public/private key import does not work for key with multiple signature expire dates
Categories
(MailNews Core :: Security: OpenPGP, defect)
Tracking
(Not tracked)
People
(Reporter: alexlehm, Unassigned)
Details
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
Steps to reproduce:
I imported my private/public key which exported from GNUPK with gpg before, when importing, they key was listed as expired since it had a key signature from 2018 and one from 2021, which happened when I extended the expire time the last time I assume. After importing the keypair and then importing the public key once again as retrieved from the public key servers, the expire date changed to 2021 and the key works now.
The url for the public key is http://keys.gnupg.net/pks/lookup?op=vindex&fingerprint=on&search=0x35C831A44747B001, i cannot provide the private key of course.
Actual results:
The key import used the first key signature regardless of the signature date and so imported the already expired signature which deactivated the key in thunderbird.
Expected results:
I would guess it should scan through the multiple signature if there are multiple present and discard the ones that are already expired and use the one with an expire date farthest in the future.
Description
•