sec-keys/openpgp-keys-kamilaszewczyk
OpenPGP keys used by Kamila Szewczyk to sign GNU Automake releases
Screenshots
View
Download
BrowseChangeLog
commit 6f0530f32d6e2e0f3bfab181be1857c78a5e7ff6
Author: lucascouts <lucascs@protonmail.com>
Date: Thu Sep 10 14:57:56 2026 -0300
add(dev-build/automake-1.19, sec-keys/openpgp-keys-kamilaszewczyk-20260910), add(metadata/md5-cache/{dev-build/automake-1.19, sec-keys/openpgp-keys-kamilaszewczyk-20260910}), mod(.autoupdate/{packages.toml, dead-upstreams.md})
Automake 1.19 was released 2026-09-10; ::gentoo is still on 1.18.1-r1.
Additive, not a replacement: SLOT is 1.19, autotools.eclass is NOT overridden,
and am-wrapper.sh only scans down from its own LAST_KNOWN_AUTOMAKE_VER=18, so
eautoreconf keeps using 1.18. Reach the new slot with WANT_AUTOMAKE=1.19.
Proven, not asserted: 0 of 133 installed files collide with slot 1.18.
Two things block a straight copy of the ::gentoo ebuild, both new in 1.19.
Signing key changed. 1.18.1 is the last tarball signed by Karl Berry
(0716748A30D155AD); 1.19 is signed by Kamila Szewczyk, ed25519 subkey
D5D527E7E338A682CBADB1C1217FCF7314636C07. verify-sig against
sec-keys/openpgp-keys-karlberry therefore FAILS, hence the new key package.
The primary key is in ftp.gnu.org/gnu/gnu-keyring.gpg, which ties it to the
GNU project rather than to a keyserver upload alone. gpgv against the key this
package installs: exit 0.
./bootstrap now refuses to run. As of 1.19 the script aborts outside a git
checkout ("just mkdir .git and the script will proceed"); the guard is absent
in 1.18.1 and present in 1.19. Rather than take that escape hatch, the call is
dropped: the release tarball already ships configure (with APIVERSION=1.19),
Makefile.in, aclocal.m4 and doc/automake.info, and bootstrap exists to
regenerate them from a VCS tree. Running it on a tarball only makes makeinfo a
hard build dependency. The ebuild says so, so nobody re-copies it from ::gentoo.
The APIVERSION sed is now guarded by grep -q, since sed exits 0 without
matching and the fix would otherwise die silently on a future bump.
The autoupdate record is pinned to the 1.19 line on purpose. SLOT derives from
PV, so 1.19.1 stays in slot 1.19 and is safe to auto-bump, but 1.20 is a
DIFFERENT slot and the applier renames the ebuild in place rather than adding a
second one. Without series, a 1.20 release would DELETE slot 1.19 instead of
adding 1.20 - the defect that erased dev-libs/icu-compat slot on 2026-08-12.
The key package gets no packages.toml record: a keyserver lookup by fingerprint
returns the key current state and publishes no version. It is registered in
dead-upstreams.md section C instead, so it is not mistaken for an oversight.
Evidence: compile exit 0, install exit 0, image inspected file by file,
aclocal-1.19 + automake-1.19 from the image generate a Makefile.in accepting
the 1.19-only AM_OPTIONAL_AUTOMAKE macro, pkgcheck clean on both packages,
gentoo-parity.sh exit 0 (0 ALIGN, 1 JUSTIFIED). Not covered: USE=test, and
USE=verify-sig inside Portage - this host has no sudo, so nothing was merged.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Author: lucascouts <lucascs@protonmail.com>
Date: Thu Sep 10 14:57:56 2026 -0300
add(dev-build/automake-1.19, sec-keys/openpgp-keys-kamilaszewczyk-20260910), add(metadata/md5-cache/{dev-build/automake-1.19, sec-keys/openpgp-keys-kamilaszewczyk-20260910}), mod(.autoupdate/{packages.toml, dead-upstreams.md})
Automake 1.19 was released 2026-09-10; ::gentoo is still on 1.18.1-r1.
Additive, not a replacement: SLOT is 1.19, autotools.eclass is NOT overridden,
and am-wrapper.sh only scans down from its own LAST_KNOWN_AUTOMAKE_VER=18, so
eautoreconf keeps using 1.18. Reach the new slot with WANT_AUTOMAKE=1.19.
Proven, not asserted: 0 of 133 installed files collide with slot 1.18.
Two things block a straight copy of the ::gentoo ebuild, both new in 1.19.
Signing key changed. 1.18.1 is the last tarball signed by Karl Berry
(0716748A30D155AD); 1.19 is signed by Kamila Szewczyk, ed25519 subkey
D5D527E7E338A682CBADB1C1217FCF7314636C07. verify-sig against
sec-keys/openpgp-keys-karlberry therefore FAILS, hence the new key package.
The primary key is in ftp.gnu.org/gnu/gnu-keyring.gpg, which ties it to the
GNU project rather than to a keyserver upload alone. gpgv against the key this
package installs: exit 0.
./bootstrap now refuses to run. As of 1.19 the script aborts outside a git
checkout ("just mkdir .git and the script will proceed"); the guard is absent
in 1.18.1 and present in 1.19. Rather than take that escape hatch, the call is
dropped: the release tarball already ships configure (with APIVERSION=1.19),
Makefile.in, aclocal.m4 and doc/automake.info, and bootstrap exists to
regenerate them from a VCS tree. Running it on a tarball only makes makeinfo a
hard build dependency. The ebuild says so, so nobody re-copies it from ::gentoo.
The APIVERSION sed is now guarded by grep -q, since sed exits 0 without
matching and the fix would otherwise die silently on a future bump.
The autoupdate record is pinned to the 1.19 line on purpose. SLOT derives from
PV, so 1.19.1 stays in slot 1.19 and is safe to auto-bump, but 1.20 is a
DIFFERENT slot and the applier renames the ebuild in place rather than adding a
second one. Without series, a 1.20 release would DELETE slot 1.19 instead of
adding 1.20 - the defect that erased dev-libs/icu-compat slot on 2026-08-12.
The key package gets no packages.toml record: a keyserver lookup by fingerprint
returns the key current state and publishes no version. It is registered in
dead-upstreams.md section C instead, so it is not mistaken for an oversight.
Evidence: compile exit 0, install exit 0, image inspected file by file,
aclocal-1.19 + automake-1.19 from the image generate a Makefile.in accepting
the 1.19-only AM_OPTIONAL_AUTOMAKE macro, pkgcheck clean on both packages,
gentoo-parity.sh exit 0 (0 ALIGN, 1 JUSTIFIED). Not covered: USE=test, and
USE=verify-sig inside Portage - this host has no sudo, so nothing was merged.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>