Outdated claims #161

gonz0 commented 2023年03月26日 13:25:29 +02:00

I have updated the claims in my key. I don't see that reflected on keyoxide though.

I debugged the issue up to the point I see my key has two self certifications, one dated 2020 and the newest one 2023. doipjs seems to be returning the first one instead of the latest.

src/server/keys.js puts the result of readKey in output.publicKey. Here, the new claim is still readable (i'll be doing a lot of trimming not to pollute the issue. This is all public information found in my PGP key anyways)

bu {
 created: 2020-07-16T19:11:15.000Z,
 rawNotations: [
 {
 name: 'proof@metacode.biz',
 },
 {
 name: 'proof@metacode.biz',
 },
 {
 name: 'proof@metacode.biz',
 }
 ],
bu {
 created: 2023-03-26T07:48:58.000Z,
 rawNotations: [
 {
 name: 'proof@ariadne.id',
 },
 {
 name: 'proof@metacode.biz',
 },
 {
 name: 'proof@metacode.biz',
 },
 {
 name: 'proof@metacode.biz',
 }
 ],
}

Later on, on index.js this object goes through doipjs processing and only the old claims come out:

[
 Claim {
 _uri: 'https://twitter.com/gonz0comar/status/1283839550394109955',
 _fingerprint: '607d555b2b11b1b3916acbde31e5fe63e2fc4825',
 },
 Claim {
 _uri: 'https://gist.github.com/gonzalob/be4d68b5dee5caa6bc79eaf5cf9ce8c3',
 _fingerprint: '607d555b2b11b1b3916acbde31e5fe63e2fc4825',
 },
 Claim {
 _uri: 'dns:gonz0.com.ar?type=TXT',
 _fingerprint: '607d555b2b11b1b3916acbde31e5fe63e2fc4825',
 }
]

These notation modifications were made following this doc: https://docs.keyoxide.org/guides/openpgp-profile-gnupg/

and the key shows only the expected notations:

 Notations: proof@metacode.biz=https://twitter.com/gonz0comar/status/1283839550394109955
 proof@metacode.biz=https://gist.github.com/gonzalob/be4d68b5dee5caa6bc79eaf5cf9ce8c3
 proof@metacode.biz=dns:gonz0.com.ar?type=TXT
 proof@ariadne.id=https://t.me/gonzalob?proof=f29d7f2863774c778d8695bac4d0

This is even more noticeable if the photo ID user is used as test case, as I emptied the notations there but they're still visible on keyoxide.

Thanks! And of course I'm available for any additional information I can provide.

I have updated the claims in my key. I don't see that reflected on keyoxide though. I debugged the issue up to the point I see my key has two self certifications, one dated 2020 and the newest one 2023. doipjs seems to be returning the first one instead of the latest. src/server/keys.js puts the result of readKey in output.publicKey. Here, the new claim is still readable (i'll be doing a lot of trimming not to pollute the issue. This is all public information found in my PGP key anyways) ```javascript bu { created: 2020年07月16日T19:11:15.000Z, rawNotations: [ { name: 'proof@metacode.biz', }, { name: 'proof@metacode.biz', }, { name: 'proof@metacode.biz', } ], bu { created: 2023年03月26日T07:48:58.000Z, rawNotations: [ { name: 'proof@ariadne.id', }, { name: 'proof@metacode.biz', }, { name: 'proof@metacode.biz', }, { name: 'proof@metacode.biz', } ], } ``` Later on, on index.js this object goes through doipjs processing and only the old claims come out: ```javascript [ Claim { _uri: 'https://twitter.com/gonz0comar/status/1283839550394109955', _fingerprint: '607d555b2b11b1b3916acbde31e5fe63e2fc4825', }, Claim { _uri: 'https://gist.github.com/gonzalob/be4d68b5dee5caa6bc79eaf5cf9ce8c3', _fingerprint: '607d555b2b11b1b3916acbde31e5fe63e2fc4825', }, Claim { _uri: 'dns:gonz0.com.ar?type=TXT', _fingerprint: '607d555b2b11b1b3916acbde31e5fe63e2fc4825', } ] ``` These notation modifications were made following this doc: https://docs.keyoxide.org/guides/openpgp-profile-gnupg/ and the key shows only the expected notations: ``` Notations: proof@metacode.biz=https://twitter.com/gonz0comar/status/1283839550394109955 proof@metacode.biz=https://gist.github.com/gonzalob/be4d68b5dee5caa6bc79eaf5cf9ce8c3 proof@metacode.biz=dns:gonz0.com.ar?type=TXT proof@ariadne.id=https://t.me/gonzalob?proof=f29d7f2863774c778d8695bac4d0 ``` This is even more noticeable if the photo ID user is used as test case, as I emptied the notations there but they're still visible on keyoxide. Thanks! And of course I'm available for any additional information I can provide.

ethan commented 2023年03月26日 17:03:59 +02:00

Did you follow the Telegram-specific guide to create the Telegram proof?

Did you follow the [Telegram-specific guide](https://docs.keyoxide.org/service-providers/telegram/) to create the Telegram proof?

gonz0 commented 2023年03月26日 17:54:22 +02:00

The issue is with notations on the key, and the fact that keyoxide is not getting the updated ones. I didn't get to check the telegram proof yet. Even so, I did follow that doc to create that specific one, yes.

The issue is with notations on the key, and the fact that keyoxide is not getting the updated ones. I didn't get to check the telegram proof yet. Even so, I did follow that doc to create that specific one, yes.

gonz0 commented 2023年03月26日 18:10:27 +02:00

I didn't get to debug so far, but I see that doipjs gets the first selfCertification:

I guess it should find the newest one instead.

I didn't get to debug so far, but I see that doipjs gets the first selfCertification: https://codeberg.org/keyoxide/doipjs/src/commit/e3392431d1cc20e78ccd003e2bf79aa3dcf78260/src/keys.js#L188 I guess it should find the newest one instead.

gonz0 commented 2023年03月26日 19:01:01 +02:00

I got it working with this patch, but have no permissions to push on doipjs to provide a pull request:

diff --git a/src/keys.js b/src/keys.js
index bb62e4a..12ee7d0 100644
--- a/src/keys.js
+++ b/src/keys.js
@@ -283,7 +283,7 @@ const process = async (publicKey) => {
 }
 
 if ('selfCertifications' in user && user.selfCertifications.length > 0) {
- const selfCertification = user.selfCertifications[0]
+ const selfCertification = user.selfCertifications.sort((e1, e2) => e2.created - e1.created)[0]
 
 const notations = selfCertification.rawNotations
 usersOutput[i].claims = notations 

I got it working with this patch, but have no permissions to push on doipjs to provide a pull request: ```diff diff --git a/src/keys.js b/src/keys.js index bb62e4a..12ee7d0 100644 --- a/src/keys.js +++ b/src/keys.js @@ -283,7 +283,7 @@ const process = async (publicKey) => { } if ('selfCertifications' in user && user.selfCertifications.length > 0) { - const selfCertification = user.selfCertifications[0] + const selfCertification = user.selfCertifications.sort((e1, e2) => e2.created - e1.created)[0] const notations = selfCertification.rawNotations usersOutput[i].claims = notations ```

gonz0 commented 2023年03月27日 13:19:18 +02:00

I have a user-side fix/workaround for this. if the key is exported with the minimal option, this works as-is, I guess because old notations are not exported.

From https://www.gnupg.org/documentation/manuals/gnupg/GPG-Input-and-Output.html

export-minimal
Export the smallest key possible. This removes all signatures except the most recent self-signature on each user ID. This option is the same as running the --edit-key command "minimize" before export except that the local copy of the key is not modified. Defaults to no.

I have a user-side fix/workaround for this. if the key is exported with the minimal option, this works as-is, I guess because old notations are not exported. From https://www.gnupg.org/documentation/manuals/gnupg/GPG-Input-and-Output.html > export-minimal > Export the smallest key possible. This removes all signatures except the most recent self-signature on each user ID. This option is the same as running the --edit-key command "minimize" before export except that the local copy of the key is not modified. Defaults to no.

yarmo commented 2023年03月28日 12:53:35 +02:00

Thanks for looking into this. I remember doing some quick testing a few years ago and the selfCertifications were always already in chronological order. Still, your solution is what should have been applied: just sort to make sure the order is correct.

Doing some testing and then I will commit the change.

Thanks for looking into this. I remember doing some quick testing a few years ago and the selfCertifications were always already in chronological order. Still, your solution is what should have been applied: just sort to make sure the order is correct. Doing some testing and then I will commit the change.

yarmo commented 2023年03月28日 13:10:29 +02:00

Ok, so this change made no difference for my keys, which is a good thing because indeed, for some reason my selfCertifications are in the right order from the start. But this change will fix the order for those keys that don't have the selfCertifications in the correct order.

Fixed with keyoxide/doipjs@d069569b32

Ok, so this change made no difference for my keys, which is a good thing because indeed, for some reason my selfCertifications are in the right order from the start. But this change will fix the order for those keys that don't have the selfCertifications in the correct order. Fixed with https://codeberg.org/keyoxide/doipjs/commit/d069569b3273a54c3400bae308792a5b85029db5