4 ms·

RPM 6.0 Released with OpenPGP Improvements and Signature Checking by Default

1 points by westurner 1y ago

westurner 1y ago
"RPM 6.0.0 Release Notes" (2025) https://rpm.org/releases/6.0.0 https://rpm.org/releases/6.0.0 "RPM 6.0 Released With OpenPGP Improvements & Enforces Signature Checking By Default" (2025) https://www.phoronix.com/news/RPM-6.0-Released https://www.phoronix.com/news/RPM-6.0-Released
westurner 1y ago
By comparison, Python has removed PGP signature support with PEP 761 and instead depends upon sigstore fulcio. /? https://www.google.com/search?q=removed+gpg+and+sigstore+only+now https://www.google.com/search?q=removed+gpg+and+sigstore+onl... IIRC OpenPGP signatures do work with W3C VC; there's a URI for the key type and algorithm? "Chapter 8. Signing container images" and any other OCI artifact: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/building_running_and_managing_containers/assembly_signing-container-images_building-running-and-managing-containers https://docs.redhat.com/en/documentation/red_hat_enterprise_... : > You can use a GNU Privacy Guard (GPG) signature or a sigstore signature to sign your container image -- "What does a PGP signature on a Git commit prove?" https://news.ycombinator.com/item?id=26640915 https://news.ycombinator.com/item?id=26640915 "Git-signatures – Multiple PGP signatures for your commits" (2019) https://news.ycombinator.com/item?id=19183803#19186012 https://news.ycombinator.com/item?id=19183803#19186012 "Linked Data Signatures for GPG" > GpgLinkedDataKeyClass2020, GpgSignature2020: https://gpg.jsld.org/ https://gpg.jsld.org/ .. spec: https://gpg.jsld.org/contexts/ https://gpg.jsld.org/contexts/ "PGP Vocabulary v1" (2021) > PgpVerificationKey2021, PgpSignature2021:https://or13.github.io/lds-pgp2021/ https://or13.github.io/lds-pgp2021/ "Verifiable Credentials with PGP" (2022) https://transmute-industries.github.io/vc-pgp/ https://transmute-industries.github.io/vc-pgp/ -- A blog post from 2022 on how to do artifact key revocation with Sigstore Fulcio, Rekor, and AWS Lambda; but revocation transparency https://blog.sigstore.dev/dont-panic-a-playbook-for-handling-account-compromise-with-sigstore-ee299dca5144/ https://blog.sigstore.dev/dont-panic-a-playbook-for-handling... "Why you can’t use Sigstore without Sigstore" (2023) https://blog.sigstore.dev/why-you-cant-use-sigstore-without-sigstore-de1ed745f6fc/ https://blog.sigstore.dev/why-you-cant-use-sigstore-without-... "Model authenticity and transparency with Sigstore" https://next.redhat.com/2025/04/10/model-authenticity-and-transparency-with-sigstore/ https://next.redhat.com/2025/04/10/model-authenticity-and-tr... sigstore/model-transparency: https://github.com/sigstore/model-transparency https://github.com/sigstore/model-transparency

1 points by westurner 1y ago

"RPM 6.0.0 Release Notes" (2025) https://rpm.org/releases/6.0.0 https://rpm.org/releases/6.0.0 "RPM 6.0 Released With OpenPGP Improvements & Enforces Signature Checking By Default" (2025) https://www.phoronix.com/news/RPM-6.0-Released https://www.phoronix.com/news/RPM-6.0-Released

westurner 1y ago

By comparison, Python has removed PGP signature support with PEP 761 and instead depends upon sigstore fulcio. /? https://www.google.com/search?q=removed+gpg+and+sigstore+only+now https://www.google.com/search?q=removed+gpg+and+sigstore+onl... IIRC OpenPGP signatures do work with W3C VC; there's a URI for the key type and algorithm? "Chapter 8. Signing container images" and any other OCI artifact: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/building_running_and_managing_containers/assembly_signing-container-images_building-running-and-managing-containers https://docs.redhat.com/en/documentation/red_hat_enterprise_... : > You can use a GNU Privacy Guard (GPG) signature or a sigstore signature to sign your container image -- "What does a PGP signature on a Git commit prove?" https://news.ycombinator.com/item?id=26640915 https://news.ycombinator.com/item?id=26640915 "Git-signatures – Multiple PGP signatures for your commits" (2019) https://news.ycombinator.com/item?id=19183803#19186012 https://news.ycombinator.com/item?id=19183803#19186012 "Linked Data Signatures for GPG" > GpgLinkedDataKeyClass2020, GpgSignature2020: https://gpg.jsld.org/ https://gpg.jsld.org/ .. spec: https://gpg.jsld.org/contexts/ https://gpg.jsld.org/contexts/ "PGP Vocabulary v1" (2021) > PgpVerificationKey2021, PgpSignature2021:https://or13.github.io/lds-pgp2021/ https://or13.github.io/lds-pgp2021/ "Verifiable Credentials with PGP" (2022) https://transmute-industries.github.io/vc-pgp/ https://transmute-industries.github.io/vc-pgp/ -- A blog post from 2022 on how to do artifact key revocation with Sigstore Fulcio, Rekor, and AWS Lambda; but revocation transparency https://blog.sigstore.dev/dont-panic-a-playbook-for-handling-account-compromise-with-sigstore-ee299dca5144/ https://blog.sigstore.dev/dont-panic-a-playbook-for-handling... "Why you can’t use Sigstore without Sigstore" (2023) https://blog.sigstore.dev/why-you-cant-use-sigstore-without-sigstore-de1ed745f6fc/ https://blog.sigstore.dev/why-you-cant-use-sigstore-without-... "Model authenticity and transparency with Sigstore" https://next.redhat.com/2025/04/10/model-authenticity-and-transparency-with-sigstore/ https://next.redhat.com/2025/04/10/model-authenticity-and-tr... sigstore/model-transparency: https://github.com/sigstore/model-transparency https://github.com/sigstore/model-transparency