https://bugs.documentfoundation.org/show_bug.cgi?id=158839
kolAflash <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |108828, 115884, 133941, | |159040 --- Comment #1 from kolAflash <[email protected]> --- I found some problems with GPG and related NSS (X.509) problems, for which no bug report seems to exist yet. So I list them here to keep track of them. Please feel free to formulate separate tickets for them. By the way, this is how I understand the terminology. OpenPGP: open technical standard PGP: initial proprietary software from which OpenPGP originated GnuPG (short GPG): Open Source implementation by GNU So LibreOffice encrypts and signs by the OpenPGP standard, using GnuPG as keyring. Save dialog -> Password and GPG encryption: https://git.libreoffice.org/core/+/ca5c9591ba38ad83415a2d4ced98bfc74d30b032/sfx2/source/dialog/filedlghelper.cxx#1420 `mbPwdCheckBoxState` becomes also set to true if the file is OpenPGP encrypted. (not with a password) https://git.libreoffice.org/core/+/ca5c9591ba38ad83415a2d4ced98bfc74d30b032/sfx2/source/dialog/filedlghelper.cxx#1538 LO also asks for a password if `CHECKBOX_GPGENCRYPTION` && `CHECKBOX_PASSWORD` are checked. But only encrypts using GPG and discards the password. GPG "Certificate Manager" for OpenPGP: Make clear, that the the term "Certificate Manager" refers to the GPG keyring for OpenPGP keys. (GPG can also handle X.509, but LibreOffice doesn't use that feature) The GPG "Certificate Manager" is NOT for X.509. Instead for LibreOffice uses Mozilla (Firefox, Thunderbird, SeaMonkey) to manage X.509 certificates. The term "Certificate Manager" is found here: - File -> Digital Signatures -> Digital Signatures... -> Certificate Chooser -> Start Certificate Manager - Options -> LibreOffice -> Security -> Certificate Manager It runs one of these programs as GUI for managing GPG. https://git.libreoffice.org/core/+/ca5c9591ba38ad83415a2d4ced98bfc74d30b032/xmlsecurity/source/dialogs/digitalsignaturesdialog.cxx#74 Here's a bug report, which is a mess up resulting from this obscurity: https://bugs.documentfoundation.org/show_bug.cgi?id=133941#c6 "Start Certificate Manager in Windows should start certificates system store" FUTURE TODO: Think about loading OpenPGP keys and X.509 certificates from a common source. Either Thunderbird (Firefox has no OpenPGP) or GnuPG/GPG. Both can manage OpenPGP and X.509. (Thunderbird >= 78 introduced it's own OpenPGP store in 2020) CertificateChooser dialog: Give a hint, that the X.509 keys are from Mozilla (Firefox / Thundebird / SeaMonkey), but the GPG keys are from GnuPG and NOT from Mozilla. (Thunderbird >= 78 introduced an internal GPG keyring in 2020) More problems in this dialog: - Table has column headers for `Issued to`, `Issued by` and `Expiration date`. But the column only contains `Issued to` stretched to full width. - REGRESSION (working in LO-7.4) - Outdated X.509 certificates can't be identified. - Filtering doesn't work for X.509 (only for GPG). - X.509 and PGP entries for the same identity (email / name) can't be easily distinguished. - Workaround: misuse use broken filtering *(see below)* to tell GPG and X.509 apart 🤪 Encrypt ODF: CertificateChooser lists GPG keys for ENCRYPTION which are marked for SIGNING ONLY. Error message when encrypting: "OpenPGP key not trusted, damaged, or encryption failure. Please try again." GNUPGHOME=libreoffice.git/test/signing-keys has a sign-only and an encrypt-only PUBLIC key. TODO: Add private test keys with sign-only and encrypt-only to test the other way around when signing. Broken window resize rules: View Certificate # can't read long lines in "Details" tab, resize blocked Options -> LibreOffice -> Security -> Certificate Path / Certificate X.509: ODF signing: X.509 signing doesn't work REGRESSION Worked for outdated and for valid certificates in LO-7.4. Broken in: LO-24.8.0.0.alpha1+ (Build ID: 71f3be3bee2e8a07f85594c02a9b44627b219e95) Valid certificate - stderr: warn:xmlsecurity.xmlsec:3979175:3979175:xmlsecurity/source/xmlsec/errorcallback.cxx:54: x509vfy.c:480: xmlSecNssX509StoreVerifyCert() '' '' 71 'subject="[email protected],CN=FIRSTNAME LASTNAME"; reason=-8179' Outdated certificate - stderr: warn:xmlsecurity.xmlsec:3976088:3976088:xmlsecurity/source/xmlsec/errorcallback.cxx:54: x509vfy.c:470: xmlSecNssX509StoreVerifyCert() '' '' 76 'subject="[email protected],CN=FIRSTNAME LASTNAME"; reason=expired' X.509 & GPG: PDF signing: Linked bug 115884 because it's a problem for X.509 caused by the introduction of GPG. https://bugs.documentfoundation.org/show_bug.cgi?id=115884#c18 "PDF signing should mention it only works with x509 certificates" X.509: NSS Password dialog: Make clear that a Mozilla profile password is requested and for which Mozilla profile. The dialog currently only states: "Enter password to open file: NSS Certificate DB" (normal users won't even know what's "NSS") X.509: CertificateChooser: Make clear from which Mozilla profile the X.509 keys are loaded. Else the user might look for a key from another profile. It's NOT enough to show this hint in NSS Password dialog, because Mozilla profile might not have a password. Additionally the dialog only shows one X.509 certificate per email and it's unclear which one (probably the one imported into Thunderbird first). That's a problem when outdated certificates are not deleted from Thunderbird, which is common practice to continue reading ole mails. Related: https://bugs.documentfoundation.org/show_bug.cgi?id=119811 "LibreOffice 6.0.6 spies on my Firefox keychain when opening MS documents" Referenced Bugs: https://bugs.documentfoundation.org/show_bug.cgi?id=108828 [Bug 108828] Improve signing with password protected gpg keys https://bugs.documentfoundation.org/show_bug.cgi?id=115884 [Bug 115884] PDF signing should mention it only works with x509 certificates https://bugs.documentfoundation.org/show_bug.cgi?id=133941 [Bug 133941] Start Certificate Manager in Windows should start certificates system store https://bugs.documentfoundation.org/show_bug.cgi?id=159040 [Bug 159040] provide easy UI to automatically apply digital signature when storing documents -- You are receiving this mail because: You are the assignee for the bug.
