diff options
| author | Werner Koch <wk@gnupg.org> | 2020-12-14 15:18:01 +0100 |
|---|---|---|
| committer | Werner Koch <wk@gnupg.org> | 2020-12-14 19:29:49 +0100 |
| commit | cc056eb534c1b8f7d1a90af3b9ecb9d6b2f322fa (patch) | |
| tree | fe95dcd9ff5ae786516005551415ad0086245f56 /dirmngr/ks-action.c | |
| parent | dirmngr: Fix adding keys to an LDAP server. (diff) | |
| download | gnupg2-cc056eb534c1b8f7d1a90af3b9ecb9d6b2f322fa.tar.xz gnupg2-cc056eb534c1b8f7d1a90af3b9ecb9d6b2f322fa.zip | |
dirmngr: Do not store the useless pgpSignerID in the LDAP.
* dirmngr/ks-engine-ldap.c (extract_attributes): Do not store the
pgpSignerID.
* g10/call-dirmngr.c (ks_put_inq_cb): Do not emit sig records.
--
The pgpSignerID has no use in the LDAP and thus don't store it.
David's idea back in 2004 was
/* This bit is really for the benefit of people who
store their keys in LDAP servers. It makes it easy
to do queries for things like "all keys signed by
Isabella". */
See-commit: 3ddd4410aef928827e1c8d4fb02c1ccd3f8eaea5
I consider this dangerous because such a query is not able to validate
the signature, does not get revocation signatures, and also has no
information about the validity of the signatures. Further many keys
are spammed tehse days with faked signatures and it does not make
sense to blow up the LDAP with such garbage.
Signed-off-by: Werner Koch <wk@gnupg.org>
Diffstat (limited to 'dirmngr/ks-action.c')
| -rw-r--r-- | dirmngr/ks-action.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/dirmngr/ks-action.c b/dirmngr/ks-action.c index 3651ca7db..0c547947f 100644 --- a/dirmngr/ks-action.c +++ b/dirmngr/ks-action.c @@ -357,9 +357,9 @@ ks_action_fetch (ctrl_t ctrl, const char *url, estream_t outfp) /* Send an OpenPGP key to all keyservers. The key in {DATA,DATALEN} is expected to be in OpenPGP binary transport format. The metadata in {INFO,INFOLEN} is in colon-separated format (concretely, it is - the output of 'for x in keys sigs; do gpg --list-$x --with-colons - KEYID; done'. This function may modify DATA and INFO. If this is - a problem, then the caller should create a copy. */ + the output of 'gpg --list-keys --with-colons KEYID'). This function + may modify DATA and INFO. If this is a problem, then the caller + should create a copy. */ gpg_error_t ks_action_put (ctrl_t ctrl, uri_item_t keyservers, void *data, size_t datalen, |