Merge branch 'mg/gpg-parse-tighten'

Detect and reject a signature block that has more than one GPG
signature.

* mg/gpg-parse-tighten:
  gpg-interface.c: detect and reject multiple signatures on commits

diff --cc gpg-interface.c
index db17d65f8ac977ddc5204130cb0af6a7565ae04b,efe2c0d3863c7b4118d08c4152dbc6e1d5dcc09f..d72a43b7748c470d82150776291c5a6a91857cd5
--- 1/gpg-interface.c
--- 2/gpg-interface.c
+++ b/gpg-interface.c
@@@ -92,28 -96,42 +96,42 @@@ static struct 
  static void parse_gpg_output(struct signature_check *sigc)
  {
        const char *buf = sigc->gpg_status;
+       const char *line, *next;
        int i;
- 
-       /* Iterate over all search strings */
-       for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
-               const char *found, *next;
- 
-               if (!skip_prefix(buf, sigcheck_gpg_status[i].check + 1, &found)) {
-                       found = strstr(buf, sigcheck_gpg_status[i].check);
-                       if (!found)
-                               continue;
-                       found += strlen(sigcheck_gpg_status[i].check);
-               }
-               sigc->result = sigcheck_gpg_status[i].result;
-               /* The trust messages are not followed by key/signer information */
-               if (sigc->result != 'U') {
-                       next = strchrnul(found, ' ');
-                       sigc->key = xmemdupz(found, next - found);
-                       /* The ERRSIG message is not followed by signer information */
-                       if (*next && sigc-> result != 'E') {
-                               found = next + 1;
-                               next = strchrnul(found, '\n');
-                               sigc->signer = xmemdupz(found, next - found);
+       int seen_exclusive_status = 0;
+ 
+       /* Iterate over all lines */
+       for (line = buf; *line; line = strchrnul(line+1, '\n')) {
+               while (*line == '\n')
+                       line++;
+               /* Skip lines that don't start with GNUPG status */
+               if (!skip_prefix(line, "[GNUPG:] ", &line))
+                       continue;
+ 
+               /* Iterate over all search strings */
+               for (i = 0; i < ARRAY_SIZE(sigcheck_gpg_status); i++) {
+                       if (skip_prefix(line, sigcheck_gpg_status[i].check, &line)) {
+                               if (sigcheck_gpg_status[i].flags & GPG_STATUS_EXCLUSIVE) {
 -                                      if (++seen_exclusive_status > 1)
++                                      if (seen_exclusive_status++)
+                                               goto found_duplicate_status;
+                               }
+ 
+                               sigc->result = sigcheck_gpg_status[i].result;
+                               /* The trust messages are not followed by key/signer information */
+                               if (sigc->result != 'U') {
+                                       next = strchrnul(line, ' ');
+                                       free(sigc->key);
+                                       sigc->key = xmemdupz(line, next - line);
+                                       /* The ERRSIG message is not followed by signer information */
+                                       if (*next && sigc->result != 'E') {
+                                               line = next + 1;
+                                               next = strchrnul(line, '\n');
+                                               free(sigc->signer);
+                                               sigc->signer = xmemdupz(line, next - line);
+                                       }
+                               }
+ 
+                               break;
                        }
                }
        }