From 263a07f04d138d9c1398568642f3a8e9e3d8fea0 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Sun, 30 Jun 2019 11:54:35 -0400 Subject: [PATCH] dirmngr: Only use SKS pool CA for SKS pool * dirmngr/http.c (http_session_new): when checking whether the keyserver is the HKPS pool, check specifically against the pool name, as ./configure might have been used to select a different default keyserver. It makes no sense to apply Kristian's certificate authority to anything other than the literal host hkps.pool.sks-keyservers.net. Signed-off-by: Daniel Kahn Gillmor Gbp-Pq: Name dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch --- dirmngr/http.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dirmngr/http.c b/dirmngr/http.c index d2456c6dc..2643a2b56 100644 --- a/dirmngr/http.c +++ b/dirmngr/http.c @@ -767,7 +767,7 @@ http_session_new (http_session_t *r_session, is_hkps_pool = (intended_hostname && !ascii_strcasecmp (intended_hostname, - get_default_keyserver (1))); + "hkps.pool.sks-keyservers.net")); /* If the user has not specified a CA list, and they are looking * for the hkps pool from sks-keyservers.net, then default to