revoked uid(s) are listed in list_keys() -> uids: []

[pettai]

Describe the bug
revoked uid(s) are listed in list_keys() -> uids: []

To Reproduce
Steps to reproduce the behavior:

1. create or use a existing key
2. gpg --edit-key <keyid>
3. add a uid
4. revoke the added uid
5. list the keys using gpg -k (doesn't list revoked uid(s))

pub   rsa4096 2025-01-17 [SC]
      F35AA3797588C94A8ZXXXXXXXXXXXXXXX
uid           [ unknown] My Name <mail@some.mail>
uid           [ unknown] My Name <othermail@somewhere.else>
[...]

7. list keys using list_keys() (shows the revoked uid in uids: [])

[...], 'uids': ['My Name <mail@some.mail>', 'My Name <othermail@somewhere.else>', 'My Name <this_is_revoked@email.address>', [...] ]

(gpg --edit-key <keyid> shows that it's revoked)

[...]
pub  rsa4096/XXXXXXXXXXXXXXX
     created: 2025-01-17  expires: never       usage: SC
     trust: unknown       validity: unknown
[...]
[ unknown] (1). My Name <mail@some.mail>
[ unknown] (2)  My Name <othermail@somewhere.else>
[ revoked] (3)  My Name <this_is_revoked@email.address>
[...]

Expected behavior
Hide the revoked uid(s) in uids: [] and perhaps add an option to list_keys(uids=False) (default) == don't list revoked uid(s), and uids=True lists all + revoked uids)

Environment

• Ubuntu 22.04
• python-gnupg 0.5.3 aswell as 0.5.2-1

[pettai]

This shows it
gpg --with-colons --fixed-list-mode -k

[...]
uid:-::::1739363958::<key>::My Name <mail@some.mail>::::::::::0:
uid:-::::1739445653::<key>::My Name <othermail@somewhere.else>::::::::::0:
uid:r::::::<key>::My Name <this_is_revoked@email.address>::::::::::0:
[...]

Looks like the timestamp is removed from the revoked uid and "-" is changed to "r"

[vsajip]

Or perhaps return all the keys, but mark the revocation status for each key? Rather than add another flag parameter to the list_keys API?

Also, of course, people might be relying on the current behaviour. Possibly the answer is to leave the existing uids attribute alone and populate a new attribute with more information including timestamps, revocation status etc.

[pettai]

For me, just hiding all revoked uids is good enough 👍
Either a nob to get them not listed or an attribute that can be used to filter on...

[vsajip]

Well, list_keys lists keys, and a key could have multiple uids, some of which are revoked. I would prefer to return the low-level data from gpg - e.g. list_keys result gets an attribute called uid_map, which maps uids to dicts with information about those uids. You would have to look at this map to establish the status of particular uids. Also, gpg is a user-level tool that makes certain decisions (which could change from version to version), it's better for a lower-level tool like python-gnupg to return the relevant data to the user (here, a developer) and let them decide what to do with that data.

[vsajip]

Example of how the change would be documented:

New in version 0.5.5: The returned value from list_keys() now has a new attribute, uid_map, which is a dictionary mapping uids to dicts with detailed information about the corresponding uid. The keys of the information provided are listed in the table above. Refer to the GnuPG documentation for more information.

You could use this information as in the following example:

>>> import gnupg
>>> gpg = gnupg.GPG(...)
[....]
>>> from pprint import pprint
>>> keys = gpg.list_keys()
>>> pprint(keys.uids)
['Andrew Able (A test user) <andrew.able@alpha.com>',
 'Barb Bruin <barb.bruin@beta.com>',
 'Babs Broon <babs.broon@beta.com>',
 'Barbara Brown (A test user) <barbara.brown@beta.com>',
 'Charlie Clark (A test user) <charlie.clark@gamma.com>',
 'Donna Davis (A test user) <donna.davis@delta.com>']
>>> pprint(keys.uid_map['Barbara Brown (A test user) <barbara.brown@beta.com>'])
{'algo': '',
 'date': '1739485458',
 'dummy': '8B989767967370B894C53279A3BDF655F00CD4DE',
 'expires': '',
 'keyid': '',
 'length': '',
 'ownertrust': '',
 'sig': '',
 'trust': 'u',
 'type': 'uid',
 'uid': 'Barbara Brown (A test user) <barbara.brown@beta.com>'}
>>> pprint(keys.uid_map['Barb Bruin <barb.bruin@beta.com>'])
{'algo': '',
 'date': '1739485886',
 'dummy': '951261047308BCA0B45FD738AD8630B336B88ECF',
 'expires': '',
 'keyid': '',
 'length': '',
 'ownertrust': '',
 'sig': '',
 'trust': 'u',
 'type': 'uid',
 'uid': 'Barb Bruin <barb.bruin@beta.com>'}
>>> pprint(keys.uid_map['Babs Broon <babs.broon@beta.com>'])
{'algo': '',
 'date': '',
 'dummy': '2BDB74660AC54DF33DE523429386E2D460904E74',
 'expires': '',
 'keyid': '',
 'length': '',
 'ownertrust': '',
 'sig': '',
 'trust': 'r',
 'type': 'uid',
 'uid': 'Babs Broon <babs.broon@beta.com>'}
>>>

The first two of these dictionaries show normal uids (trust is 'u', for ultimate), whereas the third shows a revoked uid (trust is 'r', for revoked).

[pettai]

That looks good, is uid_map['Babs Broon <babs.broon@beta.com>'] with 'trust': 'r' an example of a revoked uid?

[vsajip]

is ... an example of a revoked uid?

Yes, as I say at the foot of my last comment 😄

[pettai]

is ... an example of a revoked uid?

Yes, as I say at the foot of my last comment 😄

Doh! 👀 I was very tired and not fully awake then I read that...
Thanks for a swift fix!