commit 2d238cf3875f1a0a7c874f0a9b14f7582d19907a
Author: Sven Joachim <svenjoac@gmx.de>
Date: Sat Jan 24 20:37:31 2026 +0100
Convert the watch files to version 5
commit afee7675c395951ac92ca5bf3a393410931c396c
Author: Sven Joachim <svenjoac@gmx.de>
Date: Sat Jan 24 20:23:04 2026 +0100
Update upstream signing key
The key had expired on 2026-01-18, update has a published a refreshed
version at
https://invisible-island.net/public/dickey@invisible-island.net-rsa3072.asc.
Unfortunately we cannot simply replace the current key with a minimal
export of the new one, as that would break verification of the current
version when dpkg-source creates the source package, see
https://gitlab.com/sequoia-pgp/sequoia/-/issues/1105.
To keep both dpkg-source and uscan happy, we need both the expired
self-sig and the new one, I merged them with the following two commands:
$ gpg --export --armor --export-options export-minimal 19882D92DDA4C400C22C0D56CC2AF4472167BE03 >> debian/upstream/signing-key.asc
$ sq keyring merge --overwrite --output debian/upstream/signing-key.asc debian/upstream/signing-key.asc
When we update to a newer upstream patchlevel, we can minimize the key
again.
There is 1 open security issue in trixie.
You can find information about how to handle this issue in the security team's documentation.
There are 2 open security issues in bookworm.
You can find information about how to handle these issues in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/n/ncurses.png){kind=link}