Add pgpVerifySignature2 #2453

nwalfield · 2023-03-24T13:28:57Z

Add a new function, pgpVerifySignature2. pgpVerifySignature2 is like pgpVerifySignature, but optionally returns a descriptive error message (in the case of failure) or a lint (in the case of success).

This requires rpm-sequoia 1.4 or later.

See rpm-software-management/rpm-sequoia#39 and
#2127 (comment)

pmatilai · 2023-03-24T13:40:50Z

rpmio/rpmkeyring.c

+                rpmlog(RPMLOG_ERR, "Error verifying signature: %s",
+                       errormsg);
+            } else {
+                rpmlog(RPMLOG_WARNING, "Warning verifying signature: %s",


rpmlog() prefixes ERR and WARNING with error: and warning: respectively so these will appear a bit redundant, eg error: Error verifying signature: <explanation>

Not that I have any particularly bright ideas for better messages.

Good point, I'll remove the error and warning. Verifying signature is enough. errormsg will contain the actual text.

Having now tested this, I wonder if even that is necessary because that context is already supplied by the Sequoia message:

/home/pmatilai/Downloads/anydesk-6.1.1-1.el8.x86_64.rpm:
error: Error verifying signature: Verifying a signature using certificate D56311E5FF3B6F39D5A16ABE18DF3741CDFFDE29:
No binding signature at time 2021-04-13T11:08:37Z
error: Error verifying signature: Verifying a signature using certificate D56311E5FF3B6F39D5A16ABE18DF3741CDFFDE29:

I think we should decide which side emits the "verifying signature" context and drop it from the other entirely. I'd be fine with letting the Sequoia side handle it all because it has far more information available.

Here's what the new output looks like:

$ sudo update-crypto-policies --set DEFAULT $ LD_PRELOAD=$HOME/rpm-sequoia/target/release/librpm_sequoia.so RPM_TRACE=0 ./rpm -i ~/anydesk-6.1.1-1.el7.x86_64.rpm error: Verifying a signature using certificate D56311E5FF3B6F39D5A16ABE18DF3741CDFFDE29 (philandro Software GmbH <[email protected]>): Certificate 18DF3741CDFFDE29 invalid: policy violation because: No binding signature at time 2021-04-13T11:08:37Z error: /home/neal/anydesk-6.1.1-1.el7.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID cdffde29: BAD error: /home/neal/anydesk-6.1.1-1.el7.x86_64.rpm cannot be installed $ sudo update-crypto-policies --set FUTURE $ LD_PRELOAD=$HOME/rpm-sequoia/target/release/librpm_sequoia.so ./rpm -i ~/anydesk-6.1.1-1.el7.x86_64.rpm error: Verifying a signature using certificate D56311E5FF3B6F39D5A16ABE18DF3741CDFFDE29 (philandro Software GmbH <[email protected]>): 1. Signature 155143, created at Tue Apr 13 11:08:37 2021 invalid: it relies on legacy cryptography because: Policy rejected non-revocation signature (Binary) requiring collision resistance because: SHA1 is not considered secure since 1970-01-01T00:00:00Z 2. Certificate 18DF3741CDFFDE29 invalid: policy violation because: No binding signature at time 2021-04-13T11:08:37Z error: /home/neal/anydesk-6.1.1-1.el7.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID cdffde29: BAD error: /home/neal/anydesk-6.1.1-1.el7.x86_64.rpm cannot be installed $ LD_PRELOAD=$HOME/rpm-sequoia/target/release/librpm_sequoia.so RPM_TRACE=0 ./rpm -i ~/google-chrome-stable-109.0.5414.119-1.x86_64.rpm error: Verifying a signature using certificate 4CCA1EAF950CEE4AB83976DCA040830F7FAC5991 (Google, Inc. Linux Package Signing Key <[email protected]>): 1. Signature 2179, created at Mon Jan 23 21:23:32 2023 invalid: it relies on legacy cryptography because: Policy rejected non-revocation signature (Binary) requiring collision resistance because: SHA1 is not considered secure since 1970-01-01T00:00:00Z 2. Certificate A040830F7FAC5991 invalid: policy violation because: No binding signature at time 2023-01-23T21:23:32Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 1970-01-01T00:00:00Z warning: /home/neal/google-chrome-stable-109.0.5414.119-1.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 7fac5991: NOTTRUSTED error: Failed dependencies: rpmlib(PayloadIsXz) <= 5.2-1 is needed by google-chrome-stable-109.0.5414.119-1.x86_64

I think that resolves this issue.

rpmio/rpmpgp_internal.c

pmatilai · 2023-03-31T07:38:25Z

Some minor wrinkles to sort out on both sides, but this indeed makes a world of difference for understanding what's going on:

[pmatilai🎩︎localhost brpm]$ ./rpmkeys -Kv ~/Downloads/anydesk-6.2.1-1.el8.x86_64.rpm
/home/pmatilai/Downloads/anydesk-6.2.1-1.el8.x86_64.rpm:
error: Error verifying signature: Verifying a signature using certificate D56311E5FF3B6F39D5A16ABE18DF3741CDFFDE29:
Signature is OK, but key is not trusted: verification relies on legacy crypto
error: Error verifying signature: Verifying a signature using certificate D56311E5FF3B6F39D5A16ABE18DF3741CDFFDE29:
Signature is OK, but key is not trusted: verification relies on legacy crypto
Header V3 RSA/SHA1 Signature, key ID cdffde29: BAD
Header SHA1 digest: OK
V3 RSA/SHA1 Signature, key ID cdffde29: BAD
MD5 digest: OK

[pmatilai🎩︎localhost brpm]$ ./rpmkeys -Kv ~/Downloads/anydesk-6.1.1-1.el8.x86_64.rpm
/home/pmatilai/Downloads/anydesk-6.1.1-1.el8.x86_64.rpm:
error: Error verifying signature: Verifying a signature using certificate D56311E5FF3B6F39D5A16ABE18DF3741CDFFDE29:
No binding signature at time 2021-04-13T11:08:37Z
error: Error verifying signature: Verifying a signature using certificate D56311E5FF3B6F39D5A16ABE18DF3741CDFFDE29:
No binding signature at time 2021-04-13T11:08:37Z
Header V3 RSA/SHA1 Signature, key ID cdffde29: BAD
Header SHA1 digest: OK
V3 RSA/SHA1 Signature, key ID cdffde29: BAD
MD5 digest: OK

This seems more than adequate for 4.18.x but I'm now wondering if we shouldn't go ahead and wire this up all the way through in 4.19, there's a long-standing need for a saner package verification public API anyway... (#2041) Mind you, I'm not expecting you to do that work, just thinking out loud.

nwalfield · 2023-03-31T07:41:07Z

The change is relative straightforward, and is a major UX improvement, I'd say. I think it makes a lot of sense to add it to master and publish it with 4.19.

pmatilai · 2023-03-31T07:50:07Z

Oh absolutely it will go into 4.19 as well, what I'm wondering is if we shouldn't go the extra step further there.

pmatilai · 2023-03-31T08:03:44Z

On a loosely related note, this starts getting into territory where we may want to support multiple versions of rpm-sequoia, ie test whether Verify2 is available and fall back to old if not. I'll look into that, don't worry about it.

Add a new function, pgpVerifySignature2, which is like pgpVerifySignature, but optionally returns descriptive error messages (in the case of failure) or lints (in the case of success). This requires rpm-sequoia 1.4 or later. See rpm-software-management/rpm-sequoia#39 and rpm-software-management#2127 (comment)

nwalfield · 2023-04-12T16:01:56Z

This is basically done. (CI is failing, because rpm-sequoia 1.4 is not yet available.) @pmatilai if you are happy, I'll release rpm-sequoia 1.4. Otherwise, I'm happy to iterate some more.

Add a new function, `pgpPrtParams2`, which is like `pgpPrtParams`, but optionally returns descriptive error messages (in the case of failure) or lints (in the case of success). This requires rpm-sequoia 1.4 or later. Fixes rpm-software-management#2483.

nwalfield · 2023-04-13T23:16:42Z

FYI, I've also released 1.4.0 of rpm-sequoia

nwalfield · 2023-04-15T14:46:29Z

And thanks to @decathorpe, 1.4.0 already in rawhide: https://packages.fedoraproject.org/pkgs/rust-rpm-sequoia/rpm-sequoia/

pmatilai · 2023-04-20T10:43:42Z

I took this, adjusted the tests to match + fixed some minor issues such as indentation and missing prototype for pgpPrtParams2(), added temporary tweak to pull the new rpm-sequoia from updates-testing and merged it into one commit (separate commits didn't seem particularly beneficial): #2493

pmatilai · 2023-04-20T10:46:07Z

Thanks for the initial work!

nwalfield · 2023-04-21T15:00:33Z

@pmatilai : Thanks a lot for revising this! It's a bit embarrassing that I failed to commit the adjustments to the tests :/. I'm sorry for making work for you.

pmatilai · 2023-04-28T06:15:32Z

@nwalfield , not at all. You've certainly done more than your share on this all, and I knew you had other commitments in April.

pmatilai reviewed Mar 24, 2023

View reviewed changes

pmatilai reviewed Mar 31, 2023

View reviewed changes

rpmio/rpmpgp_internal.c Outdated Show resolved Hide resolved

pmatilai mentioned this pull request Mar 31, 2023

Provide a decent API for verifying package signatures #2041

Open

nwalfield force-pushed the pgp-verify-signature2 branch 2 times, most recently from 31c8068 to 5498d2b Compare April 11, 2023 23:15

nwalfield force-pushed the pgp-verify-signature2 branch from 5498d2b to b74ad98 Compare April 12, 2023 16:00

Add pgpPrtParams2

fe2b495

Add a new function, `pgpPrtParams2`, which is like `pgpPrtParams`, but optionally returns descriptive error messages (in the case of failure) or lints (in the case of success). This requires rpm-sequoia 1.4 or later. Fixes rpm-software-management#2483.

pmatilai closed this Apr 20, 2023

nwalfield deleted the pgp-verify-signature2 branch May 3, 2023 12:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add pgpVerifySignature2 #2453

Add pgpVerifySignature2 #2453

nwalfield commented Mar 24, 2023

pmatilai Mar 24, 2023

nwalfield Mar 24, 2023

pmatilai Mar 31, 2023 •

edited

Loading

nwalfield Apr 11, 2023

pmatilai commented Mar 31, 2023

nwalfield commented Mar 31, 2023

pmatilai commented Mar 31, 2023

pmatilai commented Mar 31, 2023

nwalfield commented Apr 12, 2023

nwalfield commented Apr 13, 2023

nwalfield commented Apr 15, 2023

pmatilai commented Apr 20, 2023 •

edited

Loading

pmatilai commented Apr 20, 2023

nwalfield commented Apr 21, 2023

pmatilai commented Apr 28, 2023

Add pgpVerifySignature2 #2453

Add pgpVerifySignature2 #2453

Conversation

nwalfield commented Mar 24, 2023

pmatilai Mar 24, 2023

Choose a reason for hiding this comment

nwalfield Mar 24, 2023

Choose a reason for hiding this comment

pmatilai Mar 31, 2023 • edited Loading

Choose a reason for hiding this comment

nwalfield Apr 11, 2023

Choose a reason for hiding this comment

pmatilai commented Mar 31, 2023

nwalfield commented Mar 31, 2023

pmatilai commented Mar 31, 2023

pmatilai commented Mar 31, 2023

nwalfield commented Apr 12, 2023

nwalfield commented Apr 13, 2023

nwalfield commented Apr 15, 2023

pmatilai commented Apr 20, 2023 • edited Loading

pmatilai commented Apr 20, 2023

nwalfield commented Apr 21, 2023

pmatilai commented Apr 28, 2023

pmatilai Mar 31, 2023 •

edited

Loading

pmatilai commented Apr 20, 2023 •

edited

Loading