diff options
| author | Alyssa Ross <hi@alyssa.is> | 2019-06-30 14:04:22 +0000 |
|---|---|---|
| committer | Alyssa Ross <hi@alyssa.is> | 2019-06-30 14:09:02 +0000 |
| commit | c727083e6565293c0e38f033fc1db07b187bddb0 (patch) | |
| tree | 21933649f96477c7c0c833f5128978d27459e9b0 /pkgs/tools/security/gnupg | |
| parent | e295fd81370929a4268e94ba95d86f3f296d610c (diff) | |
| download | nixlib-c727083e6565293c0e38f033fc1db07b187bddb0.tar nixlib-c727083e6565293c0e38f033fc1db07b187bddb0.tar.gz nixlib-c727083e6565293c0e38f033fc1db07b187bddb0.tar.bz2 nixlib-c727083e6565293c0e38f033fc1db07b187bddb0.tar.lz nixlib-c727083e6565293c0e38f033fc1db07b187bddb0.tar.xz nixlib-c727083e6565293c0e38f033fc1db07b187bddb0.tar.zst nixlib-c727083e6565293c0e38f033fc1db07b187bddb0.zip | |
gnupg: change default keyserver to non-SKS
See https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f. The SKS network is vulnerable to certificate poisoning, which can destroy GnuPG installations. keys.openpgp.org is a new non-SKS keyserver that is resistant to this type of attack. With such an attack being possible, it is unsafe to use SKS keyservers for almost anything, and so we should protect our users from a now unsafe default. keys.openpgp.org offers some (but not all) functionality of SKS, and is better than nothing. This default is only present in gnupg22. gnupg20 and gnupg1orig are not affected.
Diffstat (limited to 'pkgs/tools/security/gnupg')
| -rw-r--r-- | pkgs/tools/security/gnupg/22.nix | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix index b360992c6bef..978bf1d4e4b5 100644 --- a/pkgs/tools/security/gnupg/22.nix +++ b/pkgs/tools/security/gnupg/22.nix @@ -33,7 +33,10 @@ stdenv.mkDerivation rec { patches = [ ./fix-libusb-include-path.patch ]; - postPatch = stdenv.lib.optionalString stdenv.isLinux '' + postPatch = '' + sed -i 's,hkps://hkps.pool.sks-keyservers.net,hkps://keys.openpgp.org,g' \ + configure doc/dirmngr.texi doc/gnupg.info-1 + '' + stdenv.lib.optionalString stdenv.isLinux '' sed -i 's,"libpcsclite\.so[^"]*","${stdenv.lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c ''; #" fix Emacs syntax highlighting :-( |