<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 07/31/2015 01:24 PM, Michał
Masłowski wrote:<br>
</div>
<blockquote cite="mid:877fpg5jgr.fsf@elros.vpn.mtjm.eu" type="cite">
<blockquote type="cite">
<pre wrap="">2) Sign stuff manually using SHA512sum and openssl's whirlpool (see my
PKGBUILDs for an example of this fail-safe); and import any GPG
signatures from upstream as needed, adding them to validpgpkeys field
for GPG verification.
</pre>
</blockquote>
<pre wrap="">
Fix the tools so no manual work is needed here.</pre>
</blockquote>
Upstream bug/patch submitted:<br>
<a class="moz-txt-link-freetext" href="https://bugs.archlinux.org/task/45859">https://bugs.archlinux.org/task/45859</a><br>
<br>
<br>
It will be as easy as including<br>
sha512sum()<br>
whirlpoolsum()<br>
in the PKGBUILD.<br>
<br>
<br>
<blockquote cite="mid:877fpg5jgr.fsf@elros.vpn.mtjm.eu" type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">3) Sign the PKGBUILD with GPG:
gpg --default-key [YOURKEYID] -b PKGBUILD
</pre>
</blockquote>
<pre wrap="">
Another manual step; also puts non-source files in the git repo.
No code review is in this procedure.
</pre>
</blockquote>
I don't see any way around this yet. You could do this in batch if
desired.<br>
parallel gpg --default-key [yourkey] -b ::: PKGBUILD<br>
<br>
If people are using abs it pulls PKGBUILD and related source files,
adding a .sig allows abs users to validate the PKGBUILD was created
by the claimed PKBUILD Maintainer. I consider this better than
unsigned package builds since it wouldn't take much to alter a
PKGBUILD and re-push. Then someone would need to go back and trace
git commits to figure out who. Even then unless the git is signed
it'll be very hard to determine how that happened since everyone is
using the same git user, and it would be trivially easy to spoof
username in gitconfig should an attacker actually gain access.<br>
<br>
Regarding the code review, thankfully gpg is pretty straight forward
since we can use --verify. <br>
The only unreviewed portion is my two hash skip functions since it
is not possible to hash-check a file you will be altering. (in this
case the GPG signature which is created <i>after</i> the PKGBUILD)<br>
</body>
</html>