diff --git a/openpgp/read.go b/openpgp/read.go index 94c4e6a..fa530dd 100644 --- a/openpgp/read.go +++ b/openpgp/read.go @@ -405,7 +405,10 @@ func CheckDetachedSignature(keyring KeyRing, signed, signature io.Reader) (signe } } - return nil, errors.ErrUnknownIssuer + if err == nil { + err = errors.ErrUnknownIssuer + } + return nil, err } // CheckArmoredDetachedSignature performs the same actions as diff --git a/openpgp/read_test.go b/openpgp/read_test.go index b08469d..796095c 100644 --- a/openpgp/read_test.go +++ b/openpgp/read_test.go @@ -279,6 +279,15 @@ func TestDetachedSignature(t *testing.T) { testDetachedSignature(t, kring, readerFromHex(detachedSignatureHex), signedInput, "binary", testKey1KeyId) testDetachedSignature(t, kring, readerFromHex(detachedSignatureTextHex), signedInput, "text", testKey1KeyId) testDetachedSignature(t, kring, readerFromHex(detachedSignatureV3TextHex), signedInput, "v3", testKey1KeyId) + + incorrectSignedInput := signedInput + "X" + _, err := CheckDetachedSignature(kring, bytes.NewBufferString(incorrectSignedInput), readerFromHex(detachedSignatureHex)) + if err == nil { + t.Fatal("CheckDetachedSignature returned without error for bad signature") + } + if err == errors.ErrUnknownIssuer { + t.Fatal("CheckDetachedSignature returned ErrUnknownIssuer when the signer was known, but the signature invalid") + } } func TestDetachedSignatureDSA(t *testing.T) {