On Fri, Dec 02, 2016 at 06:38:12PM +0100, Hartmut Goebel wrote: > Hi, > > the keys for authenticating an archive currently do not hold any > comment. This makes it hard to track acls and remove certain keys if > required.
Indeed, this makes key management a little harder than it needs to be. > Please implement some way to add and change the comment on keys in > /etc/guix/ and in /etc/guix/acl. > > Proposed usage when generating the key: > guix archive --generate-key=… --comment "store.example.com" > > Proposed usage when importing the key and overwriting any existing comment > > guix archive --authorize --comment "store.example.com" > > For now, since we have no commands for key management, these would be > enough IMO. Existing commenty an easily be changed in the file, so for > now we do not need a tool for this. I think that the comment should either be signed somehow, or the field name should be "untrusted-comment". OpenBSD's signify tool (which we have a port of in Guix) does this: ------ $ cat foo.pub untrusted comment: Leo's example public key RWRrY3me0s1DYDBfpcUKZ+ul9m8FgdZfz5+cHjxBabEsvDrjL/ecTeUL ------ Minisign, which is a 3rd party tool compatible with signify, also has trusted comments: https://github.com/jedisct1/minisign/blob/master/src/manpage.md#notes
