{"action":"opened","issue":{"url":"https://api.github.com/repos/martincmelik/Securix-Linux/issues/77","labels_url":"https://api.github.com/repos/martincmelik/Securix-Linux/issues/77/labels{/name}","comments_url":"https://api.github.com/repos/martincmelik/Securix-Linux/issues/77/comments","events_url":"https://api.github.com/repos/martincmelik/Securix-Linux/issues/77/events","html_url":"https://github.com/martincmelik/Securix-Linux/issues/77","id":53219886,"number":77,"title":"gpg -u doesn't really do anything, drop it","user":{"login":"adrelanos","id":1985040,"avatar_url":"https://avatars.githubusercontent.com/u/1985040?v=3","gravatar_id":"","url":"https://api.github.com/users/adrelanos","html_url":"https://github.com/adrelanos","followers_url":"https://api.github.com/users/adrelanos/followers","following_url":"https://api.github.com/users/adrelanos/following{/other_user}","gists_url":"https://api.github.com/users/adrelanos/gists{/gist_id}","starred_url":"https://api.github.com/users/adrelanos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adrelanos/subscriptions","organizations_url":"https://api.github.com/users/adrelanos/orgs","repos_url":"https://api.github.com/users/adrelanos/repos","events_url":"https://api.github.com/users/adrelanos/events{/privacy}","received_events_url":"https://api.github.com/users/adrelanos/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/martincmelik/Securix-Linux/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-01-01T13:40:05Z","updated_at":"2015-01-01T13:40:05Z","closed_at":null,"body":"Talking about these.\r\n\r\n```\r\ngpg -quiet --homedir /etc/portage/gpg -u DCD05B71EAB94199527F44ACDB6B8C1F96D8BF6D --verify \"${STAGE3LATESTFILE##*/}.DIGESTS.asc\"\r\n```\r\n\r\n```\r\ngpg --homedir /etc/portage/gpg -u 13EBBDBEDE7A12775DFDB1BABB572E0E2D182910 --verify \"${SX_PORTAGEFILE##*/}.gpgsig\" \"${SX_PORTAGEFILE##*/}\"\r\n```\r\n\r\n`-u` has actually no effect.\r\n\r\nTested this on a normal system.\r\n\r\n```\r\ngpg -u 13EBBDBEDE7A12775DFDB1BABB572E0E2D182910 --verify portage-20141224.tar.bz2.gpgsig portage-20141224.tar.bz2\r\ngpg: Signature made Thu 25 Dec 2014 01:55:33 AM CET using RSA key ID C9189250\r\ngpg: Good signature from \"Gentoo Portage Snapshot Signing Key (Automated Signing Key)\" [unknown]\r\ngpg: WARNING: This key is not certified with a trusted signature!\r\ngpg:          There is no indication that the signature belongs to the owner.\r\nPrimary key fingerprint: DCD0 5B71 EAB9 4199 527F  44AC DB6B 8C1F 96D8 BF6D\r\n     Subkey fingerprint: E1D6 ABB6 3BFC FB4B A02F  DF1C EC59 0EEA C918 9250\r\n```\r\n\r\nNow use some arbitrary value.\r\n\r\n```\r\ngpg -u xxx --verify portage-20141224.tar.bz2.gpgsig portage-20141224.tar.bz2\r\ngpg: Signature made Thu 25 Dec 2014 01:55:33 AM CET using RSA key ID C9189250\r\ngpg: Good signature from \"Gentoo Portage Snapshot Signing Key (Automated Signing Key)\" [unknown]\r\ngpg: WARNING: This key is not certified with a trusted signature!\r\ngpg:          There is no indication that the signature belongs to the owner.\r\nPrimary key fingerprint: DCD0 5B71 EAB9 4199 527F  44AC DB6B 8C1F 96D8 BF6D\r\n     Subkey fingerprint: E1D6 ABB6 3BFC FB4B A02F  DF1C EC59 0EEA C918 9250\r\n```\r\n\r\nSame result.\r\n\r\nSo `-u` doesn't actually help.\r\n\r\nBut it doesn't matter security wise, because you are using a special homedir `/etc/portage/gpg`, that does not include the user's keys or so.\r\n\r\nTherefore I recommend to drop the whole `-u` thing for simplicity."}}