search

isislovecruft / python-gnupg

A modified version of python-gnupg, including security patches, extensive documentation, and extra features.
Other
426 stars 171 forks source link

self.status is None: #291

Open ianccole opened 5 months ago

ianccole commented 5 months ago

Verify() assumes that KEY_CONSIDERED is never the first line parsed as it will append this to an existing self.status

See here:

https://github.com/isislovecruft/python-gnupg/blob/784571449032e811587249743e183fc5e908a673/pretty_bad_protocol/_parsers.py#L1519

But this is my output from the CL:


vagrant@UK01MBTSP-vm:~/dvt-prodtest-uk$ gpg --no-options --no-emit-version --no-tty --status-fd 2 --verify tests/sample_limits/med_pcba_p9_and_above_032_orig.lim 
[GNUPG:] NEWSIG
gpg: Signature made Wed 26 Oct 2022 10:52:20 BST
gpg:                using DSA key F96C4AF3CF6F8F26
[GNUPG:] KEY_CONSIDERED 51ADFA4BD2C3E4A1F9DD7A40F96C4AF3CF6F8F26 0
[GNUPG:] SIG_ID B7Tvd7WNfRCjRig008b+rTEm5ak 2022-10-26 1666777940
[GNUPG:] KEY_CONSIDERED 51ADFA4BD2C3E4A1F9DD7A40F96C4AF3CF6F8F26 0
[GNUPG:] GOODSIG F96C4AF3CF6F8F26 Orthogon Engineer (Used to sign limits files) <ostest@orthogonsystems.com>
gpg: Good signature from "Orthogon Engineer (Used to sign limits files) <ostest@orthogonsystems.com>" [unknown]
[GNUPG:] VALIDSIG 51ADFA4BD2C3E4A1F9DD7A40F96C4AF3CF6F8F26 2022-10-26 1666777940 0 3 0 17 2 01 51ADFA4BD2C3E4A1F9DD7A40F96C4AF3CF6F8F26
[GNUPG:] TRUST_UNDEFINED 0 pgp
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 51AD FA4B D2C3 E4A1 F9DD  7A40 F96C 4AF3 CF6F 8F26

Personally - would change self.status = None to self.status = "" in 2 places:

https://github.com/isislovecruft/python-gnupg/blob/784571449032e811587249743e183fc5e908a673/pretty_bad_protocol/_parsers.py#L1424

https://github.com/isislovecruft/python-gnupg/blob/784571449032e811587249743e183fc5e908a673/pretty_bad_protocol/_parsers.py#L1522