Check all signing subkeys when verifying identity

Fixes C3S#11.
garrettr · Jan 22, 2016 · b67af0e · b67af0e
1 parent b28acb6
commit b67af0e
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/app/models/pgpkey.rb b/app/models/pgpkey.rb
@@ -8,4 +8,8 @@ def public_key
   def metadata
     GPGME::Key.get(self.fpr).to_s
   end
+
+  def subkeys
+    GPGME::Key.get(self.fpr).subkeys
+  end
 end
diff --git a/lib/decrypt_mails.rb b/lib/decrypt_mails.rb
@@ -36,7 +36,10 @@ def receive_with_encryption(email, options={})
         user = User.find_by_mail sender_email if sender_email.present?
         key = Pgpkey.find_by user_id: user.id
         signatures.each do |s|
-          valid = true if key.fpr == s.fpr
+          key.subkeys.each do |subkey|
+            valid = true if subkey.capability.include? :sign and \
+                            subkey.fpr == s.fpr
+          end
         end if not signatures.empty?
       end