From 4cb1906c1c47ce2c8b7180bc31ffdb1af4b5ffe8 Mon Sep 17 00:00:00 2001 From: Ingo Klöcker Date: Thu, 9 Jul 2026 16:34:06 +0200 Subject: Ignore TRUST_ status lines if no NEWSIG was seen * src/verify.c (_gpgme_verify_status_handler): Don't return error if TRUST_* status line is seen before NEWSIG status line has been seen. -- Since recently, in de-vs compliance mode, gpgsm emits TRUST_ status lines during decryption if the validation of the encryption certificate fails. Consequently, it's not an error if a TRUST_ status line is seen without having seen a NEWSIG status line before. GnuPG-bug-id: 8333 --- src/verify.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/verify.c b/src/verify.c index 19ac5d71..7ae18cb8 100644 --- a/src/verify.c +++ b/src/verify.c @@ -996,9 +996,14 @@ _gpgme_verify_status_handler (void *priv, gpgme_status_code_t code, char *args) case GPGME_STATUS_TRUST_MARGINAL: case GPGME_STATUS_TRUST_FULLY: case GPGME_STATUS_TRUST_ULTIMATE: + /* In de-vs compliance mode TRUST_ status is emitted during + * decryption if validation of the encryption certificate + * fails. Silently, ignore such a status line if no NEWSIG + * was seen. */ + if (!sig) + break; opd->only_newsig_seen = 0; - return sig ? parse_trust (sig, code, args) - : trace_gpg_error (GPG_ERR_INV_ENGINE); + return parse_trust (sig, code, args); case GPGME_STATUS_PKA_TRUST_BAD: case GPGME_STATUS_PKA_TRUST_GOOD: -- cgit