Merge tag '0.6.3' into debian

release 0.6.3

1 files changed, 9 insertions, 4 deletions

diff --git a/plugins/curl b/plugins/curl
index 9c47601..3ae028c 100755
--- a/plugins/curl
+++ b/plugins/curl
@@ -5,8 +5,8 @@
 # ENVIRONMENT VARIABLES:
 #	URL		URL to download known_hosts file from
 #	CURL_OPTIONS	options passed to curl
-#	SIGURL		URL of the GnuPG signature
-#	KEYRING		path to the keyring for use by gpgv
+#	SIGURL		URL of the OpenPGP signature
+#	KEYRING		path to the OpenPGP keyring with certificates
 #
 
 set -e
@@ -14,8 +14,13 @@ set -e
 if [ "${SIGURL}" ]; then
 	curl -fRz "./current" -m 300 ${CURL_OPTIONS} -o new.sig "${SIGURL}" -o new "${URL}"
 	[ -e new ] || exit 0
-	gpgv --keyring "${KEYRING}" --status-fd 2 new.sig || exit 1
-	# return 1 because it's not clear what other codes may used
+	if command -v sopv >/dev/null; then
+		sopv verify new.sig "${KEYRING}" <new || exit 1
+	else
+		gpgv --keyring "${KEYRING}" --status-fd 2 new.sig new || exit 1
+	fi
+	# return 1 because it's not clear what other codes may be safe to
+	# use that do not overlap with codes from curl.
 else
 	curl -fRz "./current" -m 300 ${CURL_OPTIONS} -o new "${URL}"
 fi