On Wed, Sep 23, 2026 at 09:10:13AM +0200, Marc Espie wrote:
> I'll have a closer look tonight hopefully, but the signature information
> is taken from the location, then passed into the installed
> packing-list through decorate (in PackageRepository/Installed.pm)
> 
> The location info is done through uncompress, that does parse the gzip
> comment.
> 
> Maybe IO::Uncompress::Gunzip changed recently and does not pass the
> full comment around ? that would be my best guess.

Found it.

naddy probably changed the process he uses to sign packages.

the method strips the path, but it's a simple file name now.

The following patch fixes both the recording of the signer from
the gzip header, and not erroring out for installed packages with
no signer annotation.

Index: OpenBSD/PackageRepository.pm
===================================================================
RCS file: /build/data/openbsd/cvs/src/usr.sbin/pkg_add/OpenBSD/PackageRepository.pm,v
diff -u -p -r1.178 PackageRepository.pm
--- OpenBSD/PackageRepository.pm	1 Jun 2025 00:45:39 -0000	1.178
+++ OpenBSD/PackageRepository.pm	23 Sep 2026 17:39:20 -0000
@@ -406,8 +406,10 @@ sub uncompress($self, $object, @p)
 		my $h = $fh->getHeaderInfo;
 		if ($h) {
 			for my $line (split /\n/, $h->{Comment}) {
-				if ($line =~ m/^key=.*\/(.*)\.sec$/) {
-					$object->{signer} = $1;
+				if ($line =~ m/^key=(.*)\.sec$/) {
+					my $path = $1;
+					$path =~ s,.*/,,;
+					$object->{signer} = $path;
 				} elsif ($line =~ m/^date=(.*)$/) {
 					$object->{signdate} = $1;
 				}
Index: OpenBSD/PkgInfo.pm
===================================================================
RCS file: /build/data/openbsd/cvs/src/usr.sbin/pkg_add/OpenBSD/PkgInfo.pm,v
diff -u -p -r1.54 PkgInfo.pm
--- OpenBSD/PkgInfo.pm	25 Nov 2023 11:02:23 -0000	1.54
+++ OpenBSD/PkgInfo.pm	23 Sep 2026 17:39:20 -0000
@@ -430,8 +430,9 @@ sub print_info($self, $state, $pkg, $han
 			if ($plist->is_signed) {
 				my $sig = $plist->get('digital-signature');
 				if ($sig->{key} eq 'signify2') {
+					my $signer = $plist->get('signer');
 					$state->say("reportedly signed by #1",
-					    $plist->get('signer')->name);
+					    $signer->name) if defined $signer;
 				} else {
 					$state->say("\@digital-signature #1: no currently supported signature", 	
 					    $sig->{key});