mirror of
https://github.com/containers/skopeo.git
synced 2025-04-27 19:05:32 +00:00
0484557df8
This fixes CVE-2020-8945 by incorporating proglottis/gpgme#23 . Other changes included by the rebase: - Support for gpgme_off_t (~no-op on Linux) - Wrapping a few more GPGME functions (irrelevant if we don't call them) Given how invasive the CVE fix is (affecting basically all binding code), it seems safer to just update the package (and be verifiably equivalent with upstream) than to backport and try to back out the few other changes. Performed by updating vendor conf and $ vndr github.com/mtrmac/gpgme Signed-off-by: Miloslav Trmač <mitr@redhat.com>
19 lines
527 B
Go
19 lines
527 B
Go
// +build !windows
|
|
|
|
package gpgme
|
|
|
|
// #include <stdlib.h>
|
|
import "C"
|
|
import (
|
|
"unsafe"
|
|
)
|
|
|
|
// This is somewhat of a horrible hack. We need to unset GPG_AGENT_INFO so that gpgme does not pass --use-agent to GPG.
|
|
// os.Unsetenv should be enough, but that only calls the underlying C library (which gpgme uses) if cgo is involved
|
|
// - and cgo can't be used in tests. So, provide this helper for test initialization.
|
|
func unsetenvGPGAgentInfo() {
|
|
v := C.CString("GPG_AGENT_INFO")
|
|
defer C.free(unsafe.Pointer(v))
|
|
C.unsetenv(v)
|
|
}
|