1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-12-22 10:19:57 +01:00
Werner Koch fbb50867f8 gpg: Make the use of "--verify FILE" for detached sigs harder.
* g10/openfile.c (open_sigfile): Factor some code out to ...
(get_matching_datafile): new function.
* g10/plaintext.c (hash_datafiles): Do not try to find matching file
in batch mode.
* g10/mainproc.c (check_sig_and_print): Print a warning if a possibly
matching data file is not used by a standard signatures.
--

Allowing to use the abbreviated form for detached signatures is a long
standing bug which has only been noticed by the public with the
release of 2.1.0.  :-(

What we do is to remove the ability to check detached signature in
--batch using the one file abbreviated mode.  This should exhibit
problems in scripts which use this insecure practice.  We also print a
warning if a matching data file exists but was not considered because
the detached signature was actually a standard signature:

  gpgv: Good signature from "Werner Koch (dist sig)"
  gpgv: WARNING: not a detached signature; \
  file 'gnupg-2.1.0.tar.bz2' was NOT verified!

We can only print a warning because it is possible that a standard
signature is indeed to be verified but by coincidence a file with a
matching name is stored alongside the standard signature.

Reported-by: Simon Nicolussi (to gnupg-users on Nov 7)
Signed-off-by: Werner Koch <wk@gnupg.org>

(backported from commit 69384568f66a48eff3968bb1714aa13925580e9f)

Updated doc/gpg.texi.
2014-11-14 19:41:24 +01:00
..
2010-09-23 08:15:45 +00:00
2007-10-23 10:48:09 +00:00
2009-09-02 15:02:01 +00:00
2007-10-23 10:48:09 +00:00
2007-10-23 10:48:09 +00:00
2007-10-23 10:48:09 +00:00
2007-10-23 10:48:09 +00:00
2007-10-23 10:48:09 +00:00
2007-10-23 10:48:09 +00:00
2007-10-23 10:48:09 +00:00
2014-08-06 18:33:21 +02:00
2009-12-15 11:07:43 +00:00
2009-09-02 17:30:53 +00:00
2007-10-23 10:48:09 +00:00
2013-07-12 17:26:55 +09:00
2007-10-23 10:48:09 +00:00
2014-06-23 14:57:32 +02:00
2007-10-23 10:48:09 +00:00
2007-10-23 10:48:09 +00:00
2011-02-23 15:13:40 +01:00
2007-10-23 10:48:09 +00:00
2007-10-23 10:48:09 +00:00
2011-08-09 10:54:22 +02:00
2005-10-05 16:58:50 +00:00
2009-06-24 14:01:20 +00:00
2011-08-09 10:54:22 +02:00
2013-07-12 17:26:55 +09:00
2009-05-11 09:37:25 +00:00
2007-10-23 10:48:09 +00:00
2007-10-23 10:48:09 +00:00
2007-10-23 10:48:09 +00:00
2007-10-23 10:48:09 +00:00
2007-10-23 10:48:09 +00:00