def import_files_from(conf, incoming_dir):
    '''
    Import files from an untrusted incoming source.

    IMPORTANT: We assume that the uploader can not edit their files post-upload.
    If they could, we would be vulnerable to timing attacks here.
    '''

    emitter = EventEmitter(LkModule.RUBICON)
    for dud_file in glob(os.path.join(incoming_dir, '*.dud')):
        dud = Dud(dud_file)

        try:
            dud.validate(keyrings=conf.trusted_gpg_keyrings)
        except Exception as e:
            reason = 'Signature validation failed: {}'.format(str(e))
            reject_upload(conf, dud, reason, emitter)
            continue

        # if we are here, the file is good to go
        accept_upload(conf, dud, emitter)