From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: bug#27437: Source downloader accepts X.509 certificate for incorrect domain Date: Thu, 22 Jun 2017 23:24:01 -0400 Message-ID: <20170623032401.GA13366@jasmine.lan> References: <20170621061752.GA32412@jasmine.lan> <87lgolipi0.fsf@gnu.org> <87injohwac.fsf@netris.org> <87o9tf1ytl.fsf@elephly.net> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="dDRMvlgZJXvWKvBx" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:47016) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dOFDY-0006My-1v for bug-guix@gnu.org; Thu, 22 Jun 2017 23:25:09 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dOFDT-0004Ne-4n for bug-guix@gnu.org; Thu, 22 Jun 2017 23:25:08 -0400 Received: from debbugs.gnu.org ([208.118.235.43]:59296) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dOFDS-0004M5-I1 for bug-guix@gnu.org; Thu, 22 Jun 2017 23:25:03 -0400 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1dOFDS-00020s-Bx for bug-guix@gnu.org; Thu, 22 Jun 2017 23:25:02 -0400 Sender: "Debbugs-submit" Resent-Message-ID: Content-Disposition: inline In-Reply-To: <87o9tf1ytl.fsf@elephly.net> List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: Ricardo Wurmus Cc: 27437@debbugs.gnu.org --dDRMvlgZJXvWKvBx Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jun 22, 2017 at 11:45:26PM +0200, Ricardo Wurmus wrote: >=20 > Mark H Weaver writes: >=20 > > FWIW, I always check digital signatures when they're available, and I > > hope that others will as well, but in practice we are putting our faith > > in a large number of contributors, some of whom might not be so careful. >=20 > I do the same when signatures are available. I couldn=E2=80=99t find this > recommendation in =E2=80=9Ccontributing.texi=E2=80=9D =E2=80=94 should we= add it there? To me, it seems that the manual section Packaging Guidelines is a better fit. But, we tend to recommend people read Contributing, but rarely do I see Packaging Guidelines recommended. I suppose it's assumed they will find it themselves. --dDRMvlgZJXvWKvBx Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAllMic4ACgkQJkb6MLrK fwhqQg//aFTPTnUeTD97IokGgPLjZJUphNMtrldYHqmlRPwgZWV8Vfucg/k2cE8/ I3KJkfbI5m4wjI+hAgHsTvbRLQq1gtJPe6UmGI71FeNq+Zv7NSAdDAl8xqqYd13x cNBne/SJs1wCl+QtP7bYB9M1MmCXa7hIwk9Zu5T3MtXwY3Rt1RDtng4youNtbXaL GgkmQTeqnsBegrNx6USMfGysILMyZaH5ZrY6uLgHHCGWnze+tvlXZbcG2VVo92JS bmGxnuZCS1ZQFqkNqreLIbu43Z8/mKdjq8PDRjuoGEI1PuvmFFyDQEjZ0FotCyer FE6jBokdCrzpA/jB4f0Umb5Ox4tdFsnQYIYGSE4IrAkXi3kLl0DuMAQ69t2K4b02 8DPFvLGcAfEXQn5BbplpcpjTuF5X1GzZruYnQbCVQNnLbvRXUKLrxgyqjg+4cQs5 64xVcAhTAjAkzS6nVSK68WRjsufh/dnzl1rQ6OG5O+gbR6YOBtWOf6XjmzHqpKzn a9VFRodOfSz1DegfrqB760izhmZdJq/dYGxItUlQJOvfJMEmghd59RI3+MXbX4al 31JpNM+WqEWCaQd8diEd+KcnrxP/7OVI+8pvgspTOtrwnmjYOtbP+0I1e9yC5Z+7 dNkvguhH7Lmn+zWz12v7NotWTzT3BUBoA8zjbZAXH/StRFbCDZA= =xjmu -----END PGP SIGNATURE----- --dDRMvlgZJXvWKvBx--