Public bug reported:
As part of Ubuntu key rotation strategy, we rely on dual-signing
(inline, or detached) such that validation with at least one key
available in a keyring should be trusted, without using web-of-trust.
However, it seems to be only correctly so far implemented by the apt's
gpgv method.
Ideally, we should ship an easy enough to use the helper that is `like
gpgv` to use, and possibly reusing apt's gpgv code and/or exposing it
via apt-key's verify.
The problem seems to be that 1 good sig + 1 no public key available,
results in gpgv exiting with 2, instead of 0 or 1.
Ideally it should be easy enough to use gpgv/gpg to verify that at least
one signature is good, and decrypt/extract signed contents only.
More details and reproducers to follow.
** Affects: apt (Ubuntu)
Importance: Undecided
Status: New
** Affects: debmirror (Ubuntu)
Importance: Undecided
Status: New
** Affects: gnupg2 (Ubuntu)
Importance: Undecided
Status: New
** Affects: ubuntu-keyring (Ubuntu)
Importance: Undecided
Status: New
** Affects: ubuntu-release-upgrader (Ubuntu)
Importance: Undecided
Status: New
** Also affects: gnupg2 (Ubuntu)
Importance: Undecided
Status: New
** Also affects: apt (Ubuntu)
Importance: Undecided
Status: New
** Also affects: debmirror (Ubuntu)
Importance: Undecided
Status: New
** Also affects: ubuntu-release-upgrader (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1801762
Title:
Dual-signed things should be easy to verify with one key
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1801762/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
