mirror of
https://github.com/aptly-dev/aptly.git
synced 2026-11-12 14:31:02 +00:00
Daniel Pinder
59ff63de62
Debian co-signs each suite's InRelease with more than one archive key, so gpgv reports a good signature from the key you trust and NO_PUBKEY for the others, exiting 2. Both verifiers treat that as failure, which means mirroring Debian requires importing every key Debian happens to sign with. apt does not require this: it is fatal only when there is no good signature or a BADSIG. Adopt that rule for unknown signers. When gpgv exits non-zero the status stream is parsed per NEWSIG block and the result is a success only when the process exited, at least one block is a good signature from a held key, at least one block is an unknown issuer (ERRSIG reason 9 with NO_PUBKEY), and nothing else appears. BADSIG, EXPSIG, EXPKEYSIG and REVKEYSIG from a held key still fail, as does any unexplained failure. The exit-zero path is unchanged. KEYEXPIRED and KEYREVOKED are deliberately not disqualifiers: doc/DETAILS notes KEYEXPIRED is emitted for an expired subkey even when that subkey was not used, so treating it as a verdict rejects valid signatures. checkDetachedSignature gets the equivalent change for the internal verifier.