I'm in the course of rescuing a legacy app that got left behind and turned out to be needed on rare occasions, one of which occurred yesterday. I need to rebuild some libraries and the libraries have a strict dependance on gcc > 6.0 which the server sadly lacked by a mile. So I went looking for a newer gcc and found mirror sites here:https://gcc.gnu.org/mirrors.html such as http://www.netgull.com/gcc/releases/gcc-9.3.0/. (Aside: so many sites still answer over http, not https, oh yay!)
The gcc-9.3.0.tar.gz archive signature in gcc-9.3.0.tar.gz.sig is with the key for Jakub Jelinek listed on the gnu.org page, fingerprint
33C2 35A3 4C46 AA3F FB29 3709 A328 C3A2 C3C4 5C06.
This key is in the ancient keyring at https://ftp.gnu.org/gnu/gnu-keyring.gpg, and has expired.
Why are recent versions of gcc, of all things, being distributed this way? Is there some refreshed version of this key I'm not finding? Or a different mirror site using a different signing key?