methods/gpgv: Correctly handle weak signatures with multiple keys

[apt.git] / methods / gpgv.cc

diff --git a/methods/gpgv.cc b/methods/gpgv.cc
index 06e1612e61998cbb2b24bca17052fb17dc38f10e..de9dfea1eb943150f89923444cac34ce78e5e523 100644 (file)
--- a/methods/gpgv.cc
+++ b/methods/gpgv.cc
@@ -159,7 +159,12 @@ string GPGVMethod::VerifyGetSigners(const char *file, const char *outfile,
             std::clog << "Got VALIDSIG, key ID: " << sig << std::endl;
          // Reject weak digest algorithms
          if (std::find(WeakDigests.begin(), WeakDigests.end(), tokens[7]) != WeakDigests.end())
-            BadSigners.push_back(string(sig));
+         {
+            // Treat them like an expired key: For that a message about expiry
+            // is emitted, a VALIDSIG, but no GOODSIG.
+            WorthlessSigners.push_back("WEAKDIGEST " + string(sig));
+            GoodSigners.erase(std::remove(GoodSigners.begin(), GoodSigners.end(), string(sig)));
+         }
 
          ValidSigners.push_back(string(sig));
       }