[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#33733: Irrelevant narinfo signatures are honored

From: Ludovic Courtès
Subject: bug#33733: Irrelevant narinfo signatures are honored
Date: Fri, 14 Dec 2018 00:39:55 +0100
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)

Ludovic Courtès <address@hidden> skribis:

> The problem is that ‘guix substitute’ will accept such narinfos (when
> they are signed by an authorized key), even though the signature doesn’t
> cover the important parts (namely: StorePath, NarHash, and References;
> the rest is mostly informative.)  A fix is attached with tests that
> illustrate the problem.

I pushed the fix as 60b04024f8823192b74c1ed5b14f318049865ac7 and an
update of the ‘guix’ package as

I encourage you to upgrade your daemon.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]