#1060664 gpg: auto-key-retrieve does not work

Package:
gpg
Source:
gpg
Description:
GNU Privacy Guard -- minimalist public key operations
Submitter:
Vincent Lefevre
Date:
2024-01-12 13:57:02 UTC
Severity:
normal
#1060664#5
Date:
2024-01-12 10:40:55 UTC
From:
To:
The --keyserver-options=auto-key-retrieve option does not work. It is
described as an obsolete alias for the option auto-key-retrieve, but
it is still documented, so that it is still expected to be supported.
Note that it is still used by libmodule-signature-perl.

The test I did:

zira:~> MODULE_SIGNATURE_VERBOSE=1 MODULE_SIGNATURE_KEYSERVER=pgpkeys.eu cpan -i XML::RPC
Reading '/home/vinc17/.cpan/Metadata'
  Database was generated on Thu, 11 Jan 2024 22:41:02 GMT
Running install for module 'XML::RPC'
CPAN: Digest::SHA loaded ok (v6.04)
CPAN: Module::Signature loaded ok (v0.88)
Executing gpg/--verify/--batch/--no-tty/--keyserver=hkp://pgpkeys.eu:11371/--keyserver-options=auto-key-retrieve//tmp/E4jnBjTWP8
gpg: Signature made 2023-12-17T16:29:09 CET
gpg:                using RSA key 77576125A905F1BA
gpg: Can't check signature: No public key

Signature invalid for file /home/vinc17/.cpan/sources/authors/id/C/CA/CAVAC/CHECKSUMS. Please investigate.
[...]

zira:~[2]> gpg --keyserver pgpkeys.eu --recv-keys 77576125A905F1BA
gpg: key 328DA867450F89EC: 13 duplicate signatures removed
gpg: key 328DA867450F89EC: "PAUSE Batch Signing Key 2024 <pause@pause.perl.org>" 1 new user ID
gpg: key 328DA867450F89EC: "PAUSE Batch Signing Key 2024 <pause@pause.perl.org>" 14 new signatures
gpg: key 328DA867450F89EC: "PAUSE Batch Signing Key 2024 <pause@pause.perl.org>" 2 new subkeys
gpg: Total number processed: 1
gpg:           new user IDs: 1
gpg:            new subkeys: 2
gpg:         new signatures: 14

zira:~> MODULE_SIGNATURE_VERBOSE=1 MODULE_SIGNATURE_KEYSERVER=pgpkeys.eu cpan -i XML::RPC
Reading '/home/vinc17/.cpan/Metadata'
  Database was generated on Thu, 11 Jan 2024 22:41:02 GMT
Running install for module 'XML::RPC'
CPAN: Digest::SHA loaded ok (v6.04)
CPAN: Module::Signature loaded ok (v0.88)
Executing gpg/--verify/--batch/--no-tty/--keyserver=hkp://pgpkeys.eu:11371/--keyserver-options=auto-key-retrieve//tmp/TMJRFmY_zR
gpg: Signature made 2023-12-17T16:29:09 CET
gpg:                using RSA key 77576125A905F1BA
gpg: Good signature from "PAUSE Batch Signing Key 2024 <pause@pause.perl.org>" [unknown]
[...]

In summary, the public key was missing and wasn't retrieved
automatically, even though --keyserver-options=auto-key-retrieve was
used. Then I retrieved the key explicitly with --recv-keys and using
the same keyserver, which succeeded, and the signature could be
verified.
#1060664#12
Date:
2024-01-12 13:45:02 UTC
From:
To:
I've tried --auto-key-retrieve on a different machine, and this
doesn't have any effect either:

cventin:~> gpg --verbose --keyserver pgpkeys.eu --auto-key-retrieve --verify /home/vlefevre/.cpan/sources/authors/id/C/CA/CAVAC/CHECKSUMS
gpg: armor header: Hash: SHA1
gpg: armor header: Version: GnuPG v2.0.14 (GNU/Linux)
gpg: original file name=''
gpg: Signature made 2023-12-17T16:29:09 CET
gpg:                using RSA key 77576125A905F1BA
gpg: Can't check signature: No public key

Putting the option in .gnupg/gpg.conf doesn't have any effect either.