[openpgp] Re: [Dance] Key digest companion for RFC 7929 OPENPGPKEY

I doubt current solution I have seen in Fedora is any kind better.

When you upgrade to new release, it will ask you:

Do you trust this key: <Fingerprint>

Y/n?

I doubt this is desired state.

I think instead of this question, it should try DNSSEC validated query 
to some OPENPGPFP record I am proposing to introduce. If it matches the 
key you have, then it is probably correct key.

I know there are more protocols allowing similar thing. I think DNSSEC 
could be lighweight enough to do this job. We had it implemented in 
dnf3. I would like to have it in dnf5 later.

I mean, there is nothing wrong with obtaining key together with a media. 
But there should be some trust anchor, making this secure. We have one 
such trust anchor in DNS and this is my proposal to use it.

On 21/11/2025 18:47, Simo Sorce wrote:
> On Fri, 2025-11-21 at 18:10 +0100, Petr Menšík wrote:
>> Yes! Because at least how this is used by Fedora, you always get
>> installed the key itself on the media or from the repository. It is
>> often the case you have the keys, but are not sure they are considered
>> (still) trusted by its owner.
> FWIW I would not consider what Fedora does in this area as "best
> practice", and would not try to optimize for that use case.
>
-- 
Petr Menšík
Senior Software Engineer, RHEL
Red Hat, https://www.redhat.com/
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB

_______________________________________________
openpgp mailing list -- [email protected]
To unsubscribe send an email to [email protected]