security-and-privacy/gnupg
security-and-privacy
/
gnupg
mirror of git://git.gnupg.org/gnupg.git
1
0
Fork 0
Code Activity

gpg: Obsolete --no-sig-create-check. 

* g10/gpg.c (opts): Make --no-sig-create-check a NOP.
* g10/options.h (struct opt): Remove field "no_sig_create_check".
* g10/sign.c (do_sign): Do not run the create check for Libgcrypt 1.7.

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2015-08-31 23:35:32 +02:00
parent 80521c3ff9
commit 60b0403f3c
No known key found for this signature in database
GPG Key ID: E3FDFF218E45B72B
4 changed files with 12 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
doc/gpg.texi
View File

@ -1719,12 +1719,7 @@ can be done if someone else has write access to your public keyring.
@item --no-sig-create-check
@opindex no-sig-create-check
GnuPG normally verifies each signature right after creation to protect
against bugs and hardware malfunctions which could leak out bits from
the secret key. This extra verification needs some time (about 115%
for DSA keys), and so this option can be used to disable it.
However, due to the fact that the signature creation needs manual
interaction, this performance penalty does not matter in most settings.
This option is obsolete. It has no function.
@item --auto-check-trustdb
@itemx --no-auto-check-trustdb

4
g10/gpg.c
View File

@ -331,7 +331,6 @@ enum cmd_and_opt_values
oNoExpensiveTrustChecks,
oFixedListMode,
oNoSigCache,
oNoSigCreateCheck,
oAutoCheckTrustDB,
oNoAutoCheckTrustDB,
oPreservePermissions,
@ -697,7 +696,6 @@ static ARGPARSE_OPTS opts[] = {
ARGPARSE_s_n (oAutoKeyRetrieve, "auto-key-retrieve", "@"),
ARGPARSE_s_n (oNoAutoKeyRetrieve, "no-auto-key-retrieve", "@"),
ARGPARSE_s_n (oNoSigCache, "no-sig-cache", "@"),
ARGPARSE_s_n (oNoSigCreateCheck, "no-sig-create-check", "@"),
ARGPARSE_s_n (oAutoCheckTrustDB, "auto-check-trustdb", "@"),
ARGPARSE_s_n (oNoAutoCheckTrustDB, "no-auto-check-trustdb", "@"),
ARGPARSE_s_n (oMergeOnly, "merge-only", "@" ),
@ -776,6 +774,7 @@ static ARGPARSE_OPTS opts[] = {
/* Dummy options. */
ARGPARSE_s_n (oNoop, "sk-comments", "@"),
ARGPARSE_s_n (oNoop, "no-sk-comments", "@"),
ARGPARSE_s_n (oNoop, "no-sig-create-check", "@"),
ARGPARSE_end ()
};
@ -2816,7 +2815,6 @@ main (int argc, char **argv)
}
break;
case oNoSigCache: opt.no_sig_cache = 1; break;
case oNoSigCreateCheck: opt.no_sig_create_check = 1; break;
case oAllowNonSelfsignedUID: opt.allow_non_selfsigned_uid = 1; break;
case oNoAllowNonSelfsignedUID: opt.allow_non_selfsigned_uid=0; break;
case oAllowFreeformUID: opt.allow_freeform_uid = 1; break;

1
g10/options.h
View File

@ -194,7 +194,6 @@ struct
int try_all_secrets;
int no_expensive_trust_checks;
int no_sig_cache;
int no_sig_create_check;
int no_auto_check_trustdb;
int preserve_permissions;
int no_homedir_creation;

13
g10/sign.c
View File

@ -291,10 +291,16 @@ do_sign( PKT_secret_key *sk, PKT_signature *sig,
gcry_mpi_release (frame);
}
if (!rc && !opt.no_sig_create_check) {
if (!rc
#if GCRYPT_VERSION_NUMBER >= 0x010700 /* Libgcrypt >= 1.7 */
&& is_DSA (sk->pubkey_algo)
#endif /* Libgcrypt >= 1.7 */
)
{
/* Check that the signature verification worked and nothing is
* fooling us e.g. by a bug in the signature create
* code or by deliberately introduced faults. */
* fooling us e.g. by a bug in the signature creation code or by
* deliberately introduced faults. Libgcrypt 1.7 includes
* this check for RSA and thus we don't need it in that case. */
PKT_public_key *pk = xmalloc_clear (sizeof *pk);
if( get_pubkey( pk, sig->keyid ) )
@ -312,6 +318,7 @@ do_sign( PKT_secret_key *sk, PKT_signature *sig,
g10_errstr (rc));
free_public_key (pk);
}
if( rc )
log_error(_("signing failed: %s\n"), g10_errstr(rc) );
else {