Fwd: 2 Patches : bugfix

[Robert J. Hansen]

> Since I stressed [my own certificate](http://keys.foopgp.org:11371/ pks/
> lookup?op=index&search=0xFE1349E747CF1896) to test some (of mine) 
> innovations around PGP (see for example: [https://foopgp.org/ 
> blog/2026-07-18-vcard-openpgp/](https://foopgp.org/blog/2026-07-18- vcard-
> openpgp/)), people can't no more send me encrypted email from clients
> like evolution.

This "let's merge LibrePGP certificates with vCards" idea seems to badly
misunderstand both.

A vCard is purely a data storage format, like HTTP. Authenticating
stored data is a separate problem that should be solved at a different
conceptual level: see how TLS is built on top of HTTP, for instance.

> Here is the fix :
> 
> - [https://github.com/foopgp/gnupg/commit/ 
> a445a5079a85c5190cd69021c673c4aac0658732](https://github.com/foopgp/ gnupg/
> commit/a445a5079a85c5190cd69021c673c4aac0658732)

From your edited comment,

/* The search matched one user id, but a mail address may appear
 * on several of them.  Revoking one of those must not make the
 * address unusable while another user id still carries it and is
 * itself usable.  */

Maybe I need my morning coffee (it's 0700 here), but I've read this
three times and have no idea what bug you think you've discovered or how
this amounts to a fix.

> And [Mnêmê](https://foopgp.org/blog/2026-05-09-hello-my-name-is- mneme/)
> (The claude-opus agent I use to work with) found also an other bug
> which can prevent encrypting to certificate [like ours] (https://
> keys.foopgp.org/pks/lookup? 
> op=index&search=0xD995BB48C67FD9C1E8A03F7CDEC98791AADC429B):

Dunno what you're talking about:

$ gpg --import ~Downloads/0xD995BB48C67FD9C1E8A03F7CDEC98791AADC429B.asc
gpg: key DEC98791AADC429B: 4 signatures not checked due to missing keys
gpg: key DEC98791AADC429B: public key "Mnêmê <mneme at foopgp.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: Note: signatures using the MD5 algorithm are rejected
gpg: depth: 0  valid:   4  signed:   3  trust: 0-, 0q, 0n, 0m, 0f, 4u
gpg: depth: 1  valid:   3  signed:   0  trust: 2-, 0q, 0n, 0m, 1f, 0u
gpg: next trustdb check due at 2029-07-26

$ gpg --recipient 0xD995BB48C67FD9C1E8A03F7CDEC98791AADC429B --encrypt
index.html
gpg: D67CF0191FF1197E: There is no assurance this key belongs to the
named user

sub  cv25519/D67CF0191FF1197E 2026-05-04 Mnêmê <mneme at foopgp.org>
      D995BB48C67FD9C1E8A03F7CDEC98791AADC429B
      6C3800430CC84E9A4CA31DB4D67CF0191FF1197E

It is NOT certain that the key belongs to the person named
in the user ID.  If you *really* know what you are doing,
you may answer the next question with yes.

Use this key anyway? (y/N) y

$ ls -lh index.html.gpg
-rw-r--r--@ 1 rjh  staff   739B Sep 10 07:04 index.html.gpg


... Your cert is perfectly usable for encryption.

> BTW, I think you should try [our innovations and software](https:// 
> foopgp.org/solutions/activity-rd/). Even if they are still a bit 
> experimental and dirty, they already [greatly improve PGP UX for many 
> "normal" people](https://foopgp.org/solutions/djibian/).

If you can point us to the many people they are helping, we'd love to
talk to them and find out how to improve.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20260910/b6ee631d/attachment-0005.sig>