3 ms·

I don't think that this complaint is completely meritless but I don't buy most of the arguments. - keys not in a public keyserver? Does not mean that the sign

I don't think that this complaint is completely meritless but I don't buy most of the arguments. - keys not in a public keyserver? Does not mean that the signature is useless. - half of all keys used to sign on PyPI since 2020 are already expired. In theory you can't easily sign with an expired key, so I guess what he means is that he found packages using expired keys, but not that the keys were expired at the time the package was signed/pushed. Since them it is normal and does not mean that it will not verify once you take the signature date into account. I guess that it is heaven more common if you follow the good practice of a dedicated short life subkey of 2 years. In my own personal experience, I already got reports of an user of my package asking if everything was ok because I accidentally signed a release with a wrong key.

Avamander 3y ago
> Does not mean that the signature is useless. This has been discussed throughly in this and the previous thread. The gist is that without the public key being discoverable, it's not much more than a hash. Which makes it quite useless. > but not that the keys were expired at the time the package was signed/pushed. We can't know that with PGP. There's no validity stapling showing that a key was valid (or invalid) during the time of signing. All we have is that at the time of verifying the signature it was invalid, thus it's generally useless/invalid. This is further worsened by the fact that revocations (or extensions) are hard to have an up-to-date eye on, so you might be verifying a signature, finding it valid but they key had been already revoked. Yikes.