Skip to content

Commit 70b9bd1

Browse files
rouiljrouilj
committed
issue2551279 - GPG support removed from pypi - rewrite pgp signature validation.
Added/updated documentation on using gpg signature files for the distribution to security.txt. Added signature files to main website/mercurial. Removed verification documentation from public key file included in distribution. key file now references security.txt/.html.
1 parent 2c2b0e5 commit 70b9bd1

File tree

10 files changed

+198
-70
lines changed

10 files changed

+198
-70
lines changed

‎CHANGES.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ python 3.6 or newer (3.4/3.5 might work, but they are not tested).
1616

1717
Fixed:
1818

19+
- Updated directions for verifying Roundup distribution using pgp.
1920
- Dockerfile healthcheck fixed so it works when trackers are
2021
specified on command line. Also cleanup of unneeded
2122
packages. (John Rouillard)

‎RELEASE.txt‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -138,41 +138,43 @@ Roundup release checklist:
138138
pypi account and be added as a maintainer to roundup. Ask existing
139139
maintainer for access. You can do this two ways:
140140

141-
python3 setup.py sdist upload --repository pypi --sign
141+
python3 setup.py sdist upload --repository pypi
142142

143143
which rebuilds the source distribution tarball and uploads it.
144-
This means that you have uploaded something tha is not tested. It
145-
should be the same as the tarball you tested but....
144+
This means that you have uploaded something that is not tested,
145+
also it does not have a gpg signature. It should be the same as
146+
the tarball you tested but....
146147

147-
Another way to do this is to use twine (pip install twine).
148+
A better way to do this is to use twine (pip install twine).
148149
You need to sign the tarball. This can be done with:
149150

150151
cd dist
151152
gpg --detach-sign --armor -u 1F2DD0CB756A76D8 <filename>.tgz
152153

153154
you should be prompted to use the roundup release key. If not you
154155
can add [email protected].
155-
This will create a file by the name <filename>.tgz.asc. Then
156-
use twine to upload *both* the asc and distibution tarball
157-
at the same time. E.G.:x
156+
This will create a file by the name <filename>.tgz.asc.
157+
The original directions used twine to upload the tarball and the
158+
signature, but as of May 2023, PyPI no longer accepts signature
159+
files.
158160

159-
twine upload --repository pypi <filename>.tar.gz <filename>.tar.gz.asc
161+
So we publish the signature as part of the website. Move the file
162+
to the website/www/signatures directory. Commit the .asc signature
163+
file to mercurial.
160164

161-
(If you upload the .asc file separately from the distibution file
162-
it gets a different path and is not able to be located in the pypi
163-
interface. The asc file is downloaded using the tarball path and
164-
add `asc'.)
165+
Use twine to upload the distribution tarball. E.G.
166+
167+
twine upload --repository pypi <filename>.tar.gz
165168

166169
The distribution file should appear on
167170
https://pypi.python.org/pypi/roundup in no time. If you are using
168171
python older than 2.7.13 you need a .pypirc shown below since the
169-
URL has changed. If using 2.7.13 or newer, you can remove the
170-
"--repository pypi" option and use 'setup.py sdist upload...'.
172+
URL has changed.
171173

172174
You can also use twine to upload the .whl (wheel) format
173175
distributions (if created). Follow the directions for generating
174-
the gpg asc files and upload the .whl distribution and .whl.asc
175-
signature files together.
176+
the gpg asc files and place the .whl.asc in the signature
177+
directory.
176178

177179
14. Refresh website.
178180
website/README.txt

‎doc/security.txt‎

Lines changed: 99 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,26 +2,117 @@
22
:description:
33
Documentation on how to report security issues with
44
Roundup. Also index to security related portions in other
5-
Roundup documentation.
5+
Roundup documentation. How to verify distribution using gpg.
66

77
.. index::
88
single: Reporting Security Issues
99
single: Security Issues, Reporting
1010

1111

12-
======================================
13-
Reporting Security Issues with Roundup
14-
======================================
12+
=======================
13+
Roundup Security Issues
14+
=======================
1515

1616
Security issues with Roundup should be reported by email to:
1717

1818
[email protected] (John Rouillard)
1919

2020
[email protected] (Ralf Schlatterbeck)
2121

22-
Also you can find rouilj on irc in channel #roundup at irc.oftc.net (see
23-
Contact_ for more directions and web interface).
24-
25-
Use these mechanisms to establish initial contact.
22+
If these fail, you can find rouilj on irc in channel #roundup at
23+
irc.oftc.net (see Contact_ for more directions and web
24+
interface). Methods listed at Contact_ are all public, so they should
25+
be used to contact somebody with the Roundup project for establishing
26+
a proper method of reporting the security issue.
2627

2728
.. _Contact: https://www.roundup-tracker.org/contact.html
29+
30+
Verify Source Tarball
31+
---------------------
32+
33+
.. index::
34+
single: Distribution, verify with gpg
35+
single: Signature, verify
36+
37+
If you download the source tarball using ``python3 -m pip download
38+
roundup`` or from https://pypi.org/project/roundup/#files you can
39+
verify the file using gpg.
40+
41+
This is the information on the public PGP/GPG key used to sign Roundup
42+
distributions. It is used to sign the 1.6.0, 2.2.0, and newer
43+
releases. (Note that the @ sign in email addresses have been replaced
44+
with the word "at" to reduce spam directed at the mailing list.)::
45+
46+
Key info: Roundup Team (signing key for roundup releases)
47+
<roundup-devel at lists.sourceforge.net>
48+
Expires: 2028-07-17
49+
Key fingerprint = 411E 354B 5D1A F261 25D6 2122 1F2D D0CB 756A 76D8
50+
51+
Releases 1.6.1, 2.0.0 and 2.1.0 were accidentally signed with this key
52+
[1]_::
53+
54+
Key info: John Rouillard (Roundup Release Key)
55+
<rouilj+roundup at ieee.org>
56+
Expires: 2023-07-09
57+
Key fingerprint = A1E6 364E 9429 E9D8 2B3B 2373 DB05 ADC4 2330 5876
58+
59+
.. [1] Use gpg to import this key from the keyserver pgp.mit.edu
60+
if you need to verify one of these releases. Use the gpg
61+
pgp.mit.edu keyserver example replacing the key fingerprint
62+
with the one starting A1E6.
63+
64+
You can import a key from pgp.mit.edu using::
65+
66+
gpg --keyserver pgp.mit.edu --receive-keys 411E354B5D1AF26125D621221F2DD0CB756A76D8
67+
68+
where the fingerprint (without spaces) is used to identify which key
69+
to receive. You can also extract and import the file
70+
``tools/roundup.public.pgp.key`` from the download source tarball
71+
using::
72+
73+
tar -xzvf roundup-2.2.0.tar.gz -O \
74+
roundup-2.2.0/tools/roundup.public.pgp.key > pub.key
75+
76+
gpg --import pub.key
77+
78+
Once you have loaded the public key, you need a detached signature for
79+
your release. PyPI used to support uploading gpg detached
80+
signatures. However that is no longer supported and downloading
81+
existing signatures may not work in the future.
82+
83+
As a result, the signatures for all Roundup final releases starting
84+
with 1.6.0 have been moved and are linked below:
85+
86+
* `2.2.0 <../signatures/roundup-2.2.0.tar.gz.asc>`_
87+
* `2.1.0 <../signatures/roundup-2.1.0.tar.gz.asc>`_
88+
* `2.0.0 <../signatures/roundup-2.0.0.tar.gz.asc>`_
89+
* `1.6.1 <../signatures/roundup-1.6.1.tar.gz.asc>`_
90+
* `1.6.0 <../signatures/roundup-1.6.0.tar.gz.asc>`_
91+
92+
To use it, download the correct versioned link and verify it with
93+
(note 1.5.7 is a dummy version, use the correct version number)::
94+
95+
gpg --verify roundup-1.5.7.tar.gz.asc roundup-1.5.7.tar.gz
96+
97+
You should see::
98+
99+
gpg: Signature made Wed 13 Jul 2022 12:24:14 AM EDT
100+
gpg: using RSA key 411E354B5D1AF26125D621221F2DD0CB756A76D8
101+
gpg: Good signature from "Roundup Team (signing key for roundup releases) <roundup-devel at lists.sourceforge.net>" [unknown]
102+
gpg: WARNING: This key is not certified with a trusted signature!
103+
gpg: There is no indication that the signature belongs to the owner.
104+
Primary key fingerprint: 411E 354B 5D1A F261 25D6 2122 1F2D D0CB 756A 76D8
105+
106+
which verifies the tarball integrity. The WARNING is expected and the
107+
date corresponds to the newest renewal of the Roundup key. As long as
108+
you see the output starting with "Good signature from" followed by the
109+
Key Info for your key, everything is OK.
110+
111+
If something is wrong you will see:
112+
113+
gpg: Signature made Wed 13 Jul 2022 12:24:14 AM EDT
114+
gpg: using RSA key 411E354B5D1AF26125D621221F2DD0CB756A76D8
115+
gpg: BAD signature from "Roundup Team (signing key for roundup releases) <roundup-devel at lists.sourceforge.net>"
116+
117+
*do not use* the tarball if the signature is BAD. Email the
118+
roundup-devel mailing list if you have this happen to you.

‎tools/roundup.public.pgp.key‎

Lines changed: 4 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,51 +1,9 @@
1-
This is the public PGP/GPG key used to sign Roundup distributions. It
2-
is used starting with the 1.6.0 release. (Note in this file the @ sign
3-
in emails have been replaced with the word "at".)
1+
This is the public PGP/GPG key used to sign Roundup distributions.
2+
See the Security document at:
43

5-
Key info: Roundup Team (signing key for roundup releases)
6-
<roundup-devel at lists.sourceforge.net>
7-
RSA key ID: 756A76D8
8-
Expires: 2028-07-17
9-
Key fingerprint = 411E 354B 5D1A F261 25D6 2122 1F2D D0CB 756A 76D8
4+
https://www.roundup-tracker.org/docs/security.html
105

11-
Import the key in this file using:
12-
13-
gpg --import roundup.public.pgp.key
14-
15-
Then you can use it to verify a downloaded Roundup release from pypi.
16-
Get the url of the release from:
17-
18-
https://pypi.org/project/roundup
19-
20-
Example (note there is no 1.5.7 release):
21-
22-
https://files.pythonhosted.org/packages/bf/14/d61fac5ed2aaca8c720ac4d4077428b8fdafa356089516ba9ee630975d2a/roundup-1.5.7.tar.gz
23-
24-
download the file then download:
25-
26-
https://files.pythonhosted.org/packages/bf/14/d61fac5ed2aaca8c720ac4d4077428b8fdafa356089516ba9ee630975d2a/roundup-1.5.7.tar.gz.asc
27-
28-
(same url as the file with .asc added at the end).
29-
30-
To verify the tar file run:
31-
32-
gpg --verify roundup-1.5.7.tar.gz.asc roundup-1.5.7.tar.gz
33-
34-
and you should see:
35-
36-
gpg: Signature made Wed 11 Jul 2018 08:40:06 PM EDT using RSA key ID 756A76D8
37-
gpg: checking the trustdb
38-
[...]
39-
gpg: Good signature from "Roundup Team (signing key for roundup releases) <roundup-devel at lists.sourceforge.net>"
40-
[...]
41-
42-
which verifies the tarball integrity. If something is wrong you will see:
43-
44-
gpg: Signature made Wed 11 Jul 2018 08:40:06 PM EDT using RSA key ID 756A76D8
45-
gpg: BAD signature from "Roundup Team (signing key for roundup releases) <roundup-devel at lists.sourceforge.net>"
46-
47-
*do not use* the tarball if the signature is BAD. Email the
48-
roundup-devel mailing list if there is a problem.
6+
for details on how to use it.
497

508
-----BEGIN PGP PUBLIC KEY BLOCK-----
519

‎website/www/Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ html: docs
2929
sed -i -e '/<meta/s/og\\:/og:/' \
3030
-e '/<meta/s/name="og:/property="og:/' html/index.html
3131
cp robots.txt html/robots.txt
32+
mkdir html/signatures && cp signatures/*.asc html/signatures
3233

3334
linkcheck:
3435
mkdir -p $(TMP)/linkcheck $(TMP)/doctrees

‎website/www/signatures/roundup-1.6.0.tar.gz.asc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
-----BEGIN PGP SIGNATURE-----
2+
Version: GnuPG v1
3+
4+
iQIcBAABAgAGBQJbSI1TAAoJEB8t0Mt1anbYSFsQAJvj4+piuyY51RTl7nbk+qKD
5+
aDwmlvNL/FcBlc9PmzCk71woUg8+IPVFqeCYGPj/dKieKivCaLTnwkNDEsYdBe5h
6+
08L50WOVMPPNEsLVI+j7q6BO9dVK+XE5zqNMub8JfcCf0A8emvruZskVoin5Pju+
7+
Vpge95yfBjOi+bfV8k0KjBjN+l/Ih1VzvER3YGmuMXhnP+nQaGlZ0i5lIphQDGeV
8+
zrqtBXwBETJ0vPQNmc+x6RjhD1Uwfe3Qm3IimfvwmKo4EfasJOlhycSYMZ2CUEWN
9+
3tSi3uKsZHAs+5Ya+MywLrO8IkQYFW3NVM3CK7ZWFH7uL3dgUP1Ui4L/LtnjMq/6
10+
4Oa4NsEeKmHmfmQOceLoqZ0zPLrJZpt+FW/bPtnDnNtDAwLJcvK6+9tCZnYKlajh
11+
iDWKNIOJWauyfub1l75znsDmrpoU5K/9ISxlG7lIUMWjMBQoPcMy3JUr6jEtE2zb
12+
Rwm6Tst/E97ZL3xg/jBY8OgpOj9cgpqV8WtUBRumdpD3C93vPgBCeKcdR6wQ7G0d
13+
LLm4gxlseX9FGOdsUShpC6aEegatX15t/sstZE+b/WYdu0hgF2wPh9ERnfis3eAz
14+
Xof+shdZliJH+HNfPaTbQjhgqUJ8Aiur/AfT/4NjtiwS7wVvuguJ1vpU59yMEppM
15+
yEExU26bxUuHoajAmpAW
16+
=lrME
17+
-----END PGP SIGNATURE-----

‎website/www/signatures/roundup-1.6.1.tar.gz.asc‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
-----BEGIN PGP SIGNATURE-----
2+
Version: GnuPG v1
3+
4+
iQGcBAABAgAGBQJdKdmzAAoJENsFrcQjMFh2o28L/iSCGofdtHXiM2GVjyaHYudL
5+
9KCptcZX0XHZliVevVXiAbHVegpG2nnt2EhW2uv3AxJFJysDg+nVQIRWZlwvuw8I
6+
3jk+sQAjSesOkOHGwUy/G9lZzAqI9L6cWB/HedNL9pUznA4akF/Xv9RIo7V5T1Ph
7+
uVpvuDtxD6DF7EaymBo+LVCZQjH1loff3YYGJcJj97785jglphuTbLuS0o0dtR0s
8+
ZfT8jwfuGgJWKN+5eL0ieda+5K+e8XRG7VUx5TGnDkmKbHWtEH+6ZjSKjRi0b1oH
9+
LCNqHe4No9WgrIhWUgEQNe4EbVoFGqE0B8RJom4kAolMd8uH8z+KutisPGET9H/b
10+
3rhOTq9cGN5IAmo5l3gteSLD+S28UbjKXneN9ycqGABug2CjZV8HzfexxCr7UI20
11+
XHsDQNnPv+BKcOzImrmqcWoao7kKbeQ+4RYfVokUGNCiWAZmwvqGoiF1E9lAhyes
12+
V7tepsvWy1640nxAdQD8/W+E3dpK4kKqjRtOEgQNcg==
13+
=eJeY
14+
-----END PGP SIGNATURE-----

‎website/www/signatures/roundup-2.0.0.tar.gz.asc‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
-----BEGIN PGP SIGNATURE-----
2+
3+
iQGzBAABCgAdFiEEoeY2TpQp6dgrOyNz2wWtxCMwWHYFAl8MXlcACgkQ2wWtxCMw
4+
WHYbcQv/RlIQFEQqSorZ/+SEuv8txmwBWmizASIhvbvlS4Nfjx7RnAjAI0PFEaJI
5+
F6sqDjBCQhv6SI4t4Z1RVT/0Btt9DOThrDECc2dwMZaoIzUqmulN19l/ATrk7imq
6+
NkZ2KwACUtQA0YGJXcqi6wUsJBbFcuZSDdxHfzQ5UO1Myk37UXvQ01GLuPj6RppG
7+
MwmdTEcDI9souxEQWQQtEEWa6mvbVG0yVMUTevXrws0TqGWV/k8x1mIlpyaebCSx
8+
DXmmnuYnyTbDS3Yx9Rh+wJNuEEQM8P0/kj9DsNzGMd+941ckgyIk7v9M1OPl8FyM
9+
M0J2dlVVsJPUOrdiI/U/Y9jNFPde+3kUnX+24Nj3UZgzKk3stLRKer6oLM4YphjG
10+
Kq3p7FE2tmT0iQdyvQ1fiE1AOleslr/CErku42UD/CGfdOnpx3UzFCCpao7pesYY
11+
3XMfwwIjXMoCd4OjLS4D4FQljpnSuNVT0JW1UPtsfWrSycMoxPtFVg6a2ASQ7Ej8
12+
TVNkZi0X
13+
=2xhu
14+
-----END PGP SIGNATURE-----

‎website/www/signatures/roundup-2.1.0.tar.gz.asc‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
-----BEGIN PGP SIGNATURE-----
2+
3+
iQGzBAABCgAdFiEEoeY2TpQp6dgrOyNz2wWtxCMwWHYFAmDtEooACgkQ2wWtxCMw
4+
WHZyowv/Z1kL4coSM661C7nQOQU/N5UBc7WfDPreLgmA1htONhTAxDstSN0TDmQu
5+
mYIRaYiO50iHYcUpEwrVy3tPgk3wT8XjpoVmCsuJhREeED502q3BYC6uzyfBeKWe
6+
QxvDa5+usMrw1jJpVXUYyfSOvC9MlBea5ZOwrlwsFeeoXli6RjZLzqotOjFmRrha
7+
/lUNRGJsIy5Tn5XIq3g8xCmOpqAYiraR4rz95QJ1yZIiP5mACVQ8ZHr58qmlPyHw
8+
qO7C4YYOSSSwaLqutvixlLyP5+L7CJtQQT3lcCEgwG9CoSxZmg/SkV0GlyDq8VV7
9+
cqvP1LG+VwO3RWH9RH08mc5KnIIX6GmY8V9f6AZ6oHCRC31TKMvs7lW1xZ5YiOIT
10+
Ao+qTKcEUkq97PbHFMeT7lNJePLL5gG1jtcK2BrDae3Ro2tLtwIMN6oAg6FPzDib
11+
kFNzl2mUcti3GDj6VP+Qz8LS9KEq7F4TvfKC3ZgyPcsFsxw7l03tj3DUphmK/Emd
12+
Jt/KxEVd
13+
=IqQw
14+
-----END PGP SIGNATURE-----

‎website/www/signatures/roundup-2.2.0.tar.gz.asc‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
-----BEGIN PGP SIGNATURE-----
2+
3+
iQIzBAABCgAdFiEEQR41S10a8mEl1iEiHy3Qy3VqdtgFAmLOSO4ACgkQHy3Qy3Vq
4+
dthDlA//RFpw6qqlzW0tpam8Y/Sg5xyk8uuon/UUgjBBNv4pWJsg93aWRVLsBLQt
5+
2UuXSx4KuO46tX62mCo4wy7N93a0BMTuSu0UZX9svSbEudANj6mIWHOJd1CiBs6H
6+
eS1l0xJs/barIt1bP7mDY1vPMxb2Y0LFMAoZU8l938RUtoRQQt5kXHJJQbasM4J7
7+
pQjT/lXtD6vVKAcactfQKj+HdVhgt97ZP1ANFBB9rUrwa+b6E4peIgO61ueXKAtv
8+
GFQyKS2pv7khgw3VF0DB09JdyksAUr7Opj0p8mlK+s8l7ttjQ0ecPx8gpHv8Cgjr
9+
ZsaR1mH1tW/RPoOc70w86AQ07+kNrnPN/3ox62fO1ZjJo/ase3+ynS4p6WuM34l3
10+
hwDs989eJ+8oYdm8v2bk+jCHA8sGluC1y/YnpLG6LTn1ubrSBx1wTdvYMthZUlmn
11+
l9lNwCIrKzhS1jrDZZ2dTBcLpsB5fXi+q5hPCKgtWcDyzXD5EFtaTA1XGr3dMh/0
12+
jSoguw+vx3xE6EuAwoB2n+noUcZpoqwNGOhw7o15fOD8HZnGYn77i3z2SwW4TZhM
13+
JmKaTELAHotPXx6DGSkNfrxLLoLg0/UlqS1Ur2CTVBesueIwcGVET1XW1n9qt2Jp
14+
8MdN8tNofaThvWWz2WKkbJScRlGf9a/AkZT2iTQA/hRYNP66CU0=
15+
=XiE+
16+
-----END PGP SIGNATURE-----

0 commit comments

Comments
 (0)