Arch Linux keyring can't be assumed installed

[Foxboron]

@coderobe

We should fetch the keyring, or have a list of keys we need somewhere so we can recv them.

[coderobe]

Should be easy, https://github.com/Foxboron/archlinux-repro/blob/3976ebc2da1475677495767d13a98b7a677ff422/buildinfo#L106 is the only usage i think?

Is the keyring alone available directly anywhere?

[kpcyrd]

@coderobe invoking gpg like that is exploitable, it may return success without actually verifying ${filename}. iirc the filename needs to be specified in argv explicitly to force verification of a detached signature.

[coderobe]

yeah, you're right - though we're only downloading from our archive anyways. https://github.com/Foxboron/archlinux-repro/blob/3976ebc2da1475677495767d13a98b7a677ff422/buildinfo#L70 patches welcome!

[Foxboron]

Fixed with 1dc31a5