security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2024-11-11 21:48:50 +01:00
Code Activity
a20b4c9543
gnupg/doc
History
Werner Koch 69384568f6 gpg: Make the use of "--verify FILE" for detached sigs harder. 
* g10/openfile.c (open_sigfile): Factor some code out to ...
(get_matching_datafile): new function.
* g10/plaintext.c (hash_datafiles): Do not try to find matching file
in batch mode.
* g10/mainproc.c (check_sig_and_print): Print a warning if a possibly
matching data file is not used by a standard signatures.
--

Allowing to use the abbreviated form for detached signatures is a long
standing bug which has only been noticed by the public with the
release of 2.1.0.  :-(

What we do is to remove the ability to check detached signature in
--batch using the one file abbreviated mode.  This should exhibit
problems in scripts which use this insecure practice.  We also print a
warning if a matching data file exists but was not considered because
the detached signature was actually a standard signature:

  gpgv: Good signature from "Werner Koch (dist sig)"
  gpgv: WARNING: not a detached signature; \
  file 'gnupg-2.1.0.tar.bz2' was NOT verified!

We can only print a warning because it is possible that a standard
signature is indeed to be verified but by coincidence a file with a
matching name is stored alongside the standard signature.

Reported-by: Simon Nicolussi (to gnupg-users on Nov 7)
Signed-off-by: Werner Koch <wk@gnupg.org>
2014-11-13 17:39:31 +01:00
..
examples add new certifciates 2008-06-25 11:14:48 +00:00
a-decade-of-gnupg.txt Workaround for a mingw runtime bug. 2008-09-04 10:35:41 +00:00
announce-2.0.txt sm/ 2006-11-14 10:23:21 +00:00
announce-2.1.txt doc: Add announce text for 2.1 2014-11-06 10:03:39 +01:00
ChangeLog-2011 Generate the ChangeLog from commit logs. 2011-12-01 11:09:02 +01:00
com-certs.pem Remove all expired common CA certificates. 2014-11-04 21:47:03 +01:00
contrib.texi Include dirmngr manual 2010-06-10 10:39:44 +00:00
DCO Add missing file. 2013-04-17 11:26:27 +02:00
debugging.texi doc: Improve the rendering of the manual 2014-06-25 11:15:45 +02:00
DETAILS Typo fixes. 2014-11-04 21:29:58 +01:00
dirmngr.texi dirmngr: Add support for hkps keyservers. 2014-05-05 16:23:37 +02:00
FAQ Add a static FAQ. 2010-10-05 13:56:25 +00:00
faq.org faq: Add a section on copyright assignments 2012-12-19 11:05:05 +01:00
fdl.texi Taken from NewPG 2003-01-09 13:24:01 +00:00
glossary.texi Typo fixes. Fixes bug#1093 2009-07-22 13:33:46 +00:00
gnupg7.texi Include dirmngr manual 2010-06-10 10:39:44 +00:00
gnupg-badge-openpgp.eps * preset-passphrase.c (preset_passphrase): Handle --passphrase. 2004-12-21 19:05:15 +00:00
gnupg-badge-openpgp.jpg * preset-passphrase.c (preset_passphrase): Handle --passphrase. 2004-12-21 19:05:15 +00:00
gnupg-badge-openpgp.pdf Made make distcheck work again 2006-06-20 17:47:10 +00:00
gnupg-card-architecture.fig Changed to GPLv3. 2007-07-04 19:49:40 +00:00
gnupg-logo-tr.png Beautified the online html manual 2011-08-12 14:40:47 +02:00
gnupg-logo.eps Add new logo. 2007-03-08 18:31:56 +00:00
gnupg-logo.pdf doc: Add gnupg-logo.pdf 2014-07-03 11:03:22 +02:00
gnupg-logo.png doc: Improve the rendering of the manual 2014-06-25 11:15:45 +02:00
gnupg.texi doc: Improve the rendering of the manual 2014-06-25 11:15:45 +02:00
gpg-agent.texi tests: Speed up the genkey1024.test by using not so strong random. 2014-10-30 09:55:51 +01:00
gpg.texi gpg: Make the use of "--verify FILE" for detached sigs harder. 2014-11-13 17:39:31 +01:00
gpgsm.texi Typo fixes. 2014-11-04 21:29:58 +01:00
gpgv.texi doc: Some gpg and gpgv clarifications. 2013-10-04 14:31:35 +02:00
gpl.texi doc: Formatting fixes. 2013-04-19 12:01:22 +02:00
HACKING speedo: Support building from dist-source generated tarball. 2014-06-17 10:37:55 +02:00
help.be.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.ca.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.cs.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.da.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.de.txt Changes the header presented before requesting the user ID. 2008-06-01 19:44:05 +00:00
help.el.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.eo.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.es.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.et.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.fi.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.fr.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.gl.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.hu.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.id.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.it.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.ja.txt Japanese: update po and doc. 2013-02-12 14:15:21 +09:00
help.nb.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.pl.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.pt_BR.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.pt.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.ro.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.ru.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.sk.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.sv.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.tr.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.txt gpg: Add shortcut for setting key capabilities. 2014-09-26 14:43:48 +02:00
help.zh_CN.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
help.zh_TW.txt Created help files form the current po entries. 2007-12-04 15:00:14 +00:00
howto-create-a-server-cert.texi Typo fixes. Fixes bug#1093 2009-07-22 13:33:46 +00:00
howtos.texi Add a howto section. 2007-05-08 13:59:41 +00:00
instguide.texi doc: Remove some stuff for the very incomplete instguide. 2014-09-03 09:45:20 +02:00
KEYSERVER Migrated more stuff to doc/ 2006-08-21 20:20:23 +00:00
Makefile.am doc: Added What's new in 2.1 article. 2014-11-04 21:29:45 +01:00
mksamplekeys Adjust awk to not add trailing whitespace. 2012-11-30 12:43:34 -05:00
Notes Changed license of the manual stuff to GPL. 2004-09-29 11:04:30 +00:00
OpenPGP gpg: Remove all support for v3 keys and always create v4-signatures. 2014-10-17 13:32:16 +02:00
opt-homedir.texi w32: Add code to support a portable use of GnuPG. 2013-08-01 11:20:48 +02:00
qualified.txt add new certifciates 2008-06-25 11:14:48 +00:00
samplekeys.asc Refresh sample keys 2012-11-30 12:47:49 -05:00
scdaemon.texi scd: Support for SmartCard-HSM 2014-07-25 09:43:29 +02:00
see-also-note.texi More man pages. Added include files for 2 common paragraphs. 2006-08-18 13:05:39 +00:00
specify-user-id.texi gpg: Remove warning message for non-implemented search modes. 2014-11-07 18:42:37 +01:00
sysnotes.texi Typo fixes. Fixes bug#1093 2009-07-22 13:33:46 +00:00
texi.css Beautified the online html manual 2011-08-12 14:40:47 +02:00
tools.texi tests: Speed up the genkey1024.test by using not so strong random. 2014-10-30 09:55:51 +01:00
TRANSLATE copyright assignments are not anymore required. 2013-03-29 09:13:05 +01:00
vuln-announce-2007-multiple-message.txt Changes to let the key listing use estream to help systems without 2007-03-19 14:35:04 +00:00
vuln-announce-2010-kbx-realloc.txt Some work on the dirmngr 2010-07-23 16:16:14 +00:00
vuln-announce-cve-2006-6235.txt 2006-12-06 16:38:34 +00:00
whats-new-in-2.1.txt build: Update README.maint. 2014-11-05 08:55:17 +01:00
yat2m.c yat2m: Support @set and @value. 2014-08-18 11:42:10 +02:00