[openpgp] Re: ecosystem split: text-mode signatures over C R-only line endings

Hey Daniel,

thanks for your debugging and writeup!

To my mind, this reads like there's some consensus between 
implementations that bare CR bytes should *not* be normalized which hashing.
I'll propose a change to rPGP to align with that approach.

:) Heiko


On 10/15/25 11:28 PM, Daniel Kahn Gillmor wrote:
> Hey OpenPGP folks--
>
> I've been doing some attempts at aligning various OpenPGP
> implementations, and i think i've stumbled into an ecosystem split.
>
> This shows up in the interoperability test suite, at
>
>    https://sequoia-pgp.gitlab.io/openpgp-interoperability-test-suite/results.html#Detached_signatures__Linebreak_normalization
>
> In particular, the line that tests whether the message "one\rtwo\rthree"
> can be validated by a text-mode signature over ""one\r\ntwo\r\nthree"
>
> We can see from this split that the following implementations believe
> that `\r` is a line-ending that needs to be normalized for text-mode
> signatures:
>
>   - sequoia
>   - rpgp
>   - pgpainless-cli
>
> but these other implementations do not:
>
>   - GnuPG
>   - RNP
>   - GOpenPGP
>   - OpenPGP.js
>   - PGPy
>
> Even weirder, from the latter batch, it looks like GOpenPGP does
> something entirely different from the others with a carriage-return-only
> file.  signatures made from gosop don't verify in GnuPG or RNP, in
> addition to the other three that do normalize `\r`:
>
>     https://github.com/ProtonMail/gosop/issues/48
>
> You can test this manually by signing a one-octet message that consists
> only of `\r` , and try verifying the different options.
>
> I'm not sure i understand what's happening with gosop here.
>
> I've also opened a request for a new interop test to try to get more
> data:
>
>     https://gitlab.com/sequoia-pgp/openpgp-interoperability-test-suite/-/issues/168
>
> All of the tests i've done were on Debian GNU/Linux systems, where the
> "native" line ending is `\n`.
>
> I looked in RFC 9580, and it doesn't specify what "line endings"
> actually means, other than to say that they should be converted to CRLF.
>
> So i think the following question is what we need to answer:
>
>   - is `\r` (CR) on its own a "line-ending" that needs to be converted to
>     CRLF when signing in text mode?
>
> How can we resolve this?  you'd think by 2025 we'd have all the line
> ending issues sorted out.
>
>      --dkg
>
> _______________________________________________
> openpgp mailing list -- [email protected]
> To unsubscribe send an email to [email protected]

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]