diff options
author | Nicolás Reynolds <fauno@endefensadelsl.org> | 2014-06-03 14:28:31 -0300 |
---|---|---|
committer | Nicolás Reynolds <fauno@endefensadelsl.org> | 2014-06-03 14:28:31 -0300 |
commit | e6d75a76602a8d1f1022589c77b5ba754f62975a (patch) | |
tree | f768a7c17632f309a75e3eb79a8a600f57db7977 | |
parent | 8a5fb81026577bacbab20407b3bdfb9a7d784256 (diff) | |
download | abslibre-e6d75a76602a8d1f1022589c77b5ba754f62975a.tar.gz abslibre-e6d75a76602a8d1f1022589c77b5ba754f62975a.tar.bz2 abslibre-e6d75a76602a8d1f1022589c77b5ba754f62975a.zip |
pacman: secure options for gpg
-rw-r--r-- | libre/pacman/PKGBUILD | 20 | ||||
-rw-r--r-- | libre/pacman/gpg.conf | 50 | ||||
-rw-r--r-- | libre/pacman/refresh-pacman-keys | 3 | ||||
-rw-r--r-- | libre/pacman/sks-keyservers.netCA.pem | 32 |
4 files changed, 98 insertions, 7 deletions
diff --git a/libre/pacman/PKGBUILD b/libre/pacman/PKGBUILD index 8fb58771b..f446e6e72 100644 --- a/libre/pacman/PKGBUILD +++ b/libre/pacman/PKGBUILD @@ -24,13 +24,10 @@ source=(ftp://ftp.archlinux.org/other/pacman/$pkgname-$pkgver.tar.gz{,.sig} pacman.conf.i686 pacman.conf.x86_64 pacman.conf.mips64el - makepkg.conf) -md5sums=('063c8b0ff6bdf903dc235445525627cd' - 'SKIP' - '688feb0a552f42643a76f72e7198bfe4' - '77c5fd379e73cf86fc08a4bd5c4b1ba1' - '9e0c64937ef751ae4273fa4d73381484' - 'f0f310df411f943dbc4e2dd376c88662') + makepkg.conf + gpg.conf + sks-keyservers.netCA.pem + refresh-pacman-keys) build() { cd "$pkgname-$pkgver" @@ -96,4 +93,13 @@ package() { done install -Dm644 contrib/PKGBUILD.vim "$pkgdir/usr/share/vim/vimfiles/syntax/PKGBUILD.vim" + + install -Dm755 "${srcdir}/refresh-pacman-keys" \ + "${pkgdir}/etc/cron.weekly/refresh-pacman-keys" + + install -Dm644 "${srcdir}/sks-keyservers.netCA.pem" \ + "${pkgdir}/etc/pacman.d/sks-keyservers.netCA.pem" + + install -Dm644 "${srcdir}/gpg.conf" \ + "${pkgdir}/etc/pacman.d/gpg.conf" } diff --git a/libre/pacman/gpg.conf b/libre/pacman/gpg.conf new file mode 100644 index 000000000..7fc6fc661 --- /dev/null +++ b/libre/pacman/gpg.conf @@ -0,0 +1,50 @@ +# pacman-key default options +no-greeting +no-permission-warning +lock-never +keyserver-options timeout=20 + +# From duraconf +# personal digest preferences +personal-digest-preferences SHA512 + +# message digest algorithm used when signing a key +cert-digest-algo SHA512 + +# Set the list of default preferences to string. +# used for new keys and default for "setpref" +default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed + +# From +# https://crabgrass.riseup.net/riseuplabs+paow/openpgp-best-practices +# Only use secure keyservers +keyserver hkps://hkps.pool.sks-keyservers.net +keyserver-options ca-cert-file=~/.gnupg/sks-keyservers.netCA.pem +keyserver-options no-honor-keyserver-url + +# when outputting certificates, view user IDs distinctly from keys: +fixed-list-mode + +# short-keyids are trivially spoofed; it's easy to create a long-keyid +# collision; if you care about strong key identifiers, you always want +# to see the fingerprint: +keyid-format 0xlong +fingerprint + +# when multiple digests are supported by all recipients, choose the +# strongest one: +personal-digest-preferences SHA512 SHA384 SHA256 SHA224 + +# If you use a graphical environment (and even if you don't) +# you should be using an agent: (similar arguments as +# https://www.debian-administration.org/users/dkg/weblog/64) +use-agent + +# You should always know at a glance which User IDs gpg thinks are +# legitimately bound to the keys in your keyring: +verify-options show-uid-validity +list-options show-uid-validity + +# include an unambiguous indicator of which key made a signature: (see +# http://thread.gmane.org/gmane.mail.notmuch.general/3721/focus=7234) +sig-notation issuer-fpr@notations.openpgp.fifthhorseman.net=%g diff --git a/libre/pacman/refresh-pacman-keys b/libre/pacman/refresh-pacman-keys new file mode 100644 index 000000000..e96dc34e5 --- /dev/null +++ b/libre/pacman/refresh-pacman-keys @@ -0,0 +1,3 @@ +#!/bin/bash + +pacman-key --refresh-keys diff --git a/libre/pacman/sks-keyservers.netCA.pem b/libre/pacman/sks-keyservers.netCA.pem new file mode 100644 index 000000000..24a2ad2e8 --- /dev/null +++ b/libre/pacman/sks-keyservers.netCA.pem @@ -0,0 +1,32 @@ +-----BEGIN CERTIFICATE----- +MIIFizCCA3OgAwIBAgIJAK9zyLTPn4CPMA0GCSqGSIb3DQEBBQUAMFwxCzAJBgNV +BAYTAk5PMQ0wCwYDVQQIDARPc2xvMR4wHAYDVQQKDBVza3Mta2V5c2VydmVycy5u +ZXQgQ0ExHjAcBgNVBAMMFXNrcy1rZXlzZXJ2ZXJzLm5ldCBDQTAeFw0xMjEwMDkw +MDMzMzdaFw0yMjEwMDcwMDMzMzdaMFwxCzAJBgNVBAYTAk5PMQ0wCwYDVQQIDARP +c2xvMR4wHAYDVQQKDBVza3Mta2V5c2VydmVycy5uZXQgQ0ExHjAcBgNVBAMMFXNr +cy1rZXlzZXJ2ZXJzLm5ldCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC +ggIBANdsWy4PXWNUCkS3L//nrd0GqN3dVwoBGZ6w94Tw2jPDPifegwxQozFXkG6I +6A4TK1CJLXPvfz0UP0aBYyPmTNadDinaB9T4jIwd4rnxl+59GiEmqkN3IfPsv5Jj +MkKUmJnvOT0DEVlEaO1UZIwx5WpfprB3mR81/qm4XkAgmYrmgnLXd/pJDAMk7y1F +45b5zWofiD5l677lplcIPRbFhpJ6kDTODXh/XEdtF71EAeaOdEGOvyGDmCO0GWqS +FDkMMPTlieLA/0rgFTcz4xwUYj/cD5e0ZBuSkYsYFAU3hd1cGfBue0cPZaQH2HYx +Qk4zXD8S3F4690fRhr+tki5gyG6JDR67aKp3BIGLqm7f45WkX1hYp+YXywmEziM4 +aSbGYhx8hoFGfq9UcfPEvp2aoc8u5sdqjDslhyUzM1v3m3ZGbhwEOnVjljY6JJLx +MxagxnZZSAY424ZZ3t71E/Mn27dm2w+xFRuoy8JEjv1d+BT3eChM5KaNwrj0IO/y +u8kFIgWYA1vZ/15qMT+tyJTfyrNVV/7Df7TNeWyNqjJ5rBmt0M6NpHG7CrUSkBy9 +p8JhimgjP5r0FlEkgg+lyD+V79H98gQfVgP3pbJICz0SpBQf2F/2tyS4rLm+49rP +fcOajiXEuyhpcmzgusAj/1FjrtlynH1r9mnNaX4e+rLWzvU5AgMBAAGjUDBOMB0G +A1UdDgQWBBTkwyoJFGfYTVISTpM8E+igjdq28zAfBgNVHSMEGDAWgBTkwyoJFGfY +TVISTpM8E+igjdq28zAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4ICAQAR +OXnYwu3g1ZjHyley3fZI5aLPsaE17cOImVTehC8DcIphm2HOMR/hYTTL+V0G4P+u +gH+6xeRLKSHMHZTtSBIa6GDL03434y9CBuwGvAFCMU2GV8w92/Z7apkAhdLToZA/ +X/iWP2jeaVJhxgEcH8uPrnSlqoPBcKC9PrgUzQYfSZJkLmB+3jEa3HKruy1abJP5 +gAdQvwvcPpvYRnIzUc9fZODsVmlHVFBCl2dlu/iHh2h4GmL4Da2rRkUMlbVTdioB +UYIvMycdOkpH5wJftzw7cpjsudGas0PARDXCFfGyKhwBRFY7Xp7lbjtU5Rz0Gc04 +lPrhDf0pFE98Aw4jJRpFeWMjpXUEaG1cq7D641RpgcMfPFvOHY47rvDTS7XJOaUT +BwRjmDt896s6vMDcaG/uXJbQjuzmmx3W2Idyh3s5SI0GTHb0IwMKYb4eBUIpQOnB +cE77VnCYqKvN1NVYAqhWjXbY7XasZvszCRcOG+W3FqNaHOK/n/0ueb0uijdLan+U +f4p1bjbAox8eAOQS/8a3bzkJzdyBNUKGx1BIK2IBL9bn/HravSDOiNRSnZ/R3l9G +ZauX0tu7IIDlRCILXSyeazu0aj/vdT3YFQXPcvt5Fkf5wiNTo53f72/jYEJd6qph +WrpoKqrwGwTpRUCMhYIUt65hsTxCiJJ5nKe39h46sg== +-----END CERTIFICATE----- |