[PATCH] cygport/lib/src_prep.cygpart: use gpgv2 not gpg2 --verify

[PATCH] cygport/lib/src_prep.cygpart: use gpgv2 not gpg2 --verify

[Brian Inglis]

From: "Brian Inglis" <Brian.Inglis@SystematicSW.ab.ca>

Utility gpgv2 is the gpg2 release of gpgv, a lighter, script friendly,
single operation gpg verification helper designed for use in scripts
instead of gpg2 --verify: see 'info gpg2 helper gpgv'

__gpg_verify(): use gpgv2 not gpg2 --verify

Signed-off-by: Brian Inglis <Brian.Inglis@SystematicSW.ab.ca>
---
 lib/src_prep.cygpart |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/lib/src_prep.cygpart	2024-01-15 05:09:23.000000000 -0700
+++ b/lib/src_prep.cygpart	2024-04-30 01:49:54.294030400 -0600
@@ -181,7 +181,7 @@ __gpg_verify() {
 	local _filetype=${2};
 	local _sigext=${3:-sig};
 
-	if ! check_prog gpg2
+	if ! check_prog gpgv2
 	then
 		# display notice only once
 		if ! defined _gpg_not_found_
@@ -196,7 +196,7 @@ __gpg_verify() {
 	if [ -f ${_file}.${_sigext} ]
 	then
 		inform "${_filetype} signature follows:";
-		gpg2 --verify ${_file}.${_sigext} ${_file} || true;
+		gpgv2 ${_file}.${_sigext} ${_file} || true;
 	fi
 }
 

Re: [PATCH] cygport/lib/src_prep.cygpart: use gpgv2 not gpg2 --verify

[ASSI]

Brian Inglis via Cygwin-apps writes:
> Utility gpgv2 is the gpg2 release of gpgv, a lighter, script friendly,
> single operation gpg verification helper designed for use in scripts
> instead of gpg2 --verify: see 'info gpg2 helper gpgv'

NAK.  This tool doesn't check for expired keys and also searches for
keys in different places, so you'd have to change your setup.  More
specifically you'd either have to explicitly trust all keys you want to
check (not going to happen) or use a "--keyring" argument to force it to
use the pubring.

(I've used an old key file for Cygwin in the following for
demonstration, the current key is not expired obviously.)

--8<---------------cut here---------------start------------->8---
~> gpg2 --verify cygwin/setup64.zst{.sig,}
gpg: Signature made So 07 Apr 2024 16:30:47 CEST
gpg:                using RSA key 56405CF6FCC81574682A5D561A698DE9E2E56300
gpg: Good signature from "Cygwin <cygwin@cygwin.com>" [expired]
gpg: Note: This key has expired!
Primary key fingerprint: 5640 5CF6 FCC8 1574 682A  5D56 1A69 8DE9 E2E5 6300
~> gpgv2 cygwin/setup64.zst{.sig,}
gpgv: unknown type of key resource 'trustedkeys.kbx'
gpgv: keyblock resource '/home/gratz/.gnupg/trustedkeys.kbx': General error
gpgv: Signature made So 07 Apr 2024 16:30:47 CEST
gpgv:                using RSA key 56405CF6FCC81574682A5D561A698DE9E2E56300
gpgv: Can't check signature: No public key
~> gpgv2 --keyring .gnupg/pubring.gpg cygwin/setup64.zst{.sig,}
gpgv: Signature made So 07 Apr 2024 16:30:47 CEST
gpgv:                using RSA key 56405CF6FCC81574682A5D561A698DE9E2E56300
gpgv: Good signature from "Cygwin <cygwin@cygwin.com>"
--8<---------------cut here---------------end--------------->8---


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

SD adaptations for Waldorf Q V3.00R3 and Q+ V3.54R2:
http://Synth.Stromeko.net/Downloads.html#WaldorfSDada

Re: [PATCH] cygport/lib/src_prep.cygpart: use gpgv2 not gpg2 --verify

[Brian Inglis]

On 2024-04-30 23:50, ASSI via Cygwin-apps wrote:
> Brian Inglis via Cygwin-apps writes:
>> Utility gpgv2 is the gpg2 release of gpgv, a lighter, script friendly,
>> single operation gpg verification helper designed for use in scripts
>> instead of gpg2 --verify: see 'info gpg2 helper gpgv'
> 
> NAK. This tool doesn't check for expired keys and also searches for
> keys in different places, so you'd have to change your setup.  More
> specifically you'd either have to explicitly trust all keys you want to
> check (not going to happen) or use a "--keyring" argument to force it to
> use the pubring.

Questioning FMI but not disagreeing with your decision ;^>

Not seeing any key issues as my pubring.gpg is symlinked as trustedkeys.gpg?

Although scallywag runs can not even check keys, so what can we do about that?

2024-04-28T21:41:01.4042065Z >>> Preparing ncurses-6.5+20240427-1.x86_64
2024-04-28T21:41:01.4235798Z *** Info: SOURCE 1 signature follows:
2024-04-28T21:41:01.4407160Z gpg: directory '/home/runneradmin/.gnupg' created
2024-04-28T21:41:01.4508023Z gpg: keybox '/home/runneradmin/.gnupg/pubring.kbx' 
created
2024-04-28T21:41:01.4775748Z gpg: Signature made Sat, Apr 27, 2024  8:27:29 PM UTC
2024-04-28T21:41:01.4776513Z gpg:                using RSA key 
19882D92DDA4C400C22C0D56CC2AF4472167BE03
2024-04-28T21:41:01.4784503Z gpg: Can't check signature: No public key

Other advantage is not seeing Eric Blake and others' pictures pop up ;^>

I tested with all my cached signed upstream package downloads and compared the 
logs from gpg2 --verify and gpgv2, so what benefit is reporting trust level 
"[unknown]" and expired keys from cygport, and what are you meant to do about 
expired keys for upstream package signers?

[While checking also came across keys from 1998 with my dialup email address!]

-- 
Take care. Thanks, Brian Inglis              Calgary, Alberta, Canada

La perfection est atteinte                   Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter  not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer     but when there is no more to cut
                                 -- Antoine de Saint-Exupéry