On Mon, Mar 27, 2023 at 01:29:38PM +0200, Neal H. Walfield wrote: > On Mon, 27 Mar 2023 13:16:45 +0200, > Zbigniew Jędrzejewski-Szmek wrote: > > I agree. The scope of the issue is fairly narrow, and the underlying > > issue is an invalid signature made by the anydesk maintainers. > > We also have a simple command that users can use to work around > > the issue. > > If you are thinking of sq-keyring-linter, that won't help here. This > is not a SHA-1 issue. I know. I mentioned neither of those two things ;) The workaround I had in mind: add '--exclude-anydesk'. We don't have a good replacement for graphical users yet, but I'm sure we'll be able to write something up in CommonBugs before F38 is released. > The issue (I think) is that the anydesk maintains were too aggressive > in what they striped when they exported the OpenPGP certificate. [snip] Yes, probably. Anyway, the end result is that "based on the knowledge that Sequoia has, the certificate was not valid when the signature was made." (This is based on your comment [1]. I'm reproducing this here for others.) [1] https://bugzilla.redhat.com/show_bug.cgi?id=2170878#c124 Zbyszek _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
