<br>A quick question......<br><br>I saw this in be_package.c pkg_load()<br><br><blockquote style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;" class="gmail_quote"> /* look around for a PGP signature file; load if available */<br>
MALLOC(pgpfile, strlen(pkgfile) + 5, RET_ERR(PM_ERR_MEMORY, NULL));<br> sprintf(pgpfile, "%s.sig", pkgfile);<br> if(access(pgpfile, R_OK) == 0) {<br> FILE *f;<br> long bytes;<br>
f = fopen(pgpfile, "rb");<br> fseek(f, 0L, SEEK_END);<br> bytes = ftell(f);<br> fseek(f, 0L, SEEK_SET);<br> /* don't read the file in if it is obviously not the size of a sig */<br>
if(bytes == 72) {<br> CALLOC(newpkg->pgpsig.rawdata, bytes, sizeof(char),<br> RET_ERR(PM_ERR_MEMORY, NULL));<br> fread(newpkg->pgpsig.rawdata, sizeof(char), bytes, f);<br>
newpkg->pgpsig.rawlen = bytes;<br> _alpm_log(PM_LOG_DEBUG,<br> "loaded package .sig file, location %s\n", pgpfile);<br> } else {<br> _alpm_log(PM_LOG_WARNING, _("PGP signature file for %s was abnormal"<br>
" (had length %ld), skipping\n"), pkgfile, bytes);<br> }<br> fclose(f);<br> } else {<br> _alpm_log(PM_LOG_DEBUG, "no package signature file found\n");<br>
}<br> FREE(pgpfile);<br></blockquote><br><br>So do we download the signature file along with the package? Or use %PGPSIG% in the db? <br><br><br><br>On Tue, Dec 16, 2008 at 3:49 AM, Dan McGee <<a href="mailto:dpmcgee@gmail.com">dpmcgee@gmail.com</a>> wrote:<br>
> On Mon, Dec 15, 2008 at 2:11 PM, Gerhard Brauer <<a href="mailto:gerbra@archlinux.de">gerbra@archlinux.de</a>> wrote:<br>>> Am Mon, 15 Dec 2008 13:50:49 -0600<br>>> schrieb Chris Brannon <<a href="mailto:cmbrannon@cox.net">cmbrannon@cox.net</a>>:<br>
>>> I think pacman should at least complain if the signing key is not<br>>>> found in the public keyring. Thoughts?<br>>><br>>> IMHO pacman should refuse to install anything from core and extra if<br>
>> the signature is not found or corrupted.<br>>> I don't know what to to with community (maybe a second keyring with<br>>> TU signatures?)<br>><br>> Pacman knows nothing about [core], [extra], and [community], so this<br>
> will not be possible. However, I had considered a few possibilities<br>> for this type of stuff and this was the best I could think of:<br>> One shared keyring for all repos. Under each repository section, we<br>
> would have a VerifySignatures option or something similar, which would<br>> take values of "Always", "Optional", or "Never", with one of these as<br>> a sane default. We would fail when set to "Always" if packages had no<br>
> signature, we didn't have the signature on the package, or if the<br>> signature was invalid. For optional, we would verify the signature if<br>> it was there and we had it in our keychain; spit a warning otherwise<br>
> but continue on. Never seems self explanatory<br>><br>>> My thoughts were to make a option to each repo section in pacman.conf.<br>>> With this option: Keyring = /foo/bar we have an indicator that pacman<br>
>> should check for correct signatures and users could have their<br>>> unsigned or self-signed repos additionally.<br>><br>> Ha! We think alike. I actually typed the above before I read this.<br>><br>
> -Dan<br>> _______________________________________________<br>> pacman-dev mailing list<br>> <a href="mailto:pacman-dev@archlinux.org">pacman-dev@archlinux.org</a><br>> <a href="http://archlinux.org/mailman/listinfo/pacman-dev">http://archlinux.org/mailman/listinfo/pacman-dev</a><br>
><br><br>