IJHack / QtPass / 41225513412

93%

push

github

Profiles: a subkey and its primary key are one signer (#2099)

The shared-signing-key warning (#2050, #2087) compared the keys as
written. Verification takes the primary or the signing subkey's
fingerprint from VALIDSIG, and gpg signs for a primary key with its
subkey, so a key written as its primary fingerprint in one profile and
as a subkey's (or a key ID) in another is one signer, and the warning
did not say so.

Each complete key ID or fingerprint (8, 16, 40 or 64 hex) is now looked
up once with the dialog's gpg (--list-keys --with-subkey-fingerprint),
and the primary fingerprint of the block that holds it joins the keys
as written. primaryFingerprintOf() takes only that block, whatever else
gpg prints. Lookups are cached per gpg and key, and partial input is not
looked up, so typing a key does not start gpg for every prefix. Without
gpg, or for a key it does not know, the comparison is as before.

From the tech-debt list in #2094.


Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d

Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

48 of 48 new or added lines in 2 files covered. (100.0%)

9998 of 10792 relevant lines covered (92.64%)

399.1 hits per line