aboutsummaryrefslogtreecommitdiffstats
path: root/dirmngr (follow)
Commit message (Collapse)AuthorAgeFilesLines
* build: Always use EXTERN_UNLESS_MAIN_MODULE pattern.Werner Koch2020-02-102-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | * common/util.h (EXTERN_UNLESS_MAIN_MODULE): Add the definion only here but now without the Norcroft-C. Change all other places where it gets defined. * common/iobuf.h (iobuf_debug_mode): Declare unconditionally as extern. * common/iobuf.c (iobuf_debug_mode): Define it here. * agent/gpg-agent.c (INCLUDED_BY_MAIN_MODULE): Define here and also in all main modules of all other programs. * g10/main.h: Put util.h before the local header files. -- This change is required for use with gcc/ld's LTO feature which does not allow common blocks. Further gcc 10 will make -fno-common the default and thus this chnage is always needed. What a pitty. Co-authored-by: Tomáš Mráz GnuPG-bug-id: 4831 Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 21d9bd8b87a9f793a106095e3838eb71825189d7) - Applied respective chnages also to gpg-card and keyboxd. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Fix building w/o LDAP supportWerner Koch2020-01-211-0/+6
| | | | | | * dirmngr/Makefile.am: Conditionally build dirmngr_ldap. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Tell gpg about WKD looks resulting from a cache.Werner Koch2019-12-061-0/+1
| | | | | | | | | | | | | * dirmngr/server.c (proc_wkd_get): Print new NOTE status "wkd_cached_result". * g10/call-dirmngr.c (ks_status_cb): Detect this and print a not ein verbose mode. -- This little patch is helpful to see why a WKD change still does not work after it has been updated on the server. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Replace no-strict-overflow pragma by wrapv pragma.Werner Koch2019-11-271-3/+8
| | | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (time_for_housekeeping_p): Build with --fwrapv. Replace protecting macro. -- I once replaced all JNLIB macros by GPGRT macros. However, I missed to get this right for the push pragma test and used GPGRT_GCC_HAVE_PUSH_PRAGMA instead of the correct GPGRT_HAVE_PRAGMA_GCC_PUSH Now after fixing this it turned out that no-strict-overflow is not anymore supported as oprimize pragma and thus I replaced that too according to https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58454 . Tested with 32 bit Windows but the real test will be in 2038. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Rework of the LDAP code, part 1.Werner Koch2019-11-266-40/+93
| | | | | | | | | | | | | | | | | | | | | | | * dirmngr/http.h (struct parsed_uri_s): Add flag is_ldap. * dirmngr/http.c (do_parse_uri): Set flag. Do not error out for a missing slashes in an http scheme if NO_SCHEME_CHECK is active. * dirmngr/t-http.c (main): Print new flag. * dirmngr/ks-engine-ldap.c (ks_ldap_help): Use flag instead of checking the scheme. * dirmngr/ldap-parse-uri.c (ldap_uri_p): Re-implement using http_parse_uri. * dirmngr/t-ldap-parse-uri.c (main): Add option --verbose. -- This patch merely remove the separate parser for checking for an LDAP scheme. It is better to let our generic URI parser handle this. Also fixes this bug || url[4] == 'i' || url[4] == 'i') to make the rarely used ldapi scheme case-insensitive. More changes to the LDAP code are planned. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Make building with a TLS library mandatoryWerner Koch2019-11-261-57/+34
| | | | | | | * configure.ac: Do not build dirmngr if no TLS is available. * dirmngr/http.c: Remove all uses of the USE_TLS macro. Signed-off-by: Werner Koch <[email protected]>
* dirmngr,gpg: Better diagnostic in case of bad TLS certificates.Werner Koch2019-11-181-1/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | * doc/DETAILS: Specify new status code "NOTE". * dirmngr/ks-engine-http.c (ks_http_fetch): Print a NOTE status for a bad TLS certificate. * g10/call-dirmngr.c (ks_status_cb): Detect this status. -- For example a gpg -v --locate-external-keys [email protected] now yields gpg: Note: server uses an invalid certificate gpg: (further info: bad cert for 'posteo.net': \ Hostname does not match the certificate) gpg: error retrieving '[email protected]' via WKD: Wrong name gpg: error reading key: Wrong name (without -v the "further info" line is not shown). Note that even after years Posteo is not able to provide a valid certificate for their .net addresses. Anyway, this help to show the feature. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Forward http redirect warnings to gpg.Werner Koch2019-11-184-1/+20
| | | | | | | | | | | | | | | | * dirmngr/http.c: Include dirmngr-status.h (http_prepare_redirect): Emit WARNING status lines for redirection problems. * dirmngr/http.h: Include fwddecl.h. (struct http_redir_info_s): Add field ctrl. * dirmngr/ks-engine-hkp.c (send_request): Set it. * dirmngr/ks-engine-http.c (ks_http_fetch): Set it. * g10/call-dirmngr.c (ks_status_cb): Detect the two new warnings. -- This should make it easier to diagnose problems with bad WKD servers. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Fixed typo in recently added diagnostic.Werner Koch2019-11-181-1/+1
| | | | --
* dirmngr: Use IPv4 or IPv6 interface only if available.Werner Koch2019-11-124-3/+119
| | | | | | | | | | | | | | | * dirmngr/dns-stuff.c (cached_inet_support): New variable. (dns_stuff_housekeeping): New. (check_inet_support): New. * dirmngr/http.c (connect_server): Use only detected interfaces. * dirmngr/dirmngr.c (housekeeping_thread): Flush the new cache. -- This currently works only for Windows but that is where users really ran into problems. The old workaround was to configure disable-ipv4 or disable-ipv6. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Tune down err on missing ldapservers fileAndre Heinecke2019-11-121-1/+1
| | | | | | | | | | | | * dirmngr/dirmngr.c (parse_ldapservers_file): Tune down error in case no such file exists. -- This is hardly an error because by default such a file does not exist. This caused trouble in support because people think "Oh the system prints an error". GnuPG-Bug-Id: T3539
* dirmngr: Remove cruft from dirmngr_ldapWerner Koch2019-11-115-699/+58
| | | | | | | | | | | | | | | | | | | * configure.ac (USE_LDAPWRAPPER): Remove ac_define and conditional. * dirmngr/Makefile.am: Remove USE_LDAPWRAPPER and considere true. * dirmngr/ldap-wrapper-ce.c: Remove. * dirmngr/ldap-wrapper.c: Remove USE_LDAPWRAPPER stuff. Minor chnages to debug output. * dirmngr/dirmngr_ldap.c: Remove USE_LDAPWRAPPER stuff. Remove my_ldap macros. (fetch_ldap) [W32]: Use ldap_sslinit. -- Note that the ldap_sslinit stuff for Windows has not been tested. This patch removes the whole wrapper-but-linked business because we do not need it anymore. WindowsCE for which we used it is pretty dead. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Rename an enum value for clarity.Werner Koch2019-11-111-3/+3
| | | | | | | | | | * dirmngr/ldapserver.h: Rename LDAPSERVER_OPT. -- Using _OPT is not good because it does not describe for what this configuration group is used. _SESSION immediately shows the purpose. Signed-off-by: Werner Koch <[email protected]>
* gpgsm: Allow sepcification of ldaps servers.Werner Koch2019-11-094-11/+85
| | | | | | | | | | | | | | | | | | | | | | | | | | | * sm/gpgsm.h (struct keyserver_spec): Add field use_ldaps. * sm/gpgsm.c (parse_keyserver_line): Parse flags. * sm/call-dirmngr.c (prepare_dirmngr): Send ldaps flag to the dirmngr. * dirmngr/dirmngr.h (struct ldap_server_s): Add field use_ldaps. * dirmngr/ldapserver.c (ldapserver_parse_one): Parse flags. * dirmngr/ldap.c (start_cert_fetch_ldap): Call wrapper with --tls. * dirmngr/dirmngr_ldap.c: New option --tls. (fetch_ldap): Make use of that option. -- There was no way to specify an LDAPS server in dirmngr_ldapserver.socnf or with gpgsm's --keyserver option. This patch fixes this. Eventually we should allow to replace host and port by a partial URI in the same way ldap_initialize does it. For backward compatibility we do not yet do that. Although the dirmngr code accepts an URL (eg. taken from a certificate), I can't see how the scheme was ever used. Thus the patch also detects an ldaps scheme and uses this. That part has not been tested, though. Signed-off-by: Werner Koch <[email protected]>
* doc: Document gpgsm's --keyserver option.Werner Koch2019-11-071-1/+1
| | | | | | | | -- Also fix a few related entries. Signed-off-by: Werner Koch <[email protected]>
* dns: Fix irrelevant use of tmpfile.NIIBE Yutaka2019-08-221-2/+0
| | | | | | | * dirmngr/dns.c (dns_trace_open): Don't use tmpfile. GnuPG-bug-id: 4228 Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Don't add system CAs for SKS HKPS pool.NIIBE Yutaka2019-07-161-0/+2
| | | | | | | | * dirmngr/http.c [HTTP_USE_GNUTLS] (http_session_new): Clear add_system_cas. GnuPG-bug-id: 4594 Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: fix handling of HTTPS redirections during HKPDaniel Kahn Gillmor2019-07-041-1/+3
| | | | | | | | | | | | | * dirmngr/ks-engine-hkp.c (send_request): Reinitialize HTTP session when following a HTTP redirection. -- inspired by patch from Damien Goutte-Gattat <[email protected]> GnuPG-Bug_id: 4566 Signed-off-by: Daniel Kahn Gillmor <[email protected]> Originally applied to 2.2. Here a minor conflict fix was needed.
* dirmngr: Avoid endless loop in case of HTTP error 503.Werner Koch2019-07-031-10/+33
| | | | | | | | | | | | | | | | | * dirmngr/ks-engine-hkp.c (SEND_REQUEST_EXTRA_RETRIES): New. (handle_send_request_error): Use it for 503 and 504. (ks_hkp_search, ks_hkp_get, ks_hkp_put): Pass a new var for extra_tries. -- This is a pretty stupid fix but one which works without much risk of regressions. We could have used the existing TRIES but in that case the fallback to other host would have been too limited. With the used value we can have several fallbacks to other hosts. Note that the TRIES is still cumulative and not per host. GnuPG-bug-id: 4600 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Do not rewrite the redirection for the "openpgpkey" subdomain.Werner Koch2019-07-031-0/+20
| | | | | | | | | * dirmngr/http.c (same_host_p): Consider certain subdomains to be the same. -- GnuPG-bug-id: 4603 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Allow for other hash algorithms than SHA-1 in OCSP.Werner Koch2019-05-281-25/+80
| | | | | | | | | | | | * dirmngr/ocsp.c (do_ocsp_request): Remove arg md. Add args r_sigval, r_produced_at, and r_md. Get the hash algo from the signature and create the context here. (check_signature): Allow any hash algo. Print a diagnostic if the signature does not verify. -- GnuPG-bug-id: 3966 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Improve finding OCSP cert.Werner Koch2019-05-281-1/+35
| | | | | | | | | | | | * dirmngr/certcache.c (find_cert_bysubject): Add better debug output and try to locate by keyid. -- This chnages was suggested in GnuPG-bug-id: 4536 but we do not have any test cases for this. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Add a CSRF expection for pm.meWerner Koch2019-05-091-1/+2
| | | | | | -- Also comment typo fix.
* dirmngr: Improve domaininfo cache update algorithm.Werner Koch2019-04-021-19/+106
| | | | | | | | | | | | | | | | | * dirmngr/domaininfo.c (struct domaininfo_s): Add field keepmark. (insert_or_update): Implement new update algorithm. -- The old algorithm limited the length of a bucket chain by purging the last 50% or the entries. Thus the first domains entered into the cache were never purged. The new algorithm is a bit better: It also limits the chain length on overflow to 50% but tries to keep the entries indicating that a WKD is available in the cache. If there is still space to keep more, those which clearly do not support WKD are also kept. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Better for error code for http status 413.Werner Koch2019-03-293-0/+12
| | | | | | | | | * dirmngr/ks-engine-hkp.c (send_request): New case for 413. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ocsp.c (do_ocsp_request): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
* libdns: Don't use _[A-Z] which are reserved names.NIIBE Yutaka2019-03-251-40/+40
| | | | | | | | | | * dirmngr/dns.c: Use the identifiers of "*_instance" instead of reserved "_[A-Z]". -- GnuPG-bug-id: 4420 Signed-off-by: NIIBE Yutaka <[email protected]>
* kbx: Unify the fingerprint search modes.Werner Koch2019-03-142-18/+11
| | | | | | | | | | | | | | | * kbx/keybox-search-desc.h (KEYDB_SEARCH_MODE_FPR16) (KEYDB_SEARCH_MODE_FPR20, KEYDB_SEARCH_MODE_FPR32): Remove. Switch all users to KEYDB_SEARCH_MODE_FPR along with the fprlen value. -- These search modes were added over time and there has until recently be no incentive to remove the cruft. With the change for v5 keys I finally went over all places and allowed the generic fingerprint mode along with a given length of the fingerprint at all places. Consequently the other modes can now be removed. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Avoid testing for Tor with --gpgconf-list.Werner Koch2019-03-111-1/+6
| | | | | | | | * dirmngr/dirmngr.c (post_option_parsing): Do not call set_tor_mode. (dirmngr_sighup_action): Call it here. (main): Call it here unless in --gpgconf-list mode. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Add CSRF protection exception for protonmail.Werner Koch2019-03-071-5/+40
| | | | | | | | | | * dirmngr/http.c (same_host_p): Add exception table. -- Please: Adding entries to this table shall be an exception and not the rule. Signed-off-by: Werner Koch <[email protected]>
* libdns: Avoid using compound literals (8).NIIBE Yutaka2019-02-261-20/+0
| | | | | | | | | | | | | * dirmngr/dns.h (dns_quietinit): Remove. (dns_hints_i_new): Remove. -- Even before our change, dns_quietinit was questionable macro; There was no place in dns.c which requires overrides in initializer list. Only redundant zero were. Signed-off-by: NIIBE Yutaka <[email protected]>
* libdns: Avoid using compound literals (7).NIIBE Yutaka2019-02-263-12/+16
| | | | | | | | | | | | | | | | * dirmngr/dns.h (DNS_OPTS_INIT, dns_opts): Remove. * dirmngr/dns-stuff.c (libdns_res_open): Use zero-ed, and initialized automatic variable for opts. * dirmngr/dns.c (send_query, resolve_query, resolve_addrinfo): Likewise. -- In fact, DNS_OPTS_INIT was only needed when args are none. With partially specified initialization, C99 guarantees zero-ed other members just like static object. Signed-off-by: NIIBE Yutaka <[email protected]>
* libdns: Avoid using compound literals (6).NIIBE Yutaka2019-02-263-33/+51
| | | | | | | | | | | | | * dirmngr/dns.h (dns_rr_i_new): Remove. (dns_rr_i_init): Remove unused second argument. * dirmngr/dns.c (dns_p_dump, dns_hints_query, print_packet) (parse_packet): Use automatic variable for struct dns_rr_i. (dns_d_cname): No need to call dns_rr_i_init after memset 0. (dns_rr_i_init): Remove unused second argument. Return nothing. * dirmngr/dns-stuff.c (resolve_addr_libdns, get_dns_cert_libdns) (getsrv_libdns): Follow the change of dns_rr_i_init. Signed-off-by: NIIBE Yutaka <[email protected]>
* libdns: Avoid using compound literals (5).NIIBE Yutaka2019-02-262-2/+3
| | | | | | | | | | | | | | | * dirmngr/dns.h (dns_rr_foreach): Don't use dns_rr_i_new. Call dns_rr_grep with NULL. * dirmngr/dns.c (dns_rr_grep): Support NULL for error_. -- Here we still use C99 feature of struct member initialization in dns_rr_foreach, for struct dns_rr_i. Note that in C99, it guarantees non-specified member fields are initialized by zero. So, there's no need to use dns_rr_i_new at all. Signed-off-by: NIIBE Yutaka <[email protected]>
* libdns: Avoid using compound literals (4).NIIBE Yutaka2019-02-262-7/+6
| | | | | | | | | * dirmngr/dns.h (dns_d_new*): Remove. * dirmngr/dns.c (parse_packet): Use dns_d_init with automatic variable. (parse_domain): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* libdns: Avoid using compound literals (3).NIIBE Yutaka2019-02-262-12/+18
| | | | | | | | | | | | | | | * dirmngr/dns.h (dns_p_new): Remove. * dirmngr/dns.c (dns_hosts_query): Use dns_p_init with automatic variable. (dns_hints_query, dns_res_glue, parse_packet, query_hosts) (send_query, show_hints, echo_port): Likewise. -- Implicit automatic allocation by compound literals is confusing for C90 code. Signed-off-by: NIIBE Yutaka <[email protected]>
* libdns: Avoid using compound literals (2).NIIBE Yutaka2019-02-262-19/+12
| | | | | | | | | | | | * dirmngr/dns.h (dns_strsection1, dns_strsection3): Remove. (dns_strclass1, dns_strclass3): Remove. (dns_strtype1, dns_strtype3): Remove. (dns_strsection, dns_strclass, dns_strtype): Directly use the function. * dirmngr/dns.c (dns_strsection): Use automatic variable. (dns_strclass, dns_strtype): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* libdns: Avoid using compound literals.NIIBE Yutaka2019-02-261-5/+10
| | | | | | | | | | | | | | | * dirmngr/dns.c (dns_inet_pton, dns_so_tcp_keep): Use automatic variables. (dns_poll, dns_send_nopipe): Likewise, adding const qualifier. -- Compound literals is a feature of C99. Because we only use C90 plus some limited features, in the project, it's better to avoid it. Besides, we make sure when it's read-only. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Fix initialization of assuan's nPth hook.NIIBE Yutaka2019-01-251-1/+1
| | | | | | | * dirmngr/dirmngr.c (main): Move assuan_set_system_hooks to... (thread_init): ... here. Signed-off-by: NIIBE Yutaka <[email protected]>
* Silence a few compiler warnings new with gcc 8.Werner Koch2018-12-171-5/+12
| | | | | | | | * dirmngr/dns.c: Include gpgrt.h. Silence -Warray-bounds also gcc. * tools/gpg-pair-tool.c (command_respond): Init two vars to silence gcc. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Retry another server from the pool on 502, 503, 504.Werner Koch2018-12-111-7/+33
| | | | | | | | | | | | | * dirmngr/ks-engine-hkp.c (handle_send_request_error): Add arg http_status and handle it. (ks_hkp_search): Get http_status froms end_request and pass on to handle_send_request_error. (ks_hkp_get): Ditto. (ks_hkp_put): Ditto. -- GnuPG-bug-id: 4175 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: New function http_status2string.Werner Koch2018-12-112-0/+26
| | | | | | | | | * dirmngr/http.c (http_status2string): New. -- Right now only the standard 5xx codes. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Avoid possible CSRF attacks via http redirects.Werner Koch2018-11-227-95/+435
| | | | | | | | | | | | | | | | | | | | * dirmngr/http.h (parsed_uri_s): Add fields off_host and off_path. (http_redir_info_t): New. * dirmngr/http.c (do_parse_uri): Set new fields. (same_host_p): New. (http_prepare_redirect): New. * dirmngr/t-http-basic.c: New test. * dirmngr/ks-engine-hkp.c (send_request): Use http_prepare_redirect instead of the open code. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. -- With this change a http query will not follow a redirect unless the Location header gives the same host. If the host is different only the host and port is taken from the Location header and the original path and query parts are kept. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Support the new WKD draft with the openpgpkey subdomain.Werner Koch2018-11-133-19/+68
| | | | | | | * dirmngr/server.c (proc_wkd_get): Implement new openpgpkey subdomain method. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Add FLUSHCRLs commandAndre Heinecke2018-11-122-1/+18
| | | | | | | | | | | | | | | | | | Summary: * dirmngr/crlcache.c (crl_cache_flush): Also deinit the cache. * dirmngr/server.c (hlp_flushcrls, cmd_flushcrls): New. (register_commands): Add FLUSHCRLS. -- This allows it to flush the CRL cache of a running dirmngr server. This can be useful to debug / analyze CRL issues. GnuPG-Bug-Id: T3967 Differential Revision: https://dev.gnupg.org/D469 Signed-off-by: Andre Heinecke <[email protected]> (cherry picked from commit 00321a025f90990a71b60b4689ede1f38fbde347)
* common: Prepare for parsing mail sub-addresses.Werner Koch2018-11-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | * common/mbox-util.c (mailbox_from_userid): Add arg subaddress and implement. Change all callers to pass false for it. * common/t-mbox-util.c (run_mbox_no_sub_test): New. (run_filter): Add arg no_sub. (main): Call new test and add option --no-sub. -- Some stats: In the about 5300000 keys on the SKS servers we found 3055 unique mailboxes with a '+' in it. After removing leading and trailing '+' as well as multiple '+' (e.g. "c++" or "foo+bar+baz") 2697 were left which seem to be valid sub-addresses. To filter mailboxes out from a line delimited list with user-ids (e.g. an SQL output), the command t-mbox-util --verbose --filter can be used; to output w/o sub-addresses add --no-sub. GnuPG-bug-id: 4200 Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Fix LDAP port parsing.Werner Koch2018-11-051-1/+1
| | | | | | | | | | * dirmngr/misc.c (host_and_port_from_url): Fix bad port parsing and a segv for a missing slash after the host name. -- Reportted-by: Tomas Mraz GnuPG-bug-id: 4230 Signed-off-by: Werner Koch <[email protected]>
* headers: fix spellingDaniel Kahn Gillmor2018-10-251-1/+1
| | | | Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* dirmngr: Fix out of scope use of a var in the keyserver LDAP code.Werner Koch2018-10-251-23/+10
| | | | | | | | | * dirmngr/ks-engine-ldap.c (extract_attributes): Don't use a variabale out of scope and cleanup the entire pgpKeySize block. -- GnuPG-bug-id: 4229 Signed-off-by: Werner Koch <[email protected]>
* all: fix spelling and typosDaniel Kahn Gillmor2018-10-2414-24/+24
| | | | Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* dirmngr: Prepare for updated WKD specs with ?l= paramWerner Koch2018-10-221-12/+21
| | | | | | | | | | | | | | | | | * dirmngr/server.c (proc_wkd_get): Tack the raw local address to the request. -- We append the raw non-canonicalized local address part to the hash. Servers who serve the requests from static files will ignore the parameters and a test with posteo shows that also services using a database ignore the parameter. The general idea is that service providers may use their own canonicalization rules. The problem is that we currently filter the returned key for the full mail address and thus we will never see a key if the service did a different canonicalization than we. So consider this to be an experiment. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-09 05:15:59 +0000