* g10/gpg.c (set_compliance_option): clear opt.flags.require_cross_cert with oRFC2440
-- This aligns with the expectations in RFC 2440, which doesn't specify any cross-certifications. As doc/gpg.texi says: "This is dangerous", but it aligns with the specification. The comment above says that 4880 is the same as 2440, "but with [...] --require-cross-certification", so we align the code with the intent from the comment. It looks like opt.require_cross_cert was turned on by default after that comment (and the oRFC2440 section) was written, but the oRFC2440 section was never updated to turn it off. Signed-off-by: Daniel Kahn Gillmor <[email protected]> --- g10/gpg.c | 1 + 1 file changed, 1 insertion(+) diff --git a/g10/gpg.c b/g10/gpg.c index 694364b3d..ba3525d65 100644 --- a/g10/gpg.c +++ b/g10/gpg.c @@ -2302,6 +2302,7 @@ set_compliance_option (enum cmd_and_opt_values option) case oRFC2440: opt.compliance = CO_RFC2440; opt.flags.dsa2 = 0; + opt.flags.require_cross_cert = 0; opt.rfc2440_text = 1; opt.allow_non_selfsigned_uid = 1; opt.allow_freeform_uid = 1; -- 2.47.2 _______________________________________________ Gnupg-devel mailing list [email protected] https://lists.gnupg.org/mailman/listinfo/gnupg-devel
