Tails

#1 Updated by muri 2016-03-15 14:25:07

when i try to sign the tails signing key with monkeysign i get:

monkeysign 0xDBB802B258ACD84F
Traceback (most recent call last):
  File "/usr/bin/monkeysign", line 41, in <module>
    u.main()
  File "/usr/lib/python2.7/dist-packages/monkeysign/cli.py", line 64, in main
    self.copy_secrets()
  File "/usr/lib/python2.7/dist-packages/monkeysign/ui.py", line 256, in copy_secrets
    keys = self.keyring.get_keys(None, True, False)
  File "/usr/lib/python2.7/dist-packages/monkeysign/gpg.py", line 385, in get_keys
    key = OpenPGPkey(keydata)
  File "/usr/lib/python2.7/dist-packages/monkeysign/gpg.py", line 656, in __init__
    self.parse_gpg_list(data)
  File "/usr/lib/python2.7/dist-packages/monkeysign/gpg.py", line 698, in parse_gpg_list
    (null, self.trust, self.length, self.algo, keyid, self.creation, self.expiry, serial, trust, uid, sigclass, purpose, smime, wtf, wtf, wtf) = record
ValueError: too many values to unpack

i think the tool we choose should be able to sign our own key ;)

#2 Updated by intrigeri 2016-03-15 20:10:11

It might be that by design, monkeysign needs the key that will be certified to have an encryption subkey, so that the certification can be sent encrypted to the signee?

#3 Updated by sajolida 2016-03-16 11:28:04

I think it’s this bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736548.

This is slightly off topic here, unless we’re discussing whether monkeysign is good enough to be documented and thus get more audience, generate more user support requests, etc.

#12 Updated by emmapeel 2016-09-23 02:49:29

intrigeri wrote:
> * Does it really work to pass a fingerprint with spaces? I would be somewhat surprised. The upstream doc has examples without space.
It does now. Tested it in Tails.

> * Please use HTTPS when pointing to the upstream doc.

Ack!

> * Please use consistent terminology wrt. “key ID”. I see “key id” and “keyid”, the gpg manpage uses “key ID”.

> * I’m sad that we’re reinforcing the “signing” vs. “certifying” confusion here, but I understand that it’s probably more important to be consistent with upstream’s terminology :/ Not your fault, of course.
> * Pointing to “learn more” at the beginning of the doc feels wrong to me, but I’ll let sajolida handle this part of the review.
> * The commands must not be split over multiple lines: it won’t work as-is. Worst case, if web formatting/layout requires it, use backslash to indicate line break in the middle of the command (even though it will make it harder to edit the command line for many users).
> * --smtpuser=amnesia in the template command feels wrong given the other bits that the user must replace are provided between brackets.
> * “specially when using it through the Tor network” is disputable and add little information (in Tails you’re always using Tor anyway), so I would simply drop it.
> * “With your `amnesia@boum.org` OpenPGP key” is not consistent with the use of Riseup’s SMTP.

The thing is: there tends to be more than one GPG key on our key ring in Tails. So I wanted to show how you can choose the gpg key to sign the message to, and a different mailbox to send… maybe I should be more explicit.

> * Does it really work to sign Tails’ signing key this way? At least “an encrypted and signed message will be sent” seems strange, given our signing key has no encryption subkey. If it really works, then I’m curious to what key the outgoing message will be encrypted: (just guessing:) any pubkey with an encryption subkey and a matching email address? If yes, this would be a minor security flaw in Monkeysign.

TBH, I tested it with other fingerprint… copied that one but I cannot sign it anyway because it is already signed with my key…

#13 Updated by emmapeel 2016-09-23 02:55:59

intrigeri wrote:
> Also:
>
> * https://monkeysign.readthedocs.io/en/2.x/usage.html has an example using Thunderbird (that likely most people using OpenPGP for email in Tails use); how about using it instead of manually passing SMTP info, that many people will have a hard time figuring out, on the command-line? Our Icedove now has the account configuration wizard, so it will autodetect these settings :)

I know! But this is not working in our monkeysign version shipped in Tails. Will be working with monkeysign 2.1 https://0xacab.org/monkeysphere/monkeysign/milestones/1

> * I would assume that people using Monkeysign in Tails won’t do it only once, and have persistence enabled (to store their private key). So what about documenting how to write all required settings in a config file (+ how to make it persistent), or pointing to the upstream doc that already explains that? Maybe it’s too much work on our side, for little benefit, I don’t know. What do you think?

Actually the config file was my next goal. We had some issues with the readthedocs implementation but now it is easier to work on monkeysign docs :)

I asked monkeysign people for review, and offered to document it upstream. Then we could point our users there.

https://0xacab.org/monkeysphere/monkeysign/merge_requests?scope=all&state=merged#

> * In general I’m glad that you worked with upstream on this one! The linking to it might need improvements, but I’m glad that the proposed branch does not attempt to duplicate all the info that upstream doc already has!

(wax on, wax off!)

#14 Updated by intrigeri 2016-09-23 03:22:57

> I know! But this is not working in our monkeysign version shipped in Tails. Will be working with monkeysign 2.1 https://0xacab.org/monkeysphere/monkeysign/milestones/1
> […]
> Actually the config file was my next goal. We had some issues with the readthedocs implementation but now it is easier to work on monkeysign docs :)

Excellent, thanks!

#15 Updated by intrigeri 2016-09-23 03:25:37

>> * Does it really work to pass a fingerprint with spaces? I would be somewhat surprised. The upstream doc has examples without space.
> It does now. Tested it in Tails.

Cool :)

>> * “With your `amnesia@boum.org` OpenPGP key” is not consistent with the use of Riseup’s SMTP.

> The thing is: there tends to be more than one GPG key on our key ring in Tails. So I wanted to show how you can choose the gpg key to sign the message to, and a different mailbox to send… maybe I should be more explicit.

I see. But presumably, in general one should use the SMTP server corresponding to the signing key’s UID, in order to avoid linking identities together, no? So perhaps it’s actually better to not suggest that anyone does differently.

> TBH, I tested it with other fingerprint… copied that one but I cannot sign it anyway because it is already signed with my key…

OK, so let’s play it safe and not pretend that this thing will work, since it’s unlikely to.

#23 Updated by Anonymous 2018-01-15 13:54:20

So it seems that the last thing to do on this ticket is to write a documentation for the working command?

#25 Updated by intrigeri 2018-08-17 16:23:32

Monkeysign is dead upstream and it’s unclear whether it’ll make it into Buster, so if I were you I would not spend time on it right now.

#28 Updated by intrigeri 2019-01-04 10:49:22

sajolida wrote:
> Though I see a release in June 2018:

This was some kind of “wrap things up and ship fixes that are ready” release, announced by the upstream author at the same time he announced on some mailing list that he was mostly giving up on this project. Sorry I can’t find the reference to that announcement.

#29 Updated by muri 2019-01-04 10:54:17

intrigeri wrote:
> This was some kind of “wrap things up and ship fixes that are ready” release, announced by the upstream author at the same time he announced on some mailing list that he was mostly giving up on this project. Sorry I can’t find the reference to that announcement.

FTR: https://lists.riseup.net/www/arc/monkeysphere/2018-06/msg00004.html

#30 Updated by intrigeri 2019-02-07 08:20:31

See “Monkeysign alternatives testing” on https://anarc.at/blog/2019-02-06-report/, whose conclusion is “So, surprisingly, Monkeysign might survive a bit longer, as much as I have come to dislike the poor little thing…”.