PGP: Use new librepo PGP API, remove gpgme dependency #166
Conversation
Librepo internally uses gpgme to work with PGP keys. Libdnf used the librepo keyring directly via gpgme instead of using the librepo API. It had to, the librepo API was insufficient. Librepo in version 1.15.0 extended the PGP API. This commmit uses the extended librepo PGP API and removes libdnf's dependency on gpgme.
Libdnf no longer uses gpgme. Leaving the "gpgme" strings would be misleading.
raw_key is a string in ASCII-Armor format. It makes sense to store in std::string rather than converting to vector.
Previously, only one user ID per key was supported.
jrohel
force-pushed
the
feature/use_librepo_PGP_API
branch
from
bec1753 to
ded8512
Compare
| @@ -799,7 +803,7 @@ bool Context::check_gpg_signatures(const libdnf::base::Transaction & transaction | |||
| void Context::download_and_run(libdnf::base::Transaction & transaction) { | |||
| download_packages(transaction, nullptr); | |||
|
|
|||
| std::cout << std::endl << "Verifying GPG signatures" << std::endl; | |||
| std::cout << std::endl << "Verifying PGP signatures" << std::endl; | |||
There was a problem hiding this comment.
When changing all output from GPG -> PGP, maybe also the line 748 here in the context.cpp?
|
Since we are starting with the |
|
Also another question related to builds. We don't have the new |
The CI is taking builds from nightly so it should work tomorrow (librepo 1.15.0 will be available in nightly repo). |
PGP is not really any better than GPG, because PGP is the name of the commercial software. Use OpenPGP when referring to the standard. |
|
@pmatilai What are the keys called? OpenPGP keys? Or PGP keys? Or GPG keys? When I go through the OpenPGP standard, the Armor Header Line can contain: So I chose PGP. But we can discuss where to change PGP to OpenPGP. Because you're right, PGP is a program. In addition, PGP is also a trademark. |
|
Everything is OpenPGP, including keys and signatures. The ASCII armor has "PGP" as a remnant from its origins in the PGP program, preserved for compatibility I'd think. |
|
I created a new issue for deciding about the naming problem. Here we could just fix the single mentioned occurrence of the GPG in the output from I will wait for tomorrow when new |
Librepo internally uses gpgme to work with PGP keys. Libdnf used the librepo keyring directly via gpgme instead of using the librepo API. It had to, the librepo API was insufficient.
Librepo in version 1.15.0 extended the PGP API.
This commmit uses the extended librepo PGP API and removes libdnf's dependency on gpgme.
PR also adds support for any number of user IDs in a PGP key.
This PR requires new librepo PGP API PR rpm-software-management/librepo#266 .