Your message dated Wed, 22 Jul 2026 23:49:24 +0000
with message-id <[email protected]>
and subject line Bug#872271: fixed in haskell-hopenpgp-tools 0.25-1
has caused the Debian Bug report #872271,
regarding hopenpgp-tools: please implement "hop verify", from the Stateless
OpenPGP command-line interface
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
872271: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872271
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: hopenpgp-tools
Version: 0.19.4-3
Severity: wishlist
I'd like hopenpgp-tools to produce a simple signature validation
binary, which validates a signature against a set of curated keyrings.
let's call it hov (for "hopenpgp validator").
Synopsis
--------
The proposed syntax is:
hov -k KEYRING [-k OTHERKEYRING ...] [options] SIGNATURE BLOB
Where options include:
--not-before TIMESPEC
--not-after TIMESPEC
if not present, --not-before defaults to NULL, and --not-after
defaults to "now".
It should return 0 (success) if the the signature is valid over the
blob, and was issued correctly from one of the keys in the set of
keyrings offered, and some non-zero code otherwise.
Details
-------
It should take into account at least the following concerns:
* key usage flags (signatures made by keys not with the "signing"
capability are not valid)
* signature time (signatures made before the --not-before timespec
(if non-NULL) or after the --not-after timespec are not valid)
* key validity time (signatures made before key creation or after key
expiry are not valid)
* key revocation (signatures made by revoked keys are not valid)
* key strength and signature strength (signatures over MD5 and SHA1
are not valid; signatures made by RSA keys less than 2048 bits are
not valid -- maybe there's a possible extension here to mark other
algorithms as unacceptable)
* subkey bindings (signatures made by a signing-capable subkey must
have a cross-sig to the primary key; binding sigs and cross-sigs
must be made with a reasonable signature algorithm; binding sigs
and cross-sigs must be valid, non-revoked, non-expired, not in the
past, etc)
Freshness
---------
[ rationale for --not-before and --not-after ]
In some cases, the user expects signatures to be made within a certain
temporal window. For example, in e-mail validation, if i think the
e-mail was sent at time T (e.g. if it has a "Date: T" header), i
expect the signature to be made in a little window of time around T,
or else something is clearly amiss.
For software package validation, i might have some prior version of
the software package from the same vendor, and i want to ensure that
the Date is explicitly *after* the date of that previous signature.
The user should be able to express this preference simply to the
validator and have the validator do the right thing.
Open questions
==============
here are some open questions about the proposed design and possible
future enhancements to keep in mind:
TIMESPEC format
---------------
How should hov expect the user to entire time information? With what
precision? OpenPGP has 1sec granularity. Should we bake that choice
of precision into hov?
Covert Channels
---------------
What if the SIGNATURE blob contains something other than an OpenPGP
signature? Should hov reject it or ignore the cruft?
Multiple Signatures
-------------------
What if the user wants to ensure that there are signatures from
multiple signers in the curated keyrings (e.g. 2 of 5 signers)? the
proposed interface doesn't have any way to represent that.
Info about the signature
------------------------
In the event that a signature is validated, it's possible that the
person doing verification wants to learn something about it (e.g. to
record details in a log, like date of signature). In the event that
it is not successful, it's possible that they want to learn more about
it for debugging purposes. The above simple proposal doesn't provide
any means for emitting this information for those who want it.
perhaps just logging in machine-readable form to stderr is sufficient
for the first crack at this?
--dkg
-- System Information:
Debian Release: buster/sid
APT prefers testing-debug
APT policy: (500, 'testing-debug'), (500, 'testing'), (500, 'oldstable'),
(200, 'unstable-debug'), (200, 'unstable'), (1, 'experimental-debug'), (1,
'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 4.11.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages hopenpgp-tools depends on:
ii libbz2-1.0 1.0.6-8.1
ii libc6 2.24-12
ii libffi6 3.2.1-6
ii libgmp10 2:6.1.2+dfsg-1
ii libncursesw5 6.0+20170715-2
ii libnettle6 3.3-1+b1
ii libtinfo5 6.0+20170715-2
ii libyaml-0-2 0.1.7-2
ii zlib1g 1:1.2.8.dfsg-5
hopenpgp-tools recommends no packages.
hopenpgp-tools suggests no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: haskell-hopenpgp-tools
Source-Version: 0.25-1
Done: Clint Adams <[email protected]>
We believe that the bug you reported is fixed in the latest version of
haskell-hopenpgp-tools, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Clint Adams <[email protected]> (supplier of updated haskell-hopenpgp-tools
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 22 Jul 2026 18:55:02 -0400
Source: haskell-hopenpgp-tools
Architecture: source
Version: 0.25-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Haskell Group
<[email protected]>
Changed-By: Clint Adams <[email protected]>
Closes: 872271 931238 971474 1141576
Changes:
haskell-hopenpgp-tools (0.25-1) unstable; urgency=medium
.
* New upstream version.
- Changes `hokey canonicalize` ordering to not be
dependent on an underlying hash library.
closes: #1141576.
- Adds `hop verify`. closes: #872271.
- `hot armor` no longer emits Version header.
closes: #931238.
* Mark the autopkgtest as superficial. closes: #971474.
Checksums-Sha1:
c815157e280fe4bc7a283d14a36cddb97250a30a 3084 haskell-hopenpgp-tools_0.25-1.dsc
b228aea41ddda3d84f8225817ac2758427d27bee 83268
haskell-hopenpgp-tools_0.25.orig.tar.gz
f04ef55915d7613cd8110f7185c13c41868f9faa 14596
haskell-hopenpgp-tools_0.25-1.debian.tar.xz
f60da94ea5733f0c668b79ccdc60bc7bc66a79a9 14248
haskell-hopenpgp-tools_0.25-1_source.buildinfo
Checksums-Sha256:
3575f508ed09c3fbbe10d946e0a76692c63fa6c0243ddbc28e57fe205ac16404 3084
haskell-hopenpgp-tools_0.25-1.dsc
20f8ca76d3bf6afac2a3f0e63448a97279fe89ad51ffd2c41f04d881172395c0 83268
haskell-hopenpgp-tools_0.25.orig.tar.gz
4c3764fafe6512bd11a9e9666a082e4ef9d65b4662c4a7585d96b794ac4c0861 14596
haskell-hopenpgp-tools_0.25-1.debian.tar.xz
50fde031cfff17026c4fd0b9359efb62eb904cdb8a04312774304237588b9904 14248
haskell-hopenpgp-tools_0.25-1_source.buildinfo
Files:
0ff678ae8adfca088f1dd4f0578815bc 3084 haskell optional
haskell-hopenpgp-tools_0.25-1.dsc
cc44088b2179dd9326a62db1212a6c39 83268 haskell optional
haskell-hopenpgp-tools_0.25.orig.tar.gz
ab641517b6d34cc503d83952f59a60ee 14596 haskell optional
haskell-hopenpgp-tools_0.25-1.debian.tar.xz
35d41d9d7d92d42d88ab02156b2523ab 14248 haskell optional
haskell-hopenpgp-tools_0.25-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
wsG7BAEBCgBvBYJqYVF0CRD200lbsK6aAkcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmdMVp8dat4DsJPm0NF4QVixoR1+t9u7h0yKcKXXakKn
7BYhBCEAoyxG+JWvOgh4OvbTSVuwrpoCAAAX5w//SHQehXh0jR6Rz9owmbQinFXN
gzqK4KEQps/WdQvGjLH6kTamkzTb0ZW2sl4r6JwVDCUCQkojdUJl5YJfZjLZ/iTu
+EDG0mSQ+CZMOsCa3gk2EEhnzte/XDGW0S5TyO+oNVKwmBH1OC6If6BcZnp8eeqD
M41/R+3Hjm6sUBlvKFWQn/5sPKD4eRLAh3RcXhbwX4pCM2oYuNWJ+f7nCmzlkHD4
vPXr6Y7xGIdG+XSxcl40v1KxQ6wkN2zBEK4BQ9/q3mN9pvbftNbEAExN5ZDoB8Fn
c/pWucr9wfThd8NqKZ7aK78unxYaZEcZV0ESU7OkJ6vdnGPBOn1Vmm/i9bQ/7oNY
iFGAbyIe7LfrJnxLtel4VBbAiTKjU2W8a1qNSqNzri20+fJQK8U8e+nTNW+qUcoT
Uq/CtQQOxJttfoZyBRvINESSZ4Dw1n0QtOHUTNtkkzN5iRiUXW0f3Jj4gjkGmQkn
8JQ4vAhm2KLpF1VIZg7V9ICqIWKCZn2QJsb8lnozMYEV0a5aMIabQGXM+PnC79S/
wWmPsiOhAiV+LYVgjbtdy2eYW93LAyAG+tk1supEnM4nuBAmN5kBolj24qMUZUAl
e8LSXMeuFTYj6u6xrRGB+dr0f/5G3YnoI95adRynby2LqwK24G3M3vD4gW19PO4e
KLCuvOeLbrsduVM1XgQ=
=4+Ya
-----END PGP SIGNATURE-----
pgp3GaBNLgQTQ.pgp
Description: PGP signature
--- End Message ---
