mirror of
https://github.com/aptly-dev/aptly.git
synced 2026-11-13 14:37:18 +00:00
Daniel Pinder
59ff63de62
Debian co-signs each suite's InRelease with more than one archive key, so gpgv reports a good signature from the key you trust and NO_PUBKEY for the others, exiting 2. Both verifiers treat that as failure, which means mirroring Debian requires importing every key Debian happens to sign with. apt does not require this: it is fatal only when there is no good signature or a BADSIG. Adopt that rule for unknown signers. When gpgv exits non-zero the status stream is parsed per NEWSIG block and the result is a success only when the process exited, at least one block is a good signature from a held key, at least one block is an unknown issuer (ERRSIG reason 9 with NO_PUBKEY), and nothing else appears. BADSIG, EXPSIG, EXPKEYSIG and REVKEYSIG from a held key still fail, as does any unexplained failure. The exit-zero path is unchanged. KEYEXPIRED and KEYREVOKED are deliberately not disqualifiers: doc/DETAILS notes KEYEXPIRED is emitted for an expired subkey even when that subkey was not used, so treating it as a verdict rejects valid signatures. checkDetachedSignature gets the equivalent change for the internal verifier.
23 lines
999 B
Plaintext
23 lines
999 B
Plaintext
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA256
|
|
|
|
aptly multi-signature verification fixture
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
|
|
iQEzBAEBCAAdFiEEK14dkVdjQa9ExgDhMK0ohu1Yd1wFAmqYKJEACgkQMK0ohu1Y
|
|
d1wi/Qf/du6Cfs5Og7jqNG17jUEMNO+ZTYfI60ytrcQ47BgX21zGorRWE6M9L6EJ
|
|
YbgYptGRrSHrVIZJXWVVWsdWbTHG4pW5ph2cSeVjOQWGF7JqlqjJOmrbzrQo2FSs
|
|
EwQiCloJ7sBRj7bVtf1ovkfFWp00wNO77ZHJK0vBCSf8v43V0BEykL25lvEG5KTG
|
|
TO8k+Yh9hDo/0DkPQpp7b5k9IVOgJrnQn9NuW7iD62FeM8WKrhk6EAHDzhDD5jyT
|
|
hf3ADA9nEc4i0bPVMwVXMHgW+Wmm6DtJxQYNlZrPzPLG7+1mpZN1OQBG0w/QnLsW
|
|
p6o2Nh+xVwO5ko7uSUtTCrt2IGogk4kBMwQBAQgAHRYhBDLwA6IWaB1MyBD6IZi1
|
|
MB6x+hMXBQJqmCiRAAoJEJi1MB6x+hMXZzgH/jHmAjbymQcvZ9HsQCIv7aN07sCr
|
|
HtjgUPzaOsibn8NRQiXtVQqqDChaQi2brSqeTG2oNN2+buRNQAXwyEmtC7+6SdH3
|
|
/lnH/7IpdqMRBBtmiAH5ny9DfgenWNWb8F2hAcoc00RugiDFFyVmlBfBXK5/l+KI
|
|
DanIKW97TXXMA8J8KAe/asOXaht8oiW85dmAlSlrHRWZxOBTLR3540nMTD0/Cp5n
|
|
i+ngQpqIzSykFQ/4scYVT4rc/Iu64yCV75O5fumQDrqMPqXfD+Lms4bFhQYxja8K
|
|
uofxwhwHvz5xEGSDve/krZrD8JG7mMINZjjxIr5t83eKXcxhHd7BVUBj4yI=
|
|
=ulCF
|
|
-----END PGP SIGNATURE-----
|