From Newsgroup: news.admin.hierarchies

ctjacobs@AcervanChris:/mnt/c/users/chris/onedrive/checkgroups$ pgpverify *eternal*
Control
ctjacobs@AcervanChris:/mnt/c/users/chris/onedrive/checkgroups$ pgpverify *novabbs*
Control
ctjacobs@AcervanChris:/mnt/c/users/chris/onedrive/checkgroups$

I see eternal-september and novabbs have the same pgpverify output.
Is it a security problem if two hierarchies have the same pgpverify output?

Chris
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.hierarchies

Hi Chris,

ctjacobs@AcervanChris:/mnt/c/users/chris/onedrive/checkgroups$ pgpverify *eternal*
Control
ctjacobs@AcervanChris:/mnt/c/users/chris/onedrive/checkgroups$ pgpverify *novabbs*
Control>
I see eternal-september and novabbs have the same pgpverify output.

What commands did you run?

You normally call pgpverify like this:

% pgpverify -test < checkgroups.file

where checkgroups.file is a file containing the whole control article
with its headers.

Is it a security problem if two hierarchies have the same pgpverify output?

No, the control.ctl file explicitly mentions the PGP key to use.
--
Julien |eLIE

-2-arCo Hou hou-a!
rCo Ouille, ouille-a!
rCo Ouf-a!
rCo O|| ouf-a?-a-+ (Ast|-rix)

--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.hierarchies

Op 1-9-2026 om 14:12 schreef Julien |eLIE:

Hi Chris,

ctjacobs@AcervanChris:/mnt/c/users/chris/onedrive/checkgroups$
pgpverify *eternal*
Control
ctjacobs@AcervanChris:/mnt/c/users/chris/onedrive/checkgroups$
pgpverify *novabbs*
Control>
I see eternal-september and novabbs have the same pgpverify output.

What commands did you run?

*eternal* expands to 'cmsg checkgroups eternal-september #2026090101 -
Control (control@eternal-september.org) - 2026-09-01 0634.eml'

*novabbs* expands to 'cmsg checkgroups rocksolid #2024091707 - usenet@novabbs.com (usenet@novabbs.com) - 2024-09-17 1454.eml'

So instead of using redirect I just give checkgroups.file as a parameter.
Seems to make no difference.

You normally call pgpverify like this:

% pgpverify -test < checkgroups.file
where checkgroups.file is a file containing the whole control article
with its headers.

Is it a security problem if two hierarchies have the same pgpverify
output?

No, the control.ctl file explicitly mentions the PGP key to use.

But pgpverify does not check the control.ctl?
/control.ctl on pgpverify in vi gives
E486: Pattern not found: control.ctl
Moreover pgpverify *hispagatos* gives news.hispagatos.org
while HISPAGATOS is NOT in my control.ctl.

I think eternal-september can fake checkgroups for novabbs and vice versa.

Chris
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.hierarchies

Hi Chris,

*novabbs* expands to 'cmsg checkgroups rocksolid #2024091707 - usenet@novabbs.com (usenet@novabbs.com) - 2024-09-17 1454.eml'

OK, checkgroups spotted.
I do not have the public key of novabbs installed but pgpverify
correctly sees 2 different keys for rocksolid.* and eternal-september.*:

% pgpverify -test < rocksolid
[GNUPG:] NEWSIG usenet@novabbs.com
[GNUPG:] NO_PUBKEY 2A1C655BF6D10B13

% pgpverify -test < eternal
[GNUPG:] NEWSIG control@eternal-september.org
[GNUPG:] KEY_CONSIDERED 17A7E98E3038BE35428F30E4F53C21EEF3D2EA49 0

But pgpverify does not check the control.ctl?

Yes indeed. I was speaking of the real use case of control article
processing through controlchan. You normally do not have to invoke
pgpverify by hand.
--
Julien |eLIE

-2-aLa libertad, Sancho, es uno de los m|is preciosos dones que a los
hombres dieron los cielos; con ella no pueden igualarse los tesoros
que encierran la tierra y el mar: por la libertad, as|! como por la
honra, se puede y debe aventurar la vida.-a-+ (Miguel de Cervantes
Saavedra)

--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.hierarchies

Op 4-9-2026 om 10:13 schreef Julien |eLIE:

Hi Chris,

*novabbs* expands to 'cmsg checkgroups rocksolid #2024091707 -
usenet@novabbs.com (usenet@novabbs.com) - 2024-09-17 1454.eml'

OK, checkgroups spotted.
I do not have the public key of novabbs installed but pgpverify > correctly sees 2 different keys for rocksolid.* and eternal-september.*:

% pgpverify -test < rocksolid
[GNUPG:] NEWSIG usenet@novabbs.com
[GNUPG:] NO_PUBKEY 2A1C655BF6D10B13

% pgpverify -test < eternal
[GNUPG:] NEWSIG control@eternal-september.org
[GNUPG:] KEY_CONSIDERED 17A7E98E3038BE35428F30E4F53C21EEF3D2EA49 0

But pgpverify does not check the control.ctl?

Yes indeed.-a I was speaking of the real use case of control article processing through controlchan.-a You normally do not have to invoke pgpverify by hand.

I asked Grok what controlchan does exactly
controlchan does not use NEWSIG or KEY CONSIDERED
controlchan uses GOODSIG via findid
The userid in GOODSIG is truncated at the space

The used userids are not

Control <control@eternal-september.org
and
Control (Usenet) <usenet@novabbs.com

but

Control
and
Control

So despite different keys same user ids.
And controlchan checks these same userids.


--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.hierarchies

This message was cancelled from within Thunderbird.
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: news.admin.hierarchies

Op 4-9-2026 om 10:13 schreef Julien |eLIE:

Hi Chris,

*novabbs* expands to 'cmsg checkgroups rocksolid #2024091707 -
usenet@novabbs.com (usenet@novabbs.com) - 2024-09-17 1454.eml'

OK, checkgroups spotted.
I do not have the public key of novabbs installed but pgpverify
correctly sees 2 different keys for rocksolid.* and eternal-september.*:

% pgpverify -test < rocksolid
[GNUPG:] NEWSIG usenet@novabbs.com
[GNUPG:] NO_PUBKEY 2A1C655BF6D10B13

% pgpverify -test < eternal
[GNUPG:] NEWSIG control@eternal-september.org
[GNUPG:] KEY_CONSIDERED 17A7E98E3038BE35428F30E4F53C21EEF3D2EA49 0

But pgpverify does not check the control.ctl?

Yes indeed.-a I was speaking of the real use case of control article processing through controlchan.-a You normally do not have to invoke pgpverify by hand.

Yes, I see it now.
controlchan does something with -findid and if I use -findid when I call pgpverify by hand I see the difference.

ctjacobs@AcervanChris:/mnt/c/users/chris/onedrive/checkgroups$ if
pgpverify --findid "Control <control@eternal-september.org>" <
*september*; then echo O
K; else echo "fout: $?"; fi
Control <control@eternal-september.org>
OK
--- Synchronet 3.22a-Linux NewsLink 1.2