Re:Ditching OpenPGP, a new approach to signing APT repositories
by deknos on Tuesday June 22, 2021 @07:33AM
(#27590379)
> That's an absurd statement. OpenPGP _is_ the legacy cruft. It's made for _emails_. It makes no sense elsewhere. The encoding for clearsigned signatures is overly complex.
No. It's a message encryption, and namespaces are emails, but then, most logins nowadays are identifiers via some email. this is not true. and encodings are fixable and doable in a good library, so there's no misuse.
> And Rust is inappropriate in any case for now, it's not allowed in Ubuntu main.
that's new to me, but possible, why? any link?
Re:Ditching OpenPGP, a new approach to signing APT repositories
by julian-klode on Tuesday June 22, 2021 @01:41PM
(#27594688)
Rust is a security nightmare. We'd need to add over 130 packages to main for sequioa, and then we'd need to rebuild them all each time one of them needs a security update.
Re:Ditching OpenPGP, a new approach to signing APT repositories
by xvilka on Tuesday June 22, 2021 @05:29AM
(#27589605)
It's a problem of Ubuntu then, not Debian.
Re:Ditching OpenPGP, a new approach to signing APT repositories
by julian-klode on Tuesday June 22, 2021 @01:52PM
(#27594811)
Not gonna have two different signing implementation. Same security concerns apply to Debian too, of course.
Having 130+ packages to rebuild for a critical security update is no fun.
And Rust is inappropriate in any case for now, it's not allowed in Ubuntu main.