lysann/passforios-gopenpgp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

More strictly verify detached signatures

Browse source 
Reject detached signatures from revoked and expired keys.
This commit is contained in:
Daniel Huigens 2023-02-15 17:54:37 +01:00
parent ba8a846837
commit 379e4814e0
1 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
crypto/signature.go
View file

@ -132,10 +132,13 @@ func verifySignature(pubKeyEntries openpgp.EntityList, origText io.Reader, signa
} }
signatureReader := bytes.NewReader(signature) signatureReader := bytes.NewReader(signature)
signer, err := openpgp.CheckDetachedSignatureAndHash(pubKeyEntries, origText, signatureReader, allowedHashes, config) sig, signer, err := openpgp.VerifyDetachedSignatureAndHash(pubKeyEntries, origText, signatureReader, allowedHashes, config)
if signer != nil && (errors.Is(err, pgpErrors.ErrSignatureExpired) || errors.Is(err, pgpErrors.ErrKeyExpired)) {
if verifyTime == 0 { // Expiration check disabled
return nil
}
if errors.Is(err, pgpErrors.ErrSignatureExpired) && signer != nil && verifyTime > 0 {
// if verifyTime = 0: time check disabled, everything is okay
// Maybe the creation time offset pushed it over the edge // Maybe the creation time offset pushed it over the edge
// Retry with the actual verification time // Retry with the actual verification time
config.Time = func() time.Time { config.Time = func() time.Time {
@ -147,13 +150,10 @@ func verifySignature(pubKeyEntries openpgp.EntityList, origText io.Reader, signa
return newSignatureFailed() return newSignatureFailed()
} }
signer, err = openpgp.CheckDetachedSignatureAndHash(pubKeyEntries, origText, signatureReader, allowedHashes, config) sig, signer, err = openpgp.VerifyDetachedSignatureAndHash(pubKeyEntries, origText, signatureReader, allowedHashes, config)
if err != nil {
return newSignatureFailed()
}
} }
if signer == nil { if err != nil || sig == nil || signer == nil {
return newSignatureFailed() return newSignatureFailed()
} }