GeezerVison is showing github.com — README rsa key example is flagged by security scanners · Issue #1820 · gitpython-developers/GitPython
README rsa key example is flagged by security scanners #1820Activitychanged the title [-]Readme rsa key example is flagged by security scanners[/-] [+]README rsa key example is flagged by security scanners[/+] on Feb 13, 2024Byron commented on Feb 13, 2024 Thanks for bringing this up!
Definitely, let's replace it, and a PR is definitely welcome. EliahKagan commented on Feb 13, 2024 Should the How to verify a release (DEPRECATED) section of the README, of which that RSA key is a part, be kept any longer?
It's been marked as deprecated for a while. Are the instructions in it possible to use? If its inclusion is only historical, then it could probably be replaced with a brief note at the end of the preceding section linking somewhere like gitpython-developers/gitdb#77, which is where the deprecation notice links. However, I notice gitpython-developers/gitdb#77 is still open, and from gitpython-developers/gitdb#77 (comment) I am not sure what, if anything, makes sense to do with it now.
Definitely, let's replace it, and a PR is definitely welcome.
If the fingerprint is to be replaced with a placeholder, then should the suffix shown in the gpg --edit-key command likewise be replaced? If so, and the instructions were possible to follow, then they will cease to be possible to follow unless elaboration is added.
|
gpg --edit-key 4C08421980C9 |
Byron commented on Feb 13, 2024 It's true - for some reason I was thinking the offending text must be in a source file, but instead it's in a README that tries to explain how to validate a signature.
The public key is also stored in release-verification-key.asc, and it seem to not be the same key anymore as in the line 248, but I am unsure about all of it since I don't think it's in use anymore.
Probably it's fine to remove the section entirely even as a quick fix if its applicability can indeed be doubted, which is faster than fixing it for dubious value. marcm-ml commented on Feb 14, 2024 ContributorAuthor More actions Would you want me to make a PR removing the problematic/deprecated section? Reacted by Sebastian Thiel Byron commented on Feb 14, 2024 Yes, that seems like the right thing todo. Thank you. marcm-ml commented on Feb 15, 2024 ContributorAuthor More actions Just out of curiosity, when would you plan the next release which contains the updated README? EliahKagan commented on Feb 15, 2024 Byron commented on Feb 15, 2024
Just out of curiosity, when would you plan the next release which contains the updated README?
I will try to create a new release tonight - a lot has changed since the last release so it seems worth it.
Should the existing release-verification-key.asc, mentioned in #1820 (comment), be removed too?
I would keep it as it probably still can used to verify older release for those who are into it. Those who are interested in verifying signatures will probably know how to use it as well.
With that said, I am sure it will be removed eventually, and I wouldn't even object to a PR that removes it right away either.
Also, should gitpython-developers/gitdb#77 in gitdb be considered resolved by the combination of the verification instructions having been deprecated and their removal in #1823? I ask because gitpython-developers/gitdb#77 had been the readme-linked issue documenting the deprecation, and it doesn't look like there's any recent publicly expressed interest in trying to bring back that kind of verification procedure.
That's a good point! I will close it with reference to this conversation. EliahKagan commented on Feb 20, 2024
I will try to create a new release tonight
In case it comes up and people find this by searching, note that the CI check failure on the release commit 1f37b48 is not related to this or any other changes that went into 3.1.42, it is just an intermittent failure due to #1676 and it does not reflect a problem in the GitPython library.
I would keep it [...] With that said, I am sure it will be removed eventually [...]
This can probably be done at the same time as #1708 -- see #1708 (reply in thread) and #1716 (comment) -- if it doesn't end up being removed before then. That should bring attention back to it even if it has been forgotten.
That's a good point! I will close it with reference to this conversation.
That issue, gitpython-developers/gitdb#77, is still open, which seems like it may be unintentional.
MetadataMetadataDevelopmentNo branches or pull requestsIssue actions
|