PGPainless/pgpainless
PGPainless/pgpainless
1
0
Fork 0
mirror of https://github.com/pgpainless/pgpainless.git synced 2025-12-10 06:11:08 +01:00
Code Issues Releases Wiki Activity

Rework key modification API.

Browse source 
Fixes #225
This commit is contained in:
Paul Schaub 2021-12-20 12:46:31 +01:00
parent deb23fb7e3
commit 710f961984
13 changed files with 510 additions and 204 deletions
Download patch file Download diff file Expand all files Collapse all files

125
pgpainless-core/src/main/java/org/pgpainless/key/info/KeyRingInfo.java
View file

@ -22,6 +22,7 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.bouncycastle.bcpg.sig.PrimaryUserID;
import org.bouncycastle.bcpg.sig.RevocationReason;
import org.bouncycastle.openpgp.PGPKeyRing;
import org.bouncycastle.openpgp.PGPPublicKey;
import org.bouncycastle.openpgp.PGPPublicKeyRing;
@ -38,9 +39,10 @@ import org.pgpainless.algorithm.SymmetricKeyAlgorithm;
import org.pgpainless.exception.KeyValidationError;
import org.pgpainless.key.OpenPgpFingerprint;
import org.pgpainless.key.SubkeyIdentifier;
import org.pgpainless.key.util.RevocationAttributes;
import org.pgpainless.policy.Policy;
import org.pgpainless.signature.consumer.SignaturePicker;
import org.pgpainless.signature.SignatureUtils;
import org.pgpainless.signature.consumer.SignaturePicker;
import org.pgpainless.signature.subpackets.SignatureSubpacketsUtil;
/**
@ -52,6 +54,8 @@ public class KeyRingInfo {
private final PGPKeyRing keys;
private Signatures signatures;
private final Date evaluationDate;
private final String primaryUserId;
/**
* Evaluate the key ring at creation time of the given signature.
@ -82,6 +86,8 @@ public class KeyRingInfo {
public KeyRingInfo(PGPKeyRing keys, Date validationDate) {
this.keys = keys;
this.signatures = new Signatures(keys, validationDate, PGPainless.getPolicy());
this.evaluationDate = validationDate;
this.primaryUserId = findPrimaryUserId();
}
/**
@ -251,45 +257,67 @@ public class KeyRingInfo {
return OpenPgpFingerprint.of(getPublicKey());
}
public @Nullable String getPrimaryUserId() {
return primaryUserId;
}
/**
* Return the primary user-id of the key ring.
*
* Note: If no user-id is marked as primary key using a {@link PrimaryUserID} packet,
* this method returns the first valid user-id, otherwise null.
* this method returns the latest added user-id, otherwise null.
*
* @return primary user-id or null
*/
public @Nullable String getPrimaryUserId() {
private String findPrimaryUserId() {
String nonPrimaryUserId = null;
String primaryUserId = null;
Date modificationDate = null;
List<String> validUserIds = getValidUserIds();
if (validUserIds.isEmpty()) {
List<String> userIds = getUserIds();
if (userIds.isEmpty()) {
return null;
}
for (String userId : validUserIds) {
if (userIds.size() == 1) {
return userIds.get(0);
}
PGPSignature signature = signatures.userIdCertifications.get(userId);
if (signature == null) {
for (String userId : userIds) {
PGPSignature certification = signatures.userIdCertifications.get(userId);
if (certification == null) {
continue;
}
Date creationTime = certification.getCreationTime();
PrimaryUserID subpacket = SignatureSubpacketsUtil.getPrimaryUserId(signature);
if (subpacket != null && subpacket.isPrimaryUserID()) {
// if there are multiple primary userIDs, return most recently signed
if (modificationDate == null || !signature.getCreationTime().before(modificationDate)) {
if (certification.getHashedSubPackets().isPrimaryUserID()) {
if (nonPrimaryUserId != null) {
nonPrimaryUserId = null;
modificationDate = null;
}
if (modificationDate == null || creationTime.after(modificationDate)) {
primaryUserId = userId;
modificationDate = signature.getCreationTime();
modificationDate = creationTime;
}
} else {
if (primaryUserId != null) {
continue;
}
if (modificationDate == null || creationTime.after(modificationDate)) {
nonPrimaryUserId = userId;
modificationDate = creationTime;
}
}
}
// Workaround for keys with only one user-id but no primary user-id packet.
if (primaryUserId == null) {
return validUserIds.get(0);
if (primaryUserId != null) {
return primaryUserId;
}
return primaryUserId;
return nonPrimaryUserId;
}
/**
@ -314,7 +342,7 @@ public class KeyRingInfo {
List<String> valid = new ArrayList<>();
List<String> userIds = getUserIds();
for (String userId : userIds) {
if (isUserIdValid(userId)) {
if (isUserIdBound(userId)) {
valid.add(userId);
}
}
@ -328,6 +356,18 @@ public class KeyRingInfo {
* @return true if user-id is valid
*/
public boolean isUserIdValid(String userId) {
if (!userId.equals(primaryUserId)) {
if (!isUserIdBound(primaryUserId)) {
// primary user-id not valid
return false;
}
}
return isUserIdBound(userId);
}
private boolean isUserIdBound(String userId) {
PGPSignature certification = signatures.userIdCertifications.get(userId);
PGPSignature revocation = signatures.userIdRevocations.get(userId);
@ -338,6 +378,12 @@ public class KeyRingInfo {
if (SignatureUtils.isSignatureExpired(certification)) {
return false;
}
if (certification.getHashedSubPackets().isPrimaryUserID()) {
Date keyExpiration = SignatureSubpacketsUtil.getKeyExpirationTimeAsDate(certification, keys.getPublicKey());
if (keyExpiration != null && evaluationDate.after(keyExpiration)) {
return false;
}
}
// Not revoked -> valid
if (revocation == null) {
return true;
@ -588,7 +634,7 @@ public class KeyRingInfo {
}
}
PGPSignature primaryUserIdCertification = getLatestUserIdCertification(getPrimaryUserId());
PGPSignature primaryUserIdCertification = getLatestUserIdCertification(getPossiblyExpiredUserId());
if (primaryUserIdCertification != null) {
return SignatureSubpacketsUtil.getKeyExpirationTimeAsDate(primaryUserIdCertification, getPublicKey());
}
@ -596,6 +642,38 @@ public class KeyRingInfo {
throw new NoSuchElementException("No suitable signatures found on the key.");
}
public String getPossiblyExpiredUserId() {
String validPrimaryUserId = getPrimaryUserId();
if (validPrimaryUserId != null) {
return validPrimaryUserId;
}
Date latestCreationTime = null;
String primaryUserId = null;
boolean foundPrimary = false;
for (String userId : getUserIds()) {
PGPSignature signature = getLatestUserIdCertification(userId);
if (signature == null) {
continue;
}
boolean isPrimary = signature.getHashedSubPackets().isPrimaryUserID();
if (foundPrimary && !isPrimary) {
continue;
}
Date creationTime = signature.getCreationTime();
if (latestCreationTime == null || creationTime.after(latestCreationTime) || isPrimary && !foundPrimary) {
latestCreationTime = creationTime;
primaryUserId = userId;
}
foundPrimary |= isPrimary;
}
return primaryUserId;
}
/**
* Return the expiration date of the subkey with the provided fingerprint.
*
@ -668,6 +746,15 @@ public class KeyRingInfo {
return primaryExpiration;
}
public boolean isHardRevoked(String userId) {
PGPSignature revocation = signatures.userIdRevocations.get(userId);
if (revocation == null) {
return false;
}
RevocationReason revocationReason = revocation.getHashedSubPackets().getRevocationReason();
return revocationReason == null || RevocationAttributes.Reason.isHardRevocation(revocationReason.getRevocationReason());
}
/**
* Return true if the key ring is a {@link PGPSecretKeyRing}.
* If it is a {@link PGPPublicKeyRing} return false and if it is neither, throw an {@link AssertionError}.

237
pgpainless-core/src/main/java/org/pgpainless/key/modification/secretkeyring/SecretKeyRingEditor.java
View file

@ -22,17 +22,14 @@ import javax.annotation.Nullable;
import org.bouncycastle.bcpg.S2K;
import org.bouncycastle.bcpg.SecretKeyPacket;
import org.bouncycastle.bcpg.sig.KeyExpirationTime;
import org.bouncycastle.openpgp.PGPException;
import org.bouncycastle.openpgp.PGPKeyPair;
import org.bouncycastle.openpgp.PGPKeyRingGenerator;
import org.bouncycastle.openpgp.PGPPrivateKey;
import org.bouncycastle.openpgp.PGPPublicKey;
import org.bouncycastle.openpgp.PGPSecretKey;
import org.bouncycastle.openpgp.PGPSecretKeyRing;
import org.bouncycastle.openpgp.PGPSignature;
import org.bouncycastle.openpgp.PGPSignatureGenerator;
import org.bouncycastle.openpgp.PGPSignatureSubpacketGenerator;
import org.bouncycastle.openpgp.PGPSignatureSubpacketVector;
import org.bouncycastle.openpgp.operator.PBESecretKeyDecryptor;
import org.bouncycastle.openpgp.operator.PBESecretKeyEncryptor;
import org.bouncycastle.openpgp.operator.PGPContentSignerBuilder;
@ -47,7 +44,6 @@ import org.pgpainless.algorithm.SignatureType;
import org.pgpainless.algorithm.SymmetricKeyAlgorithm;
import org.pgpainless.algorithm.negotiation.HashAlgorithmNegotiator;
import org.pgpainless.implementation.ImplementationFactory;
import org.pgpainless.key.OpenPgpFingerprint;
import org.pgpainless.key.generation.KeyRingBuilder;
import org.pgpainless.key.generation.KeySpec;
import org.pgpainless.key.info.KeyRingInfo;
@ -55,18 +51,16 @@ import org.pgpainless.key.protection.CachingSecretKeyRingProtector;
import org.pgpainless.key.protection.KeyRingProtectionSettings;
import org.pgpainless.key.protection.PasswordBasedSecretKeyRingProtector;
import org.pgpainless.key.protection.SecretKeyRingProtector;
import org.pgpainless.key.protection.UnlockSecretKey;
import org.pgpainless.key.protection.UnprotectedKeysProtector;
import org.pgpainless.key.protection.fixes.S2KUsageFix;
import org.pgpainless.key.protection.passphrase_provider.SolitaryPassphraseProvider;
import org.pgpainless.key.util.KeyRingUtils;
import org.pgpainless.key.util.RevocationAttributes;
import org.pgpainless.signature.SignatureUtils;
import org.pgpainless.signature.builder.DirectKeySignatureBuilder;
import org.pgpainless.signature.builder.RevocationSignatureBuilder;
import org.pgpainless.signature.builder.SelfSignatureBuilder;
import org.pgpainless.signature.subpackets.RevocationSignatureSubpackets;
import org.pgpainless.signature.subpackets.SelfSignatureSubpackets;
import org.pgpainless.signature.subpackets.SignatureSubpacketGeneratorUtil;
import org.pgpainless.signature.subpackets.SignatureSubpackets;
import org.pgpainless.signature.subpackets.SignatureSubpacketsHelper;
import org.pgpainless.signature.subpackets.SignatureSubpacketsUtil;
@ -107,6 +101,9 @@ public class SecretKeyRingEditor implements SecretKeyRingEditorInterface {
// retain key flags from previous signature
KeyRingInfo info = PGPainless.inspectKeyRing(secretKeyRing);
if (info.isHardRevoked(userId.toString())) {
throw new IllegalArgumentException("User-ID " + userId + " is hard revoked and cannot be re-certified.");
}
List<KeyFlag> keyFlags = info.getKeyFlagsOf(info.getKeyId());
Set<HashAlgorithm> hashAlgorithmPreferences;
@ -146,15 +143,54 @@ public class SecretKeyRingEditor implements SecretKeyRingEditorInterface {
public SecretKeyRingEditorInterface addPrimaryUserId(
@Nonnull CharSequence userId, @Nonnull SecretKeyRingProtector protector)
throws PGPException {
return addUserId(
// Determine previous key expiration date
PGPPublicKey primaryKey = secretKeyRing.getSecretKey().getPublicKey();
/*
KeyRingInfo info = PGPainless.inspectKeyRing(secretKeyRing);
String primaryUserId = info.getPrimaryUserId();
PGPSignature signature = primaryUserId == null ?
info.getLatestDirectKeySelfSignature() : info.getLatestUserIdCertification(primaryUserId);
final Date previousKeyExpiration = signature == null ? null :
SignatureSubpacketsUtil.getKeyExpirationTimeAsDate(signature, primaryKey);
*/
final Date previousKeyExpiration = null;
// Add new primary user-id signature
addUserId(
userId,
new SelfSignatureSubpackets.Callback() {
@Override
public void modifyHashedSubpackets(SelfSignatureSubpackets hashedSubpackets) {
hashedSubpackets.setPrimaryUserId();
if (previousKeyExpiration != null) {
hashedSubpackets.setKeyExpirationTime(primaryKey, previousKeyExpiration);
} else {
hashedSubpackets.setKeyExpirationTime(null);
}
}
},
protector);
// unmark previous primary user-ids to be non-primary
KeyRingInfo info = PGPainless.inspectKeyRing(secretKeyRing);
for (String otherUserId : info.getValidUserIds()) {
if (userId.toString().equals(otherUserId)) {
continue;
}
// We need to unmark this user-id as primary
if (info.getLatestUserIdCertification(otherUserId).getHashedSubPackets().isPrimaryUserID()) {
addUserId(otherUserId, new SelfSignatureSubpackets.Callback() {
@Override
public void modifyHashedSubpackets(SelfSignatureSubpackets hashedSubpackets) {
hashedSubpackets.setPrimaryUserId(null);
hashedSubpackets.setKeyExpirationTime(null); // non-primary
}
}, protector);
}
}
return this;
}
// TODO: Move to utility class?
@ -468,118 +504,119 @@ public class SecretKeyRingEditor implements SecretKeyRingEditorInterface {
@Nullable Date expiration,
@Nonnull SecretKeyRingProtector secretKeyRingProtector)
throws PGPException {
return setExpirationDate(OpenPgpFingerprint.of(secretKeyRing), expiration, secretKeyRingProtector);
}
@Override
public SecretKeyRingEditorInterface setExpirationDate(
@Nonnull OpenPgpFingerprint fingerprint,
@Nullable Date expiration,
@Nonnull SecretKeyRingProtector secretKeyRingProtector)
throws PGPException {
List<PGPSecretKey> secretKeyList = new ArrayList<>();
PGPSecretKey primaryKey = secretKeyRing.getSecretKey();
if (!primaryKey.isMasterKey()) {
throw new IllegalArgumentException("Key Ring does not appear to contain a primary secret key.");
}
boolean found = false;
for (PGPSecretKey secretKey : secretKeyRing) {
// Skip over unaffected subkeys
if (secretKey.getKeyID() != fingerprint.getKeyId()) {
secretKeyList.add(secretKey);
// reissue direct key sig
PGPSignature prevDirectKeySig = getPreviousDirectKeySignature();
if (prevDirectKeySig != null) {
PGPSignature directKeySig = reissueDirectKeySignature(expiration, secretKeyRingProtector, prevDirectKeySig);
secretKeyRing = KeyRingUtils.injectCertification(secretKeyRing, primaryKey.getPublicKey(), directKeySig);
}
// reissue primary user-id sig
String primaryUserId = PGPainless.inspectKeyRing(secretKeyRing).getPossiblyExpiredUserId();
if (primaryUserId != null) {
PGPSignature prevUserIdSig = getPreviousUserIdSignatures(primaryUserId);
PGPSignature userIdSig = reissuePrimaryUserIdSig(expiration, secretKeyRingProtector, primaryUserId, prevUserIdSig);
secretKeyRing = KeyRingUtils.injectCertification(secretKeyRing, primaryUserId, userIdSig);
}
KeyRingInfo info = PGPainless.inspectKeyRing(secretKeyRing);
for (String userId : info.getValidUserIds()) {
if (userId.equals(primaryUserId)) {
continue;
}
// We found the target subkey
found = true;
secretKey = setExpirationDate(primaryKey, secretKey, expiration, secretKeyRingProtector);
secretKeyList.add(secretKey);
}
if (!found) {
throw new IllegalArgumentException("Key Ring does not contain secret key with fingerprint " + fingerprint);
}
PGPSignature prevUserIdSig = info.getLatestUserIdCertification(userId);
if (prevUserIdSig == null) {
throw new AssertionError("A valid user-id shall never have no user-id signature.");
}
secretKeyRing = new PGPSecretKeyRing(secretKeyList);
if (prevUserIdSig.getHashedSubPackets().isPrimaryUserID()) {
PGPSignature userIdSig = reissueNonPrimaryUserId(secretKeyRingProtector, userId, prevUserIdSig);
secretKeyRing = KeyRingUtils.injectCertification(secretKeyRing, primaryUserId, userIdSig);
}
}
return this;
}
private PGPSecretKey setExpirationDate(PGPSecretKey primaryKey,
PGPSecretKey subjectKey,
Date expiration,
SecretKeyRingProtector secretKeyRingProtector)
private PGPSignature reissueNonPrimaryUserId(
SecretKeyRingProtector secretKeyRingProtector,
String userId,
PGPSignature prevUserIdSig)
throws PGPException {
if (expiration != null && expiration.before(subjectKey.getPublicKey().getCreationTime())) {
throw new IllegalArgumentException("Expiration date cannot be before creation date.");
}
PGPPrivateKey privateKey = UnlockSecretKey.unlockSecretKey(primaryKey, secretKeyRingProtector);
PGPPublicKey subjectPubKey = subjectKey.getPublicKey();
PGPSignature oldSignature = getPreviousSignature(primaryKey, subjectPubKey);
PGPSignatureSubpacketVector oldSubpackets = oldSignature.getHashedSubPackets();
PGPSignatureSubpacketGenerator subpacketGenerator = new PGPSignatureSubpacketGenerator(oldSubpackets);
SignatureSubpacketGeneratorUtil.setSignatureCreationTimeInSubpacketGenerator(new Date(), subpacketGenerator);
SignatureSubpacketGeneratorUtil.setKeyExpirationDateInSubpacketGenerator(
expiration, subjectPubKey.getCreationTime(), subpacketGenerator);
PGPSignatureGenerator signatureGenerator = SignatureUtils.getSignatureGeneratorFor(primaryKey);
signatureGenerator.setHashedSubpackets(subpacketGenerator.generate());
if (primaryKey.getKeyID() == subjectKey.getKeyID()) {
signatureGenerator.init(PGPSignature.POSITIVE_CERTIFICATION, privateKey);
for (Iterator<String> it = subjectKey.getUserIDs(); it.hasNext(); ) {
String userId = it.next();
PGPSignature signature = signatureGenerator.generateCertification(userId, subjectPubKey);
subjectPubKey = PGPPublicKey.addCertification(subjectPubKey, userId, signature);
SelfSignatureBuilder builder = new SelfSignatureBuilder(secretKeyRing.getSecretKey(), secretKeyRingProtector, prevUserIdSig);
builder.applyCallback(new SelfSignatureSubpackets.Callback() {
@Override
public void modifyHashedSubpackets(SelfSignatureSubpackets hashedSubpackets) {
// unmark as primary
hashedSubpackets.setPrimaryUserId(null);
}
} else {
signatureGenerator.init(PGPSignature.SUBKEY_BINDING, privateKey);
PGPSignature signature = signatureGenerator.generateCertification(
primaryKey.getPublicKey(), subjectPubKey);
subjectPubKey = PGPPublicKey.addCertification(subjectPubKey, signature);
}
subjectKey = PGPSecretKey.replacePublicKey(subjectKey, subjectPubKey);
return subjectKey;
});
return builder.build(secretKeyRing.getPublicKey(), userId);
}
private PGPSignature getPreviousSignature(PGPSecretKey primaryKey, PGPPublicKey subjectPubKey) {
PGPSignature oldSignature = null;
if (primaryKey.getKeyID() == subjectPubKey.getKeyID()) {
Iterator<PGPSignature> keySignatures = subjectPubKey.getSignaturesForKeyID(primaryKey.getKeyID());
while (keySignatures.hasNext()) {
PGPSignature next = keySignatures.next();
SignatureType type = SignatureType.valueOf(next.getSignatureType());
if (type == SignatureType.POSITIVE_CERTIFICATION ||
type == SignatureType.CASUAL_CERTIFICATION ||
type == SignatureType.GENERIC_CERTIFICATION) {
oldSignature = next;
private PGPSignature reissuePrimaryUserIdSig(
@Nullable Date expiration,
@Nonnull SecretKeyRingProtector secretKeyRingProtector,
@Nonnull String primaryUserId,
@Nonnull PGPSignature prevUserIdSig)
throws PGPException {
PGPSecretKey primaryKey = secretKeyRing.getSecretKey();
PGPPublicKey publicKey = primaryKey.getPublicKey();
SelfSignatureBuilder builder = new SelfSignatureBuilder(primaryKey, secretKeyRingProtector, prevUserIdSig);
builder.applyCallback(new SelfSignatureSubpackets.Callback() {
@Override
public void modifyHashedSubpackets(SelfSignatureSubpackets hashedSubpackets) {
if (expiration != null) {
hashedSubpackets.setKeyExpirationTime(true, publicKey.getCreationTime(), expiration);
} else {
hashedSubpackets.setKeyExpirationTime(new KeyExpirationTime(true, 0));
}
hashedSubpackets.setPrimaryUserId();
}
});
return builder.build(publicKey, primaryUserId);
}
private PGPSignature reissueDirectKeySignature(
Date expiration,
SecretKeyRingProtector secretKeyRingProtector,
PGPSignature prevDirectKeySig)
throws PGPException {
PGPSecretKey primaryKey = secretKeyRing.getSecretKey();
PGPPublicKey publicKey = primaryKey.getPublicKey();
final Date keyCreationTime = publicKey.getCreationTime();
DirectKeySignatureBuilder builder = new DirectKeySignatureBuilder(primaryKey, secretKeyRingProtector, prevDirectKeySig);
builder.applyCallback(new SelfSignatureSubpackets.Callback() {
@Override
public void modifyHashedSubpackets(SelfSignatureSubpackets hashedSubpackets) {
if (expiration != null) {
hashedSubpackets.setKeyExpirationTime(keyCreationTime, expiration);
} else {
hashedSubpackets.setKeyExpirationTime(null);
}
}
if (oldSignature == null) {
throw new IllegalStateException("Key " + OpenPgpFingerprint.of(subjectPubKey) +
" does not have a previous positive/casual/generic certification signature.");
}
} else {
Iterator<PGPSignature> bindingSignatures = subjectPubKey.getSignaturesOfType(
SignatureType.SUBKEY_BINDING.getCode());
while (bindingSignatures.hasNext()) {
oldSignature = bindingSignatures.next();
}
}
});
if (oldSignature == null) {
throw new IllegalStateException("Key " + OpenPgpFingerprint.of(subjectPubKey) +
" does not have a previous subkey binding signature.");
}
return oldSignature;
return builder.build(publicKey);
}
private PGPSignature getPreviousDirectKeySignature() {
KeyRingInfo info = PGPainless.inspectKeyRing(secretKeyRing);
return info.getLatestDirectKeySelfSignature();
}
private PGPSignature getPreviousUserIdSignatures(String userId) {
KeyRingInfo info = PGPainless.inspectKeyRing(secretKeyRing);
return info.getLatestUserIdCertification(userId);
}
@Override

14
pgpainless-core/src/main/java/org/pgpainless/key/modification/secretkeyring/SecretKeyRingEditorInterface.java
View file

@ -366,20 +366,6 @@ public interface SecretKeyRingEditorInterface {
@Nonnull SecretKeyRingProtector secretKeyRingProtector)
throws PGPException;
/**
* Set key expiration time.
*
* @param fingerprint key that will have its expiration date adjusted
* @param expiration target expiration time or @{code null} for no expiration
* @param secretKeyRingProtector protector to unlock the priary key
* @return the builder
*/
SecretKeyRingEditorInterface setExpirationDate(
@Nonnull OpenPgpFingerprint fingerprint,
@Nullable Date expiration,
@Nonnull SecretKeyRingProtector secretKeyRingProtector)
throws PGPException;
/**
* Create a detached revocation certificate, which can be used to revoke the whole key.
*

15
pgpainless-core/src/main/java/org/pgpainless/signature/builder/SubkeyBindingSignatureBuilder.java
View file

@ -21,6 +21,21 @@ public class SubkeyBindingSignatureBuilder extends AbstractSignatureBuilder<Subk
super(SignatureType.SUBKEY_BINDING, signingKey, protector);
}
public SubkeyBindingSignatureBuilder(
PGPSecretKey signingKey,
SecretKeyRingProtector protector,
PGPSignature oldSubkeyBinding)
throws PGPException {
super(signingKey, protector, requireValidSignatureType(oldSubkeyBinding));
}
private static PGPSignature requireValidSignatureType(PGPSignature signature) {
if (signature.getSignatureType() == SignatureType.SUBKEY_BINDING.getCode()) {
return signature;
}
throw new IllegalArgumentException("Invalid signature type.");
}
@Override
protected boolean isValidSignatureType(SignatureType type) {
return type == SignatureType.SUBKEY_BINDING;

4
pgpainless-core/src/main/java/org/pgpainless/signature/consumer/SignaturePicker.java
View file

@ -237,10 +237,6 @@ public final class SignaturePicker {
SignatureValidator.signatureIsCertification().verify(signature);
SignatureValidator.signatureStructureIsAcceptable(primaryKey, policy).verify(signature);
SignatureValidator.signatureIsAlreadyEffective(validationDate).verify(signature);
// if the currently latest signature is not yet expired, check if the next candidate is not yet expired
if (latestUserIdCert != null && !SignatureUtils.isSignatureExpired(latestUserIdCert, validationDate)) {
SignatureValidator.signatureIsNotYetExpired(validationDate).verify(signature);
}
SignatureValidator.correctSignatureOverUserId(userId, primaryKey, primaryKey).verify(signature);
} catch (SignatureValidationException e) {
// User-id certification is not valid

7
pgpainless-core/src/main/java/org/pgpainless/signature/subpackets/SignatureSubpacketsUtil.java
View file

@ -195,13 +195,14 @@ public final class SignatureSubpacketsUtil {
* @return key expiration time as date
*/
public static Date getKeyExpirationTimeAsDate(PGPSignature signature, PGPPublicKey signingKey) {
if (signature.getKeyID() != signingKey.getKeyID()) {
throw new IllegalArgumentException("Provided key (" + Long.toHexString(signingKey.getKeyID()) + ") did not create the signature (" + Long.toHexString(signature.getKeyID()) + ")");
}
KeyExpirationTime subpacket = getKeyExpirationTime(signature);
if (subpacket == null) {
return null;
}
if (signature.getKeyID() != signingKey.getKeyID()) {
throw new IllegalArgumentException("Provided key (" + Long.toHexString(signingKey.getKeyID()) + ") did not create the signature (" + Long.toHexString(signature.getKeyID()) + ")");
}
return SignatureUtils.datePlusSeconds(signingKey.getCreationTime(), subpacket.getTime());
}