From 8081d34e5f620a614f58617700f9b473392e6478 Mon Sep 17 00:00:00 2001
From: Werner Koch <wk@gnupg.org>
Date: Sun, 17 May 2026 12:59:42 +0200
Subject: Support setting attributes for CMS signatures.

* src/gpgme.h.in (GPGME_SIG_NOTATION_UNPROTECTED): New.
(struct _gpgme_sig_notation): Add field 'unprotected'.
* src/sig-notation.c (sig_notation_set_flags): Set flag.
* src/engine-gpgsm.c (gpgsm_sign): Implement setting of notations.

* tests/run-support.h: Add conversion macros.
* tests/run-sign.c (struct mystringlist_s): New.
(xmalloc): New.
(xstrtokenize): New.
(print_result): Add arg fp and adjust callers.
(main): Add options --binary and --notation.
---
 src/engine-gpgsm.c | 43 +++++++++++++++++++++++++++++++++++++++++++
 src/gpgme.h.in     |  6 +++++-
 src/sig-notation.c |  1 +
 3 files changed, 49 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/engine-gpgsm.c b/src/engine-gpgsm.c
index 94edab6b..21d6329b 100644
--- a/src/engine-gpgsm.c
+++ b/src/engine-gpgsm.c
@@ -2243,6 +2243,8 @@ gpgsm_sign (void *engine, gpgme_data_t in, gpgme_data_t out,
   char *assuan_cmd;
   int i;
   gpgme_key_t key;
+  gpgme_sig_notation_t notation;
+  int any_notations;
 
   (void)use_textmode;
 
@@ -2275,6 +2277,47 @@ gpgsm_sign (void *engine, gpgme_data_t in, gpgme_data_t out,
 	return err;
     }
 
+  /* Setup attributes.  */
+  any_notations = 0;
+  for (notation = gpgme_sig_notation_get (ctx);
+       notation; notation = notation->next)
+    {
+      if (!notation->name || !*notation->name)
+        continue;  /* We always require a name.  */
+      if (*notation->name == '_')
+        {
+          /* System attribute - use verbatim.  */
+          assuan_cmd = _gpgme_strconcat
+            (!any_notations? "SETATTR --clear ": "SETATTR ",
+             notation->name, NULL);
+          if (!assuan_cmd)
+            return gpg_error_from_syserror ();
+        }
+      else if (!notation->value || !*notation->value)
+        {
+          /* Note that a regular attribute requires a value.  */
+          return gpg_error (GPG_ERR_INV_VALUE);
+        }
+      else
+        {
+          /* FIXME: Handle long attribute values.  */
+          assuan_cmd = _gpgme_strconcat
+            (!any_notations? "SETATTR --clear ": "SETATTR ",
+             notation->name,
+             notation->flags & GPGME_SIG_NOTATION_UNPROTECTED? ":u:":":s:",
+             notation->value, NULL);
+          if (!assuan_cmd)
+            return gpg_error_from_syserror ();
+        }
+      err = gpgsm_assuan_simple_command (gpgsm, assuan_cmd, NULL, NULL);
+      free (assuan_cmd);
+      assuan_cmd = NULL;
+      if (err)
+        return err;
+      any_notations = 1; /* Do not use --clear the next round.  */
+    }
+
+
   for (i = 0; (key = gpgme_signers_enum (ctx, i)); i++)
     {
       const char *s = key->subkeys ? key->subkeys->fpr : NULL;
diff --git a/src/gpgme.h.in b/src/gpgme.h.in
index c8748eb7..bfc9f490 100644
--- a/src/gpgme.h.in
+++ b/src/gpgme.h.in
@@ -428,6 +428,7 @@ typedef unsigned int gpgme_export_mode_t;
 /* The available signature notation flags.  */
 #define GPGME_SIG_NOTATION_HUMAN_READABLE	1
 #define GPGME_SIG_NOTATION_CRITICAL		2
+#define GPGME_SIG_NOTATION_UNPROTECTED          4
 
 typedef unsigned int gpgme_sig_notation_flags_t;
 
@@ -508,8 +509,11 @@ struct _gpgme_sig_notation
   /* Notation data is critical.  */
   unsigned int critical : 1;
 
+  /* Notaion data is unprotected (unsigned).  */
+  unsigned int unprotected : 1;
+
   /* Internal to GPGME, do not use.  */
-  int _unused : 30;
+  int _unused : 29;
 };
 
 
diff --git a/src/sig-notation.c b/src/sig-notation.c
index bebf426e..30573ca2 100644
--- a/src/sig-notation.c
+++ b/src/sig-notation.c
@@ -58,6 +58,7 @@ sig_notation_set_flags (gpgme_sig_notation_t notation,
      accessible individually for the user.  */
   notation->human_readable = flags & GPGME_SIG_NOTATION_HUMAN_READABLE ? 1 : 0;
   notation->critical = flags & GPGME_SIG_NOTATION_CRITICAL ? 1 : 0;
+  notation->unprotected = flags & GPGME_SIG_NOTATION_UNPROTECTED ? 1 : 0;
 
   notation->flags = flags;
 }
-- 
cgit