Re: Retrospective by 'gpg.fail' authors
GnuPG maintainer Werner Koch responds on oss-security to the gpg.fail authors' retrospective, addressing format-nonliteral handling in time string formatting.
Werner Koch replied on the oss-security mailing list to the retrospective published by the gpg.fail authors, continuing discussion of GnuPG's handling of time string formatting. He cited GnuPG commit 98871aadb70378343541128e80ffd391e413e248, which notes that gcc's -Wformat-nonliteral warning would flag the relevant code and disables the warning for that specific function. Soatok Dreamseeker's original post raised the point that the warning flag was no longer used for the specific problem.
- Werner Koch cites GnuPG commit 98871aadb70378343541128e80ffd391e413e248 addressing the warning handling.
- Discussion follows the gpg.fail authors' security retrospective on GnuPG.
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| sha1 | 98871aadb70378343541128e80ffd391e413e248 | specific function (or maybe even code lines). GnuPG commit: 98871aadb70378343541128e80ffd391e413e248 + * Note: gcc -Wformat-noliteral would complain here. Thus |
Posted by Werner Koch on Sep 17 On Wed, 16 Sep 2026 13:06, Soatok Dreamseeker said: By "forgotten" I meant that -Wformat-nonlietral was not anymore used to that specific problem. The time string formatting is still required and gcc actually provides a working method to disable warnings for a specific function (or maybe even code lines). GnuPG commit: 98871aadb70378343541128e80ffd391e413e248 + * Note: gcc -Wformat-noliteral would complain here. Thus we disable...
This source does not provide full text. Read it at seclists.org.