On Thu, Jul 28, 2005 at 14:25:54 +0200, Tom Van Doorsselaere wrote:

Hello, I think I discovered a bug in Wotsap. A while ago, I contacted Jorgen Cederlof about my key cross-signed by another key. This cross-signature, however, did not appear on Wotsap.

Now I think I found the reason. When I do 'gpg --list-sigs my_key', I have some entries saying 'sig key_id', while some others are 'sig 3 key_id'. The ones without the 3 are reported by Wotsap, the others are not.

Is this a bug or is this on purpose?

It sounds like a bug. Many other 'sig 3' signatures are working fine, and they are ment to work.

Where should I file this bug? If this is the correct place, I would be happy to provide you with more information (actual outputs, etc.).

Sure, this is the right place. I'm in quite a bit of a hurry right now, but I'll be back next week. Can you send some more information until then, like what signatures are affected? Take another look at http://www.lysator.liu.se/~jc/wotsap/faq.html too if you haven't recently, I updated it a while ago with information about a key server bug causing some keys to not be included.

Jörgen

On Fri, Jul 29, 2005 at 15:07:35 +0200, Tom Van Doorsselaere wrote:

tom@kleine ~/wotsap/wotsap-0.6 $ gpg --list-sigs tomvd pub 1024D/1052DB11 2005-04-28 uid Tom Van Doorsselaere tomvd@wis.kuleuven.be sig 3 1052DB11 2005-04-28 Tom Van Doorsselaere tomvd@wis.kuleuven.be sig A9C3E06A 2005-04-29 Dries Kimpe Dries.Kimpe@cs.kuleuven.be sig 3 EF93F89B 2005-05-08 Vereertbrugghen Boris boris@avezoete.be sig 3 14913897 2005-05-18 Christophe Vandeplas christophe@vandeplas.com sig CE74F8D8 2005-06-21 Jan-Pieter Jacobs (jpjacobs) janpieter.jacobs@student.kuleuven.ac.be

and I signed their key too. Still only two of them appear in Wotsap. Yesterday I thought this was related with the "sig 3", but now I see that one of my signatures is "sig 3" and the other one just "sig".

Since the Swiss key server does not respond, I was unable to check out what you suggested in the FAQ. I'll do it as soon as it's online and post the results.

I just realized that the keyserver is not down, just the separate web server on port 80 on the same machine which contained the search forms. The web server answering the queries is still up. There is a mirror of the search forms at http://www.tik.ee.ethz.ch/~pgp/ , and you can use gpg as a client.

I took a look at your missing signatures, and the problem in both cases seemed to be unsigned or missing keys on the key server. If you upload those two keys manually to the key server, they should become included.

0xEF93F89B appears to be available on other key servers but not on wwwkeys.ch.pgp.net so, for some reason, the key server was not completely synced. I couldn't find 0xCE74F8D8 with signatures on any server.

I have now updated http://www.lysator.liu.se/~jc/wotsap/faq.html with information about the form mirror and synchronization problems.

Regards, Jörgen