[Pkg-gnupg-commit] [gnupg2] 90/118: g10: Use the time a signature was seen, not the embedded time, for stats

[Daniel Kahn Gillmor]

This is an automated email from the git hooks/post-receive script.

dkg pushed a commit to branch encoding-and-speling
in repository gnupg2.

commit bde29a46cedbbd2a5dfe7c91a6277c0a4ff50825
Author: Neal H. Walfield <neal at g10code.com>
Date:   Wed Sep 7 11:17:47 2016 +0200

    g10: Use the time a signature was seen, not the embedded time, for stats
    
    * g10/tofu.c (ask_about_binding): Use the time that a signature was
    seen, not allegedly generated, when generating statistics.
    
    --
    Signed-off-by: Neal H. Walfield <neal at g10code.com>
---
 g10/tofu.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/g10/tofu.c b/g10/tofu.c
index 5b20269..7cf3fc7 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -1397,9 +1397,6 @@ ask_about_binding (ctrl_t ctrl,
     }
 
   /* Get the stats for all the keys in CONFLICT_SET.  */
-  /* FIXME: When generating the statistics, do we want the time
-     embedded in the signature (column 'sig_time') or the time that
-     we first verified the signature (column 'time').  */
   strlist_rev (&conflict_set);
   for (iter = conflict_set; iter && ! rc; iter = iter->next)
     {
@@ -1435,10 +1432,12 @@ ask_about_binding (ctrl_t ctrl,
          /* Make sure the current key is first.  */ \
          " order by time_ago desc;\n"
 
+      /* Use the time when we saw the signature, not when the
+         signature was created as that can be forged.  */
       rc = gpgsql_stepx
         (dbs->db, &dbs->s.get_trust_gather_signature_stats,
          signature_stats_collect_cb, &stats, &sqerr,
-         STATS_SQL ("signatures", "sig_time", ""),
+         STATS_SQL ("signatures", "time", ""),
          GPGSQL_ARG_LONG_LONG, (long long) now,
          GPGSQL_ARG_STRING, email,
          GPGSQL_ARG_STRING, iter->d,

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-gnupg/gnupg2.git