Home GnuPG
Diffusion GnuPG d0bd91ba73a7

agent: New option --no-user-trustlist and --sys-trustlist-name.

Description

agent: New option --no-user-trustlist and --sys-trustlist-name.

* agent/gpg-agent.c (oNoUserTrustlist,oSysTrustlistName): New.
(opts): Add new option names.
(parse_rereadable_options): Parse options.
(finalize_rereadable_options): Reset allow-mark-trusted for the new
option.
* agent/agent.h (opt): Add fields no_user_trustlist and
sys_trustlist_name.
* agent/trustlist.c (make_sys_trustlist_name): New.
(read_one_trustfile): Use here.
(read_trustfiles): Use here.  Implement --no-user-trustlist.  Also
repalce "allow_include" by "systrust" and adjust callers.

With the global options we can now avoid that a user changes the
Root-CA trust by editing the trustlist.txt. However, to implement
this we need a new option so that we don't need to rely on some magic
like --no-allow-mark-trusted has been put into a force section.

The second option makes system administration easier as it allows to
keep the trustlist in a non-distributed file.

Backported-from-master: 1530d04725d475bf29328eab40b42f72ff8aa06b

Details

Provenance
wernerAuthored on Jun 14 2022, 2:25 PM
Parents
rGabe69b2094dd: gpg: Look up user ID to revoke by UID hash
Branches
Unknown
Tags
Unknown
Tasks
T5990: Option to ignore the user trustlist.txt