{"action":"created","issue":{"url":"https://api.github.com/repos/ulif/diceware/issues/18","repository_url":"https://api.github.com/repos/ulif/diceware","labels_url":"https://api.github.com/repos/ulif/diceware/issues/18/labels{/name}","comments_url":"https://api.github.com/repos/ulif/diceware/issues/18/comments","events_url":"https://api.github.com/repos/ulif/diceware/issues/18/events","html_url":"https://github.com/ulif/diceware/pull/18","id":148776130,"number":18,"title":"Added gpg verification","user":{"login":"heartsucker","id":3998464,"avatar_url":"https://avatars.githubusercontent.com/u/3998464?v=3","gravatar_id":"","url":"https://api.github.com/users/heartsucker","html_url":"https://github.com/heartsucker","followers_url":"https://api.github.com/users/heartsucker/followers","following_url":"https://api.github.com/users/heartsucker/following{/other_user}","gists_url":"https://api.github.com/users/heartsucker/gists{/gist_id}","starred_url":"https://api.github.com/users/heartsucker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/heartsucker/subscriptions","organizations_url":"https://api.github.com/users/heartsucker/orgs","repos_url":"https://api.github.com/users/heartsucker/repos","events_url":"https://api.github.com/users/heartsucker/events{/privacy}","received_events_url":"https://api.github.com/users/heartsucker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-04-15T21:39:56Z","updated_at":"2016-04-16T13:28:02Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/ulif/diceware/pulls/18","html_url":"https://github.com/ulif/diceware/pull/18","diff_url":"https://github.com/ulif/diceware/pull/18.diff","patch_url":"https://github.com/ulif/diceware/pull/18.patch"},"body":"Note:\r\n- The tests are now very slow because `gpg` keys are scoped to `function`\r\n- Unhandled exception that blows up when verification fails (make nice error message?)\r\n\r\nCloses #10 "},"comment":{"url":"https://api.github.com/repos/ulif/diceware/issues/comments/210814954","html_url":"https://github.com/ulif/diceware/pull/18#issuecomment-210814954","issue_url":"https://api.github.com/repos/ulif/diceware/issues/18","id":210814954,"user":{"login":"ulif","id":3747091,"avatar_url":"https://avatars.githubusercontent.com/u/3747091?v=3","gravatar_id":"","url":"https://api.github.com/users/ulif","html_url":"https://github.com/ulif","followers_url":"https://api.github.com/users/ulif/followers","following_url":"https://api.github.com/users/ulif/following{/other_user}","gists_url":"https://api.github.com/users/ulif/gists{/gist_id}","starred_url":"https://api.github.com/users/ulif/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ulif/subscriptions","organizations_url":"https://api.github.com/users/ulif/orgs","repos_url":"https://api.github.com/users/ulif/repos","events_url":"https://api.github.com/users/ulif/events{/privacy}","received_events_url":"https://api.github.com/users/ulif/received_events","type":"User","site_admin":false},"created_at":"2016-04-16T13:28:02Z","updated_at":"2016-04-16T13:28:02Z","body":"Thank you @heartsucker for your reply. I appreciate your input.\r\n\r\nUnfortunately I am still not convinced. The changes have much more impact on the whole package as you might be aware of.\r\n\r\nRight now I am not able to finish a single test run on my machine. Looks like there is some (`gpg`-related) deadlock. Yet I cannot tell what the exact reason is. It would probably have been faster to pregenerate keys for testing instead of doing that during testruns, but this seems not to be the reason for the tests hanging on my machine. Maybe my (special) gpg config is messing something up? Or some gpg-agent? Or my gpg version? Are both, gnugpg 1 and 2 supported?\r\n\r\nThe `gnupg` dependency also means, among other things: no official support for Python3.2, Python3.5 any more. It means (at least for testing) that we depend on a completely installed gpg.\r\n\r\nFor verifying I would, BTW, not use a script with piping, I would simply run:\r\n\r\n    $ gpg --verify path-to-wordlists-dir/wordlist_en_securedrop.asc\r\n\r\nThat's not very complicated (given, I have `gpg` installed already. And I imported the key before. Oh, yes, and I edited the trust parameters of it). If I want to get the path automatically, I would do:\r\n\r\n    $ gpg --verify `diceware --help | tail -1`/wordlist_en_securedrop.asc\r\n\r\nWouldn't it be easier to tell users about this possibility?\r\n\r\nRegarding the hashes-are-more-complicated-than-public-keys argument: I do not share it. Not as long as \"public key\" means \"gnupg\" (which I like, but it is still not simple to use, it is really not). \r\n\r\nI can sign any list of hashes by a single public key. No need to import, trustify, etc. different keys for different lists separately. No need to install `gpg`, only to get at least a basal verification. And I can put the key and all hashes on a webpage, doing the same thing you suggest for any public key. Just do the things, package mantainers do. And do it the way, they do it for decades.\r\n\r\nBut the main point for me currently is: as the \"nothing-seriously-changes\" assumption apparently does not hold even for my first local test run, I think this one needs more work.\r\n\r\nI therefore suggest to put the changes in a separate branch, at least until I can sort out what currently breaks the tests on my machine. Okay?\r\n\r\n@heartsucker : I sincerely hope, you could live with that, as I really appreciate your input, code-wise and argument-wise.\r\n"}}