Why is Debian not showing the GPG signatures on keys that Arch Linux is?

Question

I downloaded a Qubes OS ISO and I'm trying to verify its legitimacy using this guide. GPG was behaving weirdly, so I created a separate user with a separate keyring to reproduce the issue.

When I try to verify the key on my Debian system, the signature on the release signing key is not there:

$ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc
gpg: directory '/home/test/.gnupg' created
gpg: keybox '/home/test/.gnupg/pubring.kbx' created
gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc'
gpg: /home/test/.gnupg/trustdb.gpg: trustdb created
gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported
gpg: Total number processed: 1
gpg:               imported: 1
$ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-release-4-signing-key.asc
gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-release-4-signing-key.asc'
gpg: key 1848792F9E2795E9: public key "Qubes OS Release 4 Signing Key" imported
gpg: Total number processed: 1
gpg:               imported: 1
$ gpg --list-sigs "Qubes OS"
pub   rsa4096 2017-03-06 [SC]
      5817A43B283DE5A9181A522E1848792F9E2795E9
uid           [ unknown] Qubes OS Release 4 Signing Key
sig 3        1848792F9E2795E9 2017-03-06  Qubes OS Release 4 Signing Key
$

I expected another line with a signature from the master key, such as

sig          DDFA1A3E36879494 2017-03-08  Qubes Master Signing Key

Surprised, I decided to check on another system. This one is running Arch Linux. I trust it less than the Debian system. Perplexingly, the signature does show up — the output is just as above, but with the added signature line.

The GPG version is 2.2.17 on both machines.

What could be causing this discrepancy?

Answer 1

The root cause here is that

the GnuPG developers broke gpg completely in a panic reaction

-- @knoblauchkeks on Twitter

As explained in the release notes for GnuPG 2.2.17,

Ignore all key-signatures received from keyservers. This change is required to mitigate a DoS due to keys flooded with faked key-signatures. The old behaviour can be achieved by adding

keyserver-options no-self-sigs-only,no-import-clean

to your gpg.conf. [#4607]

Adding this line to my (previously non-existent) ~/.gnupg/gpg.conf and re-fetching the release key fixed the issue.

This does not happen on Arch Linux because the maintainers decided to revert the commit that introduced this behavior, which can be seen in the build scripts for the package:

prepare() {
    # ...
    patch -R -p1 -i ../self-sigs-only.patch
}

I reported this issue to Qubes, suggesting the documentation be modified to account for this in some way.