<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Hi Thorsten,<br>
<br>
<div class="moz-cite-prefix">Le 03/10/2016 à 19:30, Thorsten Wißmann
a écrit :<br>
</div>
<blockquote cite="mid:20161003173058.GB28463@ghul" type="cite">
<blockquote type="cite" style="color: #000000;">
<pre wrap=""><span class="moz-txt-citetags">> </span>Does GPG web of trust sure enough, to allow co-signing script to enable
<span class="moz-txt-citetags">> </span>such signed plugins?
</pre>
</blockquote>
<pre wrap="">I don't understand your question. But are you asking how my patch could
be extended to call only 'signed' extensions?</pre>
</blockquote>
<br>
It was, yes.<br>
I also mention the "web of trust" behavior of GPG, which nice but
complicated, just to see if some reader are involved in such
reflexion… <span class="moz-smiley-s3"><span>;-)</span></span><br>
<br>
<blockquote cite="mid:20161003173058.GB28463@ghul" type="cite">
<pre wrap="">If some bad guy has write access to some directory in $PATH and wants to
take over your password store, then the bad guy can simply add a
malicious `pass` executable and the user would not notice.</pre>
</blockquote>
<br>
Pass itself could be signed. By the user at init.<br>
I was more thinking, about installing malicious plugin, not having
malicious inside your computer.<br>
I don't think than a password manager can be used on a share system,
with shared memory or process…<br>
It is only designed to work on a personal computer. (I never though
about that before but…)<br>
<br>
<blockquote cite="mid:20161003173058.GB28463@ghul" type="cite">
<pre wrap="">I.e. I don't think `pass` should do something like signing of program
code. It's some separate problem to check if the programs in your $PATH
are trustworthy or not.</pre>
</blockquote>
<br>
I see your point, you may be right. I just emailed the reference
about signing plugins to let you know.<br>
<br>
Not tested your plugin yet…<br>
I like the logic like git or rvm.<br>
<br>
Regards,<br>
Sylvain.<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Sylvain Viart - DevOps système linux - freelance developer</pre>
</body>
</html>