Tobias Mueller | 21 Feb 16:02 2015
Picon

monkeysign.gpg: --always-trust when signing a key

Hi.

This fixes a bug when signing a key with more than one secret key.

Cheers,
  Tobi
Tobias Mueller | 21 Feb 14:42 2015
Picon

monkeysign.gpg: Give the OpenPGPKey and UID a __repr__

Hi.

With this simple cosmetic changes I find it easier to work with the gpg
module.

Cheers,
  Tobi
Thomas Klute | 19 Feb 19:46 2015
Picon
Picon

Bug#635711: Still broken in monkeysphere 0.37-2 on sid

I still see this bug in monkeysphere 0.37-2 on sid (fresh stable
install, upgrade through testing to unstable).

Aptitude installation:

Setting up monkeysphere (0.37-2) ...
adding monkeysphere user...
ms: setting up Monkeysphere authentication trust core...
Failed running transition script /usr/share/monkeysphere/transitions/0.23
dpkg: error processing package monkeysphere (--configure):
 subprocess installed post-installation script returned error exit
status 141
[... other packages ...]
Errors were encountered while processing:
 monkeysphere
E: Sub-process /usr/bin/dpkg returned an error code (1)
Failed to perform requested operation on package.  Trying to recover:
Setting up monkeysphere (0.37-2) ...
ms: setting up Monkeysphere authentication trust core...
/usr/share/monkeysphere/ma/setup: line 73: printf: write error: Broken pipe
Failed running transition script /usr/share/monkeysphere/transitions/0.23
dpkg: error processing package monkeysphere (--configure):
 subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
 monkeysphere

Running the transition script manually doesn't produce any output that
tells me what is wrong, but the return value is the same:

# /usr/share/monkeysphere/transitions/0.23; echo $?
(Continue reading)

Tobias Mueller | 16 Feb 18:15 2015
Picon

monkeysign: GnuPG 2.1 compatibility

Hi!

This patch makes monkeysign's GnuPG wrapper
more compatible with GnuPG 2.1.
The output seems to have gotten more fields.
Instead of assuming the length of the fields,
we retrieve every single fields we are interested in manually.

That's probably not the most elegant solution, but it works better
than it does now.

Cheers,
  Tobi
Tobias Mueller | 16 Feb 14:09 2015
Picon

Monkeysign: Detect key revocation

Hi.

I've implemented the detection of revoked keys.

As a fun fact:  GnuPG does not seem to export that information
when doing a --list-keys --with-colons.
So we return None if we don't know about the revocation.
If that case, you need to get your hands on the relevant public key
and try again.
Unfortunately, we currently don't save the keyring of origin of a
key.  It might be worth it to store that information as an attribute to
a OpenPGPKey.

The UI works as expected for me, i.e. it does not let me select revoked
keys.

Cheers,
  Tobi
Tobias Mueller | 16 Feb 12:45 2015
Picon

Re: Monkeysign: Calculate key expiry

Hi.

Actually, scratch the version I sent. This version works now.
I've tested it now.  The monkeyscan UI now does not show expired
keys in the "identity" menu anymore.

FWIW: One could think of parse_gpg_list already providing a datetime
object rather than us having to recreate that on every access.

Cheers,
  Tobi

fr33domlover | 30 Apr 00:21 2014
Picon

Usage with mail server

Hello,

This is my first post here. I run an SSH server and a web server and I'm
very interested in using a peer-to-peer decentralized natural way to
handle trust.

Moneysphere already works with HTTPS and SSH as described in your
website, but I didn't find any information about:

- XMPP server (as far as I know, none exists yet but it's WIP)
- mail server

I'm going to run a mail server (first just IMAP, later I'll add SMTP)
and I'd like to not use an SSL certificate from a centralized source
which requires a lot of my private information for spying me and
verifying my identity etc.

Does moneysphere support mail serving?

I can imagine it may work for sending mail to the user, but what happens
if an SMTP server wants to send email to my IMAP server? How does the
SMTP server send me encrypted data if it cannot recognize my OpenPGP
based "certificate"?

If there's any approach waiting to be implemented or used, I don't mind
pioneering. Just tell me please how it works. Also, maybe I can help add
monkeysphere support to dovecot if it's not too difficult.

Thanks in advance!
Sincerely,
(Continue reading)

micah | 21 Apr 01:41 2014
Picon

Re: Archlinux Package

Profpatsch <mail <at> profpatsch.de> writes:

> On 14-04-10 06:21pm, Profpatsch wrote:
>> Since you are linking to a git package which is broken atm:
>> 
>> There is a package using the official releases at
>> https://aur.archlinux.org/packages/monkeysign/
>
> And I just became maintainer, so it’s up-to-date now, too.

If you would like to update the link on the page, the site is running
ikiwiki, a patch or a git remote would make the update real easy!

Gabriel Pérez-Cerezo | 30 Mar 13:23 2014
Picon

Monkeysphere integration in Links2

Hello,

I have changed my plans. I have stopped working on w3m and now I'm working on Links2,
as it has much more features and is more widely used. I will write you when it is
ready.

Best wishes,
Gabriel

--

-- 
Gabriel Pérez-Cerezo Flohr
Website: http://gpcf.eu  E-mail: gabriel <at> gpcf.eu
GPG Key: D353EC69 (get it from http://gpcf.eu/key.asc)

Gabriel Pérez-Cerezo | 23 Mar 17:47 2014
Picon

libmsv licensing

Hello,

as you may know, I'm working on a fork of the w3m browser which includes monkeysphere support. I have now got a
problem with the licensing. Libmsv is licensed under the GPLv3 and w3m under the MIT license, but as it is
linked to OpenSSL, it would need a linking exception, so I have to either link the GPL code from GPL+Linking
exception code or rewrite the entire SSL code using GNUtls.

Do you think that it is better to ask someone for a linking exception or rewrite the SSL code using GNUtls?

--

-- 
Gabriel Pérez-Cerezo Flohr
Website: http://gpcf.eu  E-mail: gabriel <at> gpcf.eu
GPG Key: D353EC69 (get it from http://gpcf.eu/key.asc)

isis agora lovecruft | 3 Jul 16:50 2013
Picon

gnupg-1.1.7, a Python GnuPG wrapper, is released on PyPI


Announcing the release of a more secure Python wrapper for GnuPG on PyPI.

About this release
------------------

This is the first stable release of a module (named 'gnupg' on PyPI)[0], which
originated as a fork of python-gnupg.[1] Several problems were found with the
upstream version, including a security vulnerability triggered by unvalidated
user input, and when used within networked code, can lead to remote arbitrary
code execution. Full notes of the audit can be found in the docs/ directory of
the git repo [2] and as orgmode→html [3] in the online documentation.

The new version [4] is incompatible with the old version, though the changes
required to upgrade for software depending on the old version should be
slight. Not to mention, the module is now extensively documented,[5] and
developed openly. It was downloaded nearly 1000 times on the first day it was
uploaded to PyPI.

To install:
$ [sudo] pip install gnupg

References:
[0]: https://pypi.python.org/gnupg/
[1]: https://code.google.com/p/python-gnupg/
[2]: https://github.com/isislovecruft/python-gnupg/raw/master/docs/NOTES-python-gnupg-3.1-audit.org
[3]: http://pythonhosted.org/gnupg/NOTES-python-gnupg-3.1-audit.html
[4]: https://github.com/isislovecruft/python-gnupg/
[5]: https://pythonhosted.org/gnupg/

(Continue reading)


Gmane