Page MenuHome GnuPG

dirmngrProject
ActivePublic

Members

  • This project does not have any members.
  • View All

Watchers

  • This project does not have any watchers.
  • View All

Recent Activity

Aug 13 2021

werner changed the edit policy for dirmngr.
Aug 13 2021, 10:56 PM

Jul 27 2021

werner triaged T5531: dirmngr --validate broken for DER encoded files as Normal priority.
Jul 27 2021, 7:59 AM · gnupg (gpg23), dirmngr, Bug Report

Jun 25 2021

werner closed T5068: LDAP keyserver does not support lookup by fingerprint as Resolved.

This has been solved in 2.2.26 commit rGc75fd75532

Jun 25 2021, 11:15 AM · LDAP, dirmngr, gnupg (gpg22)

Apr 16 2021

werner closed T2332: Cannot authenticate with LDAP keyserver as Resolved.

This has been fixed in version 2.2.16.

Apr 16 2021, 8:08 PM · gnupg, dirmngr, Bug Report

Feb 10 2021

werner closed T4599: remap `--search` to `--locate-keys` (with warning) as Wontfix.
Feb 10 2021, 3:03 PM · gnupg (gpg23), dirmngr
werner closed T4488: dirmngr: allow changing `use-tor` in a reload as Wontfix.

dirmngr needs to be killed for this. gpgconf --kill dirmngr.

Feb 10 2021, 3:02 PM · gnupg (gpg23), dirmngr
werner edited projects for T3287: Improve http proxy support by honoring SRV RRs., added: gnupg; removed gnupg (gpg23).
Feb 10 2021, 11:51 AM · gnupg, dirmngr
werner closed T2964: dirmngr and gpg-agent should work automatically even when GNUPGHOME is larger than sun_path as Resolved.

The now used /var/run thingy solves all these problems nicely. In fact we may eventually remove the use fallback of using sockets in the GNUPGHOMEDIR.

Feb 10 2021, 11:29 AM · Stalled, scd, gpgagent, Bug Report, gnupg, dirmngr
werner closed T2836: dirmngr: wakes up periodically as Resolved.

The other patches don't make sense because of future plans for dirmngr.

Feb 10 2021, 11:07 AM · gnupg, gnupg (gpg23), Bug Report, dirmngr

Jan 27 2021

aheinecke reopened T5068: LDAP keyserver does not support lookup by fingerprint as "Open".
Jan 27 2021, 12:19 PM · LDAP, dirmngr, gnupg (gpg22)
aheinecke changed the visibility for T5068: LDAP keyserver does not support lookup by fingerprint.
Jan 27 2021, 12:19 PM · LDAP, dirmngr, gnupg (gpg22)
Jab closed T5068: LDAP keyserver does not support lookup by fingerprint as Spite.
Jan 27 2021, 11:56 AM · LDAP, dirmngr, gnupg (gpg22)

Jan 11 2021

werner created T5235: Delays in dirmngr http connections on Windows.
Jan 11 2021, 8:52 PM · dirmngr, ntbtls, Windows, gnupg (gpg22)

Jan 8 2021

werner closed T4447: Fix addition of new GPG keys to LDAP as Resolved.

The code has been reworked to also support the updated schema which also stores the fingerprints and a parsed down mail address. See gnupg/doc/ldap/ . These changes are in master and 2.2.26. Sorry for taking so long to fix that.

Jan 8 2021, 9:56 AM · gnupg (gpg23), patch, LDAP, dirmngr, Bug Report

Dec 22 2020

pert added a comment to T4618: DANE OpenPGP certificate retrieval does not verify DNSSEC signatures.

Granted I'm not familiar with the functions and it may not be applicable, but the DNS resolver functions in the GNU C Library have semi-recently gained parameters (RES_USE_DNSSEC) to check for DNSSEC validation IIRC. Recent versions of glibc also don't trust the 'ad' bit unless an indication of its trustworthiness is set in /etc/resolv.conf, say if using a local validating resolver, so one can be sure that it's trustworthy. It also appears musl libc may support this.

Dec 22 2020, 5:35 AM · dns, dirmngr

Nov 27 2020

werner lowered the priority of T3392: keyserver default should include pool onionbalance hkp://jirk5u4osbsr34t5.onion from Normal to Wishlist.
Nov 27 2020, 5:39 PM · Keyserver, Feature Request, dirmngr

Nov 26 2020

gniibe added a parent task for T3168: dirmngr: gpg: keyserver receive failed: No keyserver available: T3517: dirmngr: retry without SRV due to buggy routers.
Nov 26 2020, 7:51 AM · dns, dirmngr
gniibe added a subtask for T3517: dirmngr: retry without SRV due to buggy routers: T3168: dirmngr: gpg: keyserver receive failed: No keyserver available.
Nov 26 2020, 7:51 AM · Feature Request, dns, dirmngr
gniibe merged T3722: gpg "No name" error into T3517: dirmngr: retry without SRV due to buggy routers.
Nov 26 2020, 7:31 AM · Feature Request, dns, dirmngr
gniibe merged T4817: dirmgr keys.openpgp.org:443 Address family not supported by protocol into T4977: dirmngr not working with linux kernel parameter ipv6.disable=1.
Nov 26 2020, 7:15 AM · Testing, gnupg (gpg22), dirmngr, Bug Report

Sep 15 2020

werner created T5068: LDAP keyserver does not support lookup by fingerprint.
Sep 15 2020, 2:24 PM · LDAP, dirmngr, gnupg (gpg22)

Aug 28 2020

gniibe closed T4934: Returning automatic variable buffer from a function as Resolved.
Aug 28 2020, 2:58 AM · dirmngr, Testing, Bug Report

Aug 27 2020

werner closed T4977: dirmngr not working with linux kernel parameter ipv6.disable=1 as Resolved.
Aug 27 2020, 3:03 PM · Testing, gnupg (gpg22), dirmngr, Bug Report

Aug 18 2020

bernhard added a comment to T4593: dirmngr should not apply Kristian's CA when fetching from a keyserver that is not `hkps.pool.sks-keyservers.net`.

Just reading this issue in detail.

Aug 18 2020, 4:43 PM · gnupg (gpg22), Bug Report, dirmngr

Jul 13 2020

gniibe triaged T4977: dirmngr not working with linux kernel parameter ipv6.disable=1 as Normal priority.
Jul 13 2020, 3:14 AM · Testing, gnupg (gpg22), dirmngr, Bug Report
gniibe changed the status of T4977: dirmngr not working with linux kernel parameter ipv6.disable=1 from Open to Testing.

Pushed fix to master and STABLE-BRANCH-2-2.

Jul 13 2020, 3:13 AM · Testing, gnupg (gpg22), dirmngr, Bug Report
gniibe added a comment to T4977: dirmngr not working with linux kernel parameter ipv6.disable=1.

Thanks for your log.

Jul 13 2020, 2:54 AM · Testing, gnupg (gpg22), dirmngr, Bug Report

Jul 11 2020

iyanmv added a comment to T4977: dirmngr not working with linux kernel parameter ipv6.disable=1.

$ cat /run/user/1000/dirmngr.log

2020-07-11 19:33:44 dirmngr[2305.0] permanently loaded certificates: 140
2020-07-11 19:33:44 dirmngr[2305.0]     runtime cached certificates: 0
2020-07-11 19:33:44 dirmngr[2305.0]            trusted certificates: 140 (139,0,0,1)
2020-07-11 19:39:24 dirmngr[2305.6] force-crl-refresh active for issuer id CE04B58CBA5B8069AA0D503634B861593BE86F20; update required
2020-07-11 19:39:24 dirmngr[2305.6] number of system provided CAs: 148
2020-07-11 19:39:24 dirmngr[2305.6] error creating socket: Address family not supported by protocol
2020-07-11 19:39:24 dirmngr[2305.6] error connecting to 'http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl': Address family not supported by protocol
2020-07-11 19:39:24 dirmngr[2305.6] error retrieving 'http://cdp1.pca.dfn.de/global-root-g2-ca/pub/crl/cacrl.crl': Address family not supported by protocol
2020-07-11 19:39:24 dirmngr[2305.6] crl_fetch via DP failed: Address family not supported by protocol
2020-07-11 19:39:24 dirmngr[2305.6] command 'ISVALID' failed: Address family not supported by protocol
2020-07-11 19:39:24 dirmngr[2305.6] force-crl-refresh active for issuer id 3476EB7C1E02B3BAF954EEE2EFD321F7B8E49D18; update required
2020-07-11 19:39:24 dirmngr[2305.6] error creating socket: Address family not supported by protocol
2020-07-11 19:39:24 dirmngr[2305.6] error connecting to 'http://pki0336.telesec.de/rl/TeleSec_GlobalRoot_Class_2.crl': Address family not supported by protocol
2020-07-11 19:39:24 dirmngr[2305.6] error retrieving 'http://pki0336.telesec.de/rl/TeleSec_GlobalRoot_Class_2.crl': Address family not supported by protocol
2020-07-11 19:39:24 dirmngr[2305.6] crl_fetch via DP failed: Address family not supported by protocol
2020-07-11 19:39:24 dirmngr[2305.6] command 'ISVALID' failed: Address family not supported by protocol
2020-07-11 19:39:24 dirmngr[2305.6] force-crl-refresh active for issuer id 70F42DB9235EC84DC35D445B3407CABF4324291C; update required
2020-07-11 19:39:24 dirmngr[2305.6] error creating socket: Address family not supported by protocol
Jul 11 2020, 7:42 PM · Testing, gnupg (gpg22), dirmngr, Bug Report
iyanmv added a comment to T4977: dirmngr not working with linux kernel parameter ipv6.disable=1.

@gniibe I saw that you didn't understand what I meant by "dirmngr stops working properly" in E663.
Have a look at this post in Archlinux forum.

Jul 11 2020, 7:29 PM · Testing, gnupg (gpg22), dirmngr, Bug Report

Jul 2 2020

werner closed T4758: gnupg-2.2.18/dirmngr/ldap-parse-uri.c:57:27: style: Same expression on both sides of '||'. as Resolved.

Fixed; In master the code already uses our generic scheme parser.

Jul 2 2020, 4:10 PM · LDAP, dirmngr, Bug Report

Jul 1 2020

werner closed T4618: DANE OpenPGP certificate retrieval does not verify DNSSEC signatures as Wontfix.
Jul 1 2020, 2:10 PM · dns, dirmngr
werner added a comment to T4618: DANE OpenPGP certificate retrieval does not verify DNSSEC signatures.

DANE for OpenPGP is an experimental RFC (RFC-7929) and it is likely that we will remove the support because it is too hard for most users to add keys to a zone. Further a validating resolver on the desktop is too hard to maintain and the cause of too many other failures. And no, unbound etc is not an option because it is not usable by the majority of GnuPG users.

Jul 1 2020, 2:10 PM · dns, dirmngr

Jun 30 2020

dkg added a comment to T4618: DANE OpenPGP certificate retrieval does not verify DNSSEC signatures.

The same concern has been reported at https://bugs.debian.org/964033 -- if dirmngr is not going to follow the specification, it should at least document (and maybe warn?) about how it is divergent.

Jun 30 2020, 9:30 PM · dns, dirmngr

Jun 26 2020

gniibe added a comment to T4977: dirmngr not working with linux kernel parameter ipv6.disable=1.

When I test it on Debian, disabling by,

Jun 26 2020, 7:25 AM · Testing, gnupg (gpg22), dirmngr, Bug Report
gniibe claimed T4977: dirmngr not working with linux kernel parameter ipv6.disable=1.
Jun 26 2020, 7:06 AM · Testing, gnupg (gpg22), dirmngr, Bug Report
gniibe added a comment to T4977: dirmngr not working with linux kernel parameter ipv6.disable=1.

Please get log of dirmngr, by putting

log-file /run/user/<YOURNUMBER-LIKE-1000>/dirmngr.log
Jun 26 2020, 7:04 AM · Testing, gnupg (gpg22), dirmngr, Bug Report

Jun 25 2020

dkg added a comment to T4977: dirmngr not working with linux kernel parameter ipv6.disable=1.

Can you characterize the failure when ipv6.disable=1 ? The straightforward failure (connect() fails with EHOSTUNREACH after a few seconds) should presumably be treated the same as if some other host happened to be offline. That should result in dirmngr failing over to the next available address for the configured keyserver, right?

Jun 25 2020, 7:28 PM · Testing, gnupg (gpg22), dirmngr, Bug Report

Jun 22 2020

werner added a comment to T4977: dirmngr not working with linux kernel parameter ipv6.disable=1.

The problem is that I have not yet found a _portable_ way to detect proper working v6 or v4 networking without doing a test connection. For privacy reasons we don't want to do that.

Jun 22 2020, 3:32 PM · Testing, gnupg (gpg22), dirmngr, Bug Report
werner added projects to T4977: dirmngr not working with linux kernel parameter ipv6.disable=1: dirmngr, gnupg (gpg22).
Jun 22 2020, 3:20 PM · Testing, gnupg (gpg22), dirmngr, Bug Report

May 21 2020

gniibe changed the status of T4934: Returning automatic variable buffer from a function from Open to Testing.

Fixed in master and applied to 2.2 branch too.

May 21 2020, 7:39 AM · dirmngr, Testing, Bug Report

Apr 16 2020

werner closed T4898: auto import CA certs with authInfo.caIssuers as Resolved.

We do this now always if --auto-issuer-key-retrieve is set. Also backported to 2.2

Apr 16 2020, 6:02 PM · dirmngr, S/MIME, gnupg (gpg23)

Apr 14 2020

werner closed T4538: Support PSS signed CRLs as Resolved.

Data (ie.e CMS) signatures do now also work.

Apr 14 2020, 4:26 PM · dirmngr, S/MIME, libksba

Apr 9 2020

Moonchild added a comment to T4249: No connection to Keyserver possible.

I'm honestly surprised this isn't being given any sort of priority.
gnupg for windows is simply broken. Even Kleopatra, its supplied and designated key management application doesn't work re: keyserver communication.

Apr 9 2020, 11:16 PM · gnupg, dirmngr, Bug Report, gpg4win
werner added a comment to T4538: Support PSS signed CRLs.

Okay certificate and CRL checking does now work with rsaPSS. Need to work on data signatures and check the compliance modes.

Apr 9 2020, 1:09 PM · dirmngr, S/MIME, libksba

Apr 8 2020

werner claimed T4538: Support PSS signed CRLs.

I started to work on it so that I can actually use the certificates on my new D-Trust card. This will be a verify-only implementation.

Apr 8 2020, 8:37 PM · dirmngr, S/MIME, libksba

Mar 31 2020

werner triaged T4898: auto import CA certs with authInfo.caIssuers as Normal priority.
Mar 31 2020, 12:04 PM · dirmngr, S/MIME, gnupg (gpg23)
werner created T4898: auto import CA certs with authInfo.caIssuers.
Mar 31 2020, 12:04 PM · dirmngr, S/MIME, gnupg (gpg23)

Mar 9 2020

Moonchild added a comment to T4249: No connection to Keyserver possible.

I'm using enigmail 1.9.9 because I'm on a mail client that doesn't use WebExtensions, so it's using gnupg for keyserver stuff. In this case that means I've been able to verify it's a gnupg issue (both Kleopatra and enigmail displaying the same issue as CLI).

Mar 9 2020, 9:54 PM · gnupg, dirmngr, Bug Report, gpg4win
dkg added a comment to T4249: No connection to Keyserver possible.

@Moonchild wrote:

using enigmail with the new version

Mar 9 2020, 6:14 PM · gnupg, dirmngr, Bug Report, gpg4win
Moonchild added a comment to T4249: No connection to Keyserver possible.

Just registered to report pretty much the same.
I've been using gpg 2 for a long while and it's been doing just fine, up to the point where people started using keys it didn't recognise that require a later version.

Mar 9 2020, 1:03 PM · gnupg, dirmngr, Bug Report, gpg4win