aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Release 2.2.24gnupg-2.2.24Werner Koch2020-11-171-1/+5
|
* po: Auto updateWerner Koch2020-11-1625-296/+552
| | | | --
* scd:openpgp: Drop support for GnuPG 1.Werner Koch2020-11-161-36/+1
| | | | | | | | | | -- It does not make sense to keep support form GnuPG 1 here given that we don't intend to ever backport any of the current stuff to the legacy version. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Allow keygrip to be used to reference a keyWerner Koch2020-11-161-141/+129
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): Add keygrip_str. (store_keygrip): New. (read_public_key): Store the keygrip. (get_public_key): Sitto. (send_keypair_info): USe the stored keygrip. (check_keyidstr): New. Factored out from other functions and extended. (do_sign): Use check_keyidstr. (do_auth): Ditto. (do_decipher): Ditto. (do_check_pin): Ditto. -- This code is a backport of commits: b0f0791e4ade845b2a0e2a94dbda4f3bf1ceb039 cd: Factor out a function to check keyidstr. 4c4999b8185ace55eb5f3a6fa7d3dc0a77267b63 scd:openpgp: Allow PKSIGN with keygrip also for OPENPGP.3. e769609cd3c12d2e26955538399172016f78d2d4 scd: Allow KEYGRIP as KEYIDSTR. Co-authored-by: NIIBE Yutaka <[email protected]> Signed-off-by: Werner Koch <[email protected]>
* gpg: Provide better diagnostic for replaced card keys.Werner Koch2020-11-137-5/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/divert-scd.c (divert_pksign): Add arg 'grip'. Replace OPENPGP key reference to keygrips. (divert_pkdecrypt): Ditto. * agent/protect.c (parse_shadow_info): Trim spaces. * agent/pkdecrypt.c (agent_pkdecrypt): Pass the keygrip. * agent/pksign.c (agent_pksign_do): Ditto. * g10/mainproc.c (print_pkenc_list): Print extra info for an invalid id error. * g10/sign.c (do_sign): Ditto. -- Using the keygrip instead of the identifier works on OpenPGP cards and thus we use that to make sure that we are working on the right card. For other cards we better don't do that to avoid regressions. Those other cards are also usually provided and do not allow to self-generate the keys. Note that old versions of the code (gpg 1.4) used the fingerprint as additional check but that was eventually removed and now that we use the keygrip all over the place, it is best to use this to identify a key. Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix the encrypt+sign hash algo preference selection for ECDSA.Werner Koch2020-11-133-38/+58
| | | | | | | | | | | | | | | | | * g10/keydb.h (pref_hint): Change from union to struct and add field 'exact'. Adjust callers. * g10/pkclist.c (algo_available): Take care of the exact hint. * g10/sign.c (sign_file): Fix indentation. Rework the hash from recipient prefs. -- This fixes a encrypt+sign case like: One recipient key has SHA512 as highest ranked hash preference but the the signing key is a 256 bit curve. Because we don't want to use a truncated hash with ECDSA, we need to have an exact match - this is in particular important for smartcard which check that the hash matches the curves. Signed-off-by: Werner Koch <[email protected]>
* gpgconf: Yet another fix for --apply-profile.Werner Koch2020-11-121-4/+4
| | | | | | | | | * tools/gpgconf.c (main): Use gnupg_homedir instead of default_homedir. Check for existance of the directory. -- Fixes-commit: 1fbf085bc8b4a92772d1da8bfea507f4f97434b1 Signed-off-by: Werner Koch <[email protected]>
* scd: Skip unknown options in command SERIALNOWerner Koch2020-11-121-0/+2
| | | | | | | | | | | | * scd/command.c (cmd_serialno): Skip options. -- SERIALNO --all works only in 2.3 and thus naive use with 2.2 vesions would conserer "--all" as the reqyested applications. Fix is easy and should be done anyway. Signed-off-by: Werner Koch <[email protected]>
* po: Update Japanese Translations.NIIBE Yutaka2020-11-121-15/+22
| | | | | | -- Signed-off-by: NIIBE Yutaka <[email protected]>
* po: Update the German translationWerner Koch2020-11-111-13/+21
| | | | --
* gpg: Support brainpool keygen with "key from card".Werner Koch2020-11-111-0/+4
| | | | | | | * g10/keygen.c (ask_algo): Add brainpool hack in the same as for Nist curves. Signed-off-by: Werner Koch <[email protected]>
* scd: Do not print reader status change with --debug cardio.Werner Koch2020-11-111-1/+1
| | | | | | | | -- ... but use --debug reader for this. Signed-off-by: Werner Koch <[email protected]>
* w32: Revert use of one gnupg_fopen in a test toolWerner Koch2020-11-101-1/+1
| | | | --
* w32: Support Unicode also for config files etc.Werner Koch2020-11-1020-25/+76
| | | | | | | | | | | | | | * common/sysutils.c (gnupg_fopen) [W32]: Use _wfopen if needed. Use new function in most places where fopen is used. -- The config files in 2.2 are still read using fopen - we need to change this to allow Unicode directory names. There is also one case where files are written using the old fopen. The new option parser in 2.3 does not have this problem but at some places fopen is also still used. GnuPG-bug-id: 5098 Signed-off-by: Werner Koch <[email protected]>
* w32: Support utf8 for getcwd even if build with gpgrt < 1.40.Werner Koch2020-11-101-8/+28
| | | | | | | | | | | * common/sysutils.c (gnupg_getcwd) [W32]: Use Unicode version. -- gpgrt 1.40 has not yet been released, so to make getcwd work properly on Windows we need to have the code here as well. GnuPG-bug-id: 5098 Signed-off-by: Werner Koch <[email protected]>
* Prepare NEWS for the next release.Werner Koch2020-11-091-1/+53
| | | | --
* scd: Internal CCID driver: Fix a race condition on close.NIIBE Yutaka2020-11-091-12/+25
| | | | | | | | | | | | | | | | | | | | | | * scd/ccid-driver.c (ccid_require_get_status): For VENDOR_SCM reader, return 0 only at the initial call. (bulk_in): Don't detect an error for VENDOR_SCM reader, just kicking the loop, to invoke scd_update_reader_status_file, which calls ccid_slot_status again. (ccid_slot_status): Move the call of ccid_vendor_specific_setup to... (ccid_get_atr): ... here. -- For readers with interrupt transfer support, it is only intr_cb which sets handle->powered_off to 1. Keeping this condition makes no race. The function ccid_slot_status can also detect a communication error, which causes apdu_close_reader (but not setting ->powered_off). GnuPG-bug-id: 5121 Fixes-commit: 920f258eb6018ecec1d63bad6a0fb0772f72affa Signed-off-by: NIIBE Yutaka <[email protected]> (cherry picked from commit 484bafda4dbf5ffe9e7c41ef24fbc5bd791a3b32)
* card: Run factory-reset in locked stated.Werner Koch2020-11-094-17/+58
| | | | | | | | | | | | | | | | * scd/command.c (reset_notify): Add option --keep-lock. (do_reset): Add arg keep_lock. (cmd_lock): Send progress status. * g10/call-agent.c (agent_scd_apdu): Add more pseudo APDUs. * g10/card-util.c (send_apdu): Ditto. (factory_reset): Use lock commands. -- This is required so that for example Kleopatra does not detect the RESET and issues a SERIALNO of its own, thus conflicting with our SERIALNO undefined. Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix recent commit for weak digest algos and smartcards.Werner Koch2020-11-091-1/+1
| | | | | | | | * g10/sign.c (sign_file): Fix condition. -- Fixes-commit: 4c181d51a6f1fd05b7f190a18769ba5e9f892f6a Signed-off-by: Werner Koch <[email protected]>
* Require libksba 1.3.5Werner Koch2020-11-091-1/+1
| | | | | | | | | | | * configure.ac (NEED_KSBA_VERSION): Set to 1.3.5. -- Minor update to make sure that important fixes are used. That version was release in 2016 and thus before the new requirement for Libgcrypt 1.8. Signed-off-by: Werner Koch <[email protected]>
* Require Libgpg-error 1.27Werner Koch2020-11-092-21/+1
| | | | | | | | | | | | * configure.ac (NEED_GPG_ERROR_VERSION): Require 1.27 * common/util.h: Remove compatibility macros. -- This is just a minor change to align with the need for Libgcrypt 1.8. The latter was first released in summer 2017 while Libgpg-error 1.27 was released earlier in spring that year. Signed-off-by: Werner Koch <[email protected]>
* Require Libgcrypt 1.8Werner Koch2020-11-096-36/+1
| | | | | | | | | | | | | | | | | * configure.ac (NEED_LIBGCRYPT_VERSION): Require 1.8. * tools/gpgconf.c (show_version_libgcrypt): Remove conditional case for Libgcrypt < 1.8. * common/compliance.c (gnupg_rng_is_compliant): Ditto. * agent/pksign.c: Ditto. * agent/gpg-agent.c (thread_init_once): Ditto. (agent_libgcrypt_progress_cb): Ditto. * agent/command.c (cmd_getinfo): Ditto. -- Libgcrypt 1.7 reached end-of-life more than a year ago. Thus there is no reason to keep backward support for it. Signed-off-by: Werner Koch <[email protected]>
* gpg: Add canceled status message.Ben Kibbey2020-11-092-1/+2
| | | | | | | | | | | | | * common/status.h (STATUS_CANCELED_BY_USER): New. * g10/passphrase.c (passphrase_to_dek): Send STATUS_CANCELED_BY_USER instead of STATUS_MISSING_PASSPHRASE when canceled is set. -- This is to prevent further pinentry tries when the pinentry is canceled by the user during symmetric decryption. Signed-off-by: Ben Kibbey <[email protected]> (cherry picked from commit 31e47dfad0f40e31e8b3113b933696e8e4105136)
* gpg: Do not print rejected digest algo notes with --quiet.Werner Koch2020-11-091-1/+5
| | | | | | | | | | * g10/misc.c (print_digest_rejected_note): Do not print in quiet mode. (print_sha1_keysig_rejected_note): Ditto. -- GnuPG-bug-id: 4893 Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit e08e1d62d089a154ec5d7c80cd58e8e3b18d2d6b)
* speedo,w32: Install gpg-check-pattern and example profiles.Werner Koch2020-11-045-3/+40
| | | | | | | | | | | | | | | | | | | * doc/examples/vsnfd.prf: Rename to VS-NfD.prf. * doc/examples/Automatic.prf: New. * doc/Makefile.am (examples): Adjust. * build-aux/speedo/w32/inst.nsi: Install gpg-check-pattern.exe and 3 example files. * build-aux/speedo/w32/wixlib.wxs: Add new files. -- Note that we renamed the existing example profile so that kleopatra shows a nicer name. In fact the gpg4win installer just copies of theses file but it is better to maintain them here. gpg-check-pattern.exe can no be installed because we meanwhile have a regex lib which works also on Windows. Signed-off-by: Werner Koch <[email protected]>
* g13: Include a now missing header file.Werner Koch2020-11-042-0/+2
| | | | | | | | | | * g13/create.c: Include sysutuls.h * g13/sh-dmcrypt.c: Ditto. -- This is needed due to the recent switch from stat to gnupg_stat. Signed-off-by: Werner Koch <[email protected]>
* gpgconf: Make sure the homedir exists for --apply-profile.Werner Koch2020-11-041-0/+4
| | | | | | | | | | | | | | * tools/gpgconf.c (main) <aApplyDefaults, aApplyProfile>: Create the standard home directory. -- This fixes a regression due to the fix for GnuPG-bug-id: 4867 Before that change gpgsm implictly created the homedir while options were collected. It is important to have this so that a login script can create config files for new users. Signed-off-by: Werner Koch <[email protected]>
* common: Fix duplicate implementation of try_make_homedir.Werner Koch2020-11-045-48/+42
| | | | | | | | | | | * g10/openfile.c (try_make_homedir): Move core of the code to ... * common/homedir.c (gnupg_maybe_make_homedir): new. * sm/keydb.c (try_make_homedir): Implement using new function. * common/homedir.c: Include i18n.h. * po/POTFILES.in: Add common/homedir.c. Signed-off-by: Werner Koch <[email protected]>
* w32: Add another pinentry search pathAndre Heinecke2020-11-041-0/+2
| | | | | | | | | | * common/homedir.c (get_default_pinentry_name): Try ../bin/pinentry.exe -- In an installation layout where GnuPG is installed as a component of another software it might be useful to have pinentry placed in a different bin directory without the forced folder name of Gpg4win.
* w32: Add windows subsystem variant of gpgconfAndre Heinecke2020-11-042-0/+9
| | | | | | | | | | | * tools/Makefile.am (gpgconf-w32): New target. Builds gpgconf with subsystem windows. * build-aux/speedo/w32/wixlib.wxs: Package it. -- This allows us to create scripts that call gpgconf without opening a console. Using subsystem windows is better then to just close the console after start as it avoids the console flashing up.
* w32: Fix strftime problem on Windows.Werner Koch2020-11-031-2/+31
| | | | | | | | | * common/gettime.c: Include locale.h. (asctimestamp): Increase buffer. On Windows use setlocale. -- GnuPG-bug-id: 5073 Signed-off-by: Werner Koch <[email protected]>
* gpg: Switch to AES256 for symmetric encryption in de-vs mode.Werner Koch2020-11-032-4/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (set_compliance_option): For AES256 and SHA256 in de-vs mode. * g10/encrypt.c (setup_symkey): Add extra compliance check. (encrypt_simple): Avoid printing a second error oncplinace failure. -- Because we used the RFC4880 mode as base for the de-vs mode we got 3DES as symmetric encryption algorithm. With the default gnupg mode that was already used. The new extra compliance checks are added to detect whether a --personal-cipher-preference or --cipher-algo option tried to override the algorithms. They are still possible but now non-compliant algorithms will throw an error. Manual testing can be done with commands like this: gpg --no-options --compliance=de-vs \ --personal-cipher-preferences "S1 S7" \ --pinentry-mode loopback -v --passphrase abc -ac </etc/motd Here the command fails due to IDEA (S1) being the preferred cipher algorithm. Using "--s2k-digest-algo SHA1" instead of --personal-cipher-preferences will also fail. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit d1f2a6d9f71cf50318f4891c84aeedb975553896)
* po: Major update of italian translationAndre Heinecke2020-11-031-5027/+2878
| | | | | | | | * po/it.po: Update to a recent 2.2 version. -- Thanks to Denis Renzi, who also translated some Gpg4win parts to italian for this translation.
* gpg: Allow setting notations with the empty string as value.Werner Koch2020-11-022-0/+10
| | | | | | | | | | | | | | | * g10/misc.c (pct_expando): Catch special case of the empty string. Also map a NULL to the empty string. * g10/photoid.c (show_photos): Make an empty string used as command fail. -- This patch also fixes a segv when calling gpg wrongly like gpg -N \[email protected] GnuPG-bug-id: 5117 Signed-off-by: Werner Koch <[email protected]>
* gpg: Do not use weak digest algos if selected by recipient prefs.Werner Koch2020-11-024-23/+37
| | | | | | | | | | | | | | | | | | | | | | | | * g10/misc.c (is_weak_digest): New. (print_digest_algo_note): Use it here. * g10/sig-check.c (check_signature_end_simple): Use it. * g10/sign.c (hash_for): Do not use recipient_digest_algo if it is in the least of weak digest algorithm. -- If a message is signed and encrypted to several recipients, the to be used digest algorithm is deduced from the preferences of the recipient. This is so that all recipients are able to check the the signature. However, if the sender has a declared an algorithm as week, that algorithm shall not be used - in this case we fallback to the standard way of selecting an algorithm. Note that a smarter way of selecting the algo is to check this while figuring out the algorithm - this needs more testing and thus we do it the simple way. Reported-by: Phil Pennock Signed-off-by: Werner Koch <[email protected]> Backported-from-master: 15746d60d492f5792e4a179ab0a08801b4049695
* gpg: Fix iteration over signaturesIngo Klöcker2020-10-301-1/+1
| | | | | | | | * g10/keyedit.c (keyedit_quick_revsig): Take signature of correct node -- GnuPG-bug-id: 5093 (cherry picked from commit db3854f55c91ca9c34cf6a306081c3709798db3d)
* agent: Fix secret key import for Ed25519.NIIBE Yutaka2020-10-301-1/+1
| | | | | | | | | | | | | * agent/cvt-openpgp.c (convert_secret_key): Avoid adding 0x00 at the beginning of MPI. -- In master, we handle it as opaque MPI, but in 2.2, we use standard MPI here. GnuPG-bug-id: 5114 Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: New command --quick-revoke-sigWerner Koch2020-10-287-8/+334
| | | | | | | | | | | | | | | * g10/gpg.c (enum cmd_and_opt_values): Add aQuickRevSig. (opts): Add --quick-revoke-sig. (main): Implement. * g10/keyedit.c (quick_find_keyblock): Add arg 'want_secret' and adjust all callers. (keyedit_quick_revsig): new. * g10/revoke.c (get_default_sig_revocation_reason): New. * g10/keylist.c (cmp_signodes): New. -- GnuPG-bug-id: 5093 Backported-from-master: 243f9176e799b2328f2e5bed93099bfc474fdc5a
* scd: Internal CCID driver thing only for SPR532.NIIBE Yutaka2020-10-261-6/+14
| | | | | | | | | | | | | * scd/ccid-driver.c (ccid_vendor_specific_setup): New. Limit only for SPR532, excluding other readers by SCM. (ccid_slot_status): Use ccid_vendor_specific_setup. -- We follow the setup procedure of libccid implementation, which sends the escape command for SPR532 only. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Internal CCID driver limiting only for SPR532.NIIBE Yutaka2020-10-261-1/+1
| | | | | | | * scd/ccid-driver.c (ccid_vendor_specific_init): Only do that for SPR532. Signed-off-by: NIIBE Yutaka <[email protected]>
* g10,sm: Use gnupg_access at two more places.Werner Koch2020-10-262-2/+2
| | | | --
* common: Fix gnupg_access for older libgpg-error.Werner Koch2020-10-261-1/+3
| | | | | | -- Fixes-commit: dd5fd4a760b8cf6ae05ff878bcf36cf2465e744c
* common: New functions gnupg_opendir et al.Werner Koch2020-10-238-37/+210
| | | | | | | | | | | | * common/sysutils.h (struct gnupg_dirent_s): New. * common/sysutils.c: Include dirent.h. (struct gnupg_dir_s): New. (gnupg_opendir, gnupg_readdir, gnupg_closedir): New. Change all callers of opendir, readdir, and closedir to use these functions. -- GnuPG-bug-id: 5098 Backported-from-master: 7e22e08e2ab09cd3c2317f5e80e8ee47d46eff4b
* w32: Make gnupg_remove and gnupg_rename_file Unicode awareWerner Koch2020-10-231-3/+33
| | | | | | | | | | * common/sysutils.c (w32_rename): New. (gnupg_rename_file) [W32]: Support Unicode. (gnupg_remove) [W32]: Support Unicode. Drop Windows-CE support. -- GnuPG-bug-id: 5098 (cherry picked from commit 9a0197b6fe412cfc66b0cece521267180e454416)
* Replace all calls to stat by gnupg_stat.Werner Koch2020-10-2320-28/+77
| | | | | | | | | | | | * common/sysutils.c (gnupg_stat): New. * common/sysutils.h: Include sys/stat.h. -- Yet another wrapper for Unicode support on Windows. GnuPG-bug-id: 5098 Signed-off-by: Werner Koch <[email protected]> Backported-from-master: 18e5dd7b03ced51611c9ba1345cf498a0aaf14a6)
* Replace most calls to open by a new wrapper.Werner Koch2020-10-238-26/+79
| | | | | | | | | | | | | * common/sysutils.c (any8bitchar) [W32]: New. (gnupg_open): New. Replace most calls to open by this. * common/iobuf.c (any8bitchar) [W32]: New. (direct_open) [W32]: Use CreateFileW if needed. -- This is yet another step for full Unicode support on Windows. GnuPG-bug-id: 5098 (cherry picked from commit 4dcef0e17836e8725c31a3b76f2bf7144345c808)
* w32: Allow Unicode filenames for dotlockWerner Koch2020-10-212-27/+192
| | | | | | | | | | | | | * common/dotlock.c (any8bitchar) [W32]: New. (dotlock_create_w32): Use strconcat and CreateFileW. * common/t-dotlock.c: Source include dotlock.c and modify to allow manual testing on Windows. -- GnuPG-bug-id: 5098 Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit b47c355b18d9537ccc3dd3e80cc1825b018ecff7)
* Replace most of the remaining stdio calls by estream calls.Werner Koch2020-10-2120-197/+208
| | | | | | | | | | | | | -- We need to use es_fopen on Windows to cope with non-ascii file names. This is quite a large but fortunately straightforward change. At a very few places we keep using stdio (for example due to the use of popen). GnuPG-bug-id: 5098 Signed-off-by: Werner Koch <[email protected]> Backported-from-master: 390497ea115e1aca93feec297a5bd6ae7b1ba6dd
* Replace all calls to access by gnupg_accessWerner Koch2020-10-2128-115/+163
| | | | | | | | | | | | | | | | | * common/sysutils.c (gnupg_access): New. Replace all calls to access by this wrapper. * common/homedir.c (w32_shgetfolderpath): Change to return UTF-8 directory name. (standard_homedir): Adjust for change. (w32_commondir, gnupg_cachedir): Ditto. -- Also use SHGetFolderPathW instead of SHGetFolderPathA on Windows. This is required to correctly handle non-ascii filenames on Windows. GnuPG-bug-id: 5098 (cherry picked from commit c94ee1386e0d5cdac51086c4d5b92de59c09c9b5)
* scd: Add a workaround for Yubikey.NIIBE Yutaka2020-10-061-0/+6
| | | | | | | | | | | | | | | * scd/app-openpgp.c (get_public_key): Handle wrong code for Yubikey. -- Backport master commit of: 0db9c83555b4a8a0c52f96e96ec20dbfd3d75272 Yubikey version 5 s/n 609074582 returns 0x6982, version 5.2.4 s/n 610616049 returns 0x6581, where 0x6a88 is expected. Signed-off-by: NIIBE Yutaka <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-17 18:17:21 +0000