52 lines
2.2 KiB
Diff
52 lines
2.2 KiB
Diff
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
|
|
Date: Mon, 15 Jul 2019 16:24:35 -0400
|
|
Subject: gpg: drop import-clean from default keyserver import options
|
|
|
|
* g10/gpg.c (main): drop IMPORT_CLEAN from the
|
|
default opt.keyserver_options.import_options
|
|
* doc/gpg.texi: reflect this change in the documentation
|
|
|
|
Given that SELF_SIGS_ONLY is already set, it's not clear what
|
|
additional benefit IMPORT_CLEAN provides. Furthermore, IMPORT_CLEAN
|
|
means that receiving an OpenPGP certificate from a keyserver will
|
|
potentially delete data that is otherwise held in the local keyring,
|
|
which is surprising to users who expect retrieval from the keyservers
|
|
to be purely additive.
|
|
|
|
GnuPG-Bug-Id: 4628
|
|
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
|
|
---
|
|
doc/gpg.texi | 2 +-
|
|
g10/gpg.c | 3 +--
|
|
2 files changed, 2 insertions(+), 3 deletions(-)
|
|
|
|
Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/gpg-drop-import-clean-from-default-keyserver-import-optio.patch
|
|
|
|
diff --git a/doc/gpg.texi b/doc/gpg.texi
|
|
index 804ecf9..b238278 100644
|
|
--- a/doc/gpg.texi
|
|
+++ b/doc/gpg.texi
|
|
@@ -2047,7 +2047,7 @@ are available for all keyserver types, some common options are:
|
|
|
|
@end table
|
|
|
|
-The default list of options is: "self-sigs-only, import-clean,
|
|
+The default list of options is: "self-sigs-only,
|
|
repair-keys, repair-pks-subkey-bug, export-attributes". However, if
|
|
the actual used source is an LDAP server "no-self-sigs-only" is
|
|
assumed unless "self-sigs-only" has been explicitly configured.
|
|
diff --git a/g10/gpg.c b/g10/gpg.c
|
|
index 68c0454..205de60 100644
|
|
--- a/g10/gpg.c
|
|
+++ b/g10/gpg.c
|
|
@@ -2441,8 +2441,7 @@ main (int argc, char **argv)
|
|
| IMPORT_REPAIR_PKS_SUBKEY_BUG
|
|
| IMPORT_SELF_SIGS_ONLY
|
|
| IMPORT_COLLAPSE_UIDS
|
|
- | IMPORT_COLLAPSE_SUBKEYS
|
|
- | IMPORT_CLEAN);
|
|
+ | IMPORT_COLLAPSE_SUBKEYS);
|
|
opt.keyserver_options.export_options = EXPORT_ATTRIBUTES;
|
|
opt.keyserver_options.options = 0;
|
|
opt.verify_options = (LIST_SHOW_UID_VALIDITY
|