1830094 - Cannot create OpenPGP key without expiration, always 2 years expiration are used.

Status: RESOLVED FIXED

(MailNews Core :: Security: OpenPGP, defect)

Description

[Kai Engert [:KaiE:]]

Use OpenPGP key manager to generate a new key.
Select "Key does not expire".
Generate the key.

Actual incorrect behavior:
A key is created that will expire after two years.

But can be reproduced using TB 113 beta and TB 114 nightly.

Comment 1

[Kai Engert [:KaiE:]]

I can reproduce this bug using Thunderbird version 102.10, too :(

Comment 2

[Kai Engert [:KaiE:]]

When generating the key, and a zero expiration is wanted, Thunderbird will NOT call rnp_op_generate_set_expiration.

I wonder why this was never noticed before.

Nickolay, maybe the default library behavior changed during one of the past releases?
Maybe in the past RNP considered no call to rnp_op_generate_set_expiration as a zero expiration, and now it uses a default 2 year expiration period?

Comment 3

[Kai Engert [:KaiE:]]

Attachment: Bug 1830094 - When generating a non-expiring OpenPGP key, call rnp_op_generate_set_expiration(0). r=mkmelin

Comment 4

[Nickolay Olshevsky]

Kai, yeah, the default key expiration time was changed in v0.16.1 via this PR: https://github.com/rnpgp/rnp/pull/1773/

Comment 5

[Kai Engert [:KaiE:]]

I see you have announced it in the release noted.
https://github.com/rnpgp/rnp/releases/tag/v0.16.1

I blame myself for not noticing it.
We need to learn from this.

Going forward, whenever we will update RNP again, we must carefully study all release notes, and investigate each change for potential effects.

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/0f79964a014f
When generating a non-expiring OpenPGP key, call rnp_op_generate_set_expiration(0). r=mkmelin

Comment 7

[Kai Engert [:KaiE:]]

Comment on attachment 9330405 [details]
Bug 1830094 - When generating a non-expiring OpenPGP key, call rnp_op_generate_set_expiration(0). r=mkmelin

[Approval Request Comment]
Regression caused by (bug #): 1790116
User impact if declined: False OpenPGP key meta information is used
Testing completed (on c-c, etc.): manually
Risk to taking this patch (and alternatives if risky): very low

Comment 8

[Wayne Mery (:wsmwk)]

Comment on attachment 9330405 [details]
Bug 1830094 - When generating a non-expiring OpenPGP key, call rnp_op_generate_set_expiration(0). r=mkmelin

[Triage Comment]
Approved for beta

Comment 9

[Daniel Darnell [:dandarnell]]

Thunderbird 113.0b6:
https://hg.mozilla.org/releases/comm-beta/rev/efe3f192e88e

Comment 10

[Wayne Mery (:wsmwk)]

Probably safe but beta hasn't shipped yet, so skipping 102.11.0.

Comment 11

[Wayne Mery (:wsmwk)]

Comment on attachment 9330405 [details]
Bug 1830094 - When generating a non-expiring OpenPGP key, call rnp_op_generate_set_expiration(0). r=mkmelin

[Triage Comment]
Approved for esr102

Comment 12

[Rob Lemley [:rjl]]

Thunderbird 102.11.1:
https://hg.mozilla.org/releases/comm-esr102/rev/7dd849695ba3