New commits:
commit a922da811e07ee98c2dcebccfaba1b2079c8c3a7
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Thomas Orgis <sobukus AT sourcemage.org>
libassuan, libgpg-error, libksba, npth: switch to hash sig to enable
upgrade from stable
We need the GPG tools to be installable without GPG tools (dispelled
because of conflict
with gnupg-2.4) or with outdated GPG tools (new signatures being
incompatible with old
GPG).
In the long run, we should switch to hashes, and maybe optional
signatures for users,
but mainly upstream sigs being checked by the grimoire guru on spell
update once,
then hash for easy checking on cast being stored.
SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE_URL[0]=https://gnupg.org/ftp/gcrypt/libassuan/$SOURCE
- SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
-
- SOURCE2=$SOURCE.sig
- SOURCE2_URL[0]=$SOURCE_URL.sig
- SOURCE2_IGNORE=signature
+# For upgrade path from stable, GnuPG dependencies need to be verifiable
with gpg1, or even without.
+# Verify signature on update and then record the hash here!
+
SOURCE_HASH=sha512:70117f77aa43bbbe0ed28da5ef23834c026780a74076a92ec775e30f851badb423e9a2cb9e8d142c94e4f6f8a794988c1b788fd4bd2271e562071adf0ab16403
+# SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
+#
+# SOURCE2=$SOURCE.sig
+# SOURCE2_URL[0]=$SOURCE_URL.sig
+# SOURCE2_IGNORE=signature
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
WEB_SITE=https://www.gnupg.org/
diff --git a/crypto/libassuan/HISTORY b/crypto/libassuan/HISTORY
index 8ee1e32..42b92b8 100644
--- a/crypto/libassuan/HISTORY
+++ b/crypto/libassuan/HISTORY
@@ -1,3 +1,6 @@
+2023-01-22 Thomas Orgis <sobukus AT sourcemage.org>
+ * DETAILS: hash verification to offer upgrade path from stable
grimoire
+
2022-12-02 Remko van der Vossen <wich AT sourcemage.org>
* DEPENDS: texinfo is not needed
diff --git a/crypto/libgpg-error/DETAILS b/crypto/libgpg-error/DETAILS
index 91a3878..9091bb4 100755
--- a/crypto/libgpg-error/DETAILS
+++ b/crypto/libgpg-error/DETAILS
@@ -3,11 +3,14 @@
SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE_URL[0]=https://www.gnupg.org/ftp/gcrypt/libgpg-error/$SOURCE
SOURCE_URL[1]=https://gd.tuwien.ac.at/privacy/gnupg/libgpg-error/$SOURCE
- SOURCE2=$SOURCE.sig
- SOURCE2_URL[0]=${SOURCE_URL[0]}.sig
- SOURCE2_URL[1]="${SOURCE_URL[1]}.sig"
- SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
- SOURCE2_IGNORE=signature
+# For upgrade path from stable, GnuPG dependencies need to be verifiable
with gpg1, or even without.
+# Verify signature on update and then record the hash here!
+
SOURCE_HASH=sha512:b06223bb2b0f67d3db5d0d9ab116361a0eda175d4667352b5c0941408d37f2b0ba8e507297e480ccebb88cbba9d0a133820b896914b07d264fb3edaac7b8c99d
+# SOURCE2=$SOURCE.sig
+# SOURCE2_URL[0]=${SOURCE_URL[0]}.sig
+# SOURCE2_URL[1]="${SOURCE_URL[1]}.sig"
+# SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
+# SOURCE2_IGNORE=signature
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
WEB_SITE=https://www.gnupg.org/
ENTERED=20030808
diff --git a/crypto/libgpg-error/HISTORY b/crypto/libgpg-error/HISTORY
index a50bfc1..3f75f11 100644
--- a/crypto/libgpg-error/HISTORY
+++ b/crypto/libgpg-error/HISTORY
@@ -1,3 +1,6 @@
+2023-01-22 Thomas Orgis <sobukus AT sourcemage.org>
+ * DETAILS: hash verification to offer upgrade path from stable
grimoire
+
2022-10-13 Pavel Vinogradov <public AT sourcemage.org>
* DETAILS: version 1.46
SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE_URL[0]=https://gnupg.org/ftp/gcrypt/libksba/$SOURCE
- SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
-
- SOURCE2=$SOURCE.sig
- SOURCE2_URL[0]=$SOURCE_URL.sig
- SOURCE2_IGNORE=signature
+# For upgrade path from stable, GnuPG dependencies need to be verifiable
with gpg1, or even without.
+# Verify signature on update and then record the hash here!
+
SOURCE_HASH=sha512:188f6d27b4904c10cd54ba949c1132dd6c167f53dd1b77eae39c5b8e3ac8b15e87b2a54cdfddac95ac4ed41ee83c3d4e1b17d95126f245b6c204fade6739a2ce
+# SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
+#
+# SOURCE2=$SOURCE.sig
+# SOURCE2_URL[0]=$SOURCE_URL.sig
+# SOURCE2_IGNORE=signature
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
WEB_SITE=https://www.gnupg.org/related_software/libksba/
diff --git a/crypto/libksba/HISTORY b/crypto/libksba/HISTORY
index 3a5b192..094d75b 100644
--- a/crypto/libksba/HISTORY
+++ b/crypto/libksba/HISTORY
@@ -1,3 +1,6 @@
+2023-01-22 Thomas Orgis <sobukus AT sourcemage.org>
+ * DETAILS: hash verification to offer upgrade path from stable
grimoire
+
2022-12-20 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 1.6.3
SOURCE=$SPELL-$VERSION.tar.bz2
SOURCE_URL[0]=https://gnupg.org/ftp//gcrypt/npth/$SOURCE
- SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
-
- SOURCE2=$SOURCE.sig
- SOURCE2_URL[0]=$SOURCE_URL.sig
- SOURCE2_IGNORE=signature
+# For upgrade path from stable, GnuPG dependencies need to be verifiable
with gpg1, or even without.
+# Verify signature on update and then record the hash here!
+
SOURCE_HASH=sha512:2ed1012e14a9d10665420b9a23628be7e206fd9348111ec751349b93557ee69f1176bcf7e6b195b35b1c44a5e0e81ee33b713f03d79a33d1ecd9037035afeda2
+# SOURCE_GPG="GnuPG.gpg:$SOURCE.sig:VERIFIED_UPSTREAM_KEY"
+#
+# SOURCE2=$SOURCE.sig
+# SOURCE2_URL[0]=$SOURCE_URL.sig
+# SOURCE2_IGNORE=signature
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
WEB_SITE=https://www.gnupg.org/
diff --git a/crypto/npth/HISTORY b/crypto/npth/HISTORY
index 97e5aff..657d7f9 100644
--- a/crypto/npth/HISTORY
+++ b/crypto/npth/HISTORY
@@ -1,3 +1,6 @@
+2023-01-22 Thomas Orgis <sobukus AT sourcemage.org>
+ * DETAILS: hash verification to offer upgrade path from stable
grimoire
+
2018-07-17 Pavel Vinogradov <public AT sourcemage.org>
* DETAILS: version 1.6
[SM-Commit] GIT changes to master grimoire by Thomas Orgis (a922da811e07ee98c2dcebccfaba1b2079c8c3a7),
Thomas Orgis, 01/22/2023