[Rpm-maint] [rpm-software-management/rpm] PGP key identifiers use binding signature's creation time, not certificate creation time (Issue #2004)

[Neal H. Walfield]

> My proposal is to add a "pgpDigParamsModificationTime()" that returns the maximum of all self-signature creation time (they can all be verified). That's pretty much what the old code should have done since the beginning.

That doesn't work.  It is at best a heuristic. Even if you take the creation time of the most recent component or signature, you aren't guaranteed to have the latest version of the certificate. A certificate is composed of multiple packets, and some can be stripped. `keys.openpgp.org`, for instance, does this: it only returns user ID packets that it has verified.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/issues/2004#issuecomment-2039424852
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/issues/2004/2039424852 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20240405/c1305757/attachment.html>