me
/
guix
Archived
1
0
Fork 0
Code

openpgp: 'lookup-key-by-{id,fingerprint}' return the key first. 

Previously, 'lookup-key-by-{id,fingerprint}' would always return the
list of packets where the primary key is first.  Thus, the caller would
need to use 'find' to actually find the requested key.

* guix/openpgp.scm (keyring-insert): Always add KEY to PACKETS.
(lookup-key-by-id, lookup-key-by-fingerprint): Change to return the key
as the first value.
(verify-openpgp-signature): Remove now unneeded call to 'find'.
* tests/openpgp.scm ("get-openpgp-keyring"): Adjust accordingly.
master
Ludovic Courtès 2020-04-30 15:43:19 +02:00
parent b45fa0a123
commit bd8126558d
No known key found for this signature in database
GPG Key ID: 090B11993D9AEBB5
2 changed files with 30 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
guix/openpgp.scm
View File

@ -566,21 +566,12 @@ the issuer's OpenPGP public key extracted from KEYRING."
(if (= (openpgp-signature-type sig) SIGNATURE-BINARY) (if (= (openpgp-signature-type sig) SIGNATURE-BINARY)
(let* ((id (openpgp-signature-issuer-key-id sig)) (let* ((id (openpgp-signature-issuer-key-id sig))
(fingerprint (openpgp-signature-issuer-fingerprint sig)) (fingerprint (openpgp-signature-issuer-fingerprint sig))
(key-data (if fingerprint (key (if fingerprint
(lookup-key-by-fingerprint keyring fingerprint) (lookup-key-by-fingerprint keyring fingerprint)
(lookup-key-by-id keyring id)))) (lookup-key-by-id keyring id))))
;; Find the primary key or subkey that made the signature. (if key
(let ((key (find (lambda (k) (check key sig)
(and (openpgp-public-key? k) (values 'missing-key (or fingerprint id))))
(if fingerprint
(bytevector=?
(openpgp-public-key-fingerprint k)
fingerprint)
(= (openpgp-public-key-id k) id))))
key-data)))
(if key
(check key sig)
(values 'missing-key (or fingerprint id)))))
(values 'unsupported-signature sig))) (values 'unsupported-signature sig)))
(define (key-id-matches-fingerprint? key-id fingerprint) (define (key-id-matches-fingerprint? key-id fingerprint)
@ -925,29 +916,33 @@ FINGERPRINT, a bytevector."
(ids openpgp-keyring-ids) ;vhash mapping key id to packets (ids openpgp-keyring-ids) ;vhash mapping key id to packets
(fingerprints openpgp-keyring-fingerprints)) ;mapping fingerprint to packets (fingerprints openpgp-keyring-fingerprints)) ;mapping fingerprint to packets
(define* (keyring-insert key keyring #:optional (packets (list key))) (define* (keyring-insert key keyring #:optional (packets '()))
"Insert the KEY/PACKETS association into KEYRING and return the resulting "Insert the KEY/PACKETS association into KEYRING and return the resulting
keyring. PACKETS typically contains KEY, an <openpgp-public-key>, alongside keyring. PACKETS typically contains KEY, an <openpgp-public-key>, alongside
with additional <openpgp-public-key> records for sub-keys, <openpgp-user-id> with additional <openpgp-public-key> records for sub-keys, <openpgp-user-id>
records, and so on." records, and so on."
(openpgp-keyring (vhash-consv (openpgp-public-key-id key) packets (openpgp-keyring (vhash-consv (openpgp-public-key-id key)
(cons key packets)
(openpgp-keyring-ids keyring)) (openpgp-keyring-ids keyring))
(vhash-cons (openpgp-public-key-fingerprint key) packets (vhash-cons (openpgp-public-key-fingerprint key)
(cons key packets)
(openpgp-keyring-fingerprints keyring)))) (openpgp-keyring-fingerprints keyring))))
(define (lookup-key-by-id keyring id) (define (lookup-key-by-id keyring id)
"Return a list of packets for the key with ID in KEYRING, or #f if ID could "Return two values: the first key with ID in KEYRING, and a list of
not be found. ID must be the 64-bit key ID of the key, an integer." associated packets (user IDs, signatures, etc.). Return #f and the empty list
of ID was not found. ID must be the 64-bit key ID of the key, an integer."
(match (vhash-assv id (openpgp-keyring-ids keyring)) (match (vhash-assv id (openpgp-keyring-ids keyring))
((_ . lst) lst) ((_ key packets ...) (values key packets))
(#f '()))) (#f (values #f '()))))
(define (lookup-key-by-fingerprint keyring fingerprint) (define (lookup-key-by-fingerprint keyring fingerprint)
"Return a list of packets for the key with FINGERPRINT in KEYRING, or #f if "Return two values: the key with FINGERPRINT in KEYRING, and a list of
FINGERPRINT could not be found. FINGERPRINT must be a bytevector." associated packets (user IDs, signatures, etc.). Return #f and the empty list
of FINGERPRINT was not found. FINGERPRINT must be a bytevector."
(match (vhash-assoc fingerprint (openpgp-keyring-fingerprints keyring)) (match (vhash-assoc fingerprint (openpgp-keyring-fingerprints keyring))
((_ . lst) lst) ((_ key packets ...) (values key packets))
(#f '()))) (#f (values #f '()))))
;; Reads a keyring from the binary input port p. It must not be ;; Reads a keyring from the binary input port p. It must not be
;; ASCII armored. ;; ASCII armored.

22
tests/openpgp.scm
View File

@ -160,17 +160,17 @@ Pz7oopeN72xgggYUNT37ezqN3MeCqw0=
(keyring (get-openpgp-keyring (keyring (get-openpgp-keyring
(open-bytevector-input-port (open-bytevector-input-port
(call-with-input-file key read-radix-64))))) (call-with-input-file key read-radix-64)))))
(match (lookup-key-by-id keyring %civodul-key-id) (let-values (((primary packets)
(((? openpgp-public-key? primary) packets ...) (lookup-key-by-id keyring %civodul-key-id)))
(let ((fingerprint (openpgp-public-key-fingerprint primary))) (let ((fingerprint (openpgp-public-key-fingerprint primary)))
(and (= (openpgp-public-key-id primary) %civodul-key-id) (and (= (openpgp-public-key-id primary) %civodul-key-id)
(not (openpgp-public-key-subkey? primary)) (not (openpgp-public-key-subkey? primary))
(string=? (openpgp-format-fingerprint fingerprint) (string=? (openpgp-format-fingerprint fingerprint)
%civodul-fingerprint) %civodul-fingerprint)
(string=? (openpgp-user-id-value (find openpgp-user-id? packets)) (string=? (openpgp-user-id-value (find openpgp-user-id? packets))
"Ludovic Courtès <ludo@gnu.org>") "Ludovic Courtès <ludo@gnu.org>")
(equal? (lookup-key-by-id keyring %civodul-key-id) (eq? (lookup-key-by-fingerprint keyring fingerprint)
(lookup-key-by-fingerprint keyring fingerprint)))))))) primary))))))
(test-equal "get-openpgp-detached-signature/ascii" (test-equal "get-openpgp-detached-signature/ascii"
(list `(,%dsa-key-id ,%dsa-key-fingerprint dsa sha256) (list `(,%dsa-key-id ,%dsa-key-fingerprint dsa sha256)