| Summary: | GPG failing to fetch keys from key server | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | terabit.funtoo |
| Component: | Current packages | Assignee: | Kristian Fiskerstrand (RETIRED) <k_f> |
| Status: | RESOLVED FIXED | ||
| Severity: | critical | CC: | crypto+disabled |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | AMD64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
|
Description
terabit.funtoo
2016-10-24 00:28:17 UTC
As I told you on IRC in #gnupg this is expected behavior. The CA Cartel Root PKIX is unsafe and is only used for KS_FETCH[0]. Specify root CA using hkp-cacert in dirmngr.conf References: [0] https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=c3aeda82b8d00b87a5af72b4075c487c10dfdf6b In case anyone else stumble onto this bug, for completeness, the cert store can be included by ln -s /etc/ssl/certs/ca-certificates.crt $HOME/.gnupg/allcerts.pem and doing a hkp-cacert /home/<user>/.gnupg/allcerts.pem in dirmngr.conf then do a gpgconf --reload dirmngr ok, I don't really care if you consider this invalid but for anyone else that might stumble into this, just use --fetch if you expect gpg to use your system's certificate store (like a normal application) # gpg --keyid-format=0xlong --fetch 'https://pgp.mit.edu/pks/lookup?op=get&search=0xDE9452CE46F42094907F108B44D1C0F82525FE49' gpg: requesting key from 'https://pgp.mit.edu/pks/lookup?op=get&search=0xDE9452CE46F42094907F108B44D1C0F82525FE49' gpg: key 0x44D1C0F82525FE49: "Bradley Spengler (spender) <spender@grsecurity.net>" not changed gpg: Total number processed: 1 gpg: unchanged: 1 As you can see that works. I don't know anything about "CA cartels" , gpg was working a certain way and it changed in a way that broke a bunch of stuff. only documentation was in a git commit and source code comment. I implore anyone in charge of gnupg to please alert users of the discrepancy between --recv and --fetch when --recv/--keyserver is used and it fails to fetch due to TLS cert verification. Thank you. Added a use flag to 2.1.15-r1 in case anyone wants to deviate from upstream: commit fe22cb8017a704994d88377896fbd0dd3b3c3ced Author: Kristian Fiskerstrand <k_f@gentoo.org> Date: Thu Oct 27 20:32:23 2016 +0200 app-crypt/gnupg: Add use flag system-cert-store System cert store is not used by default in GnuPG 2.1 for hkps:// requests to keyservers. Adding a use flag system-cert-store that changes this behavior, matching upstream behavior for KS_FETCH. Gentoo-Bug: 597934 Package-Manager: portage-2.3.2 |
