-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 8713 day of my life David Steuber wrote:
> I'm trying out asdf-install which seems really cool. However, I keep
> getting kicked into the debugger (I'm just running sbcl directly)
> because of this:
>
> debugger invoked on a ASDF-INSTALL::KEY-NOT-TRUSTED in thread 9035:
> GPG warns that the key id 0x112ECDF2C4A3823E (Kevin M. Rosenberg <kmr@...>) is not fully trusted
Key is not trusted: you do not know if it was created by Kevin
M. Rosenberg or someone else. PGP/GPG uses Web-Of-Trust model, and
there are no "trusted authorities" such as VeriSign.
Key may be trusted if it is signed by your key or someone by key of
someone else whom you trust.
> You can type HELP for debugger help, or (SB-EXT:QUIT) to exit from SBCL.
>
> restarts (invokable by number or by possibly-abbreviated name):
> 0: [CONTINUE ] Install the package anyway
> 1: [SKIP-GPG-CHECK] Don't check GPG signature for this package
> 2: [ABORT ] Reduce debugger level (leaving debugger, returning to
> toplevel).
> 3: [TOPLEVEL ] Restart at toplevel READ/EVAL/PRINT loop.
> (ASDF-INSTALL::VERIFY-GPG-SIGNATURE/STRING
> "-----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.3 (GNU/Linux)
>
> iD8DBQA/ldOcES7N8sSjgj4RAuGIAJsHxxP7mKT4UBRR5NBlPj3r1lXBPACbBqPF
> xaY8l9KsSuYeQG0sxoLlVDI=
> =MR+C
> -----END PGP SIGNATURE-----
> "
> #P"/home/david/usr/src/sbcl/CL-MODLISP.asdf-install-tmp")
> 0] 3
asdf-install doesn't want install such package (without signed key)
without your explisit permission. So, if you really want install it,
you can choose 0.
> What do I have to do to avoid being kicked into the debugger? I know
> that I can just continue anyway, but I would like to avoid having to
> do this step if I can.
You can sign key (prefferably, locally: you signature is not exported.
You must not make exportable signature for Kevin's key before you
carefully checked that key really belongs to him.).
Avoiding falling into debugger for every package is security problem.
Don't forget that asdf-install works with Cliki and everyone can edit
any page...
> I've never used gpg before and the man page is very long :-(
There is GNU Privacy Handbook at <http://www.gpg.org>.
- --
Ivan Boldyrev
Your bytes are bitten.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.3.5 (GNU/Linux)
iQEVAwUBQHtelg4ALcwzZFpVAQKBCwf/Wh4dvxy5cu811thhmla9Ts82CyGucM7P
hjp/MQcep8D2F9V6+uwpcGDYbO53oyPyehG0ddDg+zteQmwaWcXcqlr1O4gHuZ3a
sKQgc6p2j1EyMiYG9LlWA5GeRsaUAcE7bgoeo3f3uPfHY065vnEQ+nwgr6pGVthN
pPq4qzqERzxDAtHYHAEU5lVP3dptGF7hjQ5Ishpi/DWKkEFxfWxZ4dsxytnNn9xW
QU6NYK2brWQ65po8dOPS5ofN0UB69m/BtwfOpCw+YroYNHTMR97H6T2ODdXC9WdC
PpbpqpzUn4hn71U9CP1mp9oV53IftGn2BRCk9ec/YGQlLnolWCOdSA==
=hbS9
-----END PGP SIGNATURE-----
|