head	1.1;
access;
symbols
	pkgsrc-2026Q3:1.1.0.8
	pkgsrc-2026Q3-base:1.1
	pkgsrc-2026Q2:1.1.0.6
	pkgsrc-2026Q2-base:1.1
	pkgsrc-2026Q1:1.1.0.4
	pkgsrc-2026Q1-base:1.1
	pkgsrc-2025Q4:1.1.0.2;
locks; strict;
comment	@# @;


1.1
date	2026.01.04.06.19.39;	author riastradh;	state Exp;
branches
	1.1.2.1;
next	;
commitid	OJdA6VbLBr2rx2pG;

1.1.2.1
date	2026.01.04.06.19.39;	author maya;	state dead;
branches;
next	1.1.2.2;
commitid	nubNusgIn6kmPArG;

1.1.2.2
date	2026.01.24.03.06.29;	author maya;	state Exp;
branches;
next	;
commitid	nubNusgIn6kmPArG;


desc
@@


1.1
log
@security/netpgpverify: Handle issuer fingerprint subpackets.

This is an extremely dodgy stop-gap measure to verify signatures
produced by gpg2.  It does nothing to address pervasive problems in
netpgpverify, like PR security/57449 or PR bin/59823, or even more
narrowly scoped problems with using keyids instead of fingerprints.
I'm a little reluctant to even commit this stop-gap because the
problems are so bad, and a band-aid won't fix a spurting carotid.

The symptom is:

> ./netpgpverify -k keypubring.gpg2 gpg2test.gpg2
> Ignoring unusual/reserved signature subpacket 34
> Signature did not match contents -- Signature key id 38fa6a2833ed1efa does not match onepass keyid

Test case generated by:

mkdir -m 0700 gpghome
gpg2 --homedir gpghome --batch --passphrase '' \
    --quick-gen-key user@@example.com rsa2048 sign never
echo hello world >gpg2test
gpg2 --homedir gpghome --batch --no-comments --no-emit-version \
    --output gpg2test.gpg2 --sign gpg2test
gpg2 --homedir gpghome --batch --no-comments --no-emit-version \
    --export-secret-keys >keysecring.gpg2
gpg2 --homedir gpghome --batch --no-comments --no-emit-version \
    --export >keypubring.gpg2
@
text
@hello world
@


1.1.2.1
log
@file gpg2test was added on branch pkgsrc-2025Q4 on 2026-01-24 03:06:29 +0000
@
text
@d1 1
@


1.1.2.2
log
@Pullup ticket #7047 - requested by wiz
security/netpgpverify: Bug fix

Revisions pulled up:
- security/netpgpverify/Makefile                                1.23
- security/netpgpverify/files/Makefile.in                       1.10
- security/netpgpverify/files/gpg2test                          1.1
- security/netpgpverify/files/gpg2test.gpg2                     1.1
- security/netpgpverify/files/keypubring.gpg2                   1.1
- security/netpgpverify/files/keysecring.gpg2                   1.1
- security/netpgpverify/files/libverify.c                       1.32

---
   Module Name:	pkgsrc
   Committed By:	riastradh
   Date:		Sun Jan  4 06:19:40 UTC 2026

   Modified Files:
   	pkgsrc/security/netpgpverify: Makefile
   	pkgsrc/security/netpgpverify/files: Makefile.in libverify.c
   Added Files:
   	pkgsrc/security/netpgpverify/files: gpg2test gpg2test.gpg2
   	    keypubring.gpg2 keysecring.gpg2

   Log Message:
   security/netpgpverify: Handle issuer fingerprint subpackets.

   This is an extremely dodgy stop-gap measure to verify signatures
   produced by gpg2.  It does nothing to address pervasive problems in
   netpgpverify, like PR security/57449 or PR bin/59823, or even more
   narrowly scoped problems with using keyids instead of fingerprints.
   I'm a little reluctant to even commit this stop-gap because the
   problems are so bad, and a band-aid won't fix a spurting carotid.

   The symptom is:

   > ./netpgpverify -k keypubring.gpg2 gpg2test.gpg2
   > Ignoring unusual/reserved signature subpacket 34
   > Signature did not match contents -- Signature key id 38fa6a2833ed1efa does not match onepass keyid

   Test case generated by:

   mkdir -m 0700 gpghome
   gpg2 --homedir gpghome --batch --passphrase '' \
       --quick-gen-key user@@example.com rsa2048 sign never
   echo hello world >gpg2test
   gpg2 --homedir gpghome --batch --no-comments --no-emit-version \
       --output gpg2test.gpg2 --sign gpg2test
   gpg2 --homedir gpghome --batch --no-comments --no-emit-version \
       --export-secret-keys >keysecring.gpg2
   gpg2 --homedir gpghome --batch --no-comments --no-emit-version \
       --export >keypubring.gpg2
@
text
@a0 1
hello world
@