OpenPGPCertificateComponent.getApplyingSubpacket: Limit chain selection to self-signatures

vanitasvitae · vanitasvitae · commit 79058d9d6d96 · 2026-01-22T01:29:07.000+01:00
diff --git a/pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPCertificate.java b/pg/src/main/java/org/bouncycastle/openpgp/api/OpenPGPCertificate.java
@@ -1534,7 +1534,9 @@ public Date getKeyExpirationDateAt(Date evaluationTime)
          */
         protected OpenPGPSignature.OpenPGPSignatureSubpacket getApplyingSubpacket(Date evaluationTime, int subpacketType)
         {
-            OpenPGPSignatureChain binding = getSignatureChains().getCertificationAt(evaluationTime);
+            OpenPGPSignatureChain binding = getSignatureChains()
+                    .fromOrigin(getCertificate().getPrimaryKey())
+                    .getCertificationAt(evaluationTime);
             if (binding == null)
             {
                 // is not bound

Original file line number	Diff line number	Diff line change
`@@ -1534,7 +1534,9 @@ public Date getKeyExpirationDateAt(Date evaluationTime)`
`1534`	`1534`	`*/`
`1535`	`1535`	`protected OpenPGPSignature.OpenPGPSignatureSubpacket getApplyingSubpacket(Date evaluationTime, int subpacketType)`
`1536`	`1536`	`{`
`1537`		`- OpenPGPSignatureChain binding = getSignatureChains().getCertificationAt(evaluationTime);`
	`1537`	`+ OpenPGPSignatureChain binding = getSignatureChains()`
	`1538`	`+ .fromOrigin(getCertificate().getPrimaryKey())`
	`1539`	`+ .getCertificationAt(evaluationTime);`
`1538`	`1540`	`if (binding == null)`
`1539`	`1541`	`{`
`1540`	`1542`	`// is not bound`