[dns-wg] RIPE NCC trust anchor file signature verification

Dear colleagues,

It was brought to our attention that the PGP signature of the trust
anchor file we publish for all our signed zones was failing to verify
with versions of GnuPG 1.4.8 and higher.

This was caused by a combination of the following conditions:

1. A plain text file contains white space at the ends of lines
and
2. A detached signature is generated

In this case, the signature generated by versions of GnuPG lower than
1.4.8 will not verify with GnuPG 1.4.8 and higher.

We have corrected this situation by ensuring that the trust anchor file
we publish does not have extra white space at the end of any line.
Therefore, the signature over this file will verify with any version of
GnuPG.

We have published an updated trust anchor file on the RIPE NCC website.
We also took this opportunity to introduce trust anchors for two new
reverse zones that we signed recently, which are 109.in-addr.arpa and
178.in-addr.arpa. The file and its signature are available at:

https://www.ripe.net/projects/disi/keys/index.html

Regards,

Anand Buddhdev
DNS Services Manager
RIPE NCC