Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixpkgs
base: e3926c8043cf
Choose a base ref
...
head repository: NixOS/nixpkgs
compare: fd593be44b29
Choose a head ref
  • 3 commits
  • 1 file changed
  • 1 contributor

Commits on Jun 30, 2019

  1. gnupg: change default keyserver to non-SKS 

    See https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f.

The SKS network is vulnerable to certificate poisoning, which can
destroy GnuPG installations. keys.openpgp.org is a new non-SKS keyserver
that is resistant to this type of attack.

With such an attack being possible, it is unsafe to use SKS keyservers
for almost anything, and so we should protect our users from a now
unsafe default. keys.openpgp.org offers some (but not all) functionality
of SKS, and is better than nothing.

This default is only present in gnupg22. gnupg20 and gnupg1orig are not
affected.
    @alyssais
    alyssais committed Jun 30, 2019
    Copy the full SHA
    c727083 View commit details
    Browse the repository at this point in the history

  2. gnupg: apply default server CA verification patch 

    See discussion at
#63952 (comment).

Upstream commit:

commit 1c9cc97e9d47d73763810dcb4a36b6cdf31a2254
Author: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
Date:   Sun Jun 30 11:54:35 2019 -0400

    dirmngr: Only use SKS pool CA for SKS pool

    * dirmngr/http.c (http_session_new): when checking whether the
    keyserver is the HKPS pool, check specifically against the pool name,
    as ./configure might have been used to select a different default
    keyserver.  It makes no sense to apply Kristian's certificate
    authority to anything other than the literal host
    hkps.pool.sks-keyservers.net.

    Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
    GnuPG-Bug-Id: 4593
    @alyssais
    alyssais committed Jun 30, 2019
    Copy the full SHA
    ba23c14 View commit details
    Browse the repository at this point in the history

  3. Merge pull request #63952 from alyssais/gnupg-sks 

    gnupg: change default keyserver to non-SKS
    @alyssais
    alyssais committed Jun 30, 2019
    Copy the full SHA
    fd593be View commit details
    Browse the repository at this point in the history