* configure.ac: Do not build gpg by default.

* gpgsm.c: New options --{enable,disable}-trusted-cert-crl-check.
* certchain.c (gpgsm_validate_chain): Make use of it.

* certchain.c (gpgsm_validate_chain): Check revocations even for
expired certificates.  This is required because on signature
verification an expired key is fine whereas a revoked one is not.

* gpgconf-comp.c: Add gpgsm option disable-trusted-cert-crl-check.

4 files changed, 22 insertions, 4 deletions

diff --git a/sm/ChangeLog b/sm/ChangeLog
index b209b9d4b..aa8e8671f 100644
--- a/sm/ChangeLog
+++ b/sm/ChangeLog
@@ -1,5 +1,8 @@
 2005-04-21  Werner Koch  <[email protected]>
 
+	* gpgsm.c: New options --{enable,disable}-trusted-cert-crl-check.
+	* certchain.c (gpgsm_validate_chain): Make use of it.
+
 	* certchain.c (gpgsm_validate_chain): Check revocations even for
 	expired certificates.  This is required because on signature
 	verification an expired key is fine whereas a revoked one is not.
diff --git a/sm/certchain.c b/sm/certchain.c
index 2e491f590..02e5b409f 100644
--- a/sm/certchain.c
+++ b/sm/certchain.c
@@ -752,13 +752,13 @@ gpgsm_validate_chain (ctrl_t ctrl, ksba_cert_t cert, ksba_isotime_t r_exptime,
         }
 
 
-      /* Is this a self-signed certificate? */
+      /* Is this a self-issued certificate? */
       if (subject && !strcmp (issuer, subject))
         {  /* Yes. */
           if (gpgsm_check_cert_sig (subject_cert, subject_cert) )
             {
               do_list (1, lm, fp,
-                       _("selfsigned certificate has a BAD signature"));
+                       _("self-signed certificate has a BAD signature"));
               if (DBG_X509)
                 {
                   gpgsm_dump_cert ("self-signing cert", subject_cert);
@@ -816,7 +816,9 @@ gpgsm_validate_chain (ctrl_t ctrl, ksba_cert_t cert, ksba_isotime_t r_exptime,
 
           /* Check for revocations etc. */
           if ((flags & 1))
-            rc = 0;
+            ;
+          else if (opt.no_trusted_cert_crl_check)
+            ; 
           else
             rc = is_cert_still_valid (ctrl, lm, fp,
                                       subject_cert, subject_cert,
@@ -1045,7 +1047,7 @@ gpgsm_basic_cert_check (ksba_cert_t cert)
       rc = gpgsm_check_cert_sig (cert, cert);
       if (rc)
         {
-          log_error ("selfsigned certificate has a BAD signature: %s\n",
+          log_error ("self-signed certificate has a BAD signature: %s\n",
                      gpg_strerror (rc));
           if (DBG_X509)
             {
diff --git a/sm/gpgsm.c b/sm/gpgsm.c
index dae547702..fb6533030 100644
--- a/sm/gpgsm.c
+++ b/sm/gpgsm.c
@@ -130,6 +130,8 @@ enum cmd_and_opt_values {
 
   oDisableCRLChecks,
   oEnableCRLChecks,
+  oDisableTrustedCertCRLCheck,
+  oEnableTrustedCertCRLCheck,
   oForceCRLRefresh,
 
   oDisableOCSP,
@@ -285,6 +287,8 @@ static ARGPARSE_OPTS opts[] = {
       N_("use system's dirmngr if available")},
     { oDisableCRLChecks, "disable-crl-checks", 0, N_("never consult a CRL")},
     { oEnableCRLChecks, "enable-crl-checks", 0, "@"},
+    { oDisableTrustedCertCRLCheck, "disable-trusted-cert-crl-check", 0, "@"},
+    { oEnableTrustedCertCRLCheck, "enable-trusted-cert-crl-check", 0, "@"},
     { oForceCRLRefresh, "force-crl-refresh", 0, "@"},
 
     { oDisableOCSP, "disable-ocsp", 0, "@" },
@@ -973,6 +977,12 @@ main ( int argc, char **argv)
         case oEnableCRLChecks:
           opt.no_crl_check = 0;
           break;
+        case oDisableTrustedCertCRLCheck:
+          opt.no_trusted_cert_crl_check = 1;
+          break;
+        case oEnableTrustedCertCRLCheck:
+          opt.no_trusted_cert_crl_check = 0;
+          break;
         case oForceCRLRefresh:
           opt.force_crl_refresh = 1;
           break;
@@ -1352,6 +1362,8 @@ main ( int argc, char **argv)
                 GC_OPT_FLAG_NONE );
         printf ("disable-crl-checks:%lu:\n",
                 GC_OPT_FLAG_NONE );
+        printf ("disable-trusted-cert-crl-check:%lu:\n",
+                GC_OPT_FLAG_NONE );
         printf ("enable-ocsp:%lu:\n",
                 GC_OPT_FLAG_NONE );
         printf ("include-certs:%lu:1:\n",
diff --git a/sm/gpgsm.h b/sm/gpgsm.h
index aafc4815d..1068e9d5e 100644
--- a/sm/gpgsm.h
+++ b/sm/gpgsm.h
@@ -97,6 +97,7 @@ struct {
   int ignore_time_conflict; /* Ignore certain time conflicts */
 
   int no_crl_check;         /* Don't do a CRL check */
+  int no_trusted_cert_crl_check; /* Don't run a CRL check for trusted certs. */
   int force_crl_refresh;    /* Force refreshing the CRL. */
   int enable_ocsp;          /* Default to use OCSP checks. */