gnu-arch-users
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Gnu-arch-users] signing rules


From: Robert Collins
Subject: Re: [Gnu-arch-users] signing rules
Date: Sun, 13 Mar 2005 10:55:26 +1100

On Sat, 2005-03-12 at 16:04 +0100, David Allouche wrote:
On Wed, 2005-03-09 at 00:03 +1100, Robert Collins wrote:
> I wonder if folk would be kind enough to let me know what signing and
> check rules they are using?
> 
> I'm implementing a prototype of
> http://wiki.gnuarch.org/moin.cgi/SigningRules - and knowing what
> \=default.check and archive specific check rules are in use, will let me
> provide auto-conversion code for the common case users.
> 
> So - please let me know what you use - and if someone else has already
> said they use the same rule, still let me know :).

=default.check
        tla-gpg-check gpg_command="gpg --verify-files -"

That's, well, the default.

address@hidden (and other check rules)
        ~/.arch-params/bin/my-gpg-check jblack
...
IIRC the point of this script is shutting down verbosity, but still
having it handy for diagnostic if something went wrong.

It's quite possible that this effect could have been achieved by passing
the appropriate options to gpg, but at the time I was completely scared
by this software. Toooooo many options.

In a nutshell this setup provides:
      * One keyring per archive.
      * No needless verbosity.
      * Useful diagnostic output in case of failure.
      * Relatively easy addition of new archives.

Well, that certainly is the whole hog ;). The SigningRules implementation works with your default gnupg configuration, and then applies a policy to that. This provides:
- only need the default keyring
- all output is under arch's control
- more detailed diagnostics can be provided.
- new archives are trivially added (works by default)
- policy is easy to set :
echo "[signing]
allowed_ids=address@hidden" >> ~/.arch-params/archives/$officialname

To convert, what you will need to do is set such a policy on each archive whose configuration you upgrade.

As a data point, I had a very similar configuration to yours, and the PQM at canonical does too - I'm finding the new config here much easier, and looking forward to upgrading the PQM config :0

Rob



Attachment: signature.asc
Description: This is a digitally signed message part


reply via email to

[Prev in Thread] Current Thread [Next in Thread]