Fix handling of missing timestamp in SIGINFO status

* src/verify.c (parse_sig_info): Add argument protocol. Check for "-"
if protocol is CMS.
(_gpgme_verify_status_handler): Pass protocol to parse_sig_info.

* tests/gpg/t-verify.c (check_result): Add argument timestamp. Check
timestamp.
(main): Add expected timestamp to all check_result calls.
* tests/gpgsm/t-verify.c (check_result): Add argument timestamp. Check
timestamp.
(main): Add expected timestamp to all check_result calls.
--

S/MIME signatures do not necessarily have a timestamp. In this case
gpgsm emits "-" in the SIGINFO status line.

Fixes-commit: 31eb884e8f102ed3cf1220ccdd77e6e1931a9a7b
GnuPG-bug-id: 8368

3 files changed, 35 insertions, 12 deletions

diff --git a/src/verify.c b/src/verify.c
index d221c30e..f97c255f 100644
--- a/src/verify.c
+++ b/src/verify.c
@@ -491,7 +491,7 @@ parse_valid_sig (gpgme_signature_t sig, char *args, gpgme_protocol_t protocol)
 
 
 static gpgme_error_t
-parse_sig_info (gpgme_signature_t sig, char *args)
+parse_sig_info (gpgme_signature_t sig, char *args, gpgme_protocol_t protocol)
 {
   char *end = args;
   char *tail;
@@ -500,6 +500,9 @@ parse_sig_info (gpgme_signature_t sig, char *args)
     /* We require at least the creation time.  */
     return gpg_error (GPG_ERR_GENERAL);
 
+  if ((protocol == GPGME_PROTOCOL_CMS) && (*args == '-'))
+    return 0;
+
   sig->timestamp = _gpgme_parse_timestamp (end, &tail);
   if (sig->timestamp == -1 || end == tail || (*tail && *tail != ' '))
     return trace_gpg_error (GPG_ERR_INV_ENGINE);
@@ -1036,7 +1039,7 @@ _gpgme_verify_status_handler (void *priv, gpgme_status_code_t code, char *args)
 
     case GPGME_STATUS_SIGINFO:
       opd->only_newsig_seen = 0;
-      return sig ? parse_sig_info (sig, args)
+      return sig ? parse_sig_info (sig, args, ctx->protocol)
 	: trace_gpg_error (GPG_ERR_INV_ENGINE);
 
     case GPGME_STATUS_NODATA:
diff --git a/tests/gpg/t-verify.c b/tests/gpg/t-verify.c
index 66f4c337..02011807 100644
--- a/tests/gpg/t-verify.c
+++ b/tests/gpg/t-verify.c
@@ -132,7 +132,8 @@ static const char clearsigned_plus_key_block[] =
 static void
 check_result (gpgme_verify_result_t result, int no_of_sigs, int skip_sigs,
               unsigned int summary, const char *fpr,
-	      gpgme_error_t status, int notation, int validity)
+	      gpgme_error_t status, int notation, int validity,
+              unsigned long timestamp)
 {
   gpgme_signature_t sig;
   int n;
@@ -258,6 +259,13 @@ check_result (gpgme_verify_result_t result, int no_of_sigs, int skip_sigs,
                gpgme_strerror (sig->validity_reason));
       exit (1);
     }
+  if (sig->timestamp != timestamp)
+    {
+     fprintf (stderr, "%s:%i:sig-%d: Unexpected timestamp: "
+              "want=%li have=%li\n",
+	      PGM, __LINE__, skip_sigs, timestamp, sig->timestamp);
+      exit (1);
+    }
 }
 
 
@@ -288,7 +296,7 @@ main (int argc, char *argv[])
   result = gpgme_op_verify_result (ctx);
   check_result (result, 1, 0, GPGME_SIGSUM_VALID|GPGME_SIGSUM_GREEN,
                 "A0FF4590BB6122EDEF6E3C542D727CC768697734",
-		GPG_ERR_NO_ERROR, 1, GPGME_VALIDITY_FULL);
+		GPG_ERR_NO_ERROR, 1, GPGME_VALIDITY_FULL, 974322223);
 
   /* Checking a manipulated message.  */
   gpgme_data_release (text);
@@ -298,8 +306,12 @@ main (int argc, char *argv[])
   err = gpgme_op_verify (ctx, sig, text, NULL);
   fail_if_err (err);
   result = gpgme_op_verify_result (ctx);
-  check_result (result, 1, 0, GPGME_SIGSUM_RED, "2D727CC768697734",
-		GPG_ERR_BAD_SIGNATURE, 0, GPGME_VALIDITY_UNKNOWN);
+  if (have_gpg_version ("2.5.22"))
+    check_result (result, 1, 0, GPGME_SIGSUM_RED, "2D727CC768697734",
+		  GPG_ERR_BAD_SIGNATURE, 0, GPGME_VALIDITY_UNKNOWN, 974322223);
+  else
+    check_result (result, 1, 0, GPGME_SIGSUM_RED, "2D727CC768697734",
+		  GPG_ERR_BAD_SIGNATURE, 0, GPGME_VALIDITY_UNKNOWN, 0);
 
   /* Checking a valid message.  But that one has a second signature
    * made by an unknown key.  */
@@ -315,10 +327,10 @@ main (int argc, char *argv[])
   result = gpgme_op_verify_result (ctx);
   check_result (result, 2, 0, GPGME_SIGSUM_VALID|GPGME_SIGSUM_GREEN,
                 "A0FF4590BB6122EDEF6E3C542D727CC768697734",
-		GPG_ERR_NO_ERROR, 1, GPGME_VALIDITY_FULL);
+		GPG_ERR_NO_ERROR, 1, GPGME_VALIDITY_FULL, 974322223);
   check_result (result, 2, 1, GPGME_SIGSUM_KEY_MISSING,
                 "36EC2A70C6426EB0FCE5BB4DF91C98F049D4204C",
-		GPG_ERR_NO_PUBKEY, 0, GPGME_VALIDITY_UNKNOWN);
+		GPG_ERR_NO_PUBKEY, 0, GPGME_VALIDITY_UNKNOWN, 1523533703);
 
 
   /* Checking a normal signature.  */
@@ -333,7 +345,7 @@ main (int argc, char *argv[])
   result = gpgme_op_verify_result (ctx);
   check_result (result, 1, 0, GPGME_SIGSUM_VALID|GPGME_SIGSUM_GREEN,
                 "A0FF4590BB6122EDEF6E3C542D727CC768697734",
-		GPG_ERR_NO_ERROR, 0, GPGME_VALIDITY_FULL);
+		GPG_ERR_NO_ERROR, 0, GPGME_VALIDITY_FULL, 1015172412);
 
 
   /* Checking an invalid message.  */
diff --git a/tests/gpgsm/t-verify.c b/tests/gpgsm/t-verify.c
index 3e0c6550..681ab02d 100644
--- a/tests/gpgsm/t-verify.c
+++ b/tests/gpgsm/t-verify.c
@@ -53,7 +53,8 @@ static const char test_sig1[] =
 
 static void
 check_result (gpgme_verify_result_t result, int summary, const char *fpr,
-	      gpgme_error_t status, gpgme_validity_t validity)
+	      gpgme_error_t status, gpgme_validity_t validity,
+              unsigned long timestamp)
 {
   gpgme_signature_t sig;
 
@@ -109,6 +110,13 @@ check_result (gpgme_verify_result_t result, int summary, const char *fpr,
 	       __FILE__, __LINE__, gpgme_strerror (sig->validity_reason));
       got_errors = 1;
     }
+  if (sig->timestamp != timestamp)
+    {
+     fprintf (stderr, "%s:%i: Unexpected timestamp: "
+              "want=%li have=%li\n",
+	      __FILE__, __LINE__, timestamp, sig->timestamp);
+      exit (1);
+    }
 }
 
 
@@ -159,7 +167,7 @@ main (void)
   result = gpgme_op_verify_result (ctx);
   check_result (result, GPGME_SIGSUM_VALID | GPGME_SIGSUM_GREEN,
 		"3CF405464F66ED4A7DF45BBDD1E4282E33BDB76E",
-		GPG_ERR_NO_ERROR, GPGME_VALIDITY_FULL);
+		GPG_ERR_NO_ERROR, GPGME_VALIDITY_FULL, 0);
 
   show_auditlog (ctx);
 
@@ -173,7 +181,7 @@ main (void)
   result = gpgme_op_verify_result (ctx);
   check_result (result, GPGME_SIGSUM_RED,
 		"3CF405464F66ED4A7DF45BBDD1E4282E33BDB76E",
-		GPG_ERR_BAD_SIGNATURE, GPGME_VALIDITY_UNKNOWN);
+		GPG_ERR_BAD_SIGNATURE, GPGME_VALIDITY_UNKNOWN, 0);
 
   show_auditlog (ctx);