make stringToKeySpecifier a real type

openpgp/keys.go

@@ -457,7 +457,8 @@ func addSubkey(e *Entity, packets *packet.Reader, pub *packet.PublicKey, priv *p
 		case packet.SigTypeSubkeyRevocation:
 			subKey.Sig = sig
 		case packet.SigTypeSubkeyBinding:
-			if subKey.Sig == nil {
+
+			if shouldReplaceSubkeySig(subKey.Sig, sig) {
 				subKey.Sig = sig
 			}
 		}
@@ -472,6 +473,22 @@ func addSubkey(e *Entity, packets *packet.Reader, pub *packet.PublicKey, priv *p
 	return nil
 }
 
+func shouldReplaceSubkeySig(existingSig, potentialNewSig *packet.Signature) bool {
+	if potentialNewSig == nil {
+		return false
+	}
+
+	if existingSig == nil {
+		return true
+	}
+
+	if existingSig.SigType == packet.SigTypeSubkeyRevocation {
+		return false // never override a revocation signature
+	}
+
+	return potentialNewSig.CreationTime.After(existingSig.CreationTime)
+}
+
 const defaultRSAKeyBits = 2048
 
 // NewEntity returns an Entity that contains a fresh RSA/RSA keypair with a

openpgp/packet/signature.go

@@ -727,5 +727,21 @@ func (sig *Signature) buildSubpackets() (subpackets []outputSubpacket) {
 		subpackets = append(subpackets, outputSubpacket{true, prefCompressionSubpacket, false, sig.PreferredCompression})
 	}
 
+	if sig.SigType == SigTypeKeyRevocation {
+		reasonForRevData := bytes.NewBuffer(nil)
+		reasonForRevData.Write([]byte{*sig.RevocationReason})
+		reasonForRevData.Write([]byte(sig.RevocationReasonText))
+
+		subpackets = append(
+			subpackets,
+			outputSubpacket{
+				hashed:        true,
+				subpacketType: reasonForRevocationSubpacket,
+				isCritical:    false,
+				contents:      reasonForRevData.Bytes(),
+			},
+		)
+	}
+
 	return
 }

openpgp/s2k/s2k.go

@@ -15,7 +15,7 @@ import (
 	"github.com/fluidkeys/crypto/openpgp/errors"
 )
 
-type stringToKeySpecifier = uint8
+type stringToKeySpecifier uint8
 
 const (
 	S2KCountMin     = 1024
@@ -192,7 +192,7 @@ func Parse(r io.Reader) (f func(out, in []byte), err error) {
 	}
 	h := hash.New()
 
-	switch buf[0] {
+	switch stringToKeySpecifier(buf[0]) {
 	case SimpleS2K:
 		f := func(out, in []byte) {
 			Simple(out, h, in)
@@ -228,7 +228,7 @@ func Parse(r io.Reader) (f func(out, in []byte), err error) {
 // nil. In that case, sensible defaults will be used.
 func Serialize(w io.Writer, key []byte, rand io.Reader, passphrase []byte, c *Config) error {
 	var buf [11]byte
-	buf[0] = IteratedAndSaltedS2K
+	buf[0] = byte(IteratedAndSaltedS2K)
 	buf[1], _ = HashToHashId(c.hash())
 	salt := buf[2:10]
 	if _, err := io.ReadFull(rand, salt); err != nil {