hack-require-3072r.patch

Description: Require 3072 bits for RSA keys if HACK_REQUIRE_3072R
 If the environment variable is set, require 3072 bit RSA keys.
Author: Julian Andres Klode <julian.klode@canonical.com>
Forwarded: no

--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -515,6 +515,27 @@ check_signature_end_simple (PKT_public_k
       return rc;
     }
 
+  if (getenv("APT_SIGNING_REQUIREMENTS_HACK"))
+	{
+	  switch (pk->pubkey_algo)
+		{
+		  case GCRY_PK_RSA:
+		  case GCRY_PK_RSA_E:
+		  case GCRY_PK_RSA_S:
+			if (nbits_from_pk(pk) < 2048) {
+			  write_status_printf (STATUS_ERROR, _("Unsupported apt signing key: %s: RSA keys SHOULD be at least 3072 bit"),
+				  keystr_from_pk (pk));
+			  return gpg_error (GPG_ERR_BAD_PUBKEY);
+			}
+			if (nbits_from_pk(pk) < 3072) {
+			  write_status_printf (STATUS_WARNING, _("Deprecated apt signing key: %s: RSA keys SHOULD be at least 3072 bit"),
+				  keystr_from_pk (pk));
+			}
+			break;
+		  default:
+			break;
+		}
+	}
   /* Make sure the digest algo is enabled (in case of a detached
    * signature).  */
   gcry_md_enable (digest, sig->digest_algo);