#977909 gnupg: `--trust-model always` doesn't trust keys

Package:
gnupg
Source:
gnupg2
Submitter:
Ansgar
Date:
2020-12-23 08:48:05 UTC
Severity:
normal
Tags:
#977909#5
Date:
2020-12-22 18:07:58 UTC
From:
To:
Run:

$ gpg --trust-model always \
      --no-default-keyring \
      --keyring /usr/share/keyrings/debian-archive-keyring.gpg \
      --verify /var/lib/apt/lists/deb.debian.org_debian_dists_unstable_InRelease

The output then contains:

| gpg: WARNING: Using untrusted key!

which seems strange given GnuPG was told to trust all keys.  Setting
the option via gpg.conf has the same result.

The output from --status-fd=2 include both "GOODSIG" and "VALIDSIG".

If I try to use python3-gpg to verify the signature, the signatures
returned in `result.signatures` have summary=0, i.e., no valid
signature was reported (does "GPGME_SIGSUM_VALID" mean the same as
VALIDSIG?).

Ansgar
#977909#10
Date:
2020-12-22 18:53:26 UTC
From:
To:
Look here:

  if (opt.trust_model == TM_ALWAYS)
    {
      if (!opt.quiet)
        log_info(_("WARNING: Using untrusted key!\n"));

It is just a warning - use --quiet to silence this warning.

I am not sure what python3-gpg is.


Salam-Shalom,

   Werner
#977909#15
Date:
2020-12-22 21:41:06 UTC
From:
To:
The warning is incorrect as GnuPG was told that the key is trusted.

If you feel there should be a warning please make it something like
"WARNING: GnuPG recommends not using --trust-policy=always" or
"WARNING: Key only trusted due to --trust-policy=always" or something
like this.

The official Python bindings for GPGME.

Ansgar
#977909#20
Date:
2020-12-23 08:44:50 UTC
From:
To:
On Tue, 22 Dec 2020 22:41, Ansgar said:

The warning is there for a reasons and it will not be changed.

Sorry, I did not knew Debian's package name for the GPGME binding.
Anyway, if you think that is a bug in the python binding, please file a
bug a dev.gnupg.org (tag as gpgme and python)


Shalom-Salam,

   Werner