> My proposal is to add a "pgpDigParamsModificationTime()" that returns the
> maximum of all self-signature creation time (they can all be verified).
> That's pretty much what the old code should have done since the beginning.
That doesn't work. It is at best a heuristic. Even if you take the creation
time of the most recent component or signature, you aren't guaranteed to have
the latest version of the certificate. A certificate is composed of multiple
packets, and some can be stripped. `keys.openpgp.org`, for instance, does this:
it only returns user ID packets that it has verified.
--
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/2004#issuecomment-2039424852
You are receiving this because you are subscribed to this thread.
Message ID: <rpm-software-management/rpm/issues/2004/2039424...@github.com>
_______________________________________________
Rpm-maint mailing list
Rpm-maint@lists.rpm.org
http://lists.rpm.org/mailman/listinfo/rpm-maint
