From 55b5928099bafbd5409d3377a42259c11e394cd0 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Fri, 25 Jun 2021 19:15:24 +0200 Subject: dirmngr: Change the default keyserver. * configure.ac (DIRMNGR_DEFAULT_KEYSERVER): Change to keyserver.ubuntu.com. * dirmngr/certcache.c (cert_cache_init): Disable default pool cert. * dirmngr/http-ntbtls.c (gnupg_http_tls_verify_cb): Ditto. * dirmngr/http.c (http_session_new): Ditto. * dirmngr/server.c (make_keyserver_item): Use a different mapping for the gnupg.net names. -- Due to the unfortunate shutdown of the keyserver pool, the long term defaults won't work anymore. Thus it is better to change them. For https access keyserver.ubuntu.com is now used because it can be expected that this server can stand the load from newer gnupg LTS versions. For http based access the Dutch Surfnet keyserver is used. However due to a non-standard TLS certificate this server can not easily be made the default for https. Note: that the default server will be changed again as soon as a new connected keyserver infrastructure has been established. (cherry picked from commit 47c4e3e00a7ef55f954c14b3c237496e54a853c1) --- dirmngr/server.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'dirmngr/server.c') diff --git a/dirmngr/server.c b/dirmngr/server.c index 2880dcb47..ced92de21 100644 --- a/dirmngr/server.c +++ b/dirmngr/server.c @@ -2138,22 +2138,22 @@ make_keyserver_item (const char *uri, uri_item_t *r_item) */ if (!strcmp (uri, "hkps://keys.gnupg.net") || !strcmp (uri, "keys.gnupg.net")) - uri = "hkps://hkps.pool.sks-keyservers.net"; + uri = "hkps://keyserver.ubuntu.com"; else if (!strcmp (uri, "https://keys.gnupg.net")) - uri = "https://hkps.pool.sks-keyservers.net"; + uri = "hkps://keyserver.ubuntu.com"; else if (!strcmp (uri, "hkp://keys.gnupg.net")) - uri = "hkp://hkps.pool.sks-keyservers.net"; + uri = "hkp://pgp.surf.nl"; else if (!strcmp (uri, "http://keys.gnupg.net")) - uri = "http://hkps.pool.sks-keyservers.net"; + uri = "hkp://pgp.surf.nl:80"; else if (!strcmp (uri, "hkps://http-keys.gnupg.net") || !strcmp (uri, "http-keys.gnupg.net")) - uri = "hkps://ha.pool.sks-keyservers.net"; + uri = "hkps://keyserver.ubuntu.com"; else if (!strcmp (uri, "https://http-keys.gnupg.net")) - uri = "https://ha.pool.sks-keyservers.net"; + uri = "hkps://keyserver.ubuntu.com"; else if (!strcmp (uri, "hkp://http-keys.gnupg.net")) - uri = "hkp://ha.pool.sks-keyservers.net"; + uri = "hkp://pgp.surf.nl"; else if (!strcmp (uri, "http://http-keys.gnupg.net")) - uri = "http://ha.pool.sks-keyservers.net"; + uri = "hkp://pgp.surf.nl:80"; item = xtrymalloc (sizeof *item + strlen (uri)); if (!item) -- cgit v1.2.3