From bfd320abfeaf0c7a16af3057279c77a45bfa961a Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Mon, 5 May 2025 15:52:08 +0200 Subject: Allow signing using an exactly specified subkey. * src/engine-gpg.c (append_args_from_signers): Detect exactly specified keys and apped the '!' suffix. -- Due to the ABI break which removed long long deprecated functions we can also risk to introduce a slight semantic change in the way signer keys are specified. The change is that iff a subkey-fingerprint with the '!' suffix was used to lookup a signer's key we now use this specific subkey and not any key gpg considers to be a good signing subkey. Most people would have considered the old behaviour anyway as a bug because it differs from what gpg uses at the command line. GnuPG-bug-id: 3325 Suggested-by: Benjamin Kibbey --- doc/gpgme.texi | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'doc') diff --git a/doc/gpgme.texi b/doc/gpgme.texi index bc4b1ac5..aadf9654 100644 --- a/doc/gpgme.texi +++ b/doc/gpgme.texi @@ -3658,6 +3658,11 @@ Brainpool curve. The compliance flags (e.g. is_de_vs) are set but the software has not yet been approved or is in a beta state. +@item unsigned int subkey_match : 1; +@since{2.0.0} +This flag is set iff the key has been looked up using a +fingerprint with a '!' suffix. + @item unsigned int secret : 1 This is true if the subkey is a secret key. Note that it will be false if the key is actually a stub key; i.e., a secret key operation @@ -6476,7 +6481,9 @@ Every context starts with an empty list. @deftypefun gpgme_error_t gpgme_signers_add (@w{gpgme_ctx_t @var{ctx}}, @w{const gpgme_key_t @var{key}}) The function @code{gpgme_signers_add} adds the key @var{key} to the -list of signers in the context @var{ctx}. +list of signers in the context @var{ctx}. If the key has the +subkey_match flag set (i.e. it was found via a fingerprint with '!' +suffix) that specific subkey is used for signing. Calling this function acquires an additional reference for the key. @end deftypefun -- cgit