onwnertrust and trust signature (tsig) interactions [was: Re: preferring --check-sigs over --list-sigs]

2017-09-28 Thread Daniel Kahn Gillmor
On Thu 2017-09-28 15:18:09 +0200, Peter Lebbing wrote: > It is a SHA256 trust signature issued by an RSA key. I think it's odd > they issue a level 1 partial trust signature, but I'd guess they think > they're doing their users a service by making it possible to > automatically assign partial

Re: preferring --check-sigs over --list-sigs [was: Re: Houston, we have a problem]

2017-09-28 Thread Stefan Claas
On Thu, 28 Sep 2017 14:58:05 +0100, Andrew Gallagher wrote: > On 28/09/17 14:18, Peter Lebbing wrote: > > Are you sure you had the Governikus key in your keyring? I am > > seeing the same as Stefan: the signature is bad. It says sig-3, the > > dash indicates failure. It should have been sig!3 for

Re: preferring --check-sigs over --list-sigs [was: Re: Houston, we have a problem]

2017-09-28 Thread Andrew Gallagher
On 28/09/17 14:18, Peter Lebbing wrote: > Are you sure you had the Governikus key in your keyring? I am seeing the > same as Stefan: the signature is bad. It says sig-3, the dash indicates > failure. It should have been sig!3 for a good signature. Apologies, you are right. Importing the

Re: preferring --check-sigs over --list-sigs [was: Re: Houston, we have a problem]

2017-09-28 Thread Andrew Gallagher
On 28/09/17 12:59, Stefan Claas wrote: > When long time ago Facebook's pub key received it's vanity sigs i was > upset and decided > to no longer support traditional key servers and added this text to my key. As I argued above, vanity signatures *shouldn't* be an issue - the problem comes when

Re: preferring --check-sigs over --list-sigs

2017-09-28 Thread Peter Lebbing
Ugh, really, how hard can it be? :-( Sorry about this. I'll try to get it right this time. --8<---cut here---start->8--- gpg: DBG: rsa_verify data:+01ff \ gpg: DBG:

Re: preferring --check-sigs over --list-sigs [was: Re: Houston, we have a problem]

2017-09-28 Thread Peter Lebbing
Okay, I made a boo boo regarding text wrapping. Let me repaste the debug output: --8<---cut here---start->8--- gpg: DBG: rsa_verify data:+01ff \ gpg: DBG:

Re: preferring --check-sigs over --list-sigs [was: Re: Houston, we have a problem]

2017-09-28 Thread Peter Lebbing
On 28/09/17 13:30, Andrew Gallagher wrote: > What specific error are you getting? I don't see any errors using > --check-sigs on that key, but then I don't trust Governikus so I'm not > performing the same test that you are. Are you sure you had the Governikus key in your keyring? I am seeing the

Re: preferring --check-sigs over --list-sigs

2017-09-28 Thread Werner Koch
On Wed, 27 Sep 2017 20:24, d...@fifthhorseman.net said: > I've noted this as https://dev.gnupg.org/T3430 Thanks. My fix is --check-signatures --check-sigs Same as --list-keys, but the key signatures are verified and listed too. Note that for performance reasons the

Re: preferring --check-sigs over --list-sigs [was: Re: Houston, we have a problem]

2017-09-28 Thread Stefan Claas
Am 28.09.2017 um 13:30 schrieb Andrew Gallagher: On 2017/09/28 10:57, Stefan Claas wrote: Now i have a problem lol... with my new pub key and --check-sigs. My new pub key 3BB27531899F06EA4582B2E9D68B6EAC6ECF3AB6 was signed by Governikus 864E8B951ECFC04AF2BB233E5E5CCCB4A4BF43D7 and when doing

Re: preferring --check-sigs over --list-sigs [was: Re: Houston, we have a problem]

2017-09-28 Thread Andrew Gallagher
On 2017/09/28 10:57, Stefan Claas wrote: > > Now i have a problem lol... with my new pub key and --check-sigs. > > My new pub key 3BB27531899F06EA4582B2E9D68B6EAC6ECF3AB6 was signed > by Governikus 864E8B951ECFC04AF2BB233E5E5CCCB4A4BF43D7 and when doing > a --check-sigs i get an error...under

Re: preferring --check-sigs over --list-sigs [was: Re: Houston, we have a problem]

2017-09-28 Thread Stefan Claas
Am 27.09.2017 um 20:24 schrieb Daniel Kahn Gillmor: On Wed 2017-09-27 10:10:54 +0100, Andrew Gallagher wrote: On 26/09/17 20:39, Werner Koch wrote: Unfortunately the man pages describes --list-sigs in detail and only in the next paragraph --check-sigs is explained in terms of --list-sigs. it

preferring --check-sigs over --list-sigs [was: Re: Houston, we have a problem]

2017-09-27 Thread Daniel Kahn Gillmor
On Wed 2017-09-27 10:10:54 +0100, Andrew Gallagher wrote: > On 26/09/17 20:39, Werner Koch wrote: >> Unfortunately the man pages describes --list-sigs in detail and only in >> the next paragraph --check-sigs is explained in terms of --list-sigs. >> it might be better to merge them into one