[pacman-dev] Signature within repo databases?

[Daniel Micay]

> 3) When I started work on all this, I had it in my head that
> signatures were relatively small, so it made sense to inline them.
> Mine are only 72 bytes, for instance, while other packagers are much
> longer. Modern keys generate 287 or 543 byte signatures, which are 8
> times larger than I originally thought. [1]

The signatures from ECC keys are significantly smaller, but it hasn't
been supported by GnuPG for long enough to start adopting it for new
keys. It would make sense to use Ed25519 for newly generated keys at
some point in the near future though (like when GnuPG decides to remove
it from --expert).

https://www.gnupg.org/faq/whats-new-in-2.1.html#ecc

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/pacman-dev/attachments/20150721/b9b3f18a/attachment-0001.asc>