From 379e4814e057cb626d6b7e93e0bde09222b19d96 Mon Sep 17 00:00:00 2001 From: Daniel Huigens Date: Wed, 15 Feb 2023 17:54:37 +0100 Subject: [PATCH] More strictly verify detached signatures Reject detached signatures from revoked and expired keys. --- crypto/signature.go | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/crypto/signature.go b/crypto/signature.go index 67c1d7c..3b15ba3 100644 --- a/crypto/signature.go +++ b/crypto/signature.go @@ -132,10 +132,13 @@ func verifySignature(pubKeyEntries openpgp.EntityList, origText io.Reader, signa } signatureReader := bytes.NewReader(signature) - signer, err := openpgp.CheckDetachedSignatureAndHash(pubKeyEntries, origText, signatureReader, allowedHashes, config) + sig, signer, err := openpgp.VerifyDetachedSignatureAndHash(pubKeyEntries, origText, signatureReader, allowedHashes, config) + + if signer != nil && (errors.Is(err, pgpErrors.ErrSignatureExpired) || errors.Is(err, pgpErrors.ErrKeyExpired)) { + if verifyTime == 0 { // Expiration check disabled + return nil + } - if errors.Is(err, pgpErrors.ErrSignatureExpired) && signer != nil && verifyTime > 0 { - // if verifyTime = 0: time check disabled, everything is okay // Maybe the creation time offset pushed it over the edge // Retry with the actual verification time config.Time = func() time.Time { @@ -147,13 +150,10 @@ func verifySignature(pubKeyEntries openpgp.EntityList, origText io.Reader, signa return newSignatureFailed() } - signer, err = openpgp.CheckDetachedSignatureAndHash(pubKeyEntries, origText, signatureReader, allowedHashes, config) - if err != nil { - return newSignatureFailed() - } + sig, signer, err = openpgp.VerifyDetachedSignatureAndHash(pubKeyEntries, origText, signatureReader, allowedHashes, config) } - if signer == nil { + if err != nil || sig == nil || signer == nil { return newSignatureFailed() }