bugWeeChat - Bugs: bug #37428, GPG signatures and downloading...

 
 

bug #37428: GPG signatures and downloading over TLS

Submitted by:  Abel Luck <abelxluck>
Submitted on:  Sun Sep 23 16:38:21 2012  
 
Category: packagingSeverity: 3 - Normal
Item Group: securityStatus: Fixed
Privacy: PublicAssigned to: Sebastien Helleu <flashcode>
Originator Name: Open/Closed: Closed
Release: otherIRC nick: abeluck

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Sun Oct 21 07:40:17 2012, comment #6:

Hi,

I have setup a key and signed the current stable release with it (0.3.9).

Please look at download page for more info, I added :
- SHA1 sum for all (stable) packages
- gpg signature for version 0.3.9
- instructions to get/check key and verify signature.

If something is wrong, please let me know.

For HTTPS on weechat.org, it's planned for the next weeks.

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Fri Oct 19 12:19:13 2012, comment #5:

Alright, no problem. I'll poke you in a month or two to see how it's coming along.

By the way, check out irssi's download page for an example of how to display/use the sigs:

http://irssi.org/download

Abel Luck <abelxluck>
Wed Oct 17 15:23:07 2012, comment #4:

OK, will be done later (not a high priority, and a few things on my side are needed to do that).

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Fri Oct 12 16:16:28 2012, comment #3:

I discussed this with flashcode on IRC.

The main issue is that flashcode does weechat builds on a server, so signing those packages with a GPG key is of only questionable value.

He said he'd look into changing his build process to build - at least stable releases - offline sometime in the future.

Also, getting an SSL cert for HTTPS on the download page can be done for free [0][1]. Flashcode is running something else on 443 that would need to be moved.

[0]: https://www.startssl.com/?app=12
[1]: http://arstechnica.com/security/2009/12/how-to-get-set-with-a-secure-sertificate-for-free/

Abel Luck <abelxluck>
Tue Oct 2 10:43:20 2012, comment #2:

I think that Abel means that there is no downloadable signature on http://weechat.org/download/ . The gpg signing is just

gpg --detach-sign source.tar.gz

and it generates file called

source.tar.gz.sig or source.tar.gz.gpg or if -a was given to gpg or gpg.conf had "armor" in it source.tar.gz.asc.

-a or "armor" makes the signature to be ASCII armored (plain text) instead of binary.

(I hope that I understood "Need Info" status correctly)

Mika Suomalainen <mkaysi>
Tue Oct 2 06:59:10 2012, comment #1:

If you have some time to discuss that on irc, I have some questions. Thanks.

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Sun Sep 23 16:38:21 2012, original submission:

Hi there, I can't seem to find any signatures to download and verify along side the binary packages or source tarballs.

Most users probably get weechat from their distro's packages, but as far as I can tell, the packagers have no way to verify the authenticity of the source tarballs they download.

It would be great if the download page could link to the signature, moreover, if the downloads were available for TLS, that would be useful as well.

If you have any questions about how to implement GPG signing/verification into the release process, let me know, I'd be more than happy to help.

Abel Luck <abelxluck>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by mkaysi (Posted a comment)
  • -unavailable- added by flashcode (Posted a comment)
  • -unavailable- added by abelxluck (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun Jan 20 09:23:21 2013flashcodeOpen/ClosedOpen=>Closed
    Sat Jan 5 12:00:44 2013flashcodeStatusReady For Test=>Fixed
    Sun Oct 21 07:40:34 2012flashcodeStatusNeed Info=>Ready For Test
    Sun Oct 21 07:40:17 2012flashcodeStatusPostponed=>Need Info
    Wed Oct 17 15:23:07 2012flashcodeStatusNeed Info=>Postponed
    Tue Oct 2 06:59:10 2012flashcodeStatusNone=>Need Info
      Assigned toNone=>flashcode

    Back to the top


    Powered by Savane 3.1-cleanup