Re: Outstanding question - rule on cleartext signing last line

[David Shaw <[e-mail]>]

On Mon, Dec 26, 2005 at 05:29:01PM +0000, Ian G wrote:
> 
> David Shaw wrote:
> >As far as I can see, the current system is quite reversible.  For
> >example, given a document reading "this is a test" (no line ending,
> >and the last character in the file is the second t from test), here's
> >a clear signature:
> 
> OK, I understand all that.  But you've added
> a new rule:  on signing, always add the extra
> line ending.
> 
> And that's what we want to clarify - I don't
> think the spec says that.  It simply says that
> the last newline is not part of the signature.

Ok, now we're cooking: we agree.  I don't think the spec says that
either.  I am just saying that that behavior is consistent with the
spec, and (I say) a good thing to do, and (to me) follows naturally
from what the spec does say.  That said, GPG doesn't do it, and PGP
(at least the version I have here) does.

Both PGP and GPG are compliant with the spec as written.  If you add
this extra rule to enforce reversibility, GPG will become noncompliant
(fixable, but annoying), and many GPG-created signatures will become
noncompliant (a little more worrisome).

> Can we put that in the spec?  Here's what it
> says:
> 
>     As with binary signatures on text documents, a cleartext signature
>     is calculated on the text using canonical <CR><LF> line endings.
>     The line ending (i.e. the <CR><LF>) before the '-----BEGIN PGP
>     SIGNATURE-----' line that terminates the signed text is not
>     considered part of the signed text.
> 
>     When reversing dash-escaping, an implementation MUST strip the
>     string "- " if it occurs at the beginning of a line, and SHOULD warn
>     on "-" and any character other than a space at the beginning of a
>     line.
> 
>     Also, any trailing whitespace -- spaces (0x20) and tabs (0x09) -- at
>     the end of any line is removed when the cleartext signature is
>     generated.
> 
> Here's what I suggest (changes at ***):
> 
>     As with binary signatures on text documents, a cleartext signature
>     is calculated on the text using canonical <CR><LF> line endings.
>     The line ending (i.e. the <CR><LF>) before the '-----BEGIN PGP
>     SIGNATURE-----' line that terminates the signed text is not
> *** part of the signed document and SHOULD be added by implementations. ***
> 
>     When reversing dash-escaping, an implementation MUST strip the
>     string "- " if it occurs at the beginning of a line, and SHOULD warn
>     on "-" and any character other than a space at the beginning of a
>     line.
> 
>     Also, any trailing whitespace -- spaces (0x20) and tabs (0x09) -- at
>     the end of any line is removed when the cleartext signature is
>     generated.
> 
> How's that?

I have no objection to that.

David