x/crypto/openpgp: E-mail address is not detected and misplaced into the name field

[ghost]

What version of Go are you using (go version)?

The Go Playground say's it's the latest stable so 1.14.3

Does this issue reproduce with the latest release?

Yes, it does.

What operating system and processor architecture are you using (go env)?

Irrelevant, reproduceable on the playground

What did you do?

When generating a key with GnuPG if you skip the "Real name" by hitting enter it leaves just the email address without angled brackets.
A very big screenshot

What the library sees:

• With only email UID
• With second UID that has a name

As GitHub uses this library to parse e-mail addresses from the key it did not detect my e-mail address. You can verify this by adding a key like this one to your GitHub account. (Screenshot provided.) I opened a ticket and I was made aware that GitHub uses this library, so I headed here to open this issue.

As a consequence of that, the commits I sign don't appear with the "Verified" badge.

As most people use GnuPG to generate their keys some might be in this form. I think it is a good idea to try and detect this pattern and not necessarily require angle brackets.

What did you expect to see?

id: yesplease <no@thanks>     name:yesplease       mail:no@thanks      
id: yes@please                name:                mail:yes@please

What did you see instead?

id: yesplease <no@thanks>     name:yesplease       mail:no@thanks      
id: yes@please                name:yes@please      mail:            

(Now that I think of it, this might be a bad example as it misses the TLD e.g. please.com but it wouldn't recognize it as email either way)

[cagedmantis]

/cc @FiloSottile

[ghost]

Whoops miss click sorry

[FiloSottile]

Per the accepted #44226 proposal and due to lack of maintenance, the golang.org/x/crypto/openpgp package is now frozen and deprecated. No new changes will be accepted except for security fixes. The package will not be removed.

If this is a security issue, please email security@golang.org and we will assess it and provide a fix.

If you're looking for alternatives, consider the crypto/ed25519 package for simple signatures, golang.org/x/mod/sumdb/note for inline signatures, or filippo.io/age for encryption. You can read a summary of OpenPGP issues and alternatives here.

If you are required to interoperate with OpenPGP systems and need a maintained package, we suggest considering one of multiple community forks of golang.org/x/crypto/openpgp. We don't endorse any specific one.