Skip to content

Issue fix: GPGME and the same secret key appearing in multiple public keyrings

Julian Gilbey requested to merge juliangilbey/mutt:multi-keyrings into master

Hello!

I am a Debian maintainer, and my .gnupg/gpg.conf includes the Debian developers public keyring. So when I run gpg to list my secret key, I get this:

$ gpg --list-options show-keyring --list-secret-keys 0x59D03CC92BA0FEAE
Keyring: /home/jdg/.gnupg/pubring.gpg
-------------------------------------
sec#  rsa4096/0x59D03CC92BA0FEAE 2014-10-29 [SC] [expires: 2020-06-23]
      Key fingerprint = 725E 9D6E E56F CAD6 C339  A7F2 59D0 3CC9 2BA0 FEAE
uid                   [ultimate] Julian Gilbey <julian@d-and-j.net>
uid                   [ultimate] Julian Gilbey <jdg@debian.org>
uid                   [ultimate] Julian Gilbey <J.Gilbey@maths.cam.ac.uk>
uid                   [ultimate] Julian Gilbey <jdg18@cam.ac.uk>
ssb   rsa4096/0x14A58BD97483A28B 2014-10-29 [E] [expires: 2020-06-23]
ssb   rsa4096/0x695C429316C07BFE 2014-10-29 [S] [expires: 2020-06-23]

Keyring: /usr/share/keyrings/debian-keyring.gpg
-----------------------------------------------
sec#  rsa4096/0x59D03CC92BA0FEAE 2014-10-29 [SC] [expires: 2020-06-23]
      Key fingerprint = 725E 9D6E E56F CAD6 C339  A7F2 59D0 3CC9 2BA0 FEAE
uid                   [ultimate] Julian Gilbey <julian@d-and-j.net>
uid                   [ultimate] Julian Gilbey <jdg@debian.org>
uid                   [ultimate] Julian Gilbey <jdg18@cam.ac.uk>
uid                   [ultimate] Julian Gilbey <J.Gilbey@maths.cam.ac.uk>
ssb   rsa4096/0x14A58BD97483A28B 2014-10-29 [E] [expires: 2020-06-23]
ssb   rsa4096/0x695C429316C07BFE 2014-10-29 [S] [expires: 2020-06-23]

As a consequence, GPGME says that my key fingerprint is associated with two keys, and mutt bombs out when trying to sign with this key, with the message: "ambiguous specification of secret key...".

I have tracked down the source of this bug: it is because crypt-gpgme.c assumes that if two keys are returned, they are distinct keys. This merge request fixes this issue by comparing the key fingerprints if multiple keys are found, and only exiting with the "ambiguous specification" error if keys with distinct fingerprints are found.

Merge request reports