[Rpm-maint] [rpm-software-management/rpm] Validate self-signatures and require subkey bindings on PGP public keys (#1788)

[Michael Schroeder]

@mlschroe commented on this pull request.



> +	(pkt->blen >> 24),
+	(pkt->blen >> 16),
+	(pkt->blen >>  8),
+	(pkt->blen      ),
+    };
+    rpmDigestUpdate(hash, head, 5);
+    rpmDigestUpdate(hash, pkt->body, pkt->blen);
+}
+
+static int pgpVerifySelf(pgpDigParams key, pgpDigParams selfsig,
+			const struct pgpPkt *all, int i)
+{
+    int xx = -1;
+    DIGEST_CTX hash = rpmDigestInit(selfsig->hash_algo, 0);
+    hashKey(hash, &all[0]);
+

You might want to verify the package types of the package you're hashing, i.e. `all[i-1]` should be of the required type.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1788#pullrequestreview-773697287
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20211007/37e7dcc6/attachment.html>