#1042391 gpgv: add --min-rsa-length

Package:
gpgv
Source:
gpgv
Description:
GNU privacy guard - signature verification tool
Submitter:
Julian Andres Klode
Date:
2024-01-18 08:09:02 UTC
Severity:
normal
#1042391#5
Date:
2023-07-27 10:16:54 UTC
From:
To:
I believe this allows APT to request a safe minimum RSA length from gpgv for
verification purposes, and then we could even run gpgv a 2nd time
without the flag and print a diagnostic for an orderly transition to
at least 2048R.
#1042391#10
Date:
2023-07-27 10:25:31 UTC
From:
To:
sorry about that, too quick to send :(
#1042391#17
Date:
2024-01-16 10:02:28 UTC
From:
To:
Control: severity -1 important

Bumping this. 1024R keys are becoming increasingly unsafe, and this
will eventually become release critical for trixie because we shouldn't
ship it with trust for those keys.

And APT is not capable of checking the key size itself because gpg
status fd doesn't expose it - that'd be an alternative solution.
#1042391#24
Date:
2024-01-16 11:25:23 UTC
From:
To:
OK the option does not do what it said back then. Logs are below; tl,dr is:

1. Without de-vs compliance setting, it is ignored silently
2. With de-vs compliance setting it is still a good signature
3. Only way to notice it is to also set --require-compliance

For APT we want to just ban sub-2048R keys, possibly sub-3072R keys (apparently
2048R is no longer considered safe enough for some draft standards).
#1042391#29
Date:
2024-01-18 08:06:20 UTC
From:
To: