From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp2 ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms11 with LMTPS id UI6UD4bE2F6mWwAA0tVLHw (envelope-from ) for ; Thu, 04 Jun 2020 09:53:10 +0000 Received: from aspmx1.migadu.com ([2001:41d0:2:4a6f::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp2 with LMTPS id 4KRRC4bE2F55cQAAB5/wlQ (envelope-from ) for ; Thu, 04 Jun 2020 09:53:10 +0000 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 024269402D6 for ; Thu, 4 Jun 2020 09:53:10 +0000 (UTC) Received: from localhost ([::1]:33840 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jgmYe-00030W-U0 for larch@yhetil.org; Thu, 04 Jun 2020 05:53:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:58634) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jgmYU-00030M-Og for guix-devel@gnu.org; Thu, 04 Jun 2020 05:52:58 -0400 Received: from imta-38.everyone.net ([216.200.145.38]:57158) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jgmYT-0005dG-Ha for guix-devel@gnu.org; Thu, 04 Jun 2020 05:52:58 -0400 Received: from pps.filterd (omta003.sj2.proofpoint.com [127.0.0.1]) by imta-38.everyone.net (8.16.0.27/8.16.0.27) with SMTP id 0549o9FK028619 for ; Thu, 4 Jun 2020 02:52:51 -0700 X-Eon-Originating-Account: IQVOqzlMZZbVH5h2nfYKp3HLLM-bo6Xvg9_P-Enw8DQ X-Eon-Dm: m0117124.ppops.net Received: by m0117124.mta.everyone.net (EON-AUTHRELAY2 - 5a81db89) id m0117124.5e67f957.8e1fe1 for ; Thu, 4 Jun 2020 02:52:50 -0700 X-Eon-Sig: AQMHrIJe2MRygtTeggIAAAAB,ee45151aa2e113e9573a1edf53e38ac9 X-Eip: hE7vfJxUnPeVJPElFISBBSYnySbqayylTyI0TSuD0ao Date: Thu, 4 Jun 2020 11:52:40 +0200 From: Bengt Richter To: guix-devel@gnu.org Subject: Re: GNU Shepherd 0.8.1 released Message-ID: <20200604095240.GA5255@LionPure> References: <87ftbcnwmg.fsf@gnu.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <87ftbcnwmg.fsf@gnu.org> User-Agent: Mutt/1.10.1 (2018-07-13) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.216, 18.0.687 definitions=2020-06-04_07:2020-06-02, 2020-06-04 signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1034 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-2004280000 definitions=main-2006040067 Received-SPF: pass client-ip=216.200.145.38; envelope-from=bokr@oz.net; helo=imta-38.everyone.net X-detected-operating-system: by eggs.gnu.org: First seen = 2020/06/04 05:52:51 X-ACL-Warn: Detected OS = Linux 3.x [generic] [fuzzy] X-Spam_score_int: -22 X-Spam_score: -2.3 X-Spam_bar: -- X-Spam_report: (-2.3 / 5.0 requ) BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.249, RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001 autolearn=_AUTOLEARN X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Bengt Richter Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: "Guix-devel" X-Scanner: scn0 Authentication-Results: aspmx1.migadu.com; dkim=none; dmarc=none; spf=pass (aspmx1.migadu.com: domain of guix-devel-bounces@gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=guix-devel-bounces@gnu.org X-Spam-Score: 0.99 X-TUID: Dbr8pg6G0DCc Hi Ludo, et al, Would there be a benefit from NOT using .sig's from mirrors while getting corresponding .tgz's from mirrors to help with traffic? On +2020-06-03 14:48:23 +0200, Ludovic Courtès wrote: > We are pleased to announce the GNU Shepherd version 0.8.1. This release > represents 16 commits by 4 people, bringing an important bug fix and > improvements to the code. [...] > • Download > > Here are the compressed sources and a GPG detached signature[*]: > https://ftp.gnu.org/gnu/shepherd/shepherd-0.8.1.tar.gz > https://ftp.gnu.org/gnu/shepherd/shepherd-0.8.1.tar.gz.sig > > Use a mirror for higher download bandwidth: > https://ftpmirror.gnu.org/shepherd/shepherd-0.8.1.tar.gz > https://ftpmirror.gnu.org/shepherd/shepherd-0.8.1.tar.gz.sig > > Here are the SHA1 and SHA256 checksums: > > 2964502388aa74207e6761c2ff77df69369738b0 shepherd-0.8.1.tar.gz > d32fe58694bb5350b5fc7285cf0ca0d9c7d24221aa5969d6c464ee3e3ac83f75 shepherd-0.8.1.tar.gz > > [*] Use a .sig file to verify that the corresponding file (without the > .sig suffix) is intact. First, be sure to download both the .sig file > and the corresponding tarball. Then, run a command like this: > > gpg --verify shepherd-0.8.1.tar.gz.sig [...] I am wondering if downloading the .sig file from > https://ftp.gnu.org/gnu/shepherd/shepherd-0.8.1.tar.gz.sig (to make sure it is the latest official sig, even if mirrors haven't caught up) and the big file from a mirror: (to avoid overloading the official non-mirror server) > https://ftpmirror.gnu.org/shepherd/shepherd-0.8.1.tar.gz would be a good thing to do for server traffic, while ensuring that I would detect a stale tar.gz if it didn't correspond to the official .sig. Of course one would discover it if one used the sha256sums in the announcement, but could one be fooled by gpg's accepting a valid-as-pair tgz/sig pair where both were actually out of date? If so, could a class of errors and potential vulns be eliminated by not servings .sig's at all from mirrors? (it would be inconvenient when official server was down, but not a showstopper inconvenience, since the tgz would be be mirrored and could be validated with published sha256sum's). -- Regards, Bengt Richter