Installing Mercurial on MacOS Big Sur

[Noel Duffy]

> On 17/02/2021, at 16:01, Augie Fackler <raf at durin42.com> wrote:
> 
> 
> 
>> On Feb 16, 2021, at 4:06 AM, Noel Duffy via Mercurial <mercurial at mercurial-scm.org> wrote:
>> 
>> 
>> 
>>> On 16/02/2021, at 21:18, Johannes <hguser at bbe-moldaenke.de> wrote:
>>> 
>>> Noel Duffy asked:
>>>> So, for Big Sur, what’s the best option to get Mercurial installed
>>>> with proper verification of the source?
>>> 
>>> I'm not sure about the best way. But because you mentioned living on
>>> the command line one option is to install Python (they have GPG signed
>>> downloads) and then just
>>> 
>>>  pip install mercurial
>>> 
>>> or if pip isn't included download some version of pip and copy it to
>>> site-packages and then
>>> 
>>>  python -m pip install mercurial
>> 
>> But that just moves the problem. Pip does not support signing or verifying packages, as far as I am aware.
> 
> pip fetches from pypi.org, verified via TLS. If you trust PyPI, you can trust the archives up there.

I most emphatically don’t trust PyPI. I never use it to install anything, ever. There are few if any restrictions on what gets uploaded there.

> Those archives _are_ gpg-signed, and though pip doesn’t verify them you also can’t reuse the same version number on PyPI, so you could separately download the archive, verify the signature, and then let pip do its thing.

The signature that accompanies mercurial-5.7.tar.gz on mercurial-sim.org has this key id:

% gpg --verify mercurial-5.7.tar.gz.asc
gpg: assuming signed data in 'mercurial-5.7.tar.gz'
gpg: Signature made Wed  3 Feb 07:18:20 2021 NZDT
gpg:                using RSA key 818D87CD1AC180C394C86E633A33DE460D9EC39F
gpg: Can't check signature: No public key

After a bit of digging I found this:

% gpg --keyserver hkp://pool.sks-keyservers.net --search-keys 818D87CD1AC180C394C86E633A33DE460D9EC39F
gpg: data source: http://50.242.82.152:11371
(1)	Pulkit Goyal <7895pulkit at gmail.com>
	  4096 bit RSA key 3A33DE460D9EC39F, created: 2021-01-17

The name and address match commits seen on the public lists. So I’m happy enough to build from this release tarball.

I think it would be good if there was some text on mercurial-scm.org’s download page telling users where to get the key and how to verify the signature on the repository. A sha256 or sha512 checksum would also help.

> (If you’re worried about a trusting-trust attack, there’s probably more steps you need to do, but I’m not sure it’s super worthwhile beyond a thought exercise if you’re on macOS…)

Even a sha256 or sha512 checksum of the tarball would offer some assurance that what was released matches what the release manager created. It’s not infallible, I know, as the whole SolarWinds debacle showed, but the days of downloading and running stuff from anywhere on the internet are over.