#775 new
steve

Under certain conditions verification results reference the wrong Signing Key as well as wrong Signed File

Reported by steve | November 17th, 2022 @ 12:08 AM

Reproduce

  1. Install gpg tools
  2. Open gpg keychain.
  3. Create two keys (say key 1 and key 2).
  4. Open terminal (or any other app where you can easily create a file).
  5. Create file
    echo 123 > testfile.txt
    
  6. Open testfile.txt directory in finder.
  7. Open context menu for the file.
  8. Services -> OpenPGP: Sign File
  9. Choose key 1 and sign the file with detached signature (say signature 1).
  10. In finder open context menu for testfile.txt.sig.
  11. Services -> OpenPGP: Sign File
  12. Choose key 2 and sign the file with detached signature (say signature 2).
  13. Edit testfile.txt, e.g. from terminal
    echo 000 > testfile.txt
    
  14. In finder double click on signature 2 - it shows good signature (key 2) and that signed file is textfile.txt.sig.
  15. In finder double click on signature 1 - it shows good signature (key 2) and that signed file is textfile.txt.sig itself.

What did you expect instead

On step 15:
1. The app shows wrong information about signature. It must show key 1 as key which signed testfile.txt.
2. The app shows wrong file that was signed. It must bet testfile.txt not testfile.txt.sig.
3. The app shows wrong information about file verification. It must state that signature is bad, cause file has changed after signing

Terminal using gpg/gpg2 utility the correct verification results are shown.

Comments and changes to this ticket

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.

New-ticket Create new ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป

Shared Ticket Bins

People watching this ticket

Tags

Pages