diff options
| author | Daniel Kahn Gillmor <dkg@fifthhorseman.net> | 2019-05-29 17:56:01 -0400 |
|---|---|---|
| committer | Daniel Kahn Gillmor <dkg@fifthhorseman.net> | 2019-05-29 17:56:01 -0400 |
| commit | fa0a5ffd4997c2ca38a1dd2d89459b6b1f18ad99 (patch) | |
| tree | 5f7d9c3054fe50fbc45fe7ae06d9b7ea558ea2f4 | |
| parent | f9c923bb2d87711235312e8085964372d7480ce4 (diff) | |
| download | gpgme-dkg/fix-T3464.tar.gz | |
gpg: Avoid error diagnostics with --override-session-key when verifyingdkg/fix-T3464
* src/engine-gpg.c (gpg_decrypt): only send --no-keyring when we are
not verifying.
--
Without this change, the signature verification would fail. This
problem was introduced in bded8ebc59c7fdad2617f4c9232a58047656834c in
an attempt to avoid an error when *not* verifying. Clearly more test
suite coverage is needed to avoid introducing this sort of problem in
the future.
GnuPG-bug-id: 3464
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
| -rw-r--r-- | src/engine-gpg.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/src/engine-gpg.c b/src/engine-gpg.c index 31d219a3..66d25649 100644 --- a/src/engine-gpg.c +++ b/src/engine-gpg.c @@ -1695,12 +1695,15 @@ gpg_decrypt (void *engine, strlen (override_session_key), 1); if (!err) { - /* We add --no-keyring because a keyring is not required - * when we are overriding the session key. It would + /* When we are not trying to verify signatures as well, + * we add --no-keyring because a keyring is not required + * for decryption when overriding the session key. It would * work without that option but --no-keyring avoids that * gpg return a failure due to a missing key log_error() * diagnostic. --no-keyring is supported since 2.1.14. */ - err = add_arg (gpg, "--no-keyring"); + + if (!(flags & GPGME_DECRYPT_VERIFY)) + err = add_arg (gpg, "--no-keyring"); if (!err) err = add_arg (gpg, "--override-session-key-fd"); if (!err) |