mainSavannah Administration - Support: sr #109583, "Test GPG key" reports...

 
 

sr #109583: "Test GPG key" reports error

Submitter:  alexvong1995
Submitted:  Sat 10 Nov 2018 12:48:22 PM UTC
   
 
Category:  Savannah website Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  ineiev
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Mon 23 Nov 2020 06:36:06 PM UTC, comment #14: 

It looks like gpg 2.1.11 doesn't work with your key (gpg 2.2.19 does work).

Ineiev <ineiev>
Site Administrator
Sun 22 Nov 2020 11:17:36 AM UTC, comment #13: 

Test GPG reports

Test Encryption
Errors: Encryption failed.

for me. All the previous test seems to pass. So I think something is still not right. I'm trying to use a EdDSA key, just fyi

Yunxiang Li <tleydxdy>
Sun 22 Mar 2020 05:05:19 AM UTC, comment #12: 

To add a clarification to the timeline.  Between then and now in 2020 the web frontend has been upgraded from Trisquel 7 to 8.  That brought in the new versions of gnupg*.  I know that when I look through this a year from now I won't remember this unless I add this note about the timeline to the ticket.

Bob Proulx <rwp>
Site Administrator
Tue 17 Mar 2020 12:33:30 PM UTC, comment #11: 

I've just changed Savannah config to use GnuPG 2.1 (from Trisquel 8); it should fix the issue.

Ineiev <ineiev>
Site Administrator
Tue 28 May 2019 06:47:19 AM UTC, comment #10: 


> mysql_mode


s/my//

Ineiev <ineiev>
Site Administrator
Tue 28 May 2019 06:42:36 AM UTC, comment #9: 

I've tested Savane locally on Trisquel 8.

A few functions needed replacements, and MySQL 5.7 default configuration woudn't do (mysql_mode shouldn't contain ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES); but then it worked.

Ineiev <ineiev>
Site Administrator
Tue 13 Nov 2018 02:56:29 PM UTC, comment #8: 


> Maybe we should add a symlink from one to the other so it will work like in other distros?


I think we'd better have a config option for pointing to the right gpg.

Ineiev <ineiev>
Site Administrator
Mon 12 Nov 2018 05:17:51 PM UTC, comment #7: 


> In gnupg; in gnupg2, it's 2.2.11.


Oh, so that's what they did.  That's damned confusing!  It definitely snagged me.  Maybe we should add a symlink from one to the other so it will work like in other distros?

> Are there other problems with UI apart from upgrading to PHP 7?


I have no idea.  AFAIK no one has created a test system to try it.  That would be a required step before upgrading the system.


Bob Proulx <rwp>
Site Administrator
Mon 12 Nov 2018 04:58:25 PM UTC, comment #6: 


> I just checked and Trisquel 8 has gpg 1.4.20.


In gnupg; in gnupg2, it's 2.2.11.

> The biggest problem being the web UI and the need to upgrade to PHP 7.


Are there other problems with UI apart from upgrading to PHP 7? I've just checked the migration guide, and the only issue I've found were removed ereg* functions (which I think I've just fixed).

Back to the issue at hand: in any case, savane stores whatever the user gives as the GPG key; when there are no non-ECC keys, it   just won't be able to send encrypted messages.

However, you can export multiple keys (RSA and ECC), and then savane must use what gcc 1.4 can work with.

Ineiev <ineiev>
Site Administrator
Sun 11 Nov 2018 11:13:28 PM UTC, comment #5: 


> But we can install and use gnupg2.


Yes.  But if we do then we must manually track all security issues with gpg ourselves for the duration that we are not using the OS security team for it.  That's often forgotten.

Right now when there is a security issue the community security teams usually share information about the vulnerability and coordinate disclosure and package upgrades.  For most of us in the field the first notification we get of a problem is that a new package is available to be installed from the security repository.  This is often installed even before the official disclosure.

If we count on doing our own thing and manually tracking a package like gpg then we would normally learn of problems late as part of the official disclosure.  And then are left to scramble to make an upgraded package very quickly.

Having a plan for security upgrades for any non-distribution installed utility is a concern.  And gpg lies at the center where a security vulnerability is like and would be most important.

Also this doesn't seem like something that we should be doing.  There are few if any stable releases with such a new gpg.  That means there will be few users who will be able to make use of it yet.  This seems like a lot of work, some moderate risk, for very little need.  It is much simpler to clarify with users that ED25519 cipher is not yet supported.

> It should be available in Trisquel 8.


I just checked and Trisquel 8 has gpg 1.4.20.  It will need to be Trisquel 9 before it arrives.

> Do Savannah have plans to upgrade in the near future (say in 3 - 6 months)?


Not at this time.  Although the need to do so is hanging heavy over us.  Something is going to need to happen soon.  The biggest problem being the web UI and the need to upgrade to PHP 7.  The other systems can all upgrade independently.  However this feature being discussed here in this ticket is a frontend feature.

Bob Proulx <rwp>
Site Administrator
Sun 11 Nov 2018 03:48:17 PM UTC, comment #4: 

Yes, I've checked that gnupg 2.1 was the first version supporting elliptic curve keys. It should be available in Trisquel 8. Also, Trisquel 7 will be supported until 2019. Do Savannah have plans to upgrade in the near future (say in 3 - 6 months)?

alexvong1995
Sat 10 Nov 2018 04:33:56 PM UTC, comment #3: 


>  Upgrading to Trisquel 8 would only get us to 1.4.20.


But we can install and use gnupg2.

Ineiev <ineiev>
Site Administrator
Sat 10 Nov 2018 03:54:51 PM UTC, comment #2: 

We are currently running Trisquel 7.  Upgrading to Trisquel 8 would only get us to 1.4.20.  But it would drag us into PHP 7 at the same time.

I suggest creating a standard GPG key using the default RSA type for the time being.

Bob Proulx <rwp>
Site Administrator
Sat 10 Nov 2018 03:34:19 PM UTC, comment #1: 

Your key is ED25519, the GnuPG version installed on Savannah is 1.4.16, it doesn't support that algorithm.

Probably we should upgrade.

Ineiev <ineiev>
Site Administrator
Sat 10 Nov 2018 12:48:22 PM UTC, original submission:  

Hello,

I receive the following error when I click the "Test GPG key" button after I've updated my GPG key:


gpg: keyring `/tmp/tmp.0pv00NrtVS/secring.gpg' created
gpg: keyring `/tmp/tmp.0pv00NrtVS/pubring.gpg' created
gpg: key 3AE3FB38: no valid user IDs
gpg: this may be caused by a missing self-signature
gpg: Total number processed: 1
gpg:           w/o user IDs: 1


What has gone wrong? For testing purpose, my GPG key is:


-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEW9wl+BYJKwYBBAHaRw8BAQdAurhrcJpShB9c6LjA10W25nH06B7+rC7Nha1V
ba9Jo3G0IkFsZXggVm9uZyA8YWxleHZvbmcxOTk1QGdtYWlsLmNvbT6IlgQTFggA
PgIbAQULCQgHAgYVCgkICwIEFgIDAQIeAQIXgBYhBOx5gmSisiCOEHk4nl/xWAk6
4/s4BQJb3CnABQkCL/NKAAoJEF/xWAk64/s4bHEA/RYaH1dxst2MIVuHZQg0VWuj
m7cWKTqzUasHhAkEi83eAQDq3b0LI5bPo5H2eYmeoULDUTJpuihi692H0luJRi6O
B4h1BBAWCAAdFiEEqH9mXV5BNBTOWlOF865L2yPs2hsFAlvcUbYACgkQ865L2yPs
2hsKdAD/XSsEETKmG5H597axepu6zUi8VnzEXRgUGMz4Gh1S9PkBALnlSMINOACE
2nMLnJnPrn3mebMZPLCvFJ/OMW1ugvUFuDMEW9wm0RYJKwYBBAHaRw8BAQdAk2ez
QR8X4VTHUVUiUDCeiBqnQaQWT5hq0Uj+p3VxaC6I9QQYFggAJgIbAhYhBOx5gmSi
siCOEHk4nl/xWAk64/s4BQJb3CnTBQkCL/JwAIF2IAQZFggAHRYhBDBvy48sAcJd
KdMFVmHvUC72AlLyBQJb3CbRAAoJEGHvUC72AlLyAtwA/j8hOb1n52PJ+ql+vYfN
E7dG7KAnN3yUW2NOAMkiN/qzAP4/QTDzBX1l0V6EUo8m6ozQFRLsDTYbEmb9OXrX
vCrpCAkQX/FYCTrj+zhWcAD/XFQnM1bdBKGnMxxI8fQRteaRS4WGt4qhW+CrJ6Jp
DIQBAKtU4vXg9hWlgHgvKXqSEEFm8HyGh/9jx/OoJSfKiLUHuDgEW9wm8BIKKwYB
BAGXVQEFAQEHQHWQ4hmlimFlV1kHTzNeEZ7OH1YxL8GtF5fSNeC2iAB+AwEIB4h+
BBgWCAAmAhsMFiEE7HmCZKKyII4QeTieX/FYCTrj+zgFAlvcKeoFCQIv8lAACgkQ
X/FYCTrj+zhYEgEAqflYQ6CHMbxZfiG1shTFx6rj7RjD9FqzN2bgefw4dDIA/20a
jPZhWiOxJFj8dk+LST8x8vTktqIJwnsNy0rxeugN
=bApJ
-----END PGP PUBLIC KEY BLOCK-----
-vertatim-

alexvong1995

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by tleydxdy (Posted a comment)
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by alexvong1995 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2020-11-09 ineiev StatusReady For Test Done
        Open/ClosedOpen Closed
    2020-03-17 ineiev StatusNone Ready For Test
    2020-02-25 ineiev Assigned toNone ineiev
    2018-11-10 alexvong1995 Attached File- Added EC798264A2B2208E1079389E5FF158093AE3FB38.asc, #45397

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code