From debbugs-submit-bounces@debbugs.gnu.org Wed Dec 30 21:20:41 2015 Received: (at submit) by debbugs.gnu.org; 31 Dec 2015 02:20:41 +0000 Received: from localhost ([127.0.0.1]:50782 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aESr3-0001eL-1L for submit@debbugs.gnu.org; Wed, 30 Dec 2015 21:20:41 -0500 Received: from eggs.gnu.org ([208.118.235.92]:35194) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aEQxX-0006tb-9D for submit@debbugs.gnu.org; Wed, 30 Dec 2015 19:19:15 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aEQxR-00022v-3l for submit@debbugs.gnu.org; Wed, 30 Dec 2015 19:19:09 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: * X-Spam-Status: No, score=1.1 required=5.0 tests=BAYES_50, FREEMAIL_ENVFROM_END_DIGIT,FREEMAIL_FROM,HTML_MESSAGE,T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:41794) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aEQxR-00022o-06 for submit@debbugs.gnu.org; Wed, 30 Dec 2015 19:19:09 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54379) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aEQxP-0000yS-Pc for bug-guix@gnu.org; Wed, 30 Dec 2015 19:19:08 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aEQxO-000211-Gu for bug-guix@gnu.org; Wed, 30 Dec 2015 19:19:07 -0500 Received: from mail-ig0-x236.google.com ([2607:f8b0:4001:c05::236]:37764) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aEQxO-00020R-BS for bug-guix@gnu.org; Wed, 30 Dec 2015 19:19:06 -0500 Received: by mail-ig0-x236.google.com with SMTP id to18so174617842igc.0 for ; Wed, 30 Dec 2015 16:19:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to:content-type; bh=mXSjoZP6tD5rRCQvX013ROxyBf8t4rjuYMepgi78lRU=; b=HzKHGHdmQ3FmzmthYlxqJhDMMLiXdAzohZq8U15zZbQZlhfYQ+Zq/wxDeq8EeLHhRP T3ELKMxmNRHN16mLAzbSlMxzLk9FFacx4qTrd59cBHaVBNIDobE86O1HVeZYMrFzWreA ByJiTbTDnA63RmEGuYmC5WLX/ZMTUUF2wlxr35oYcuoXjgI/nagTHDoaQwnv9TBb3a2q v/N7k363DT+T5+XnSSjfI2TtEZG1zQt3V+Yx4FESn/MzPbk5df4XOtQ2JlJ4efuxn7AM aHVVgXGQsqWkoIjThL8j5nE6jBjR11UFKY80E80keiQ0stCZlv74lUI6JrFg1EGqddQN TJkQ== MIME-Version: 1.0 X-Received: by 10.50.143.10 with SMTP id sa10mr45407094igb.77.1451521145513; Wed, 30 Dec 2015 16:19:05 -0800 (PST) Received: by 10.36.208.22 with HTTP; Wed, 30 Dec 2015 16:19:05 -0800 (PST) Date: Wed, 30 Dec 2015 16:19:05 -0800 Message-ID: Subject: .sig From: carl hansen To: bug-guix@gnu.org Content-Type: multipart/alternative; boundary=001a1135fe9a432bae0528269a2b X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -3.8 (---) X-Debbugs-Envelope-To: submit X-Mailman-Approved-At: Wed, 30 Dec 2015 21:20:40 -0500 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.8 (---) --001a1135fe9a432bae0528269a2b Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Manual says: - "Download the binary tarball from =E2=80=98ftp://....=E2=80=992 ,Footnotes(2) "As usual, make sure to download the associated .sig file and to verify the authenticity of the tarball against it!" For those who know what you mean by that, the footnote is superfluous, for those who don't know, it is opaque. I do the usual investigation, come up with gpg --verify guix-binary-0.9.0.x86_64-linux.tar.xz.sig gpg: armor header: Version: GnuPG v2 gpg: assuming signed data in `guix-binary-0.9.0.x86_64-linux.tar.xz' gpg: Signature made Wed 04 Nov 2015 10:23:38 AM PST using RSA key ID 3D9AEBB5 gpg: Can't check signature: public key not found after reading the gpg man page, with its multivarous options. So now I need "gpg --import *.asc" is how you import it into the public keyring But now I have to find the .asc file... **UNIX, world's largest Adventure game** as we used to say 30 years ago. Is there some reason the actual command line to verify the sig cannot be put into the manual? --001a1135fe9a432bae0528269a2b Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Manual says:
  • "Download the binary tarball fro= m =E2=80=98ftp://....=E2=80=99<= sup>2,

    • Footnotes

    (2)

    "As usual, make sure to download the associated .sig file and to verify the authenticity of the tarball against it!"

    For those wh= o know what you mean by that, the footnote is superfluous, for those who do= n't know, it is opaque. I do the usual investigation, come up with

    <= p>gpg --verify guix-binary-0.9.0.x86_64-linux.tar.xz.sig
    gpg: armor head= er: Version: GnuPG v2
    gpg: assuming signed data in `guix-binary-0.9.0.x8= 6_64-linux.tar.xz'
    gpg: Signature made Wed 04 Nov 2015 10:23:38 AM P= ST using RSA key ID 3D9AEBB5
    gpg: Can't check signature: public key = not found

    after reading the gpg man page, with its multivarous op= tions. So now I need

    "gpg --import *.asc" is how you import= it into the public keyring

    But now I have to find the .asc file...

    **UNIX, world's largest Adventure game** as we used to say 30 year= s ago.

    Is there some reason the actual command line to verify the sig= cannot be put into the manual?




    --001a1135fe9a432bae0528269a2b-- From debbugs-submit-bounces@debbugs.gnu.org Fri Jan 01 20:40:16 2016 Received: (at 22276) by debbugs.gnu.org; 2 Jan 2016 01:40:16 +0000 Received: from localhost ([127.0.0.1]:34065 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aFBAx-0006Ag-CI for submit@debbugs.gnu.org; Fri, 01 Jan 2016 20:40:16 -0500 Received: from eggs.gnu.org ([208.118.235.92]:33965) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aFBAq-00068D-NO for 22276@debbugs.gnu.org; Fri, 01 Jan 2016 20:40:05 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aF448-0006F3-Rk for 22276@debbugs.gnu.org; Fri, 01 Jan 2016 13:04:45 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:34080) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aF448-0006Ey-OR; Fri, 01 Jan 2016 13:04:40 -0500 Received: from reverse-83.fdn.fr ([80.67.176.83]:38092 helo=pluto) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1aF448-0008Tv-5t; Fri, 01 Jan 2016 13:04:40 -0500 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) To: carl hansen Subject: Re: bug#22276: .sig References: X-URL: http://www.fdn.fr/~lcourtes/ X-Revolutionary-Date: 12 =?utf-8?Q?Niv=C3=B4se?= an 224 de la =?utf-8?Q?R?= =?utf-8?Q?=C3=A9volution?= X-PGP-Key-ID: 0x3D9AEBB5 X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5 X-OS: x86_64-unknown-linux-gnu Date: Fri, 01 Jan 2016 19:04:38 +0100 In-Reply-To: (carl hansen's message of "Wed, 30 Dec 2015 16:19:05 -0800") Message-ID: <874mexi3bd.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: 22276 Cc: 22276@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) Hi, I=E2=80=99ve amended that section of the manual based on text from the announcement (see ). Step 1 becomes: --8<---------------cut here---------------start------------->8--- 1. Download the binary tarball from =E2=80=98ftp://alpha.gnu.org/gnu/guix/guix-binary-0.9.0.SYSTEM.tar.xz= =E2=80=99, where SYSTEM is =E2=80=98x86_64-linux=E2=80=99 for an =E2=80=98x86_64= =E2=80=99 machine already running the kernel Linux, and so on. Make sure to download the associated =E2=80=98.sig=E2=80=99 file and t= o verify the authenticity of the tarball against it, along these lines: $ wget ftp://alpha.gnu.org/gnu/guix/guix-binary-0.9.0.SYSTEM.tar.= xz.sig $ gpg --verify guix-binary-0.9.0.SYSTEM.tar.xz.sig If that command fails because you don=E2=80=99t have the required publ= ic key, then run this command to import it: $ gpg --keyserver keys.gnupg.net --recv-keys 3D9AEBB5 and rerun the =E2=80=98gpg --verify=E2=80=99 command. --8<---------------cut here---------------end--------------->8--- Thanks for your feedback! Ludo=E2=80=99. From debbugs-submit-bounces@debbugs.gnu.org Fri Jan 01 20:40:11 2016 Received: (at request) by debbugs.gnu.org; 2 Jan 2016 01:40:11 +0000 Received: from localhost ([127.0.0.1]:34063 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aFBAx-0006AZ-5W for submit@debbugs.gnu.org; Fri, 01 Jan 2016 20:40:11 -0500 Received: from eggs.gnu.org ([208.118.235.92]:33965) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aFBAq-00068D-Ej for request@debbugs.gnu.org; Fri, 01 Jan 2016 20:40:04 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aF44S-0006Vl-DD for request@debbugs.gnu.org; Fri, 01 Jan 2016 13:05:05 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:34099) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aF44S-0006Vb-9j for request@debbugs.gnu.org; Fri, 01 Jan 2016 13:05:00 -0500 Received: from reverse-83.fdn.fr ([80.67.176.83]:38094 helo=pluto) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1aF44R-00007q-Mu for request@debbugs.gnu.org; Fri, 01 Jan 2016 13:05:00 -0500 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) To: request@debbugs.gnu.org Subject: close X-URL: http://www.fdn.fr/~lcourtes/ X-Revolutionary-Date: 12 =?utf-8?Q?Niv=C3=B4se?= an 224 de la =?utf-8?Q?R?= =?utf-8?Q?=C3=A9volution?= X-PGP-Key-ID: 0x3D9AEBB5 X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5 X-OS: x86_64-unknown-linux-gnu Date: Fri, 01 Jan 2016 19:04:58 +0100 Message-ID: <87ziwpgoqd.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: request X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) close 22276 thanks From debbugs-submit-bounces@debbugs.gnu.org Fri Jan 01 20:40:16 2016 Received: (at request) by debbugs.gnu.org; 2 Jan 2016 01:40:16 +0000 Received: from localhost ([127.0.0.1]:34083 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aFBB2-0006Ar-34 for submit@debbugs.gnu.org; Fri, 01 Jan 2016 20:40:16 -0500 Received: from eggs.gnu.org ([208.118.235.92]:33965) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aFBAr-00068D-8t for request@debbugs.gnu.org; Fri, 01 Jan 2016 20:40:05 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aF42q-0005tu-E2 for request@debbugs.gnu.org; Fri, 01 Jan 2016 13:03:25 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:34040) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aF42q-0005tl-Ay for request@debbugs.gnu.org; Fri, 01 Jan 2016 13:03:20 -0500 Received: from reverse-83.fdn.fr ([80.67.176.83]:38090 helo=pluto) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1aF42l-0006ac-PV for request@debbugs.gnu.org; Fri, 01 Jan 2016 13:03:16 -0500 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) To: request@debbugs.gnu.org Subject: retitle X-URL: http://www.fdn.fr/~lcourtes/ X-Revolutionary-Date: 12 =?utf-8?Q?Niv=C3=B4se?= an 224 de la =?utf-8?Q?R?= =?utf-8?Q?=C3=A9volution?= X-PGP-Key-ID: 0x3D9AEBB5 X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5 X-OS: x86_64-unknown-linux-gnu Date: Fri, 01 Jan 2016 19:03:13 +0100 Message-ID: <87bn95i3dq.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: request X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) retitle 22276 Instructions to verify tarball signature are insufficient thanks From debbugs-submit-bounces@debbugs.gnu.org Sun Jan 03 04:20:47 2016 Received: (at 22276) by debbugs.gnu.org; 3 Jan 2016 09:20:47 +0000 Received: from localhost ([127.0.0.1]:35823 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aFeqB-0005xG-ER for submit@debbugs.gnu.org; Sun, 03 Jan 2016 04:20:47 -0500 Received: from mail-lb0-f179.google.com ([209.85.217.179]:33502) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aFeqA-0005x4-6x for 22276@debbugs.gnu.org; Sun, 03 Jan 2016 04:20:42 -0500 Received: by mail-lb0-f179.google.com with SMTP id sv6so139551444lbb.0 for <22276@debbugs.gnu.org>; Sun, 03 Jan 2016 01:20:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:references:date:in-reply-to:message-id :user-agent:mime-version:content-type:content-transfer-encoding; bh=sft/l3R7VNyQcuuQtoIs9PRB3OqyWtrk4m2VwUugDP8=; b=yLSqhHAVYYVF9YqY3LmCv8CprJPhyWPVTVAROL6SW109i/7bdxBJjIrYIWRAQgQti4 jv7G4eah8HZkHIc8jqOrm+eWRj7bihkzP3Cxn4pH/j08yC7kLRZf8soWD6+cUgjYBtt6 nUNImMpd/khIw9Gj30JoaipaUee4h6Vu8DgEHqjwimv/nLE+88XggHq4mef5r8/96WAy zuyBhkq0E07lljuJDQicuafdwGENuUNpo23JEQUO69eqrbq9/6Nz12doogkjROOX7tnw zhSj3X3Lb0RrEp8ylCb7MXNARfk3zhgdkWQWEb9oZTxL0hPtIGL9LjpJWP9yygYkMlDF 5QYg== X-Received: by 10.112.132.6 with SMTP id oq6mr20847769lbb.38.1451812836201; Sun, 03 Jan 2016 01:20:36 -0800 (PST) Received: from leviafan ([217.107.192.146]) by smtp.gmail.com with ESMTPSA id re5sm14617392lbb.22.2016.01.03.01.20.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 03 Jan 2016 01:20:35 -0800 (PST) From: Alex Kost To: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: bug#22276: .sig References: <874mexi3bd.fsf@gnu.org> Date: Sun, 03 Jan 2016 12:20:35 +0300 In-Reply-To: <874mexi3bd.fsf@gnu.org> ("Ludovic \=\?utf-8\?Q\?Court\=C3\=A8s\=22'\?\= \=\?utf-8\?Q\?s\?\= message of "Fri, 01 Jan 2016 19:04:38 +0100") Message-ID: <87d1tjxbmk.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 22276 Cc: carl hansen , 22276@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) Ludovic Court=C3=A8s (2016-01-01 21:04 +0300) wrote: > I=E2=80=99ve amended that section of the manual based on text from the > announcement (see > ). > Step 1 becomes: > > > 1. Download the binary tarball from > =E2=80=98ftp://alpha.gnu.org/gnu/guix/guix-binary-0.9.0.SYSTEM.tar.x= z=E2=80=99, > where SYSTEM is =E2=80=98x86_64-linux=E2=80=99 for an =E2=80=98x86_6= 4=E2=80=99 machine already > running the kernel Linux, and so on. > > Make sure to download the associated =E2=80=98.sig=E2=80=99 file and= to verify the > authenticity of the tarball against it, along these lines: > > $ wget ftp://alpha.gnu.org/gnu/guix/guix-binary-0.9.0.SYSTEM.ta= r.xz.sig > $ gpg --verify guix-binary-0.9.0.SYSTEM.tar.xz.sig > > If that command fails because you don=E2=80=99t have the required pu= blic > key, then run this command to import it: > > $ gpg --keyserver keys.gnupg.net --recv-keys 3D9AEBB5 Being a lazy user, my first question is: =C2=ABWhat is this "3D9AEBB5" thin= g? Hm, apparently it is some key, but what key? where did it come from? is it from gnu.org or what? maybe it is for "keys.gnupg.net" server? OK, I should read gpg manual to find it out=E2=80=A6 but I won't=C2=BB. And then= I will not check the signature because I trust the tarball from "gnu.org" but I don't trust a thing that I don't understand. (I talk only for myself, I think other people are more conscious users) I think it will be also good to explain what "3D9AEBB5" means. --=20 Alex From debbugs-submit-bounces@debbugs.gnu.org Sun Jan 03 06:11:09 2016 Received: (at 22276) by debbugs.gnu.org; 3 Jan 2016 11:11:09 +0000 Received: from localhost ([127.0.0.1]:35854 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aFgYy-0001q6-PD for submit@debbugs.gnu.org; Sun, 03 Jan 2016 06:11:09 -0500 Received: from eggs.gnu.org ([208.118.235.92]:39415) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aFgYw-0001pc-W7 for 22276@debbugs.gnu.org; Sun, 03 Jan 2016 06:11:03 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aFgYn-0002B8-GC for 22276@debbugs.gnu.org; Sun, 03 Jan 2016 06:10:57 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=BAYES_40,RP_MATCHES_RCVD autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:38525) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aFgYn-0002Ax-DR; Sun, 03 Jan 2016 06:10:53 -0500 Received: from reverse-83.fdn.fr ([80.67.176.83]:34608 helo=pluto) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1aFgYm-0004d8-Lp; Sun, 03 Jan 2016 06:10:53 -0500 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) To: Alex Kost Subject: Re: bug#22276: .sig References: <874mexi3bd.fsf@gnu.org> <87d1tjxbmk.fsf@gmail.com> X-URL: http://www.fdn.fr/~lcourtes/ X-Revolutionary-Date: 14 =?utf-8?Q?Niv=C3=B4se?= an 224 de la =?utf-8?Q?R?= =?utf-8?Q?=C3=A9volution?= X-PGP-Key-ID: 0x3D9AEBB5 X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5 X-OS: x86_64-unknown-linux-gnu Date: Sun, 03 Jan 2016 12:10:50 +0100 In-Reply-To: <87d1tjxbmk.fsf@gmail.com> (Alex Kost's message of "Sun, 03 Jan 2016 12:20:35 +0300") Message-ID: <874meuyl39.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: 22276 Cc: carl hansen , 22276@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) Alex Kost skribis: > Ludovic Court=C3=A8s (2016-01-01 21:04 +0300) wrote: > >> I=E2=80=99ve amended that section of the manual based on text from the >> announcement (see >> ). >> Step 1 becomes: >> >> >> 1. Download the binary tarball from >> =E2=80=98ftp://alpha.gnu.org/gnu/guix/guix-binary-0.9.0.SYSTEM.tar.= xz=E2=80=99, >> where SYSTEM is =E2=80=98x86_64-linux=E2=80=99 for an =E2=80=98x86_= 64=E2=80=99 machine already >> running the kernel Linux, and so on. >> >> Make sure to download the associated =E2=80=98.sig=E2=80=99 file an= d to verify the >> authenticity of the tarball against it, along these lines: >> >> $ wget ftp://alpha.gnu.org/gnu/guix/guix-binary-0.9.0.SYSTEM.t= ar.xz.sig >> $ gpg --verify guix-binary-0.9.0.SYSTEM.tar.xz.sig >> >> If that command fails because you don=E2=80=99t have the required p= ublic >> key, then run this command to import it: >> >> $ gpg --keyserver keys.gnupg.net --recv-keys 3D9AEBB5 > > Being a lazy user, my first question is: =C2=ABWhat is this "3D9AEBB5" th= ing? I would expect that the command together with the previous sentence suggest that 3D9AEBB5 identifies the key used to sign the package, no? > Hm, apparently it is some key, but what key? where did it come from? is > it from gnu.org or what? maybe it is for "keys.gnupg.net" server? OK, I > should read gpg manual to find it out=E2=80=A6 but I won't=C2=BB. And th= en I will > not check the signature because I trust the tarball from "gnu.org" but I > don't trust a thing that I don't understand. (I talk only for myself, > I think other people are more conscious users) > > I think it will be also good to explain what "3D9AEBB5" means. I would prefer to refer to a more complete document such as the GNU Privacy Handbook, but I don=E2=80=99t know what its current status is: https://www.gnupg.org/gph/en/manual.html#AEN136 Ludo=E2=80=99. From debbugs-submit-bounces@debbugs.gnu.org Sun Jan 03 06:22:55 2016 Received: (at 22276) by debbugs.gnu.org; 3 Jan 2016 11:22:55 +0000 Received: from localhost ([127.0.0.1]:35867 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aFgkR-00029L-1W for submit@debbugs.gnu.org; Sun, 03 Jan 2016 06:22:55 -0500 Received: from eggs.gnu.org ([208.118.235.92]:41570) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aFgkP-000296-If for 22276@debbugs.gnu.org; Sun, 03 Jan 2016 06:22:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aFgkG-0004hK-Gc for 22276@debbugs.gnu.org; Sun, 03 Jan 2016 06:22:48 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:38657) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aFgkG-0004hG-Dn; Sun, 03 Jan 2016 06:22:44 -0500 Received: from reverse-83.fdn.fr ([80.67.176.83]:34826 helo=pluto) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1aFgkF-0000qg-Oa; Sun, 03 Jan 2016 06:22:44 -0500 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) To: Alex Kost Subject: Re: bug#22276: .sig References: <874mexi3bd.fsf@gnu.org> <87d1tjxbmk.fsf@gmail.com> X-URL: http://www.fdn.fr/~lcourtes/ X-Revolutionary-Date: 14 =?utf-8?Q?Niv=C3=B4se?= an 224 de la =?utf-8?Q?R?= =?utf-8?Q?=C3=A9volution?= X-PGP-Key-ID: 0x3D9AEBB5 X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5 X-OS: x86_64-unknown-linux-gnu Date: Sun, 03 Jan 2016 12:22:41 +0100 In-Reply-To: <87d1tjxbmk.fsf@gmail.com> (Alex Kost's message of "Sun, 03 Jan 2016 12:20:35 +0300") Message-ID: <87io3ax5z2.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: 22276 Cc: carl hansen , 22276@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) Seems that the GPH repository given at is now unreachable: --8<---------------cut here---------------start------------->8--- $ cvs -z3 -d :pserver:anoncvs@cvs.gnupg.org:/cvs/gph co gph cvs [checkout aborted]: connect to cvs.gnupg.org(217.69.76.56):2401 failed:= Connection refused --8<---------------cut here---------------end--------------->8--- Incidentally, it=E2=80=99s DocBook, not Texinfo, so not convenient to refer= to. We could refer to the GnuPG manual, but it=E2=80=99s very much a reference manual and doesn=E2=80=99t introduce OpenPGP concepts. It sounds like fixing this documentation issue is beyond the scope of Guix; on possible fix would be to revive the GPH, possibly converting it to Texinfo and integrating it into GnuPG itself. Thoughts? Ludo=E2=80=99. From debbugs-submit-bounces@debbugs.gnu.org Mon Jan 04 04:43:07 2016 Received: (at 22276) by debbugs.gnu.org; 4 Jan 2016 09:43:07 +0000 Received: from localhost ([127.0.0.1]:37109 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aG1fL-0001s2-5F for submit@debbugs.gnu.org; Mon, 04 Jan 2016 04:43:07 -0500 Received: from mail-lb0-f181.google.com ([209.85.217.181]:33754) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aG1fJ-0001rV-Ch for 22276@debbugs.gnu.org; Mon, 04 Jan 2016 04:43:01 -0500 Received: by mail-lb0-f181.google.com with SMTP id sv6so148321975lbb.0 for <22276@debbugs.gnu.org>; Mon, 04 Jan 2016 01:43:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:references:date:in-reply-to:message-id :user-agent:mime-version:content-type:content-transfer-encoding; bh=dJJ1wSFlLOJbJ9SK8zZ81OOQR7yKxjfR8McFAWJF4Fo=; b=OOGvnr8BZZcaE5IkHhaQd0hprpjKb4SbVPAiLH4Mb3896CLcehvIRbHJw/gE4cgNwL 0zubmyORfCXvJioXBKOQ29rnXbGOQ7Ipb1s7ldnPODwyRzNUdrAfxwqEVIvKaWoK8pYG vMiD8FyQ9n7PPfl1JW7bO7+04CzIJe7tq54TtAp2rmop00CsuzLnuhYzWD31dBFNuzz3 /Xf1K/CGzOroCX+4VWlOBghWLBz3GQpyWAqB7OXpfmzlbPpigav2zrTDs6dYJ6zH7/uO 6MV1d4Qj1gDrtrH78rVUpkXqO0gyWj81W9mIr5vbB0i7GwzIqTnImiwd25W00CZEXwdQ KtPw== X-Received: by 10.112.63.130 with SMTP id g2mr25383876lbs.28.1451900575375; Mon, 04 Jan 2016 01:42:55 -0800 (PST) Received: from leviafan ([217.107.192.146]) by smtp.gmail.com with ESMTPSA id jx8sm5879431lbc.29.2016.01.04.01.42.54 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 04 Jan 2016 01:42:54 -0800 (PST) From: Alex Kost To: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: bug#22276: .sig References: <874mexi3bd.fsf@gnu.org> <87d1tjxbmk.fsf@gmail.com> <874meuyl39.fsf@gnu.org> Date: Mon, 04 Jan 2016 12:42:54 +0300 In-Reply-To: <874meuyl39.fsf@gnu.org> ("Ludovic \=\?utf-8\?Q\?Court\=C3\=A8s\=22'\?\= \=\?utf-8\?Q\?s\?\= message of "Sun, 03 Jan 2016 12:10:50 +0100") Message-ID: <87si2dwuht.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 22276 Cc: carl hansen , 22276@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) Ludovic Court=C3=A8s (2016-01-03 14:10 +0300) wrote: > Alex Kost skribis: > >> Ludovic Court=C3=A8s (2016-01-01 21:04 +0300) wrote: >> >>> I=E2=80=99ve amended that section of the manual based on text from the >>> announcement (see >>> ). >>> Step 1 becomes: >>> >>> >>> 1. Download the binary tarball from >>> =E2=80=98ftp://alpha.gnu.org/gnu/guix/guix-binary-0.9.0.SYSTEM.tar= .xz=E2=80=99, >>> where SYSTEM is =E2=80=98x86_64-linux=E2=80=99 for an =E2=80=98x86= _64=E2=80=99 machine already >>> running the kernel Linux, and so on. >>> >>> Make sure to download the associated =E2=80=98.sig=E2=80=99 file a= nd to verify the >>> authenticity of the tarball against it, along these lines: >>> >>> $ wget ftp://alpha.gnu.org/gnu/guix/guix-binary-0.9.0.SYSTEM.= tar.xz.sig >>> $ gpg --verify guix-binary-0.9.0.SYSTEM.tar.xz.sig >>> >>> If that command fails because you don=E2=80=99t have the required = public >>> key, then run this command to import it: >>> >>> $ gpg --keyserver keys.gnupg.net --recv-keys 3D9AEBB5 >> >> Being a lazy user, my first question is: =C2=ABWhat is this "3D9AEBB5" t= hing? > > I would expect that the command together with the previous sentence > suggest that 3D9AEBB5 identifies the key used to sign the package, no? Hm, not for me. But obviously my problem comes from the fact that I know nothing about encryption, security, signatures, etc. And as a total noob I trust binaries from "gnu.org" more than the scaring "3D9AEBB5" thing just because I don't understand it. >> Hm, apparently it is some key, but what key? where did it come from? is >> it from gnu.org or what? maybe it is for "keys.gnupg.net" server? OK, I >> should read gpg manual to find it out=E2=80=A6 but I won't=C2=BB. And t= hen I will >> not check the signature because I trust the tarball from "gnu.org" but I >> don't trust a thing that I don't understand. (I talk only for myself, >> I think other people are more conscious users) >> >> I think it will be also good to explain what "3D9AEBB5" means. > > I would prefer to refer to a more complete document such as the GNU > Privacy Handbook, but I don=E2=80=99t know what its current status is: > > https://www.gnupg.org/gph/en/manual.html#AEN136 Thanks for the pointer! I hope it will clarify some things for me :-) --=20 Alex From debbugs-submit-bounces@debbugs.gnu.org Mon Jan 04 04:51:07 2016 Received: (at 22276) by debbugs.gnu.org; 4 Jan 2016 09:51:07 +0000 Received: from localhost ([127.0.0.1]:37131 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aG1n9-000257-GW for submit@debbugs.gnu.org; Mon, 04 Jan 2016 04:51:07 -0500 Received: from mail-lb0-f172.google.com ([209.85.217.172]:35565) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aG1n4-00024K-A3 for 22276@debbugs.gnu.org; Mon, 04 Jan 2016 04:51:02 -0500 Received: by mail-lb0-f172.google.com with SMTP id bc4so155278362lbc.2 for <22276@debbugs.gnu.org>; Mon, 04 Jan 2016 01:51:02 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:references:date:in-reply-to:message-id :user-agent:mime-version:content-type:content-transfer-encoding; bh=VcqyigNZZDIQe1oNsmEvx8MB5Fptord/PUXzjRl54M0=; b=cGKU93HjaqfBPee8pSkgtL9D/0L6NplQWd2L2JNAh2K382hC55BuFxlclXfHlqCBIw gGBEXFWRz+AP7hdFk9JDUYQt1BY5HT6mXSZMzAtshWUMfr4MSimcpTUCbJBQN0B7P0JZ /EplnbZhSu3r+75ucnjC8p9KoZO+CIRCvsr9pVkjDAL1rEpoRiVN/DTqsBR4PXX7unB2 QUzUn1/zIch57aeT3M2Odk9ankFwdO2LeW3QwO7N7SyJ9f7YP3MQQE9hYtCgp2jHqWU4 Yg/aJD8K9C2pozYAPq/ca5TAFE5OTLthVG1p9i/z6aavesw3CEi3Dx7DoTaX5y7+CQHg 4K6w== X-Received: by 10.112.150.102 with SMTP id uh6mr30557732lbb.16.1451901056565; Mon, 04 Jan 2016 01:50:56 -0800 (PST) Received: from leviafan ([217.107.192.146]) by smtp.gmail.com with ESMTPSA id xe8sm5087813lbb.41.2016.01.04.01.50.55 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 04 Jan 2016 01:50:55 -0800 (PST) From: Alex Kost To: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: bug#22276: .sig References: <874mexi3bd.fsf@gnu.org> <87d1tjxbmk.fsf@gmail.com> <87io3ax5z2.fsf@gnu.org> Date: Mon, 04 Jan 2016 12:50:56 +0300 In-Reply-To: <87io3ax5z2.fsf@gnu.org> ("Ludovic \=\?utf-8\?Q\?Court\=C3\=A8s\=22'\?\= \=\?utf-8\?Q\?s\?\= message of "Sun, 03 Jan 2016 12:22:41 +0100") Message-ID: <87lh85wu4f.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -0.7 (/) X-Debbugs-Envelope-To: 22276 Cc: carl hansen , 22276@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) Ludovic Court=C3=A8s (2016-01-03 14:22 +0300) wrote: > Seems that the GPH repository given at > is now unreachable: > > $ cvs -z3 -d :pserver:anoncvs@cvs.gnupg.org:/cvs/gph co gph > cvs [checkout aborted]: connect to cvs.gnupg.org(217.69.76.56):2401 faile= d: Connection refused > > Incidentally, it=E2=80=99s DocBook, not Texinfo, so not convenient to ref= er to. > > We could refer to the GnuPG manual, but it=E2=80=99s very much a reference > manual and doesn=E2=80=99t introduce OpenPGP concepts. Yes, I think a reference to the gpg manual wouldn't help (I didn't find an answer to my question there) > It sounds like fixing this documentation issue is beyond the scope of > Guix; I agree. > on possible fix would be to revive the GPH, possibly converting it > to Texinfo and integrating it into GnuPG itself. It would be great, but I'm not a volunteer :-) --=20 Alex From debbugs-submit-bounces@debbugs.gnu.org Mon Jan 04 05:03:03 2016 Received: (at 22276) by debbugs.gnu.org; 4 Jan 2016 10:03:03 +0000 Received: from localhost ([127.0.0.1]:37139 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aG1yc-0002NC-Ic for submit@debbugs.gnu.org; Mon, 04 Jan 2016 05:03:03 -0500 Received: from eggs.gnu.org ([208.118.235.92]:54769) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aG1yb-0002N1-EK for 22276@debbugs.gnu.org; Mon, 04 Jan 2016 05:02:57 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aG1yS-0006ye-BX for 22276@debbugs.gnu.org; Mon, 04 Jan 2016 05:02:52 -0500 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,RP_MATCHES_RCVD autolearn=disabled version=3.3.2 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:58942) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aG1yS-0006ya-7v; Mon, 04 Jan 2016 05:02:48 -0500 Received: from pluto.bordeaux.inria.fr ([193.50.110.57]:42028 helo=pluto) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.82) (envelope-from ) id 1aG1yR-0003RJ-K9; Mon, 04 Jan 2016 05:02:47 -0500 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) To: Alex Kost Subject: Re: bug#22276: .sig References: <874mexi3bd.fsf@gnu.org> <87d1tjxbmk.fsf@gmail.com> <874meuyl39.fsf@gnu.org> <87si2dwuht.fsf@gmail.com> X-URL: http://www.fdn.fr/~lcourtes/ X-Revolutionary-Date: 15 =?utf-8?Q?Niv=C3=B4se?= an 224 de la =?utf-8?Q?R?= =?utf-8?Q?=C3=A9volution?= X-PGP-Key-ID: 0x3D9AEBB5 X-PGP-Key: http://www.fdn.fr/~lcourtes/ludovic.asc X-PGP-Fingerprint: 3CE4 6455 8A84 FDC6 9DB4 0CFB 090B 1199 3D9A EBB5 X-OS: x86_64-unknown-linux-gnu Date: Mon, 04 Jan 2016 11:02:45 +0100 In-Reply-To: <87si2dwuht.fsf@gmail.com> (Alex Kost's message of "Mon, 04 Jan 2016 12:42:54 +0300") Message-ID: <87y4c5d5mi.fsf@gnu.org> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.5 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 2001:4830:134:3::e X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: 22276 Cc: carl hansen , 22276@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) Alex Kost skribis: > Ludovic Court=C3=A8s (2016-01-03 14:10 +0300) wrote: > >> Alex Kost skribis: >> >>> Ludovic Court=C3=A8s (2016-01-01 21:04 +0300) wrote: >>> >>>> I=E2=80=99ve amended that section of the manual based on text from the >>>> announcement (see >>>> ). >>>> Step 1 becomes: >>>> >>>> >>>> 1. Download the binary tarball from >>>> =E2=80=98ftp://alpha.gnu.org/gnu/guix/guix-binary-0.9.0.SYSTEM.ta= r.xz=E2=80=99, >>>> where SYSTEM is =E2=80=98x86_64-linux=E2=80=99 for an =E2=80=98x8= 6_64=E2=80=99 machine already >>>> running the kernel Linux, and so on. >>>> >>>> Make sure to download the associated =E2=80=98.sig=E2=80=99 file = and to verify the >>>> authenticity of the tarball against it, along these lines: >>>> >>>> $ wget ftp://alpha.gnu.org/gnu/guix/guix-binary-0.9.0.SYSTEM= .tar.xz.sig >>>> $ gpg --verify guix-binary-0.9.0.SYSTEM.tar.xz.sig >>>> >>>> If that command fails because you don=E2=80=99t have the required= public >>>> key, then run this command to import it: >>>> >>>> $ gpg --keyserver keys.gnupg.net --recv-keys 3D9AEBB5 >>> >>> Being a lazy user, my first question is: =C2=ABWhat is this "3D9AEBB5" = thing? >> >> I would expect that the command together with the previous sentence >> suggest that 3D9AEBB5 identifies the key used to sign the package, no? > > Hm, not for me. But obviously my problem comes from the fact that I > know nothing about encryption, security, signatures, etc. And as a > total noob I trust binaries from "gnu.org" more than the scaring > "3D9AEBB5" thing just because I don't understand it. I see. Though be aware that DNS is easily hijacked, that =E2=80=9Cgnu.org= =E2=80=9D can be made to resolve to something else, and that gnu.org=E2=80=99s machines c= ould be compromised with an attacker changing the contents of archives therein, etc. Digital signatures are the mechanism to allow recipients to verify the authenticity and integrity of tarballs. Ludo=E2=80=99. From unknown Mon Jun 23 07:48:57 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Mon, 01 Feb 2016 12:24:04 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator