FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > ArchLinux > ArchLinux Pacman Development

 
 
LinkBack Thread Tools
 
Old 06-24-2011, 02:05 AM
Dan McGee
 
Default Add support for verifying pgp signatures to makepkg

On Thu, Jun 23, 2011 at 2:36 AM, Wieland Hoffmann
<themineo@googlemail.com> wrote:

First, thanks for giving this a try.

Commit descriptions are nice to have in permanent history, but all
that stuff you wrote in the cover letter won't show up. Can you
instead include some of that right here in the patch in commit
message-style writing?

> ---
> *scripts/makepkg.sh.in | * 52 +++++++++++++++++++++++++++++++++++++++++++++++-
> *1 files changed, 50 insertions(+), 2 deletions(-)
>
> diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in
> index 78cd4cf..cc4f152 100644
> --- a/scripts/makepkg.sh.in
> +++ b/scripts/makepkg.sh.in
> @@ -516,7 +516,7 @@ download_sources() {
> * * * *pushd "$SRCDEST" &>/dev/null
>
> * * * *local netfile
> - * * * for netfile in "${source[@]}"; do
> + * * * for netfile in "${source[@]}" "${pgpsigs[@]}"; do
> * * * * * * * *local file=$(get_filepath "$netfile" || true)
> * * * * * * * *if [[ -n "$file" ]]; then
> * * * * * * * * * * * *msg2 "$(gettext "Found %s")" "${file##*/}"
> @@ -680,6 +680,49 @@ check_checksums() {
> * * * *fi
> *}
>
> +check_pgpsigs() {
> + * * * (( ! ${#source[@]} )) && return 0
> + * * * (( ! ${#pgpsigs[@]})) && return 0
> +
> + * * * if ! type -p gpg >/dev/null; then
> + * * * * * * * error "$(gettext "Cannot find the gpg binary! Is gnupg installed?")"
> + * * * * * * * exit 1 # $E_MISSING_PROGRAM
> + * * * fi
Please see the check_software patch
(http://projects.archlinux.org/pacman.git/commit/?id=7468956236), this
will need to be updated to work that way instead of how we used to do
it.

> +
> + * * * msg "$(gettext "Validating source files with gpg...")"
> +
> + * * * local file
> + * * * local errors=0
> +
> + * * * for file in "${pgpsigs[@]}"; do
> + * * * * * * * local valid
> + * * * * * * * local found=1
> +
> + * * * * * * * file="$(get_filename "$file")"
> + * * * * * * * echo -n " * *${file%.sig} ... " >&2
> +
> + * * * * * * * if ! file="$(get_filepath "$file")"; then
What are you doing here? Assignment or comparison? Do this in two
statements rather than trying to be cute, and use an actual [[ -z ]]
block please.

> + * * * * * * * * * * * echo "$(gettext "NOT FOUND")" >&2
> + * * * * * * * * * * * errors=1
> + * * * * * * * * * * * found=0
> + * * * * * * * fi
> +
> + * * * * * * * if (( found )); then
> + * * * * * * * * * * * if ! gpg --quiet --batch --verify "$file" 2> /dev/null; then
> + * * * * * * * * * * * * * * * echo "$(gettext "Verification failed")" >&2
Any need to eat stderr? If things only show up in exceptional cases,
I'd rather it come through.

> + * * * * * * * * * * * * * * * errors=1
> + * * * * * * * * * * * else
> + * * * * * * * * * * * * * * * echo $(gettext "Verified") >&2
> + * * * * * * * * * * * fi
> + * * * * * * * fi
> + * * * done
> +
> + * * * if (( errors )); then
> + * * * * * * * error "$(gettext "One or more pgp signatures could not be verified!")"
> + * * * * * * * exit 1
> + * * * fi
> +}
> +
> *extract_sources() {
> * * * *msg "$(gettext "Extracting Sources...")"
> * * * *local netfile
> @@ -1614,6 +1657,7 @@ usage() {
> * * * *echo "$(gettext " *--key <key> * * *Specify a key to use for gpg signing instead of the default")"
> * * * *printf "$(gettext " *--nocheck * * * *Do not run the check() function in the %s")
" "$BUILDSCRIPT"
> * * * *echo "$(gettext " *--nosign * * * * Do not create a signature for the package")"
> + * * * echo "$(gettext " *--pgp * * * * * *Enable verification of source files with pgp signatures")"
I'm not real keen on this option as it isn't clear whether it deals
with signing or verification. I think --verify would be better, but
I'll leave that up to Allan.

> * * * *echo "$(gettext " *--pkg <list> * * Only build listed packages from a split package")"
> * * * *echo "$(gettext " *--sign * * * * * Sign the resulting package with gpg")"
> * * * *echo "$(gettext " *--skipinteg * * *Do not fail when integrity checks are missing")"
> @@ -1651,7 +1695,7 @@ ARGLIST=("$@")
> *# Parse Command Line Options.
> *OPT_SHORT="AcCdefFghiLmop:rRsV"
> *OPT_LONG="allsource,asroot,ignorearch,check,clean ,cleancache,nodeps"
> -OPT_LONG+=",noextract,force,forcever:,geninteg,hel p,holdver"
> +OPT_LONG+=",noextract,force,forcever:,geninteg,he lp,holdver,pgp"
> *OPT_LONG+=",install,key:,log,nocolor,nobuild,noch eck,nosign,pkg:,rmdeps"
> *OPT_LONG+=",repackage,skipinteg,sign,source,syncd eps,version,config:"
> *# Pacman Options
> @@ -1694,6 +1738,7 @@ while true; do
> * * * * * * * *--nosign) * * * * SIGNPKG='n' ;;
> * * * * * * * *-o|--nobuild) * * NOBUILD=1 ;;
> * * * * * * * *-p) * * * * * * * shift; BUILDFILE=$1 ;;
> + * * * * * * * --pgp) * * * * * *PGPSIGS=1;;
> * * * * * * * *--pkg) * * * * * *shift; PKGLIST=($1) ;;
> * * * * * * * *-r|--rmdeps) * * *RMDEPS=1 ;;
> * * * * * * * *-R|--repackage) * REPKG=1 ;;
> @@ -2129,6 +2174,9 @@ else
> * * * *download_sources
> * * * *if (( ! SKIPINTEG )); then
> * * * * * * * *check_checksums
> + * * * * * * * if (( PGPSIGS )); then
> + * * * * * * * * * * * check_pgpsigs
> + * * * * * * * fi
This check should probably match how we do it elsewhere; e.g.,
check_signature() the first two lines. I'd move it inside
check_pgpsigs itself. Also declare it upfront where we set the rest of
these.

> * * * *else
> * * * * * * * *warning "$(gettext "Skipping integrity checks.")"
> * * * *fi
> --
> 1.7.5.4
 
Old 06-24-2011, 08:53 AM
Wieland Hoffmann
 
Default Add support for verifying pgp signatures to makepkg

Hallo, Dan McGee:
> On Thu, Jun 23, 2011 at 2:36 AM, Wieland Hoffmann
> <themineo@googlemail.com> wrote:
>
> First, thanks for giving this a try.
>
> Commit descriptions are nice to have in permanent history, but all
> that stuff you wrote in the cover letter won't show up. Can you
> instead include some of that right here in the patch in commit
> message-style writing?

Will do (looks like I have to resubmit these anyway).

> > +
> > + * * * msg "$(gettext "Validating source files with gpg...")"
> > +
> > + * * * local file
> > + * * * local errors=0
> > +
> > + * * * for file in "${pgpsigs[@]}"; do
> > + * * * * * * * local valid
> > + * * * * * * * local found=1
> > +
> > + * * * * * * * file="$(get_filename "$file")"
> > + * * * * * * * echo -n " * *${file%.sig} ... " >&2
> > +
> > + * * * * * * * if ! file="$(get_filepath "$file")"; then
> What are you doing here? Assignment or comparison? Do this in two
> statements rather than trying to be cute, and use an actual [[ -z ]]
> block please.

That's just a copy of
http://projects.archlinux.org/pacman.git/tree/scripts/makepkg.sh.in#n640
get_filepath() already checks if the file exists.

> > + * * * * * * * * * * * echo "$(gettext "NOT FOUND")" >&2
> > + * * * * * * * * * * * errors=1
> > + * * * * * * * * * * * found=0
> > + * * * * * * * fi
> > +
> > + * * * * * * * if (( found )); then
> > + * * * * * * * * * * * if ! gpg --quiet --batch --verify "$file" 2> /dev/null; then
> > + * * * * * * * * * * * * * * * echo "$(gettext "Verification failed")" >&2
> Any need to eat stderr? If things only show up in exceptional cases,
> I'd rather it come through.

Oh, that's supposed to be a 1.

> > @@ -2129,6 +2174,9 @@ else
> > * * * *download_sources
> > * * * *if (( ! SKIPINTEG )); then
> > * * * * * * * *check_checksums
> > + * * * * * * * if (( PGPSIGS )); then
> > + * * * * * * * * * * * check_pgpsigs
> > + * * * * * * * fi
> This check should probably match how we do it elsewhere; e.g.,
> check_signature() the first two lines.

Hm, check_signature()? Either grep is lying to me or that doesn't exist
anywhere.

> I'd move it inside check_pgpsigs itself. Also declare it upfront where
> we set the rest of these.

I'm not exactly sure how I missed that, thanks!

--
Wieland
 
Old 06-24-2011, 09:21 AM
Dan McGee
 
Default Add support for verifying pgp signatures to makepkg

On Fri, Jun 24, 2011 at 3:53 AM, Wieland Hoffmann
<themineo@googlemail.com> wrote:
> Hallo, Dan McGee:
>> On Thu, Jun 23, 2011 at 2:36 AM, Wieland Hoffmann
>> <themineo@googlemail.com> wrote:
>>
>> First, thanks for giving this a try.
>>
>> Commit descriptions are nice to have in permanent history, but all
>> that stuff you wrote in the cover letter won't show up. Can you
>> instead include some of that right here in the patch in commit
>> message-style writing?
>
> Will do (looks like I have to resubmit these anyway).
>
>> > +
>> > + * * * msg "$(gettext "Validating source files with gpg...")"
>> > +
>> > + * * * local file
>> > + * * * local errors=0
>> > +
>> > + * * * for file in "${pgpsigs[@]}"; do
>> > + * * * * * * * local valid
>> > + * * * * * * * local found=1
>> > +
>> > + * * * * * * * file="$(get_filename "$file")"
>> > + * * * * * * * echo -n " * *${file%.sig} ... " >&2
>> > +
>> > + * * * * * * * if ! file="$(get_filepath "$file")"; then
>> What are you doing here? Assignment or comparison? Do this in two
>> statements rather than trying to be cute, and use an actual [[ -z ]]
>> block please.
>
> That's just a copy of
> http://projects.archlinux.org/pacman.git/tree/scripts/makepkg.sh.in#n640
> get_filepath() already checks if the file exists.
Aha, OK. It's fine, it just is a bit hairy in what it is doing.

>
>> > + * * * * * * * * * * * echo "$(gettext "NOT FOUND")" >&2
>> > + * * * * * * * * * * * errors=1
>> > + * * * * * * * * * * * found=0
>> > + * * * * * * * fi
>> > +
>> > + * * * * * * * if (( found )); then
>> > + * * * * * * * * * * * if ! gpg --quiet --batch --verify "$file" 2> /dev/null; then
>> > + * * * * * * * * * * * * * * * echo "$(gettext "Verification failed")" >&2
>> Any need to eat stderr? If things only show up in exceptional cases,
>> I'd rather it come through.
>
> Oh, that's supposed to be a 1.
I was suggesting no redirection at all.

>> This check should probably match how we do it elsewhere; e.g.,
>> check_signature() the first two lines.
>
> Hm, check_signature()? Either grep is lying to me or that doesn't exist
> anywhere.
>
>> I'd move it inside check_pgpsigs itself. Also declare it upfront where
>> we set the rest of these.

create_signature, whoops!
 
Old 06-24-2011, 09:54 AM
Wieland Hoffmann
 
Default Add support for verifying pgp signatures to makepkg

Hallo, Dan McGee:
> >
> >> > + * * * * * * * * * * * echo "$(gettext "NOT FOUND")" >&2
> >> > + * * * * * * * * * * * errors=1
> >> > + * * * * * * * * * * * found=0
> >> > + * * * * * * * fi
> >> > +
> >> > + * * * * * * * if (( found )); then
> >> > + * * * * * * * * * * * if ! gpg --quiet --batch --verify "$file" 2> /dev/null; then
> >> > + * * * * * * * * * * * * * * * echo "$(gettext "Verification failed")" >&2
> >> Any need to eat stderr? If things only show up in exceptional cases,
> >> I'd rather it come through.
> >
> > Oh, that's supposed to be a 1.
> I was suggesting no redirection at all.

That redirect is taken from pacman-key (the patch introducing it is
http://mailman.archlinux.org/pipermail/pacman-dev/2010-October/011724.html).
Maybe Denis (if he's still reading this list) can elaborate on why it's
there.

>
> >> This check should probably match how we do it elsewhere; e.g.,
> >> check_signature() the first two lines.
> >
> > Hm, check_signature()? Either grep is lying to me or that doesn't exist
> > anywhere.
> >
> >> I'd move it inside check_pgpsigs itself. Also declare it upfront where
> >> we set the rest of these.
>
> create_signature, whoops!

Will do.

--
Wieland
 
Old 06-24-2011, 09:57 AM
Wieland Hoffmann
 
Default Add support for verifying pgp signatures to makepkg

Hallo, Dan McGee:
> On Thu, Jun 23, 2011 at 2:36 AM, Wieland Hoffmann
> <themineo@googlemail.com> wrote:
>
> First, thanks for giving this a try.
>
> Commit descriptions are nice to have in permanent history, but all
> that stuff you wrote in the cover letter won't show up. Can you
> instead include some of that right here in the patch in commit
> message-style writing?
>
> > ---
> > *scripts/makepkg.sh.in | * 52 +++++++++++++++++++++++++++++++++++++++++++++++-
> > *1 files changed, 50 insertions(+), 2 deletions(-)
> >
> > diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in
> > index 78cd4cf..cc4f152 100644
> > --- a/scripts/makepkg.sh.in
> > +++ b/scripts/makepkg.sh.in
> > +check_pgpsigs() {
> > + * * * (( ! ${#source[@]} )) && return 0
> > + * * * (( ! ${#pgpsigs[@]})) && return 0
> > +
> > + * * * if ! type -p gpg >/dev/null; then
> > + * * * * * * * error "$(gettext "Cannot find the gpg binary! Is gnupg installed?")"
> > + * * * * * * * exit 1 # $E_MISSING_PROGRAM
> > + * * * fi
> Please see the check_software patch
> (http://projects.archlinux.org/pacman.git/commit/?id=7468956236), this
> will need to be updated to work that way instead of how we used to do
> it.

Is it better to add a separate check or should I extend the existing one
and its error message?

--
Wieland
 
Old 06-24-2011, 06:49 PM
Dan McGee
 
Default Add support for verifying pgp signatures to makepkg

On Fri, Jun 24, 2011 at 4:57 AM, Wieland Hoffmann
<themineo@googlemail.com> wrote:
> Hallo, Dan McGee:
>> On Thu, Jun 23, 2011 at 2:36 AM, Wieland Hoffmann
>> <themineo@googlemail.com> wrote:
>>
>> First, thanks for giving this a try.
>>
>> Commit descriptions are nice to have in permanent history, but all
>> that stuff you wrote in the cover letter won't show up. Can you
>> instead include some of that right here in the patch in commit
>> message-style writing?
>>
>> > ---
>> > *scripts/makepkg.sh.in | * 52 +++++++++++++++++++++++++++++++++++++++++++++++-
>> > *1 files changed, 50 insertions(+), 2 deletions(-)
>> >
>> > diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in
>> > index 78cd4cf..cc4f152 100644
>> > --- a/scripts/makepkg.sh.in
>> > +++ b/scripts/makepkg.sh.in
>> > +check_pgpsigs() {
>> > + * * * (( ! ${#source[@]} )) && return 0
>> > + * * * (( ! ${#pgpsigs[@]})) && return 0
>> > +
>> > + * * * if ! type -p gpg >/dev/null; then
>> > + * * * * * * * error "$(gettext "Cannot find the gpg binary! Is gnupg installed?")"
>> > + * * * * * * * exit 1 # $E_MISSING_PROGRAM
>> > + * * * fi
>> Please see the check_software patch
>> (http://projects.archlinux.org/pacman.git/commit/?id=7468956236), this
>> will need to be updated to work that way instead of how we used to do
>> it.
>
> Is it better to add a separate check or should I extend the existing one
> and its error message?

Probably just add a new block- checking it twice isn't that big of
deal, and that way the error message can say "required for verifying
source files" or whatever.

-Dan
 
Old 06-26-2011, 04:21 PM
Wieland Hoffmann
 
Default Add support for verifying pgp signatures to makepkg

Hallo, Dan McGee:

>On Thu, Jun 23, 2011 at 2:36 AM, Wieland Hoffmann
><themineo@googlemail.com> wrote:
>> + * * * * * * * * * * * echo "$(gettext "NOT FOUND")" >&2
>> + * * * * * * * * * * * errors=1
>> + * * * * * * * * * * * found=0
>> + * * * * * * * fi
>> +
>> + * * * * * * * if (( found )); then
>> + * * * * * * * * * * * if ! gpg --quiet --batch --verify "$file"
>> 2> /dev/null; then
>> + * * * * * * * * * * * * * * * echo "$(gettext "Verification
>> failed")" >&2
>Any need to eat stderr? If things only show up in exceptional cases,
>I'd rather it come through.

After looking at this more thorougly it seems like ALL output will
appear on stderr [0].
I think it's a good idea to eat stderr here and instead use
--status-file to save status messages in a temporary file and then grep
for one of EXPSIG, EXPKEYSIG or REVKEYSIG (yes, gpg exits with status 0
even if the key that signed something has been revoked)[1] and exit
immediately with an error message. Any objections?

[0]
http://lists.gnupg.org/pipermail/gnupg-users/2010-November/039821.html
[1]
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=doc/DETAILS;h=2e1d92bb7c7cbeed9008ed268b365613ab3c5948 ;hb=refs/heads/STABLE-BRANCH-2-0#l232

--
Wieland / Mineo
 
Old 06-28-2011, 11:21 PM
Allan McRae
 
Default Add support for verifying pgp signatures to makepkg

On 23/06/11 17:36, Wieland Hoffmann wrote:

Hi,

this adds support for verifying pgp signatures provided by upstream to
makepkg. A new array pgpsigs is defined holding the URLs to all the
signature files.

However, there're still a few quirks:

* You have to manually import the key which signed the source. Actually
that's good, but:

* You don't know why the verification failed. It's either a wrong
signature or the key is simply not known to gnupg. This is really
bad, so I've chosen to make pgp verification optional for now. makepkg
--pgp enables it.



I'm not going to review the actual patches yet because I think there are
a few things that need discussed about how best to handle this first.


Firstly I want to note that there is another patch implementing this in
a slightly different way on the bug tracker:

https://bugs.archlinux.org/task/20448
https://github.com/str1ngs/pacman/compare/sigs
So we might be able to combine some ideas here.


So, onto the implementation:

1) Do we need a separate array for signatures, or should they be just
added in the source=() array? If it was in the source array, I can just
use bash expansion like:


source=(http://ftp.gnu.org/gnu/bash/bash-4.2.tar.gz{,.sig})

and it is fairly clear which files have signatures. It is also flexible
enough to have a different source line if the signature is hosted
elsewhere. As a "bonus" we would get md5sum checks on the signature file...


I find a separate array that is not aligned with the source array (as in
element x in the source array is not going to always be element x in the
sig array) to be a bit confusing. We can detect signatures to check in
the source array by extension (note comment #4 below) so I really think
a separate array is overkill.


2) How much control do we need on when this checking is done? Both
implementation so far have provided some way to enable/disable this
checking. I think it should run by default and a --skippgpcheck (name
needs work...) analog to --skipinteg is all that is needed.


3) Can we use some return values from gpg to distinguish the failure
cases? Then we could give some granularity in our output - e.g. Pass,
FAIL, Unknown Key, (others???). I would be fine if the "Unknown Key"
case was just a warning. I would also tend to hide the gpg output here
as a failure will need manually investigated by the user anyway.


4) Note many projects distribute ascii armored signatures, so the
extensions that need to be detected are .sig and .asc (is that all?)


Allan
 
Old 06-29-2011, 01:55 AM
Allan McRae
 
Default Add support for verifying pgp signatures to makepkg

On 29/06/11 09:21, Allan McRae wrote:

On 23/06/11 17:36, Wieland Hoffmann wrote:

Hi,

this adds support for verifying pgp signatures provided by upstream to
makepkg. A new array pgpsigs is defined holding the URLs to all the
signature files.

However, there're still a few quirks:

* You have to manually import the key which signed the source. Actually
that's good, but:

* You don't know why the verification failed. It's either a wrong
signature or the key is simply not known to gnupg. This is really
bad, so I've chosen to make pgp verification optional for now. makepkg
--pgp enables it.



I'm not going to review the actual patches yet because I think there are
a few things that need discussed about how best to handle this first.

Firstly I want to note that there is another patch implementing this in
a slightly different way on the bug tracker:
https://bugs.archlinux.org/task/20448
https://github.com/str1ngs/pacman/compare/sigs
So we might be able to combine some ideas here.


So, onto the implementation:

1) Do we need a separate array for signatures, or should they be just
added in the source=() array? If it was in the source array, I can just
use bash expansion like:

source=(http://ftp.gnu.org/gnu/bash/bash-4.2.tar.gz{,.sig})

and it is fairly clear which files have signatures. It is also flexible
enough to have a different source line if the signature is hosted
elsewhere. As a "bonus" we would get md5sum checks on the signature file...

I find a separate array that is not aligned with the source array (as in
element x in the source array is not going to always be element x in the
sig array) to be a bit confusing. We can detect signatures to check in
the source array by extension (note comment #4 below) so I really think
a separate array is overkill.


Another advantage of using the source array is that the gpg keys get
included with makepkg --allsource without any modifiations to makepkg.



2) How much control do we need on when this checking is done? Both
implementation so far have provided some way to enable/disable this
checking. I think it should run by default and a --skippgpcheck (name
needs work...) analog to --skipinteg is all that is needed.

3) Can we use some return values from gpg to distinguish the failure
cases? Then we could give some granularity in our output - e.g. Pass,
FAIL, Unknown Key, (others???). I would be fine if the "Unknown Key"
case was just a warning. I would also tend to hide the gpg output here
as a failure will need manually investigated by the user anyway.


I see in another message to this thread the mention of using
--status-file and grepping the output given gpg is crap with its return
codes. That seems fine, but before that is implemented we should get a
list of possible values and decide what makepkg will do with them.
i.e., success, error or warning for the various cases. I'd lean to more
warnings than failures...



4) Note many projects distribute ascii armored signatures, so the
extensions that need to be detected are .sig and .asc (is that all?)

Allan
 
Old 06-29-2011, 02:34 PM
Wieland Hoffmann
 
Default Add support for verifying pgp signatures to makepkg

Hallo, Allan McRae:
> On 29/06/11 09:21, Allan McRae wrote:
> >Firstly I want to note that there is another patch implementing this in
> >a slightly different way on the bug tracker:
> >https://bugs.archlinux.org/task/20448
> >https://github.com/str1ngs/pacman/compare/sigs
> >So we might be able to combine some ideas here.

I'm a bit short on time until next week, but I'll add a comment on
Flyspray so we're not duplicating our efforts

> >So, onto the implementation:
> >
> >1) Do we need a separate array for signatures, or should they be just
> >added in the source=() array? If it was in the source array, I can just
> >use bash expansion like:
> >
> >source=(http://ftp.gnu.org/gnu/bash/bash-4.2.tar.gz{,.sig})
> >
> >and it is fairly clear which files have signatures. It is also flexible
> >enough to have a different source line if the signature is hosted
> >elsewhere. As a "bonus" we would get md5sum checks on the signature file...
> >
> >I find a separate array that is not aligned with the source array (as in
> >element x in the source array is not going to always be element x in the
> >sig array) to be a bit confusing. We can detect signatures to check in
> >the source array by extension (note comment #4 below) so I really think
> >a separate array is overkill.

It should be possible to implement this without adding a separate array.

> >2) How much control do we need on when this checking is done? Both
> >implementation so far have provided some way to enable/disable this
> >checking. I think it should run by default and a --skippgpcheck (name
> >needs work...) analog to --skipinteg is all that is needed.

The reason for disabling this by default were that is was unclear why
the verification process failed.

> >
> >3) Can we use some return values from gpg to distinguish the failure
> >cases? Then we could give some granularity in our output - e.g. Pass,
> >FAIL, Unknown Key, (others???). I would be fine if the "Unknown Key"
> >case was just a warning. I would also tend to hide the gpg output here
> >as a failure will need manually investigated by the user anyway.
>
> I see in another message to this thread the mention of using
> --status-file and grepping the output given gpg is crap with its
> return codes. That seems fine, but before that is implemented we
> should get a list of possible values and decide what makepkg will do
> with them. i.e., success, error or warning for the various cases.
> I'd lean to more warnings than failures...

To better illustrate this, I've uploaded my patch to github, too:
https://github.com/mineo/pacman/compare/makepkg-pgp .

--
Wieland
 

Thread Tools




All times are GMT. The time now is 07:28 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org