Arch Linux

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#58495 - [mkinitcpio-busybox] pkgbuild, add fingerprint

Attached to Project: Arch Linux
Opened by . (flysprayer) - Tuesday, 08 May 2018, 09:51 GMT
Last edited by Doug Newgard (Scimmia) - Thursday, 20 September 2018, 15:01 GMT
Task Type Feature Request
Category Packages: Core
Status Closed
Assigned To Bartłomiej Piotrowski (Barthalion)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No
This task depends upon

Closed by  Doug Newgard (Scimmia)
Thursday, 20 September 2018, 15:01 GMT
Reason for closing:  Deferred
Additional comments about closing:  Added to https://www.archlinux.org/todo/use-gpg-s ignatures-and-https-sources/
Comment by Eli Schwartz (eschwartz) - Tuesday, 08 May 2018, 15:06 GMT
(Not listed in the TODO for some reason.)

This is a dsa1024 signature, it hardly even qualifies. :(

Someone should ask the busybox maintainer to upgrade to a post-2000 signing algorithm. Also I cannot find anywhere on the internet where his PGP key is publicly referenced.
Comment by Eli Schwartz (eschwartz) - Tuesday, 08 May 2018, 15:12 GMT
No, even worse. This isn't a useful PGP signature at all, it's a PGP-signed message:

MD5: 5db059384469827ab19dac69d3fcd092 busybox-1.28.2.tar.bz2
SHA1: 5ddba42aa14b875688727f0a3a9973e42fc51c23 busybox-1.28.2.tar.bz2
Comment by . (flysprayer) - Thursday, 20 September 2018, 14:48 GMT
gpg: Signature made Sun 09 Sep 2018 09:57:50 PM EEST
gpg: using DSA key 47B70C55ACC9965B
gpg: Good signature from "Denis Vlasenko <vda.linux@googlemail.com>" [unknown]
Comment by Doug Newgard (Scimmia) - Thursday, 20 September 2018, 14:49 GMT
Looks like they did start signing the tarball with 1.29.x

Loading...