[PATCH GNUPG] sm: Search for qualified.txt at sysconfdir first

[Werner Koch]

On Fri,  1 Sep 2017 08:24, alon.barlev at gmail.com said:

> The qualified.txt may be modified by the Administrator, hence this
> artifact is a configuration. A product may provide sane defaults,
> however, it should be possible for the Administrator to manage

The idea behind the qualified.txt is to cope with German signature law
which originally demanded that all valid root certificates are at least
registered at a federal agency (Bundesnetzagentur).  So this should be a
pretty static thing and could be updated by updating the gnupg package.
Later it turned out that getting hold of the actual list is in a secure
way is impossible.  For example calling the support desk of one of the
CA to ask for verification of the root certificate's fingerprint ended
up in the support person reading to me the very same website I had in
front of me - a web site I had directed that person to.  I conclude that
this whole system is entirely bogus and, for other reasons; limited also
by the the security of https certificates.

Enough of a rant.

Given that the current qualified.txt has only expired certificates and I
do not want to maintain this file anymore, I think it is better to move
this entirely to sysconfdir and have no fallback.  So we would
distribute only an explample explaining the format.

What do you think?


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 227 bytes
Desc: not available
URL: </pipermail/attachments/20170901/14a5c6a0/attachment.sig>