Change Details

Long ago gpg didn't output the signed data when it was told to verify signed data (with --verify). Therefore gpgme didn't pass the --verify command when verifying (clear) signed data, so that gpg had to guess what gpgme wants and, as a side-effect, gpg output the signed data. Since 7+ years (GnuPG 2.1.16) the --verify command respects the --output option. Because gpgme passes the --output option to gpg when verifying (clear) signed data we can (for gpg 2.1.16+) explicitly ask gpg to --verify. There is a minor risk that this change breaks code that relies on the undocumented behavior of gpgme_op_verify to let gpg guess what to do with the "signed" data. I think breaking this undocumented behavior is acceptable.

Long ago gpg didn't output the signed data when it was told to verify signed data (with --verify). Therefore gpgme didn't pass the --verify command when verifying (clear) signed data, so that gpg had to guess what gpgme wants and, as a side-effect, gpg output the signed data. Since 7+ years (GnuPG 2.1.16) the --verify command respects the --output option. Because gpgme passes the --output option to gpg when verifying (clear) signed data we can (for gpg 2.1.16+) explicitly ask gpg to --verify. This will also avoid the warning "no command supplied. Trying to guess what you mean ..." issued by gpg which ends up in the diagnostic/audit log. There is a minor risk that this change breaks code that relies on the undocumented behavior of gpgme_op_verify to let gpg guess what to do with the "signed" data. I think breaking this undocumented behavior is acceptable.

Long ago gpg didn't output the signed data when it was told to verify signed data (with --verify). Therefore gpgme didn't pass the --verify command when verifying (clear) signed data, so that gpg had to guess what gpgme wants and, as a side-effect, gpg output the signed data. Since 7+ years (GnuPG 2.1.16) the --verify command respects the --output option. Because gpgme passes the --output option to gpg when verifying (clear) signed data we can (for gpg 2.1.16+) explicitly ask gpg to --verify. This will also avoid the warning "no command supplied. Trying to guess what you mean ..." issued by gpg which ends up in the diagnostic/audit log. There is a minor risk that this change breaks code that relies on the undocumented behavior of gpgme_op_verify to let gpg guess what to do with the "signed" data. I think breaking this undocumented behavior is acceptable.