[2021-12-08 19:28:24+0500] Anna Vyalkova:
On 2021-12-08 13:54, Haelwenn (lanodan) Monnier wrote:
> >+case ${VERIFY_SIG_IMPL} in
> >+ gnupg)
> >+ BDEPEND="
> >+ verify-sig? (
> >+ app-crypt/gnupg
> >+ >=app-portage/gemato-16
> >+ )"
> >+ ;;
> >+ signify)
> >+ BDEPEND="verify-sig? ( app-crypt/signify )"
>
> Might be worth it to depend on app-crypt/minisign instead or depend on any.
> minisign is already stabilized and I slightly prefer it's implementation over
> the ported signify as there is no vendoring.
> That said minisign could be considered bloated compared to signify.
$ minisign -Vp /usr/share/openpgp-keys/gmid-1.7.pub -m SHA256 -x SHA256.sig -o
Trusted signature comment should start with "trusted comment: "
It doesn't work :/
Also it has no "verify signed checksums list" mode.
Not sure what your files are but those two are definitely bugs in minisign. :/
> >+ case ${VERIFY_SIG_IMPL} in
> >+ gnupg)
> >+ gemato gpg-wrap -K "${key}" "${extra_args[@]}" -- \
> >+ gpg --verify "${sig}" "${file}" ||
> >+ die "PGP signature verification failed"
> >+ ;;
> >+ signify)
> >+ signify -V -p "${key}" -m "${file}" -x "${sig}" ||
> >+ die "PGP signature verification failed"
>
> Should be something like "Signify signature verification failed".
It's still PGP, so the message is accurate. Having different messages
would be inconsistent. That's what I think.
Nah, signify has nothing to do with OpenPGP, they are entirely different.
OpenPGP is defined in RFC4880 and is implemented by PGP, GnuPG and NetPGP.
It notably has non-rotable identity keys, subkeys, keyservers and a
web-of-trust.
Signify is just barebones signatures from one simple key, with rotation being
intended and no designed network protocol.
See https://flak.tedunangst.com/post/signify for details.
