Package: hopenpgp-tools
Version: 0.23.11-1
Severity: normal
File: /usr/bin/hokey
X-Debbugs-Cc: [email protected], [email protected]
Hello,
I maintain a company-internal keyring with the certificates of my colleagues to
populate our WKD.
The certificates are tracked in git in their canonical order as defined
by `hokey canonicalize`.
Now I have with hokey 0.23.11-1 (and thus libghc-hashable-dev
1.4.4.0-1+b1):
hokey canonicalize < 7E845B82AD0A1E93 > 7E845B82AD0A1E93.canon
hokey (hopenpgp-tools) 0.23.11
Copyright (C) 2012-2023 Clint Adams
hokey comes with ABSOLUTELY NO WARRANTY. This is free software, and you
are welcome to redistribute it under certain conditions.
$ sha256sum baylibre-keyring/7E845B82AD0A1E93
baylibre-keyring/7E845B82AD0A1E93.canon
048d5a50c05562d219b4ed47d631810a4dc1f376d51e97c16c379e2923b08eb5
7E845B82AD0A1E93
048d5a50c05562d219b4ed47d631810a4dc1f376d51e97c16c379e2923b08eb5
7E845B82AD0A1E93.canon
So as expected the cert file doesn't change on canonicalizing again.
However if my colleague Clément (on Cc), who is using Arch btw, does the
same with hokey 0.23.11 linked against hashable 1.4.7.0, he gets:
$ sha256sum baylibre-keyring/7E845B82AD0A1E93
baylibre-keyring/7E845B82AD0A1E93.canon
048d5a50c05562d219b4ed47d631810a4dc1f376d51e97c16c379e2923b08eb5
7E845B82AD0A1E93
255da847cfeb96a6bb47624e83e9310183e3bd0a021f903c5d8de65e9a3c6085
7E845B82AD0A1E93.canon
.
Clément worked out the reason (with the help of Claude, so take it with
a grain of salt given that we're not fluent in Haskell):
Packet ordering bases on comparing hashes
(Codec/Encryption/OpenPGP/Types.hs, `instance Ord Pkt`) and canonicalize
sorts using that Ord instance. Now hashable changed byte hashing in
https://github.com/haskell-unordered-containers/hashable/pull/301 and
thus canonicalization changed.
IMHO canonicalization shouldn't depend on an (unstable) hashing
algorithm. It should at least be documented that canonicalization is
unstable, or better, canonicalization should be fixed to be independent
of hashing.
Best regards
Uwe
-- System Information:
Debian Release: 13.5
APT prefers stable-updates
APT policy: (750, 'stable-updates'), (750, 'stable-security'), (750,
'stable-debug'), (750, 'stable'), (700, 'oldstable-security'), (700,
'oldstable-debug'), (700, 'oldstable'), (600, 'unstable'), (500,
'unstable-debug'), (500, 'testing-debug'), (500, 'proposed-updates'), (500,
'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: arm64
Kernel: Linux 7.1.3+deb14-amd64 (SMP w/22 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages hopenpgp-tools depends on:
ii libbz2-1.0 1.0.8-6
ii libc6 2.42-17
ii libffi8 3.4.8-2
ii libgmp10 2:6.3.0+dfsg-3
ii libnettle8t64 3.10.2-1+b1
ii libnuma1 2.0.19-1
ii libyaml-0-2 0.2.5-2
ii zlib1g 1:1.3.dfsg+really1.3.1-1+b1
hopenpgp-tools recommends no packages.
hopenpgp-tools suggests no packages.
-- no debconf information
