Merge branch 'STABLE-BRANCH-2-2' into master

--
Resolved Conflicts:
	configure.ac - Adjust due to new log_clock otions

1 files changed, 39 insertions, 1 deletions

diff --git a/sm/certlist.c b/sm/certlist.c
index 39ab03c5d..c9e275e9d 100644
--- a/sm/certlist.c
+++ b/sm/certlist.c
@@ -489,7 +489,8 @@ gpgsm_release_certlist (certlist_t list)
    subjectKeyIdentifier. */
 int
 gpgsm_find_cert (ctrl_t ctrl,
-                 const char *name, ksba_sexp_t keyid, ksba_cert_t *r_cert)
+                 const char *name, ksba_sexp_t keyid, ksba_cert_t *r_cert,
+                 int allow_ambiguous)
 {
   int rc;
   KEYDB_SEARCH_DESC desc;
@@ -537,6 +538,16 @@ gpgsm_find_cert (ctrl_t ctrl,
              won't lead to ambiguous names. */
           if (!rc && !keyid)
             {
+              ksba_isotime_t notbefore = "";
+              const unsigned char *image = NULL;
+              size_t length = 0;
+              if (allow_ambiguous)
+                {
+                  /* We want to return the newest certificate */
+                  if (ksba_cert_get_validity (*r_cert, 0, notbefore))
+                    *notbefore = '\0';
+                  image = ksba_cert_get_image (*r_cert, &length);
+                }
             next_ambiguous:
               rc = keydb_search (ctrl, kh, &desc, 1);
               if (rc == -1)
@@ -546,6 +557,10 @@ gpgsm_find_cert (ctrl_t ctrl,
                   if (!rc)
                     {
                       ksba_cert_t cert2 = NULL;
+                      ksba_isotime_t notbefore2 = "";
+                      const unsigned char *image2 = NULL;
+                      size_t length2 = 0;
+                      int cmp = 0;
 
                       if (!keydb_get_cert (kh, &cert2))
                         {
@@ -554,6 +569,29 @@ gpgsm_find_cert (ctrl_t ctrl,
                               ksba_cert_release (cert2);
                               goto next_ambiguous;
                             }
+                          if (allow_ambiguous)
+                            {
+                              if (ksba_cert_get_validity (cert2, 0, notbefore2))
+                                *notbefore2 = '\0';
+                              image2 = ksba_cert_get_image (cert2, &length2);
+                              cmp = strcmp (notbefore, notbefore2);
+                              /* use certificate image bits as last resort for stable ordering */
+                              if (!cmp)
+                                cmp = memcmp (image, image2, length < length2 ? length : length2);
+                              if (!cmp)
+                                cmp = length < length2 ? -1 : length > length2 ? 1 : 0;
+                              if (cmp < 0)
+                                {
+                                  ksba_cert_release (*r_cert);
+                                  *r_cert = cert2;
+                                  strcpy (notbefore, notbefore2);
+                                  image = image2;
+                                  length = length2;
+                                }
+                              else
+                                ksba_cert_release (cert2);
+                              goto next_ambiguous;
+                            }
                           ksba_cert_release (cert2);
                         }
                       rc = gpg_error (GPG_ERR_AMBIGUOUS_NAME);