#1093703 fails to encrypt from stdin when using an untrusted key

Package:
gpg-sq
Source:
gpg-sq
Description:
gpg-like OpenPGP CLI toolkit
Submitter:
Antoine Beaupre
Date:
2025-01-21 17:15:04 UTC
Severity:
normal
#1093703#5
Date:
2025-01-21 17:13:58 UTC
From:
To:
When a recipient is not "trusted" by gpg, this works:

    echo foo | gpg --armor -e -r RECIPIENT

But this doesn't:

    echo foo | gpg-sq --armor -e -r RECIPIENT

I think it's because of the way the terminal is handled. Here's what
it looks like in gpg:
gpg: 0000000000000000: There is no assurance this key belongs to the named user

sub  rsa4096/0000000000000000 2022-01-31 RECIPIENT <recipient@torproject.org>
 Primary key fingerprint: 0000 0000 0000 0000 0000  0000 0000 0000 0000 0000
      Subkey fingerprint: 0000 0000 0000 0000 0000  0000 0000 0000 0000 0000

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N) y
-----BEGIN PGP MESSAGE-----

0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000==
=0000
-----END PGP MESSAGE-----

I've redacted PII from the output. But the point is: the key is not
trusted, gpg is worried, prompts me for confirmation, I accept, and
yay, an encrypted blob.

chameleon seems to stumble along the way somewhere:
gpg: 0000000000000000: There is no assurance this key belongs to the named user

sub  rsa4096/0000000000000000 2022-01-31 RECIPIENT <recipient@torproject.org>
 Primary key fingerprint: 0000 0000 0000 0000 0000  0000 0000 0000 0000 0000
      Subkey fingerprint: 0000 0000 0000 0000 0000  0000 0000 0000 0000 0000

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N) gpg: -: encryption failed: Unusable public key

Boom!