Skip to Content.
Sympa Menu

sm-sorcery-bugs - [SM-Sorcery-Bugs] [Bug 13815] New: no multisign support

sm-sorcery-bugs AT lists.ibiblio.org

Subject: Bugs for Sorcery are reported here

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-sorcery-bugs AT lists.ibiblio.org
  • Subject: [SM-Sorcery-Bugs] [Bug 13815] New: no multisign support
  • Date: 3 Jun 2007 14:10:25 -0000

http://bugs.sourcemage.org/show_bug.cgi?id=13815

Summary: no multisign support
Product: Sorcery
Version: 1.14.x
Platform: Other
URL: http://ftp.digium.com/pub/libpri/old/
OS/Version: other
Status: NEW
Severity: normal
Priority: P2
Component: subroutines
AssignedTo: sm-sorcery-bugs AT lists.ibiblio.org
ReportedBy: jakakranjc AT email.si


I was adding a new spell, libpri (10269) and changed it to use upstream
signing
for verification. However, it kept failing the verification:

lynxlynx navaden # delve -c start PRE_BUILD libpri
staging enabled
Building libpri
GPG checking source file libpri-1.4.0.tar.gz...
--sha1 sha1 sha1 sha1 sha1--
Algorithm used: sha1
Algorithm checks out
Checking spell level sha1
Spell level is not an allowed level
Failure to verify gpg signature
Abort? [y]

spell level sha1?? I tracked the problem down to this gpg_verify_signature
call:
gpg_verify_signature "$( locate_spell_file "$SFNAME" )" \
"$FILENAME" \
"$( locate_spell_file "$PFNAME" securely)" GPGALGO_USED

I appended an "echo --$GPGALGO_USED--" which can be seen in the above output.
This tarball is multisigned and the extra fields in GPGALGO_USED push
GPGLEVEL
to some further parameter number in the next call (no quoting):
if is_allowed_hash $GPGALGO_USED $GPGLEVEL ; then rc=0 ; else rc=1 ; fi

resulting in this bugreport.

The easiest thing would be to make gpg_verify_signature return/set just one
algorithm, but this could be problematic if a signature file contained
different kinds of signatures (algorithms). So perhaps is_allowed_hash should
iterate over all of the algorithms and remove the unacceptable ones from the
signature file.

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.



  • [SM-Sorcery-Bugs] [Bug 13815] New: no multisign support, bugzilla-daemon, 06/03/2007

Archive powered by MHonArc 2.6.24.

Top of Page