[openpgp] ecosystem split: text-mode signatures over CR-only line endings

Hey OpenPGP folks--

I've been doing some attempts at aligning various OpenPGP
implementations, and i think i've stumbled into an ecosystem split.

This shows up in the interoperability test suite, at

  https://sequoia-pgp.gitlab.io/openpgp-interoperability-test-suite/results.html#Detached_signatures__Linebreak_normalization

In particular, the line that tests whether the message "one\rtwo\rthree"
can be validated by a text-mode signature over ""one\r\ntwo\r\nthree"

We can see from this split that the following implementations believe
that `\r` is a line-ending that needs to be normalized for text-mode
signatures:

 - sequoia
 - rpgp
 - pgpainless-cli

but these other implementations do not:

 - GnuPG
 - RNP
 - GOpenPGP
 - OpenPGP.js
 - PGPy

Even weirder, from the latter batch, it looks like GOpenPGP does
something entirely different from the others with a carriage-return-only
file.  signatures made from gosop don't verify in GnuPG or RNP, in
addition to the other three that do normalize `\r`:

   https://github.com/ProtonMail/gosop/issues/48

You can test this manually by signing a one-octet message that consists
only of `\r` , and try verifying the different options.

I'm not sure i understand what's happening with gosop here.

I've also opened a request for a new interop test to try to get more
data:

   https://gitlab.com/sequoia-pgp/openpgp-interoperability-test-suite/-/issues/168

All of the tests i've done were on Debian GNU/Linux systems, where the
"native" line ending is `\n`.

I looked in RFC 9580, and it doesn't specify what "line endings"
actually means, other than to say that they should be converted to CRLF.

So i think the following question is what we need to answer:

 - is `\r` (CR) on its own a "line-ending" that needs to be converted to
   CRLF when signing in text mode?

How can we resolve this?  you'd think by 2025 we'd have all the line
ending issues sorted out.

    --dkg

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]

-----BEGIN PGP SIGNATURE-----

wr0EARYKAG8FgmjwEgYJEHgLhU7ZwrSWRxQAAAAAAB4AIHNhbHRAbm90YXRpb25z
LnNlcXVvaWEtcGdwLm9yZ3qJBSZgrLRLqzoY2S1tWhAXyXwRJQdsxKXlraH6nwpO
FiEEY6wRjlsuXWbIioWneAuFTtnCtJYAAAmdAP9o/Kes8ExVxtaUmc/Z2wuGGOPL
3P78uEduxXBqqo56nwEA0BmI33KuNaAwz77jxMdWQ32ffmZxjtOdQUYJsEx2lgw=
=nbdn
-----END PGP SIGNATURE-----