LDAP keyserver patch 2

[David Shaw]

--0OAP2g/MAC+5xKAE
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi folks,

Here's version 2 of the generic keyserver support for GnuPG.  For most
people this means "LDAP keyserver support" :)

Significant changes since version 1:

* GnuPG now passes the keys to get/send via pipes, rather than using
  the command line.  Since anyone can run ps, this was done to avoid
  information leakage to other users logged into the same box as
  you.  What keys you are fetching from a keyserver is nobody's
  business but yours.

* Key modification time is shown if verbose is on (see below).

* A new config file option: "keyserver-options".  This is a space or
  comma delimited string that gives options for the keyserver fetcher.

  Current options are:

    verbose
      give more information about what the keyserver fetcher is doing.
      Give "verbose" twice for even more information.

    fast-import
      similar to the --fast-import option when importing from a file.
      The import happens without updating the trustdb.  This makes the
      import faster, but you'll have to run gpg --update-trustdb
      later.

    include-disabled
      The LDAP keyserver has the notion of a "disabled" key.  This is
      a key that for whatever reason, the keyholder does not want the
      server to give out.  This feature lets you bypass the lockout
      and get the key anyway.  I'm somewhat torn as to whether this is
      a good idea.

I welcome comments on the include-disabled issue, and whether it would
be useful to have an include-revoked, and by default not fetch revoked
keys.

Some stuff from last time:

To use the new feature, you need to tell GnuPG which keyserver helper
to call.  Do this by adding the protocol to the keyserver names in
your options file.  For example:

 # Old HKP keyservers still work
 keyserver x-hkp://wwwkeys.pgp.net

 # New LDAP keyserver
 keyserver ldap://certserver.pgp.com

 # Email keyserver
 keyserver mailto://pgp-public-keys@keys.pgp.net

For backwards compatibility, if you don't specify a protocol, GnuPG
assumes it's a HKP keyserver.  For HKP, the patch will still call the
internal HKP keyserver code, but I hope to move the HKP code to a
separate application at some point.

After applying the patch via the usual patch -p1, you should run
automake and autoconf to rebuild configure and the makefiles.  After
that, the usual ./configure and make should do it.

The patch is against 1.0.6 (not 1.0.6a), and should be considered
experimental for now.  As always, comments welcome.

Get the patch at:
    http://www.jabberwocky.com/crypto/patch.gnupg-1.0.6.dms.keyserver.2

David

--=20
   David Shaw  |  dshaw@jabberwocky.com  |  WWW http://www.jabberwocky.com/
+--------------------------------------------------------------------------=
-+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson

--0OAP2g/MAC+5xKAE
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iQEVAwUBO66LpIccwqs8s7QVAQG58Qf/f0xvH6ddMD4nE9ao0Y12gvOd6OPd/Ct8
DbA63m8iBwVHB/PQLzSsVXH9kUlfXs0O2T5j2YeDt1C4wkcPYom/Vf1EGdywTrs9
qVdP9+Pd//itEfYHiNsNDOuBPF0E0ecjWA9IylcgZZIiDUGvubw0KTuIikSVqgQs
+1uWp53TkY5VogTto/S2j24FWbGMZMMC7UBm/npK0ShJop/VN8zlWzX2A+1WiXM2
4RrU/c6xMG4c/0N81t4QTsNPB6m8ZiQ68q/AK5cO1OGXyv5K/b/5tnv42jKeL5Pg
5vIv7UNGTNwEW85QJmWKvAm//5Ds0yOaxp0H5OG77zaX/hdLdnTnRg==
=HnKl
-----END PGP SIGNATURE-----

--0OAP2g/MAC+5xKAE--