GNU bug report logs - #42048
[PATCH 0/6] Authenticated channels for everyone!

Previous Next

Full log

Message #56 received at 42048 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: zimoun <zimon.toutoune <at> gmail.com>
Cc: 42048 <at> debbugs.gnu.org
Subject: Re: [bug#42048] [PATCH 0/6] Authenticated channels for everyone!
Date: Wed, 01 Jul 2020 14:17:50 +0200

Hi,

zimoun <zimon.toutoune <at> gmail.com> skribis:

> On Thu, 25 Jun 2020 at 23:04, Ludovic Courtès <ludo <at> gnu.org> wrote:
>
>> The most visible effect is that channel introductions are now
>> part of the API and shown by ‘guix describe’.  It becomes a long-term
>> commitment because we want to be able to pass the output of
>> ‘guix describe -C channels’ or /run/current-system/channels.scm
>> to ‘guix pull’ and ‘guix time-machine’ in the future.
>
> How could I test this machinery with "guix time-machine"?

The normal way.  :-)

But of course, the new ‘introduction’ field of <channel> won’t be
recognized by older Guix versions.  In that case, you should use the
output of ‘guix describe -f channels-sans-intro’ as I wrote in the
manual.

>> Contrary to what I initially proposed¹, channel introductions are
>> stripped to the bare minimum: a commit/fingerprint pair (as is
>> currently the case on master, internally).  I figured it doesn’t
>> buy us much to have the commit/fingerprint pair signed; what
>> matters is that users obtain the introduction from a trusted
>> source, and the signature wouldn’t help with that.  I also got
>> rid of the idea of rendering introductions are opaque base64 blobs.
>
> What happens when traveling in time if the key used by the signature has
> been compromised?

In general, when a developer loses control over their key, another
committer should remove it right away form ‘.guix-authorizations’.  (I
did that today following Brett’s message, for example.)

Signatures on past commits can still be verified and everything is fine.
The (guix openpgp) code ignores key expiration and revocation; it “just”
verifies signatures.

> Today, everything is fine, I sign and I do in introduction.  Couple of
> months (or even years) later, my key will be compromised and so I will
> revoke it.  What happens if I do "guix time-machine -C"?

That’s OK.  The keyring is distributed along with the channel still
contains your key, with or without a revocation certificate, but that
doesn’t prevent us from verifying signatures on past commits.  (This is
different from what gpg does.)

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.