SKS Keyserver Network Under Attack

Re:SKS Keyserver Network Under Attack by snackematician on Saturday June 29, 2019 @01:10PM (#20313628)

Sibling comments have discussed how this affects Debian, Ubuntu, and opensuse -- any Arch users know how this affects us? Seems like official repos should be fine but what about packages from the AUR?

[ Parent | on HN ]

Re:SKS Keyserver Network Under Attack by snazz on Saturday June 29, 2019 @02:09PM (#20313925)

I don’t think the AUR has a concept of package signing—a PKGBULD will often download a tarball from somewhere and any signing is ad-hoc. The official repositories use their own key ring (which is distributed without a key server).

[ Parent | on HN ]

Re:SKS Keyserver Network Under Attack by majewsky on Saturday June 29, 2019 @02:26PM (#20313996)

Correct. The only time when this would concern you is when you add a third-party repository, e.g. one of [1]. This usually involves a manual TOFU step where you do the equivalent of `gpg --recv-keys $ID` on the pacman keyring.

[1] https://wiki.archlinux.org/index.php/Unofficial_user_reposit...

[ Parent | on HN ]

Re:SKS Keyserver Network Under Attack by jwilk on Saturday June 29, 2019 @04:16PM (#20314544)

Beware that "gpg --recv-keys <keyid>" (or even "gpg --recv-keys <fingerprint>"!) can be tricked into inserting malicious keys into the keyring:

https://dev.gnupg.org/T3398

[ Parent | on HN ]

Re:SKS Keyserver Network Under Attack by mikedilger on Sunday June 30, 2019 @12:32AM (#20316352)

My /etc/pacman.d/gnupg/gpg.conf had this line:

  keyserver hkp://pool.sks-keyservers.net

[ Parent | on HN ]