[openpgp] Re: ecosystem split: text-mode signatures over C R-only line endings

Hi dkg & all,

I'd be in favor of defining a line ending as `\n` or `\r\n` and
leaving `\r` by itself alone.

> Even weirder, from the latter batch, it looks like GOpenPGP does
> something entirely different from the others with a carriage-return-only
> file. signatures made from gosop don't verify in GnuPG or RNP, in
> addition to the other three that do normalize `\r`:
> 
>    https://github.com/ProtonMail/gosop/issues/48

>From testing GnuPG, it seems that it replaces a trailing `\r` with an
empty string:

    $ printf '\r' | gpg --detach-sign --armor --textmode > gpg.sig
    $ printf '\r' | gosop verify gpg.sig gpg.cert
    Code 3: No acceptable signatures found ("gosop verify")
    $ printf '' | gosop verify gpg.sig gpg.cert
    2025-10-16T12:37:09Z 72E33AE81300E553BC4EEDEFCB064A128FA90686 72E33AE81300E553BC4EEDEFCB064A128FA90686 mode:text

So, I suspect that it's GnuPG's (and RNP's?) handling of trailing `\r`
that's broken, not GopenPGP's.

(The other implementations that fail to verify GopenPGP's signature
normalize `\r` to `\r\n`, which is more defensible, but as mentioned
I'd also suggest to change.)

Best,
Daniel

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]