pg.ddx.io pgsql-pkg-debian@postgresql.org mailing list archive
help / color / mirror / Atom feedRequest for PGDG Repository Signing-Key Verification — PostgreSQL 16.10
3+ messages / 3 participants
[nested] [flat]
* Request for PGDG Repository Signing-Key Verification — PostgreSQL 16.10
@ 2026-10-22 01:57 eric asiedu <iameric.asiedu@gmail.com>
2026-10-30 16:27 ` Re: Request for PGDG Repository Signing-Key Verification — PostgreSQL 16.10 Christoph Berg <myon@debian.org>
0 siblings, 1 reply; 3+ messages in thread
From: eric asiedu @ 2026-10-22 01:57 UTC (permalink / raw)
To: pgsql-pkg-debian
Hello PostgreSQL APT Repository Maintainers,
I am contacting you on behalf of Aserion, an enterprise cryptographic
security and post-quantum migration assurance platform currently
undergoing a security qualification review.
As part of our software supply-chain verification, we are seeking
authoritative confirmation of the PostgreSQL Global Development Group
(PGDG) repository signing key used to authenticate PostgreSQL 16.10
source-package metadata.
Our verification identified the following:
*PGDG repository signing-key fingerprint:*
B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8
*PostgreSQL 16.10 source archive SHA-256:*
de8485f4ce9c32e3ddfeef0b7c261eed1cecb54c9bcd170e437ff454cb292b42
*Archive size:* 24,977,722 bytes
We successfully verified the signature chain from the PGDG archived Debian
repository's InRelease metadata through its Sources.bz2 index to the exact
archive digest.
We also verified a historical third-party OpenPGP certification of the PGDG
key by Christoph Berg's key.
To complete our independent trust assessment, could you please confirm:
1.
Whether the PGDG fingerprint above is the authentic, authorized
repository signing key for the relevant repository metadata.
2.
Whether the key was authorized for signing the PostgreSQL 16.10
source-package metadata and whether there are any relevant known
compromise, revocation or replacement notices.
3.
Whether there is an authoritative historical key record, signed
statement, or independently verifiable channel that can corroborate the
key's identity.
4.
Whether the archived signed metadata is an appropriate reference for
establishing the authenticity of this exact source archive, subject to its
date and freshness limitations.
A response identifying an authoritative verification method or existing
signed evidence would be greatly appreciated. We are not requesting changes
to PostgreSQL or a new release signature.
Thank you for your assistance.
Kind regards,
Aserion Security Qualification Team
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Request for PGDG Repository Signing-Key Verification — PostgreSQL 16.10
2026-10-22 01:57 Request for PGDG Repository Signing-Key Verification — PostgreSQL 16.10 eric asiedu <iameric.asiedu@gmail.com>
@ 2026-10-30 16:27 ` Christoph Berg <myon@debian.org>
2026-10-30 18:02 ` Re: Request for PGDG Repository Signing-Key Verification — PostgreSQL 16.10 Pierre-Marie Petit <pierremariepetit@gmail.com>
0 siblings, 1 reply; 3+ messages in thread
From: Christoph Berg @ 2026-10-30 16:27 UTC (permalink / raw)
To: eric asiedu <iameric.asiedu@gmail.com>; +Cc: pgsql-pkg-debian
Re: eric asiedu
> A response identifying an authoritative verification method or existing
> signed evidence would be greatly appreciated. We are not requesting changes
> to PostgreSQL or a new release signature.
Hey,
could you please help us understand
1) which extra information on something like
https://www.postgresql.org/download/linux/debian/ you are missing and
2) why we are seeing an influx of these questions now when the
situation didn't change in the last 15 years. Did some AI guide tell
you to ask?
Christoph
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: Request for PGDG Repository Signing-Key Verification — PostgreSQL 16.10
2026-10-22 01:57 Request for PGDG Repository Signing-Key Verification — PostgreSQL 16.10 eric asiedu <iameric.asiedu@gmail.com>
2026-10-30 16:27 ` Re: Request for PGDG Repository Signing-Key Verification — PostgreSQL 16.10 Christoph Berg <myon@debian.org>
@ 2026-10-30 18:02 ` Pierre-Marie Petit <pierremariepetit@gmail.com>
0 siblings, 0 replies; 3+ messages in thread
From: Pierre-Marie Petit @ 2026-10-30 18:02 UTC (permalink / raw)
To: Christoph Berg <myon@debian.org>; eric asiedu <iameric.asiedu@gmail.com>; pgsql-pkg-debian
Hi, i asked AI best way to follow pre-requisite. But in fact i was wrong.
no extras informations are missing.
*Pierre-Marie PetitDBA Oracle - PostgreSql - SqlServer*
Le ven. 30 oct. 2026 à 17:27, Christoph Berg <myon@debian.org> a écrit :
> Re: eric asiedu
> > A response identifying an authoritative verification method or existing
> > signed evidence would be greatly appreciated. We are not requesting
> changes
> > to PostgreSQL or a new release signature.
>
> Hey,
>
> could you please help us understand
>
> 1) which extra information on something like
> https://www.postgresql.org/download/linux/debian/ you are missing and
>
> 2) why we are seeing an influx of these questions now when the
> situation didn't change in the last 15 years. Did some AI guide tell
> you to ask?
>
> Christoph
>
>
>
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2026-10-30 18:02 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-10-22 01:57 Request for PGDG Repository Signing-Key Verification — PostgreSQL 16.10 eric asiedu <iameric.asiedu@gmail.com>
2026-10-30 16:27 ` Christoph Berg <myon@debian.org>
2026-10-30 18:02 ` Pierre-Marie Petit <pierremariepetit@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox