Add comments to archive keys and acls

  • Open
  • quality assurance status badge
Details
3 participants
  • Hartmut Goebel
  • Leo Famulari
  • Ludovic Courtès
Owner
unassigned
Submitted by
Hartmut Goebel
Severity
wishlist
H
H
Hartmut Goebel wrote on 2 Dec 2016 18:38
(address . bug-guix@gnu.org)
5841B184.4050802@crazy-compilers.com
Hi,

the keys for authenticating an archive currently do not hold any
comment. This makes it hard to track acls and remove certain keys if
required.

Please implement some way to add and change the comment on keys in
/etc/guix/ and in /etc/guix/acl.

Proposed usage when generating the key:
guix archive --generate-key=… --comment "store.example.com"

Proposed usage when importing the key and overwriting any existing comment

guix archive --authorize --comment "store.example.com"

For now, since we have no commands for key management, these would be
enough IMO. Existing commenty an easily be changed in the file, so for
now we do not need a tool for this.

--
Regards
Hartmut Goebel

| Hartmut Goebel | h.goebel@crazy-compilers.com |
| www.crazy-compilers.com | compilers which you thought are impossible |
L
L
Leo Famulari wrote on 2 Dec 2016 19:13
(name . Hartmut Goebel)(address . h.goebel@crazy-compilers.com)(address . 25094@debbugs.gnu.org)
20161202181351.GA30572@jasmine
On Fri, Dec 02, 2016 at 06:38:12PM +0100, Hartmut Goebel wrote:
Toggle quote (6 lines)
> Hi,
>
> the keys for authenticating an archive currently do not hold any
> comment. This makes it hard to track acls and remove certain keys if
> required.

Indeed, this makes key management a little harder than it needs to be.

Toggle quote (14 lines)
> Please implement some way to add and change the comment on keys in
> /etc/guix/ and in /etc/guix/acl.
>
> Proposed usage when generating the key:
> guix archive --generate-key=… --comment "store.example.com"
>
> Proposed usage when importing the key and overwriting any existing comment
>
> guix archive --authorize --comment "store.example.com"
>
> For now, since we have no commands for key management, these would be
> enough IMO. Existing commenty an easily be changed in the file, so for
> now we do not need a tool for this.

I think that the comment should either be signed somehow, or the field
name should be "untrusted-comment".

OpenBSD's signify tool (which we have a port of in Guix) does this:

------
$ cat foo.pub
untrusted comment: Leo's example public key
RWRrY3me0s1DYDBfpcUKZ+ul9m8FgdZfz5+cHjxBabEsvDrjL/ecTeUL
------

Minisign, which is a 3rd party tool compatible with signify, also has
trusted comments:

L
L
Ludovic Courtès wrote on 4 Dec 2016 00:55
(name . Leo Famulari)(address . leo@famulari.name)
87inr08t4h.fsf@gnu.org
Leo Famulari <leo@famulari.name> skribis:

Toggle quote (9 lines)
> On Fri, Dec 02, 2016 at 06:38:12PM +0100, Hartmut Goebel wrote:
>> Hi,
>>
>> the keys for authenticating an archive currently do not hold any
>> comment. This makes it hard to track acls and remove certain keys if
>> required.
>
> Indeed, this makes key management a little harder than it needs to be.

Agreed. The crux of the problem is that libgcrypt’s canonical sexp
parser does not recognize comments.
which may be the reason, but other implementations of canonical sexps
(such as lsh and Nettle) do recognize them, so we should just get
libgcrypt to follow suit.

Toggle quote (17 lines)
>> Please implement some way to add and change the comment on keys in
>> /etc/guix/ and in /etc/guix/acl.
>>
>> Proposed usage when generating the key:
>> guix archive --generate-key=… --comment "store.example.com"
>>
>> Proposed usage when importing the key and overwriting any existing comment
>>
>> guix archive --authorize --comment "store.example.com"
>>
>> For now, since we have no commands for key management, these would be
>> enough IMO. Existing commenty an easily be changed in the file, so for
>> now we do not need a tool for this.
>
> I think that the comment should either be signed somehow, or the field
> name should be "untrusted-comment".

I think it’s no different than the optional comment in OpenSSH public
keys, and it should be clear that it’s free from and untrusted by
definition (the sexp syntax at least makes it clear that it’s a comment,
as opposed to the OpenSSH public key format).

Ludo’.
L
L
Ludovic Courtès wrote on 25 Jan 2017 18:52
control message for bug #25094
(address . control@debbugs.gnu.org)
87mvefvxh4.fsf@gnu.org
severity 25094 wishlist
?
Your comment

Commenting via the web interface is currently disabled.

To comment on this conversation send an email to 25094@debbugs.gnu.org

To respond to this issue using the mumi CLI, first switch to it
mumi current 25094
Then, you may apply the latest patchset in this issue (with sign off)
mumi am -- -s
Or, compose a reply to this issue
mumi compose
Or, send patches to this issue
mumi send-email *.patch