apt/methods/gpgv.cc, branch 2.9.17Debians commandline package managerhttps://git.kalnischkies.de/apt/atom?h=2.9.172024-12-07T14:14:34Zmethods/gpgv: Remove apt-key mentions2024-12-07T14:14:34ZJulian Andres Klodejak@debian.org2024-12-07T14:07:35Zurn:sha1:2bb8a2c71c12063e52220c3a3839e063f11a319dDetect working gpgv using gpgv --dump-options2024-11-28T18:01:36ZJulian Andres Klodejak@debian.org2024-11-28T08:55:57Zurn:sha1:86f8353ce7a343db7b19422db0d37379ac45ff4e
This gains us support for not using an absolute path, which
is nice, and we can now cache the invocation across fork() in
the method.
Still keep preferring absolute paths, this avoids execvp() having
to iterate the path and reduces bug potential with custom gpgv in
/usr/local.
Fix the last entry in the list of gpgvs to say gpgv1
Do not implode key file name vector for calling gpgv2024-11-28T09:17:21ZJulian Andres Klodejak@debian.org2024-11-23T16:45:11Zurn:sha1:0e69c1fa5b8a4a1237933fa47113ea839a66f8a0
Converting it to a comma-separated string and back loses precision.
Only revoke weak RSA keys for now, add 'next' and 'future' levels2024-07-15T17:17:55ZJulian Andres Klodejulian.klode@canonical.com2024-07-15T17:13:58Zurn:sha1:47deb766c0a11c54d122197531279677545459af
Algorithms not in the next level give a warning, algorithms
in not in the future level introduce an audit message for
the --audit flag.
next: >=rsa2048,ed25519,ed448,nistp256,nistp384,nistp512
future: >=rsa3072,ed25519,ed448
LP: #2073126
gpgv: Add a LaterWorthless level, a SoonWorthless but at 'audit' level2024-07-15T17:17:04ZJulian Andres Klodejulian.klode@canonical.com2024-07-15T15:58:08Zurn:sha1:04cb5104a018184fe1fac114cbc212a9395d6845Revert "Temporarily downgrade key assertions to "soon worthless""2024-04-09T17:59:52ZJulian Andres Klodejulian.klode@canonical.com2024-04-09T17:56:26Zurn:sha1:81c65f7e86b8f16eaaa91d9c205a594b0ebde159
We temporarily downgraded the errors to warnings to give the
launchpad PPAs time to be fixed, but warnings are not safe:
Untrusted keys could be hiding on your system, but just not
used at the moment. Hence revert this so we get the errors we
want.
This reverts commit 66998ed3d299bede651ad40368bdb270f5f5b0f9.
LP: #2060721
Gbp-Dch: full
Temporarily downgrade key assertions to "soon worthless"2024-02-28T17:22:01ZJulian Andres Klodejulian.klode@canonical.com2024-02-28T16:04:05Zurn:sha1:66998ed3d299bede651ad40368bdb270f5f5b0f9
This will only issue warnings instead of errors while we continue
cleaning up our repositories.
Rename 'weak digest algorithm' to 'weak algorithm'2024-02-28T17:22:01ZJulian Andres Klodejulian.klode@canonical.com2024-02-28T15:52:33Zurn:sha1:8a14c18c5b487139948dcb22abd37bffdd9cf5f4
This allows us to render public key algorithms as weak as well.
Implement gpgv --assert-pubkey-algo=>=rsa2048,ed25519,ed4482024-02-28T17:22:01ZJulian Andres Klodejulian.klode@canonical.com2024-02-28T14:14:43Zurn:sha1:50e3fee26ae843a812b1c9ec8531946931773fd3
The assertion can be overriden using apt::key::assert-pubkey-algo,
the default is the most opinionated one.
This will inform the user during apt-cdrom add as we do not
pass --quiet to user, so adjust test case.
Add a simple test case for it to test-method-gpgv.
LP: #2055193
gpgv: Add a reason to worthless signers2024-02-28T17:21:01ZJulian Andres Klodejulian.klode@canonical.com2024-02-28T13:49:48Zurn:sha1:60d653634f889abe09c0f4d88f2559eab9202635