Skip to Content.
Sympa Menu

sm-discuss - [SM-Discuss] gnupg 1.4.8 is stricter

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Jaka Kranjc <lynx AT mages.ath.cx>
  • To: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: [SM-Discuss] gnupg 1.4.8 is stricter
  • Date: Fri, 21 Dec 2007 17:11:06 +0100

Baro complained that findutils and some other spells (ghostscript-fonts-std
and ghostscript-fonts-other) suddenly fail their source verification. It was
nailed down to yesterday's update of gnupg. From their changelog [0];
> * By default (i.e. --gnupg mode), --require-cross-certification is
> now on. --rfc2440-text and --force-v3-sigs are now off.

Which causes:
> lynxlynx navaden # delve -c start PRE_BUILD findutils
> staging enabled
> Building findutils
> GPG checking source file findutils-4.2.31.tar.gz...
> gpg: Signature made Wed 30 May 2007 10:12:09 PM CEST using DSA key ID
> 13141C36
> gpg: using subkey 13141C36 instead of primary key 0F3FD5DE
> gpg: WARNING: signing subkey 13141C36 is not cross-certified
> gpg: please see http://www.gnupg.org/faq/subkey-cross-certify.html for more
> information
> gpg: Can't check signature: general error
> Failure to verify gpg signature
> Abort? [y] n
> Unpacking source file findutils-4.2.31.tar.gz for spell findutils.

We could add --no-require-cross-certification and revert the update for now.
Or do we just say that this is an increase in security, bug some packagers to
fix their keys and leave it be?
> --no-require-cross-certification
> When verifying a signature made from a subkey, ensure
> that the cross certification "back signature" on the subkey is present and
> valid. This protects against a subtle attack against subkeys that can
> sign. Defaults to --require-cross-certification for gpg.

LP

[0] http://lists.gnupg.org/pipermail/gnupg-announce/2007q4/000266.html
--
We cannot command nature except by obeying her. --Sir Francis Bacon
Have a sourcerous day! www.sourcemage.org

Attachment: signature.asc
Description: This is a digitally signed message part.




Archive powered by MHonArc 2.6.24.

Top of Page