Hi,
On 12/20/2012 04:29 AM, James McCoy wrote:
> commit 0e804cc658e3a00e07873a4be880f3d2769c913f
> Author: James McCoy <james...@debian.org>
> Date: Wed Dec 19 22:25:01 2012 -0500
>
> dscverify: Use "gpg --status-fd" to get more details about validity
>
> Simply running "gpg < file" doesn't ensure the content is properly
> signed. Even when it does, we may not be using the signed content.
>
> Using "gpg --status-fd 1 < file" solves both of these issues. Even
> though it still won't error out with an unsigned file, we'll be able to
> detect that the content wasn't signed by the lack of a VALIDSIG status.
> Also, the command will emit the signed content between PLAINTEXT status
> and any subsequent status lines.
Mixing the status output from gpg and the data is a bad idea. It's
probably still possible to bypass the check with something like
{ echo something; echo "[GNUPG:] VALIDSIG" } | gpg --store
If you use --status-fd, please use a file descriptor that is not used
for anything else.
Ansgar
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
