Re: New “guix refresh” command

[Nikita Karetnikov <nikita@karetnikov.org>]

[-- Attachment #1: Type: text/plain, Size: 1241 bytes --]

> When downloading new tarballs, it also retrieves signatures and checks
> them with GPG, via the new (guix gnupg) module.

Could you point me to this part of the source code?  I fail to find it.

> If the public key is missing, it attempts to get it from keys.gnupg.net,
> and tries again; in that case, the key is added to your keyring.

I haven't tried the tool yet, but I'm suspicious.

First, what if the mirror is malicious but the key is there?  You'll
fetch a malicious tarball and a malicious key.  Is it possible to use
three mirrors to check keys and tarballs?

I also think that one must always check keys manually (using similar
pages [1]).  Maybe we should manually add fingerprints to a
licenses.scm-like file and use it along with keys.gnupg.net.  It sounds
tedious, but it'll be necessary only when you package something for the
first time.  What do you think?

It also bugs me that there are a lot of packages which are not signed at
all.  I guess I'll start to ask maintainers to add signatures (at least
for the future versions).  I hope you'll do the same.

Second, is there a way not to pollute my keyring with such keys or at
least mark them somehow (for example, as not trusted)?

[1] http://gcc.gnu.org/mirrors.html

[-- Attachment #2: Type: application/pgp-signature, Size: 835 bytes --]