gnupg, branch debian-unstable-patch-queue

dirmngr: Don't add system CAs for SKS HKPS pool.

2019-07-20T18:16:21Z

* dirmngr/http.c [HTTP_USE_GNUTLS] (http_session_new): Clear add_system_cas. -- Cherry-picking the master commit of: 75e0ec65170b7053743406e3f3b605febcf7312a GnuPG-bug-id: 4594 Signed-off-by: NIIBE Yutaka (cherry picked from commit 58e234fbeb6cc5908b69a73e50428f02e584e504) Gbp-Pq: Name dirmngr-Don-t-add-system-CAs-for-SKS-HKPS-pool.patch

gpg: Improve import slowness.

2019-07-20T18:16:21Z

* g10/import.c (read_block): Avoid O(N^2) append. (sec_to_pub_keyblock): Likewise. Signed-off-by: NIIBE Yutaka (cherry picked from commit 33c17a8008c3ba3bb740069f9f97c7467f156b54) Gbp-Pq: Topic from-master Gbp-Pq: Name gpg-Improve-import-slowness.patch

gpg: Fix keyring retrieval.

2019-07-20T18:16:21Z

* g10/keyring.c (keyring_get_keyblock): Avoid O(N^2) append. GnuPG-bug-id: 4592 Signed-off-by: NIIBE Yutaka (cherry picked from commit a7a043e82555a9da984c6fb01bfec4990d904690) Gbp-Pq: Topic from-master Gbp-Pq: Name gpg-Fix-keyring-retrieval.patch

gpg: drop import-clean from default keyserver import options

2019-07-20T18:16:21Z

* g10/gpg.c (main): drop IMPORT_CLEAN from the default opt.keyserver_options.import_options * doc/gpg.texi: reflect this change in the documentation Given that SELF_SIGS_ONLY is already set, it's not clear what additional benefit IMPORT_CLEAN provides. Furthermore, IMPORT_CLEAN means that receiving an OpenPGP certificate from a keyserver will potentially delete data that is otherwise held in the local keyring, which is surprising to users who expect retrieval from the keyservers to be purely additive. GnuPG-Bug-Id: 4628 Signed-off-by: Daniel Kahn Gillmor Gbp-Pq: Name gpg-drop-import-clean-from-default-keyserver-import-optio.patch

fix spelling

2019-07-20T18:16:21Z

Gbp-Pq: Name fix-spelling.patch

Make gpg-zip use tar from $PATH

2019-07-20T18:16:20Z

Apparently there is no clean way to configure this from ./configure, and upstream is deprecating gpg-zip anyway. So just force-set tar to be manually "tar" (meaning, that we should look in the $PATH at runtime). See also https://dev.gnupg.org/T4251 and https://bugs.debian.org/913582 Gbp-Pq: Name Make-gpg-zip-use-tar-from-PATH.patch

Use hkps://keys.openpgp.org as the default keyserver

2019-07-20T18:16:20Z

As of 2.2.17, GnuPG will refuse to accept any third-party certifications from OpenPGP certificates pulled from the keyserver network. The SKS keyserver network currently has at least a dozen popular certificates which are flooded with enough unusable third-party certifications that they cannot be retrieved in any reasonable amount of time. The hkps://keys.openpgp.org keyserver installation offers HKPS, performs cryptographic validation, and by policy does not distribute third-party certifications anyway. It is not distributed or federated yet, unfortunately, but it is functional, which is more than can be said for the dying SKS pool. And given that GnuPG is going to reject all the third-party certifications anyway, there is no clear "web of trust" rationale for relying on the SKS pool. One sticking point is that keys.openpgp.org does not distribute user IDs unless the user has proven control of the associated e-mail address. This means that on standard upstream GnuPG, retrieving revocations or subkey updates of those certificates will fail, because upstream GnuPG ignores any incoming certificate without a user ID, even if it knows a user ID in the local copy of the certificate (see https://dev.gnupg.org/T4393). However, we have three patches in debian/patches/import-merge-without-userid/ that together fix that bug. Signed-off-by: Daniel Kahn Gillmor Gbp-Pq: Name Use-hkps-keys.openpgp.org-as-the-default-keyserver.patch

dirmngr: Only use SKS pool CA for SKS pool

2019-07-20T18:16:20Z

* dirmngr/http.c (http_session_new): when checking whether the keyserver is the HKPS pool, check specifically against the pool name, as ./configure might have been used to select a different default keyserver. It makes no sense to apply Kristian's certificate authority to anything other than the literal host hkps.pool.sks-keyservers.net. Signed-off-by: Daniel Kahn Gillmor Gbp-Pq: Name dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch

gpg: accept subkeys with a good revocation but no self-sig during import

2019-07-20T18:16:20Z

* g10/import.c (chk_self_sigs): Set the NODE_GOOD_SELFSIG flag when we encounter a valid revocation signature. This allows import of subkey revocation signatures, even in the absence of a corresponding subkey binding signature. -- This fixes the remaining test in import-incomplete.scm. GnuPG-Bug-id: 4393 Signed-off-by: Daniel Kahn Gillmor Gbp-Pq: Topic import-merge-without-userid Gbp-Pq: Name gpg-accept-subkeys-with-a-good-revocation-but-no-self-sig.patch

gpg: allow import of previously known keys, even without UIDs

2019-07-20T18:16:20Z

* g10/import.c (import_one): Accept an incoming OpenPGP certificate that has no user id, as long as we already have a local variant of the cert that matches the primary key. -- This fixes two of the three broken tests in import-incomplete.scm. GnuPG-Bug-id: 4393 Signed-off-by: Daniel Kahn Gillmor Gbp-Pq: Topic import-merge-without-userid Gbp-Pq: Name gpg-allow-import-of-previously-known-keys-even-without-UI.patch