Source Mage code commit list

[Thomas Orgis <scm AT sourcemage.org>]

GIT changes to master grimoire by Thomas Orgis <sobukus AT sourcemage.org>:

 ftp/wget/DETAILS |    5 +----
 ftp/wget/HISTORY |    3 +++
 2 files changed, 4 insertions(+), 4 deletions(-)

New commits:
commit cc06516b86e1cdbbbc172b1d7563246fe49b034a
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Thomas Orgis <sobukus AT sourcemage.org>

    wget: switch to hash instead of flaky GPG sig
    
    1. The key that used to work from gnu.gpg expired last year and
    apparently because of that fact got silently removed on the recent
    update of gnu.gpg (13a891ca5be812258e068c84e7076f563a338e7c).
    
    2. The new signing key of the main author is only rather indirectly
    associated with the project (a person claiming the name of the current
    author responded on Stack Overflow 4 years ago to a question about how
    to verify wget sources, seriously). Putting the Key ID on the wget website
    would give it some HTTPS-based weak trust. But so … nothing.
    
    I fail to see the advantage of possibly trusting changed versions of
    the source tarball when the (blindly) trusted key is used to make another
    sig along with it. We want to ensure that the exact same source is used
    for repeated builds. A check of a signature without at least storing
    a hash of that signature itself does not provide that.
    
    Upstream signatures are there for the guru to verify and establish trust
    before writing the hash into DETAILS (bonus points for a system that
    stores multiple hashes and file size for added robustness, as pkgsrc
    does). After that, hashes stored in the grimoire are the only sensible
    truth to ensure that the downloaded sources are a) verified and
    b) identical to those tested by the guru working on the spell.
    
    I hope we can agree on ending the nonsense of managing (and failing at 
that,
    as seen in this case) piles of gpg keys in grimoire keyrings. We got 
better
    things to do.

diff --git a/ftp/wget/DETAILS b/ftp/wget/DETAILS
index 5add485..d4a89e3 100755
--- a/ftp/wget/DETAILS
+++ b/ftp/wget/DETAILS
@@ -2,11 +2,8 @@
          VERSION=1.20.3
   SECURITY_PATCH=6
           SOURCE=$SPELL-$VERSION.tar.gz
+     
SOURCE_HASH=sha512:e8b82b40e270296228094a78d47f81580bdbdea9e6b93fd61b37dccb39430aeb9bda5397dc53a31c952a61629383c7e2a8c8abf414c8a4dd369af6ecf2717e6c
    SOURCE_URL[0]=$GNU_URL/$SPELL/$SOURCE
-         SOURCE2="${SOURCE}.sig"
-  SOURCE2_URL[0]="${SOURCE_URL[0]}.sig"
-      SOURCE_GPG="gnu.gpg:${SOURCE2}:UPSTREAM_KEY"
-  SOURCE2_IGNORE="signature"
 SOURCE_DIRECTORY="$BUILD_DIRECTORY/$SPELL-$VERSION"
         DOC_DIRS=""
         WEB_SITE=https://www.gnu.org/software/wget/
diff --git a/ftp/wget/HISTORY b/ftp/wget/HISTORY
index 6acb43c..a5baf06 100644
--- a/ftp/wget/HISTORY
+++ b/ftp/wget/HISTORY
@@ -1,3 +1,6 @@
+2020-02-26 Thomas Orgis <sobukus AT sourcemage.org>
+       * DETAILS: remove GPG signature usage, hash more stable
+
 2019-10-10 Treeve Jelbert <treeve AT sourcemage.org>
        * DEPENDS: use GETTEXT