Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fingerprint verification and apt-key fix in INSTALL.md #4609

Closed
wants to merge 3 commits into from

Conversation

Projects
None yet
3 participants
@anoadragon453
Copy link
Member

commented Feb 11, 2019

Signed-off-by: Juuso "Linda" Lapinlampi linda@lindalap.fi

Juuso "Linda" Lapinlampi added some commits Feb 6, 2019

INSTALL.md: Add repo-key.asc fingerprint verification
For the apt-secure(8) infrastructure, it is critical keys added manually
via apt-key(8) must be verified. In an attempt to not undermine that
security (in an unlikely event the matrix.org server would be
compromised), print the fingerprint of the repository key while
importing it to apt(8)'s keyrings.

It is also implied in apt-key(8) man page that the "add" command should
not be used, but instead keyrings added to the /etc/apt/trusted.gpg.d/
directory.

Add a copy of the fingerprint in the instructions.

Silence curl's output while here, for ease of verification.

Requires GnuPG version 2.1.14 or later. No transitional package (gnupg2)
is required in Debian, since Debian 9 (stretch).
INSTALL.md: Fix apt-key(8) unsupported filetype
It seems like GPG keybox files are unsupported by apt(8) at this time,
so install the ASCII-armored key directly to trust database as is and
fingerprint it.

For future improvement, Matrix.org should ship its own keyring package
per apt-secure(8) recommendations.

@anoadragon453 anoadragon453 requested a review from matrix-org/synapse-core Feb 11, 2019

@codecov-io

This comment has been minimized.

Copy link

commented Feb 11, 2019

Codecov Report

Merging #4609 into develop will increase coverage by <.01%.
The diff coverage is n/a.

@@             Coverage Diff             @@
##           develop    #4609      +/-   ##
===========================================
+ Coverage    75.32%   75.33%   +<.01%     
===========================================
  Files          338      338              
  Lines        34502    34503       +1     
  Branches      5636     5636              
===========================================
+ Hits         25989    25993       +4     
+ Misses        6929     6928       -1     
+ Partials      1584     1582       -2
@richvdh
Copy link
Member

left a comment

This feels overcomplex, and off-putting to first-time users.

You're downloading the keys over https anyway: what is the threat model that requires this much paranoia?

@anoadragon453

This comment has been minimized.

Copy link
Member Author

commented Feb 12, 2019

Closed at Linda's request.

@anoadragon453 anoadragon453 deleted the anoa/linda_install_fixes branch Feb 12, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.