#22883 - Trustable "guix pull" - GNU bug report logs

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #67 received at 22883@debbugs.gnu.org (full text, mbox, reply):

Received: (at 22883) by debbugs.gnu.org; 4 Jun 2016 22:28:09 +0000
From debbugs-submit-bounces@debbugs.gnu.org Sat Jun 04 18:28:09 2016
Received: from localhost ([127.0.0.1]:54704 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1b9K33-0000A0-Q2
	for submit@debbugs.gnu.org; Sat, 04 Jun 2016 18:28:09 -0400
Received: from eggs.gnu.org ([208.118.235.92]:33182)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ludo@gnu.org>) id 1b9K32-00009V-3G
 for 22883@debbugs.gnu.org; Sat, 04 Jun 2016 18:28:04 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <ludo@gnu.org>) id 1b9K2s-0000s7-Vm
 for 22883@debbugs.gnu.org; Sat, 04 Jun 2016 18:27:58 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.4 required=5.0 tests=BAYES_20,RP_MATCHES_RCVD
 autolearn=disabled version=3.3.2
Received: from fencepost.gnu.org ([2001:4830:134:3::e]:45986)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <ludo@gnu.org>)
 id 1b9K2V-0000pK-EA; Sat, 04 Jun 2016 18:27:31 -0400
Received: from reverse-83.fdn.fr ([80.67.176.83]:47394 helo=pluto)
 by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128)
 (Exim 4.82) (envelope-from <ludo@gnu.org>)
 id 1b9K2U-0000Vo-HK; Sat, 04 Jun 2016 18:27:30 -0400
From: ludo@gnu.org (Ludovic Courtès)
To: Werner Koch <wk@gnupg.org>
Subject: Re: bug#22883: Trustable "guix pull"
References: <87io14sqoa.fsf@dustycloud.org>
 <87fustj59o.fsf@wheatstone.g10code.de>
X-URL: http://www.fdn.fr/~lcourtes/
X-Revolutionary-Date: 18 Prairial an 224 de la Révolution
X-PGP-Key-ID: 0x090B11993D9AEBB5
X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc
X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4  0CFB 090B 1199 3D9A EBB5
X-OS: x86_64-unknown-linux-gnu
Date: Sun, 05 Jun 2016 00:27:27 +0200
In-Reply-To: <87fustj59o.fsf@wheatstone.g10code.de> (Werner Koch's message of
 "Sat, 04 Jun 2016 18:19:31 +0200")
Message-ID: <874m98vbcg.fsf@gnu.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From: 2001:4830:134:3::e
X-Spam-Score: -6.4 (------)
X-Debbugs-Envelope-To: 22883
Cc: 22883@debbugs.gnu.org, Justus Winter <justus@gnupg.org>, neal@walfield.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -6.4 (------)

Hi Werner,

Werner Koch <wk@gnupg.org> skribis:

> I would indeed suggest to use gpgv (or gpgv2, but I hope Guix has alread
> moved to name gpg2 gpg)

We have a policy to respect what upstream does because in general we
cannot or shouldn’t try to guess what’s “best”, IMO.  So in this case,
we keep the default names, ‘gpg2’ and ‘gpgv2’.

Do you think we should rename those files?

> because we once wrote it for Debian.  It has the simplest semantics
> and thus best fits your purpose.  We use it in GnuPG itself for the
> speedo build system; it is sufficent to run this simple script:
>
> --8<---------------cut here---------------start------------->8---
>   if ! $GPGV --keyring "$distsigkey" swdb.lst.sig swdb.lst; then
>     echo "list of software versions is not valid!" >&2
>     exit 1
>   fi
> --8<---------------cut here---------------end--------------->8---

OK.

The problem I mentioned is that git expects to invoke ‘gpg’, not ‘gpgv’,
and it does not provide a way to pass a different argument list:

  https://github.com/git/git/blob/master/gpg-interface.c#L213

> In all other context I would suggest the use of GPGME to verify
> signatures, because GPGME also evaluates the trust and all the status
> line gpg spits out.
>
> There are no issues with l10n because _all_ scripts SHOULD use gpg with
> the options --status-fd and --with-colons.  That output creates a well
> defined API and we try very hard never to break it.

I’m aware of it, but unfortunately, git invokes gpg on the user’s
behalf, and all it gives is the human-readable, l10n’d output:

--8<---------------cut here---------------start------------->8---
$ LANGUAGE=fr_FR git log  --pretty="format:%H %GG" HEAD |head -4
40d71e44f5068b28f48bd131940260cc0ab2e2d1 gpg: Signature faite le Sun 05 Jun 2016 12:05:39 AM CEST avec la clef RSA d'identifiant 3D9AEBB5
gpg: Bonne signature de « Ludovic Courtès <ludo@gnu.org> » [totale]
gpg:                 alias « Ludovic Courtès <ludo@chbouib.org> » [totale]
gpg:                 alias « Ludovic Courtès (Inria) <ludovic.courtes@inria.fr> » [totale]
--8<---------------cut here---------------end--------------->8---

(Internally it does use ‘--status-fd’ but that doesn’t help us as
users.)

> Mike Gerwitz's article is a bit long read right now.  I have never
> looked into git to check whether git correctly calls gpg to verify
> signatures.  That should eventually be done.  And yes, please sign your
> commits (I use an Ed25519 key stored on a Gnuk token; which works very
> well).

We sign commits and it’s wonderful; now all we need is tools to actually
use those signatures to authenticate checkouts.  :-)

Thanks for taking the time to comment!

Ludo’.

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 01:12:06 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#22883 Trustable "guix pull"