Refactor gpg import to use machine readable colon format#256
Refactor gpg import to use machine readable colon format#256Xerkus wants to merge 1 commit intolaminas:1.25.xfrom
Conversation
592c7de to
5db5062
Compare
|
I was wrong. Combination of public primary plus secret subkeys is not realistic, removing check for that. Stub can not be distinguished from real secret key when using Subkeys with no secrets are exported as secret stubs as well. Stub could be detected via Extra guards for key validity I added originally are in effect useless, removed them. If key can be imported but has any issues signing it will fail to sign release couple seconds later anyway. Extra checks here would only provide a bit of verbosity at best. |
29ca5aa to
31720aa
Compare
Signed-off-by: Aleksei Khudiakov <aleksey@xerkus.pro>
31720aa to
0174cd0
Compare
Description
Current gpg import uses unstable gpg output to determine if key was imported and to get imported key id.
Unstable format is unreliable, for example gpg 2.4.3 on my machine outputs
gpg: key 0x8CA5C026AE941316: secret key importedline that would not match existing regex due to0xprefix in key id. This is not encountered with gpg used by action but I would call it a bug.This PR is refactoring gpg key import to use colon delimited machine readable format. Information can be found at https://github.com/gpg/gnupg/blob/master/doc/DETAILS
Additional improvements are to guard against adding keys that do not have secret keys or subkeys with sign capability. Expired keys could cause gpg sign to fail anyway but I do not know how reliable expiry information is in gpg import output.