The XFree86 public key

The XFree86 Project uses the security at XFree86.org public key so that all parties using XFree86 software and this site know that it is authentic. Our public key also tells you that the information received from this site was not altered either deliberately or inadvertently and that our identity is inextricably bound to the information provided.

We sign only the tagged release software available from our FTP site. We also use our public key for other security sensitive matters. We do not sign our experimental snapshots.

Where do you find the key?

The security at XFree86.org GNU Privacy Guard (GPG) public key is available from the following sites:

from this web page
from this link where it can be downloaded
and a public key server such as pgp.mit.edu

How do you verify the key fingerprint?

We strongly recommend that you check the fingerprint of our key against a number of different sources after downloading it but before trusting it. Do not rely on this page solely as it could have been compromised.

If you should find that at any of these sites, our signature differs from the one provided at this website or in any of the packages that we have signed and uploaded on our FTP site or our FTP mirrors, report this immediately security at Xfree86.org. Do not forget to include a complete URL to the file with a bad signature in your report.

A good reference for further information on public key validation, authentication and other trust-reated issues is the GPG Handbook.

The security@xfree86.org public key fingerprint is:

A0EA FDB7 1D11 CE9D 072A 2CB5 6458 ACD2 6955 B539

How do you check the XFree86 signature?

First you need to import the security@xfree86.org public key to your key ring with a command like:

gpg --import security@xfree86.org.asc

To verify the signature for a foo.tgz file distribution, run the command

gpg --verify foo.tgz.asc foo.tgz

Report any bad signatures of packages found on our FTP site or its mirrors to security@XFree86.org. Do not forget to include a complete URL to the file with a bad signature in your report.

What is the security@XFree86.org public key?

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info on this, go here

mQGiBDyFGMQRBACyWOLb7vHlBpzIuJwU0Zh6T6g46Tjs46IEIxCSQNfNNgMbtcdM
XvWGuTJjIKXLvp3jvgXoVptefBvTzVKsXxug9HA/xWGuHOFiKzWNCCYk4hDuM/nx
XQCCWMsHnDuZCpbKonHqyM/wAr8RXGd1ERvxCvFXSuV0iUD8hum164cwswCglh8J
IY2HafHC7up+Q/DGv8+CAdkD/3QNwGlyYhFNv6oWWr+HDZSso9nDkqRfI4PIgRrD
b8e/ntnHsua+Q/E77y6eYf/c/YKeVn93W9uw8hInnnXOs5qVQd2VEuvUgwMvDcpM
9pRlTooCdVV/+XQlcmx03igwNMKWr5EDdPOcbaYTuwDupJKNohdqTSh/npbhUjpJ
OdtkA/sHflTW7OdscJzFj8GcEzbA9JMDUkqse3x+/4JYdX7P000pCQO51n6WIDNE
GfPZfLhCpB0XeGrm8Qw7CGD6vqdozWQdL6PYigoY/Vwmmet2eXKLuQWMM4FXUCQ9
CXCvcs3WbPLGo/uekv10jtkDqOsM3evnGi/L5fawwm3oVYnbKbQnWEZyZWU4NiBT
ZWN1cml0eSA8c2VjdXJpdHlAeGZyZWU4Ni5vcmc+iFcEExECABcFAjyFGMQFCwcK
AwQDFQMCAxYCAQIXgAAKCRBkWKzSaVW1OQHgAJoCID4c7NJtIzaiPcZTimzeaQwT
DgCeM0CvhNsEgB3h9reoRvHpXO4KOuaIRgQQEQIABgUCPIUZFwAKCRCnFfcJo1bU
m3DbAKCzT2+tM1RVVokrXZ7P2r9gDSrbMACfYH3Es3agKlocAye50dtcOS8ZEje5
AQ0EPIUYyxAEAK0ABejoG8wgj+clKtOBiSo+Kh+yQJS4YaNenNfAWGg7pnpb80rK
ajJRaih2y2AMnn+QR3ZdsS/JZCydw8Cen9zVoVq3HIRdsTmIHqsOyA68auqA4AWx
TSYyFq6dUm/VmOuP6TvqPZyn4LnztDjPLVNfJOkgWs+PnBPcwO2s2Fm3AAMFBACk
wexM7unT8FMouezxnAwS35/SuhC8sSA16x3SU/QDY0eIDjMHMyDN3iBoo002u5kg
tx7z7jaKJRe8g1oo8d1xs21kGev4e/ktuZoWK5+myb7NOLZdLkcMdfpAROuST1Ou
EVtvQsYSgpXaMvvKHhwgNgT+1LL3caHNRdLkU/EuI4hGBBgRAgAGBQI8hRjLAAoJ
EGRYrNJpVbU5C+UAn1sLJfcaZpVTreAso9qYcBgJUM6gAJ9BCdUJALo0jxynhkC4
9GVS6sE1Sw==
=0ieG
-----END PGP PUBLIC KEY BLOCK-----

XFree86® is a registered trademark of The XFree86 Project, Inc.

Last Modified: 24 June 2004.