helpSavannah Administration - Support: sr #109583, "Test GPG key" reports...

 
 

sr #109583: "Test GPG key" reports error

Submitted by:  Alex Vong <alexvong1995>
Submitted on:  Sat 10 Nov 2018 12:48:22 PM UTC  
 
Category:  Savannah website Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Assigned to:  None Operating System:  None
Open/Closed:  Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

( Jump to the original submission)

Tue 13 Nov 2018 02:56:29 PM UTC, comment #8:

> Maybe we should add a symlink from one to the other so it will work like in other distros?


I think we'd better have a config option for pointing to the right gpg.

Ineiev <ineiev>
Site Administrator
Mon 12 Nov 2018 05:17:51 PM UTC, comment #7:

> In gnupg; in gnupg2, it's 2.2.11.


Oh, so that's what they did. That's damned confusing! It definitely snagged me. Maybe we should add a symlink from one to the other so it will work like in other distros?

> Are there other problems with UI apart from upgrading to PHP 7?


I have no idea. AFAIK no one has created a test system to try it. That would be a required step before upgrading the system.

Bob Proulx <rwp>
Site Administrator
Mon 12 Nov 2018 04:58:25 PM UTC, comment #6:

> I just checked and Trisquel 8 has gpg 1.4.20.


In gnupg; in gnupg2, it's 2.2.11.

> The biggest problem being the web UI and the need to upgrade to PHP 7.


Are there other problems with UI apart from upgrading to PHP 7? I've just checked the migration guide, and the only issue I've found were removed ereg* functions (which I think I've just fixed).

Back to the issue at hand: in any case, savane stores whatever the user gives as the GPG key; when there are no non-ECC keys, it just won't be able to send encrypted messages.

However, you can export multiple keys (RSA and ECC), and then savane must use what gcc 1.4 can work with.

Ineiev <ineiev>
Site Administrator
Sun 11 Nov 2018 11:13:28 PM UTC, comment #5:

> But we can install and use gnupg2.


Yes. But if we do then we must manually track all security issues with gpg ourselves for the duration that we are not using the OS security team for it. That's often forgotten.

Right now when there is a security issue the community security teams usually share information about the vulnerability and coordinate disclosure and package upgrades. For most of us in the field the first notification we get of a problem is that a new package is available to be installed from the security repository. This is often installed even before the official disclosure.

If we count on doing our own thing and manually tracking a package like gpg then we would normally learn of problems late as part of the official disclosure. And then are left to scramble to make an upgraded package very quickly.

Having a plan for security upgrades for any non-distribution installed utility is a concern. And gpg lies at the center where a security vulnerability is like and would be most important.

Also this doesn't seem like something that we should be doing. There are few if any stable releases with such a new gpg. That means there will be few users who will be able to make use of it yet. This seems like a lot of work, some moderate risk, for very little need. It is much simpler to clarify with users that ED25519 cipher is not yet supported.

> It should be available in Trisquel 8.


I just checked and Trisquel 8 has gpg 1.4.20. It will need to be Trisquel 9 before it arrives.

> Do Savannah have plans to upgrade in the near future (say in 3 - 6 months)?


Not at this time. Although the need to do so is hanging heavy over us. Something is going to need to happen soon. The biggest problem being the web UI and the need to upgrade to PHP 7. The other systems can all upgrade independently. However this feature being discussed here in this ticket is a frontend feature.

Bob Proulx <rwp>
Site Administrator
Sun 11 Nov 2018 03:48:17 PM UTC, comment #4:

Yes, I've checked that gnupg 2.1 was the first version supporting elliptic curve keys. It should be available in Trisquel 8. Also, Trisquel 7 will be supported until 2019. Do Savannah have plans to upgrade in the near future (say in 3 - 6 months)?

Alex Vong <alexvong1995>
Sat 10 Nov 2018 04:33:56 PM UTC, comment #3:

> Upgrading to Trisquel 8 would only get us to 1.4.20.


But we can install and use gnupg2.

Ineiev <ineiev>
Site Administrator
Sat 10 Nov 2018 03:54:51 PM UTC, comment #2:

We are currently running Trisquel 7. Upgrading to Trisquel 8 would only get us to 1.4.20. But it would drag us into PHP 7 at the same time.

I suggest creating a standard GPG key using the default RSA type for the time being.

Bob Proulx <rwp>
Site Administrator
Sat 10 Nov 2018 03:34:19 PM UTC, comment #1:

Your key is ED25519, the GnuPG version installed on Savannah is 1.4.16, it doesn't support that algorithm.

Probably we should upgrade.

Ineiev <ineiev>
Site Administrator
Sat 10 Nov 2018 12:48:22 PM UTC, original submission:

Hello,

I receive the following error when I click the "Test GPG key" button after I've updated my GPG key:

What has gone wrong? For testing purpose, my GPG key is:

Alex Vong <alexvong1995>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by alexvong1995 (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-11-10 alexvong1995 Attached File- => Added EC798264A2B2208E1079389E5FF158093AE3FB38.asc, #45397

    Back to the top


    Powered by Savane 3.3