Re: Update AB5FEB886DBB99C2

Uwe Kleine-König <[email protected]> Mon, 10 Feb 2025 13:43:41 +0100
Newsgroups	org.kernel.linux.keys
Message-ID	<3ie26bbhuzw657fibjyzt4w3tdo5eip6m6nr36b4egzn2lzadi@fv3a4ebsd4f3>
Hello Konstantin,

On Wed, Nov 27, 2024 at 11:02:10AM -0500, Konstantin Ryabitsev wrote:
> On Thu, Nov 28, 2024 at 12:37:32AM +0900, Vincent Mailhol wrote:
> > Hi,
> > 
> > I collected a few more cross signatures. Could you update my public key
> > with the one attached? Thank you.
> 
> Updated, thanks.
> 
> > Actually, I also wanted to confirm one thing. I uploaded my keys and all
> > its cross signature on keyserver.ubuntu.com:
> > 
> > https://keyserver.ubuntu.com/pks/lookup?search=AB5FEB886DBB99C2&op=index
> > 
> > and so, I was expecting those cross signs to be automatically
> > synchronized during the periodic update. But it did not happen.
> 
> Indeed, looks like they don't give us the third-party signature data when we
> ask for key updates:
> 
>     $ gpg --list-sigs AB5FEB886DBB99C2
>     pub   ed25519/AB5FEB886DBB99C2 2024-06-01 [SC] [expires: 2029-12-31]
>           ED8F700574E67F20E574E8E2AB5FEB886DBB99C2
>     uid                 [ unknown] Vincent Mailhol <[email protected]>
>     sig 3        AB5FEB886DBB99C2 2024-10-27  [self-signature]
>     sig          0B0244C40D0D431C 2024-11-05  Shuah Khan <[email protected]>
>     sig          EBC26CDB5A56DE73 2024-11-04  Steven Rostedt (Der Hacker) <[email protected]>
>     [...]
> 
>     $ gpg --keyserver keyserver.ubuntu.com --recv-key AB5FEB886DBB99C2
>     gpg: key AB5FEB886DBB99C2: "Vincent Mailhol <[email protected]>" not changed
>     gpg: Total number processed: 1
>     gpg:              unchanged: 1
> 
> I only get your latest signatures when I import what you sent in:
> 
>     $ gpg --import keys/AB5FEB886DBB99C2.asc
>     gpg: key AB5FEB886DBB99C2: "Vincent Mailhol <[email protected]>" 3 new signatures
>     gpg: Total number processed: 1
>     gpg:         new signatures: 3
> 
> This is normal, though -- very few keyservers still provide third-party
> signature data after the attacks on that functionality a few years ago.
> 
> > So let me ask: what type of data are actually synchronized? Is it only
> > the sub-keys and the expiration dates? Or is there a way to upload the
> > cross signatures somewhere to have them automatically synchronized in
> > kernel/pgpkeys.git during the periodic updates?
> 
> The keyservers can really only be relied for publishing things like:
> 
> - new subkeys
> - new uids
> - updated expiry dates
> 
> For third-party signature data it's best to send an export to this list.

Note that keyserver.ubuntu.com still provides 3rd-Party signatures, just
gpg doesn't import them by default.

If you really want all that stuff, use:

	gpg --refresh --keyserver-options no-self-sigs-only --keyserver keyserver.ubuntu.com

Best regards
Uwe
signature.asc (application/pgp-signature, 488 B)