From: Ted Zlatanov <tzz@lifelogs.com>
To: emacs-devel@gnu.org
Subject: Re: [PATCH] package.el: check tarball signature
Date: Mon, 30 Sep 2013 17:54:41 -0400 [thread overview]
Message-ID: <874n92x9em.fsf@flea.lifelogs.com> (raw)
In-Reply-To: m3eh863xbz.fsf-ueno@gnu.org
On Mon, 30 Sep 2013 15:48:16 -0400 Daiki Ueno <ueno@gnu.org> wrote:
DU> Well, I still don't understand why this is advertised as such a
DU> difficult problem, particularly why package.el would need sign operation
DU> with Emacs. Am I missing something?
Yes, I think so. Checking package signatures in general was mostly
resolved back in June 2013, I simply didn't have time to work on it
until just now. When I wanted to play with it over the weekend, the
GnuPG 2.0.20 behavior annoyed me enough that I complained about it and
am planning to expose the libnettle functions ASAP so we don't have to
depend on GnuPG.
The difficult part has been specifying the desired behavior, not
implementing it.
Perhaps you can look at
http://thread.gmane.org/gmane.emacs.devel/155400/focus=160631 and look
at my patch there and the surrounding discussion for background. Stefan
participated and advised me on most of the desired features.
DU> Perhaps it might make sense to discuss with some code. Here it is.
DU> The code verifies a detached signature NAME-VERSION.tar.sig with a
DU> trusted keyring located under ~/.emacs.d/elpa/gnupg/. That's it.
The signed/unsigned status needs to be shown in the package listing.
Some archives are signed, some aren't. Any file from an archive, not
just a package tarball, should be signed (especially the package index).
The management of the special gnupg keychain needs to be abstracted.
Signatures should be generated from inside Emacs.
In addition I started on the EPG interaction you've finished, so you can
probably start with my patch and fix the EPG-related pieces and any
other issues instead of writing your own.
DU> For uploading packages, we could simply use the same mechanism as
DU> gnupload in Gnulib.
DU> It's actually a 10-minute work at an airport lobby and tested only with
DU> the local package archive.
Your help is very welcome.
Ted
next prev parent reply other threads:[~2013-09-30 21:54 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-09-30 19:48 [PATCH] package.el: check tarball signature Daiki Ueno
2013-09-30 19:58 ` Eli Zaretskii
2013-10-02 6:20 ` [PATCHv2] " Daiki Ueno
2013-10-02 10:43 ` Ted Zlatanov
2013-09-30 21:54 ` Ted Zlatanov [this message]
2013-09-30 22:56 ` [PATCH] " Stefan Monnier
2013-10-02 11:17 ` Ted Zlatanov
2013-10-02 7:16 ` Daiki Ueno
2013-10-02 10:41 ` Ted Zlatanov
2013-10-02 12:22 ` Daiki Ueno
2013-10-02 13:53 ` Ted Zlatanov
2013-10-03 3:51 ` Stefan Monnier
2013-10-02 13:15 ` Thien-Thi Nguyen
2013-10-03 3:45 ` Stefan Monnier
2013-10-03 3:52 ` Stefan Monnier
2013-10-03 7:18 ` Daiki Ueno
2013-10-03 14:19 ` Ted Zlatanov
2013-10-03 15:01 ` Stefan Monnier
2013-10-04 19:23 ` Eli Zaretskii
2013-10-04 21:14 ` Ted Zlatanov
2013-10-05 0:34 ` Daiki Ueno
2013-10-05 5:40 ` Stephen J. Turnbull
2013-10-05 10:03 ` Ted Zlatanov
2013-10-05 15:07 ` Stephen J. Turnbull
2013-10-05 21:51 ` Ted Zlatanov
2013-10-05 9:57 ` Ted Zlatanov
2013-10-05 7:09 ` Eli Zaretskii
2013-10-05 10:11 ` Ted Zlatanov
2013-10-05 12:37 ` Eli Zaretskii
2013-10-05 13:53 ` Stefan Monnier
2013-10-04 2:46 ` Daiki Ueno
2013-10-04 16:19 ` Ted Zlatanov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://www.gnu.org/software/emacs/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=874n92x9em.fsf@flea.lifelogs.com \
--to=tzz@lifelogs.com \
--cc=emacs-devel@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/emacs.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).