bugWeeChat - Bugs: bug #37428, GPG signatures and downloading...

 
 

bug #37428: GPG signatures and downloading over TLS

Submitted by:  Abel Luck <abelxluck>
Submitted on:  Sun 23 Sep 2012 04:38:21 PM UTC  
 
Category: packagingSeverity: 3 - Normal
Item Group: securityStatus: Fixed
Privacy: PublicAssigned to: Sebastien Helleu <flashcode>
Originator Name: Open/Closed: Closed
Release: otherIRC nick: abeluck

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Sun 21 Oct 2012 07:40:17 AM UTC, comment #6:

Hi,

I have setup a key and signed the current stable release with it (0.3.9).

Please look at download page for more info, I added :
- SHA1 sum for all (stable) packages
- gpg signature for version 0.3.9
- instructions to get/check key and verify signature.

If something is wrong, please let me know.

For HTTPS on weechat.org, it's planned for the next weeks.

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Fri 19 Oct 2012 12:19:13 PM UTC, comment #5:

Alright, no problem. I'll poke you in a month or two to see how it's coming along.

By the way, check out irssi's download page for an example of how to display/use the sigs:

http://irssi.org/download

Abel Luck <abelxluck>
Wed 17 Oct 2012 03:23:07 PM UTC, comment #4:

OK, will be done later (not a high priority, and a few things on my side are needed to do that).

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Fri 12 Oct 2012 04:16:28 PM UTC, comment #3:

I discussed this with flashcode on IRC.

The main issue is that flashcode does weechat builds on a server, so signing those packages with a GPG key is of only questionable value.

He said he'd look into changing his build process to build - at least stable releases - offline sometime in the future.

Also, getting an SSL cert for HTTPS on the download page can be done for free [0][1]. Flashcode is running something else on 443 that would need to be moved.

[0]: https://www.startssl.com/?app=12
[1]: http://arstechnica.com/security/2009/12/how-to-get-set-with-a-secure-sertificate-for-free/

Abel Luck <abelxluck>
Tue 02 Oct 2012 10:43:20 AM UTC, comment #2:

I think that Abel means that there is no downloadable signature on http://weechat.org/download/ . The gpg signing is just

gpg --detach-sign source.tar.gz

and it generates file called

source.tar.gz.sig or source.tar.gz.gpg or if -a was given to gpg or gpg.conf had "armor" in it source.tar.gz.asc.

-a or "armor" makes the signature to be ASCII armored (plain text) instead of binary.

(I hope that I understood "Need Info" status correctly)

Mika Suomalainen <mkaysi>
Tue 02 Oct 2012 06:59:10 AM UTC, comment #1:

If you have some time to discuss that on irc, I have some questions. Thanks.

Sebastien Helleu <flashcode>
Project AdministratorIn charge of this item.
Sun 23 Sep 2012 04:38:21 PM UTC, original submission:

Hi there, I can't seem to find any signatures to download and verify along side the binary packages or source tarballs.

Most users probably get weechat from their distro's packages, but as far as I can tell, the packagers have no way to verify the authenticity of the source tarballs they download.

It would be great if the download page could link to the signature, moreover, if the downloads were available for TLS, that would be useful as well.

If you have any questions about how to implement GPG signing/verification into the release process, let me know, I'd be more than happy to help.

Abel Luck <abelxluck>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by mkaysi (Posted a comment)
  • -unavailable- added by flashcode (Posted a comment)
  • -unavailable- added by abelxluck (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 20 Jan 2013 09:23:21 AM UTCflashcodeOpen/ClosedOpen=>Closed
    Sat 05 Jan 2013 12:00:44 PM UTCflashcodeStatusReady For Test=>Fixed
    Sun 21 Oct 2012 07:40:34 AM UTCflashcodeStatusNeed Info=>Ready For Test
    Sun 21 Oct 2012 07:40:17 AM UTCflashcodeStatusPostponed=>Need Info
    Wed 17 Oct 2012 03:23:07 PM UTCflashcodeStatusNeed Info=>Postponed
    Tue 02 Oct 2012 06:59:10 AM UTCflashcodeStatusNone=>Need Info
      Assigned toNone=>flashcode

    Back to the top


    Powered by Savane 3.1-cleanup