@mgorny@social.treehouse.systems
2026-09-21 12:21 UTC
Zero days since it turned out that #GnuPG has arbitrarily changed behavior between versions in the name of "safe default", and required you to pass an additional option to make it behave properly in the rare cases it matters. Of course we still need to support old versions and alternative implementations without that option. And of course there is no clean way of checking whether it's available or not.
https://bugs.gentoo.org/983021
#OpenPGP #GPG #Gentoo
Replies (3)
-
@duxsco@fedifreu.de 2026-09-21 12:55
@mgorny@social.treehouse.systems Once GnuPG can, at least, verify RFC 9580/9880 compliant signatures (https://floss.social/@hko/117127125465768501), we can think about creating new PQC-resilient keypairs and use a tool (e.g. sequoia-pgp) that can create RFC 9580/9880 compliant signatures for ::gentoo repo, stage3 tarballs and whatever. Since https://dev.gnupg.org/T4618.html, I lost trust in GnuPG.
-
@lanodan@queer.hacktivis.me 2026-09-21 12:32
@mgorny@social.treehouse.systems And of course an awful error message with it.
-
@andrewg@mastodon.ie 2026-09-21 16:02
@mgorny@social.treehouse.systems do you know when this changed in gnupg?