saltstack/salt - Jubjub's forge

saltstack/salt

mirror of https://github.com/saltstack/salt.git synced 2025-04-17 10:10:20 +00:00

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

2 lines

59 B

Markdown

Raw Normal View History

Add `signed_by_[any|all]` parameters to `gpg.verify` (#63168) * Add test for issue 63145 * Make gpg.verify respect gnupghome * Add `signed_by_any`/`signed_by_all` params to gpg.verify * Reconsider status check * Fix tests * Plug verification issue after status check reconsideration Since missing pubkeys also cause the previous signature's fingerprint to be overwritten, this would have led to situations where the check could have passed when it should not have. * Cleanup logic * Workaround python-gnupg issue https://github.com/vsajip/python-gnupg/issues/214 * Adapt offical fix for workaround https://github.com/vsajip/python-gnupg/commit/ee94a7ecc1a86484c9f02337e2bbdd05fd32b383 That was very fast. * Backport more meaningful test * Update versionadded * Avoid exception on import w/ missing gnupg lib * Do not apply workaround on fixed versions * Correct bool comparison * Account for subkeys sig_info["fingerprint"] contains the actual signing key's fingerprint, which might be a subkey. The primary key's fingerprint is always found in sig_info["pubkey_fingerprint"]. In cases where a signing subkey was used, the intended behavior is still comparison with the primary key. * Bump versionadded * Rename changelog files to .md

2023-05-09 19:24:48 +00:00

Added signed_by_any/signed_by_all parameters to gpg.verify