Skip to content

Commit

Permalink
Use experimental keyserver hkps://keys.openpgp.org
Browse files Browse the repository at this point in the history
The SKS keyserver network is vulnerable to spam attacks, and these
attacks started to happen. Downloading a spammed key will break GnuPG
installation "in hard to debug ways". To mitigate this problem, switch
to using a new experimental keyserver that is not part of the SKS
network. This server has its own limitations, but it seems to be the way
to go in the future.

For more information about the SKS network attack:
https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f

Fixes #72.
  • Loading branch information
leandro-lucarella-sociomantic committed Sep 3, 2019
1 parent 100c5b3 commit c42696b
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 4 deletions.
2 changes: 1 addition & 1 deletion docker/develdlang
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ apt_add_bintray_repos sociomantic-tsunami/ebtree sociomantic-tsunami/dlang \
dlang-community/apt

# Add extra DMD D-APT repo
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys EBCF975E5BA24D5E
apt-key adv --keyserver hkps://keys.openpgp.org --recv-keys EBCF975E5BA24D5E
# Added manually until D-APT is fixed
#wget http://downloads.sourceforge.net/project/d-apt/files/d-apt.list \
# -O /etc/apt/sources.list.d/d-apt.list
Expand Down
10 changes: 7 additions & 3 deletions docker/util.sh
Original file line number Diff line number Diff line change
Expand Up @@ -70,20 +70,24 @@ apt_update_and_install_base_packages()
# Select extra packages depending on the distro version
case "$dist" in
bionic)
extra_packages="gpg-agent dirmngr"
extra_packages="gpg-agent"
;;
xenial)
extra_packages="gnupg-agent gnupg-curl"
;;
*)
extra_packages=
;;
esac

# We install some basic packages first.
apt -y install apt-transport-https software-properties-common curl $extra_packages
apt -y install apt-transport-https software-properties-common curl dirmngr \
$extra_packages
}

apt_install_bintray_key()
{
apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 379CE192D401AB61
apt-key adv --keyserver hkps://keys.openpgp.org --recv-keys 379CE192D401AB61
}

apt_add_bintray_repos()
Expand Down

0 comments on commit c42696b

Please sign in to comment.