rpm-sequoia 1.4.0 - Announce - lists.sequoia-pgp.org

13 Apr 2023


      Hi everyone,
I'm pleased to announce v1.4.0 of the RPM Sequoia crate.
I have published rpm-sequoia on crates.io:
https://crates.io/crates/rpm-sequoia
You can also fetch version 1.4.0 using the v1.4.0 tag:
https://github.com/rpm-software-management/rpm-sequoia/releases/tag/v1.4.0
which I signed:
$ git verify-tag v1.4.0
  gpg: Signature made Thu Apr 13 23:10:27 2023 +02:00
  gpg:                using RSA key C03FA6411B03AE12576461187223B56678E02528
  gpg: Good signature from "Neal H. Walfield neal@walfield.org" [ultimate]
  gpg:                     "Neal H. Walfield neal@gnupg.org"
  gpg:                     "Neal H. Walfield neal@pep-project.org"
  gpg:                     "Neal H. Walfield neal@pep.foundation"
  gpg:                     "Neal H. Walfield neal@sequoia-pgp.org"
The most notable change in this release is better error reporting.
Based on feedback from users of rpm on Fedora 38 beta, we learned that
many certificates, and many packages use outdated cryptography, or are
generated from broken OpenPGP implementations.  As sequoia-openpgp is
more strict in what it accepts than rpm's deprecated internal OpenPGP
implementation, installing these packages now results in an error.
Although rpm-sequoia often knows in detail why a certificate or
signature is invalid, rpm did not have a way to return this
information.  As such, rpm could only print out that the package could
not be installed, like this:
```
$ rpm -i google-chrome-stable-109.0.5414.119-1.x86_64.rpm
warning: google-chrome-stable-109.0.5414.119-1.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 7fac5991: NOTTRUSTED
    package google-chrome-stable-109.0.5414.119-1.x86_64 does not verify: Header V4 DSA/SHA1 Signature, key ID 7fac5991: NOTTRUSTED
```
This release introduces two new functions, which are identical to
existing functions in their functionality, but also return rich error
messages, which will hopefully help users more easily diagnose the
underlying problem.  For instance, using a patched version of rpm,
which uses these new interfaces, here's what happens when trying to
install a package whose signature can't be verified:
```
$ rpm -i google-chrome-stable-109.0.5414.119-1.x86_64.rpm
error: Verifying a signature using certificate 4CCA1EAF950CEE4AB83976DCA040830F7FAC5991 (Google, Inc. Linux Package Signing Key linux-packages-keymaster@google.com):
  1. Signature 02b3 created at Mon Jan 23 21:23:32 2023 invalid: signature relies on legacy cryptography
      because: Policy rejected non-revocation signature (Binary) requiring collision resistance
      because: SHA1 is not considered secure since 1970-01-01T00:00:00Z
  2. Certificate A040830F7FAC5991 invalid: policy violation
      because: No binding signature at time 2023-01-23T21:23:32Z
      because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
      because: SHA1 is not considered secure since 1970-01-01T00:00:00Z
warning: google-chrome-stable-109.0.5414.119-1.x86_64.rpm: Header V4 DSA/SHA1 Signature, key ID 7fac5991: NOTTRUSTED
error: Failed dependencies:
    rpmlib(PayloadIsXz) <= 5.2-1 is needed by google-chrome-stable-109.0.5414.119-1.x86_64
$ rpm -i anydesk-6.1.1-1.el7.x86_64.rpm
error: Verifying a signature using certificate D56311E5FF3B6F39D5A16ABE18DF3741CDFFDE29 (philandro Software GmbH info@philandro.com):
  1. Signature 9b8f created at Tue Apr 13 11:08:37 2021 invalid: signature relies on legacy cryptography
      because: Policy rejected non-revocation signature (Binary) requiring collision resistance
      because: SHA1 is not considered secure since 1970-01-01T00:00:00Z
  2. Certificate 18DF3741CDFFDE29 invalid: policy violation
      because: No binding signature at time 2021-04-13T11:08:37Z
error: anydesk-6.1.1-1.el7.x86_64.rpm: Header V3 RSA/SHA1 Signature, key ID cdffde29: BAD
error: anydesk-6.1.1-1.el7.x86_64.rpm cannot be installed
```
And here's what rpm emits when trying to install a package with an
incorrectly generated signature:
```
$ rpm -i intel-oneapi-common-licensing-2023.1.0-2023.1.0-43473.noarch.rpm
error: intel-oneapi-common-licensing-2023.1.0-2023.1.0-43473.noarch.rpm: Header RSA signature: BAD (package tag 268: invalid OpenPGP signature: Parsing an OpenPGP packet:
  Failed to parse Signature Packet
      because: Signature appears to be created by a non-conformant OpenPGP implementation, see https://github.com/rpm-software-management/rpm/issues/2351.
      because: Malformed MPI: leading bit is not set: expected bit 8 to be set in      101 (5))
error: intel-oneapi-common-licensing-2023.1.0-2023.1.0-43473.noarch.rpm cannot be installed
```
Neal on behalf of the whole Sequoia PGP team