[pkg-gnupg-maint] Bug#834922: gnupg: No more able to sign with my 4096R key since the switch to GnuPG 2.x, but still able to sign with my old 1024D key

[Axel Beckert]

Control: retitle -1 gnupg: Fails to sign if secret part of a signing subkey is not present, but its public part known (regression from gpg1)

Hi,

Werner Koch wrote:
> can you please run 
> 
>   echo foo | gpg --clearsign -v --debug ipc
> 
> which shows the communication with gpg-agent.  It won't show passphrases
> or secret key material, but if you prefer, send the output to my by PM.

Thanks to Werner's analysis, we found the culprit respectively the
(IMHO) regression:

My 4096R key has a signing subkey which is primarily meant for
machines I don't have physical control over. The private part of that
subkey is only on machines where the private part of the masterkey
isn't. Plus on that one machine (my Thinkpad) where I generated it.

But via key refreshes, my other machines know about the public part of
that subkey. And that's the cause for this issue:

While gpg1 handles that situation without issues and uses the
masterkey for signing, gpg2 seems to insist on using that subkey for
signing despite there's no secret part for that subkey available. I
consider this is a regression compared to gpg1.

(And yes, the case where I explicitly requested that subkey should
have failed for sure, just not the other cases.)

And my 1024D key still worked, because I didn't use subkeys with it.

		Regards, Axel
-- 
 ,''`.  |  Axel Beckert <abe at debian.org>, http://people.debian.org/~abe/
: :' :  |  Debian Developer, ftp.ch.debian.org Admin
`. `'   |  4096R: 2517 B724 C5F6 CA99 5329  6E61 2FF9 CD59 6126 16B5
  `-    |  1024D: F067 EA27 26B9 C3FC 1486  202E C09E 1D89 9593 0EDE