Support detached signature verification for tars and zips#16574
Support detached signature verification for tars and zips#16574ellahathaway merged 7 commits intodotnet:mainfrom
Conversation
ellahathaway
force-pushed
the
signcheck-detached-signature
branch
from
7f43a23 to
2b6ca9c
Compare
|
@mmitche - friendly ping for a review whenever you get a chance :) I'd like to get this in and flowed to the VMR by 10.0 code complete. Thanks! |
…verifiers The parameter name 'supportsDetachedSignature' implied capability support, but it actually controls whether verifiers look for a detached signature (.sig file) instead of a non-detached signature. Rename to 'signatureIsDetached' to better reflect the semantics. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
Should this be merged? |
I would like to test this on rpms and debs first. I have it on my list to get it merged in before 10.0 code complete this month. Side note that dotnet/dotnet#5835 would help immensely with the timing issue of merging changes like this (not having to get these changes in before code complete deadline, waiting for release day for a reboostrap, etc). |
rpms and debs were being skipped by default due to my changes. Fixed in 394ddef. This PR is ready to be merged once it gets approved. |
Co-authored-by: Michael Simons <msimons@microsoft.com>
Move detached signature concept out of PgpVerifier and into the subclasses that use it (TarVerifier, ZipVerifier). Make GetSignatureDocumentAndSignableContent abstract again, and provide reusable helpers (VerifyDetachedSignature, GetDetachedSignatureDocument AndSignableContent) for subclasses with detached signatures.
|
/backport to release/10.0 |
|
Started backporting to |
5 participants
Closes #16249
Adds support for detecting and verifying tars and zips with detached signatures.