site:  http://ageinghacker.net
* GNU Jitter:            https://www.gnu.org/software/jitter
* GNU epsilon:           https://www.gnu.org/software/epsilon

I support everyone's freedom of mocking any opinion or belief, no
matter how deeply held, with open disrespect and the same unrelented
enthusiasm of a toddler who has just learned the word "poo".
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 857 bytes
Desc: not available
URL: <http://lists.osuosl.org/pipermail/replicant/attachments/20220603/8a33380a/attachment-0001.asc>