#907234 gnupg should correctly deal with multiple keyrings

Package:
gnupg
Source:
gnupg2
Submitter:
Nicolas Braud-Santoni
Date:
2023-08-29 16:15:19 UTC
Severity:
normal
Tags:
#907234#5
Date:
2018-08-25 01:37:14 UTC
From:
To:
Hi,

I noticed that gnupg reports that a particularly mail was signed by a key
that is expired... since 2019 :

My current time is set to the correct date, and here is the output of `gpg -k`:


Please find attached the mail that exposed the bug.
I am using neomutt as a mail reader, in cast that's relevant.


Best,

  nicoo
#907234#10
Date:
2018-08-25 01:54:56 UTC
From:
To:
So that would be one entry for pub 0xDA82830E3CCC3A3A, and the signature
expires on 2019-07-15:
That would be a second entry for pub 0xDA82830E3CCC3A3A, and the
signature expires on 2020-07-14:

Now the subkeys, that all expire on 2020-07-14
It looks like the signature should be accepted and that there should not
be two entries for 0xDA82830E3CCC3A3A, as they are the same key. Am I
missing something?

Did you attach it? It does not appear on the bug page.
#907234#15
Date:
2018-08-25 01:59:12 UTC
From:
To:
 - https://lists.gnupg.org/pipermail/gnupg-users/2004-January/021284.html

[[

No, if you have a keyring with a duplicate key, the merge happens on
import.  Since the keys are already there, the way to fix it is:

* export both keys to a file
* delete the keys on the keyring.
* import the keys again.  They will be merged.

Make a backup first, just in case

]]

Cheers,
#907234#20
Date:
2018-08-26 19:36:09 UTC
From:
To:
Hi Alexandre,

Thanks for finding this mail on gnupg-users; it was indeed that my public
keyring didn't have your updated key (with the new subkey expiration).

The second entry was from /usr/share/keyrings/debian-keyring.gpg, which was
more up-to-date.


Best,

  nicoo