On 06/02/2009 10:14 AM, Vincent Panel wrote: > I just wondered if it was possible to postpone the expiration date > after it has been set and/or after the deadline has been reached.
yes, this is possible. Assming you're talking about 56B55C11, it looks
like you've successfully done so.
> I've tried to export the result and put it on the mit keyserver but it
> failed. According to the message I've read, it was because my userids
> wer signed by two keys (which is more or less wrong : I've checked and
> they are signed twice by the same key, but at different dates).
It's actually self-signed three times by the same key:
* the original self-signature
* the new self-signature with the updated expiration
* a third self-signature which moves the "primary User ID" flag from
one UID to another.
If pgp.mit.edu rejected the key, that's a bug in that keyserver.
I just tried pulling this key from pgp.mit.edu and from
pool.sks-keyservers.net, and found that pgp.mit.edu only had the first
two self-sigs on each UID, while pool.sks-keyservers.net had all three.
then i tried pushing the full key (with all three self-sigs) back to
pgp.mit.edu. After that, pgp.mit.edu returned all three self-sigs.
So it seems there was a buggy propagation in there, but i might have
just fixed it manually for this specific key.
(the explicit steps described above were:
umask 077
mkdir yohonet yohonet/mit yohonet/sks
GNUPGHOME=yohonet/mit gpg --keyserver pgp.mit.edu --recv 56B55C11
GNUPGHOME=yohonet/sks gpg --keyserver pool.sks-keyservers.net --recv
56B55C11
GNUPGHOME=yohonet/sks gpg --list-sigs 56B55C11
GNUPGHOME=yohonet/mit gpg --list-sigs 56B55C11
GNUPGHOME=yohonet/sks gpg --keyserver pgp.mit.edu --send 56B55C11
GNUPGHOME=yohonet/mit gpg --keyserver pgp.mit.edu --recv 56B55C11
GNUPGHOME=yohonet/mit gpg --list-sigs 56B55C11
)
I'd be interested in seeing the error output you got from sending the
key to pgp.mit.edu. When i sent the full key back to pgp.mit.edu, i got
no error message at all, just the expected line from gpg:
gpg: sending key 56B55C11 to hkp server pgp.mit.edu
> What
> is strange is I've tried another keyserver and it worked (without
> removing the expired signature).
It's probably a good idea to use the other keyserver then, and avoid
pgp.mit.edu.
> But, well, the real problem is that now, even if my new subkey has
> been imported successfully, the primary key on the keyserver still has
> the old expiration date set - i.e. the primary key has expired : do
> you know if I can update the key on the keyserver so that it is aware
> of the new expiration date ?
this is already done. the old self-signature with the old expiration
date will persist forever, but the new self-sig has a more recent
creation date, and RFC-compliant OpenPGP implementations will respect it.
--dkg
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
