diff options
| author | Daniel Kahn Gillmor <dkg@fifthhorseman.net> | 2020-03-19 00:15:08 -0400 |
|---|---|---|
| committer | David Bremner <david@tethera.net> | 2020-04-30 18:02:38 -0300 |
| commit | 9055dfdae41ba762b12434fe678fc524ea3ed618 (patch) | |
| tree | edf22a4fd27817bdacaf7e88436acc7c36ccae2a | |
| parent | b415ec06c309974247d202c21a0f9f1b0d828f5d (diff) | |
tests: disable CRL checks from gpgsm
GPGME has a strange failure mode when it is in offline mode, and/or
when certificates don't have any CRLs: in particular, it refuses to
accept the validity of any certificate other than a "root" cert.
This can be worked around by setting the `disable-crl-checks`
configuration variable for gpgsm.
I've reported this to the GPGME upstream at
https://dev.gnupg.org/T4883, but I have no idea how it will be
resolved. In the meantime, we'll just work around it.
Note that this fixes the test for verification of
id:smime-multipart-signed@protected-headers.example, because
multipart/signed messages are already handled correctly (one-part
PKCS#7 messages will get fixed later).
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
| -rwxr-xr-x | test/T356-protected-headers.sh | 2 | ||||
| -rw-r--r-- | test/test-lib.sh | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/test/T356-protected-headers.sh b/test/T356-protected-headers.sh index b7a83715..520cb71c 100755 --- a/test/T356-protected-headers.sh +++ b/test/T356-protected-headers.sh @@ -157,7 +157,7 @@ test_expect_equal "$output" id:protected-with-legacy-display@crypto.notmuchmail. for variant in multipart-signed onepart-signed; do test_begin_subtest "verify signed PKCS#7 subject ($variant)" - test_subtest_known_broken + [ "$variant" = multipart-signed ] || test_subtest_known_broken output=$(notmuch show --verify --format=json "id:smime-${variant}@protected-headers.example") test_json_nodes <<<"$output" \ 'signed_subject:[0][0][0]["crypto"]["signed"]["headers"]=["Subject"]' \ diff --git a/test/test-lib.sh b/test/test-lib.sh index 43fffa09..5c8eab7c 100644 --- a/test/test-lib.sh +++ b/test/test-lib.sh @@ -144,7 +144,7 @@ add_gpgsm_home () echo "$fpr S relax" >> "$GNUPGHOME/trustlist.txt" gpgsm --quiet --batch --no-tty --no-common-certs-import --disable-dirmngr --import < $NOTMUCH_SRCDIR/test/smime/ca.crt echo "4D:E0:FF:63:C0:E9:EC:01:29:11:C8:7A:EE:DA:3A:9A:7F:6E:C1:0D S" >> "$GNUPGHOME/trustlist.txt" - echo include-certs::1 | gpgconf --output /dev/null --change-options gpgsm + printf '%s::1\n' include-certs disable-crl-checks | gpgconf --output /dev/null --change-options gpgsm gpgsm --batch --no-tty --no-common-certs-import --pinentry-mode=loopback --passphrase-fd 3 \ --disable-dirmngr --import "$NOTMUCH_SRCDIR/test/smime/bob.p12" >>"$GNUPGHOME"/import.log 2>&1 3<<<'' test_debug "cat $GNUPGHOME/import.log" |