GpgFrontend/gpgme
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

doc: Explain verify_result_t.status == 0 more

Browse Source 
* doc/gpgme.texi (gpgme_verify_result_t): Explain
GPGME_STATUS_NO_ERROR more clearly.

--
This might help to avoid misunderstandings how the
status can be interpreted and explains why a verify
of unsigned PGP Data returns no error.

As a reaction to CVE-2020-10759 discovered by Justin Steven.
This commit is contained in:
Andre Heinecke 2020-06-09 10:21:54 +02:00
parent 728ead8ebd
commit 88f3202521
No known key found for this signature in database
GPG Key ID: 2978E9D40CBABA5C
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
doc/gpgme.texi
View File

@ -5773,8 +5773,15 @@ status codes are of interest:
@table @code
@item GPG_ERR_NO_ERROR
This status indicates that the signature is valid. For the combined
result this status means that all signatures are valid.
This status indicates that the signature could be verified or that
there is no signature. For the combined result this status
means that all signatures could be verified.
Note: This does not mean that a valid signature could be found. Check
the @code{summary} field for that.
For example a @code{gpgme_op_decrypt_verify} returns a verification
result with GPG_ERR_NO_ERROR for encrypted but unsigned data.
@item GPG_ERR_SIG_EXPIRED
This status indicates that the signature is valid but expired. For