Incomplete key comparison in clone

[14mRh4X0r]

Summary

On gopass clone with GPG, gopass checks whether we already have access to the cloned repository by comparing our usable keys to the keys listed in .gpg-id. However, this is a string comparison. While .gpg-id allows for any GPG-approved way to specify a key, gopass will use short form keys (e.g. 0x17F3ED51DADD9393) to compare.

Steps To Reproduce

1. Have a repository with one of your keys in a non-short form in .gpg-id
2. gopass clone the repository
3. gopass will reply with "Please ask the owner of the password store to add one of your keys"

Expected behavior

In step 3: gopass will reply with "Found valid decryption keys. You can now decrypt your passwords."

Environment

• OS: Arch Linux
• OS version: Linux vischium 6.11.5-arch1-1 Add template feature #1 SMP PREEMPT_DYNAMIC Tue, 22 Oct 2024 18:31:38 +0000 x86_64 GNU/Linux
• gopass Version: gopass 1.15.15 go1.23.3 linux amd64
• Installation method: pacman