Reproducing this bug involves dirmngr's extra-certs and trusted-certs
directories. Since 070d7bf this means you have to modify files in your sysconfig
dir. Sorry for that. Turns out there is a usecase for having those in your
homedir. Debugging ;-)
To reproduce you can use Intevations email and root ca. I've attached the
exported files in a tarball.
The files were created by:
gpgsm --export 0x84F36B70 > root_ca_2010.der
gpgsm --export 0x6439087E > email_ca_2013.der
gpgsm --export 0xD2889BDB > aheinecke.der
The test signature was created by:
echo foo | gpgsm --sign --include-certs 0 -u 0xD2889BDB > testsig
Now this issue is only reproducible if you have the root_ca in trusted-certs and
the email_ca in extra-certs.
This might need root:
sysconfdir=$(gpgconf --list-dirs | grep sysconfdir | cut -f2 -d:)
mkdir -p $sysconfdir/extra-certs
mkdir -p $sysconfdir/trusted-certs
cp root_ca_2010.der $sysconfdir/trusted-certs
cp email_ca_2013.der $sysconfdir/extra-certs
Now for the test:
export GNUPGHOME=$(mktemp -d)
gpgsm --import aheinecke.der
gpgsm -k |grep -E '(ID|Subject):'
ID: 0x76CE8F33 Subject: /CN=CA Cert Signing
Authority/OU=http:\x2f\x2fwww.cacert.org/O=Root CA/EMail=support@cacert.org
ID: 0x72B0BD08
Subject: /CN=The STEED Self-Signing Nonthority
ID: 0xD2889BDB
Subject: /CN=Andre Heinecke/O=Intevation GmbH/C=DE
ID: 0x6439087E
Subject: /CN=Email CA 2013/O=Intevation GmbH/C=DE
ID: 0x84F36B70
Subject: /CN=Root CA 2010/O=Intevation GmbH/C=DE-> Steed and CACert come from the default file, Root CA and EMail CA were
obtained from dirmngr cache.
Now the bug:
gpgsm --verify testsig
gpgsm -k |grep -E '(ID|Subject):'
ID: 0x76CE8F33 Subject: /CN=CA Cert Signing
Authority/OU=http:\x2f\x2fwww.cacert.org/O=Root CA/EMail=support@cacert.org
ID: 0x72B0BD08
Subject: /CN=The STEED Self-Signing Nonthority
ID: 0x6439087E
Subject: /CN=Email CA 2013/O=Intevation GmbH/C=DE
ID: 0xD2889BDB
Subject: /CN=Andre Heinecke/O=Intevation GmbH/C=DE
ID: 0x84F36B70
Subject: /CN=Root CA 2010/O=Intevation GmbH/C=DE
ID: 0x6439087E
Subject: /CN=Email CA 2013/O=Intevation GmbH/C=DE
ID: 0x84F36B70
Subject: /CN=Root CA 2010/O=Intevation GmbH/C=DEEmail CA and Root CA are now listed twice! Additional verify's do not increase that.