Re: Questiona about additional signatures on my key have not been synced to kernel-pgpkeys

Uwe Kleine-König <[email protected]> Wed, 22 Oct 2025 16:18:15 +0200
Newsgroups	org.kernel.linux.keys
Message-ID	<z2gr5m6bvcel4vzugolc2m52wdsuuffekorx4upxagflrespvh@5xue6nt4dvnq>
Hello Brian,

On Wed, Oct 22, 2025 at 08:59:39AM -0400, Brian Masney wrote:
> My key was added to the kernel-pgpkeys repo on Sep 4th, and at the
> time I only had one signature on my key. Since then, I now have 4
> signatures. I pushed my changes over a month ago with: 'gpg
> --send-keys A46D32705865AA3DDEDC2904B7D2DD275D7EC087'. Additionally, I
> uploaded it to https://keys.openpgp.org/upload/.
> 
> The Ubuntu keyserver shows 4 signatures.
> 
> https://keyserver.ubuntu.com/pks/lookup?search=A46D32705865AA3DDEDC2904B7D2DD275D7EC087&fingerprint=on&op=index
> 
> keys.openpgp.org only shows 1 signature at the moment.
> 
> https://keys.openpgp.org/vks/v1/by-fingerprint/A46D32705865AA3DDEDC2904B7D2DD275D7EC087
> 
> I see that you did a periodic update from the keyservers yesterday,
> however my changes still haven't been updated in the repository. I
> assume you pull from keys.openpgp.org. Do you have a suggestion how I
> can push the additional signatures to keys.openpgp.org so that my key
> will be updated in the future?

That's expected behaviour (expected to me that is :-).

Since some time gpg defaults to not sync 3rd-party signatures when
fetching a key from a keyserver. This is to cope for issues like

	https://dkg.fifthhorseman.net/blog/openpgp-certificate-flooding.html

. So sending the key to the list is the right thing to do.

If you know what you're doing you can pass `--keyserver-options
no-self-sigs-only` to gpg to "fix" that behaviour:

	$ gpg --recv-keys --keyserver hkps://keyserver.ubuntu.com/ A46D32705865AA3DDEDC2904B7D2DD275D7EC087
	gpg: key B7D2DD275D7EC087: public key "Brian Masney <[email protected]>" imported
	gpg: Total number processed: 1
	gpg:               imported: 1

	$ gpg --list-sigs A46D32705865AA3DDEDC2904B7D2DD275D7EC087
	pub   ed25519 2025-09-03 [SC]
	      A46D32705865AA3DDEDC2904B7D2DD275D7EC087
	uid           [ unknown] Brian Masney <[email protected]>
	sig 3        B7D2DD275D7EC087 2025-09-03  [self-signature]
	sig 3        B7D2DD275D7EC087 2025-09-03  [self-signature]
	sig 3        B7D2DD275D7EC087 2025-09-04  [self-signature]
	uid           [ unknown] Brian Masney <[email protected]>
	sig 3        B7D2DD275D7EC087 2025-09-03  [self-signature]
	sig 3        B7D2DD275D7EC087 2025-09-04  [self-signature]
	uid           [ unknown] Brian Masney <[email protected]>
	sig 3        B7D2DD275D7EC087 2025-09-03  [self-signature]
	sig 3        B7D2DD275D7EC087 2025-09-04  [self-signature]
	sub   cv25519 2025-09-03 [E]
	sig          B7D2DD275D7EC087 2025-09-04  [self-signature]

	$ gpg --recv-keys --keyserver hkps://keyserver.ubuntu.com/ --keyserver-options no-self-sigs-only A46D32705865AA3DDEDC2904B7D2DD275D7EC087
	gpg: key B7D2DD275D7EC087: 12 signatures not checked due to missing keys
	gpg: key B7D2DD275D7EC087: "Brian Masney <[email protected]>" 12 new signatures
	gpg: no ultimately trusted keys found
	gpg: Total number processed: 1
	gpg:         new signatures: 12

	$ gpg --list-sigs A46D32705865AA3DDEDC2904B7D2DD275D7EC087
	pub   ed25519 2025-09-03 [SC]
	      A46D32705865AA3DDEDC2904B7D2DD275D7EC087
	uid           [ unknown] Brian Masney <[email protected]>
	sig 3        B7D2DD275D7EC087 2025-09-03  [self-signature]
	sig 3        B7D2DD275D7EC087 2025-09-03  [self-signature]
	sig 3        B7D2DD275D7EC087 2025-09-04  [self-signature]
	sig          13B55DD07C53B851 2025-09-03  [User ID not found]
	sig          254BCFC56BF6CE8D 2025-09-10  [User ID not found]
	sig          E0D3C9EF07D2F8B4 2025-09-05  [User ID not found]
	sig          FC974D585706DA43 2025-09-08  [User ID not found]
	uid           [ unknown] Brian Masney <[email protected]>
	sig 3        B7D2DD275D7EC087 2025-09-03  [self-signature]
	sig 3        B7D2DD275D7EC087 2025-09-04  [self-signature]
	sig          13B55DD07C53B851 2025-09-03  [User ID not found]
	sig          254BCFC56BF6CE8D 2025-09-10  [User ID not found]
	sig          E0D3C9EF07D2F8B4 2025-09-05  [User ID not found]
	sig          FC974D585706DA43 2025-09-08  [User ID not found]
	uid           [ unknown] Brian Masney <[email protected]>
	sig 3        B7D2DD275D7EC087 2025-09-03  [self-signature]
	sig 3        B7D2DD275D7EC087 2025-09-04  [self-signature]
	sig          13B55DD07C53B851 2025-09-03  [User ID not found]
	sig          254BCFC56BF6CE8D 2025-09-10  [User ID not found]
	sig          E0D3C9EF07D2F8B4 2025-09-05  [User ID not found]
	sig          FC974D585706DA43 2025-09-08  [User ID not found]
	sub   cv25519 2025-09-03 [E]
	sig          B7D2DD275D7EC087 2025-09-04  [self-signature]

For good reasons the script that implements the periodic update doesn't
pass `--keyserver-options no-self-sigs-only` to gnupg.

Best regards
Uwe
signature.asc (application/pgp-signature, 488 B)