security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

gpg: Replace --override-compliance-check by a real fix.

Browse source 
* common/compliance.c (gnupg_pk_is_allowed): Handle EdDSA.
* g10/gpg.c (oOverrideComplianceCheck): Remove.
(opts): Turn --override-compliance-check into a dummy option.
* g10/options.h (opt): Remove override_compliance_check.
* g10/sig-check.c (check_key_verify_compliance): Remove use of that
option.
--

The introduction of --override-compliance-check actually hid the real
cause for the signature verification problem in de-vs mode for the
Ed25519 key.  The real fix is to handle the EdDSA algorithm in
gnupg_pk_is_allowed.

Fixes-commit: fb26e144ad
GnuPG-bug-id: 5655
This commit is contained in:
Werner Koch 2023-01-20 11:02:02 +01:00
parent b9528830d6
commit d98bf02a03
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
5 changed files with 8 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

16
g10/gpg.c
View file

@ -360,7 +360,6 @@ enum cmd_and_opt_values
oShowSessionKey,
oOverrideSessionKey,
oOverrideSessionKeyFD,
oOverrideComplianceCheck,
oNoRandomSeedFile,
oAutoKeyRetrieve,
oNoAutoKeyRetrieve,
@ -878,7 +877,6 @@ static gpgrt_opt_t opts[] = {
ARGPARSE_s_s (oCipherAlgo, "cipher-algo", "@"),
ARGPARSE_s_s (oDigestAlgo, "digest-algo", "@"),
ARGPARSE_s_s (oCertDigestAlgo, "cert-digest-algo", "@"),
ARGPARSE_s_n (oOverrideComplianceCheck, "override-compliance-check", "@"),
ARGPARSE_header (NULL, N_("Options for unattended use")),
@ -972,6 +970,7 @@ static gpgrt_opt_t opts[] = {
ARGPARSE_s_s (oNoop, "aead-algo", "@"),
ARGPARSE_s_s (oNoop, "personal-aead-preferences","@"),
ARGPARSE_s_n (oNoop, "rfc4880bis", "@"),
ARGPARSE_s_n (oNoop, "override-compliance-check", "@"),
ARGPARSE_group (302, N_(
@ -3666,10 +3665,6 @@ main (int argc, char **argv)
opt.flags.allow_old_cipher_algos = 1;
break;
case oOverrideComplianceCheck:
opt.flags.override_compliance_check = 1;
break;
case oFakedSystemTime:
{
size_t len = strlen (pargs.r.ret_str);
@ -3879,15 +3874,6 @@ main (int argc, char **argv)
g10_exit(2);
}
/* We allow overriding the compliance check only in non-batch mode
* so that the user has a chance to see the message. */
if (opt.flags.override_compliance_check && opt.batch)
{
opt.flags.override_compliance_check = 0;
log_info ("Note: '%s' ignored due to batch mode\n",
"--override-compliance-check");
}
set_debug (debug_level);
if (opt.verbose) /* Print the compatibility flags. */
parse_compatibility_flags (NULL, &opt.compat_flags, compatibility_flags);