Maniphest T2284

tsign behavior does not achieve what dkg says it should
Closed, DuplicatePublic
Actions

Assigned To
None
Authored By
clint
Mar 12 2016, 12:35 AM
Tags
Subscribers
clint
dkg
• gniibe
gouttegd
justus
linsam
neal
View All 9 Subscribers

Description

According to dkg, the tsign domain parameter means

"limit this trust signature to only cover certifications of User IDs with e-mail
addresses that have the given domain after the @ sign"

However, when used, this does not achieve the desired effect.

Details

Version
1.4.20

Related Objects

Event Timeline

clint added projects: gnupg, Bug Report.Mar 12 2016, 12:35 AM
clint set Version to 1.4.20.
clint added a subscriber: clint.
neal added a subscriber: neal.Mar 13 2016, 10:29 PM

Hi Clint,

Out of curiosity, have you tried this on 2.1?

I realize this is probably very easy to reproduce, but could you nevertheless
list the commands that you used to show the bug?

Thanks!

clint added a comment.Mar 14 2016, 9:31 PM

I have not tried this on 2.1.

To reproduce

% gpg --recv-keys 0EE5BE979282D80B9F7540F1CCD2ED94D21739E9

74D1153FB159BB3D1BAC641CAC504BE650012B98

    % gpg --edit-key 0EE5BE979282D80B9F7540F1CCD2ED94D21739E9
    tsign with 2 (I trust fully), depth 1, domain "aclu.org"
    Check validity of 74D1153FB159BB3D1BAC641CAC504BE650012B98

If you make the trust signature without a domain specified,
74D1153FB159BB3D1BAC641CAC504BE650012B98 will appear as "full". With the domain
specified, it appears as "unknown".

clint added a comment.Mar 14 2016, 9:31 PM

795_gnupg-tsign-shenanigans.txt3 KBDownload

marcus mentioned this in T2923: trust signature domain restrictions don't work.Jul 3 2017, 11:07 AM
dkg added a subscriber: dkg.Jul 14 2017, 12:21 PM

Note that T2923 includes a patch that might help.

• gniibe added a subscriber: • gniibe.Nov 9 2017, 7:41 AM

I confirmed this is same bug in T2923: trust signature domain restrictions don't work, I am closing this one as duplicate.

If you type "ACLU.ORG" (upper letters), it works.

• gniibe merged a task: T2923: trust signature domain restrictions don't work.Nov 9 2017, 7:41 AM
• gniibe added subscribers: linsam, wiktor-k, justus and 2 others.
• gniibe closed this task as a duplicate of T2923: trust signature domain restrictions don't work.Nov 9 2017, 7:44 AM