News for hackers. Stuff that matters.
Re:Ditching OpenPGP, a new approach to signing APT repositories by julian-klode on Tuesday June 22, 2021 @06:13AM (#27589845)
Still have to trust 1k RSA keys because GPG does not allow us to say they're unsafe.
Re:Ditching OpenPGP, a new approach to signing APT repositories by upofadown on Tuesday June 22, 2021 @08:12AM (#27590665)
You can tell how long a key is just by looking at it. You can then say anything you want. The use of particular keys is a Debian policy issue. It has nothing to do with the use of a particular message format like OpenPGP.
Re:Ditching OpenPGP, a new approach to signing APT repositories by julian-klode on Tuesday June 22, 2021 @01:06PM (#27594246)
That's not how it works, no. This is a gpg specific issue as it does not communicate the key size over the status fd.

We don't parse the keys ourselves for obvious reasons.

Re:Ditching OpenPGP, a new approach to signing APT repositories by upofadown on Tuesday June 22, 2021 @07:11PM (#27598517)
Dunno about that but --with-colons certainly works to show the key length of a key.
Re:Ditching OpenPGP, a new approach to signing APT repositories by deknos on Tuesday June 22, 2021 @07:35AM (#27590390)
i am pretty sure you can mark them yourself. but that they are generally still used, well that's called backwards compatibility. and that's needed.