1 files changed, 51 insertions, 0 deletions
diff --git a/main/gnupg/0420-gpg-drop-import-clean-from-default-keyserver-import-options.patch b/main/gnupg/0420-gpg-drop-import-clean-from-default-keyserver-import-options.patch
new file mode 100644
index 00000000000..26098e791fd
--- /dev/null
+++ b/main/gnupg/0420-gpg-drop-import-clean-from-default-keyserver-import-options.patch
@@ -0,0 +1,51 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Mon, 15 Jul 2019 16:24:35 -0400
+Subject: gpg: drop import-clean from default keyserver import options
+
+* g10/gpg.c (main): drop IMPORT_CLEAN from the
+default opt.keyserver_options.import_options
+* doc/gpg.texi: reflect this change in the documentation
+
+Given that SELF_SIGS_ONLY is already set, it's not clear what
+additional benefit IMPORT_CLEAN provides.  Furthermore, IMPORT_CLEAN
+means that receiving an OpenPGP certificate from a keyserver will
+potentially delete data that is otherwise held in the local keyring,
+which is surprising to users who expect retrieval from the keyservers
+to be purely additive.
+
+GnuPG-Bug-Id: 4628
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ doc/gpg.texi | 2 +-
+ g10/gpg.c    | 3 +--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+Patch-Source: https://sources.debian.org/data/main/g/gnupg2/2.2.27-2/debian/patches/gpg-drop-import-clean-from-default-keyserver-import-optio.patch
+
+diff --git a/doc/gpg.texi b/doc/gpg.texi
+index 804ecf9..b238278 100644
+--- a/doc/gpg.texi
++++ b/doc/gpg.texi
+@@ -2047,7 +2047,7 @@ are available for all keyserver types, some common options are:
+ 
+ @end table
+ 
+-The default list of options is: "self-sigs-only, import-clean,
++The default list of options is: "self-sigs-only,
+ repair-keys, repair-pks-subkey-bug, export-attributes". However, if
+ the actual used source is an LDAP server "no-self-sigs-only" is
+ assumed unless "self-sigs-only" has been explicitly configured.
+diff --git a/g10/gpg.c b/g10/gpg.c
+index 68c0454..205de60 100644
+--- a/g10/gpg.c
++++ b/g10/gpg.c
+@@ -2441,8 +2441,7 @@ main (int argc, char **argv)
+ 					    | IMPORT_REPAIR_PKS_SUBKEY_BUG
+                                             | IMPORT_SELF_SIGS_ONLY
+                                             | IMPORT_COLLAPSE_UIDS
+-                                            | IMPORT_COLLAPSE_SUBKEYS
+-                                            | IMPORT_CLEAN);
++                                            | IMPORT_COLLAPSE_SUBKEYS);
+     opt.keyserver_options.export_options = EXPORT_ATTRIBUTES;
+     opt.keyserver_options.options = 0;
+     opt.verify_options = (LIST_SHOW_UID_VALIDITY