#964033 /usr/bin/dirmngr: dane key location doesn't validate DNSSEC

Package:
dirmngr
Source:
gnupg2
Description:
GNU privacy guard - network certificate management service
Submitter:
Uwe Kleine-König
Date:
2024-02-17 13:57:05 UTC
Severity:
normal
Tags:
#964033#5
Date:
2020-06-30 19:06:53 UTC
From:
To:
Hello,

	user@host:~$ rm -rf .gnupg/
	user@host:~$ gpg --locate-keys --auto-key-locate clear,dane uwe@kleine-koenig.org
	gpg: directory '/home/test/.gnupg' created
	gpg: keybox '/home/test/.gnupg/pubring.kbx' created
	gpg: /home/test/.gnupg/trustdb.gpg: trustdb created
	gpg: key E2DCDD9132669BD6: public key "Uwe Kleine-König <uwe@kleine-koenig.org>" imported
	gpg: Total number processed: 1
	gpg:               imported: 1
	pub   rsa4096 2010-06-15 [SC] [expires: 2024-06-21]
	      0D2511F322BFAB1C1580266BE2DCDD9132669BD6
	uid           [ unknown] Uwe Kleine-König <uwe@kleine-koenig.org>
	sub   rsa2048 2015-01-11 [S] [expires: 2022-01-09]
	sub   rsa2048 2015-01-11 [E] [expires: 2022-01-09]
	sub   rsa2048 2015-01-11 [A] [expires: 2022-01-09]

My expectation is that a key retrieval method called "dane" verifies
DNSSEC, but that is not the case here. See
https://dnsviz.net/d/kleine-koenig.org/dnssec/, the zone has a key, but
it is not anchored in .org.

According to
https://tools.ietf.org/html/draft-ietf-dane-openpgpkey-05#section-5 "The
lookup result MUST pass DNSSEC validation". (Thanks to Jakub Wilk for
finding the relevant documentation.)

Best regards
Uwe
#964033#16
Date:
2024-02-17 13:52:08 UTC
From:
To:
This has been closed upstream as "Wontfix".