keybase / keybase/client

Can't login to update key or curl submit

Open
#14,691 6 comments 1 reaction 0 assignees View on GitHub
Dominant language
Go
Stars
9.2k
Forks
1.3k
PR merge metrics
PR metrics pending

Description

keybase-user: robbat2
log-id: 29b76c3b9bb947b1ed62671c

```
$ keybase login robbat2
▶ ERROR during GPG provisioning.
We were able to generate a PGP signature with gpg client, but it was rejected by the server. This often means that this PGP key is expired or unusable. You can update your key on https://keybase.io
▶ ERROR Key corrupted: Could not open key: no valid primary key self-signature or key(s) have expired
```

And using the gpg+curl method to sign the update, I get:
```
Error in your post
-------------------

Code: 915
Name: KEY_BAD_UIDS
Description: You can't delete your keybase.io username
* Connection #0 to host keybase.io left intact
```

w/ `curl -v`:
```
* Trying 52.6.136.121...
* TCP_NODELAY set
* Connected to keybase.io (52.6.136.121) port 443 (#0)
* Initializing NSS with certpath: none
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: none
* ALPN, server accepted to use http/1.1
* SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* Server certificate:
* subject: CN=keybase.io,OU=PositiveSSL,OU=Domain Control Validated
* start date: May 18 00:00:00 2018 GMT
* expire date: Jun 17 23:59:59 2019 GMT
* common name: keybase.io
* issuer: CN=COMODO RSA Domain Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
> POST /_/api/1.0/key/add.json HTTP/1.1
> Host: keybase.io
> User-Agent: curl/7.55.0
> Accept: */*
> Content-Length: 32271
> Content-Type: application/x-www-form-urlencoded
> Expect: 100-continue
>
< HTTP/1.1 100 Continue
* We are completely uploaded and fine
< HTTP/1.1 200 OK
< Date: Wed, 14 Nov 2018 23:45:38 GMT
< Content-Type: text/html; charset=utf-8
< Content-Length: 124
< Connection: keep-alive
< Vary: X-HTTP-Method-Override
< X-Frame-Options: SAMEORIGIN
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< ETag: W/"7c-u/3tVHjxbrkDn/M1Q9l6mH44TX8"
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
<
Error in your post
-------------------

Code: 915
Name: KEY_BAD_UIDS
Description: You can't delete your keybase.io username
* Connection #0 to host keybase.io left intact
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the `keybase login robbat2` GPG provisioning flow and the `/_/api/1.0/key/add.json` endpoint shown in the report. Reproduce the expired-key and `KEY_BAD_UIDS` cases, then trace how the client submits the key update; done means the user can update the key and log in without either error.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.