Importer fails on signed upload carying non-utf8 notation data in GPG signature
GPG has a feature called Notation data allowing users to attach arbitrary data to a signature.
The sequoia-pgp project provides a rust implementation for a compatible interface to gpg and gpgv, which can be installed from testing and unstable using gpg-from-sq and gpgv-from-sq. In this context, the gpg sq backend comnmand includes a random binary hash in every signature.
The notation data is present in the status output, as seen in this example:
$ gpg --verify --status-fd 1 test.asc |& grep -a NOTATION_DATA | cat -A
[GNUPG:] NOTATION_DATA M-^EM-#(%0CkM-o%0BM-hM-h%1Al!Z}M-^D)XM-^QKM-cM-lM-^]M-MM-u5}M-^MM-t]M-yM-[M- $
Because of this partially encoded binary in an otherwise text output (Upstream and I have divergent point of view in the matter, see #1074127), debexpo importer will fail trying to decode it as UTF8.
Therefore, we need to adapt the GPG code to exclude notation data before trying to decode the output.
Note: fcb2642c added testing for importing users key with UTF-8 uid. Alongside with a regression test for the notation data, it should be enough to validate the correct behavior for the new implementation.
TODO:
-
Allow debexpo_exec()caller to override the encoding -
Make GnuPG._run()drop notation data information and then decode as UTF-8 -
Add tests