[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#25094: Add comments to archive keys and acls
From: |
Leo Famulari |
Subject: |
bug#25094: Add comments to archive keys and acls |
Date: |
Fri, 2 Dec 2016 13:13:51 -0500 |
User-agent: |
Mutt/1.7.1 (2016-10-04) |
On Fri, Dec 02, 2016 at 06:38:12PM +0100, Hartmut Goebel wrote:
> Hi,
>
> the keys for authenticating an archive currently do not hold any
> comment. This makes it hard to track acls and remove certain keys if
> required.
Indeed, this makes key management a little harder than it needs to be.
> Please implement some way to add and change the comment on keys in
> /etc/guix/ and in /etc/guix/acl.
>
> Proposed usage when generating the key:
> guix archive --generate-key=… --comment "store.example.com"
>
> Proposed usage when importing the key and overwriting any existing comment
>
> guix archive --authorize --comment "store.example.com"
>
> For now, since we have no commands for key management, these would be
> enough IMO. Existing commenty an easily be changed in the file, so for
> now we do not need a tool for this.
I think that the comment should either be signed somehow, or the field
name should be "untrusted-comment".
OpenBSD's signify tool (which we have a port of in Guix) does this:
------
$ cat foo.pub
untrusted comment: Leo's example public key
RWRrY3me0s1DYDBfpcUKZ+ul9m8FgdZfz5+cHjxBabEsvDrjL/ecTeUL
------
Minisign, which is a 3rd party tool compatible with signify, also has
trusted comments:
https://github.com/jedisct1/minisign/blob/master/src/manpage.md#notes