Public SourceMage Discussion List

[Jaka Kranjc <lynx AT mages.ath.cx>]

Baro complained that findutils and some other spells (ghostscript-fonts-std 
and ghostscript-fonts-other) suddenly fail their source verification. It was 
nailed down to yesterday's update of gnupg. From their changelog [0];
>     * By default (i.e. --gnupg mode), --require-cross-certification is
>       now on.  --rfc2440-text and --force-v3-sigs are now off.

Which causes:
> lynxlynx navaden # delve -c start PRE_BUILD findutils
> staging enabled
> Building findutils
> GPG checking source file findutils-4.2.31.tar.gz...
> gpg: Signature made Wed 30 May 2007 10:12:09 PM CEST using DSA key ID
> 13141C36 
> gpg: using subkey 13141C36 instead of primary key 0F3FD5DE 
> gpg: WARNING: signing subkey 13141C36 is not cross-certified
> gpg: please see http://www.gnupg.org/faq/subkey-cross-certify.html for more
> information
> gpg: Can't check signature: general error 
> Failure to verify gpg signature
> Abort? [y] n
> Unpacking source file findutils-4.2.31.tar.gz for spell findutils.

We could add --no-require-cross-certification and revert the update for now. 
Or do we just say that this is an increase in security, bug some packagers to 
fix their keys and leave it be?
>        --no-require-cross-certification
>               When  verifying  a  signature  made  from a subkey, ensure
> that the cross certification "back signature" on the subkey is present and
> valid. This protects  against  a  subtle attack  against  subkeys  that can
> sign. Defaults to --require-cross-certification for gpg.

LP

[0] http://lists.gnupg.org/pipermail/gnupg-announce/2007q4/000266.html
-- 
We cannot command nature except by obeying her.  --Sir Francis Bacon
Have a sourcerous day! www.sourcemage.org

Attachment: signature.asc
Description: This is a digitally signed message part.