Check the validity of hash algo #3416
Conversation
If an RPM package has been signed and the hash algorithm is not supported by the current version, no error is reported during the verification of the RPM package, and "$?" return 0. Fix this problem.
|
NAK, this is stuff we do NOT want to know about (but historically, know too much). An unsupported signature algorithm will cause signature checking to fail, and that's all we care about. |
|
What verification are you talking about, specifically? The term is overloaded in multiple places around rpm... If an unknown algorithm causes us to give an OK to an unverifiable signature then we obviously do have a rather bug someplace. |
If xxx.rpm has been signed (Assume that the hash algorithm is hash_algo1 and the encryption and decryption algorithm is ecdsa.) , and the current RPM does not support hash_algo1. Run the |
|
Oh, right: an unsupported algorithm will be treated equally to non-existent ones, and if it's a signature the package will simply be considered unsigned. And, in the traditional configuration a signature is not required, only digest verification is required by default. Add this to the verify command and it will fail because there's no positive verification of the signature: The unsupported digest behavior is to permit the package to be verified by some other means, and that's even more important going forward as we add support for multiple signatures per package. It's is a dark corner for sure and non-obvious behavior when you first encounter it, but it's something we can't change without breaking other things. It'll be fixed by #1573. |
|
In the meanwhile: if you can do so in your environment, turning on enforcing signature checking (that _pkgverify_level thing) is very much recommended, that's supported since 4.14.2. It's just that so many workflows are based around the traditional no-signature behavior that changing the upstream default is damn hard. |
If an RPM package has been signed and the hash algorithm is not supported by the current version, no error is reported during the verification of the RPM package, and "$?" return 0. Fix this problem.