diff options
| author | David Kalnischkies <david@kalnischkies.de> | 2016-04-29 00:31:49 +0200 |
|---|---|---|
| committer | David Kalnischkies <david@kalnischkies.de> | 2016-05-01 10:50:24 +0200 |
| commit | fb7b11ebb852fa255053ecab605bc9cfe9de0603 (patch) | |
| tree | 409a82bf36e0be9d79666872a2165feb9c22b932 /methods | |
| parent | 1af227c2eaad386f0917fc4f36c84fd5999b884e (diff) | |
don't show NO_PUBKEY warning if repo is signed by another key
Daniel Kahn Gillmor highlights in the bugreport that security isn't
improving by having the user import additional keys – especially as
importing keys securely is hard.
The bugreport was initially about dropping the warning to a notice, but
in given the previously mentioned observation and the fact that we
weren't printing a warning (or a notice) for expired or revoked keys
providing a signature we drop it completely as the code to display a
message if this was the only key is in another path – and is considered
critical.
Closes: 618445
Diffstat (limited to 'methods')
| -rw-r--r-- | methods/gpgv.cc | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/methods/gpgv.cc b/methods/gpgv.cc index 53c3ff80e..9099521bd 100644 --- a/methods/gpgv.cc +++ b/methods/gpgv.cc @@ -203,14 +203,14 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile, } else if (strncmp(buffer, GNUPGGOODSIG, sizeof(GNUPGGOODSIG)-1) == 0) { - char *sig = buffer + sizeof(GNUPGPREFIX); - char *p = sig + sizeof("GOODSIG"); + char *sig = buffer + sizeof(GNUPGGOODSIG); + char *p = sig; while (*p && isxdigit(*p)) p++; *p = 0; if (Debug == true) - std::clog << "Got GOODSIG, key ID:" << sig << std::endl; - GoodSigners.push_back(string(sig)); + std::clog << "Got GOODSIG, key ID: " << sig << std::endl; + GoodSigners.push_back(string(buffer+sizeof(GNUPGPREFIX))); } else if (strncmp(buffer, GNUPGVALIDSIG, sizeof(GNUPGVALIDSIG)-1) == 0) { |