bryson/pacman
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
pacman/scripts
History
Dave Reisner d080a469a0 pacman-key: Do not reinterpret keys from revoked keyrings 
Given a revoked keyring containing only:

  BC1FBE4D2826A0B51E47ED62E2539214C6C11350

We should only disable this specific keyid. This change enforces that the
contents of the -revoked keyring file are full fingerprints which can uniquely
identify a key.

Before:

  # pacman-key --populate archlinux
  ==> Appending keys from archlinux.gpg...
  ==> Locally signing trusted keys in keyring...
    -> Locally signing key 0E8B644079F599DFC1DDC3973348882F6AC6A4C2...
    -> Locally signing key 684148BB25B49E986A4944C55184252D824B18E8...
    -> Locally signing key 44D4A033AC140143927397D47EFD567D4C7EA887...
    -> Locally signing key 27FFC4769E19F096D41D9265A04F9397CDFD6BB0...
    -> Locally signing key AB19265E5D7D20687D303246BA1DFB64FFF979E7...
  ==> Importing owner trust values...
  ==> Disabling revoked keys in keyring...
    -> Disabling key 1390420191...
    -> Disabling key E2539214C6C11350...
    -> Disabling key 8544EA82113502DE...
  ==> Updating trust database...
  gpg: next trustdb check due at 2014-01-22

After:

  # pacman-key --populate archlinux
  ==> Appending keys from archlinux.gpg...
  ==> Locally signing trusted keys in keyring...
    -> Locally signing key 0E8B644079F599DFC1DDC3973348882F6AC6A4C2...
    -> Locally signing key 684148BB25B49E986A4944C55184252D824B18E8...
    -> Locally signing key 44D4A033AC140143927397D47EFD567D4C7EA887...
    -> Locally signing key 27FFC4769E19F096D41D9265A04F9397CDFD6BB0...
    -> Locally signing key AB19265E5D7D20687D303246BA1DFB64FFF979E7...
  ==> Importing owner trust values...
  ==> Disabling revoked keys in keyring...
    -> Disabling key BC1FBE4D2826A0B51E47ED62E2539214C6C11350...
  ==> Updating trust database...
  gpg: next trustdb check due at 2014-01-22

Partially addresses FS#35478. This does nothing to confirm whether or not the
key was successfully disabled -- a ridiculously simple request which appears to
be far too difficult for gpg to manage.

Signed-off-by: Dave Reisner <dreisner@archlinux.org>
Signed-off-by: Allan McRae <allan@archlinux.org>
2013-06-04 14:01:41 +10:00
..
library Fix spelling errors using 'codespell' tool 2013-04-18 13:20:13 +10:00
po More translation updates 2013-05-07 12:53:23 +10:00
.gitignore rankmirrors: move to contrib/ 2012-04-24 20:33:08 -04:00
Makefile.am distribute library/term_colors.sh 2013-03-10 11:33:59 +10:00
makepkg.sh.in Restrict pkgname from starting with a dot. 2013-06-04 13:38:48 +10:00
pacman-db-upgrade.sh.in scripts: Add color to pacman-db-upgrade 2013-03-08 17:04:39 +10:00
pacman-key.sh.in pacman-key: Do not reinterpret keys from revoked keyrings 2013-06-04 14:01:41 +10:00
pacman-optimize.sh.in scripts: Add color to pacman-optimize 2013-03-08 17:04:39 +10:00
pkgdelta.sh.in pkgdelta: fix improper passing of file argument 2013-03-14 11:47:11 +10:00
repo-add.sh.in repo-add: Update copyright year 2013-03-15 13:21:32 +10:00