Bugs for Sorcery are reported here

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=13815

           Summary: no multisign support
           Product: Sorcery
           Version: 1.14.x
          Platform: Other
               URL: http://ftp.digium.com/pub/libpri/old/
        OS/Version: other
            Status: NEW
          Severity: normal
          Priority: P2
         Component: subroutines
        AssignedTo: sm-sorcery-bugs AT lists.ibiblio.org
        ReportedBy: jakakranjc AT email.si


I was adding a new spell, libpri (10269) and changed it to use upstream 
signing 
for verification. However, it kept failing the verification:

lynxlynx navaden # delve -c start PRE_BUILD libpri
staging enabled
Building libpri
GPG checking source file libpri-1.4.0.tar.gz...
--sha1 sha1 sha1 sha1 sha1--
Algorithm used: sha1
Algorithm checks out
Checking spell level sha1
Spell level is not an allowed level
Failure to verify gpg signature
Abort? [y]

spell level sha1?? I tracked the problem down to this gpg_verify_signature 
call:
  gpg_verify_signature "$( locate_spell_file "$SFNAME" )" \
                       "$FILENAME" \
                       "$( locate_spell_file "$PFNAME" securely)" GPGALGO_USED

I appended an "echo --$GPGALGO_USED--" which can be seen in the above output. 
This tarball is multisigned and the extra fields in GPGALGO_USED push 
GPGLEVEL 
to some further parameter number in the next call (no quoting):
if is_allowed_hash $GPGALGO_USED $GPGLEVEL ; then rc=0 ; else rc=1 ; fi

resulting in this bugreport.

The easiest thing would be to make gpg_verify_signature return/set just one 
algorithm, but this could be problematic if a signature file contained 
different kinds of signatures (algorithms). So perhaps is_allowed_hash should 
iterate over all of the algorithms and remove the unacceptable ones from the 
signature file.

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.