From bb6481a82072cf2df27306508c8b72b584eb4f80 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Peter=20M=C3=BCller?= Date: Sun, 12 Nov 2017 15:40:28 +0100 Subject: [PATCH 1/1] validate GPG keys by fingerprint MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Validate GPG keys by fingerprint and not by 8-bit key-ID. This makes exploiting bug #11539 harder, but not impossible and does not affect existing installations. Signed-off-by: Peter Müller Signed-off-by: Michael Tremer --- src/pakfire/lib/functions.pl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pakfire/lib/functions.pl b/src/pakfire/lib/functions.pl index c347916d80..cfb7e51175 100644 --- a/src/pakfire/lib/functions.pl +++ b/src/pakfire/lib/functions.pl @@ -34,8 +34,8 @@ use Net::Ping; package Pakfire; # GPG Keys -my $myid = "64D96617"; # Our own gpg-key paks@ipfire.org -my $trustid = "65D0FD58"; # gpg-key of CaCert +my $myid = "179740DC4D8C47DC63C099C74BDE364C64D96617"; # Our own gpg-key paks@ipfire.org +my $trustid = "A31D4F81EF4EBD07B456FA04D2BB0D0165D0FD58"; # gpg-key of CaCert # A small color-hash :D my %color; -- 2.39.2