Re: Update AB5FEB886DBB99C2

On Thu, Nov 28, 2024 at 12:37:32AM +0900, Vincent Mailhol wrote:
> Hi,
> 
> I collected a few more cross signatures. Could you update my public key
> with the one attached? Thank you.

Updated, thanks.

> Actually, I also wanted to confirm one thing. I uploaded my keys and all
> its cross signature on keyserver.ubuntu.com:
> 
> https://keyserver.ubuntu.com/pks/lookup?search=AB5FEB886DBB99C2&op=index
> 
> and so, I was expecting those cross signs to be automatically
> synchronized during the periodic update. But it did not happen.

Indeed, looks like they don't give us the third-party signature data when we
ask for key updates:

    $ gpg --list-sigs AB5FEB886DBB99C2
    pub   ed25519/AB5FEB886DBB99C2 2024-06-01 [SC] [expires: 2029-12-31]
          ED8F700574E67F20E574E8E2AB5FEB886DBB99C2
    uid                 [ unknown] Vincent Mailhol <[email protected]>
    sig 3        AB5FEB886DBB99C2 2024-10-27  [self-signature]
    sig          0B0244C40D0D431C 2024-11-05  Shuah Khan <[email protected]>
    sig          EBC26CDB5A56DE73 2024-11-04  Steven Rostedt (Der Hacker) <[email protected]>
    [...]

    $ gpg --keyserver keyserver.ubuntu.com --recv-key AB5FEB886DBB99C2
    gpg: key AB5FEB886DBB99C2: "Vincent Mailhol <[email protected]>" not changed
    gpg: Total number processed: 1
    gpg:              unchanged: 1

I only get your latest signatures when I import what you sent in:

    $ gpg --import keys/AB5FEB886DBB99C2.asc
    gpg: key AB5FEB886DBB99C2: "Vincent Mailhol <[email protected]>" 3 new signatures
    gpg: Total number processed: 1
    gpg:         new signatures: 3

This is normal, though -- very few keyservers still provide third-party
signature data after the attacks on that functionality a few years ago.

> So let me ask: what type of data are actually synchronized? Is it only
> the sub-keys and the expiration dates? Or is there a way to upload the
> cross signatures somewhere to have them automatically synchronized in
> kernel/pgpkeys.git during the periodic updates?

The keyservers can really only be relied for publishing things like:

- new subkeys
- new uids
- updated expiry dates

For third-party signature data it's best to send an export to this list.

-K