IJHack / QtPass / 40490438402

93%

push

github

GpgIdSigner: a revoked signing key does not vouch for a .gpg-id (#2059)

* GpgIdSigner: a revoked signing key does not vouch for a .gpg-id

gpg reports a signature by a revoked key as REVKEYSIG plus KEYREVOKED,
yet still prints VALIDSIG and exits 0. verify() only read VALIDSIG, so
a signing key revoked after it leaked kept signing recipient lists that
QtPass accepted, as long as it stayed configured. The block of the first
VALIDSIG (NEWSIG to NEWSIG) now must not say revoked. An expired key's
signature still counts: gpg calls it good, and pass accepts it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* Test the revoked signer through verify() as well

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

---------

Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

11 of 11 new or added lines in 1 file covered. (100.0%)

9309 of 10057 relevant lines covered (92.56%)

200.22 hits per line