From mboxrd@z Thu Jan 1 00:00:00 1970 From: Nikita Karetnikov Subject: Re: New =?utf-8?Q?=E2=80=9Cguix_refresh=E2=80=9D?= command Date: Tue, 07 May 2013 23:03:54 +0400 Message-ID: <87d2t2ehnp.fsf@karetnikov.org> References: <87ehdzlg89.fsf@gnu.org> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha1; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([208.118.235.92]:35011) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UZn8H-00009O-DD for bug-guix@gnu.org; Tue, 07 May 2013 15:01:06 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UZn8B-00025b-Ge for bug-guix@gnu.org; Tue, 07 May 2013 15:01:01 -0400 List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org To: Ludovic =?utf-8?Q?Court=C3=A8s?= Cc: bug-guix@gnu.org --=-=-= > When downloading new tarballs, it also retrieves signatures and checks > them with GPG, via the new (guix gnupg) module. Could you point me to this part of the source code? I fail to find it. > If the public key is missing, it attempts to get it from keys.gnupg.net, > and tries again; in that case, the key is added to your keyring. I haven't tried the tool yet, but I'm suspicious. First, what if the mirror is malicious but the key is there? You'll fetch a malicious tarball and a malicious key. Is it possible to use three mirrors to check keys and tarballs? I also think that one must always check keys manually (using similar pages [1]). Maybe we should manually add fingerprints to a licenses.scm-like file and use it along with keys.gnupg.net. It sounds tedious, but it'll be necessary only when you package something for the first time. What do you think? It also bugs me that there are a lot of packages which are not signed at all. I guess I'll start to ask maintainers to add signatures (at least for the future versions). I hope you'll do the same. Second, is there a way not to pollute my keyring with such keys or at least mark them somehow (for example, as not trusted)? [1] http://gcc.gnu.org/mirrors.html --=-=-= Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQIcBAEBAgAGBQJRiVAeAAoJEM+IQzI9IQ38QKAP/jXQmKfxxMtBcHdP+S4MgQND 8ifLyOtDT9phHpjOw1HAHnZhrRQWB81s7HmHLB/jh0FcC4L4cymTmH+ZPRp/8Dk1 WvTcJQ3O4o0i5OUpj5sN9B7S4nsxcjzYAwz8iLXrG1KOchQ1vzIsEK4eiln8SH9x NO0ap/WVnExKnizAAEfIsClPObXWcvYYu5Abpi/4AFtPcPwzfHerA95j14uzip7R rQjVKPsK+st5SBtpgM2cftDlWmON3YlKTv2QhVyE9No5d/OrwvwY57o3ZLr3QwzC W2lwi6hMxrTiUOIfb7v6Udava/AEywTJ0Fa0h/c/EK/kI/Hx+Z+KdWQZck9Q9LbK 2HoJ2PbaSzkmWz/1XWGGD91/hRI7VyNWFiOwRPBwrnBMKNQa0F4fb9DVHkwyg8fN kdwsjizw3wsxocsSLMPsb8bq+Rhw4pjFBQngZ5RpRhBKZuDdRWKs8GLe1dl4bXp8 Gck18EqdsDbAQ176HytoArQ5C7Yulzh+u2HhgTQyudxTJsk9bcVuy9ihb9mjcoaj DiTzt2GjzMO9+SpKJqGLW636DFOsc8RAREBf5L+PBqCn9rnyIw8S6AVmCu/EszXe Zs0qN/tIQ1tXWe/G3U/hZdBXFdk8YpT7SbA3sY7PXFmzlHM1P095eTYJGM0E+VS8 6Xc0Mldkw01DSXbCzaJi =G1Ep -----END PGP SIGNATURE----- --=-=-=--