Björn Persson, 2026-07-22 20:11 +02:00: > Jakub Jelen wrote: >> and sequoia's handling of multiple armored signatures in one file > > Bitcoin Core does that. Multiple people sign each release, so security > isn't dependent on a single trusted entity. An attacker would have to > acquire several people's signing keys. It's a good practice that should > be encouraged. I had hoped that the package could be fixed some day to > do meaningful signature verification. That will be harder if the > ability to handle such files will be lost.
sqv can handle multiple signatures just fine. What it currently doesn't
support is concatenated *ASCII armored* signatures. So something like:
-----BEGIN PGP SIGNATURE-----
[...]
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNATURE-----
[...]
-----END PGP SIGNATURE-----
Just concatenate the signature packets together, either in binary or as
one ASCII armored block.
As a hacky shell script:
cat SHA256SUMS.asc | { asig=""; while IFS=$'\n' read -r line; do
asig="$asig$line"$'\n'; if [[ "$line" =~ ^-----END ]]; then printf '%s' "$asig"
| sq packet dearmor >> sigs; asig=""; fi; done }
sqv actually supports requiring signatures from multiple public keys out
of the box. For example:
sqv --keyring keys.pgp --signatures 3 --signature-file sigs SHA256SUMS
will check that the file has been signed by at least 3 different public
keys contained in the keyring.
Simon
OpenPGP_signature.asc
Description: OpenPGP digital signature
-- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
