bugWeeChat - Bugs: bug #37428, GPG signatures and downloading...

 
 

bug #37428: GPG signatures and downloading over TLS

Submitter:  Abel Luck <abelxluck>
Submitted:  Sun 23 Sep 2012 04:38:21 PM UTC
   
 
Category:  packaging Severity:  3 - Normal
Item Group:  security Status:  Fixed
Privacy:  Public Assigned to:  flashcode
Originator Name:  Open/Closed:  Closed
Release:  * other IRC nick:  abeluck
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Sun 21 Oct 2012 07:40:17 AM UTC, comment #6: 

Hi,

I have setup a key and signed the current stable release with it (0.3.9).

Please look at download page for more info, I added :
- SHA1 sum for all (stable) packages
- gpg signature for version 0.3.9
- instructions to get/check key and verify signature.

If something is wrong, please let me know.

For HTTPS on weechat.org, it's planned for the next weeks.

Sebastien Helleu <flashcode>
Group administrator
Fri 19 Oct 2012 12:19:13 PM UTC, comment #5: 

Alright, no problem. I'll poke you in a month or two to see how it's coming along.

By the way, check out irssi's download page for an example of how to display/use the sigs:

http://irssi.org/download

Abel Luck <abelxluck>
Wed 17 Oct 2012 03:23:07 PM UTC, comment #4: 

OK, will be done later (not a high priority, and a few things on my side are needed to do that).

Sebastien Helleu <flashcode>
Group administrator
Fri 12 Oct 2012 04:16:28 PM UTC, comment #3: 

I discussed this with flashcode on IRC.

The main issue is that flashcode does weechat builds on a server, so signing those packages with a GPG key is of only questionable value.

He said he'd look into changing his build process to build - at least stable releases - offline sometime in the future.

Also, getting an SSL cert for HTTPS on the download page can be done for free [0][1]. Flashcode is running something else on 443 that would need to be moved.

[0]: https://www.startssl.com/?app=12
[1]: http://arstechnica.com/security/2009/12/how-to-get-set-with-a-secure-sertificate-for-free/

Abel Luck <abelxluck>
Tue 02 Oct 2012 10:43:20 AM UTC, comment #2: 

I think that Abel means that there is no downloadable signature on http://weechat.org/download/ . The gpg signing is just

gpg --detach-sign source.tar.gz

and it generates file called

source.tar.gz.sig or source.tar.gz.gpg or if -a was given to gpg or gpg.conf had "armor" in it source.tar.gz.asc.

-a or "armor" makes the signature to be ASCII armored (plain text) instead of binary.

(I hope that I understood "Need Info" status correctly)

Mika Suomalainen <mkaysi>
Tue 02 Oct 2012 06:59:10 AM UTC, comment #1: 

If you have some time to discuss that on irc, I have some questions. Thanks.

Sebastien Helleu <flashcode>
Group administrator
Sun 23 Sep 2012 04:38:21 PM UTC, original submission:  

Hi there, I can't seem to find any signatures to download and verify along side the binary packages or source tarballs.

Most users probably get weechat from their distro's packages, but as far as I can tell, the packagers have no way to verify the authenticity of the source tarballs they download.

It would be great if the download page could link to the signature, moreover, if the downloads were available for TLS, that would be useful as well.

If you have any questions about how to implement GPG signing/verification into the release process, let me know, I'd be more than happy to help.

Abel Luck <abelxluck>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by mkaysi (Posted a comment)
  • -email is unavailable- added by flashcode (Posted a comment)
  • -email is unavailable- added by abelxluck (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-01-20 flashcode Open/ClosedOpen Closed
    2013-01-05 flashcode StatusReady For Test Fixed
    2012-10-21 flashcode StatusNeed Info Ready For Test
    2012-10-21 flashcode StatusPostponed Need Info
    2012-10-17 flashcode StatusNeed Info Postponed
    2012-10-02 flashcode StatusNone Need Info
        Assigned toNone flashcode

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code