Use experimental keyserver hkps://keys.openpgp.org #73
Conversation
leandro-lucarella-sociomantic
requested review from
iain-buclaw-sociomantic and
daniel-motzev-dunnhumby
|
I have no fundamental problems or concerns with this, considering the point we're starting from is a keyserver that's been taken offline. |
|
Adding a commit to fix the build. I don't understand why this is now necessary, as all versions should be pinned, this build should be reproducible. |
leandro-lucarella-sociomantic
force-pushed
the
keyserver
branch
3 times, most recently
from
fde5ccd to
8480bce
Compare
|
Dammit! The build fails because the downloaded keys don't have ID information. This is a known issue with the new keyserver and GPG should be eventually fixed to support this but only a higher entity could know when... |
|
For now I'm more inclined to leave this PR for future reference and only address it if the SKS network starts to be a real problem... The alternative solution would be to just download the keys and host them somewhere as plain text files instead of using a keyserver. |
leandro-lucarella-sociomantic
force-pushed
the
keyserver
branch
from
8480bce to
46d0a85
Compare
The SKS keyserver network is vulnerable to spam attacks, and these attacks started to happen. Downloading a spammed key will break GnuPG installation "in hard to debug ways". To mitigate this problem, switch to using a new experimental keyserver that is not part of the SKS network. This server has its own limitations, but it seems to be the way to go in the future. For more information about the SKS network attack: https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f Fixes sociomantic-tsunami#72.
leandro-lucarella-sociomantic
force-pushed
the
keyserver
branch
from
46d0a85 to
c42696b
Compare
The SKS keyserver network is vulnerable to spam attacks, and these attacks started to happen. Downloading a spammed key will break GnuPG installation "in hard to debug ways". To mitigate this problem, switch to using a new experimental keyserver that is not part of the SKS network. This server has its own limitations, but it seems to be the way to go in the future.
For more information about the SKS network attack:
https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f
Fixes #72.