IJHack / QtPass / 40556537830
93%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 122
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 92.471%. Remained the same
40556537830

push

github

web-flow 
RnpCrypto: detached sign and verify for .gpg-id, and a key listing (#2065)

* RnpCrypto: detached sign and verify for .gpg-id, and a key listing

Step 2 of #2005, the in-process OpenPGP backend's next pieces:

- sign(): a binary detached signature, as gpg --detach-sign
  --local-user writes .gpg-id.sig. The signer is named as gpg takes it
  and must be exactly one key with a valid signing key whose secret is
  here; never another secret key. A protected key is unlocked through
  the passphrase provider.
- verify(): the first good signature decides and gives the signing and
  primary fingerprints, as GpgIdSigner::validSigFingerprints() does. A
  revoked signer counts for nothing (RNP already fails it; checked here
  too), an expired one's older signature still counts, as with gpg.
- listKeys(): primaries with user IDs, creation and expiry, revoked,
  expired, whether a secret part is here, and whether it can encrypt or
  sign now: what the Users dialog needs.
- Key lookup takes a usage (encrypt or sign) for what makes a candidate.

Tested against GnuPG both ways (gpg verifies RNP's signatures with
VALIDSIG by that key, RNP verifies gpg's), tampering, a missing secret,
wrong and right passphrases, a revoked signer and one expired since.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VJygpMUf461yZgfAqwMJ6d
Signed-off-by: Anne Jan Brouwer <brouwer@annejan.com>

* Review: an address names that address; revoked user IDs name nothing

- An e-mail address names the key with a user ID of that address,
  compared without regard to case, not every user ID containing it:
  the signing key setting comes in upper case, so the exact match never
  hit and the partial one let alice@ find malice@ (and, with only that
  key's secret here, sign with it). Stricter than gpg -r's substring.
- Revoked user IDs are left out of listKeys() and of every lookup.
- SECURITY.md says precisely what names exactly one key.
- T... (continued)

9433 of 10201 relevant lines covered (92.47%)

304.72 hits per line

Jobs
ID Job ID Ran Files Coverage
1 40556537830.1 122
92.47
GitHub Action Run
Source Files on build 40556537830