Use key fingerprint as ID instead of “long” ID. #452
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It is generally assumed that for applications demanding good security, the full key fingerprint should be used instead of just the 64-bit or, let alone, 32-bit key ID.
This PR uses the key fingerprint from GPG to replace the key ID. It works by waiting for an
fpr
record in the key list and, if it looks like belonging to the key at hand by comparing the end of the fingerprint to the previously found ID, replacing thekey_id
field with it (it should normally be the next line after thepub
orsec
record).As a bonus, this increases compatibility with other frontends, like gopass-pw, which use the fingerprint and would cause unwanted updates of
.gpg-id
.