Re: Checking signatures on source tarballs

[Brandon Invergo <brandon@invergo.net>]

Hi everyone,

On Thu, 2015-10-08 at 13:44 +0200, Ludovic Courtès wrote:

> Actually I see that GSRC already maintains per-package keyrings.
> 
> How is this maintained, Brandon?  That is, where do you get information
> on which keys to put in the keyring, etc.?

Admittedly, it's not ideal.  When we first add a package, we make a
keyring for it based on whatever information is available to us.
Sometimes the public key is listed in the release announcement.  Other
times, we just have to grab the public key of whatever we see the
package was signed with.  Obviously, that's not very secure since it
could have been signed by an attacker.  However usually this process is
only performed when adding a new (to GNU) package.  Then, if the
signature-checking process ever fails on future releases, I actually
look into it.  Sometimes, no public key is available in any of the key
servers as far as I can tell.  In those cases, we ignore the signature.

As I said, this isn't ideal and I would welcome any ideas for a unified
solution for both GSRC and Guix.  I could swear that previously a
keyring of the GNU maintainers was made available by the FSF somewhere
but I cannot find it.  One minimal thing that I can do is to send out a
request to all maintainers to make the public key (or at least its id)
available on the package's home page...we still probably wouldn't have
100% coverage, but it's a start.

-brandon