HPLIP

  1. Bug #1432516
  2. Comment #5

Comment 5 for bug 1432516

Revision history for this message
Enrico Zini (enrico) wrote : Re: [Bug 1432516] Re: Insecure binary driver verification (CVE-2015-0839)

On Fri, Jun 19, 2015 at 02:19:58PM -0000, Johannes Meixner wrote:

> Also our (SUSE) security team imformed me that
> the real solution would be when the HPLIP software
> contains the complete public fingerprint and uses that
> instead of the key id.

The Debian maintainer of gnupg is worried that the complete public
fingerprint may not be enough, and suggests instead to ship the whole
public key with HPLIP, which I think is a good idea, and would even skip
the whole keyserver step entirely.

I wonder why that wasn't done in the first place.

Enrico

--
GPG key: 4096R/E7AD5568 2009-05-08 Enrico Zini <email address hidden>