> Can you explain what you are thinking or worried about here?
I'm not especially worried. It just sounds like a lot of work! But it sounds
like you have already done the work, so there is no problem.
> > Can you think of any use cases where this would cause a problem?
>
> Yes. If the new certificate is missing some components that the existing
> version has, signatures that could once be verified may no longer be
> verifiable.
I suppose there might be some situations where that is helpful. But it sounds
dangerous as a default behaviour. Old keys would never get retired / revoked.
This could leave users vulnerable to attack. Otherwise, what's the point of
rotating keys?
--
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/2577#issuecomment-1646600750
You are receiving this because you are subscribed to this thread.
Message ID: <rpm-software-management/rpm/issues/2577/1646600...@github.com>
_______________________________________________
Rpm-maint mailing list
Rpm-maint@lists.rpm.org
http://lists.rpm.org/mailman/listinfo/rpm-maint
