#22883 - Trustable "guix pull" - GNU bug report logs

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #144 received at 22883@debbugs.gnu.org (full text, mbox, reply):

Received: (at 22883) by debbugs.gnu.org; 2 Sep 2018 20:07:39 +0000
From debbugs-submit-bounces@debbugs.gnu.org Sun Sep 02 16:07:39 2018
Received: from localhost ([127.0.0.1]:43357 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1fwYep-0007y3-0Q
	for submit@debbugs.gnu.org; Sun, 02 Sep 2018 16:07:39 -0400
Received: from eggs.gnu.org ([208.118.235.92]:44332)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ludo@gnu.org>) id 1fwYen-0007xq-A7
 for 22883@debbugs.gnu.org; Sun, 02 Sep 2018 16:07:37 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <ludo@gnu.org>) id 1fwYeh-0006j4-Dn
 for 22883@debbugs.gnu.org; Sun, 02 Sep 2018 16:07:32 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=disabled
 version=3.3.2
Received: from fencepost.gnu.org ([2001:4830:134:3::e]:57197)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <ludo@gnu.org>)
 id 1fwYeh-0006j0-A5; Sun, 02 Sep 2018 16:07:31 -0400
Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=42378 helo=ribbon)
 by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256)
 (Exim 4.82) (envelope-from <ludo@gnu.org>)
 id 1fwYeh-0003wq-2i; Sun, 02 Sep 2018 16:07:31 -0400
From: ludo@gnu.org (Ludovic Courtès)
To: Vagrant Cascadian <vagrant@debian.org>
Subject: Re: bug#22883: Trustable "guix pull"
References: <87io14sqoa.fsf@dustycloud.org> <87tvnemfjh.fsf@aikidev.net>
 <871sab7ull.fsf@gnu.org> <87zhwz6ct4.fsf@aikidev.net>
X-URL: http://www.fdn.fr/~lcourtes/
X-Revolutionary-Date: 16 Fructidor an 226 de la Révolution
X-PGP-Key-ID: 0x090B11993D9AEBB5
X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc
X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4  0CFB 090B 1199 3D9A EBB5
X-OS: x86_64-pc-linux-gnu
Date: Sun, 02 Sep 2018 22:07:30 +0200
In-Reply-To: <87zhwz6ct4.fsf@aikidev.net> (Vagrant Cascadian's message of
 "Sun, 02 Sep 2018 10:15:19 -0700")
Message-ID: <877ek364u5.fsf@gnu.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From: 2001:4830:134:3::e
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: 22883
Cc: 22883@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -6.0 (------)

Vagrant Cascadian <vagrant@debian.org> skribis:

> On 2018-09-02, Ludovic Courtès wrote:
>> Vagrant Cascadian <vagrant@debian.org> skribis:
>>> I really don't like having a custom GNUPGHOME, but I didn't see any
>>> other obvious way to pass arguments to git to use a custom keyring. I
>>> populated this GNUPGHOME with keys from:
>>>
>>>   https://savannah.gnu.org/project/memberlist-gpgkeys.php?group=guix&download=1
>>>
>>> And then ran gpg --refresh-keys on it, as several keys were
>>> outdated/expired.
>>
>> ‘gpgv’, which is recommended for this use case, has a ‘--keyring’
>> argument.  I suppose we could use that.
>
> I'm not sure how to get git to use gpgv instead of gpg, and extracting
> the information out of git and then implementing some external
> verification process, while possible, is likely error-prone.

Oh right, IIRC Git cannot use gpgv (this was probably discussed in this
issue, now that I think about it.)

Good thing is that using Guile-Git as in the toy example at
<https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22883#103>, we can use
gpgv.

> A feature request to git to allow passing gpg arguments or use gpgv
> would be the best way forward in the long-term.

That would work too.

Thanks,
Ludo’.

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 01:15:14 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#22883 Trustable "guix pull"