[Rpm-maint] [rpm-software-management/rpm] RFE: Signing packages with signify (#1193)

Demi Marie Obenour notifications at github.com
Fri Dec 25 03:59:22 UTC 2020


IMO, moving from OpenPGP to PKCS#7 would hardly be a victory.  Moving to something like Signify would.

Ideally, the signature would be at a fixed offset and of a fixed length, so there is no need to parse the file before checking the signature.  That eliminates an enormous class of vulnerabilities.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/1193#issuecomment-751163148
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20201224/5a01efab/attachment.html>


More information about the Rpm-maint mailing list