Multiple signatures after import.
dshaw at jabberwocky.com
Mon Apr 14 22:17:02 CEST 2003
-----BEGIN PGP SIGNED MESSAGE-----
On Thu, Jan 01, 1970 at 12:00:00AM +0000, Yenot wrote:
> On Sunday 13 April 2003 11:40 pm, David Shaw wrote:
> > On Sun, Apr 13, 2003 at 12:00:32PM +0400, Yenot wrote:
> > >
> > > I did some more testing. To me, it looks like GnuPG 1.2.1 *is*
> > > merging non byte-for-byte signatures -- but the result depends
> > > on the order of operations.
> > >
> > > For a test case, I've attached "bob1.asc" and "bob2.asc". Both
> > > files contain the same key for UID "bob at test.com". In both files
> > > there is a single self-signature on the UID, but the self-signature
> > > in "bob1.asc" has a creation date 13 seconds before the signature
> > > in "bob2.asc".
> > >
> > > gpg --import bob1.asc bob2.asc [Keeps both signatures.]
> > > gpg --import bob2.asc bob1.asc [Removes older signature in bob1.asc]
> > This is not signature merging. Given two valid self-signatures, GnuPG
> > will not import an older self-signature if a newer one is present.
> > (Even if it is present, the older of the two it is ignored.)
> When importing a key multiple times, the process of combining the
> signatures on both keys to form a united key is called a "merge".
> This term is well established in PGP literature. The fact that
> you're trying to bend terminology to justify GnuPG's behavior,
> is an indication that GnuPG's behavior could be improved.
Well, I guess you can call the reject-old-sigs behavior whatever you
like. Incidentally, I don't need to "justify" any behavior in GnuPG.
You asked what GnuPG was doing. I answered. Don't like it? Send in
a patch. (Hint - file g10/import.c, lines 1689-1690).
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2rc1 (GNU/Linux)
-----END PGP SIGNATURE-----
More information about the Gnupg-devel