[Rpm-maint] [rpm-software-management/rpm] Validate self-signatures and require subkey bindings on PGP public keys (#1788)

[Panu Matilainen]

@pmatilai commented on this pull request.



>  	    }
 	}
 
-	if (pgpPrtPkt(&pkt, digp))
+	if (digp->tag == PGPTAG_PUBLIC_KEY && pkt->tag == PGPTAG_SIGNATURE)
+	    selfsig = pgpDigParamsNew(pkt->tag);

https://datatracker.ietf.org/doc/html/rfc4880#section-11.1 says:

> Each Subkey packet MUST be followed by one Signature packet, which should be a subkey binding signature issued by the top-level key.

Surely a signature with a different issuer will simply not pass?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1788#discussion_r725877751
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20211011/8a4c93a0/attachment.html>