Bug#753853: libqca2-plugin-gnupg: Fails when GnuPG encounters unrelated expired keys
Package: libqca2-plugin-gnupg
Version: 2.0.0~beta3-2
Severity: important
Tags: upstream patch
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
If a key has a non-related, expired signing subkey, any operation on this key
currently will fail, claiming the key is expired. Additionally, actions will
"randomly" fail each time GnuPG decides to update its trust database and
encounters completely unrelated expired keys.
I've filed a review request for an upstream patch here:
https://git.reviewboard.kde.org/r/118567/
I've attached a minimal patch to this report which stays as close to the
current (working) behaviour as possible, without introducing new enumeration
values as requested by the upstream developer.
With this patch, KEYEXPIRED will be ignored because it's thrown regardless
of being related to the current operation. Instead, EXPKEYSIG, REVKEYSIG and
INV_RECP are used accordingly.
Revoked keys are currently treated as expired keys.
Due to a bug/unexpected behaviour in GnuPG, encrypting to an expired or
revoked key will omit the reason for failing.
- -- System Information:
Debian Release: jessie/sid
APT prefers unstable
APT policy: (600, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 3.14-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages libqca2-plugin-gnupg depends on:
ii gnupg 1.4.18-1
ii libc6 2.19-4
ii libgcc1 1:4.9.0-9
ii libqca2 2.0.3-6
ii libqtcore4 4:4.8.6+dfsg-2
ii libstdc++6 4.9.0-9
libqca2-plugin-gnupg recommends no packages.
libqca2-plugin-gnupg suggests no packages.
- -- no debconf information
-----BEGIN PGP SIGNATURE-----
iQEcBAEBCgAGBQJTuD4OAAoJECgd6uQ0EKrTJkAIAKLkBaDiVvYynKGHlHT2Oo8o
5uaDoq4nxg/1eYtWl0D0eDDM0TStsE7UnZ7KwCILUujvagIX2gdlft6zHYIYJkpJ
L2jCxVNfHdidFQ0sKzU/55llZjzjCtMXZ+cEnquGb+fmCyu5pGy77lVXuAlzzR3T
VakVhks66FoLTImbFTJ1+CMbfouNaxWFHmIitYShq2PWV5Ca6r+lVKxaP0diGHCl
/Fk8xZ2AcRSZ5pPJHH9YKraFhnri/3PKb7Q1OPx7PCuJv3Q8ax2XA2ET2u9TmFvs
BbdNkySCxAAhJZST7OfQ80OhZ1J0sbWbCvd1ezzNkr410N6pUqmlI4PFVLc4j2Y=
=9Cj6
-----END PGP SIGNATURE-----
>From 1887108236bc61b598d565ee1866c5573f5a26ab Mon Sep 17 00:00:00 2001
From: Florian Fieber <florian@florianfieber.de>
Date: Sun, 1 Jun 2014 13:47:11 +0200
Subject: [PATCH] [gnupg] Fix operating on keys with unrelated, expired subkeys
Ignore KEYEXPIRED which will be thrown regardless of the expired key being
related to the current operation. Instead, use EXPKEYSIG, REVKEYSIG and
INV_RECP accordingly.
Revoked keys are currently treated as expired keys.
Due to a bug/unexpected behaviour in GnuPG, encrypting to an expired or
revoked key will omit the reason for failing.
---
plugins/qca-gnupg/gpgop.cpp | 31 ++++++++++++-------------------
1 file changed, 12 insertions(+), 19 deletions(-)
diff --git a/plugins/qca-gnupg/gpgop.cpp b/plugins/qca-gnupg/gpgop.cpp
index 293e422..3918b67 100644
--- a/plugins/qca-gnupg/gpgop.cpp
+++ b/plugins/qca-gnupg/gpgop.cpp
@@ -879,25 +879,13 @@ private:
if(curError == GpgOp::ErrorUnknown)
curError = GpgOp::ErrorFormat;
}
- else if(s == "KEYEXPIRED")
+ else if(s == "EXPKEYSIG")
{
- if(curError == GpgOp::ErrorUnknown)
- {
- if(input.op == GpgOp::SignAndEncrypt)
- {
- if(!signPartDone)
- curError = GpgOp::ErrorSignerExpired;
- else
- curError = GpgOp::ErrorEncryptExpired;
- }
- else
- {
- if(signing)
- curError = GpgOp::ErrorSignerExpired;
- else
- curError = GpgOp::ErrorEncryptExpired;
- }
- }
+ curError = GpgOp::ErrorSignerExpired;
+ }
+ else if(s == "REVKEYSIG")
+ {
+ curError = GpgOp::ErrorSignerExpired;
}
else if(s == "INV_RECP")
{
@@ -907,6 +895,12 @@ private:
{
if(r == 10)
curError = GpgOp::ErrorEncryptUntrusted;
+ // revoked
+ else if(r == 4)
+ curError = GpgOp::ErrorEncryptExpired;
+ // expired
+ else if(r == 5)
+ curError = GpgOp::ErrorEncryptExpired;
else
curError = GpgOp::ErrorEncryptInvalid;
}
@@ -965,7 +959,6 @@ private:
{
badPassphrase = false;
- // a trick to determine what KEYEXPIRED should apply to
signPartDone = true;
}
else if(s == "BAD_PASSPHRASE")
--
2.0.1
Reply to: