Maniphest T7133

Add feature to load designated revoker from LDAP
Closed, ResolvedPublic
Actions

Assigned To
• werner
Authored By
• ebo
May 23 2024, 10:19 AM
Tags
Subscribers
• alexk
• ebo
pl13
timegrid

Description

There is an option in gpg since February 2023 to configure a designated revoker for all new keys (--add-desig-revoker).

We should add another feature: Iff this option is configured, gpg shall try to load the requested key from LDAP in the same manner as it does for a trusted-key.

Revisions and Commits

rG GnuPG
rG5e1ce8adf244 gpg: Implement the LDAP AKL mechanism
rG753175c74e9d gpg: Autoload designated revoker key and ADSK when needed.
rG330354972a27 gpg: Autoload designated revoker key and ADSK when needed.
rG465ea9116d1f gpg: Autoload designated revoker key and ADSK when needed.

Related Objects

Event Timeline

• ebo created this task.May 23 2024, 10:19 AM
• ebo mentioned this in T6881: Kleopatra: Make designated revoker configurable for new keys.May 23 2024, 10:23 AM
• werner triaged this task as Normal priority.May 23 2024, 12:01 PM
• werner added a commit: rG465ea9116d1f: gpg: Autoload designated revoker key and ADSK when needed..Jun 5 2024, 10:34 AM
• werner added a commit: rG330354972a27: gpg: Autoload designated revoker key and ADSK when needed..Jul 1 2024, 3:13 PM
• ebo raised the priority of this task from Normal to Needs Triage.Oct 9 2024, 10:36 AM
• werner added a comment.Oct 10 2024, 9:47 AM

I do not want to do that for 2.2.45 (T7255) because we want to do that release RSN

• werner triaged this task as High priority.Nov 4 2024, 12:54 PM
• alexk added a subscriber: • alexk.Aug 4 2025, 11:49 AM
• werner edited projects, added vsd34; removed vsd33.Nov 14 2025, 12:45 PM
• werner added a project: backport.Nov 18 2025, 8:01 PM
• werner added a commit: rG753175c74e9d: gpg: Autoload designated revoker key and ADSK when needed..Feb 13 2026, 3:34 PM
• werner changed the task status from Open to Testing.Feb 13 2026, 3:35 PM
• werner moved this task from Backlog to WiP on the gnupg22 board.
• werner moved this task from Backlog to WIP on the vsd34 board.
• werner mentioned this in Unknown Object (Maniphest Task).Mar 12 2026, 5:08 PM
• ebo edited projects, added vsd33; removed vsd34.Apr 16 2026, 2:18 PM
• ebo moved this task from WiP to QA on the gnupg22 board.
• ebo moved this task from Backlog to QA on the vsd33 board.
• ebo moved this task from QA to vsd-3.3.6 on the vsd33 board.
• ebo edited projects, added vsd33 (vsd-3.3.6); removed vsd33.
• ebo edited projects, added gnupg22 (gnupg-2.2.53); removed gnupg22.Apr 16 2026, 3:05 PM
timegrid changed the task status from Testing to Open.EditedApr 16 2026, 4:51 PM
timegrid added a subscriber: timegrid.

Do I understand this correctly, that on CLI key generation the public key of the designated revoker should be fetched automatically?

On vsd-3.3.7-beta90.9 @ win10 this does not work:

>gpg -vvv --add-desig-revoker F2610788330B5FED333A62841600B31C4D9DAB34 --quick-gen-key "to be revoked"
[...]
Continue? (Y/n)
gpg: invalid revocation key 'F2610788330B5FED333A62841600B31C4D9DAB34': No public key
>gpg -vvv --add-desig-revoker F2610788330B5FED333A62841600B31C4D9DAB34 --full-gen-key
[...]
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o
gpg: invalid revocation key 'F2610788330B5FED333A62841600B31C4D9DAB34': No public key

The cert is found on LDAP though:

>gpg --search-keys F2610788330B5FED333A62841600B31C4D9DAB34                                                 [...]
(1)     designated revoker <designated.revoker@gnupg.test>                                                                        3072 bit RSA key 1600B31C4D9DAB34, created: 2026-04-16, expires: 2029-04-16
timegrid changed the task status from Open to Testing.Apr 16 2026, 4:51 PM
timegrid moved this task from gnupg-2.2.53 to WiP on the gnupg22 board.
timegrid edited projects, added gnupg22; removed gnupg22 (gnupg-2.2.53).
timegrid changed the task status from Testing to Open.Apr 16 2026, 5:00 PM
timegrid added a comment.Tue, Sep 1, 10:20 AM

Still does not seem to work in vsd-3.4.0-beta1344 @ win10.

pl13 added a subscriber: pl13.Tue, Sep 1, 10:41 AM
• werner added a commit: rG5e1ce8adf244: gpg: Implement the LDAP AKL mechanism.Wed, Sep 2, 9:48 AM
timegrid moved this task from WiP to QA on the gnupg22 board.Wed, Sep 2, 1:34 PM

Looks good to me on vsd-3.4.0-beta1344, gpg 2.2.56-beta5 @ win10:

C:\Users\g10>gpg -k download
gpg: error reading key: No public key

C:\Users\g10>gpg --yes --add-desig-revoker D9DF7577C3FD36B2C94947F84E93E9CCFABA81DA --quick-gen-key with-desig-revoker
gpg: key 4E93E9CCFABA81DA: public key "download <download@ldap.test>" imported
gpg: Total number processed: 1
gpg:               imported: 1
[...]

C:\Users\g10>gpg -k download
pub   rsa3072 2026-09-01 [SC] [expires: 2029-08-31]
      D9DF7577C3FD36B2C94947F84E93E9CCFABA81DA
uid           [ unknown] download <download@ldap.test>
sub   rsa3072 2026-09-01 [E]
timegrid closed this task as Resolved.Wed, Sep 2, 2:42 PM