From a594aa3856f3e4652552566cfc47240402ea1dd8 Mon Sep 17 00:00:00 2001 From: Christoph Reiter Date: Sat, 26 Jun 2021 15:42:19 +0200 Subject: [PATCH] gnupg: Switch the default keyserver to keyserver.ubuntu.com pool.sks-keyservers.net no longer exists, which makes pacman-key fail etc. Patches are taken from https://salsa.debian.org/debian/gnupg2/-/tree/debian/main/debian/patches --- ...ys2.patch => 0001-gnupg-2.2.8-msys2.patch} | 0 ...gr-Only-use-SKS-pool-CA-for-SKS-pool.patch | 29 +++++++++++++++++++ ....ubuntu.com-as-the-default-keyserver.patch | 29 +++++++++++++++++++ gnupg/PKGBUILD | 15 ++++++++-- 4 files changed, 70 insertions(+), 3 deletions(-) rename gnupg/{gnupg-2.2.8-msys2.patch => 0001-gnupg-2.2.8-msys2.patch} (100%) create mode 100644 gnupg/0002-dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch create mode 100644 gnupg/0003-Use-keyserver.ubuntu.com-as-the-default-keyserver.patch diff --git a/gnupg/gnupg-2.2.8-msys2.patch b/gnupg/0001-gnupg-2.2.8-msys2.patch similarity index 100% rename from gnupg/gnupg-2.2.8-msys2.patch rename to gnupg/0001-gnupg-2.2.8-msys2.patch diff --git a/gnupg/0002-dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch b/gnupg/0002-dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch new file mode 100644 index 00000000..5710aa10 --- /dev/null +++ b/gnupg/0002-dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch @@ -0,0 +1,29 @@ +From: Daniel Kahn Gillmor +Date: Sun, 30 Jun 2019 11:54:35 -0400 +Subject: dirmngr: Only use SKS pool CA for SKS pool + +* dirmngr/http.c (http_session_new): when checking whether the +keyserver is the HKPS pool, check specifically against the pool name, +as ./configure might have been used to select a different default +keyserver. It makes no sense to apply Kristian's certificate +authority to anything other than the literal host +hkps.pool.sks-keyservers.net. + +Signed-off-by: Daniel Kahn Gillmor +--- + dirmngr/http.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/dirmngr/http.c b/dirmngr/http.c +index 5e3f17c..40160e0 100644 +--- a/dirmngr/http.c ++++ b/dirmngr/http.c +@@ -768,7 +768,7 @@ http_session_new (http_session_t *r_session, + + is_hkps_pool = (intended_hostname + && !ascii_strcasecmp (intended_hostname, +- get_default_keyserver (1))); ++ "hkps.pool.sks-keyservers.net")); + + /* If we are looking for the hkps pool from sks-keyservers.net, + * then forcefully use its dedicated certificate authority. */ \ No newline at end of file diff --git a/gnupg/0003-Use-keyserver.ubuntu.com-as-the-default-keyserver.patch b/gnupg/0003-Use-keyserver.ubuntu.com-as-the-default-keyserver.patch new file mode 100644 index 00000000..49731022 --- /dev/null +++ b/gnupg/0003-Use-keyserver.ubuntu.com-as-the-default-keyserver.patch @@ -0,0 +1,29 @@ +diff --git a/configure.ac b/configure.ac +index 3752acd..c195efb 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -1979,7 +1979,7 @@ AC_DEFINE_UNQUOTED(TPM2DAEMON_SOCK_NAME, "S.tpm2daemon", + AC_DEFINE_UNQUOTED(DIRMNGR_SOCK_NAME, "S.dirmngr", + [The name of the dirmngr socket]) + AC_DEFINE_UNQUOTED(DIRMNGR_DEFAULT_KEYSERVER, +- "hkps://hkps.pool.sks-keyservers.net", ++ "hkps://keyserver.ubuntu.com", + [The default keyserver for dirmngr to use, if none is explicitly given]) + + AC_DEFINE_UNQUOTED(GPGEXT_GPG, "gpg", [The standard binary file suffix]) +diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi +index 981b48b..00004a4 100644 +--- a/doc/dirmngr.texi ++++ b/doc/dirmngr.texi +@@ -331,7 +331,10 @@ whether Tor is locally running or not. The check for a running Tor is + done for each new connection. + + If no keyserver is explicitly configured, dirmngr will use the +-built-in default of @code{hkps://hkps.pool.sks-keyservers.net}. ++built-in default of @code{hkps://keyserver.ubuntu.com}. ++ ++Note that the above default is a MSYS2-specific choice. Upstream ++GnuPG prefers @code{hkps://hkps.pool.sks-keyservers.net}. + + Windows users with a keyserver running on their Active Directory + should use @code{ldap:///} for @var{name} to access this directory. diff --git a/gnupg/PKGBUILD b/gnupg/PKGBUILD index f4dc218a..ff2cd9bf 100644 --- a/gnupg/PKGBUILD +++ b/gnupg/PKGBUILD @@ -2,7 +2,7 @@ pkgname=gnupg pkgver=2.2.28 -pkgrel=1 +pkgrel=2 pkgdesc='Complete and free implementation of the OpenPGP standard' provides=('dirmngr' "gnupg2=${pkgver}") url='https://gnupg.org/' @@ -46,11 +46,15 @@ depends=('bzip2' 'zlib' ) source=("https://gnupg.org/ftp/gcrypt/${pkgname}/${pkgname}-${pkgver}.tar.bz2"{,.sig} - 'gnupg-2.2.8-msys2.patch' + '0001-gnupg-2.2.8-msys2.patch' + '0002-dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch' + '0003-Use-keyserver.ubuntu.com-as-the-default-keyserver.patch' "c8b2162.patch::https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=patch;h=c8b2162") sha256sums=('6ff891fc7583a9c3fb9f097ee0d1de0a12469d4b53997e7ba5064950637dfaec' 'SKIP' 'cb23f1a61fd213c25e85b6ba8afb190b7da14a8cfa59cc56ce82df941db8c3c9' + '33b6b7c9f71232794326780c55450079147f65f61c8152930b2e51366ca3e843' + '25caf05126b89f76d6849d475e0eb2d50a79ea2771250246b3c1b5daf3284995' '5a4e9dbc453d472eab0d0b450d2ce259038871940461a9feb07b6f0a2032550c') validpgpkeys=('D8692123C4065DEA5E0F3AB5249B39D24F25E3B6' '46CC730865BB5C78EBABADCF04376F3EE0856959' @@ -62,7 +66,12 @@ install=${pkgname}.install prepare() { cd "${srcdir}/${pkgname}-${pkgver}" sed '/noinst_SCRIPTS = gpg-zip/c sbin_SCRIPTS += gpg-zip' -i tools/Makefile.in - patch -p1 -i ${srcdir}/gnupg-2.2.8-msys2.patch + + patch -p1 -i ${srcdir}/0001-gnupg-2.2.8-msys2.patch + + # https://bugs.archlinux.org/task/71078#comment200369 + patch -p1 -i ${srcdir}/0002-dirmngr-Only-use-SKS-pool-CA-for-SKS-pool.patch + patch -p1 -i ${srcdir}/0003-Use-keyserver.ubuntu.com-as-the-default-keyserver.patch # Upstream commit dirmngir: Fix build with --disable-ldap. patch -Np1 -i "${srcdir}/c8b2162.patch"