subKey signature for unknown key gives NullPointer

[ruud-de-jong]

One of my dependencies is DerbyClient 10.10.1.1.
It's key is: https://hkps.pool.sks-keyservers.net/pks/lookup?op=get&options=mr&search=0x3D8B00E198E21827

3D8B00E198E21827.zip

I've attached the key(ring) it downloads from the keyserver.
It fails with the following stacktrace:

java.lang.NullPointerException
	at org.bouncycastle.openpgp.operator.bc.BcPGPKeyConverter.getPublicKey(Unknown Source)
	at org.bouncycastle.openpgp.operator.bc.BcPGPContentVerifierBuilderProvider$BcPGPContentVerifierBuilder.build(Unknown Source)
	at org.bouncycastle.openpgp.PGPSignature.init(Unknown Source)
	at org.simplify4u.plugins.PublicKeyUtils.lambda$null$4(PublicKeyUtils.java:179)
	at io.vavr.control.Try.run(Try.java:118)
	at org.simplify4u.plugins.PublicKeyUtils.lambda$verifySigForSubKey$5(PublicKeyUtils.java:176)

[ruud-de-jong]

If I add this test:

    @Test
    public void invalidDerbyClient() throws IOException, PGPException {

        try (InputStream inputStream = getClass().getResourceAsStream("/3D8B00E198E21827.asc")) {
            PGPPublicKeyRing publicKeyRing = PublicKeyUtils.loadPublicKeyRing(inputStream, 0x3D8B00E198E21827L);

            assertNotNull(publicKeyRing);

            assertEquals(PublicKeyUtils.getUserIDs(publicKeyRing.getPublicKey(0x3D8B00E198E21827L), publicKeyRing),
                    Collections.singletonList("Rick Hillegas <rhillegas@apache.org>"));
        }
    }

And change the main code from

        subKey.getSignatures().forEachRemaining(s -> Try.run(() -> {
                    PGPSignature sig = (PGPSignature) s;
                    PGPPublicKey masterKey = publicKeyRing.getPublicKey(sig.getKeyID());
                    sig.init(new BcPGPContentVerifierBuilderProvider(), masterKey);
                    if (!sig.verifyCertification(masterKey, subKey)) {
                        throw new PGPException(
                                String.format("Failed signature type: %d for subKey: %s in key: %s",
                                        sig.getSignatureType(),
                                        fingerprint(subKey), fingerprint(masterKey)));
                    }
                }).get()
        );

to

        subKey.getSignatures().forEachRemaining(s -> Try.run(() -> {
                    PGPSignature sig = (PGPSignature) s;
                    PGPPublicKey masterKey = publicKeyRing.getPublicKey(sig.getKeyID());
                    if (masterKey != null) {
                        sig.init(new BcPGPContentVerifierBuilderProvider(), masterKey);
                        if (!sig.verifyCertification(masterKey, subKey)) {
                            throw new PGPException(
                                    String.format("Failed signature type: %d for subKey: %s in key: %s",
                                            sig.getSignatureType(),
                                            fingerprint(subKey), fingerprint(masterKey)));
                        }
                    }
                }).get()
        );

it works.
But, is this the desired behaviour?

[ruud-de-jong]

I've added a pull request, but cannot seem to link it to this issue

[slawekjaranowski]

PR: #73

[slawekjaranowski]

NullPointer occurs because SubKey for this key is signed by someone more, and in key ring we don't have all keys.

For SubKey we should verify only "Binding Signature" not all signature.

thx for test, I will do some more fix.

[slawekjaranowski]

Key is ok