NetBSD Problem Report #42383

From gson@gson.org  Fri Nov 27 13:06:51 2009
Return-Path: <gson@gson.org>
Received: from mail.netbsd.org (mail.netbsd.org [204.152.190.11])
	by www.NetBSD.org (Postfix) with ESMTP id 335E063B8B4
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 27 Nov 2009 13:06:51 +0000 (UTC)
Message-Id: <20091127130645.C94CF75EA9@guava.gson.org>
Date: Fri, 27 Nov 2009 15:06:45 +0200 (EET)
From: gson@gson.org (Andreas Gustafsson)
Reply-To: gson@gson.org (Andreas Gustafsson)
To: gnats-bugs@gnats.NetBSD.org
Subject: Developer PGP key signing example is wrong for gpg 1.4.9
X-Send-Pr-Version: 3.95

>Number:         42383
>Category:       misc
>Synopsis:       Developer PGP key signing example is wrong for gpg 1.4.9
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    www
>State:          closed
>Class:          doc-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Nov 27 13:10:00 +0000 2009
>Closed-Date:    Thu Jan 05 16:05:03 +0000 2017
>Last-Modified:  Thu Jan 05 16:05:03 +0000 2017
>Originator:     Andreas Gustafsson
>Release:        N/A
>Organization:
>Environment:
System: NetBSD guava.gson.org 5.0.1 NetBSD 5.0.1 (GENERIC) #0: Thu Jul 30 01:39:11 UTC 2009 builds@b8.netbsd.org:/home/builds/ab/netbsd-5-0-1-RELEASE/i386/200907292356Z-obj/home/builds/ab/netbsd-5-0-1-RELEASE/src/sys/arch/i386/compile/GENERIC i386
Architecture: i386
Machine: i386
>Description:

The instructions for signing PGP keys at
http://www.netbsd.org/developers/pgp.html contain the following
example:

  % cat >> moe@doe.org
  Hi Moe,

  please return this message to me. Please sign and encrypt it.

  Thanks,
  Joe
  ^D
  % dd if=/dev/urandom count=1 | md5 >> moe@doe.org
  % gpg --armor --encrypt moe@doe.org > moe@doe.org.asc

When following this example using GnuPG version 1.4.9, two issues
arise:

1. gpg prompts you with

  You did not specify a user ID. (you may use "-r")

  Current recipients:

Would it not make more sense to specify "-r moe@doe.org" on the
command line, thereby eliminating the user interaction, the need
to figure out what to answer, and the risk of answering incorrectly?

2. gpg prompts you with

  File `moe@doe.org.asc' exists. Overwrite? (y/N)

This is because gpg will actually write the encrypted message to the
file "moe@doe.org.asc" and not to standard output; the redirection
"> moe@doe.org.asc" in the example is unnecessary and only has the effect
of creating an empty file which triggers the "Overwrite?"  question
and which will then be overwritten if you answer "y" to the above
question.  Did some earlier version of gpg perhaps require the
redirection?

To fix both issues, I think the last line of the example ought to say

  % gpg --armor --encrypt -r moe@doe.org moe@doe.org

but I'm not comfortable committing the change without review since
this is a security critical procedure and I actually know next to
nothing about PGP.

>How-To-Repeat:

Try to sign a developer's key following the instructions.  Get confused.

>Fix:

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: misc-bug-people->www
Responsible-Changed-By: dholland@NetBSD.org
Responsible-Changed-When: Fri, 04 Jan 2013 00:25:05 +0000
Responsible-Changed-Why:
website issue


From: Ryo ONODERA <ryo_on@yk.rim.or.jp>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: misc/42383 (Developer PGP key signing example is wrong for gpg
 1.4.9)
Date: Sat, 05 Jan 2013 10:02:32 +0900 (JST)

 Is this PR relevant to current web page,
 http://www.netbsd.org/developers/pgp.html ?

 And I cannot find the example in question in reposirory,
 http://cvsweb.netbsd.org/bsdweb.cgi/htdocs/developers/pgp.xml?only_with_tag=MAIN .

From: Andreas Gustafsson <gson@gson.org>
To: gnats-bugs@NetBSD.org
Cc: www@netbsd.org,
    gnats-admin@netbsd.org,
    netbsd-bugs@netbsd.org,
    gson@gson.org (Andreas Gustafsson)
Subject: Re: misc/42383 (Developer PGP key signing example is wrong for gpg
 1.4.9)
Date: Sat, 5 Jan 2013 14:52:34 +0200

 Ryo ONODERA wrote:
 >  Is this PR relevant to current web page,
 >  http://www.netbsd.org/developers/pgp.html ?

 Yes.

 >  And I cannot find the example in question in reposirory,
 >  http://cvsweb.netbsd.org/bsdweb.cgi/htdocs/developers/pgp.xml?only_with_tag=MAIN .

 Try line 424 and onwards of

    http://cvsweb.netbsd.org/bsdweb.cgi/htdocs/developers/pgp.xml?annotate=1.15&only_with_tag=MAIN

 -- 
 Andreas Gustafsson, gson@gson.org

From: Ryo ONODERA <ryo_on@yk.rim.or.jp>
To: gson@gson.org
Cc: gnats-bugs@NetBSD.org, www@NetBSD.org, gnats-admin@NetBSD.org,
 netbsd-bugs@NetBSD.org
Subject: Re: misc/42383 (Developer PGP key signing example is wrong for gpg
 1.4.9)
Date: Sun, 06 Jan 2013 01:21:32 +0900 (JST)

 From: Andreas Gustafsson <gson@gson.org>, Date: Sat, 5 Jan 2013 14:52:34 +0200

 >>  And I cannot find the example in question in reposirory,
 >>  http://cvsweb.netbsd.org/bsdweb.cgi/htdocs/developers/pgp.xml?only_with_tag=MAIN .
 > 
 > Try line 424 and onwards of
 > 
 >    http://cvsweb.netbsd.org/bsdweb.cgi/htdocs/developers/pgp.xml?annotate=1.15&only_with_tag=MAIN

 Thank you.
 I have read your PR by mistake.

State-Changed-From-To: open->feedback
State-Changed-By: darcy@NetBSD.org
State-Changed-When: Thu, 05 Jan 2017 10:04:14 +0000
State-Changed-Why:
I have committed the fix supplied.


From: "D'Arcy J.M. Cain" <darcy@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/42383 CVS commit: htdocs/developers
Date: Thu, 5 Jan 2017 10:00:43 +0000

 Module Name:	htdocs
 Committed By:	darcy
 Date:		Thu Jan  5 10:00:43 UTC 2017

 Modified Files:
 	htdocs/developers: pgp.xml

 Log Message:
 Fix key signing example.
 Fixes PR#42383


 To generate a diff of this commit:
 cvs rdiff -u -r1.17 -r1.18 htdocs/developers/pgp.xml

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: feedback->closed
State-Changed-By: gson@NetBSD.org
State-Changed-When: Thu, 05 Jan 2017 16:05:03 +0000
State-Changed-Why:
LGTM


>Unformatted:

Home	PR Database Search