Automatic printer driver download should support signed packages

Attached is a patch which also accepts signed packages from the OpenPrinting web server.

I have packaged up Jockey with the patches for this bug and bug 574396 applied. The debdiff for this package is attached. Can someone of the core developers please upload this package? Thanks.

Please note that this patch is insufficient. It merely filters requests for signed packages, but it does nothing to actually download the keys and install them into apt, so that the signatures will actually be verified.

Attached is an updated debdiff.

As currently Jockey installs all packages, regardless whether they have a known signature or not, we restrict the acceptance of signed packages to manufacturers who actually have uploaded signed packages to OpenPrinting, currently only Epson. In Natty we will add real support for signed packages.

Sorry, last debdiff was wrong, here is the correct one.

Note that this patch still doesn't do anything about actually fetching and installing the Epson key, so we still don't get any verification of the added archive. Also, the bug title/scope is much broader and applies to all printer drivers. This is definitively out of scope for Maverick, so I unset the milestone.

We need to discuss whether we should just ship the Epson key with the Jockey package, but that'd break as soon as the key gets changed.

Either we'd need to always install the Epson key on all systems (which would be a bit overkill), or we need to ship a local "EpsonPrinterDriverHandler" handler which wraps this Epson case and on installation also installs the GPG key. However, the change for bug 574396 just made that impossible, we'd need to revert the speedup hack again.

unsubscribing the sponsors since the bug seems to still need discussion

Fix needs to be implemented as described in the blueprint

https://blueprints.launchpad.net/ubuntu/+spec/packageselection-desktop-n-automatic-printer-driver-download-should-support-signed-packages

This bug was fixed in the package jockey - 0.7-0ubuntu1

---------------
jockey (0.7-0ubuntu1) natty; urgency=low

  * New upstream release:
    - Add support for repository fingerprints, and retrieve them from
      openprinting.org when available.
    - Allow binary drivers if they have a valid GPG fingerprint on a trusted
      https:// site. This is a lot weaker than our usual archive trust chain,
      but as it's very hard to get a chain of trust to printer driver vendors,
      relying on good SSL certificates is the next best step, and still much
      better than what the average user does when searching and downloading a
      driver by himself.
    - Add API for retrieving and installing a GPG key based on a fingerprint.
    - Merge add_repository() into install_package(), which is much more
      practical for verifying whether a package in a new repository ist
      trustworthy.
  * jockey/oslib.py, tests/oslib.py: Update for merged add_repository(), and
    implement GPG retrieval and repository trust checking. This now provides
    secure binary third-party drivers. (LP: #604698)
  * tests/oslib.py, test_ubuntu_package_header_modaliases(): Fix typo in
    regular expression which didn't catch "fglrx" before.
  * data/handlers/fglrx.py, data/handlers/nvidia.py: Disable these two
    handlers in a live system environment (if /rofs exists). We will most
    likely run out of RAM trying to download, build, and install all the
    packages in the RAM disk. (LP: #685017)
 -- Martin Pitt <email address hidden> Thu, 06 Jan 2011 19:13:24 +0100