- improve implementation of SignatureVerify.bad_signatures
- improve implementation of SignatureVerify.good_signatures
- fix implementation of SignatureVerify.__bool__
- fix capitalization and spelling of SecurityIssues flag members
- pythonize the names of SAFE_CURVES and MINIMUM_ASYMMETRIC_KE?Y_LENGTHS
- move the functionality of is_hash_considered_secure into a HashAlgorithm property called is_considered_secure where it always should have been
- move the functionality of check_assymetric_algo_and_its_parameters into a PubKeyAlgorithm function called validate_params like it always should have been
pgpy has been using TZ-naive datetime objects, despite all OpenPGP
wire-format dates being essentially UTC.
Better to represent the datetime objects explicitly as UTC.
Closes: #401
As new versions of OpenPGP signatures are defined, implementations may
provide multiple signatures, one of an older version for legacy
clients and one of a new version for clients that can read the new
signature form.
PGPy should skip over any signature whose version is not recognized.
In commit 08a76fdda9, distutils was
dropped. Before then, gpg_ver was a global mutable class instance,
mutated inside a function and then used. After then, it's a global
string that is... also modified inside a function and then used.
Strings cannot be modified inside functions like that. It shadows the
variable in the local scope, which means the global variable is
inaccessible now. In fact the global variable exists solely to be used
inside this function, but now it cannot be.
So, because it can be bound inside the function, it *must* be, but only
if python-gpg was installed did this actually occur. If not, we skipped
the integration tests and then tried to log the version, assuming that
the global default value of "unknown" was still bound, which is no
longer true.
As per RFC 4880 13.2, "Since TripleDES is the MUST-implement algorithm,
if it is not explicitly in the list, it is tacitly at the end."
Some keys in the wild do not have it explicitly in the list, so put it
there as a default.
The OpenPGP specifications are ambiguous about the encoding of
passwords.
In practice, we expect most passphrases to be UTF-8-encoded, but if
the incoming passphrase is in fact a bytestring, we ought to be able
to handle it correctly.
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
distutils is going away in python 3.12. LooseVersion() wasn't really
being used for anything particularly useful. The strings that were
returned by the openssl backend for the cryptography module, or the
GPGME "engine" version were both just being replayed later as strings
anyway.
So, keep them in string form. If future work needs to do things like
compare them, apparently packaging.version contains classes that might
be better-maintained going forward.
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
