From patchwork Mon Mar 21 11:44:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Peter_M=C3=BCller?= X-Patchwork-Id: 5370 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4KMXpv2Hldz3wt4 for ; Mon, 21 Mar 2022 11:44:55 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4KMXps5PRxzpY; Mon, 21 Mar 2022 11:44:53 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4KMXps4DDPz2xn3; Mon, 21 Mar 2022 11:44:53 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) client-signature ECDSA (P-384)) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4KMXpr6L22z2xNS for ; Mon, 21 Mar 2022 11:44:52 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4KMXpq6qBCzpY for ; Mon, 21 Mar 2022 11:44:51 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1647863092; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JDMI3T/S48U2KF+3Jo+kPsoA0TC+DKmvBu5r0B8UJ1o=; b=NnxMQ4LfZR1q27QvhO6RK9NL3QcYhjyfHHlQhEyJERdWhgG4SgDi7xRNNVnTSj8Jv0MFPz uKz6QaZXk4PXjiAA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1647863092; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JDMI3T/S48U2KF+3Jo+kPsoA0TC+DKmvBu5r0B8UJ1o=; b=oXtIvJKX+d4qe06cCenJZFGyrgmOUl/EyS58L+3DhjpDqCWpXu3AnqisumR6ZjWx0SP80K u0Gk0TzGRZlfZCoL+437D2lQVg+BE1VofkQnuWWWS2dFr1K49dZku2pAKdrnHJCViFpTUk BM/yiechIbt2lg5gssXRrrQOhR/H49u99c+OcsCmt/dKsONte/rV6jPb5m63ZeGETKzFg8 ODhF0mj4YaYt1ruQ+28J2V3Ud1arbkepdD5LZwYIIKmbEilS0yuthWEqUhwGklKt+BA6HY BpJQWtroVuZuhQxNbhPqKeAGLqEq84Tl9czK5TjsOMAwtTirsYspnDXV3ZuyRg== Message-ID: <5d58d997-0219-3ea3-ed96-04cba303ebfb@ipfire.org> Date: Mon, 21 Mar 2022 11:44:48 +0000 MIME-Version: 1.0 Content-Language: en-US To: "IPFire: Development" From: =?utf-8?q?Peter_M=C3=BCller?= Subject: [PATCH] Core Update 166: Drop old 2007 Pakfire key, and remove it from existing installations X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" It is not necessary to have this key present on IPFire systems anymore, since it has not been in use for years, and we can expect systems to be sufficiently up-to-date, so they no longer need to rely on old updates or add-ons signed with this key. Also, given the current key was generated in 2018, we should consider a Pakfire key rollover soon. Signed-off-by: Peter Müller Acked-by: Michael Tremer --- config/rootfiles/common/pakfire | 1 - config/rootfiles/core/166/filelists/files | 1 + config/rootfiles/core/166/update.sh | 6 +++++ src/initscripts/system/pakfire | 3 --- src/pakfire/pakfire-2007.key | 31 ----------------------- 5 files changed, 7 insertions(+), 35 deletions(-) delete mode 100644 src/pakfire/pakfire-2007.key diff --git a/config/rootfiles/common/pakfire b/config/rootfiles/common/pakfire index 0487c58f9..bd5559597 100644 --- a/config/rootfiles/common/pakfire +++ b/config/rootfiles/common/pakfire @@ -6,7 +6,6 @@ opt/pakfire/db/rootfiles #opt/pakfire/etc #opt/pakfire/pakfire.conf opt/pakfire/etc/pakfire.conf -opt/pakfire/pakfire-2007.key opt/pakfire/pakfire-2018.key #opt/pakfire/lib opt/pakfire/lib/functions.pl diff --git a/config/rootfiles/core/166/filelists/files b/config/rootfiles/core/166/filelists/files index b77c7fa07..6bb3c8d82 100644 --- a/config/rootfiles/core/166/filelists/files +++ b/config/rootfiles/core/166/filelists/files @@ -1,5 +1,6 @@ etc/inittab.d etc/rc.d/init.d/firewall +etc/rc.d/init.d/pakfire srv/web/ipfire/cgi-bin/connections.cgi srv/web/ipfire/cgi-bin/ids.cgi usr/lib/firewall/rules.pl diff --git a/config/rootfiles/core/166/update.sh b/config/rootfiles/core/166/update.sh index 3924039c6..1370555b0 100644 --- a/config/rootfiles/core/166/update.sh +++ b/config/rootfiles/core/166/update.sh @@ -34,11 +34,17 @@ done # Remove files rm -vf \ /etc/dracut.conf \ + /opt/pakfire/pakfire-2007.key \ /usr/bin/mkinitrd \ /usr/lib/dracut \ /usr/local/bin/ovpn-ccd-convert \ /usr/local/bin/rebuild-initrd +# Delete old 2007 Pakfire key from GPG keyring +export GNUPGHOME="/opt/pakfire/etc/.gnupg" +gpg --batch --yes --delete-keys 179740DC4D8C47DC63C099C74BDE364C64D96617 +unset GNUPGHOME + # Stop services # Extract files diff --git a/src/initscripts/system/pakfire b/src/initscripts/system/pakfire index 4fe399403..1305bda48 100644 --- a/src/initscripts/system/pakfire +++ b/src/initscripts/system/pakfire @@ -29,9 +29,6 @@ case "${1}" in boot_mesg "Setting up Pakfire Package Manager..." gpg --import /opt/pakfire/pakfire-2018.key &>/dev/null evaluate_retval - - # Try to import the old key, too - gpg --import /opt/pakfire/pakfire-2007.key &>/dev/null ;; *) diff --git a/src/pakfire/pakfire-2007.key b/src/pakfire/pakfire-2007.key deleted file mode 100644 index ced120ad8..000000000 --- a/src/pakfire/pakfire-2007.key +++ /dev/null @@ -1,31 +0,0 @@ ------BEGIN PGP PUBLIC KEY BLOCK----- - -mQGiBEYssZ8RBACcbHcYW+gPbjPFxv4ImlK1FgXV3s65Nnu7V9kghB7AZXterMVM -rZ87sNEw6J3JT32k0e9iBukA1QrshPg3c/mL+2/lMvvxsUW19rj/8ZBCCnP1Svgq -9q0OSJfadbm9b6Ndj06D/3EM+VpY5aI7XgNenh7ZcDbY9m8YDPdu0OF9uwCgltJS -+Pzjr16bJ/VnI549LfIG2KkEAJZWQmLQSXbl4VVEOSyaaJN8ugGBnZtnaL6IBE9K -0FHoZU3GaEOP6L3IUHUzyWsrpC/G44hGPC3xIbr5VG3sJ6hUc3J2rjx1clFdyN6A -bte9EWk1HkRFdaMfDn86vhIjn7znHU4cbvQLIpgB12+y2P/ydqLwyuyf6rV1JEWk -pSXpA/91LnlvICvqompSmrpLKpb+DSe59tr/r5GI36VNnqWt32InmF0N2ceLwG1F -K62M4Tf5/OZOg5m3uoTTHWf355+7NJjyPzT+DYbsuK56TNd/cFPeVdisdteeuINj -3DIC/8H9Y7mvYMAoSNtdA74JrdzGiqH2zSTB/oa/nwDXFekrq7Q2TWljaGFlbCBU -cmVtZXIgKFBha2ZpcmUgU2lnbmluZyBLZXkpIDxwYWtzQGlwZmlyZS5vcmc+iFoE -ExECABoFAkYssZ8CGwMCCwIDFQIDAxYCAQIeAQIXgAAKCRBL3jZMZNlmF0pBAJ95 -S5xzasjMQLpvOWA9E4JG3YJasQCfbNpdZXbZHr7Io7hLR9iJ+OhybfuIawQQEQIA -KwUCRi3ByAWDAeKFAB4aaHR0cDovL3d3dy5jYWNlcnQub3JnL2Nwcy5waHAACgkQ -0rsNAWXQ/VjJhQCfUQh+9wPAlyQVb9gYZ5zgHfqDY1MAn2T/VXH2+acwC4O3oV1W -Ni36NNRpuQINBEYsuJoQCAC6wq4ZMtWRGF/GeTd9l7boo40ulBth8Wr+IBK38XYv -5s+WLiTuuTCM8Thq4eY3MOfO+VXhjQen1S2e8WiZq+c55pDDAKXvBFmVNKcgkK7C -1AW85kY86aspoAK3/vi2pghlXAysTKSoW+WfoCbASDheEJopOkIMehdroraI2zTM -y8AEk+TnbRPzoFNBEYwr3J1GlkegtU3mIPpALDfpL4+HoCgS+7SfAvIlG//C+4W/ -oI/VOYHDdM5zR1av/pVZGpUK4Ao/JBxXMaqsbiP43KytbNuMRsZ+sFDs/ZtmHf1z -6AQ8mnxU0klT4ppU8Nl3hSVcvRacm6wBTvvGEqjkApkPAAMFCACKWJVpzcVAdOMP -aB08qJ+GPSSgxspaSoFPjVN307Pr1Di/ZriC/UVNrq/eUHEIvC1zIx+t3O109qVH -RMWbfCj+4/OBHJ4Ik3Nc5/8v6zaGwixJrkjohF8QLwodqazrjc+W3VsQ5jwfPpLe -DFpd3xHhj5zhXQKN0tCCk435Q/58aMQCK75St3/ymP6NGaE2s7dsXU/BwndgfxJu -Yz8LEK6phJ2t0jBiJJgcjWkoBkq8MhI6wKW6uDU4B/KKGHHLuZHg1ZKum8ASMcti -S980DlSJyfLJnUIio5F/u/csug8bHKq5pA1x+wmsUBhuH66aosNJuz35Bl4nW365 -PoahYtQBiEkEGBECAAkFAkYsuJsCGwwACgkQS942TGTZZheq7ACfTrW5OaZOhrwt -Jr+xgdjSFRrT14cAnjkEj51RQsP7LS5UTm+yce2olHDp -=hYb3 ------END PGP PUBLIC KEY BLOCK-----