Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Thomas Orgis (a922da811e07ee98c2dcebccfaba1b2079c8c3a7)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Thomas Orgis <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Thomas Orgis (a922da811e07ee98c2dcebccfaba1b2079c8c3a7)
  • Date: Sun, 22 Jan 2023 08:02:32 +0000

GIT changes to master grimoire by Thomas Orgis <sobukus AT sourcemage.org>:

crypto/libassuan/DETAILS | 13 ++++++++-----
crypto/libassuan/HISTORY | 3 +++
crypto/libgpg-error/DETAILS | 13 ++++++++-----
crypto/libgpg-error/HISTORY | 3 +++
crypto/libksba/DETAILS | 13 ++++++++-----
crypto/libksba/HISTORY | 3 +++
crypto/npth/DETAILS | 13 ++++++++-----
crypto/npth/HISTORY | 3 +++
8 files changed, 44 insertions(+), 20 deletions(-)

New commits:
commit a922da811e07ee98c2dcebccfaba1b2079c8c3a7
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Thomas Orgis <sobukus AT sourcemage.org>

libassuan, libgpg-error, libksba, npth: switch to hash sig to enable
upgrade from stable

We need the GPG tools to be installable without GPG tools (dispelled
because of conflict
with gnupg-2.4) or with outdated GPG tools (new signatures being
incompatible with old
GPG).

In the long run, we should switch to hashes, and maybe optional
signatures for users,
but mainly upstream sigs being checked by the grimoire guru on spell
update once,
then hash for easy checking on cast being stored.

diff --git a/crypto/libassuan/DETAILS b/crypto/libassuan/DETAILS
index 8ec1466..ebbb898 100755
--- a/crypto/libassuan/DETAILS
+++ b/crypto/libassuan/DETAILS
@@ -3,11 +3,14 @@

SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE_URL[0]=https://gnupg.org/ftp/gcrypt/libassuan/$SOURCE
- SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
-
- SOURCE2=$SOURCE.sig
- SOURCE2_URL[0]=$SOURCE_URL.sig
- SOURCE2_IGNORE=signature
+# For upgrade path from stable, GnuPG dependencies need to be verifiable
with gpg1, or even without.
+# Verify signature on update and then record the hash here!
+
SOURCE_HASH=sha512:70117f77aa43bbbe0ed28da5ef23834c026780a74076a92ec775e30f851badb423e9a2cb9e8d142c94e4f6f8a794988c1b788fd4bd2271e562071adf0ab16403
+# SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
+#
+# SOURCE2=$SOURCE.sig
+# SOURCE2_URL[0]=$SOURCE_URL.sig
+# SOURCE2_IGNORE=signature

SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
WEB_SITE=https://www.gnupg.org/
diff --git a/crypto/libassuan/HISTORY b/crypto/libassuan/HISTORY
index 8ee1e32..42b92b8 100644
--- a/crypto/libassuan/HISTORY
+++ b/crypto/libassuan/HISTORY
@@ -1,3 +1,6 @@
+2023-01-22 Thomas Orgis <sobukus AT sourcemage.org>
+ * DETAILS: hash verification to offer upgrade path from stable
grimoire
+
2022-12-02 Remko van der Vossen <wich AT sourcemage.org>
* DEPENDS: texinfo is not needed

diff --git a/crypto/libgpg-error/DETAILS b/crypto/libgpg-error/DETAILS
index 91a3878..9091bb4 100755
--- a/crypto/libgpg-error/DETAILS
+++ b/crypto/libgpg-error/DETAILS
@@ -3,11 +3,14 @@
SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE_URL[0]=https://www.gnupg.org/ftp/gcrypt/libgpg-error/$SOURCE
SOURCE_URL[1]=https://gd.tuwien.ac.at/privacy/gnupg/libgpg-error/$SOURCE
- SOURCE2=$SOURCE.sig
- SOURCE2_URL[0]=${SOURCE_URL[0]}.sig
- SOURCE2_URL[1]="${SOURCE_URL[1]}.sig"
- SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
- SOURCE2_IGNORE=signature
+# For upgrade path from stable, GnuPG dependencies need to be verifiable
with gpg1, or even without.
+# Verify signature on update and then record the hash here!
+
SOURCE_HASH=sha512:b06223bb2b0f67d3db5d0d9ab116361a0eda175d4667352b5c0941408d37f2b0ba8e507297e480ccebb88cbba9d0a133820b896914b07d264fb3edaac7b8c99d
+# SOURCE2=$SOURCE.sig
+# SOURCE2_URL[0]=${SOURCE_URL[0]}.sig
+# SOURCE2_URL[1]="${SOURCE_URL[1]}.sig"
+# SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
+# SOURCE2_IGNORE=signature
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
WEB_SITE=https://www.gnupg.org/
ENTERED=20030808
diff --git a/crypto/libgpg-error/HISTORY b/crypto/libgpg-error/HISTORY
index a50bfc1..3f75f11 100644
--- a/crypto/libgpg-error/HISTORY
+++ b/crypto/libgpg-error/HISTORY
@@ -1,3 +1,6 @@
+2023-01-22 Thomas Orgis <sobukus AT sourcemage.org>
+ * DETAILS: hash verification to offer upgrade path from stable
grimoire
+
2022-10-13 Pavel Vinogradov <public AT sourcemage.org>
* DETAILS: version 1.46

diff --git a/crypto/libksba/DETAILS b/crypto/libksba/DETAILS
index e5f9da3..0cb093d 100755
--- a/crypto/libksba/DETAILS
+++ b/crypto/libksba/DETAILS
@@ -4,11 +4,14 @@

SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE_URL[0]=https://gnupg.org/ftp/gcrypt/libksba/$SOURCE
- SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
-
- SOURCE2=$SOURCE.sig
- SOURCE2_URL[0]=$SOURCE_URL.sig
- SOURCE2_IGNORE=signature
+# For upgrade path from stable, GnuPG dependencies need to be verifiable
with gpg1, or even without.
+# Verify signature on update and then record the hash here!
+
SOURCE_HASH=sha512:188f6d27b4904c10cd54ba949c1132dd6c167f53dd1b77eae39c5b8e3ac8b15e87b2a54cdfddac95ac4ed41ee83c3d4e1b17d95126f245b6c204fade6739a2ce
+# SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
+#
+# SOURCE2=$SOURCE.sig
+# SOURCE2_URL[0]=$SOURCE_URL.sig
+# SOURCE2_IGNORE=signature

SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
WEB_SITE=https://www.gnupg.org/related_software/libksba/
diff --git a/crypto/libksba/HISTORY b/crypto/libksba/HISTORY
index 3a5b192..094d75b 100644
--- a/crypto/libksba/HISTORY
+++ b/crypto/libksba/HISTORY
@@ -1,3 +1,6 @@
+2023-01-22 Thomas Orgis <sobukus AT sourcemage.org>
+ * DETAILS: hash verification to offer upgrade path from stable
grimoire
+
2022-12-20 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 1.6.3

diff --git a/crypto/npth/DETAILS b/crypto/npth/DETAILS
index 4a67b86..7fe5d35 100755
--- a/crypto/npth/DETAILS
+++ b/crypto/npth/DETAILS
@@ -3,11 +3,14 @@

SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE_URL[0]=https://gnupg.org/ftp//gcrypt/npth/$SOURCE
- SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
-
- SOURCE2=$SOURCE.sig
- SOURCE2_URL[0]=$SOURCE_URL.sig
- SOURCE2_IGNORE=signature
+# For upgrade path from stable, GnuPG dependencies need to be verifiable
with gpg1, or even without.
+# Verify signature on update and then record the hash here!
+
SOURCE_HASH=sha512:2ed1012e14a9d10665420b9a23628be7e206fd9348111ec751349b93557ee69f1176bcf7e6b195b35b1c44a5e0e81ee33b713f03d79a33d1ecd9037035afeda2
+# SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
+#
+# SOURCE2=$SOURCE.sig
+# SOURCE2_URL[0]=$SOURCE_URL.sig
+# SOURCE2_IGNORE=signature

SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
WEB_SITE=https://www.gnupg.org/
diff --git a/crypto/npth/HISTORY b/crypto/npth/HISTORY
index 97e5aff..657d7f9 100644
--- a/crypto/npth/HISTORY
+++ b/crypto/npth/HISTORY
@@ -1,3 +1,6 @@
+2023-01-22 Thomas Orgis <sobukus AT sourcemage.org>
+ * DETAILS: hash verification to offer upgrade path from stable
grimoire
+
2018-07-17 Pavel Vinogradov <public AT sourcemage.org>
* DETAILS: version 1.6




  • [SM-Commit] GIT changes to master grimoire by Thomas Orgis (a922da811e07ee98c2dcebccfaba1b2079c8c3a7), Thomas Orgis, 01/22/2023

Archive powered by MHonArc 2.6.24.

Top of Page