phive icon indicating copy to clipboard operation
phive copied to clipboard

Published 20 hours ago • verified publisher icon phar-io

Consider implementing additional means to find gpg public keys

Open theseer opened this issue 4 years ago • 0 comments

Given that gnupg apparently returns NEWSIG <email-address> along with NO_PUBKEY <key-id>, we could also use the email address to search for pub keys:

  • Lookup via DNS (PKA or CERT types?)
  • Lookup via WKD (Web Key Directory)

Not sure how many projects support that already but I guess we could promote it. This might actually make it worth while to extract the key finding code into it's own component.

/cc @jaapio

theseer avatar Nov 20 '20 20:11 theseer