diff --git a/NEWS b/NEWS index 4d7fb80b6..583485d01 100644 --- a/NEWS +++ b/NEWS @@ -20,6 +20,8 @@ Noteworthy changes in version 2.4.6 (unreleased) * gpg: ADSKs are now configurable for new keys. [T6882] + * gpg: New option --proc-all-sigs. [T7261] + * gpgsm: Emit user IDs with an empty Subject also in colon mode. [T7171] diff --git a/doc/gpg.texi b/doc/gpg.texi index 493e89277..7e80a293a 100644 --- a/doc/gpg.texi +++ b/doc/gpg.texi @@ -264,6 +264,11 @@ out the actual signed data, but there are other pitfalls with this format as well. It is suggested to avoid cleartext signatures in favor of detached signatures. +Note: With option @option{--batch} he verification of signatures stops +at the first bad signature. This is a safe default for unattended +processing but sometimes a status for all signatures is needed. To +override this early bailout use the option @option{--proc-all-sigs}. + Note: To check whether a file was signed by a certain key the option @option{--assert-signer} can be used. As an alternative the @command{gpgv} tool can be used. @command{gpgv} is designed to @@ -1371,6 +1376,12 @@ Assume "yes" on most questions. Should not be used in an option file. Assume "no" on most questions. Should not be used in an option file. +@item --proc-all-sigs +@opindex proc-all-sigs +This option overrides the behaviour of the @option{--batch} option to +stop signature verification at the first bad signatures. + + @item --list-filter @{select=@var{expr}@} @opindex list-filter A list filter can be used to output only certain keys during key diff --git a/g10/gpg.c b/g10/gpg.c index 461feff50..1a96db989 100644 --- a/g10/gpg.c +++ b/g10/gpg.c @@ -455,6 +455,7 @@ enum cmd_and_opt_values oAssertSigner, oAssertPubkeyAlgo, oKbxBufferSize, + oProcAllSigs, oNoop }; @@ -902,6 +903,7 @@ static gpgrt_opt_t opts[] = { ARGPARSE_s_n (oBatch, "batch", "@"), ARGPARSE_s_n (oNoBatch, "no-batch", "@"), + ARGPARSE_s_n (oProcAllSigs, "proc-all-sigs", "@"), ARGPARSE_s_n (oAnswerYes, "yes", "@"), ARGPARSE_s_n (oAnswerNo, "no", "@"), ARGPARSE_s_i (oStatusFD, "status-fd", "@"), @@ -2802,6 +2804,10 @@ main (int argc, char **argv) nogreeting = 1; break; + case oProcAllSigs: + opt.flags.proc_all_sigs = 1; + break; + case oUseAgent: /* Dummy. */ break; diff --git a/g10/mainproc.c b/g10/mainproc.c index e722618ca..40b90479f 100644 --- a/g10/mainproc.c +++ b/g10/mainproc.c @@ -2549,7 +2549,7 @@ check_sig_and_print (CTX c, kbnode_t node) release_kbnode( keyblock ); if (rc) g10_errors_seen = 1; - if (opt.batch && rc) + if (opt.batch && rc && !opt.flags.proc_all_sigs) g10_exit (1); } else /* Error checking the signature. (neither Good nor Bad). */ diff --git a/g10/options.h b/g10/options.h index e6526b86e..29641119d 100644 --- a/g10/options.h +++ b/g10/options.h @@ -305,6 +305,8 @@ struct /* Fail if an operation can't be done in the requested compliance * mode. */ unsigned int require_compliance:1; + /* Process all signatures even in batch mode. */ + unsigned int proc_all_sigs:1; } flags; /* Linked list of ways to find a key if the key isn't on the local