Re: OpenPGP certificates with SHA-1 issues in Debian keyrings

2025-03-26 Thread Christoph Biedl
Guillem Jover wrote... > A recent dupload improvement to switch from its GnuPG based OpenPGP > verification hook to use the dpkg OpenPGP multi-backend > implementation, which as a side effect got rid of a very old code path > that was ignoring some GnuPG verification failures, resurfaced an old >

Re: OpenPGP certificates with SHA-1 issues in Debian keyrings

2025-03-24 Thread Guillem Jover
Hi! On Thu, 2025-03-20 at 22:00:04 +0100, Christoph Biedl wrote: > Being one of those on the list, I'm even more confused than I'd be about > this anyway. Ok, let me try to clarify, then! > So those people you listed: > > * Did they something wrong (although certainly with best intentions)? I

Re: OpenPGP certificates with SHA-1 issues in Debian keyrings

2025-03-23 Thread Guillem Jover
Hi! On Sun, 2025-03-23 at 18:46:37 -0400, Robert Edmonds wrote: > Guillem Jover wrote: > > Not all of these issues are equally "bad" from a Debian point of view, > > but all are probably bad for the certificate owners, as it might imply > > that people cannot verify signatures made with those cert

Re: OpenPGP certificates with SHA-1 issues in Debian keyrings

2025-03-23 Thread Robert Edmonds
Guillem Jover wrote: > Hi! > > A recent dupload improvement to switch from its GnuPG based OpenPGP > verification hook to use the dpkg OpenPGP multi-backend > implementation, which as a side effect got rid of a very old code path > that was ignoring some GnuPG verification failures, resurfaced an

Re: OpenPGP certificates with SHA-1 issues in Debian keyrings

2025-03-22 Thread Christoph Biedl
Guillem Jover wrote... > I'm happy to try to address anything that seems unclear, or get > someone else who might be able to answer! And as Holger suggested > elsewhere, we can probably also create a FAQ on the wiki with some of > this to point to people. Thanks for your explanations, things are

Re: OpenPGP certificates with SHA-1 issues in Debian keyrings

2025-03-21 Thread Jonathan McDowell
[I don't have enough time at present to fully drive this from a keyring-maint PoV, but without any hats on I thought I'd add a couple of extra bits of information.] On Fri, Mar 21, 2025 at 01:11:20AM +0100, Guillem Jover wrote: On Thu, 2025-03-20 at 22:00:04 +0100, Christoph Biedl wrote: Bein

Re: OpenPGP certificates with SHA-1 issues in Debian keyrings

2025-03-20 Thread Holger Levsen
On Thu, Mar 20, 2025 at 01:14:57PM +0100, Guillem Jover wrote: > So «certificate» should be taken as a synonym with what was previously > known as «Transferable Public Key» (or «public key»), in contrast to > a «key» which is understood as a «Transferable Secret Key» (or > «secret key»). Which shou

Re: OpenPGP certificates with SHA-1 issues in Debian keyrings

2025-03-20 Thread Guillem Jover
Hi! On Thu, 2025-03-20 at 10:55:16 +0900, Charles Plessy wrote: > sorry but I am confused... can you explain at a beginner level what is the > difference between a certificate and a "key" in the sense it is used in the > Developers Reference? Ah, sorry, the OpenPGP working group and as part of th

Re: OpenPGP certificates with SHA-1 issues in Debian keyrings

2025-03-20 Thread Stephan Verbücheln
> sorry but I am confused... can you explain at a beginner level what > is the difference between a certificate and a "key" in the sense it > is used in the Developers Reference? A certificate is a key with a name attached to it. So in the case of Debian developer's PGP keys, it means the same thin

Re: OpenPGP certificates with SHA-1 issues in Debian keyrings

2025-03-19 Thread Charles Plessy
Hi Guillem, sorry but I am confused... can you explain at a beginner level what is the difference between a certificate and a "key" in the sense it is used in the Developers Reference? Have a nice day, Charles -- Charles Plessy Nagahama, Yomitan, Okinawa, Japan Debian M