gpg signature of leaf packages

Hi

I was discussing the possibility of signing leaf packages a few days
back with KP. I was doing some research on the feasability, including
generation of a trusted key. Here is one result I got importing my own
key in another account and using it to veryfy the signature of a
package. The imported key was not signed, as the gpg installation in
this account does not have a secret key. I _believe_ by distributing the
.gnupg directory in initrd we could check signtures on our packages in
the following manner. I am aware that without a private key the trust
model of gpg is not completed.


gpg --decrypt /tmp/wpasupp.lwp | tar -tzf -
gpg: Signature made Sat 23 Sep 2017 03:43:14 PM CEST using DSA key ID
05B80A16
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: Good signature from "Erich Titl <[email protected]>"
gpg:                 aka "Erich Titl <[email protected]>"
etc/
etc/webconf/
etc/webconf/wpasupp.webconf
var/
var/webconf/
var/webconf/www/
var/webconf/www/wpa_restart.tip
var/webconf/www/wpa_disconnect.tip
var/webconf/www/wpa.tip
var/webconf/www/wpa_scan.tip
var/webconf/www/pix/
var/webconf/www/pix/85pct.png
var/webconf/www/pix/15pct.png
var/webconf/www/pix/50pct.png
var/webconf/www/pix/65pct.png
var/webconf/www/pix/35pct.png
var/webconf/www/pix/100pct.png
var/webconf/www/wpa_connect.tip
var/webconf/www/wpa.js
var/webconf/www/wpa_forget.tip
var/webconf/www/wpa.css
var/webconf/www/wpa.cgi
var/webconf/www/wpa.info
var/webconf/lib/
var/webconf/lib/wpa.func

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot


_______________________________________________
leaf-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-devel