Re: Why Does Debian Use PGP to Sign Packages

From	kpcyrd <kpcyrd@archlinux.org>
Newsgroups	linux.debian.security
Subject	Re: Why Does Debian Use PGP to Sign Packages
Date	2025-08-16 16:30 +0200
Message-ID	<Lkq4V-840E-1@gated-at.bofh.it> (permalink)
References	<Lke3L-7W49-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 8/16/25 3:22 AM, fosres@posteo.de wrote:
> Hello All,
> 
> In an earlier post I asked why Debian uses PGP to sign packages despite 
> its complexity.
> 
> Some responded that Sequoia PGP simplifies the process.
> 
> I now wish to ask why Debian uses PGP in general to sign packages when 
> there are alternatives such as SigStore.

Having worked with both PGP/RFC-4880 and Sigstore, I found them to be of 
similar complexity, implementation wise (x509, ASN.1, base64 encoded 
json all layered into each other, some multiple times).

Also, when I looked into pypi's implementation of PEP-740[1], I couldn't 
figure out how to do an offline-verification of the 
signature/attestation using the sigstore Rust crate[2], to the point I 
gave up on my project.

[1]: https://github.com/kpcyrd/pypi-provenance-auth
[2]: https://docs.rs/sigstore/

(Not trying to hijack this thread, but if somebody knows how to do this, 
I'm still interested in a solution).

cheers,
kpcyrd

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Why Does Debian Use PGP to Sign Packages fosres@posteo.de - 2025-08-16 03:40 +0200
  Re: Why Does Debian Use PGP to Sign Packages Jeffrey Walton <noloader@gmail.com> - 2025-08-16 11:20 +0200
    Re: Why Does Debian Use PGP to Sign Packages Simon Josefsson <simon@josefsson.org> - 2025-08-16 11:40 +0200
  Re: Why Does Debian Use PGP to Sign Packages Simon Josefsson <simon@josefsson.org> - 2025-08-16 11:30 +0200
  Re: Why Does Debian Use PGP to Sign Packages kpcyrd <kpcyrd@archlinux.org> - 2025-08-16 16:30 +0200

csiph-web