TakeV/guix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

openpgp: 'verify-openpgp-signature' looks up by fingerprint when possible.

Browse source 
* guix/openpgp.scm (verify-openpgp-signature): Use
'lookup-key-by-fingerprint' when SIG contains a fingerprint.
Honor FINGERPRINT in the 'find' predicate.  Upon missing-key, return
FINGERPRINT if available.
* tests/openpgp.scm ("verify-openpgp-signature, missing key"): Adjust
expected value accordingly.
This commit is contained in:
Ludovic Courtès 2020-04-26 23:27:36 +02:00
parent efe1f0122c
commit b45fa0a123
No known key found for this signature in database
GPG key ID: 090B11993D9AEBB5
2 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
guix/openpgp.scm
View file

@ -564,16 +564,23 @@ (define (check key sig)
;; TODO: Support SIGNATURE-TEXT.
(if (= (openpgp-signature-type sig) SIGNATURE-BINARY)
(let* ((issuer (openpgp-signature-issuer-key-id sig))
(key-data (lookup-key-by-id keyring issuer)))
(let* ((id (openpgp-signature-issuer-key-id sig))
(fingerprint (openpgp-signature-issuer-fingerprint sig))
(key-data (if fingerprint
(lookup-key-by-fingerprint keyring fingerprint)
(lookup-key-by-id keyring id))))
;; Find the primary key or subkey that made the signature.
(let ((key (find (lambda (k)
(and (openpgp-public-key? k)
(= (openpgp-public-key-id k) issuer)))
(if fingerprint
(bytevector=?
(openpgp-public-key-fingerprint k)
fingerprint)
(= (openpgp-public-key-id k) id))))
key-data)))
(if key
(check key sig)
(values 'missing-key issuer))))
(values 'missing-key (or fingerprint id)))))
(values 'unsupported-signature sig)))
(define (key-id-matches-fingerprint? key-id fingerprint)

2
tests/openpgp.scm
View file

@ -192,7 +192,7 @@ (define %hello-signature/ed25519/sha1 ;digest-algo: sha1
%hello-signature/ed25519/sha1)))
(test-equal "verify-openpgp-signature, missing key"
`(missing-key ,%rsa-key-id)
`(missing-key ,%rsa-key-fingerprint)
(let* ((keyring (get-openpgp-keyring (%make-void-port "r")))
(signature (get-openpgp-packet
(open-bytevector-input-port