{"action":"created","issue":{"url":"https://api.github.com/repos/AppImage/AppImageUpdate/issues/16","repository_url":"https://api.github.com/repos/AppImage/AppImageUpdate","labels_url":"https://api.github.com/repos/AppImage/AppImageUpdate/issues/16/labels{/name}","comments_url":"https://api.github.com/repos/AppImage/AppImageUpdate/issues/16/comments","events_url":"https://api.github.com/repos/AppImage/AppImageUpdate/issues/16/events","html_url":"https://github.com/AppImage/AppImageUpdate/issues/16","id":268761686,"number":16,"title":"Check the gpg signature when updating","user":{"login":"pamarcos","id":3248441,"avatar_url":"https://avatars3.githubusercontent.com/u/3248441?v=4","gravatar_id":"","url":"https://api.github.com/users/pamarcos","html_url":"https://github.com/pamarcos","followers_url":"https://api.github.com/users/pamarcos/followers","following_url":"https://api.github.com/users/pamarcos/following{/other_user}","gists_url":"https://api.github.com/users/pamarcos/gists{/gist_id}","starred_url":"https://api.github.com/users/pamarcos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pamarcos/subscriptions","organizations_url":"https://api.github.com/users/pamarcos/orgs","repos_url":"https://api.github.com/users/pamarcos/repos","events_url":"https://api.github.com/users/pamarcos/events{/privacy}","received_events_url":"https://api.github.com/users/pamarcos/received_events","type":"User","site_admin":false},"labels":[{"id":556076791,"url":"https://api.github.com/repos/AppImage/AppImageUpdate/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/AppImage/AppImageUpdate/milestones/1","html_url":"https://github.com/AppImage/AppImageUpdate/milestone/1","labels_url":"https://api.github.com/repos/AppImage/AppImageUpdate/milestones/1/labels","id":2871192,"number":1,"title":"rewrite","description":null,"creator":{"login":"TheAssassin","id":4503202,"avatar_url":"https://avatars3.githubusercontent.com/u/4503202?v=4","gravatar_id":"","url":"https://api.github.com/users/TheAssassin","html_url":"https://github.com/TheAssassin","followers_url":"https://api.github.com/users/TheAssassin/followers","following_url":"https://api.github.com/users/TheAssassin/following{/other_user}","gists_url":"https://api.github.com/users/TheAssassin/gists{/gist_id}","starred_url":"https://api.github.com/users/TheAssassin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TheAssassin/subscriptions","organizations_url":"https://api.github.com/users/TheAssassin/orgs","repos_url":"https://api.github.com/users/TheAssassin/repos","events_url":"https://api.github.com/users/TheAssassin/events{/privacy}","received_events_url":"https://api.github.com/users/TheAssassin/received_events","type":"User","site_admin":false},"open_issues":6,"closed_issues":20,"state":"open","created_at":"2017-10-28T03:54:21Z","updated_at":"2018-02-24T14:38:43Z","due_on":null,"closed_at":null},"comments":19,"created_at":"2017-10-26T13:33:40Z","updated_at":"2018-03-03T09:54:31Z","closed_at":null,"author_association":"NONE","body":"This issue is created just for reference so that this is not forgotten.\r\n\r\nAt the moment, the gpg_check method is commented out as you can see in the current implementation:\r\n\r\n```\r\ngpg_check()\r\n{\r\n  set +e\r\n  if [ \"$(which gpg_currently_disabled)\" != \"\" ] ; then\r\n    echo \"GPG is installed; hence attempting signature verification\"\r\n    ASC_URL=$( echo \"${ZSYNC_URL}\" | sed -e 's|.zsync|.asc|g' )\r\n    # curl -k -L -O -# \"${ASC_URL}\" && gpg --verify $(basename \"${ASC_URL}\") && echo \"Signature verified\"\r\n  else\r\n    echo \"GPG is not installed; hence skipping signature verification\" >&2\r\n  fi\r\n  set -e\r\n}\r\n```\r\n\r\nAfter reading https://github.com/AppImage/AppImageKit/issues/238, I came up with the following solution:\r\n\r\n```\r\ngpg_check()\r\n{\r\n  set +e\r\n  if [[ \"$(which gpg2)\" != \"\" && \"$(which validate)\" != \"\" ]]; then\r\n    echo \"GPG is installed; hence attempting signature verification\"\r\n    validate \"${ISO}\"\r\n\r\n    if [[ $? -eq 0 ]]; then\r\n      echo \"GPG signature verified\"\r\n    else\r\n      echo \"GPG verification failed. Please close and retry\"\r\n      mv -f \"${ISO}.zs-old\" \"${ISO}\"\r\n      exit 1\r\n    fi\r\n  else\r\n    echo \"GPG is not installed; hence skipping signature verification\" >&2\r\n  fi\r\n  set -e\r\n}\r\n```\r\n\r\nAll that's needed is to include the `validate` binary into the PATH so that `appimageupdate` can run it. In my case, I created a self update-able AppImage adding those two plus `appimageupdategui` and `zsync_curl`."},"comment":{"url":"https://api.github.com/repos/AppImage/AppImageUpdate/issues/comments/370135236","html_url":"https://github.com/AppImage/AppImageUpdate/issues/16#issuecomment-370135236","issue_url":"https://api.github.com/repos/AppImage/AppImageUpdate/issues/16","id":370135236,"user":{"login":"probonopd","id":2480569,"avatar_url":"https://avatars3.githubusercontent.com/u/2480569?v=4","gravatar_id":"","url":"https://api.github.com/users/probonopd","html_url":"https://github.com/probonopd","followers_url":"https://api.github.com/users/probonopd/followers","following_url":"https://api.github.com/users/probonopd/following{/other_user}","gists_url":"https://api.github.com/users/probonopd/gists{/gist_id}","starred_url":"https://api.github.com/users/probonopd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/probonopd/subscriptions","organizations_url":"https://api.github.com/users/probonopd/orgs","repos_url":"https://api.github.com/users/probonopd/repos","events_url":"https://api.github.com/users/probonopd/events{/privacy}","received_events_url":"https://api.github.com/users/probonopd/received_events","type":"User","site_admin":false},"created_at":"2018-03-03T09:54:31Z","updated_at":"2018-03-03T09:54:31Z","author_association":"OWNER","body":"> we could bundle some \"known good\" keys in a keyring\r\n\r\nThis is where the \"web of trust\" idea comes in, so that we don't have to decide which keys to include. To be honest, I'd rather like to see the keyring part in the distribution. They already today decide which keys to ship by default, and users are always free to add extra keys."}}
{"actor":{"display_login":"probonopd"}}