[Rpm-maint] [rpm-software-management/rpm] Validate and require subkey binding signatures on PGP public keys (#1795)

[Demi Marie Obenour]

@DemiMarie requested changes on this pull request.



> +	if (sigalg->setmpi(sigalg, i, p))
+	    break;

@pmatilai good point.  In fact, I would argue that *not* adding the check would make this PR a regression security wise.  Would it be possible to include #1705 in this PR?  It is tiny and passes the regression test suite, and can be replaced with a better solution later.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1795#pullrequestreview-782356055
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20211018/f54d31ef/attachment.html>