Arch Linux

pacman-key should be checking that the first field is "pub", instead of ignoring it, but I'm more interested in this comment...

# Read the revoked key IDs to an array. The conversion from whatever is
# inside the file to key ids is important, because key ids are the only
# guarantee of identification for the keys.

...and to be honest, I don't see why it does the conversion in the first place. I mean, it immediately gives the "converted" key IDs to the *same* GnuPG which converted them in the first place... wouldn't it achieve exactly the same by using each line from foo-revoked directly with `gpg --edit-key`?

Not to mention that `archlinux-revoked` currently contains the full 160-bit fingerprint of the revoked key. It is a *better* identifier than a 64-bit key ID, so requiring foo-revoked lists to have the fingerprints would be better than wasting time with the conversion.

I agree that requiring the complete key id makes sense here.

Also: atm the script fails silently when trying to disable invalid keys. It would be better to bail on any error here. It's quite important to know that disabling a key way successful.

Sadly, gpg can't tell you when disabling the key fails in batch mode. It simply doesn't output anything when it fails. We'll have to figure out something a little more clever here, even if it's something as stupid as checking the status of the key post-disabling.

+1 to interpreting data from -revoked file as real IDs. I see no reason that we should be leaving these up to "interpretation".