Hi folks,

I just tried to use the caff package to sign keys. When used with a key
with a single uid, this nicely shows the key fingerprint so it can be
checked before signing:


  [INFO] Sign the following keys according to your policy, then exit gpg with 'save' after signing each key
  gpg --local-user 3798AF15A1565658 --homedir=/home/matthijs/.caff/gnupghome --secret-keyring /home/matthijs/.gnupg/secring.gpg --no-auto-check-trustdb --trust-model=always --edit-key 98E0D178DCB90C1945C50DB1ED0DD3368DE40924 showphoto sign
  gpg (GnuPG) 1.4.18; Copyright (C) 2014 Free Software Foundation, Inc.
  This is free software: you are free to change and redistribute it.
  There is NO WARRANTY, to the extent permitted by law.


  pub  4096R/8DE40924  created: 2011-11-04  expires: never       usage: SC
  sub  4096R/8133EC28  created: 2011-11-04  expires: never       usage: E
  [ unknown] (1). Martijn van Brummelen (25-08-1982) <martijn@brumit.nl>



  pub  4096R/8DE40924  created: 2011-11-04  expires: never       usage: SC
   Primary key fingerprint: 98E0 D178 DCB9 0C19 45C5  0DB1 ED0D D336 8DE4 0924

       Martijn van Brummelen (25-08-1982) <martijn@brumit.nl>

  Are you sure that you want to sign this key with your
  key "Matthijs Kooijman <matthijs@stdin.nl>" (A1565658)

  Really sign? (y/N) y

However, when multiple uids are present, the fingerprint is not shown:

  [INFO] Sign the following keys according to your policy, then exit gpg with 'save' after signing each key
  gpg --local-user 3798AF15A1565658 --homedir=/home/matthijs/.caff/gnupghome --secret-keyring /home/matthijs/.gnupg/secring.gpg --no-auto-check-trustdb --trust-model=always --edit-key 566A0E6BF957F44032BF2DBAF8307A6ED690AC06 showphoto sign
  gpg (GnuPG) 1.4.18; Copyright (C) 2014 Free Software Foundation, Inc.
  This is free software: you are free to change and redistribute it.
  There is NO WARRANTY, to the extent permitted by law.


  pub  4096R/D690AC06  created: 2010-09-18  expires: never       usage: SC
  sub  4096R/721F9133  created: 2010-09-18  expires: never       usage: E
  [ unknown] (1). Jan-Pascal van Best <janpascal@vanbest.org>
  [ unknown] (2)  Jan-Pascal van Best <janpascal@vanbest.eu>


  Really sign all user IDs? (y/N)

After selecting "y" here, it turns out that the fingerprint _is_
actually shown (but I previously didn't want to select y before I
confirmed the fingerprint). So perhaps this is just gnupg being unclear
with its prompts?

So might be something that needs to be fixed in gnupg, but I'm reporting it
here because perhaps just needs to modify its options to gpg (haven't
investigated this yet). I've included the gnupg maintainers in Cc, feel
free to reassign this bug if appropriate.

Gr.

Matthijs

Control: severity -1 wishlist

Hi Matthijs,

If no UID(s) is (are) selected, gpg wants to make sure you really intend
to sign all UIDs.  So a workaround is to preselect all UIDs; with gpg2
it's can be done in one go with a single command in the prompt: ‘uid *’
(OTOH if you use the 1.4 branch, as of 1.4.18 you'll have to select each
UID manually.)

So it could be done by starting your gpg2 prompt as follows:

  gpg2 --local-user 3798AF15A1565658 \
       --homedir=/home/matthijs/.caff/gnupghome \
       --secret-keyring /home/matthijs/.gnupg/secring.gpg \
       --no-auto-check-trustdb --trust-model=always \
       --edit-key 98E0D178DCB90C1945C50DB1ED0DD3368DE40924 \
       showphoto 'uid *' sign

I'll think of the possible drawbacks of making it the default (with gpg2
at least).  Another possibility would be to have a configuration option
containing all commands at once:

  $CONFIG{'gpg-command'} = [ 'showphoto', 'uid *', 'sign', 'save' ];

Suggestions welcome ;-)

Cheers,