gpg: New option --override-compliance-check

* g10/gpg.c (oOverrideComplianceCheck): New.
(opts): Add new option.
(main): Set option and add check for batch mode.
* g10/options.h (opt): Add flags.override_compliance_check.

* g10/sig-check.c (check_signature2): Factor complaince checking out
to ...
(check_key_verify_compliance): this.  Turn error into a warning in
override mode.
--

There is one important use case for this: For systems configured
globally to use de-vs mode, Ed25519 and other key types are not
allowed because they are not listred in the BSI algorithm catalog.
Now, our release signing keys happen to be Ed25519 and thus we need to
offer a way for users to check new versions even if the system is in
de-vs mode.  This does on purpose not work in --batch mode so that
scripted solutions won't accidently pass a signature check.

GnuPG-bug-id: 5655

1 files changed, 31 insertions, 11 deletions

diff --git a/g10/sig-check.c b/g10/sig-check.c
index 8dd18b2e2..eb6c9669d 100644
--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -67,6 +67,35 @@ sig_check_dump_stats (void)
 }
 
 
+static gpg_error_t
+check_key_verify_compliance (PKT_public_key *pk)
+{
+  gpg_error_t err = 0;
+
+  if (!gnupg_pk_is_allowed (opt.compliance, PK_USE_VERIFICATION,
+                            pk->pubkey_algo, 0, pk->pkey,
+                            nbits_from_pk (pk),
+                            NULL))
+    {
+      /* Compliance failure.  */
+      log_info (_("key %s may not be used for signing in %s mode\n"),
+                 keystr_from_pk (pk),
+                 gnupg_compliance_option_string (opt.compliance));
+      if (opt.flags.override_compliance_check)
+        log_info (_("continuing verification anyway due to option %s\n"),
+                  "--override-compliance-failure");
+      else
+        {
+          log_inc_errorcount (); /* We used log info above.  */
+          err = gpg_error (GPG_ERR_PUBKEY_ALGO);
+        }
+    }
+
+  return err;
+}
+
+
+
 /* Check a signature.  This is shorthand for check_signature2 with
    the unnamed arguments passed as NULL.  */
 int
@@ -172,17 +201,8 @@ check_signature2 (ctrl_t ctrl,
     }
   else if (get_pubkey_for_sig (ctrl, pk, sig, forced_pk))
     rc = gpg_error (GPG_ERR_NO_PUBKEY);
-  else if (!gnupg_pk_is_allowed (opt.compliance, PK_USE_VERIFICATION,
-                                 pk->pubkey_algo, 0, pk->pkey,
-                                 nbits_from_pk (pk),
-                                 NULL))
-    {
-      /* Compliance failure.  */
-      log_error (_("key %s may not be used for signing in %s mode\n"),
-                 keystr_from_pk (pk),
-                 gnupg_compliance_option_string (opt.compliance));
-      rc = gpg_error (GPG_ERR_PUBKEY_ALGO);
-    }
+  else if ((rc = check_key_verify_compliance (pk)))
+    ;/* Compliance failure.  */
   else if (!pk->flags.valid)
     {
       /* You cannot have a good sig from an invalid key.  */