Importing public key from keys.openpgp.org fails with "no user ID"

Bug #1844055 reported by Tom Reynolds
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
gnupg2 (Debian)
Fix Released
Unknown
gnupg2 (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

Running (up to date) 18.04 LTS I'm trying to import a public key from the somewhat new but OpenPGP key spamming resistant key server at keys.openpgp.org:

$ curl -s 'https://keys.openpgp.org/vks/v1/by-fingerprint/723E343AC00331F03473E6837BE5A11FA37E8721' | gpg --import
gpg: key 0x7BE5A11FA37E8721: no user ID
gpg: Total number processed: 1
$

This key fails to import (GPG does not report that any keys were imported).

$ gpg --version | head -n2
gpg (GnuPG) 2.2.4
libgcrypt 1.8.1
$

This makes it impossible to use most of the keys stored on the keys.openpgp.org keyserver and forces users (who want / need to use key servers) to instead work with SKS keyservers which do not prevent signature spamming, on a GPG build which lacks fixes against signature spamming. Which puts Ubuntu 18.04 LTS users at great risk of becoming victims of signature spamming, breaking their GPG installations in ways which are difficult to debug.

This issue has been previously discussed and solved in Debian at https://bugs.debian.org/930665

ProblemType: Bug
DistroRelease: Ubuntu 18.04
Package: gnupg 2.2.4-1ubuntu1.2
ProcVersionSignature: Ubuntu 5.0.0-27.28~18.04.1-generic 5.0.21
Uname: Linux 5.0.0-27-generic x86_64
ApportVersion: 2.20.9-0ubuntu7.7
Architecture: amd64
CurrentDesktop: ubuntu:GNOME
Date: Sun Sep 15 16:20:13 2019
SourcePackage: gnupg2
UpgradeStatus: No upgrade log present (probably fresh install)

CVE References

Revision history for this message
Tom Reynolds (tomreyn) wrote :
Revision history for this message
Tom Reynolds (tomreyn) wrote :
Changed in gnupg2 (Debian):
status: Unknown → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in gnupg2 (Ubuntu):
status: New → Confirmed
Revision history for this message
Tom Reynolds (tomreyn) wrote :

See also related bug 1844059.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.