Re: asdf-install updated in SBCL CVS

Daniel Barlow wrote:
> Having discovered that gpg has an alternate output mode which is
> intended to be machine-parseable, I've just committed some exciting
> new breakage to SBCL's asdf-install contrib to make it a bit smarter
> about checking GPG signatures.  It now attempts to check signatures
> for all packages no matter where they've come from, but there are
> restarts to bypass most of the checks.

Using the --status-fd mode is a good choice. I've attached a patch
[untested] that uses gpgv rather gpg for verifying the signature.

> Presently (a) and (b) are terminal errors,  (c) can be ignored, and 
> (d) has a restart that lets you add the packager to your package
> supplier list.  The package supplier list is stored between sessions
> in ~/.sbcl/trusted-uids.lisp

That's reasonable for now. At some point, perhaps, cclan will have a
master list of "trusted by cclan" public keys. These would be public
keys that have been accepted by cclan to certify the package was
uploaded by an individual "known" to the cclan project and trusted to
follow the "cclan guidelines". Of course, the concepts of "known" and
"cclan guidelines" have not been formalized for the cclan project.

-- 
Kevin Rosenberg
[email protected]

--- installer.lisp.orig	2003-09-21 15:22:07.000000000 -0600
+++ installer.lisp	2003-09-21 15:24:11.000000000 -0600
@@ -173,9 +173,17 @@
 (defun verify-gpg-signature/string (string file-name)
   (let* ((proc
 	  (sb-ext:run-program
-	   "gpg"
+	   "gpgv"
 	   (list
-	    "--status-fd" "1" "--verify" "-"
+	    "--status-fd" "1"
+	    "--keyring"
+	    (namestring (merge-pathnames
+			 (make-pathname
+			  :directory '(:relative ".gnupg")
+			  :name "pubring"
+			  :type "gpg")
+			 (user-homedir-pathname)))
+	    "--verify" "-"
 	    (namestring file-name))
 	   :output :stream :error :stream :search t
 	   :input (make-string-input-stream string) :wait t))

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/bhnPES7N8sSjgj4RAv/7AJ44Z/jugIHnpvHY25Ue4VOrUIs+eQCdFxJS
Th7SOOJKUnW7nnc89nBQ2m8=
=JR13
-----END PGP SIGNATURE-----