From 54a8770aeb20eb9e18b5e95e51c376ec7820f8f6 Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor via Gnupg-devel Date: Fri, 31 Jan 2025 12:37:16 -0500 Subject: gpg: --compliance=rfc2440 does not require cross-certification * g10/gpg.c (set_compliance_option): clear opt.flags.require_cross_cert with oRFC2440 -- This aligns with the expectations in RFC 2440, which doesn't specify any cross-certifications. As doc/gpg.texi says: "This is dangerous", but it aligns with the specification. The comment above says that 4880 is the same as 2440, "but with [...] --require-cross-certification", so we align the code with the intent from the comment. It looks like opt.require_cross_cert was turned on by default after that comment (and the oRFC2440 section) was written, but the oRFC2440 section was never updated to turn it off. Signed-off-by: Daniel Kahn Gillmor --- g10/gpg.c | 1 + 1 file changed, 1 insertion(+) diff --git a/g10/gpg.c b/g10/gpg.c index 694364b3d..ba3525d65 100644 --- a/g10/gpg.c +++ b/g10/gpg.c @@ -2302,6 +2302,7 @@ set_compliance_option (enum cmd_and_opt_values option) case oRFC2440: opt.compliance = CO_RFC2440; opt.flags.dsa2 = 0; + opt.flags.require_cross_cert = 0; opt.rfc2440_text = 1; opt.allow_non_selfsigned_uid = 1; opt.allow_freeform_uid = 1; -- cgit v1.2.3