Re:Ditching OpenPGP, a new approach to signing APT repositories
by julian-klode on Tuesday June 22, 2021 @06:13AM
(#27589845)
Still have to trust 1k RSA keys because GPG does not allow us to say they're unsafe.
[ Parent
| on HN ]
Re:Ditching OpenPGP, a new approach to signing APT repositories
by upofadown on Tuesday June 22, 2021 @08:12AM
(#27590665)
You can tell how long a key is just by looking at it. You can then say anything you want. The use of particular keys is a Debian policy issue. It has nothing to do with the use of a particular message format like OpenPGP.
Re:Ditching OpenPGP, a new approach to signing APT repositories
by julian-klode on Tuesday June 22, 2021 @01:06PM
(#27594246)
That's not how it works, no. This is a gpg specific issue as it does not communicate the key size over the status fd.
We don't parse the keys ourselves for obvious reasons.