Page MenuHome GnuPG

KMail / Kleopatra: Use gpgme_set_sender to add a hint which UserID was selected for a signature
Open, LowPublic

Description

GpgOL uses gpgme_set_sender to add a mail address which is then added as meta information in the signature.

As I see it this is really only required for the TOFU implementation in GnuPG so that validating a signature does count up the correct userid. So priority is rather low in my opinion.
I am not a fan of TOFU anymore or rather think that trust on first use is better handled by doing an lsign when we first see a certificate and then handle a conflict if we already have a certificate for that user id. That whole "conunting signatures for each userid etc." is not really helpful IMO.

The idea for gpgme_set_sender was that if you receive 10 Mails from aheinecke@gnupg.org. But that key also lists wk@gnupg.org as a userid that the TOFU model does not show wk@gnupg.org as valid when before you only verified mails in the context of communicatgion with aheinecke. Even if they both belong to the same key.