gentoo-mirror/gentoo
1
0
Fork 0
mirror of https://github.com/gentoo-mirror/gentoo.git synced 2026-01-06 02:17:34 -08:00
Code Issues Projects Releases Wiki Activity

verify-sig.eclass: Accept 1-out-of-n sigs on multisig files

Browse Source 
If a distfile has multiple detached signatures, pass verification
if at least one of them can be verified rather than requiring all
of them.  This is particularly helpful for upstreams where the whole
set of release keys is hard to come by.

Closes: https://bugs.gentoo.org/873211
Closes: https://github.com/gentoo/gentoo/pull/29224
Signed-off-by: Michał Górny <mgorny@gentoo.org>
Closes: https://github.com/gentoo/gentoo/pull/29592
Signed-off-by: Michał Górny <mgorny@gentoo.org>
This commit is contained in:
Michał Górny 2023-01-23 09:23:18 +01:00
parent d466b3b94a
commit 0611129171
No known key found for this signature in database
GPG Key ID: 639ADAE2329E240E
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
eclass/verify-sig.eclass
View File

@ -160,7 +160,7 @@ verify-sig_verify_detached() {
# https://bugs.gentoo.org/854492
local -x TMPDIR=/tmp
gemato openpgp-verify-detached -K "${key}" \
"${extra_args[@]}" \
"${extra_args[@]}" --no-require-all-good \
"${sig}" "${file}" ||
die "PGP signature verification failed"
;;