lib/Horde/Crypt/Pgp.php: Shorten long PGP key IDs to 16 digits (inste… #6
Conversation
…ad of deprecated 8 digits). Newer keyserver implementations return a "400 Bad Request" error if 8-digit-key-IDs are queried (e.g. keys.openpgp.org).
|
Please make returning 16 instead of 8 characters a choice by parameter to that method, defaulting to the old behaviour, and only using 16 when querying the keyserver. |
|
Urgh, we could do this, but why? All modern GPGs since at least five years reject processing of 8-digit GPG short forms of the fingerprint. Several years ago, some university researchers iirc from the Netherlands showed that it is easy/possible to create GPG keys matching the last 8-digit of well-known fingerprints (they scanned the web-of-trust, took keys with many signatures and tried to create keys with similar looking fingerprints). They did that with several GPG keys belonging to Debian developers. Since then, 8-digit shortforms for fingerprints are really outdated and are not supported anymore. Please adjust the patch if needed, I don't have time for it atm. (and don't see the point in it, honestly). |
|
Good point, even though it's debateable whether this is an API break. |
It definitely is an API breakage, but the whole thing broke world-wide. And: thanks for looking into these PRs and maintaining Horde. I will try to do my best to keep Horde in Debian although its PHP 8.2 support is very bad currently (and next Debian stable aka bookworm will ship PHP 8.2). |
|
We are working on full PHP 8.x support too now |
Please take a look at the patches in the packaging repos [1] then. I did php unit test 8.x/9.x fixes already for Debian 11. With PHP 8.x I am not there, yet. I will mail you / the mailing list directly for better coordination of efforts (because this is OT here). [1] https://salsa.debian.org/horde-team (each repo as a debian/patches/ folder with many many patches) |
…ad of deprecated 8 digits).
Newer keyserver implementations return a "400 Bad Request" error if
8-digit-key-IDs are queried (e.g. keys.openpgp.org).