seahorse issues in trust functions

Bug #304565 reported by marco.pallotta
24
This bug affects 3 people
Affects Status Importance Assigned to Milestone
seahorse
Fix Released
Medium
seahorse (Ubuntu)
Fix Released
Medium
Unassigned

Bug Description

I have noticed that the trusting functions in seahorse are misleading and don't work very well (to be the truth are a disaster). In fact we have (I have an italian translation so I hope to translate correctly):
- the option "I have verified that this key is owned by <<USER>>" in the trust tab of the key properties
- the trust care ("no care", "random care", "very carefully") in the verifying procedure of the key in the sign key window

Now, once imported, I have the opportunity to sign a key only with the "sign" button (in fact to sign the key with the sign button in the trust tab I have to enable the option "I have verified that this key is owned by <<USER>>): this is the first bug, in fact I find correct to sign a key only after having verified the ownership of the key but seahorse also permits to me to sign the key via sign button in the main window without checking the option described before. Now this bug brings to a paradoxical bug as we can have a key signed, after verifying its ownership very carefully, without having checked the option "I have verified that this key is owned by <<USER>>" and the key is not placed in the "trust keys" tab in the main seahorse window.
Then, after signing the key, if I open the key properties to check the option "I have verified that this key is owned by <<USER>>", to remove the paradox and to place the key in the trust tab, the fact that the key were signed disappears (people that signed the key disappears) in the trust tab and appears the button "sign this key" (another bug as I already signed the key). I don't sign it again, but I close the property window and then I reopen it. All seems to be ok now:
- the option "I have verified that this key is owned by <<USER>>" is checked
- the sign button is not present but there is a "revoke the sign" button in grey (is this another bug? How can I revoke the key if I created it with this possibility but the button is always not selectable?)
- people that signed the key are showed

Now If I go to the "detail" tab to select the trust level and then I go again in the trust tab all the above scenario disappears again and the "trust this key" button is already showed (another bug). So I have to close the property window and reopen it to show a correct situation.

I'm with Ubuntu Hardy x86_64 and seahorse 2.22.2-0

Revision history for this message
Mackenzie Morgan (maco.m) wrote :

After all that, are you listed as one of the people that signed the key?

I think the simplest course of action would be to just remove the right-click->Sign This Key option.

description: updated
Changed in seahorse:
importance: Undecided → Medium
status: New → Incomplete
Revision history for this message
marco.pallotta (marco-pallotta) wrote :

After all the bugs I described I'm as one of the people that signed the key or, however, sorehorse shows this (I think I have to go to command line to verify this to be sure at 100% as bug 304539)
I think we cannot only remove the right-click -> sign this key option but, at this point, also the sign button in the main window. I think the better solution is to show the "trust" tab of the key properties either after clicking on the sign button or after right clicking - "Sign This", so we are sure that the user will sign a key only after having checked the option "I have verified that this key is owned by <<USER>>". At last we'll have unified the signing procedure in logical way.

Revision history for this message
Mackenzie Morgan (maco.m) wrote : Re: [Bug 304565] Re: seahorse issues in trust functions

Ah, I didn't see the Sign button in the main window. You're right. It
should only be accessible from the same place as "I've verified..." or
at the very *least* it should be grey for any key that doesn't have that
checkbox marked.

Er, you said that it listed all the signers in the box on the "I've
verified..." windows. Are you visible in there?

Revision history for this message
marco.pallotta (marco-pallotta) wrote :

Morgan, yes, I'm visible in that window (only I signed the key).

Revision history for this message
Mackenzie Morgan (maco.m) wrote :

Wait...I can't reproduce this in Intrepid.

If I do any of the following, the same window comes up:
- Right-click -> Sign
- "Sign" button on toolbar
- Right-click -> Properties -> Trust -> "Sign this Key"

That window asks how carefully the key has been checked. It does not have any requirements on checking the key, so there is no inconsistency.

Nowhere in Seahorse do I see "I have verified that this key is owned by <<USER>>" at all. The Trust tab's only checkbox is "I trust signatures from ____ on other keys." Checking that checkbox is not a requirement to hit the "Sign this Key" button next to it.

Either it changed between 8.04 and 8.10 or the Italian translation is wrong. Trying to see in #ubuntu-it if anyone can translate the current one to see if it changed.

Changed in seahorse:
status: Incomplete → New
Revision history for this message
Mackenzie Morgan (maco.m) wrote :

LjL in #ubuntu-it says that the Italian translation in 8.10 matches with what the English 8.10 says, and the Seahorse dev says he's pretty sure that was one of the Seahorse 2.22 -> 2.24 changes. So, I'm marking it Fix Released.

Changed in seahorse:
status: New → Fix Released
Revision history for this message
marco.pallotta (marco-pallotta) wrote :

Morgan, I have to contradict to you as I can confirm in Intrepid almost all I have posted. I made tests with Intrepid live and with seahorse 2.24.1. In fact:
1) I imported a key with "import remote keys" button, I signed it (with "sign" button or with "sign" option in the context menu opened with mouse right button makes not difference), I went to trust tab in key properties and I selected "trust signatures from ... on the other keys" and then the first bug appears as the "sign this key" button (in the same tab) is showed as I didn't sign this key (but I just signed it). If I close this window and then I reopen it the "sing this key" disappears and a grey button "revoke signature" is showed but I have created the key with the ability to revoke it.
2) I imported a key in my keyring, I opened the trust tab in key properties and I signed the key with the button I find in this tab. When signed a new "sign this key" button is showed again. If I close this window and then I re-open it all seems ok.
3) After importing and signing a key I went to the "detail" tab to select the trust level and then I went to the trust tab: the "sign this key" button is showed again, so I have to close the property window and reopen it to show a correct situation.

At last the only thing fixed is the fact that the option "I have verified that this key is owned by <<USER>>" in the trust tab of the key properties is present no more.

Changed in seahorse:
status: Fix Released → New
Revision history for this message
Mackenzie Morgan (maco.m) wrote :

O_O OK, I'm playing with that checkbox some more, and I'm still not sure we're seeing the same thing, but I *am* seeing some odd behaviour in the Sign/Revoke button. Every time I check/uncheck the checkbox, the signature list appears for a moment and the button goes to "Revoke" mode, then wait 2 seconds and it switches to not having a list and being the "Sign" button.

Revision history for this message
Mackenzie Morgan (maco.m) wrote :

I talked to the upstream developer yesterday, and he said the oddness of the checkbox is in current trunk still. The GNOME bug is now attached.

Changed in seahorse:
status: New → Confirmed
Changed in seahorse:
status: Confirmed → Triaged
Changed in seahorse:
status: Unknown → Confirmed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package seahorse - 2.26.0-0ubuntu1

---------------
seahorse (2.26.0-0ubuntu1) jaunty; urgency=low

  * New upstream version: (LP: #343457)
    - Fix cancel button in 'Add keyring' dialog.
    - Update GUI before showing window, to avoid GUI changes
      when selection is initialized.
    - Allow multiple "Sync and Publish" windows to open.
    - Disable input method in password prompt.
    - Fix various crashers, and smaller bugs.
      (LP: #289516, #327481, #304565)
  * debian/patches
    - updated 08_force_ssh.patch to apply cleanly
    - updated 80_autoconf_update.patch to apply cleanly

 -- Andreas Moog <email address hidden> Mon, 16 Mar 2009 02:21:36 +0100

Changed in seahorse:
status: Triaged → Fix Released
Changed in seahorse:
status: Confirmed → Fix Released
Changed in seahorse:
importance: Unknown → Medium
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.