Better handle certificates where old self signatures are stripped #47
Conversation
|
Regardless of what ultimately gets done about the issue with gpg stripping old self-signatures, this much seems absolutely necessary to let people upgrade away from affected packages. Such as https://bugzilla.redhat.com/show_bug.cgi?id=2215440 So my 👍 for this. |
- If a certificate is not valid when a package signature is made,
but is valid now, detect this and return `NotTrusted`.
- This happens when old self signatures have been stripped.
Consider a certificate `C` that expires `te`. It is used to sign
a package `P` at `t0`, where `t0 < te`. At `t1`, where `t1 > t0`,
`C`'s expiration is extended. It now has two self signatures.
When `C` is exported using `gpg --export`, `gpg` strips old self
signatures, which results in the certificate `Ce`. When rpm tries
to verify the package's signature using `Ce`, the certificate
cannot be canonicalized at `t0`, because the self signature that
was valid at time `t0` was stripped.
- See #46
|
I improved the commit message, but the code is the same. |
Thanks for the feedback. |
|
@nwalfield , are you planning to do a new release with this fix in it, or should we just patch it in Fedora for the time being? It's not a problem either way, just checking. |
|
I can do a release today. |
|
Awesome, thanks! |
If a certificate is not valid when a packet signature is made, but is valid now, detect this and return
NotTrusted. This happens when old self signatures are stripped.Fixes Relax "No binding signature" #46