[Rpm-maint] [rpm-software-management/rpm] No way to get rid of duplicated of ther same NEVR (#1792)

2021-10-07 Thread mikhailnov
[user@rosa2019 tmp]$ sudo rpm -e --nodeps -vh gnome-session gnome-session-bin [sudo] пароль для user: ошибка: "gnome-session-bin" specifies multiple packages: gnome-session-bin-40.1.1-8.x86_64 gnome-session-bin-40.1.1-8.x86_64 [user@rosa2019 tmp]$ sudo rpm -e --nodeps -vh gnome-session

Re: [Rpm-maint] [rpm-software-management/rpm] Validate self-signatures and require subkey bindings on PGP public keys (#1788)

2021-10-07 Thread Michael Schroeder
@mlschroe commented on this pull request. > } } - if (pgpPrtPkt(, digp)) + if (digp->tag == PGPTAG_PUBLIC_KEY && pkt->tag == PGPTAG_SIGNATURE) + selfsig = pgpDigParamsNew(pkt->tag); Maybe you should also check that the issuer id matches and ignore

Re: [Rpm-maint] [rpm-software-management/rpm] Validate self-signatures and require subkey bindings on PGP public keys (#1788)

2021-10-07 Thread Michael Schroeder
@mlschroe commented on this pull request. > break; + if (pkt->tag == PGPTAG_PUBLIC_SUBKEY) + expect = PGPTAG_SIGNATURE; Should we also enforce a self-sig on a User ID Packet? -- You are receiving this because you are subscribed to this thread. Reply to this email

Re: [Rpm-maint] [rpm-software-management/rpm] Validate self-signatures and require subkey bindings on PGP public keys (#1788)

2021-10-07 Thread Michael Schroeder
@mlschroe commented on this pull request. > if (pkttype == PGPTAG_SIGNATURE) break; + + if (alloced < i) { Shouldn't that be `alloced <= i`? -- You are receiving this because you are subscribed to this thread. Reply to this email directly or view it on GitHub:

Re: [Rpm-maint] [rpm-software-management/rpm] Validate self-signatures and require subkey bindings on PGP public keys (#1788)

2021-10-07 Thread Michael Schroeder
@mlschroe commented on this pull request. > } } - if (pgpPrtPkt(, digp)) + if (digp->tag == PGPTAG_PUBLIC_KEY && pkt->tag == PGPTAG_SIGNATURE) + selfsig = pgpDigParamsNew(pkt->tag); The code assumes that the self-sig always comes first if there are

Re: [Rpm-maint] [rpm-software-management/rpm] Validate self-signatures and require subkey bindings on PGP public keys (#1788)

2021-10-07 Thread Michael Schroeder
@mlschroe commented on this pull request. > + (pkt->blen >> 24), + (pkt->blen >> 16), + (pkt->blen >> 8), + (pkt->blen ), +}; +rpmDigestUpdate(hash, head, 5); +rpmDigestUpdate(hash, pkt->body, pkt->blen); +} + +static int pgpVerifySelf(pgpDigParams key,