This repository has been archived by the owner on Apr 26, 2024. It is now read-only.
Error fetching matrix.org:ed25519:auto from key server
#6596
Assignees
Labels
z-bug
(Deprecated Label)
Comments
|
this is probably stopping back-pagination working in lots of places :/ |
|
i'd vote for either option 4 (stopgap for over christmas) or option 3 (everyone should be keeping updated anyway, although i'm a bit worried that we don't understand the key query response handling logic) |
richvdh
added a commit
that referenced
this issue
Jan 3, 2020
As a notary server, when we return our own keys, include all of our signing keys in verify_keys. This is a workaround for #6596.
richvdh
added a commit
that referenced
this issue
Jan 3, 2020
Lift the restriction that *all* the keys used for signing v2 key responses be present in verify_keys. Fixes #6596.
richvdh
added a commit
that referenced
this issue
Jan 6, 2020
* Kill off redundant SynapseRequestFactory We already get the Site via the Channel, so there's no need for a dedicated RequestFactory: we can just use the right constructor. * Workaround for error when fetching notary's own key As a notary server, when we return our own keys, include all of our signing keys in verify_keys. This is a workaround for #6596.
richvdh
added a commit
that referenced
this issue
Jan 6, 2020
Lift the restriction that *all* the keys used for signing v2 key responses be present in verify_keys. Fixes #6596.
|
fixed by #6625 |
|
except that we now have a different error: |
|
This happens every 24 hours or so, because matrix.org publishes its keys with a refresh interval of 24 hours (ie, the default). It's actually not as bad as it appears, because once the lookup fails on the keyserver, it falls back to a direct lookup, which works fine. Still, it looks like the notary server is now publishing broken responses (presumably as a result of #6620), which is a thing we should fix. |
|
hopefully fixed (again) by #6657 |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Attempts to fetch
matrix.org'sed25519:autokey from the key server currently result in the following error:The problem is that (as per #5573), we recently rotated out the
ed25519:autokey, so it now appears in theverify_keys(rather than theold_verify_keys) field in the response. However, we still sign the response withed25519:auto, supposedly for compatibility with synapses which are configured to require that the notary response be signed with that key (which will include all those with configs predating #5374 / Synapse 1.0.0).For reasons which I don't entirely understand, the code which handles the response to the key query (https://github.com/matrix-org/synapse/blob/v1.7.2/synapse/crypto/keyring.py#L513-L521) requires that each key used to sign the response appears in
verify_keys.Options for a fix include:
Un-rotate the key, making
ed25519:autothe primary key again. However, everyone in the federation now believes thated25519:autostopped being used on the 19th December, and will reject everything generated thereafter. So this is a non-option.Stop signing with
ed25519:auto. This may break compatibility with Synapses configured to require that key.Release a version of synapse which removes the check that all keys used for the signature be in
verify_keysin the response.Somehow hack the matrix.org notary server to include
ed25519:autoin theverify_keysresponse, despite it no longer being an active key.The text was updated successfully, but these errors were encountered: