Merge pull request #2563 from lazka/gnupg-default-keyserver-ubuntu

gnupg: Switch the default keyserver to keyserver.ubuntu.com

gnupg/0002-dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch

@@ -0,0 +1,29 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Sun, 30 Jun 2019 11:54:35 -0400
+Subject: dirmngr: Only use SKS pool CA for SKS pool
+
+* dirmngr/http.c (http_session_new): when checking whether the
+keyserver is the HKPS pool, check specifically against the pool name,
+as ./configure might have been used to select a different default
+keyserver.  It makes no sense to apply Kristian's certificate
+authority to anything other than the literal host
+hkps.pool.sks-keyservers.net.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ dirmngr/http.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/dirmngr/http.c b/dirmngr/http.c
+index 5e3f17c..40160e0 100644
+--- a/dirmngr/http.c
++++ b/dirmngr/http.c
+@@ -768,7 +768,7 @@ http_session_new (http_session_t *r_session,
+ 
+     is_hkps_pool = (intended_hostname
+                     && !ascii_strcasecmp (intended_hostname,
+-                                          get_default_keyserver (1)));
++                                          "hkps.pool.sks-keyservers.net"));
+ 
+     /* If we are looking for the hkps pool from sks-keyservers.net,
+      * then forcefully use its dedicated certificate authority.  */

gnupg/0003-Use-keyserver.ubuntu.com-as-the-default-keyserver.patch

@@ -0,0 +1,29 @@
+diff --git a/configure.ac b/configure.ac
+index 3752acd..c195efb 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1979,7 +1979,7 @@ AC_DEFINE_UNQUOTED(TPM2DAEMON_SOCK_NAME, "S.tpm2daemon",
+ AC_DEFINE_UNQUOTED(DIRMNGR_SOCK_NAME, "S.dirmngr",
+                    [The name of the dirmngr socket])
+ AC_DEFINE_UNQUOTED(DIRMNGR_DEFAULT_KEYSERVER,
+-                   "hkps://hkps.pool.sks-keyservers.net",
++                   "hkps://keyserver.ubuntu.com",
+       [The default keyserver for dirmngr to use, if none is explicitly given])
+ 
+ AC_DEFINE_UNQUOTED(GPGEXT_GPG, "gpg", [The standard binary file suffix])
+diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
+index 981b48b..00004a4 100644
+--- a/doc/dirmngr.texi
++++ b/doc/dirmngr.texi
+@@ -331,7 +331,10 @@ whether Tor is locally running or not.  The check for a running Tor is
+ done for each new connection.
+ 
+ If no keyserver is explicitly configured, dirmngr will use the
+-built-in default of @code{hkps://hkps.pool.sks-keyservers.net}.
++built-in default of @code{hkps://keyserver.ubuntu.com}.
++
++Note that the above default is a MSYS2-specific choice.  Upstream
++GnuPG prefers @code{hkps://hkps.pool.sks-keyservers.net}.
+ 
+ Windows users with a keyserver running on their Active Directory
+ should use @code{ldap:///} for @var{name} to access this directory.

gnupg/PKGBUILD

@@ -2,7 +2,7 @@
 
 pkgname=gnupg
 pkgver=2.2.28
-pkgrel=1
+pkgrel=2
 pkgdesc='Complete and free implementation of the OpenPGP standard'
 provides=('dirmngr' "gnupg2=${pkgver}")
 url='https://gnupg.org/'
@@ -46,11 +46,15 @@ depends=('bzip2'
          'zlib'
         )
 source=("https://gnupg.org/ftp/gcrypt/${pkgname}/${pkgname}-${pkgver}.tar.bz2"{,.sig}
-        'gnupg-2.2.8-msys2.patch'
+        '0001-gnupg-2.2.8-msys2.patch'
+        '0002-dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch'
+        '0003-Use-keyserver.ubuntu.com-as-the-default-keyserver.patch'
         "c8b2162.patch::https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=patch;h=c8b2162")
 sha256sums=('6ff891fc7583a9c3fb9f097ee0d1de0a12469d4b53997e7ba5064950637dfaec'
             'SKIP'
             'cb23f1a61fd213c25e85b6ba8afb190b7da14a8cfa59cc56ce82df941db8c3c9'
+            '33b6b7c9f71232794326780c55450079147f65f61c8152930b2e51366ca3e843'
+            '25caf05126b89f76d6849d475e0eb2d50a79ea2771250246b3c1b5daf3284995'
             '5a4e9dbc453d472eab0d0b450d2ce259038871940461a9feb07b6f0a2032550c')
 validpgpkeys=('D8692123C4065DEA5E0F3AB5249B39D24F25E3B6'
               '46CC730865BB5C78EBABADCF04376F3EE0856959'
@@ -62,7 +66,12 @@ install=${pkgname}.install
 prepare() {
   cd "${srcdir}/${pkgname}-${pkgver}"
   sed '/noinst_SCRIPTS = gpg-zip/c sbin_SCRIPTS += gpg-zip' -i tools/Makefile.in
-  patch -p1 -i ${srcdir}/gnupg-2.2.8-msys2.patch
+
+  patch -p1 -i ${srcdir}/0001-gnupg-2.2.8-msys2.patch
+
+  # https://bugs.archlinux.org/task/71078#comment200369
+  patch -p1 -i ${srcdir}/0002-dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch
+  patch -p1 -i ${srcdir}/0003-Use-keyserver.ubuntu.com-as-the-default-keyserver.patch
 
   # Upstream commit dirmngir: Fix build with --disable-ldap.
   patch -Np1 -i "${srcdir}/c8b2162.patch"