From: Peter Müller <peter.mueller@link38.eu>
Date: Sun, 12 Nov 2017 14:40:28 +0000 (+0100)
Subject: validate GPG keys by fingerprint
X-Git-Tag: v2.19-core117~1^2~78
X-Git-Url: http://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff_plain;h=bb6481a82072cf2df27306508c8b72b584eb4f80;hp=b7a5076ca0b7d378cfac7c14fb37b51986daa1cf

validate GPG keys by fingerprint

Validate GPG keys by fingerprint and not by 8-bit key-ID.

This makes exploiting bug #11539 harder, but not impossible
and does not affect existing installations.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/src/pakfire/lib/functions.pl b/src/pakfire/lib/functions.pl
index c347916d80..cfb7e51175 100644
--- a/src/pakfire/lib/functions.pl
+++ b/src/pakfire/lib/functions.pl
@@ -34,8 +34,8 @@ use Net::Ping;
 package Pakfire;
 
 # GPG Keys
-my $myid = "64D96617";			# Our own gpg-key paks@ipfire.org
-my $trustid = "65D0FD58";		# gpg-key of CaCert
+my $myid = "179740DC4D8C47DC63C099C74BDE364C64D96617";		# Our own gpg-key paks@ipfire.org
+my $trustid = "A31D4F81EF4EBD07B456FA04D2BB0D0165D0FD58";	# gpg-key of CaCert
 
 # A small color-hash :D
 my %color;