Re: [Rpm-maint] [rpm-software-management/rpm] RFE: add support for multiple OpenPGP signatures per package (Issue #3385)

2024-11-07 Thread Simo Sorce
The encoding does not affect the feature for me so I have no opinion. Some PQ signatures can be big. The scheme that has the biggest signatures for now is SLH-DSA (formerly known as SPHINCS+) and the stronger variant has a signature size of 50KiB. ML-DSA's (aka Dilithium) biggest signature is ~

[Rpm-maint] [rpm-software-management/rpm] Fixes + cleanups to rpmkeys manual (PR #3433)

2024-11-07 Thread Panu Matilainen
Drop all references to pre-historical Red Hat keys, short key-ids and gpg-pubkey packages. Use the term fingerprint consistently everywhere. Add a brief explanation of the --list format and usage example for --export too. You can view, comment on, or merge this pull request online at: https://

Re: [Rpm-maint] [rpm-software-management/rpm] Use rpmkeys --list in test cases (PR #3434)

2024-11-07 Thread Florian Festi
@ffesti pushed 1 commit. 0744ee17dd9b866b6875ec97ade73d30b3b41cf8 Use rpmkeys --list in test cases -- View it on GitHub: https://github.com/rpm-software-management/rpm/pull/3434/files/e4f43ca01e35b7b48da3f2daa057171a0a12b0a6..0744ee17dd9b866b6875ec97ade73d30b3b41cf8 You are receiving this becau

Re: [Rpm-maint] [rpm-software-management/rpm] Another signature verification verbose message update (PR #3432)

2024-11-07 Thread Panu Matilainen
@pmatilai pushed 2 commits. f453b9a7f2c373dc10ab728149bfd2a44bf3914d Add "OpenPGP" to all signature verification related messages 2adcff251a5486a445eb6021c8450333f4d5c0f7 Call header+payload signatures and digests legacy -- View it on GitHub: https://github.com/rpm-software-management/rpm/pu

Re: [Rpm-maint] [rpm-software-management/rpm] Use rpmkeys --list in test cases (PR #3434)

2024-11-07 Thread Panu Matilainen
Merged #3434 into master. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/pull/3434#event-15180551362 You are receiving this because you are subscribed to this thread. Message ID: ___ Rpm-maint mail

Re: [Rpm-maint] [rpm-software-management/rpm] RFE: add support for multiple OpenPGP signatures per package (Issue #3385)

2024-11-07 Thread Panu Matilainen
> The point was not about the correctness of our implementation of base64, but that the format should have only one canonical encoding any alternate encodings being rejected. It also makes the format more reproducible. > > When incorporating existing formats, it is suggested to use a format whos

Re: [Rpm-maint] [rpm-software-management/rpm] Fixes + cleanups to rpmkeys manual (PR #3433)

2024-11-07 Thread Panu Matilainen
@pmatilai commented on this pull request. > **rpmkeys** **\--list** -More details about a specific public key, when imported, can be displayed by -querying. Here\'s information about the Red Hat GPG/DSA key: - -**rpm -qi gpg-pubkey-db42a60e** +This lists all currently imported public keys (ak

[Rpm-maint] [rpm-software-management/rpm] Use rpmkeys --list in test cases (PR #3434)

2024-11-07 Thread Florian Festi
This indeed does work with the fs backend nowadays. Since 42985d54824fc518b203aebfaf12e1daa3bb994a actually. You can view, comment on, or merge this pull request online at: https://github.com/rpm-software-management/rpm/pull/3434 -- Commit Summary -- * Use rpmkeys --list in test cases -- F

Re: [Rpm-maint] [rpm-software-management/rpm] Use rpmkeys --list in test cases (PR #3434)

2024-11-07 Thread Panu Matilainen
Updating the tests to rpmkeys is okay for sure, but we'll want to preserve the filesystem level tests. Without those, we don't actually know what the backend does or even what backend gets used, just that *something* works :sweat_smile: This already saved my a** at least once. -- Reply to thi

Re: [Rpm-maint] [rpm-software-management/rpm] Fixes + cleanups to rpmkeys manual (PR #3433)

2024-11-07 Thread Neal H. Walfield
@nwalfield commented on this pull request. Only a few small nits. Feel free to ignore. > **rpmkeys** **\--list** -More details about a specific public key, when imported, can be displayed by -querying. Here\'s information about the Red Hat GPG/DSA key: - -**rpm -qi gpg-pubkey-db42a60e** +This

Re: [Rpm-maint] [rpm-software-management/rpm] Fixes + cleanups to rpmkeys manual (PR #3433)

2024-11-07 Thread Panu Matilainen
@pmatilai commented on this pull request. > -Or alternatively: +Delete the keys in *FINGERPRINT*. For example: That's the word that was escaping me :smile: -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/pull/3433#discussion_r1832575687

Re: [Rpm-maint] [rpm-software-management/rpm] Another signature verification verbose message update (PR #3432)

2024-11-07 Thread Panu Matilainen
Rebased and conflict fixed. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/pull/3432#issuecomment-2462071930 You are receiving this because you are subscribed to this thread. Message ID:

Re: [Rpm-maint] [rpm-software-management/rpm] Fixes + cleanups to rpmkeys manual (PR #3433)

2024-11-07 Thread Panu Matilainen
@pmatilai commented on this pull request. > **rpmkeys** **\--list** -More details about a specific public key, when imported, can be displayed by -querying. Here\'s information about the Red Hat GPG/DSA key: - -**rpm -qi gpg-pubkey-db42a60e** +This lists all currently imported public keys (ak

Re: [Rpm-maint] [rpm-software-management/rpm] Another signature verification verbose message update (PR #3432)

2024-11-07 Thread Florian Festi
Merged #3432 into master. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/pull/3432#event-15180030109 You are receiving this because you are subscribed to this thread. Message ID: ___ Rpm-maint mail

Re: [Rpm-maint] [rpm-software-management/rpm] Fixes + cleanups to rpmkeys manual (PR #3433)

2024-11-07 Thread Panu Matilainen
@pmatilai pushed 1 commit. adf9eedd53d4af5384d749c5e84320ea045d8205 Fixes + cleanups to rpmkeys manual -- View it on GitHub: https://github.com/rpm-software-management/rpm/pull/3433/files/28b336dd4254b19ed604e91b01a8d0d6a43ae467..adf9eedd53d4af5384d749c5e84320ea045d8205 You are receiving this b

Re: [Rpm-maint] [rpm-software-management/rpm] Fixes + cleanups to rpmkeys manual (PR #3433)

2024-11-07 Thread Panu Matilainen
Thanks for the suggestsions, should be sorted now. I also found yet more fubar about the rpm database and headers in there, removed. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/pull/3433#issuecomment-2462109438 You are receiving this beca

Re: [Rpm-maint] [rpm-software-management/rpm] Fixes + cleanups to rpmkeys manual (PR #3433)

2024-11-07 Thread Panu Matilainen
@pmatilai commented on this pull request. > -Finally, public keys can be erased after importing just like packages. -Here\'s how to remove the Red Hat GPG/DSA key: +Write the key(s) in an ASCII-armor encoding. Also, "write" seemed lonely now that the context changed, so I replaced it with 'O

Re: [Rpm-maint] [rpm-software-management/rpm] Use rpmkeys --list in test cases (PR #3434)

2024-11-07 Thread Florian Festi
There are a couple of other test having an even more thorough look on the file system. Keeping the `find` line for the one case where there actually files to find. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/pull/3434#issuecomment-24621

[Rpm-maint] [rpm-software-management/rpm] RFE: add shorthand options for rpmkeys operations (Issue #3435)

2024-11-07 Thread Panu Matilainen
--list etc gets boring to type real fast, we should have one letter shorthands for all the major modes. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/issues/3435 You are receiving this because you are subscribed to this thread. Message ID:

Re: [Rpm-maint] [rpm-software-management/rpm] Fixes + cleanups to rpmkeys manual (PR #3433)

2024-11-07 Thread Neal H. Walfield
@nwalfield commented on this pull request. > -Finally, public keys can be erased after importing just like packages. -Here\'s how to remove the Red Hat GPG/DSA key: +Write the key(s) in an ASCII-armor encoding. Perhaps: s/in/using/ -- Reply to this email directly or view it on GitHub: https

Re: [Rpm-maint] [rpm-software-management/rpm] Fixes + cleanups to rpmkeys manual (PR #3433)

2024-11-07 Thread Panu Matilainen
@pmatilai pushed 1 commit. 6bec5fc3de53e8885a769c36b498e4b824e112df Fixes + cleanups to rpmkeys manual -- View it on GitHub: https://github.com/rpm-software-management/rpm/pull/3433/files/adf9eedd53d4af5384d749c5e84320ea045d8205..6bec5fc3de53e8885a769c36b498e4b824e112df You are receiving this b

Re: [Rpm-maint] [rpm-software-management/rpm] RFE: add support for SHA-3 (Issue #3436)

2024-11-07 Thread Panu Matilainen
AFAICS SHA-3 in rpm-sequoia depends on the [crypto-refresh](https://gitlab.com/sequoia-pgp/sequoia/-/tree/crypto-refresh) branch to land in main Sequoia first. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/issues/3436#issuecomment-24639554

[Rpm-maint] [rpm-software-management/rpm] RFE: add support for SHA-3 (Issue #3436)

2024-11-07 Thread Panu Matilainen
The [post-quantum signatures](https://github.com/openpgp-pqc/draft-openpgp-pqc/blob/main/draft-ietf-openpgp-pqc.md) are all SHA-3 based, rpm needs to recognize them. As the actual crypto comes from rpm-sequoia or rpmpgp_legacy, the rpm side of this is little more than adding a couple of enums b

Re: [Rpm-maint] [rpm-software-management/rpm] RFE: add support for SHA-3 (Issue #3436)

2024-11-07 Thread Neal H. Walfield
That's correct. We plan to add support for 9580 to sequoia-openpgp 2.0, which is due out early next year. Note: 2.0 will not include support for PQC, because it is not yet standardized. -- Reply to this email directly or view it on GitHub: https://github.com/rpm-software-management/rpm/issue