|
Bugzilla – Full Text Bug Listing |
| Summary: | interactive help is not context oriented. | ||
|---|---|---|---|
| Product: | [openSUSE] SUSE LINUX 10.0 | Reporter: | Olli Artemjev <grey-olli> |
| Component: | Other | Assignee: | Klaus Singvogel <kssingvo> |
| Status: | RESOLVED INVALID | QA Contact: | E-mail List <qa-bugs> |
| Severity: | Enhancement | ||
| Priority: | P5 - None | CC: | grey-olli |
| Version: | Final | Keywords: | documentation, security, UI |
| Target Milestone: | --- | ||
| Hardware: | i686 | ||
| OS: | SuSE Linux 10.0 | ||
| Whiteboard: | |||
| Found By: | Customer | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
Also adding 153565 to dependences, since s2k mode is also noted here. Regarding: 1. I see no contradiction between the manual and how the things happen. You (as not owner of the expired) can _sign_ an expired key (of a friend), but you cannot use an expired key to sign documents. This is the crucial point here. You must change the expiration date of your key to use it again (as you did later). ==> INVALID 2. The same here: you try to skip the verification of the _signatures_ of your secret key. But later you try to use your expired key to do things. The "--skip-verify" only skips the verification part, but never disables the check, if your key is still valid (is used within its lifetime). I think you mixed here things. ==> INVALID. 3. The default is to work on the database of your public keys (not the database of your secret keys). Therefore the toggle is the only and correct help. ==> INVALID I'm sorry to say, but all your thoughts are different from the way how they really works. Closing the whole bug with INVALID. Klaus forgot to close this. Okay, sending manual (man 1 gpg) changes suggestions to one of list members and to Klaus (in CC). Hopefully that'll be on the mailing list ('ve no access due to strict reverse dns checks on sending to the list).
Agree w/ 1,2 - thanks for corrections!
3. The help is printed after typing 'help' or '?' and contains 'prefs'
in the list of help topics. Though 'prefs' are not usable unless toggle is used.
By context help I mean showing only the reference to usable within the current mode commands.
Thus reopening and changing severity to 'Enhancement' and setting priority to 'None', since that is generally the lowest possible priority. %)
Thanks for resolving issues!
PS: Feel free to close the bug now - the manual page suggestions are moving to
the gnupg related mailing list (hopefully) and the context help (as I mean it) is not a very important thing to do.
Olli: Klaus didn't receive a mail about this but I informed him. Regarding 3.: sorry, didn't notice that this is your real problem. You don't have any "prefs" stored within the keys which are in your _secret_ keyring. The commands for working on both keyrings are the same, and the online help lists only the available commands. I don't think this is bug, as a result is returned (...use toggle... :). Sure it's not a very handsome result, but it is at least some. :) At the moment, I don't see any chance to fix this, as it is a major effort to do a split here. Please ask the gnupg mailing list, wben it is a necessity for you. Thanks for understanding. |
from man 1 gpg: ===================cut==================== --expert --no-expert Allow the user to do certain nonsensical or "silly" things like signing an expired or revoked key, or certain potentially incompatible things like generating unusual key types. This also disables certain warning messages about potentially incompatible actions. As the name implies, this option is for experts only. If you don't fully understand the implications of what it allows you to do, leave this off. --no-expert disables this option. ===================cut==================== Now I've expired key: --------cut-------- ----------------- [ 23:03:08, olli@skylab, ~/.gnupg ] $ gpg --list-keys 0x6879649A gpg: using PGP trust model gpg: NOTE: signature key 0x6879649A expired Wed Feb 9 09:24:05 2005 MSK Keyring: /home/olli/.gnupg/pubring.gpg -------------------------------------- pub 1024D/0x6879649A 2002-02-10 [expired: 2005-02-09] Key fingerprint = 154B 5A59 DF51 6602 F589 2314 C77A 5292 6879 649A uid [ expired] Light Olli (Olli) <olli@digger.org.ru> sub 2048g/0x86BB1BD6 2002-02-10 [expired: 2005-02-09] ----------------- [ 23:03:11, olli@skylab, ~/.gnupg ] $ gpg --list-secret-keys 0x6879649A gpg: using PGP trust model gpg: NOTE: signature key 0x6879649A expired Wed Feb 9 09:24:05 2005 MSK gpg: NOTE: signature key 0x6879649A expired Wed Feb 9 09:24:05 2005 MSK gpg: NOTE: signature key 0x6879649A expired Wed Feb 9 09:24:05 2005 MSK gpg: NOTE: signature key 0x6879649A expired Wed Feb 9 09:24:05 2005 MSK Keyring: /home/olli/.gnupg/secring.gpg -------------------------------------- sec 1024D/0x6879649A 2002-02-10 [expired: 2005-02-09] Key fingerprint = 154B 5A59 DF51 6602 F589 2314 C77A 5292 6879 649A uid Light Olli (Olli) <olli@digger.org.ru> ssb 2048g/0x86BB1BD6 2002-02-10 [expires: 2005-02-09] ----------------- [ 23:03:23, olli@skylab, ~/.gnupg ] $ --------cut-------- The key has now no practical need though even after I've published my new key on my web and exported into keyserver I was asked by a friend to send the new key signed by an old key. That's OK. So I tried: --------cut-------- ----------------- [ 22:31:15, olli@skylab, ~/.gnupg ] $ gpg -o ./tmpdir/0x4D6C4871.pub --export 0x4D6C4871 File `./tmpdir/0x4D6C4871.pub' exists. Overwrite? (y/N) y gpg: writing to `./tmpdir/0x4D6C4871.pub' ----------------- [ 23:04:33, olli@skylab, ~/.gnupg ] $ gpg -u 0x6879649A -o 0x4D6C4871.pub.detached-sign.asc --detach-sign ./tmpdir/0x4D6C4871.pub gpg: NOTE: signature key 0x6879649A expired Срд 09 Фев 2005 09:24:05 MSK gpg: NOTE: signature key 0x6879649A expired Срд 09 Фев 2005 09:24:05 MSK gpg: NOTE: signature key 0x6879649A expired Срд 09 Фев 2005 09:24:05 MSK gpg: NOTE: signature key 0x6879649A expired Срд 09 Фев 2005 09:24:05 MSK gpg: skipped "0x6879649A": unusable secret key gpg: signing failed: unusable secret key ----------------- [ 23:05:37, olli@skylab, ~/.gnupg ] $ --------cut-------- And that's also OK, since using an old expired key is a bad idea. Though, since I definitely know what I wish to get I'm using --expert: --------cut-------- ----------------- [ 23:05:37, olli@skylab, ~/.gnupg ] $ gpg --expert -u 0x6879649A -o 0x4D6C4871.pub.detached-sign.asc --detach-sign ./tmpdir/0x4D6C4871.pub gpg: NOTE: signature key 0x6879649A expired Срд 09 Фев 2005 09:24:05 MSK gpg: NOTE: signature key 0x6879649A expired Срд 09 Фев 2005 09:24:05 MSK gpg: NOTE: signature key 0x6879649A expired Срд 09 Фев 2005 09:24:05 MSK gpg: NOTE: signature key 0x6879649A expired Срд 09 Фев 2005 09:24:05 MSK gpg: skipped "0x6879649A": unusable secret key gpg: signing failed: unusable secret key ----------------- [ 23:06:11, olli@skylab, ~/.gnupg ] $ --------cut-------- And that's definitely agains the man. :/ I've the following in my ~/.gnupg/gpg.conf: --------cut-------- ----------------- [ 23:25:49, olli@skylab, ~/.gnupg ] $ grep -v ^\# /home/olli/.gnupg/gpg.conf | grep -v ^\$ armor max-output 0 no-mangle-dos-filenames no-default-recipient no-encrypt-to verbose bzip2-compress-level 6 no-textmode interactive ask-cert-level default-cert-level 0 keyserver hkp://subkeys.pgp.net keyserver-options include-revoked,include-disabled,no-honor-keyserver-url,include-subkeys,verbose,no-auto-key-retrive list-options show-photos,show-policy-urls,show-notations,show-std-notations,show-user-notations,show-keyserver-urls,show-uid-validity,show-unusable-uids,show-unusable-subkeys,show-keyring,show-sig-expire,show-sig-subpackets verify-options show-photos,show-policy-urls,show-notations,show-std-notations,show-user-notations,show-keyserver-urls,show-keyserver-urls,show-unusable-uids photo-viewer "/usr/bin/ida -" display-charset koi8-r no-utf8-strings enable-progress-filter no-comments no-emit-version set-filename ThisReplacesFileName completes-needed 1 marginals-needed 5 cipher-algo AES256 digest-algo SHA512 compress-algo BZIP2 s2k-cipher-algo AES256 s2k-digest-algo SHA512 s2k-mode 3 disable-cipher-algo 3DES disable-pubkey-algo 3DES no-throw-keyids use-agent no-allow-non-selfsigned-uid no-greeting no-require-secmem with-fingerprint default-sig-expire 5y default-cert-expire 5y keyid-format 0xshort --------cut-------- Well, wile trying to get results this way found that --skip-verify doesn't work in this case also: --------cut-------- ----------------- [ 23:50:58, olli@skylab, ~/.gnupg ] $ gpg --no-options --verbose --expert --no-expensive-trust-checks --no-ask-cert-expire --no-ask-sig-expire --skip-verify --ignore-valid-from --ignore-time-conflict -u 0x6879649A -o 0x4D6C4871.pub.detached-sign.asc --detach-sign ./tmpdir/0x4D6C4871.pub gpg: NOTE: signature key 6879649A expired Срд 09 Фев 2005 09:24:05 MSK gpg: NOTE: signature key 6879649A expired Срд 09 Фев 2005 09:24:05 MSK gpg: NOTE: signature key 6879649A expired Срд 09 Фев 2005 09:24:05 MSK gpg: NOTE: signature key 6879649A expired Срд 09 Фев 2005 09:24:05 MSK gpg: skipped "0x6879649A": unusable secret key gpg: signing failed: unusable secret key ----------------- [ 23:51:05, olli@skylab, ~/.gnupg ] $ --------cut-------- As from man: --------cut-------- --skip-verify Skip the signature verification step. This may be used to make the decryption faster if the signature verification is not needed. --------cut-------- Yes, authors may mean that this is _only_ usefull on decryption. But then this should be noted in the man. W/o this I may aspect to skipt the internal checks that I'm getting warnings about: --------cut-------- gpg: NOTE: signature key 6879649A expired Срд 09 Фев 2005 09:24:05 MSK --------cut-------- And finally I had to edit the key to make a signature from it.. That's not what I'm expecting from an expert mode. Defenitely --expert should work another way - force doing things that're not done normally. Or lets implement --force to get that beheviour. =) --------cut-------- ----------------- [ 00:02:31, olli@skylab, ~/.gnupg ] $ gpg --edit-key 0x6879649A gpg: NOTE: signature key 0x6879649A expired Срд 09 Фев 2005 09:24:05 MSK Secret key is available. gpg: using PGP trust model pub 1024D/0x6879649A created: 2002-02-10 expired: 2005-02-09 usage: CSA trust: unknown validity: expired sub 2048g/0x86BB1BD6 created: 2002-02-10 expired: 2005-02-09 usage: E [ expired] (1). Light Olli (Olli) <olli@digger.org.ru> Command> pref pub 1024D/0x6879649A created: 2002-02-10 expired: 2005-02-09 usage: CSA trust: unknown validity: expired [ expired] (1). Light Olli (Olli) <olli@digger.org.ru> S7 S10 S3 S4 H3 H2 Z2 Z1 [no-ks-modify] Command> toggle sec 1024D/0x6879649A created: 2002-02-10 expires: 2005-02-09 ssb 2048g/0x86BB1BD6 created: 2002-02-10 expires: never (1) Light Olli (Olli) <olli@digger.org.ru> Command> pref Please use the command "toggle" first. --------cut-------- The last one here says me that help is not context-related, since typing '?' I see the 'pref' even if it's disabled for the secret keys (asks for toggle back to public key info mode). --------cut-------- ommand> toggle pub 1024D/0x6879649A created: 2002-02-10 expired: 2005-02-09 usage: CSA trust: unknown validity: expired sub 2048g/0x86BB1BD6 created: 2002-02-10 expired: 2005-02-09 usage: E [ expired] (1). Light Olli (Olli) <olli@digger.org.ru> Command> enable Command> pref pub 1024D/0x6879649A created: 2002-02-10 expired: 2005-02-09 usage: CSA trust: unknown validity: expired [ expired] (1). Light Olli (Olli) <olli@digger.org.ru> S7 S10 S3 S4 H3 H2 Z2 Z1 [no-ks-modify] Command> disable Command> pref pub 1024D/0x6879649A created: 2002-02-10 expired: 2005-02-09 usage: CSA trust: unknown validity: expired *** This key has been disabled [ expired] (1). Light Olli (Olli) <olli@digger.org.ru> S7 S10 S3 S4 H3 H2 Z2 Z1 [no-ks-modify] Please note that the shown key validity is not necessarily correct unless you restart the program. Command> enable Command> pref pub 1024D/0x6879649A created: 2002-02-10 expired: 2005-02-09 usage: CSA trust: unknown validity: expired [ expired] (1). Light Olli (Olli) <olli@digger.org.ru> S7 S10 S3 S4 H3 H2 Z2 Z1 [no-ks-modify] Command> --------cut-------- From above I see that --expert was not working on _enabled_ key (disabled keys giveup w/ worning in prefs). Okay, now: --------cut-------- Command> check uid Light Olli (Olli) <olli@digger.org.ru> gpg: NOTE: signature key 0x6879649A expired Срд 09 Фев 2005 09:24:05 MSK sig!3 0x6879649A 2002-02-10 never [self-signature] gpg: NOTE: signature key 0x6879649A expired Срд 09 Фев 2005 09:24:05 MSK sig!3 0x6879649A 2002-02-10 never [self-signature] Command> expire Changing expiration time for the primary key. Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years Key is valid for? (0) 0 Key does not expire at all Is this correct? (y/N) y You need a passphrase to unlock the secret key for user: "Light Olli (Olli) <olli@digger.org.ru>" gpg: NOTE: signature key 0x6879649A expired Срд 09 Фев 2005 09:24:05 MSK 1024-bit DSA key, ID 0x6879649A, created 2002-02-10 gpg: DSA/SHA1 signature from: "0x6879649A Light Olli (Olli) <olli@digger.org.ru>" pub 1024D/0x6879649A created: 2002-02-10 expires: never usage: CSA trust: unknown validity: unknown sub 2048g/0x86BB1BD6 created: 2002-02-10 expired: 2005-02-09 usage: E [ unknown] (1). Light Olli (Olli) <olli@digger.org.ru> Command> check uid Light Olli (Olli) <olli@digger.org.ru> sig!3 0x6879649A 2002-02-10 never [self-signature] sig!3 0x6879649A 2006-02-27 never [self-signature] Command> toggle sec 1024D/0x6879649A created: 2002-02-10 expires: never ssb 2048g/0x86BB1BD6 created: 2002-02-10 expires: never (1) Light Olli (Olli) <olli@digger.org.ru> Command>^D Save changes? (y/N) y --------cut-------- And only after that it works (though require me to avoid some of my options set): --------cut-------- ----------------- [ 00:18:31, olli@skylab, ~/.gnupg ] $ gpg --expert -u 0x6879649A -o 0x4D6C4871.pub.detached-sign.asc --detach-sign ./tmpdir/0x4D6C4871.pub You need a passphrase to unlock the secret key for user: "Light Olli (Olli) <olli@digger.org.ru>" 1024-bit DSA key, ID 0x6879649A, created 2002-02-10 gpg: writing to `0x4D6C4871.pub.detached-sign.asc' gpg: DSA requires the use of a 160 bit hash algorithm gpg: signing failed: general error ----------------- [ 00:19:32, olli@skylab, ~/.gnupg ] $ gpg --no-options --expert -u 0x6879649A -o 0x4D6C4871.pub.detached-sign.asc --detach-sign ./tmpdir/0x4D6C4871.pub You need a passphrase to unlock the secret key for user: "Light Olli (Olli) <olli@digger.org.ru>" 1024-bit DSA key, ID 6879649A, created 2002-02-10 ----------------- [ 00:21:05, olli@skylab, ~/.gnupg ] $ ls ./0x4D6C4871.pub.detached-sign.asc -l -rw-r--r-- 1 olli wheel 65 2006-02-28 00:20 ./0x4D6C4871.pub.detached-sign.asc ----------------- [ 00:21:28, olli@skylab, ~/.gnupg ] $ --------cut-------- Though that's OK, since I insist by default on options that are not compatible with DSA keys. (see also bug 153565: https://bugzilla.novell.com/show_bug.cgi?id=153565). So the following work OK: --------cut-------- ----------------- [ 00:25:24, olli@skylab, ~/.gnupg ] $ gpg --no-options --use-agent -u 0x6879649A -o 0x4D6C4871.pub.detached-sign.asc --detach-sign ./tmpdir/0x4D6C4871.pub You need a passphrase to unlock the secret key for user: "Light Olli (Olli) <olli@digger.org.ru>" 1024-bit DSA key, ID 6879649A, created 2002-02-10 ----------------- [ 00:25:42, olli@skylab, ~/.gnupg ] $ ls ./0x4D6C4871.pub.detached-sign.asc -l -rw-r--r-- 1 olli wheel 65 2006-02-28 00:25 ./0x4D6C4871.pub.detached-sign.asc ----------------- [ 00:25:49, olli@skylab, ~/.gnupg ] $ --------cut-------- Anyway: 1. --expert doesn't work as expected by manual. If the manual is somewhat wrong the good idea is having --force to insist on doing things that are forbidden normally. 2. --skip-verify either doesn't work for internal signatures either insuffitiently described in the man. 3. interactive help in --edit-key is not context related. Setting this to Major level since I assume that the --expert should work, but it doesn't. This muster me to edit keys that are not used anymore, except some special situations that should be covered by some '--force'-alike option (the expert is intended to be one here, according to manual). The 2 & 3 are minor. Sorry that a few bugs in one post. :|