Re: F45 Change Proposal: Sequoia opengpgverify (self-contained)

HW42 <[email protected]> Thu, 23 Jul 2026 01:58:48 +0200

Newsgroups	gmane.linux.redhat.fedora.devel
Message-ID	<[email protected]>

Björn Persson, 2026-07-22 20:11 +02:00:
> Jakub Jelen wrote:
>> and sequoia's handling of multiple armored signatures in one file
> 
> Bitcoin Core does that. Multiple people sign each release, so security
> isn't dependent on a single trusted entity. An attacker would have to
> acquire several people's signing keys. It's a good practice that should
> be encouraged. I had hoped that the package could be fixed some day to
> do meaningful signature verification. That will be harder if the
> ability to handle such files will be lost.

sqv can handle multiple signatures just fine. What it currently doesn't
support is concatenated *ASCII armored* signatures. So something like:

    -----BEGIN PGP SIGNATURE-----
    
    [...]
    -----END PGP SIGNATURE-----
    -----BEGIN PGP SIGNATURE-----
    
    [...]
    -----END PGP SIGNATURE-----

Just concatenate the signature packets together, either in binary or as
one ASCII armored block.

As a hacky shell script:

    cat SHA256SUMS.asc | { asig=""; while IFS=$'\n' read -r line; do asig="$asig$line"$'\n'; if [[ "$line" =~ ^-----END ]]; then printf '%s' "$asig" | sq packet dearmor >> sigs; asig=""; fi; done }

sqv actually supports requiring signatures from multiple public keys out
of the box. For example:

    sqv --keyring keys.pgp --signatures 3 --signature-file sigs SHA256SUMS

will check that the file has been signed by at least 3 different public
keys contained in the keyring.

Simon

-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new

OpenPGP_signature.asc (application/pgp-signature, 833 B)