#22883 - Trustable "guix pull" - GNU bug report logs

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #58 received at 22883@debbugs.gnu.org (full text, mbox, reply):

Received: (at 22883) by debbugs.gnu.org; 4 Jun 2016 16:21:30 +0000
From debbugs-submit-bounces@debbugs.gnu.org Sat Jun 04 12:21:30 2016
Received: from localhost ([127.0.0.1]:54545 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1b9EKH-000797-UK
	for submit@debbugs.gnu.org; Sat, 04 Jun 2016 12:21:30 -0400
Received: from kerckhoffs.g10code.com ([217.69.77.222]:33625)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <wk@gnupg.org>) id 1b9EKF-00078x-Pv
 for 22883@debbugs.gnu.org; Sat, 04 Jun 2016 12:21:28 -0400
Received: from uucp by kerckhoffs.g10code.com with local-rmail (Exim 4.80 #2
 (Debian)) id 1b9EKD-0004M5-Hm
 for <22883@debbugs.gnu.org>; Sat, 04 Jun 2016 18:21:25 +0200
Received: from wk by wheatstone.g10code.de with local (Exim 4.84 #3 (Debian))
 id 1b9EIX-0002Vi-LP; Sat, 04 Jun 2016 18:19:41 +0200
From: Werner Koch <wk@gnupg.org>
To: 22883@debbugs.gnu.org
Subject: Re: bug#22883: Trustable "guix pull"
In-reply-to: 87bn3iz1xc.fsf_-_@gnu.org
Organisation: g10 Code GmbH
X-message-flag: Mails containing HTML will not be read!
 Please send only plain text.
OpenPGP: url=https://k.gnupg.net/80615870F5BAD690333686D0F2AD85AC1E42B367
Date: Sat, 04 Jun 2016 18:19:31 +0200
Message-ID: <87fustj59o.fsf@wheatstone.g10code.de>
User-Agent: Gnus/5.13 (Gnus v5.13)
MIME-Version: 1.0
Content-Type: multipart/signed;
 boundary="=ICE-propaganda-9/11-computer-terrorism-plutonium-CipherTAC-2000-ANZU";
 micalg=pgp-sha1; protocol="application/pgp-signature"
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: 22883
Cc: Justus Winter <justus@gnupg.org>, neal@walfield.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -5.0 (-----)

[Message part 1 (text/plain, inline)]

Hi,

Ludo' asked us to send some comments on how to verify git commits.  I
only had time to quickly browse the mail thread.

I would indeed suggest to use gpgv (or gpgv2, but I hope Guix has alread
moved to name gpg2 gpg) because we once wrote it for Debian.  It has the
simplest semantics and thus best fits your purpose.  We use it in GnuPG
itself for the speedo build system; it is sufficent to run this simple
script:

--8<---------------cut here---------------start------------->8---
  if ! $GPGV --keyring "$distsigkey" swdb.lst.sig swdb.lst; then
    echo "list of software versions is not valid!" >&2
    exit 1
  fi
--8<---------------cut here---------------end--------------->8---

In all other context I would suggest the use of GPGME to verify
signatures, because GPGME also evaluates the trust and all the status
line gpg spits out.

There are no issues with l10n because _all_ scripts SHOULD use gpg with
the options --status-fd and --with-colons.  That output creates a well
defined API and we try very hard never to break it.

Mike Gerwitz's article is a bit long read right now.  I have never
looked into git to check whether git correctly calls gpg to verify
signatures.  That should eventually be done.  And yes, please sign your
commits (I use an Ed25519 key stored on a Gnuk token; which works very
well).


Shalom-Salam,

   Werner


-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
    /* EFH in Erkrath: https://alt-hochdahl.de/haus */

[Message part 2 (application/pgp-signature, inline)]

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sat Dec 21 18:54:20 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#22883 Trustable "guix pull"