Validation: Checked, using

ls -lt $(grep -lr 'BEGIN' signature | grep -v sequoia/rust)

and

ls -lt $(for i in $(find signature -type f | grep -v 'sequoia/rust\|pgp.cert.d\|/softkeys/' ); do if (od -An -tx1 < $i| read x; echo "$x" | cut -c 1 | grep -q '[89abcdef]') ; then echo "$i"; fi; done)

(looking for files which start with OpenPGP packets, all of which have the leading bit set)

that all signature / key files have been updated, or don’t need to be.

Are there instructions somewhere on how you generated these? Would be good to have this documented I guess.

Are there instructions somewhere on how you generated these?

Sadly, no. “It would have been a good idea”, but, also, I’d rather not spend time re-automating that now.

The basic process was:

• Generate new keys
• Save them using the old format that we use in git (for historical reasons? Anyway this might be a more interoperable way to store the secret keys):

  GNUPGHOME=$(pwd)/signature/fixtures gpg --export-secret-keys > ./signature/fixtures/secring.gpg
  rm -r {signature/simplesigning/testdata,signature/fixtures}/{.gpg-v21-migrated,private-keys-v1.d}

• For each relevant signature:

  orig=signature/fixtures/expired.signature  # iterate orig through all relevant files
  gpg --list-packets $orig  # along with the file name, determine what needs to happen
  gpg -d $orig | GNUPGHOME=$(pwd)/signature/fixtures gpg --sign --default-key $key_id - > _  # + other parameters as required
  diff -u <(gpg --list-packets $orig) <(gpg --list-packets _) # Check the outcome
  mv _ $orig

Updated to use SHA256, not SHA1 (rejected by Fedora system policies with Sequoia), in the -v3 signatures, ready for merging.

My comments was not meant to suggest to automate that (which I agree would always be nice). It was meant as document which commands you run (for this PR) to regenerate the files so at least the next time it is needed someone has a place to start.

It was meant as document which commands you run

Yes — the above is the gist of it, to list the affected files and to re-sign, but there a bit of manual tinkering (e.g. the corrupt signatures need to be manually edited).