Arch Linux

erincerys

Member

Registered: 2021-01-12

Posts: 6

Can't import public GPG key

Hi,

I've ran into this issue before but I don't remember how I solved it. Installing from AUR fails to verify PGP key, but not for the typical novice reason...

When I do `gpg --search-keys` or `--recv-keys`, I get back that the key was processed, but not imported:

$ gpg --search-keys AB9942E6D4A4CFC3412620A749FC7012A5DE03AE
gpg: enabled debug flags: memstat
gpg: data source: https://keys.openpgp.org:443
(1)       4096 bit RSA key 49FC7012A5DE03AE, created: 2011-01-15
Keys 1-1 of 1 for "AB9942E6D4A4CFC3412620A749FC7012A5DE03AE".  Enter number(s), N)ext, or Q)uit > 1
gpg: data source: https://keys.openpgp.org:443
gpg: pub  rsa4096/49FC7012A5DE03AE 2011-01-15  
gpg: key 49FC7012A5DE03AE: no user ID
gpg: Total number processed: 1
gpg: keydb: handles=0 locks=0 parse=0 get=0
gpg:        build=0 update=0 insert=0 delete=0
gpg:        reset=0 found=0 not=0 cache=0 not=0
gpg: kid_not_found_cache: count=0 peak=0 flushes=0
gpg: sig_cache: total=0 cached=0 good=0 bad=0
gpg: random usage: poolsize=600 mixed=0 polls=0/0 added=0/0
              outmix=0 getlvl1=0/0 getlvl2=0/0
gpg: rndjent stat: collector=0x0000000000000000 calls=0 bytes=0
gpg: secmem usage: 0/32768 bytes in 0 blocks

Same for if I attempt a manual verification of the package asset:

erin at chandra in ~/.cache/pikaur/build/wireguard-dkms
$ gpg --verify wireguard-linux-compat-1.0.20210424.tar.asc wireguard-linux-compat-1.0.20210424.tar.xz 
gpg: enabled debug flags: memstat
gpg: Signature made Sat 24 Apr 2021 01:49:45 PM PDT
gpg:                using RSA key AB9942E6D4A4CFC3412620A749FC7012A5DE03AE
gpg:                issuer "jason@zx2c4.com"
gpg: WARNING: unacceptable HTTP redirect from server was cleaned up
gpg: (further info: changed from 'https://zx2c4.com/.well-known/openpgpkey/hu/pdngwadrk71d7kh1yw6babkzjk71p6db?l=jason' to 'https://www.zx2c4.com/.well-known/openpgpkey/hu/pdngwadrk71d7kh1yw6babkzjk71p6db?l=jason')
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0
gpg: requesting key 49FC7012A5DE03AE from hkps server keys.openpgp.org
gpg: data source: https://keys.openpgp.org:443
gpg: pub  rsa4096/49FC7012A5DE03AE 2011-01-15  
gpg: key 49FC7012A5DE03AE: no user ID
gpg: Total number processed: 1
gpg: Can't check signature: No public key
gpg: keydb: handles=3 locks=0 parse=0 get=0
gpg:        build=0 update=0 insert=0 delete=0
gpg:        reset=3 found=0 not=4 cache=0 not=2
gpg: kid_not_found_cache: count=1 peak=0 flushes=0
gpg: sig_cache: total=0 cached=0 good=0 bad=0
gpg: random usage: poolsize=600 mixed=0 polls=0/0 added=0/0
              outmix=0 getlvl1=0/0 getlvl2=0/0
gpg: rndjent stat: collector=0x0000000000000000 calls=0 bytes=0
gpg: secmem usage: 0/32768 bytes in 0 blocks

Clearly `dirmngr` is running and functioning, as the key is successfully retrieved. It just can't be imported. Yet `gpg` isn't providing a clear reason for that as far as I can tell.

The key isn't expired, but I'd imagine that wouldn't necessarily be the problem anyway:

$ gpg ~/gpg-keys/AB9942E6D4A4CFC3412620A749FC7012A5DE03AE.asc 
gpg: enabled debug flags: memstat
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
gpg: keydb: handles=0 locks=0 parse=0 get=0
gpg:        build=0 update=0 insert=0 delete=0
gpg:        reset=0 found=0 not=0 cache=0 not=0
gpg: kid_not_found_cache: count=0 peak=0 flushes=0
gpg: sig_cache: total=5 cached=0 good=0 bad=0
gpg: random usage: poolsize=600 mixed=0 polls=0/0 added=0/0
              outmix=0 getlvl1=0/0 getlvl2=0/0
gpg: rndjent stat: collector=0x0000000000000000 calls=0 bytes=0
gpg: secmem usage: 0/32768 bytes in 0 blocks
pub   rsa4096 2011-01-15 [SCEA]
      AB9942E6D4A4CFC3412620A749FC7012A5DE03AE
sub   rsa4096 2011-01-15 [E] [expires: 2022-02-11]
sig        49FC7012A5DE03AE 2021-02-11   [keybind]
sig        49FC7012A5DE03AE 2018-02-03   [keybind]
sig        49FC7012A5DE03AE 2017-02-10   [keybind]
sig        49FC7012A5DE03AE 2015-03-18   [keybind]
sig        49FC7012A5DE03AE 2011-01-15   [keybind]

Permissions for `~/.gnupg`:

erin at chandra in ~/.cache/pikaur/build/wireguard-dkms
$ ls -la ~/.gnupg/
total 2188
drwx------   5 erin erin    4096 May 28 13:02 .
drwx------ 100 erin erin    4096 May 28 13:01 ..
drwx------   2 erin erin    4096 Feb 10 12:51 crls.d
-rw-r--r--   1 erin erin     337 Feb 26 08:00 dirmngr.conf
-rw-r--r--   1 erin erin     272 Feb 10 12:59 dirmngr.conf.gpgconf.bak
-rw-r--r--   1 erin erin     303 Feb 26 08:00 gpg-agent.conf
-rw-r--r--   1 erin erin     724 Feb 26 08:00 gpg.conf
-rw-r--r--   1 erin erin     659 Feb 22 07:37 gpg.conf.gpgconf.bak
-rw-r--r--   1 erin erin     303 Feb 26 08:00 gpgsm.conf
-rw-r--r--   1 erin erin     238 Feb 10 12:59 gpgsm.conf.gpgconf.bak
srwxr-xr-x   1 erin erin       0 Feb 26 08:00 log-socket
drwx------   2 erin erin    4096 Mar  4 10:39 openpgp-revocs.d
drwx------   2 erin erin    4096 Mar 16 08:22 private-keys-v1.d
-rw-r--r--   1 erin erin 1085548 Apr 24 15:45 pubring.kbx
-rw-r--r--   1 erin erin 1081487 Mar 20 18:03 pubring.kbx~
-rw-r--r--   1 erin erin       7 May 28 12:41 reader_0.status
-rw-r--r--   1 erin erin     303 Feb 26 08:00 scdaemon.conf
-rw-r-----   1 erin erin     676 Feb 22 18:14 sshcontrol
srwxr-xr-x   1 erin erin       0 May 28 12:41 S.uiserver
-rw-------   1 erin erin    1600 Mar 16 08:22 trustdb.gpg

`gpg.conf` contents:

$ cat ~/.gnupg/gpg.conf
###+++--- GPGConf ---+++###
utf8-strings
verbose
#debug-level guru
keyserver hkps://keys.openpgp.org
auto-key-retrieve
debug-level basic
log-file socket:///home/erin/.gnupg/log-socket

`pubring.kbx` seems fine. Moving it out, and trying to import again created a new one, but was still unsuccessful.

Any ideas?

loqs

Member

Registered: 2014-03-06

Posts: 19,010

Re: Can't import public GPG key

gpg: data source: https://keys.openpgp.org:443
...
gpg: key 49FC7012A5DE03AE: no user ID

If an ID has not been verified on https://keys.openpgp.org/ it will not have an email address attached and gpg will not be able to import it.

erincerys

Member

Registered: 2021-01-12

Posts: 6

Re: Can't import public GPG key

Is that so? The package maintainer seems to think it works fine. Package was last updated 5/14, and they commented back to someone saying as much on 5/20. Perhaps they are mistaken, though I'm not sure how they verified their build correctly if that's the case.

loqs

Member

Registered: 2014-03-06

Posts: 19,010

Re: Can't import public GPG key

gpg --search-keys AB9942E6D4A4CFC3412620A749FC7012A5DE03AE
gpg: data source: https://162.213.33.8:443
(1)	Jason A. Donenfeld <Jason@zx2c4.com>
	  4096 bit RSA key 49FC7012A5DE03AE, created: 2011-01-15
Keys 1-1 of 1 for "AB9942E6D4A4CFC3412620A749FC7012A5DE03AE".  Enter number(s), N)ext, or Q)uit > 

By using a keyserver that does not have that restriction. e.g. keyserver hkps://keyserver.ubuntu.com or keyserver hkp://pool.sks-keyservers.net
Edit:
You are aware all the current repo kernels do not require wireguard-dkms?

Last edited by loqs (2021-05-28 21:06:30)

erincerys

Member

Registered: 2021-01-12

Posts: 6

Re: Can't import public GPG key

The error occurred even when downloading the key manually from the keyserver and trying to import it.

I did realise that this module is useless though... nothing I have installed requires this package anymore, and yeah, it's baked into the kernel now. I ended up just uninstalling it :^)

Thanks for the quick responses anyway!

loqs

Member

Registered: 2014-03-06

Posts: 19,010

Re: Can't import public GPG key

Did you download the key from https://keys.openpgp.org which would supply you with a key with no userID or from a server that supplies userIDs for all keys?

erincerys

Member

Registered: 2021-01-12

Posts: 6

Re: Can't import public GPG key

I did download it via browser from keys.openpgp.org. However it doesn't appear true that this keyserver exclusively supplies all keys without user IDs.

For example, this key has one:

erin at chandra in ~/pkg/dogecash-5.2.4-patches
$ gpg ~/gpg-keys/65ED513993F08DA06F9639A6F13F9E16BCA5BFAD.asc 
gpg: enabled debug flags: memstat
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
gpg: Note: signature key F13F9E16BCA5BFAD expired Mon 19 Apr 2021 10:18:56 AM PDT
gpg: keydb: handles=0 locks=0 parse=0 get=0
gpg:        build=0 update=0 insert=0 delete=0
gpg:        reset=0 found=0 not=0 cache=0 not=0
gpg: kid_not_found_cache: count=0 peak=0 flushes=0
gpg: sig_cache: total=2 cached=0 good=0 bad=0
gpg: random usage: poolsize=600 mixed=0 polls=0/0 added=0/0
              outmix=0 getlvl1=0/0 getlvl2=0/0
gpg: rndjent stat: collector=0x0000000000000000 calls=0 bytes=0
gpg: secmem usage: 0/32768 bytes in 0 blocks
pub   rsa4096 2017-04-19 [SC] [expired: 2021-04-19]
      65ED513993F08DA06F9639A6F13F9E16BCA5BFAD
uid           Talos (Talos, Cisco Systems Inc.) <research@sourcefire.com>
sig        F13F9E16BCA5BFAD 2017-04-19   [selfsig]
sub   rsa4096 2017-04-19 [E] [expired: 2021-04-19]
sig        F13F9E16BCA5BFAD 2017-04-19   [keybind]

You're correct in the lack of a uid is the blocker to import though! I can import that one...

Regardless, MIT, ubuntu nor sks-keyservers has the `wireguard-dkms` developer's key.

Last edited by erincerys (2021-05-28 22:25:49)

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,483

Re: Can't import public GPG key

Searching key or UID (mail commented in the PKGBUILD) on hkps.pool.sks-keyservers.net shows the key expired 2021-02-02 and there seems no valid key for that UID.
hkps://keyserver.ubuntu.com still has it and  https://keys.openpgp.org has it w/o UID.

it doesn't appear true that this keyserver exclusively supplies all keys without user IDs.

It's not.

If an ID has not been verified on https://keys.openpgp.org/ it will not have an email address attached and gpg will not be able to import it.

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc