Home GnuPG
Diffusion GnuPG 26bce2f01d20

gpg: Fix import's repair-key duplicate signature detection.

Description

gpg: Fix import's repair-key duplicate signature detection.

* g10/packet.h (PKG_siganture): Add field 'help_counter'.
* g10/key-check.c (sig_comparison): Take care of HELP_COUNTER.
(key_check_all_keysigs): De-duplicate on a per-block base.

The key_check_all_keysigs first does a detection of duplicate
signature. This is done over all signatures at once. The problem
here is for example:

key
uid_1
  sig_uid_1.1
  sig_uid_1.2
subkey_1
  sig_sub_1.1
subkey_2
  sig_sub_2.1
  sig_sub_2.2  (duplicate of sig_sub_1.1)

Now the de-duplication deletes the first signature and keeps the
second. That works in most cases for foreign signature on userids but
in the above constellation the code simply removes sig_sub_1.1 so that
subkey_1 has no binding signature anymore. In a later step during
import the missing binding is detected and subkey_1 is removed because
it is not anymore valid. The sig_sub_2.2 will also be removed later
because it does not check out for subkey_2 (that is as expected).

The fix is to let the de-duplication work only on blocks (ie. within
the signatures of a user id or a subkey). This will not detect all
duplicates but that does not harm because later steps will detect and
remove them.

In the above case (with this patch applied) the second phase of
key_check_all_keysigs will reorder key signatures and move the
duplicate sig_sub_2.2 directly after sig_sub_1.1. This duplicates the
signature and for cleanness we should kick the de-duplication process
again. This will be done with a followup patch.

  • GnuPG-bug-id: T3994
  • Signed-off-by: Werner Koch <wk@gnupg.org>

Details

Provenance
wernerAuthored on Jun 7 2018, 5:22 PM
Parents
rG1bc6b5174248: gpg: Improve verbose output during import.
Branches
Unknown
Tags
Unknown
Tasks
T3994: import-clean drops a seemingly valid subkey