openpgp: Select only supported encryption-capable keys.

7 files changed, 35 insertions, 29 deletions

diff --git a/guide/src/chapter_01.md b/guide/src/chapter_01.md
index f1dbc653..874b70e6 100644
--- a/guide/src/chapter_01.md
+++ b/guide/src/chapter_01.md
@@ -61,7 +61,7 @@ fn main() -> openpgp::Result<()> {
 #     // Get the keypair to do the signing from the Cert.
 #     let keypair = tsk
 #         .keys().unencrypted_secret()
-#         .with_policy(policy, None).alive().revoked(false).for_signing()
+#         .with_policy(policy, None).supported().alive().revoked(false).for_signing()
 #         .nth(0).unwrap().key().clone().into_keypair()?;
 #
 #     // Start streaming an OpenPGP message.
@@ -212,7 +212,7 @@ fn generate() -> openpgp::Result<openpgp::Cert> {
 #     // Get the keypair to do the signing from the Cert.
 #     let keypair = tsk
 #         .keys().unencrypted_secret()
-#         .with_policy(policy, None).alive().revoked(false).for_signing()
+#         .with_policy(policy, None).supported().alive().revoked(false).for_signing()
 #         .nth(0).unwrap().key().clone().into_keypair()?;
 #
 #     // Start streaming an OpenPGP message.
@@ -363,7 +363,7 @@ fn sign(policy: &dyn Policy,
     // Get the keypair to do the signing from the Cert.
     let keypair = tsk
         .keys().unencrypted_secret()
-        .with_policy(policy, None).alive().revoked(false).for_signing()
+        .with_policy(policy, None).supported().alive().revoked(false).for_signing()
         .nth(0).unwrap().key().clone().into_keypair()?;
 
     // Start streaming an OpenPGP message.
@@ -525,7 +525,7 @@ Verified data can be read from this using [`io::Read`].
 #     // Get the keypair to do the signing from the Cert.
 #     let keypair = tsk
 #         .keys().unencrypted_secret()
-#         .with_policy(policy, None).alive().revoked(false).for_signing()
+#         .with_policy(policy, None).supported().alive().revoked(false).for_signing()
 #         .nth(0).unwrap().key().clone().into_keypair()?;
 #
 #     // Start streaming an OpenPGP message.
diff --git a/guide/src/chapter_02.md b/guide/src/chapter_02.md
index 052d59b8..7d663701 100644
--- a/guide/src/chapter_02.md
+++ b/guide/src/chapter_02.md
@@ -58,7 +58,7 @@ fn main() -> openpgp::Result<()> {
 #            sink: &mut dyn Write, plaintext: &str, recipient: &openpgp::Cert)
 #            -> openpgp::Result<()> {
 #    let recipients =
-#        recipient.keys().with_policy(policy, None).alive().revoked(false)
+#        recipient.keys().with_policy(policy, None).supported().alive().revoked(false)
 #        .for_transport_encryption();
 #
 #    // Start streaming an OpenPGP message.
@@ -206,7 +206,7 @@ fn generate() -> openpgp::Result<openpgp::Cert> {
 #            sink: &mut dyn Write, plaintext: &str, recipient: &openpgp::Cert)
 #            -> openpgp::Result<()> {
 #    let recipients =
-#        recipient.keys().with_policy(policy, None).alive().revoked(false)
+#        recipient.keys().with_policy(policy, None).supported().alive().revoked(false)
 #        .for_transport_encryption();
 #
 #    // Start streaming an OpenPGP message.
@@ -354,7 +354,7 @@ fn encrypt(policy: &dyn Policy,
            sink: &mut dyn Write, plaintext: &str, recipient: &openpgp::Cert)
            -> openpgp::Result<()> {
     let recipients =
-        recipient.keys().with_policy(policy, None).alive().revoked(false)
+        recipient.keys().with_policy(policy, None).supported().alive().revoked(false)
         .for_transport_encryption();
 
     // Start streaming an OpenPGP message.
@@ -516,7 +516,7 @@ Decrypted data can be read from this using [`io::Read`].
 #            sink: &mut dyn Write, plaintext: &str, recipient: &openpgp::Cert)
 #            -> openpgp::Result<()> {
 #    let recipients =
-#        recipient.keys().with_policy(policy, None).alive().revoked(false)
+#        recipient.keys().with_policy(policy, None).supported().alive().revoked(false)
 #        .for_transport_encryption();
 #
 #    // Start streaming an OpenPGP message.
diff --git a/openpgp/examples/generate-encrypt-decrypt.rs b/openpgp/examples/generate-encrypt-decrypt.rs
index 972ceced..bc147827 100644
--- a/openpgp/examples/generate-encrypt-decrypt.rs
+++ b/openpgp/examples/generate-encrypt-decrypt.rs
@@ -51,7 +51,7 @@ fn encrypt(p: &dyn Policy, sink: &mut dyn Write, plaintext: &str,
     -> openpgp::Result<()>
 {
     let recipients =
-        recipient.keys().with_policy(p, None).alive().revoked(false)
+        recipient.keys().with_policy(p, None).supported().alive().revoked(false)
         .for_transport_encryption();
 
     // Start streaming an OpenPGP message.
diff --git a/openpgp/examples/generate-sign-verify.rs b/openpgp/examples/generate-sign-verify.rs
index deaa5e61..ee7b67b2 100644
--- a/openpgp/examples/generate-sign-verify.rs
+++ b/openpgp/examples/generate-sign-verify.rs
@@ -49,7 +49,7 @@ fn sign(p: &dyn Policy, sink: &mut dyn Write, plaintext: &str, tsk: &openpgp::Ce
     // Get the keypair to do the signing from the Cert.
     let keypair = tsk
         .keys().unencrypted_secret()
-        .with_policy(p, None).alive().revoked(false).for_signing()
+        .with_policy(p, None).supported().alive().revoked(false).for_signing()
         .nth(0).unwrap().key().clone().into_keypair()?;
 
     // Start streaming an OpenPGP message.
diff --git a/openpgp/src/serialize/stream.rs b/openpgp/src/serialize/stream.rs
index 095c0d3b..0cd1902a 100644
--- a/openpgp/src/serialize/stream.rs
+++ b/openpgp/src/serialize/stream.rs
@@ -97,7 +97,7 @@
 //! #     Cert::from_bytes(&include_bytes!(
 //! #     "../../tests/data/keys/testy-new-private.pgp")[..])?;
 //! let signing_keypair = sender.keys().secret()
-//!     .with_policy(p, None).alive().revoked(false).for_signing()
+//!     .with_policy(p, None).supported().alive().revoked(false).for_signing()
 //!     .nth(0).unwrap()
 //!     .key().clone().into_keypair()?;
 //!
@@ -105,7 +105,7 @@
 //! #     sender.clone();
 //! // Note: One certificate may contain several suitable encryption keys.
 //! let recipients =
-//!     recipient.keys().with_policy(p, None).alive().revoked(false)
+//!     recipient.keys().with_policy(p, None).supported().alive().revoked(false)
 //!     // Or `for_storage_encryption()`, for data at rest.
 //!     .for_transport_encryption();
 //!
@@ -679,7 +679,7 @@ impl<'a> Signer<'a> {
     /// #     Cert::from_bytes(&include_bytes!(
     /// #     "../../tests/data/keys/testy-new-private.pgp")[..])?;
     /// let signing_keypair = cert.keys().secret()
-    ///     .with_policy(p, None).alive().revoked(false).for_signing()
+    ///     .with_policy(p, None).supported().alive().revoked(false).for_signing()
     ///     .nth(0).unwrap()
     ///     .key().clone().into_keypair()?;
     ///
@@ -770,7 +770,7 @@ impl<'a> Signer<'a> {
     /// #     Cert::from_bytes(&include_bytes!(
     /// #     "../../tests/data/keys/testy-new-private.pgp")[..])?;
     /// # let signing_keypair = cert.keys().secret()
-    /// #     .with_policy(p, None).alive().revoked(false).for_signing()
+    /// #     .with_policy(p, None).supported().alive().revoked(false).for_signing()
     /// #     .nth(0).unwrap()
     /// #     .key().clone().into_keypair()?;
     /// # let mut sink = vec![];
@@ -839,7 +839,7 @@ impl<'a> Signer<'a> {
     /// #     "../../tests/data/keys/testy-new-private.pgp")[..])?;
     /// # let signing_keypair
     /// #     = cert.keys().secret()
-    /// #           .with_policy(p, None).alive().revoked(false).for_signing()
+    /// #           .with_policy(p, None).supported().alive().revoked(false).for_signing()
     /// #           .nth(0).unwrap()
     /// #           .key().clone().into_keypair()?;
     ///
@@ -908,11 +908,11 @@ impl<'a> Signer<'a> {
     /// # let cert = Cert::from_bytes(&include_bytes!(
     /// #     "../../tests/data/keys/testy-new-private.pgp")[..])?;
     /// # let signing_keypair = cert.keys().secret()
-    /// #     .with_policy(p, None).alive().revoked(false).for_signing()
+    /// #     .with_policy(p, None).supported().alive().revoked(false).for_signing()
     /// #     .nth(0).unwrap()
     /// #     .key().clone().into_keypair()?;
     /// # let additional_signing_keypair = cert.keys().secret()
-    /// #     .with_policy(p, None).alive().revoked(false).for_signing()
+    /// #     .with_policy(p, None).supported().alive().revoked(false).for_signing()
     /// #     .nth(0).unwrap()
     /// #     .key().clone().into_keypair()?;
     ///
@@ -961,7 +961,7 @@ impl<'a> Signer<'a> {
     /// # let cert = Cert::from_bytes(&include_bytes!(
     /// #     "../../tests/data/keys/testy-new-private.pgp")[..])?;
     /// # let signing_keypair = cert.keys().secret()
-    /// #     .with_policy(p, None).alive().revoked(false).for_signing()
+    /// #     .with_policy(p, None).supported().alive().revoked(false).for_signing()
     /// #     .nth(0).unwrap()
     /// #     .key().clone().into_keypair()?;
     /// let recipient: Cert = // ...
@@ -1003,7 +1003,7 @@ impl<'a> Signer<'a> {
     /// # let cert = Cert::from_bytes(&include_bytes!(
     /// #     "../../tests/data/keys/testy-new-private.pgp")[..])?;
     /// # let signing_keypair = cert.keys().secret()
-    /// #     .with_policy(p, None).alive().revoked(false).for_signing()
+    /// #     .with_policy(p, None).supported().alive().revoked(false).for_signing()
     /// #     .nth(0).unwrap()
     /// #     .key().clone().into_keypair()?;
     ///
@@ -1046,7 +1046,7 @@ impl<'a> Signer<'a> {
     /// #     Cert::from_bytes(&include_bytes!(
     /// #     "../../tests/data/keys/testy-new-private.pgp")[..])?;
     /// let signing_key = cert.keys().secret()
-    ///     .with_policy(p, None).alive().revoked(false).for_signing()
+    ///     .with_policy(p, None).supported().alive().revoked(false).for_signing()
     ///     .nth(0).unwrap()
     ///     .key();
     /// let signing_keypair = signing_key.clone().into_keypair()?;
@@ -1103,7 +1103,7 @@ impl<'a> Signer<'a> {
     /// #     "../../tests/data/keys/testy-new-private.pgp")[..])?;
     /// # let signing_keypair
     /// #     = cert.keys().secret()
-    /// #           .with_policy(p, None).alive().revoked(false).for_signing()
+    /// #           .with_policy(p, None).supported().alive().revoked(false).for_signing()
     /// #           .nth(0).unwrap()
     /// #           .key().clone().into_keypair()?;
     /// #
@@ -1868,7 +1868,7 @@ impl<'a> Recipient<'a> {
     /// )?;
     ///
     /// let recipients =
-    ///     cert.keys().with_policy(p, None).alive().revoked(false)
+    ///     cert.keys().with_policy(p, None).supported().alive().revoked(false)
     ///     // Or `for_storage_encryption()`, for data at rest.
     ///     .for_transport_encryption()
     ///     .map(|ka| Recipient::new(ka.key().keyid(), ka.key()));
@@ -1926,7 +1926,7 @@ impl<'a> Recipient<'a> {
     /// )?;
     ///
     /// let recipients =
-    ///     cert.keys().with_policy(p, None).alive().revoked(false)
+    ///     cert.keys().with_policy(p, None).supported().alive().revoked(false)
     ///     // Or `for_storage_encryption()`, for data at rest.
     ///     .for_transport_encryption()
     ///     .map(Into::into)
@@ -1980,7 +1980,7 @@ impl<'a> Recipient<'a> {
     /// )?;
     ///
     /// let recipients =
-    ///     cert.keys().with_policy(p, None).alive().revoked(false)
+    ///     cert.keys().with_policy(p, None).supported().alive().revoked(false)
     ///     // Or `for_storage_encryption()`, for data at rest.
     ///     .for_transport_encryption()
     ///     .map(|ka| Recipient::from(ka)
@@ -2068,7 +2068,7 @@ impl<'a> Encryptor<'a> {
     /// )?;
     ///
     /// let recipients =
-    ///     cert.keys().with_policy(p, None).alive().revoked(false)
+    ///     cert.keys().with_policy(p, None).supported().alive().revoked(false)
     ///     // Or `for_storage_encryption()`, for data at rest.
     ///     .for_transport_encryption();
     ///
@@ -2198,7 +2198,7 @@ impl<'a> Encryptor<'a> {
     /// )?;
     ///
     /// let recipients =
-    ///     cert.keys().with_policy(p, None).alive().revoked(false)
+    ///     cert.keys().with_policy(p, None).supported().alive().revoked(false)
     ///     // Or `for_storage_encryption()`, for data at rest.
     ///     .for_transport_encryption();
     ///
@@ -2281,7 +2281,7 @@ impl<'a> Encryptor<'a> {
     /// )?;
     ///
     /// let recipients =
-    ///     cert.keys().with_policy(p, None).alive().revoked(false)
+    ///     cert.keys().with_policy(p, None).supported().alive().revoked(false)
     ///     // Or `for_storage_encryption()`, for data at rest.
     ///     .for_transport_encryption();
     ///
@@ -3187,7 +3187,8 @@ mod test {
         ] {
             eprintln!("{:?}", String::from_utf8(data.to_vec())?);
             let signing_keypair = cert.keys().secret()
-                .with_policy(p, None).alive().revoked(false).for_signing()
+                .with_policy(p, None).supported()
+                .alive().revoked(false).for_signing()
                 .nth(0).unwrap()
                 .key().clone().into_keypair()?;
             let mut signature = vec![];
diff --git a/sop/src/main.rs b/sop/src/main.rs
index 95390fa4..7a53811f 100644
--- a/sop/src/main.rs
+++ b/sop/src/main.rs
@@ -126,6 +126,7 @@ fn real_main() -> Result<()> {
 
                 let mut one = false;
                 for key in tsk.keys()
+                    .supported()
                     .secret()
                     .alive()
                     .revoked(false)
@@ -195,6 +196,7 @@ fn real_main() -> Result<()> {
             for tsk in tsks {
                 let mut one = false;
                 for key in tsk.keys().with_policy(p, None)
+                    .supported()
                     .secret()
                     .alive()
                     .revoked(false)
@@ -281,6 +283,7 @@ fn real_main() -> Result<()> {
 
                 let mut one = false;
                 for key in cert.keys()
+                    .supported()
                     .alive()
                     .revoked(false)
                     .for_storage_encryption()
@@ -643,6 +646,7 @@ impl<'a> Helper<'a> {
         for tsk in secrets {
             for ka in tsk.keys().secret()
                 .with_policy(policy, None)
+                .supported()
                 .for_transport_encryption().for_storage_encryption()
             {
                 let id: KeyID = ka.key().fingerprint().into();
diff --git a/sq/src/commands/mod.rs b/sq/src/commands/mod.rs
index 6415e2cf..fbf96657 100644
--- a/sq/src/commands/mod.rs
+++ b/sq/src/commands/mod.rs
@@ -51,6 +51,7 @@ fn get_signing_keys(certs: &[openpgp::Cert], p: &dyn Policy,
     'next_cert: for tsk in certs {
         for key in tsk.keys().with_policy(p, timestamp).alive().revoked(false)
             .for_signing()
+            .supported()
             .map(|ka| ka.key())
         {
             if let Some(secret) = key.optional_secret() {
@@ -108,7 +109,7 @@ pub fn encrypt<'a>(policy: &'a dyn Policy,
     for cert in recipients.iter() {
         let mut count = 0;
         for key in cert.keys().with_policy(policy, None).alive().revoked(false)
-            .key_flags(&mode).map(|ka| ka.key())
+            .key_flags(&mode).supported().map(|ka| ka.key())
         {
             recipient_subkeys.push(key.into());
             count += 1;