security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

dirmngr: Do not store the useless pgpSignerID in the LDAP.

Browse source 
* dirmngr/ks-engine-ldap.c (extract_attributes): Do not store the
pgpSignerID.
* g10/call-dirmngr.c (ks_put_inq_cb): Do not emit sig records.
--

The pgpSignerID has no use in the LDAP and thus don't store it.
David's idea back in 2004 was
              /* This bit is really for the benefit of people who
                 store their keys in LDAP servers.  It makes it easy
                 to do queries for things like "all keys signed by
                 Isabella".  */
See-commit: 3ddd4410ae

I consider this dangerous because such a query is not able to validate
the signature, does not get revocation signatures, and also has no
information about the validity of the signatures.  Further many keys
are spammed tehse days with faked signatures and it does not make
sense to blow up the LDAP with such garbage.

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2020-12-14 15:18:01 +01:00
parent e47de85382
commit 0e88c73bc9
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
4 changed files with 5 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

4
dirmngr/ks-engine-ldap.c
View file

@ -1739,9 +1739,6 @@ extract_attributes (LDAPMod ***modlist, char *line)
if (is_sub)
modlist_add (modlist, "pgpSubKeyID", keyid);
if (is_sig)
modlist_add (modlist, "pgpSignerID", keyid);
}
if (is_pub)
@ -1969,7 +1966,6 @@ ks_ldap_put (ctrl_t ctrl, parsed_uri_t uri,
modlist_add (&modlist, "pgpKeyType", NULL);
modlist_add (&modlist, "pgpUserID", NULL);
modlist_add (&modlist, "pgpKeyCreateTime", NULL);
modlist_add (&modlist, "pgpSignerID", NULL);
modlist_add (&modlist, "pgpRevoked", NULL);
modlist_add (&modlist, "pgpSubKeyID", NULL);
modlist_add (&modlist, "pgpKeySize", NULL);