Page MenuHome GnuPG
Create Task
Maniphest T2284

tsign behavior does not achieve what dkg says it should
Closed, DuplicatePublic
Actions

Description

According to dkg, the tsign domain parameter means

"limit this trust signature to only cover certifications of User IDs with e-mail
addresses that have the given domain after the @ sign"

However, when used, this does not achieve the desired effect.

Details

Version
1.4.20

Related Objects

Event Timeline

clint added projects: gnupg, Bug Report.Mar 12 2016, 12:35 AM
clint set Version to 1.4.20.
clint added a subscriber: clint.
neal added a subscriber: neal.Mar 13 2016, 10:29 PM

Hi Clint,

Out of curiosity, have you tried this on 2.1?

I realize this is probably very easy to reproduce, but could you nevertheless
list the commands that you used to show the bug?

Thanks!

clint added a comment.Mar 14 2016, 9:31 PM

I have not tried this on 2.1.

To reproduce

% gpg --recv-keys 0EE5BE979282D80B9F7540F1CCD2ED94D21739E9

74D1153FB159BB3D1BAC641CAC504BE650012B98

    % gpg --edit-key 0EE5BE979282D80B9F7540F1CCD2ED94D21739E9
    tsign with 2 (I trust fully), depth 1, domain "aclu.org"
    Check validity of 74D1153FB159BB3D1BAC641CAC504BE650012B98

If you make the trust signature without a domain specified,
74D1153FB159BB3D1BAC641CAC504BE650012B98 will appear as "full". With the domain
specified, it appears as "unknown".

clint added a comment.Mar 14 2016, 9:31 PM

795_gnupg-tsign-shenanigans.txt3 KBDownload

marcus mentioned this in T2923: trust signature domain restrictions don't work.Jul 3 2017, 11:07 AM
dkg added a subscriber: dkg.Jul 14 2017, 12:21 PM

Note that T2923 includes a patch that might help.

• gniibe added a subscriber: • gniibe.Nov 9 2017, 7:41 AM

I confirmed this is same bug in T2923: trust signature domain restrictions don't work, I am closing this one as duplicate.

If you type "ACLU.ORG" (upper letters), it works.

• gniibe merged a task: T2923: trust signature domain restrictions don't work.Nov 9 2017, 7:41 AM
• gniibe added subscribers: linsam, wiktor-k, justus and 2 others.
• gniibe closed this task as a duplicate of T2923: trust signature domain restrictions don't work.Nov 9 2017, 7:44 AM