#38 CheckSign Broken

[Raphael Avital]

In line 178 of Global.pas, (in the CheckSign function),
GPG.EXE is instructed to look for the public key ring
with the following line:

publist.LoadFromFile(HomeDir + '\Pubring.gpg.txt');

This causes a dr.watson error with our development tool
(PowerBuilder, which granted, may not be the most
stable) for the simple reason that the public keyring file
is named "pubring.gpg" and not "pubring.gpg.txt".

As proof, I renamed both the public and secret keyrings
adding the ".txt" extension - which eliminated the
dr.watson error during the CryptoTW.dll function call to
CheckSign, but resulted in "unknown user" being
returned. Then I ran gpg.exe from a command promp.
Please look at the output below (all of it generated by
gpg.exe as a result of issuing the single command on
the first line):

C:\PGP\GPG_PB>gpg --decrypt file1.txt.gpg
gpg: keyring `c:/gnupg\secring.gpg' created
gpg: keyring `c:/gnupg\pubring.gpg' created
gpg: encrypted with ELG-E key, ID D88718C1
gpg: decryption failed: secret key not available

This proves that in the absence of keyring files with
a ".gpg" extension, gpg.exe IMMEDIATELY creates two
new keyring files (public and secret) and uses them,
instead of anything else, to look for keys in them. Since
they are empty, ANY instruction passed to gpg.exe that
relies on finding the keys will ALWAYS fail.

IF there is a way to instruct gpg.exe to look for a keyring
file under a different name, I have not seen it anywhere,
it certainly is not in the eoptions.txt file (which is created
by CryptoTW.dll, and we know gpg.exe is directed by
CryptoTW.dll to find its options there and nowhere else).

Result - regardless of the fact that one platform or
another may be unstable enough to generate a
dr.watson error when it should exit more gracefully,
CheckSign will NEVER work as long as it looks for a
keyring file ending in ".txt".

Can this be fixed before the next release? We can't give
up on signature verification as this is a CommonLine
requirement.

Many thanks

[Raphael Avital]

Logged In: YES
user_id=539088

Additional Info: The above was tested with GPG 1.20 and
CryptoTW 1.10.

The result obtained from the call to CheckSign was "Unknown
Signer"

I have re-tested with the following:

GPG 1.0.6-2, CryptoTW 0.9.7.2, 0.9.1.0, 1.0.1.a, and 1.10

I have made sure to RE-CREATE new keys for two users with
GPG 1.0.6-2. With each of the CryptoTW versions above, all
calls to the Checksign version returned the correct signer in
the format:
Real Name (comment) <email address>

Something is not right. Especially when you consider the
problem reported above with the "txt" extension of the keyring
file, the same version 1.10 of CryptoTW doesn't seem to care
about the fact that those files don't exist, and doesn't fail. As
reported above, with GPG 1.20, it crashed when it couldn't
find those files, and ran ok when I renamed the keyring files
to add the txt extension to them (which caused gpg 1.2 to
immediately create new keyring files with the gpg extension,
and because they were empty the checksign call
returned "unknown signer."

[Raphael Avital]

Logged In: YES
user_id=539088

SOLUTION:

I have narrowed the problem to the following:

In global.pas, line 719:
if OutPutDir <> nil then
TmpKeyStr := ExcludeTrailingBackslash(OutPutDir)
+'\pubkey.txt'
else
TmpKeyStr := WorkingDir + '\pubkey.txt';

So the TmpKeyStr var is set to include a
filename "pubkey.txt." Further down. the batch
file "pubkey.bat" is created, and includes this line:

" "c:\gnupg\gpg" --homedir "c:\gnupg" --list-keys
>c:\gnupg\Logs\pubkey.txt "

When it runs, it does create a file named "pubkey.txt"
containing a list of the keys in the keyring. The problem is,
that line 178 in global.bas directs the CheckSign function to
look for it under the name "pubring.gpg.txt" (hence my initial
error in assuming the public keyring was the culprit):

publist.LoadFromFile(HomeDir + '\Pubring.gpg.txt');

So the CheckSign function attempts to compare the output
of --list-packets with the contents of the text file listing the
keys, under a different name, and since the file doesn't exist
under that name, exists ungracefully.

In order to fix this, the simplest thing would be to change line
178 to read:

publist.LoadFromFile(HomeDir + '\Pubkey.txt');

I am not aware of a similar problem anywhere else in the
code or any other call to this file under this erroneous name.

THANKS

[Raphael Avital]

Logged In: YES
user_id=539088

Addendum to solution:

When I renamed the file pubkey.txt to pubring.gpg.txt the
CheckSign function completed successfully and returned
valid output in the format RealName (Comment) <email>

Hope this helps

[Michael Epler]

Logged In: YES
user_id=435360

It seems that something has changed the way the bat file is
created. The bat file should be creating a file called
pubring.gpg.txt instead.

[John Gill]

Logged In: YES
user_id=436438

mike, was this fixed and never closed?