Re: [openpgp] Stop dragging around old material, please!

[Daniel Huigens <[e-mail]>]

Hi Neal,

I see, that's a shame. But thanks for the information, I'm not
super familiar with the code signing side of OpenPGP, so I didn't
think of that, indeed.

Best,
Daniel


------- Original Message -------
On Thursday, November 17th, 2022 at 22:42, Neal H. Walfield <[e-mail]> wrote:

> Hi Daniel,
> 

> On Thu, 17 Nov 2022 16:30:42 +0100,
> Daniel Huigens wrote:
> 

> > I just wanted to say that I didn't mean to dismiss your point of view,
> > and actually I agree with trying to get rid of legacy stuff. I'm not
> > sure if it's possible in this particular case but that doesn't mean
> > that it's not worth discussing, IMO.
> > 

> > There are in fact some things in the spec that I think implementations
> > can get away with not implementing; V3 keys and signatures being one
> > of them (we haven't supported it for quite a while).
> 

> 

> A small comment: we just added support for v3 signatures to Sequoia
> due to their prevalence in the rpm world as discussed in
> https://bugzilla.redhat.com/show_bug.cgi?id=2141686. This comment by
> the maintainer of rpm summarizes the situation:
> 

> So, basically everything signed by obs-signd is affected as it
> defaults to OpenPGP v3 signatures. And that being used by OBS and
> multiple other places for signing rpms, this affects at least
> 

> - opensuse (and so presumably their enterprise offerings too but can't verify that)
> - copr
> - rpmfusion
> 

> I don't know what RHEL is signed with, but packages in RHEL 7-9
> (didn't bother with older) are signed using OpenPGP V3 signatures
> too.
> 

> So there really is only one conclusion to make: this is a no-go
> until Sequoia adds support for verifying V3 signatures. Or the world
> catches up, which is going to be years before all relevant content
> signed with V3 has gone dropped out of relevance, even if everybody
> started just now.
> 

> FWIW, Fedora itself and also Mageia appear to have V4 signatures, at
> least as of current versions.
> 

> https://bugzilla.redhat.com/show_bug.cgi?id=2141686#c23
> 

> Neal