Re: Best practices for signature verifcation

[Ali Polatel <alip () hexsys org>]

On Monday, 29 December 2025 at 02:36, Demi Marie Obenour <demiobenour () gmail com> wrote:

> In light of the recent GnuPG vulnerabilities, I remembered that OpenPGP
> is almost never the right choice. CMS/PKCS#7 isn't any better, and
> X.509 is also bad except that its extremely wide deployment in TLS
> keeps it alive.
>
> See https://www.latacora/com/blog/2019/07/16/the-pgp-problem/
>
> and https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/.

OpenBSD has signify[1] and the article "Securing OpenBSD From Us To You"
by the main author is worth reading. Having been a loyal GnuPG user for
long years, these vulnerabilities made me reconsider my approach to
signing yet again. This time, though, I decided to act on it. I wrote
a clean Rust implementation of signify and called it signify-rs[3].
It uses the same license (ISC) as the reference implementation. Code
is free of unsafes and arithmetic side effects. No proc macros are used
in the code or any dependencies making it static-linking friendly. It's
fairly portable and passes tests on FreeBSD, NetBSD, Linux and Windows.

My initial goal is to switch signing Syd binary releases from gpg to
signify. Next intention is to consider signing package manifests on
Exherbo Linux distribution with it. If my memory serves me right,
Gentoo Linux and Portage has support for GPG signed manifests and
it has been a longstanding issue in Exherbo Linux how we want to
do manifests. Current consensus is to use thin package manifests
on a best-effort basis because we lack the developer time to go
all in. Thin manifests store a single checksum and package size
of the relevant package distfiles. My goal/dream is to integrate
signify into this workflow and start signing thin manifests using
signify.

Sharing is caring, so here is the git[5] and CI[6]. CI saves
static-linked signify binaries as build artifacts which gives
an option to quickly test. Enjoy.

Finally, my contribution is the "keyring" feature. When built
with this feature on Linux, keyrings(7) support is compiled in.
This adds a "-k <key-id>" argument to the subcommands -G(enerate)
and -S(ign) when the user may submit a 32-bit key ID rather than
inputting the passphrase manually with a prompt.

[1]: https://man.openbsd.org/signify
[2]: https://www.openbsd.org/papers/bsdcan-signify.html
[3]: https://crates.io/crates/signify-rs
[4]: https://www.kepstin.ca/blog/manifest-generation-in-exherbo/
[5]: https://git.sr.ht/~alip/signify
[6]: https://builds.sr.ht/~alip/signify

> --
> Sincerely,
> Demi Marie Obenour (she/her/hers)

Best regards,
Ali Polatel

Attachment: publickey - alip@hexsys.org - 0xC22DA9DE.asc
Description:

Attachment: signature.asc
Description: OpenPGP digital signature