search

craigwblake / redline

Pure Java Rpm Library
http://redline-rpm.org
MIT License
128 stars 97 forks source link

Issue #112 using a DSA key results in an rPM package with an unverifi… #113

Open bschelberg opened 8 years ago

bschelberg commented 8 years ago

Using a DSA key results in an RPM package with an unverifiable signature

It seems like DSA has been deprecated by some projects, and we're strongly encouraged to move to RSA. However, Redline RPM currently accepts DSA keys for sigining, but signs the package incorrectly, resulting in errors from RPM with errors that are difficult to diagnose.

kkolinko commented 7 years ago

I do not like this.

  1. It breaks the feature implemented by #77 In scenario of #77 your getAlgorithm() call will return null and you will fail with IAE. Expected behaviour is to fall through and set this.enabled=false,

  2. It does not solve the issue of wrong signature by generating a correct one. It just disallows one to generate any other signature besides RSA.