[Rpm-maint] [rpm-software-management/rpm] Validate self-signatures and require subkey bindings on PGP public keys (#1788)

[Panu Matilainen]

@pmatilai commented on this pull request.



> +	(pkt->blen >> 24),
+	(pkt->blen >> 16),
+	(pkt->blen >>  8),
+	(pkt->blen      ),
+    };
+    rpmDigestUpdate(hash, head, 5);
+    rpmDigestUpdate(hash, pkt->body, pkt->blen);
+}
+
+static int pgpVerifySelf(pgpDigParams key, pgpDigParams selfsig,
+			const struct pgpPkt *all, int i)
+{
+    int xx = -1;
+    DIGEST_CTX hash = rpmDigestInit(selfsig->hash_algo, 0);
+    hashKey(hash, &all[0]);
+

Oh, good point on the CERT verification (annoying as it may be...)

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1788#discussion_r725905963
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20211011/57d4aed4/attachment.html>