diff options
| author | Justin Burnham <justin@jburnham.net> | 2013-09-18 23:27:32 -0700 |
|---|---|---|
| committer | Justin Burnham <justin@jburnham.net> | 2013-09-18 23:27:32 -0700 |
| commit | 4f9883421653a8a3c5ebe3c8f7507af183af0b94 (patch) | |
| tree | 1254b22f6978b163352444bebc534bdd1d2ca6db | |
| parent | 79b997382a2dfe628117d0485ad8dc01e9fc4f5b (diff) | |
| download | git-remote-gcrypt-4f9883421653a8a3c5ebe3c8f7507af183af0b94.zip git-remote-gcrypt-4f9883421653a8a3c5ebe3c8f7507af183af0b94.tar.gz git-remote-gcrypt-4f9883421653a8a3c5ebe3c8f7507af183af0b94.tar.bz2 | |
Better signature validation for subkeys.
| -rwxr-xr-x | git-remote-gcrypt | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/git-remote-gcrypt b/git-remote-gcrypt index bb19652..94e7d58 100755 --- a/git-remote-gcrypt +++ b/git-remote-gcrypt @@ -388,7 +388,7 @@ make_new_repo() # $1 return var for goodsig match, $2 return var for signers text read_config() { - local recp_= r_keyinfo= cap_= conf_part= good_sig= signers_= + local recp_= r_keyinfo= r_keyfpr= gpg_list= cap_= conf_part= good_sig= signers_= Conf_signkey=$(git config --path user.signingkey || :) conf_part=$(git config --get "remote.$NAME.gcrypt-participants" '.+' || git config --get gcrypt.participants '.+' || :) @@ -406,16 +406,21 @@ read_config() for recp_ in $conf_part do - filter_to @r_keyinfo "pub*" \ - "$(gpg --with-colons --fast-list -k "$recp_")" + gpg_list=$(gpg --with-colons --fast-list --fingerprint -k "$recp_") + filter_to @r_keyinfo "pub*" "$gpg_list" + filter_to @r_keyfpr "fpr*" "$gpg_list" isnull "$r_keyinfo" || isnonnull "${r_keyinfo##*"$Newline"*}" || echo_info "WARNING: '$recp_' matches multiple keys, using one" + isnull "$r_keyfpr" || isnonnull "${r_keyfpr##*"$Newline"*}" || + echo_info "WARNING: '$recp_' matches multiple fingerprints, using one" r_keyinfo=${r_keyinfo%%"$Newline"*} + r_keyfpr=${r_keyfpr%%"$Newline"*} keyid_=$(xfeed "$r_keyinfo" cut -f 5 -d :) + fprid_=$(xfeed "$r_keyfpr" cut -f 10 -d :) - isnonnull "$keyid_" && + isnonnull "$fprid_" && signers_="$signers_ $keyid_" && - append_to @good_sig "^\[GNUPG:\] GOODSIG $keyid_" || { + append_to @good_sig "^\[GNUPG:\] VALIDSIG .*$fprid_$" || { echo_info "WARNING: Skipping missing key $recp_" continue } |