Rocky Linux 9 (Fedora 34) cannot recognize the signature added by Gitea #14003

Closed
opened 2025-11-02 10:59:47 -06:00 by GiteaMirror · 2 comments
Owner

Originally created by @ExplodingDragon on GitHub (Jan 16, 2025).

Due to https://github.com/ProtonMail/go-crypto/pull/208, RPM versions < 4.17 cannot recognize signature information generated by ProtonMail/go-crypto. (see https://github.com/ProtonMail/go-crypto/issues/263)

There is no need to consider fixing this issue until a better solution is available; this issue is only for archiving purposes.

Affected versions : all versions after a8e7caedfa.

Originally created by @ExplodingDragon on GitHub (Jan 16, 2025). Due to https://github.com/ProtonMail/go-crypto/pull/208, `RPM versions < 4.17` cannot recognize signature information generated by `ProtonMail/go-crypto`. (see https://github.com/ProtonMail/go-crypto/issues/263) There is no need to consider fixing this issue until a better solution is available; this issue is only for archiving purposes. **Affected versions** : all versions after a8e7caedfa062cd8ea34f722806b3f162d24e939.
GiteaMirror added the type/bugtype/upstream labels 2025-11-02 10:59:47 -06:00
Author
Owner

@wxiaoguang commented on GitHub (Jan 16, 2025):

The ProtonMail/go-crypto 1.1.x is required by go-git 5.13

And yes, according to https://github.com/ProtonMail/go-crypto/issues/263, it is a regression in go-crypto 1.1 ..... I guess it should be fixed by upstream, either revert to the old behavior, or introduce an option

ps: Gitea 1.23.x is also affected because go-git there was also upgraded to 5.13 to fix security issues (#33133 in 1.23)

@wxiaoguang commented on GitHub (Jan 16, 2025): The `ProtonMail/go-crypto 1.1.x` is required by `go-git 5.13` * https://github.com/go-git/go-git/blob/v5.12.0/go.mod (go-crypto 1.0) * https://github.com/go-git/go-git/blob/v5.13.0/go.mod (go-crypto 1.1) And yes, according to https://github.com/ProtonMail/go-crypto/issues/263, it is a regression in go-crypto 1.1 ..... I guess it should be fixed by upstream, either revert to the old behavior, or introduce an option ps: Gitea 1.23.x is also affected because go-git there was also upgraded to 5.13 to fix security issues (#33133 in 1.23)
Author
Owner

@wxiaoguang commented on GitHub (Feb 27, 2025):

Upstream has merged the fix: Make Issuer Key ID signature subpacket non-critical ProtonMail/go-crypto#266

@wxiaoguang commented on GitHub (Feb 27, 2025): Upstream has merged the fix: Make Issuer Key ID signature subpacket non-critical ProtonMail/go-crypto#266
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#14003