ryan77627/guix
1
0
Fork 0
mirror of https://git.in.rschanz.org/ryan77627/guix.git synced 2024-11-07 15:36:20 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnupg: Honor GnuPG's configuration for the key server.

Browse source 
The previous default "pool.sks-keyservers.net" doesn't seem to work anymore;
besides, users know best.

* guix/gnupg.scm (%openpgp-key-server): Default to #f, meaning not provided.
(gnupg-receive-keys): Make SERVER and KEYRING keyword arguments.  Adjust doc.
Provide the '--keyserver' argument only when %openpgp-key-server is not #f.
(gnupg-verify*): Do not set a default value for SERVER.  Adjust accordingly.
This commit is contained in:
Maxim Cournoyer 2021-11-13 21:43:45 -05:00
parent dcc4028c0e
commit 4c91332cce
No known key found for this signature in database
GPG key ID: 1260E46482E63562
1 changed files with 18 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
guix/gnupg.scm
View file

@ -2,6 +2,7 @@
;;; Copyright © 2010, 2011, 2013, 2014, 2016, 2018, 2019 Ludovic Courtès <ludo@gnu.org> ;;; Copyright © 2010, 2011, 2013, 2014, 2016, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
;;; Copyright © 2013 Nikita Karetnikov <nikita@karetnikov.org> ;;; Copyright © 2013 Nikita Karetnikov <nikita@karetnikov.org>
;;; Copyright © 2020 Tobias Geerinckx-Rice <me@tobias.gr> ;;; Copyright © 2020 Tobias Geerinckx-Rice <me@tobias.gr>
;;; Copyright © 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com>
;;; ;;;
;;; This file is part of GNU Guix. ;;; This file is part of GNU Guix.
;;; ;;;
@ -56,9 +57,9 @@ (define current-keyring
"/gpg/trustedkeys.kbx"))) "/gpg/trustedkeys.kbx")))
(define %openpgp-key-server (define %openpgp-key-server
;; The default key server. Note that keys.gnupg.net appears to be ;; The default key server. It defaults to #f, which causes GnuPG to use the
;; unreliable. ;; one it is configured with.
(make-parameter "pool.sks-keyservers.net")) (make-parameter #f))
;; Regexps for status lines. See file `doc/DETAILS' in GnuPG. ;; Regexps for status lines. See file `doc/DETAILS' in GnuPG.
@ -182,22 +183,26 @@ (define (gnupg-status-missing-key? status)
(_ #f))) (_ #f)))
status)) status))
(define* (gnupg-receive-keys fingerprint/key-id server (define* (gnupg-receive-keys fingerprint/key-id
#:optional (keyring (current-keyring))) #:key server (keyring (current-keyring)))
"Download FINGERPRINT/KEY-ID from SERVER, a key server, and add it to "Download FINGERPRINT/KEY-ID from SERVER if specified, otherwise from
KEYRING." GnuPG's default/configured one. The key is added to KEYRING."
(unless (file-exists? keyring) (unless (file-exists? keyring)
(mkdir-p (dirname keyring)) (mkdir-p (dirname keyring))
(call-with-output-file keyring (const #t))) ;create an empty keybox (call-with-output-file keyring (const #t))) ;create an empty keybox
(zero? (system* (%gpg-command) "--keyserver" server (zero? (apply system*
"--no-default-keyring" "--keyring" keyring `(,(%gpg-command)
"--recv-keys" fingerprint/key-id))) ,@(if server
(list "--keyserver" server)
'())
"--no-default-keyring" "--keyring" ,keyring
"--recv-keys" ,fingerprint/key-id))))
(define* (gnupg-verify* sig file (define* (gnupg-verify* sig file
#:key #:key
(key-download 'interactive) (key-download 'interactive)
(server (%openpgp-key-server)) server
(keyring (current-keyring))) (keyring (current-keyring)))
"Like `gnupg-verify', but try downloading the public key if it's missing. "Like `gnupg-verify', but try downloading the public key if it's missing.
Return two values: 'valid-signature and a fingerprint/name pair upon success, Return two values: 'valid-signature and a fingerprint/name pair upon success,
@ -215,7 +220,7 @@ (define* (gnupg-verify* sig file
(let ((missing (gnupg-status-missing-key? status))) (let ((missing (gnupg-status-missing-key? status)))
(define (download-and-try-again) (define (download-and-try-again)
;; Download the missing key and try again. ;; Download the missing key and try again.
(if (gnupg-receive-keys missing server keyring) (if (gnupg-receive-keys missing #:server server #:keyring keyring)
(match (gnupg-status-good-signature? (match (gnupg-status-good-signature?
(gnupg-verify sig file keyring)) (gnupg-verify sig file keyring))
(#f (#f