From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: Re: [PATCH] validate GPG keys by fingerprint Date: Mon, 13 Nov 2017 23:07:41 +0000 Message-ID: <1510614461.3441.17.camel@ipfire.org> In-Reply-To: <1510613939.3441.16.camel@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3765594191028363970==" List-Id: --===============3765594191028363970== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable I commented more on the bug report. Everyone who is interested in this should check that one out... On Mon, 2017-11-13 at 22:58 +0000, Michael Tremer wrote: > Thanks. I merged this and so we can work on improving this more... >=20 > On Sun, 2017-11-12 at 15:40 +0100, Peter M=C3=BCller wrote: > > Validate GPG keys by fingerprint and not by 8-bit key-ID. > >=20 > > This makes exploiting bug #11539 harder, but not impossible > > and does not affect existing installations. > >=20 > > Signed-off-by: Peter M=C3=BCller > > --- > > src/pakfire/lib/functions.pl | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > >=20 > > diff --git a/src/pakfire/lib/functions.pl b/src/pakfire/lib/functions.pl > > index c347916d8..cfb7e5117 100644 > > --- a/src/pakfire/lib/functions.pl > > +++ b/src/pakfire/lib/functions.pl > > @@ -34,8 +34,8 @@ use Net::Ping; > > package Pakfire; > > =20 > > # GPG Keys > > -my $myid =3D "64D96617"; # Our own gpg-key paks(a)ipfire.org > > -my $trustid =3D "65D0FD58"; # gpg-key of CaCert > > +my $myid =3D "179740DC4D8C47DC63C099C74BDE364C64D96617"; # Our own gpg-= key paks(a)ipfire.org > > +my $trustid =3D "A31D4F81EF4EBD07B456FA04D2BB0D0165D0FD58"; # gpg-key of= CaCert > > =20 > > # A small color-hash :D > > my %color; --===============3765594191028363970== Content-Type: application/pgp-signature Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="signature.asc" MIME-Version: 1.0 LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KCmlRSXpCQUFCQ2dBZEZpRUU1L3JXNWwzR0dl Mnlwa3R4Z0hudy8yK1FDUWNGQWxvS0piMEFDZ2tRZ0hudy8yK1EKQ1FjamVnLy9SN0JvSjUwMnJN K1Y1ZDhHd0QxU2NpWFA5VDB5bkV2ZzQvRjA4d0N3b3AxeU5pYStnVDE0aWhvUApicld4dW9jakhS R2lZU2IzM0puL0xmdGRuY1VSNlFFQm5kWGNwcExqK1ZDa2dvZ1pqQVAzR1NMTWV6eUJWc05aCnNX MU9zc3BneDArZGdkazRmTGp1Skw5WmVSTmk4eklzU2M2b0xhMk5paHU1aFBOeE8wMDdwUUxjL2hT SmdkUmgKSDRDekdCdmQwaU5NZU56RWtTNzVBTWlrdnkrZ0tCMm1iRWNFS3AxL3dCaHZhMytZS2Na UnFNM2owL1c0ZlJiQgpTc2p5TVpXM2ViR1dseWZoMi82TUZRTWxEQVdweEJxR2liSjkzUC9hMkVG VVRQdHczcDcxV3hKNkttTnJKMFp4Cm02K1orVkhiRUtGYnc1cnpMeGxRY2duT016SjgvUklNNXMy aE9CMGx6ZkY5YklIR1ltNEVvVGY0emNmQTJOeG8KNUdsaUNtMm5tK0VzVXV3TFUycldST24vSEFi T0RqVUZHbUJPQkpBa1E5dnhzR0JBUDBZdTM5Umg3ODVTRFFBTApmdnpSTWpaeXlqOUNQbGluVFlI RGIzT3kzc0VPNTZYb1kzbVJwRFpGR0NmbXJPbFhieDVud3ZrM1U2Zi9XNmJICi9yVlM4NnU1UE9B Tm05bTFMd3JLcVBDZW9vWnpPK2IrcHdCcnprajJqYVdhSEtqVlp1ZndoZmluVHloVy96Um4KZjA2 b2dFYkZlYXlnSWx5bmFUTGJxSU9GQmp0WWNRRkpNTFFMNDQwb3d0RnJ5S0xnS1F5MyszdXFqTnEv Nkg1MwpsNUR4a1lvWFJNdHZ0WGhKQjhVNUxuMWtrUEZQUUlvbWJ1VTVGZVBjYkdVN3JhZDI5Mnc9 Cj1WK0RwCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo= --===============3765594191028363970==--