GNU Shepherd 0.8.1 released

GNU Shepherd 0.8.1 released

[Ludovic Courtès]

[-- Attachment #1: Type: text/plain, Size: 2632 bytes --]

We are pleased to announce the GNU Shepherd version 0.8.1.  This release
represents 16 commits by 4 people, bringing an important bug fix and
improvements to the code.


• About

  The GNU Daemon Shepherd or GNU Shepherd is a service manager written
  in Guile that looks after the herd of system services.  It provides a
  replacement for the service-managing capabilities of SysV-init (or any
  other init) with a dependency-based system with a convenient
  interface.  The GNU Shepherd may also be used by unprivileged users to
  manage per-user daemons (e.g., tor, privoxy, mcron, etc.)  It is
  written in Guile Scheme, and is configured and extended using Guile.

  The GNU Shepherd is developed jointly with the GNU Guix project; it is
  used as the init system of Guix, GNU’s advanced GNU/Linux distribution.

  https://www.gnu.org/software/shepherd/


• Download

  Here are the compressed sources and a GPG detached signature[*]:
    https://ftp.gnu.org/gnu/shepherd/shepherd-0.8.1.tar.gz
    https://ftp.gnu.org/gnu/shepherd/shepherd-0.8.1.tar.gz.sig

  Use a mirror for higher download bandwidth:
    https://ftpmirror.gnu.org/shepherd/shepherd-0.8.1.tar.gz
    https://ftpmirror.gnu.org/shepherd/shepherd-0.8.1.tar.gz.sig

  Here are the SHA1 and SHA256 checksums:

  2964502388aa74207e6761c2ff77df69369738b0  shepherd-0.8.1.tar.gz
  d32fe58694bb5350b5fc7285cf0ca0d9c7d24221aa5969d6c464ee3e3ac83f75  shepherd-0.8.1.tar.gz

  [*] Use a .sig file to verify that the corresponding file (without the
  .sig suffix) is intact.  First, be sure to download both the .sig file
  and the corresponding tarball.  Then, run a command like this:

    gpg --verify shepherd-0.8.1.tar.gz.sig

  If that command fails because you don't have the required public key,
  then run this command to import it:

    gpg --keyserver keys.openpgp.org \
        --recv-keys 3CE464558A84FDC69DB40CFB090B11993D9AEBB5

  and rerun the 'gpg --verify' command.

  This release was bootstrapped with the following tools:
    Autoconf 2.69
    Automake 1.16.2
    Makeinfo 6.7
    Help2man 1.47.13


• Changes since version 0.8.0 (excerpt from the NEWS file)

  ** Fix race condition that could lead shepherd to stop itself
     (<https://bugs.gnu.org/40981>)
  ** Use ‘signalfd’ on GNU/Linux to improve efficiency and simplify code
  ** Outdated bits have been removed from the manual
  ** Updated translation: sv

Please report bugs to bug-guix@gnu.org.
Join guix-devel@gnu.org and gnu-system-discuss@gnu.org for discussions.

Ludovic, on behalf of the Shepherd herd.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: GNU Shepherd 0.8.1 released

[Bengt Richter]

Hi Ludo, et al,

Would there be a benefit from NOT using .sig's from mirrors
while getting corresponding .tgz's from mirrors to help with traffic?

On +2020-06-03 14:48:23 +0200, Ludovic Courtès wrote:
> We are pleased to announce the GNU Shepherd version 0.8.1.  This release
> represents 16 commits by 4 people, bringing an important bug fix and
> improvements to the code.
[...]
> • Download
> 
>   Here are the compressed sources and a GPG detached signature[*]:
>     https://ftp.gnu.org/gnu/shepherd/shepherd-0.8.1.tar.gz
>     https://ftp.gnu.org/gnu/shepherd/shepherd-0.8.1.tar.gz.sig
> 
>   Use a mirror for higher download bandwidth:
>     https://ftpmirror.gnu.org/shepherd/shepherd-0.8.1.tar.gz
>     https://ftpmirror.gnu.org/shepherd/shepherd-0.8.1.tar.gz.sig
> 
>   Here are the SHA1 and SHA256 checksums:
> 
>   2964502388aa74207e6761c2ff77df69369738b0  shepherd-0.8.1.tar.gz
>   d32fe58694bb5350b5fc7285cf0ca0d9c7d24221aa5969d6c464ee3e3ac83f75  shepherd-0.8.1.tar.gz
> 
>   [*] Use a .sig file to verify that the corresponding file (without the
>   .sig suffix) is intact.  First, be sure to download both the .sig file
>   and the corresponding tarball.  Then, run a command like this:
> 
>     gpg --verify shepherd-0.8.1.tar.gz.sig
[...]

I am wondering if downloading the .sig file from
>     https://ftp.gnu.org/gnu/shepherd/shepherd-0.8.1.tar.gz.sig
(to make sure it is the latest official sig, even if mirrors haven't caught up)

and the big file from a mirror:
(to avoid overloading the official non-mirror server)
>     https://ftpmirror.gnu.org/shepherd/shepherd-0.8.1.tar.gz
would be a good thing to do for server traffic, while ensuring that
I would detect a stale tar.gz if it didn't correspond to the official .sig.

Of course one would discover it if one used the sha256sums in the announcement,
but could one be fooled by gpg's accepting a valid-as-pair tgz/sig pair where
both were actually out of date?

If so, could a class of errors and potential vulns be eliminated by not servings .sig's
at all from mirrors? (it would be inconvenient when official server was down, but
not a showstopper inconvenience, since the tgz would be be mirrored and could be
validated with published sha256sum's).

-- 
Regards,
Bengt Richter