perfsonar-official.gpg.key via https instead of http

[Happy86]

Hi,

the documentation at https://docs.perfsonar.net/install_debian.html#step-1-configure-apt / https://github.com/perfsonar/docs/blob/master/install_debian.rst?plain=1#L69 refers to http://downloads.perfsonar.net/debian/perfsonar-release.gpg.key.

So to initially get the public key it has to be downloaded via http without TLS. Maybe I'm a bit too paranoid but that sounds like a bad idea.

When manually changing http to https curl errors with no alternative certificate subject name matches target host name 'downloads.perfsonar.net'.

Ignoring the broken certificate (misconfigured webserver?) using curl --insecure a HTTP/1.1 404 Not Found is returned.

Can you please fix this?

Thank you.

Best regards,
Andreas

PS: Using apt-key add also emits Warning: apt-key is deprecated. Manage keyring files in trusted.gpg.d instead (see apt-key(8)).. But moving the file to /etc/apt/trusted.gpg.d/perfsonar-official.asc and including [signed-by=/etc/apt/trusted.gpg.d/perfsonar-official.asc] after the deb/deb-src and before the http... in perfsonar-release.list fixes that.

[mfeit-internet2]

This is being worked on. Internet2 is using this as an opportunity to migrate an old server to a new one.

Re. the use of apt-key: The installation script has a replacement for that in testing. We'll fix the docs, too.

[laeti-tia]

Our download repository is now setup to use https.

[Happy86]

Thank you for your work! :-)