search

EFForg / cryptobot-email

GNU Affero General Public License v3.0
61 stars 11 forks source link

Key lookup is brittle #32

Open liliakai opened 10 years ago

liliakai commented 10 years ago

Currently when bot.py looks for it's own key it matches very strictly against the configured name and email:

    expected_uid = '{0} <{1}>'.format(config.PGP_NAME, config.PGP_EMAIL)
    fingerprint = gpg.has_secret_key_with_uid(expected_uid)

If I happen to change cryptobot's pgp name in config.py it will fail to find its own key. Same if I generate a gpg key with something in the comment field, e.g., "Crypto Bot (TEST) cryptobot@eff.org".

Suggest modifying GnuPG::has_secret_key_with_uid to list all keys for config.PGP_EMAIL and take the first one. For bonus points, add a key id config, just in case you have generated multiple keys for cryptobot.