[Rpm-maint] [rpm-software-management/rpm] verifySignature(): package signatures must be PGPSIGTYPE_BINARY (PR #1801)

[Demi Marie Obenour]

@DemiMarie commented on this pull request.

Thanks for the feedback @pmatilai.

> @@ -426,6 +426,11 @@ static int pgpVersion(const uint8_t *h, size_t hlen, uint8_t *version)
     return 0;
 }
 
+int pgpSignatureType(pgpDigParams _digp) {
+    assert(_digp->tag == PGPTAG_SIGNATURE);

That is a good point I had not considered, thanks.  If it is okay with you I can make a PR to add this to `CONTRIBUTING.md`

> @@ -566,7 +566,9 @@ static rpmRC verifyDigest(struct rpmsinfo_s *sinfo)
 static rpmRC
 verifySignature(rpmKeyring keyring, struct rpmsinfo_s *sinfo)
 {
-    rpmRC res = rpmKeyringVerifySig(keyring, sinfo->sig, sinfo->ctx);
+    rpmRC res = RPMRC_FAIL;
+    if (sinfo->sig && pgpSignatureType(sinfo->sig) == PGPSIGTYPE_BINARY)

Done, thanks!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1801#pullrequestreview-785916855
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20211021/ab3b097c/attachment.html>