Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Thomas Orgis (cc06516b86e1cdbbbc172b1d7563246fe49b034a)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Thomas Orgis <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Thomas Orgis (cc06516b86e1cdbbbc172b1d7563246fe49b034a)
  • Date: Wed, 26 Feb 2020 16:32:19 +0000

GIT changes to master grimoire by Thomas Orgis <sobukus AT sourcemage.org>:

ftp/wget/DETAILS | 5 +----
ftp/wget/HISTORY | 3 +++
2 files changed, 4 insertions(+), 4 deletions(-)

New commits:
commit cc06516b86e1cdbbbc172b1d7563246fe49b034a
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Thomas Orgis <sobukus AT sourcemage.org>

wget: switch to hash instead of flaky GPG sig

1. The key that used to work from gnu.gpg expired last year and
apparently because of that fact got silently removed on the recent
update of gnu.gpg (13a891ca5be812258e068c84e7076f563a338e7c).

2. The new signing key of the main author is only rather indirectly
associated with the project (a person claiming the name of the current
author responded on Stack Overflow 4 years ago to a question about how
to verify wget sources, seriously). Putting the Key ID on the wget website
would give it some HTTPS-based weak trust. But so … nothing.

I fail to see the advantage of possibly trusting changed versions of
the source tarball when the (blindly) trusted key is used to make another
sig along with it. We want to ensure that the exact same source is used
for repeated builds. A check of a signature without at least storing
a hash of that signature itself does not provide that.

Upstream signatures are there for the guru to verify and establish trust
before writing the hash into DETAILS (bonus points for a system that
stores multiple hashes and file size for added robustness, as pkgsrc
does). After that, hashes stored in the grimoire are the only sensible
truth to ensure that the downloaded sources are a) verified and
b) identical to those tested by the guru working on the spell.

I hope we can agree on ending the nonsense of managing (and failing at
that,
as seen in this case) piles of gpg keys in grimoire keyrings. We got
better
things to do.

diff --git a/ftp/wget/DETAILS b/ftp/wget/DETAILS
index 5add485..d4a89e3 100755
--- a/ftp/wget/DETAILS
+++ b/ftp/wget/DETAILS
@@ -2,11 +2,8 @@
VERSION=1.20.3
SECURITY_PATCH=6
SOURCE=$SPELL-$VERSION.tar.gz
+
SOURCE_HASH=sha512:e8b82b40e270296228094a78d47f81580bdbdea9e6b93fd61b37dccb39430aeb9bda5397dc53a31c952a61629383c7e2a8c8abf414c8a4dd369af6ecf2717e6c
SOURCE_URL[0]=$GNU_URL/$SPELL/$SOURCE
- SOURCE2="${SOURCE}.sig"
- SOURCE2_URL[0]="${SOURCE_URL[0]}.sig"
- SOURCE_GPG="gnu.gpg:${SOURCE2}:UPSTREAM_KEY"
- SOURCE2_IGNORE="signature"
SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
DOC_DIRS=""
WEB_SITE=https://www.gnu.org/software/wget/
diff --git a/ftp/wget/HISTORY b/ftp/wget/HISTORY
index 6acb43c..a5baf06 100644
--- a/ftp/wget/HISTORY
+++ b/ftp/wget/HISTORY
@@ -1,3 +1,6 @@
+2020-02-26 Thomas Orgis <sobukus AT sourcemage.org>
+ * DETAILS: remove GPG signature usage, hash more stable
+
2019-10-10 Treeve Jelbert <treeve AT sourcemage.org>
* DEPENDS: use GETTEXT




  • [SM-Commit] GIT changes to master grimoire by Thomas Orgis (cc06516b86e1cdbbbc172b1d7563246fe49b034a), Thomas Orgis, 02/26/2020

Archive powered by MHonArc 2.6.24.

Top of Page