Check cross-signature details when signing/certifying

twiss · twiss · commit 118cc34ef176 · 2025-01-15T16:18:49.000+01:00
diff --git a/openpgp/v2/subkeys.go b/openpgp/v2/subkeys.go
@@ -189,6 +189,9 @@ func (s *Subkey) LatestValidBindingSignature(date time.Time, config *packet.Conf
 				if err == nil {
 					err = checkSignatureDetails(s.Primary.PrimaryKey, sig.Packet, date, config)
 				}
+				if err == nil && (sig.Packet.FlagCertify || sig.Packet.FlagSign || sig.Packet.FlagAuthenticate) {
+					err = checkSignatureDetails(s.PublicKey, sig.Packet.EmbeddedSignature, date, config)
+				}
 				valid := err == nil
 				sig.Valid = &valid
 			}

Original file line number	Diff line number	Diff line change
`@@ -189,6 +189,9 @@ func (s Subkey) LatestValidBindingSignature(date time.Time, config packet.Conf`
`189`	`189`	`if err == nil {`
`190`	`190`	`err = checkSignatureDetails(s.Primary.PrimaryKey, sig.Packet, date, config)`
`191`	`191`	`}`
	`192`	`+ if err == nil && (sig.Packet.FlagCertify \|\| sig.Packet.FlagSign \|\| sig.Packet.FlagAuthenticate) {`
	`193`	`+ err = checkSignatureDetails(s.PublicKey, sig.Packet.EmbeddedSignature, date, config)`
	`194`	`+ }`
`192`	`195`	`valid := err == nil`
`193`	`196`	`sig.Valid = &valid`
`194`	`197`	`}`