Relax the self-signature requirement. #52
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Triggered from #52 by @nwalfield. Checking if we can fast forward Target branch ( commit 9a5a387979713c112ff7abb775ec88608647c24e (HEAD -> main, origin/main, origin/HEAD)
Author: Neal H. Walfield <[email protected]>
Date: Thu Aug 24 17:26:10 2023 +0200
Add the fast-forward action.
- Add the `fast-forward` action to show if fast forwarding a pull
request is possible, and to actually do a fast-forward merge when an
authorized user adds a comment containing `/fast-forward` to the
pull request.Pull request ( commit a22932dba43b4524adbeb3576839f75cac4d894e (pull_request/neal/issue-50)
Author: Neal H. Walfield <[email protected]>
Date: Thu Aug 24 17:31:24 2023 +0200
Relax the self-signature requirement.
- When we verify a data signature, we canonicalize the signer's
certificate to look as it did at the time of the data signature.
- When exporting a certificate, GnuPG strips old self signatures.
- This means that when a certificate's expiration time is extended,
say, we are no longer able to verify old data signatures, because
the certificate is not considered to be valid as of the data
signature's creation time!
- Relax this requirement. Also allow a certificate, if it can be
canonicalized as of the current time.
- Fixes #50.It is possible to fast forward |
- When we verify a data signature, we canonicalize the signer's
certificate to look as it did at the time of the data signature.
- When exporting a certificate, GnuPG strips old self signatures.
- This means that when a certificate's expiration time is extended,
say, we are no longer able to verify old data signatures, because
the certificate is not considered to be valid as of the data
signature's creation time!
- Relax this requirement. Also allow a certificate, if it can be
canonicalized as of the current time.
- Fixes #50.
nwalfield
force-pushed
the
neal/issue-50
branch
from
a22932d to
ed4d12b
Compare
|
Triggered from #52 by @nwalfield. Checking if we can fast forward Target branch ( commit 9a5a387979713c112ff7abb775ec88608647c24e (HEAD -> main, origin/main, origin/HEAD)
Author: Neal H. Walfield <[email protected]>
Date: Thu Aug 24 17:26:10 2023 +0200
Add the fast-forward action.
- Add the `fast-forward` action to show if fast forwarding a pull
request is possible, and to actually do a fast-forward merge when an
authorized user adds a comment containing `/fast-forward` to the
pull request.Pull request ( commit ed4d12beaea8aa7331c232d3444e89a41f43662a (pull_request/neal/issue-50)
Author: Neal H. Walfield <[email protected]>
Date: Thu Aug 24 17:31:24 2023 +0200
Relax the self-signature requirement.
- When we verify a data signature, we canonicalize the signer's
certificate to look as it did at the time of the data signature.
- When exporting a certificate, GnuPG strips old self signatures.
- This means that when a certificate's expiration time is extended,
say, we are no longer able to verify old data signatures, because
the certificate is not considered to be valid as of the data
signature's creation time!
- Relax this requirement. Also allow a certificate, if it can be
canonicalized as of the current time.
- Fixes #50.It is possible to fast forward |
|
/fast-forward |
|
Triggered from #52 (comment) by @nwalfield. Trying to fast forward Target branch ( commit 9a5a387979713c112ff7abb775ec88608647c24e (HEAD -> main, origin/main, origin/HEAD)
Author: Neal H. Walfield <[email protected]>
Date: Thu Aug 24 17:26:10 2023 +0200
Add the fast-forward action.
- Add the `fast-forward` action to show if fast forwarding a pull
request is possible, and to actually do a fast-forward merge when an
authorized user adds a comment containing `/fast-forward` to the
pull request.Pull request ( commit ed4d12beaea8aa7331c232d3444e89a41f43662a (pull_request/neal/issue-50)
Author: Neal H. Walfield <[email protected]>
Date: Thu Aug 24 17:31:24 2023 +0200
Relax the self-signature requirement.
- When we verify a data signature, we canonicalize the signer's
certificate to look as it did at the time of the data signature.
- When exporting a certificate, GnuPG strips old self signatures.
- This means that when a certificate's expiration time is extended,
say, we are no longer able to verify old data signatures, because
the certificate is not considered to be valid as of the data
signature's creation time!
- Relax this requirement. Also allow a certificate, if it can be
canonicalized as of the current time.
- Fixes #50.Fast forwarding $ git push origin ed4d12beaea8aa7331c232d3444e89a41f43662a:main
To https://github.com/rpm-software-management/rpm-sequoia.git
9a5a387..ed4d12b ed4d12beaea8aa7331c232d3444e89a41f43662a -> main |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When we verify a data signature, we canonicalize the signer's certificate to look as it did at the time of the data signature.
When exporting a certificate, GnuPG strips old self signatures.
This means that when a certificate's expiration time is extended, say, we are no longer able to verify old data signatures, because the certificate is not considered to be valid as of the data signature's creation time!
Relax this requirement. Also allow a certificate, if it can be canonicalized as of the current time.
Fixes RPM distrusts signatures done by previous versions of prolonged keys #50.