GPG: Sign full public key
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 55/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- typescript
- Domain
- security
Research direction
Start by finding the current code that runs gpg --fingerprint and the input box used for verification. Replace the fingerprint export with gpg --armor --export, update the input handling for multiline armored keys, and verify that a full public key can be displayed and processed successfully.
Written by the indexing model from the issue text.
Description
Currently we just sign the GPG fingerprint. It's relatively human friendly, but it comes at the cost of signatures being over far less entropy/data than signing the full public key would bring.
This could be for absolutely nothing, but it feels like we should present & sign the whole public key, to make extra sure there's not some sneaky impersonation.
current example
Verifying my PGP key on keytrace
did: did:plc:zjbq26wybii5ojoypkso2mso
gpg: f0:00:ba:3d
possible next
Verifying my PGP key on keytrace
did: did:plc:zjbq26wybii5ojoypkso2mso
-----BEGIN PGP PUBLIC KEY BLOCK-----
mDMEanQJtxYJKwYBBAHaRw8BAQdAfP2sBlRAvVijq6wowWVTAoPtDol1urqeQwSz
EOeKCAm0GWtleXRyYWNlLXRlc3RAZXhhbXBsZS5jb22IkAQTFgoAOBYhBKVwnIRH
Lv4QS9nQ+y6rLN824qqQBQJqdAm3AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheA
AAoJEC6rLN824qqQ2gkBAKSe1RFKd2rRBzbiC1fzpL/u9ci9WupKkY7WW1j7ArwB
AQClgfDXcw2oWtU46//SgE1e5Sm/D/vf+ivEE3hcVrL3Aw==
=OBA0
-----END PGP PUBLIC KEY BLOCK-----
how?
use gpg --armor --export instead of gpg --fingerprint to get the full public key, update the input box to accept multi-line input.
- Dominant language
- TypeScript
- Stars
- 86
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from orta/keytrace
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
Difficulty 3/5 1-2 days Newbie friendliness 65/100
Similar issues
-
[测试] 等待仓库加载后再记录多仓库排序基线Possibly taken @myot233 claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
area:arcade p3-medium ready-for-agent testing type:docs
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
fderuiter/deruiter.dev#2369 ·
Maintainers usually reply within 1 day
-
area:devenv origin:agent type:bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
overengineeringstudio/effect-utils#1949 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
ccch1mneyyy/dsh-TUI#1631 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
MiniMax-AI/minimax-code#507 ·
Maintainers usually reply within 1 day