Validate key expiration time

[slawekjaranowski]

Key expiration time should be checked and when key expire signing should fail.

[mkarg]

Should it really fail or should it just log a warning? Possibly a philosopic question.

[mkarg]

I am neither a GPG nor Bouncy Castle expert, so I checked the API and it seems only public keys have an expiration date (secretKey.getPublicKey().getValidDays())?

[slawekjaranowski]

IMHO for expired key we should break and report cause with reason
the same does gpg (but reason is only in verbose mode)

gpg -v --armo --sign -u B09391374A115DE2
gpg: Note: signature key B09391374A115DE2 expired Wed Dec 23 08:29:20 2020 CET
gpg: skipped "B09391374A115DE2": Unusable secret key
gpg: signing failed: Unusable secret key

[mkarg]

Agreed. Do you know how to ask Bouncy Castle for the expiration date? I just cannot find that in the API docs. :-(

[slawekjaranowski]

It is not easy - I know

my recipe - add test and in debug mode look at loaded pgp object, and look to bouncycastle source

useful will be look at pgp packets, by:

gpg --list-packets src/test/resources/priv-expired-key-no-pass.asc

I will try to do it today evening