PGPkeys EU<p>First steps towards more robust sync! </p><p><a href="https://infosec.exchange/tags/Hockeypuck" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Hockeypuck</span></a>’s dataset normalisation rules (or “filters”) were updated between v2.1 and v2.2, meaning that <a href="https://infosec.exchange/tags/SKS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SKS</span></a> recon did not work between <a href="https://infosec.exchange/tags/openpgp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>openpgp</span></a> <a href="https://infosec.exchange/tags/keyservers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>keyservers</span></a> running the older and newer versions. The keyservers could not all be updated simultaneously, and a few keyservers still run v2.1 today for compatibility reasons, so we had to find a way to prevent the network from split-braining.</p><p>The quick and dirty solution was a small script that runs on each side of the filter discontinuity, polls for local changes, and submits them to the other side over HKP (the protocol your <a href="https://infosec.exchange/tags/PGP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PGP</span></a> client uses). But this is effectively the same idea as the old PKS sync model, just over HTTP(S) instead of email. And sks-keyserver used to support PKS-over-email, so shouldn’t hockeypuck be able to do PKS-over-HTTP natively?</p><p>The short answer is, it can! It was long intended for hockeypuck to support PKS email, but only a fraction of the necessary code was written, and there were no tests. Today, the pgpkeys test swarm has just performed its first sync using the completed PKS code, which supports *both* HTTP and email transport.</p><p>It’s not ready for production yet though. Further testing is required, and then the second part of the PKS code can be written: automatic failover from SKS to PKS when filter mismatch is detected (and just as importantly, automatic fail*back*).</p><p>This will mean that keyserver operators will be able in the future to upgrade across filter discontinuities without risking a split brain scenario. It should also mean that key updates submitted to the hockeypuck network could be automatically synced to <span class="h-card" translate="no"><a href="https://floss.social/@keys_openpgp_org" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>keys_openpgp_org</span></a></span> … watch this space! 😎</p><p>(Hockeypuck v2.3 development is kindly supported by <span class="h-card" translate="no"><a href="https://mastodon.xyz/@NGIZero" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>NGIZero</span></a></span> Core)</p>