#22883 - Trustable "guix pull" - GNU bug report logs

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #70 received at 22883@debbugs.gnu.org (full text, mbox, reply):

Received: (at 22883) by debbugs.gnu.org; 5 Jun 2016 01:44:34 +0000
From debbugs-submit-bounces@debbugs.gnu.org Sat Jun 04 21:44:34 2016
Received: from localhost ([127.0.0.1]:54787 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1b9N7C-0006Rm-8Y
	for submit@debbugs.gnu.org; Sat, 04 Jun 2016 21:44:34 -0400
Received: from eggs.gnu.org ([208.118.235.92]:57319)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <mtg@gnu.org>) id 1b9N79-0006RW-Da
 for 22883@debbugs.gnu.org; Sat, 04 Jun 2016 21:44:33 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <mtg@gnu.org>) id 1b9N73-0001QR-9s
 for 22883@debbugs.gnu.org; Sat, 04 Jun 2016 21:44:26 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-3.3 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD
 autolearn=disabled version=3.3.2
Received: from fencepost.gnu.org ([2001:4830:134:3::e]:47970)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <mtg@gnu.org>)
 id 1b9N6e-0001Pe-P5; Sat, 04 Jun 2016 21:44:00 -0400
Received: from localhost ([::1]:53784 helo=mikegerwitz-pc.gerwitz.local)
 by fencepost.gnu.org with esmtps (TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128)
 (Exim 4.82) (envelope-from <mtg@gnu.org>)
 id 1b9N6c-0001vb-LQ; Sat, 04 Jun 2016 21:43:58 -0400
From: Mike Gerwitz <mtg@gnu.org>
To: Werner Koch <wk@gnupg.org>
Subject: Re: bug#22883: Trustable "guix pull"
In-Reply-To: <87fustj59o.fsf@wheatstone.g10code.de> (Werner Koch's message of
 "Sat, 04 Jun 2016 18:19:31 +0200")
Date: Sat, 04 Jun 2016 21:43:29 -0400
Message-ID: <877fe4v29q.fsf@gnu.org>
References: <87io14sqoa.fsf@dustycloud.org>
 <87fustj59o.fsf@wheatstone.g10code.de>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.0.92 (gnu/linux)
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha1; protocol="application/pgp-signature"
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From: 2001:4830:134:3::e
X-Spam-Score: -6.4 (------)
X-Debbugs-Envelope-To: 22883
Cc: 22883@debbugs.gnu.org, Justus Winter <justus@gnupg.org>, neal@walfield.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -6.4 (------)

[Message part 1 (text/plain, inline)]

On Sat, Jun 04, 2016 at 18:19:31 +0200, Werner Koch wrote:
> There are no issues with l10n because _all_ scripts SHOULD use gpg with
> the options --status-fd and --with-colons.  That output creates a well
> defined API and we try very hard never to break it.
> [...]
> I have never looked into git to check whether git correctly calls gpg
> to verify signatures.  That should eventually be done.

A quick glance (latest master, gpg-interface.c:208 verify_signed_buffer):

It invokes `gpg --status-fd=1 --verify FILE -`, where FILE is a
signature written to a temporary file for the sake of invoking
GPG.  It checks for a non-zero exit code and GOODSIG:

  ret |= !strstr(pbuf->buf, "\n[GNUPG:] GOODSIG ");

-- 
Mike Gerwitz
Free Software Hacker+Activist | GNU Maintainer & Volunteer
https://mikegerwitz.com
FSF Member #5804 | GPG Key ID: 0x8EE30EAB

[signature.asc (application/pgp-signature, inline)]

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 01:34:04 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#22883 Trustable "guix pull"