openpgp: Be tolerant when deciding wheter a signature is alive.

  - Consider the following scenario: computer A's clock says 9:00.00
    and signs and sends a message to computer B.  Computer B's clock
    says 8:59.59, it receives the message and tries to verify it.
    From Computer B's perspective, the signature is not valid, because
    it was generated in the future.

  - This situation occured, because the two clocks were not completely
    synchronized.  Unfortunately, a few seconds of clock skew are not
    unusual, particularly when dealing with VMs.

  - Since it is almost always better to consider such messages as
    valid, be tolerant when deciding whether a signature is alive.

1 files changed, 1 insertions, 1 deletions

diff --git a/tool/src/commands/inspect.rs b/tool/src/commands/inspect.rs
index ee915c54..23ebe8a5 100644
--- a/tool/src/commands/inspect.rs
+++ b/tool/src/commands/inspect.rs
@@ -151,7 +151,7 @@ fn inspect_tpk(output: &mut dyn io::Write, tpk: &openpgp::TPK,
         if let Some(sig) = uidb.binding_signature(None) {
             if sig.signature_expired(None) {
                 writeln!(output, "                 Expired")?;
-            } else if ! sig.signature_alive(None) {
+            } else if ! sig.signature_alive(None, time::Duration::seconds(0)) {
                 writeln!(output, "                 Not yet valid")?;
             }
         }