security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

gpgsm: Add --always-trust feature.

Browse source 
* sm/gpgsm.h (opt): Re-purpose unused flag always_trust.
(struct server_control_s): Add "always_trust".
(VALIDATE_FLAG_BYPASS): New.
* sm/gpgsm.c (oAlwaysTrust): New.
(opts): Add "--always-trust"
(main): Set option.
* sm/server.c (option_handler): Add option "always-trust".
(reset_notify): Clear that option.
(cmd_encrypt): Ditto.
(cmd_getinfo): Add sub-command always-trust.
* sm/certchain.c (gpgsm_validate_chain): Handle VALIDATE_FLAG_BYPASS.
* sm/certlist.c (gpgsm_add_to_certlist): Set that flag for recipients
in always-trust mode.
--

GnuPG-bug-id: 6559
This commit is contained in:
Werner Koch 2023-08-31 11:13:38 +02:00
parent 4d7361d923
commit cdd6747e1e
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
6 changed files with 78 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

20
doc/gpgsm.texi
View file

@ -694,6 +694,13 @@ instead to make sure that the gpgsm process exits with a failure if
the compliance rules are not fulfilled. Note that this option has
currently an effect only in "de-vs" mode.
@item --always-trust
@opindex always-trust
Force encryption to the specified certificates without any validation
of the certificate chain. The only requirement is that the
certificate is capable of encryption. Note that this option is
ineffective if @option{--require-compliance} is used.
@item --ignore-cert-with-oid @var{oid}
@opindex ignore-cert-with-oid
Add @var{oid} to the list of OIDs to be checked while reading
@ -1603,6 +1610,10 @@ The leading two dashes usually used with @var{opt} shall not be given.
Return OK if the connection is in offline mode. This may be either
due to a @code{OPTION offline=1} or due to @command{gpgsm} being
started with option @option{--disable-dirmngr}.
@item always-trust
Returns OK of the connection is in always-trust mode. That is either
@option{--always-trust} or @option{GPGSM OPTION always-trust} are
active.
@end table
@node GPGSM OPTION
@ -1709,6 +1720,15 @@ If @var{value} is true or @var{value} is not given all network access
is disabled for this session. This is the same as the command line
option @option{--disable-dirmngr}.
@item always-trust
If @var{value} is true or @var{value} is not given encryption to the
specified certificates is forced without any validation of the
certificate chain. The only requirement is that the certificates are
capable of encryption. If set to false the standard behaviour is
re-established. This option is cleared by a RESET and after each
encrypt operation. Note that this option is ignored if
@option{--always-trust} or @option{--require-compliance} are used.
@item input-size-hint
This is the same as the @option{--input-size-hint} command line option.