[Rpm-maint] [rpm-software-management/rpm] rpm --import does not replace old keys with new keys (Issue #2577)

[Andrew Clausen]

> Can you explain what you are thinking or worried about here?

I'm not especially worried.  It just sounds like a lot of work!  But it sounds like you have already done the work, so there is no problem.

> >  Can you think of any use cases where this would cause a problem?
>
> Yes. If the new certificate is missing some components that the existing version has, signatures that could once be verified may no longer be verifiable.

I suppose there might be some situations where that is helpful.  But it sounds dangerous as a default behaviour.  Old keys would never get retired / revoked.  This could leave users vulnerable to attack.  Otherwise, what's the point of rotating keys?


-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/2577#issuecomment-1646600750
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/issues/2577/1646600750 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20230722/eea9e936/attachment.html>