aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Release 2.2.26gnupg-2.2.26Werner Koch2020-12-212-2/+27
|
* common: Remove superfluous debug output from dotlock.c.Werner Koch2020-12-211-2/+0
| | | | | | | | | | * common/dotlock.c (dotlock_create_unix): Remove debug output. -- This was left over from developement about 10 years ago. Exhibits itself when using sshfs. GnuPG-bug-id: 5193
* po: Auto-mergeWerner Koch2020-12-2126-3361/+3010
| | | | --
* po: Update German translationWerner Koch2020-12-211-13/+30
| | | | --
* build: Remove the code to build symcryptrunWerner Koch2020-12-213-16/+3
| | | | | | | -- syncryptrun is too ancient to be of any use and has not been tested in many years. Thus we should not allow to build it.
* doc: Explain LDAP keyserver parametersWerner Koch2020-12-211-1/+20
|
* common: Fix the "ignore" meta command in argparse.cWerner Koch2020-12-213-36/+122
| | | | | | | | | | | | | | | | * src/argparse.c (gnupg_argparse): Factor some code out to ... (prepare_arg_return): new. (gnupg_argparse): No missing arg error in ignore sections. * common/sysutils.c: Include pwd.h. (gnupg_getusername): New. -- Options in an [ignore] section do not anymore lead to an error if an argument is missing. However, if the option is also in a force section the error is thrown. This is a port of the fix from libgpg-error. Also fixes the username fixme.
* gpg: Fix --trusted-key with fingerprint arg.Werner Koch2020-12-181-1/+2
| | | | | | | | | * g10/trustdb.c (tdb_register_trusted_key): Take care of that other constant. -- Fixes-commit: 810ea2cc684480c6aadceb2a10dd00f3fa67f2fb Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Do not block threads in LDAP keyserver calls.Werner Koch2020-12-181-6/+38
| | | | | | | | | | | | | | | | | | * dirmngr/ks-engine-ldap.c: Wrap some ldap calls. -- The former gpgkeys_ldap module has once been ported to dirmngr but unfortunately the dirmngr_ldap wrapper has not been used so that we have internal LDAP calls with these problems: - No usable timeouts. - On non-Windows platforms a lot of extra libs and possibly even a second copy of Libgcrypt is pulled in. - Only one threads runs at a time. This patch mitigates the last point. Signed-off-by: Werner Koch <[email protected]>
* Merge branch 'wk/stable-2.2-global-options' into STABLE-BRANCH-2-2Werner Koch2020-12-1825-1397/+2529
|\ | | | | | | --
| * dirmngr: Fix backport of the new option parser from 2.3wk/stable-2.2-global-optionsWerner Koch2020-12-181-0/+5
| | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (main) <aGPGConfList>: Re-introduce gpgconf-dirmngr.conf. -- Fixes-commit: a028f24136a062f55408a5fec84c6d31201b2143
| * Backport of the new option parser from 2.3Werner Koch2020-12-0425-1402/+2529
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * configure.ac (GPGRT_ENABLE_ARGPARSE_MACROS): Define. * common/argparse.c, common/argparse.h: Rewrite. * tests/gpgscm/main.c: Switch to the new option parser. * g10/gpg.c: Switch to the new option parser and enable a global conf file. * g10/gpgv.c: Ditto. * agent/gpg-agent.c: Ditto. * agent/preset-passphrase.c: Ditto. * agent/protect-tool.c: Ditto. * scd/scdaemon.c: Ditto. * dirmngr/dirmngr.c: Ditto. * dirmngr/dirmngr_ldap.c: Ditto * dirmngr/dirmngr-client.c: Ditto. * kbx/kbxutil.c: Ditto. * tools/gpg-card.c: Ditto. * tools/gpg-check-pattern.c: Ditto. * tools/gpg-connect-agent.c: Ditto. * tools/gpg-pair-tool.c: Ditto. * tools/gpg-wks-client.c: Ditto. * tools/gpg-wks-server.c: Ditto. * tools/gpgconf.c: Ditto. * tools/gpgsplit.c: Ditto. * tools/gpgtar.c: Ditto. * g13/g13.c: Ditto. * g13/g13-syshelp.c: Ditto. Do not force verbose mode. * sm/gpgsm.c: Ditto. Add option --no-options. -- This is backport from master commit cdbe10b762f38449b86da69076209324b0c99982 commit ba463128ce65a0f347643f7246a8e097c5be19f1 commit 3bc004decd289810bc1b6ad6fb8f47e45c770ce6 commit 2c823bd878fcdbcc4f6c34993e1d0539d9a6b237 commit 0e8f6e2aa98c212442001036fb5178cd6cd8af59 but without changing all functions names to gpgrt. Instead we use wrapper functions which, when building against old Libgpg-error versions, are implemented in argparse.c using code from the current libgpg-error. This allows to keep the dependency requirement at libgpg-error 1.27 to support older distributions. Tested builds against 1.27 and 1.40-beta. Note that g13-syshelp does not anymore default to --verbose because that can now be enabled in /etc/gnupg/g13-syshelp.conf. GnuPG-bug-id: 4788 Signed-off-by: Werner Koch <[email protected]>
* | gpg: New AKL method "ntds"Werner Koch2020-12-178-6/+90
| | | | | | | | | | | | | | | | | | | | | | * dirmngr/ks-engine-ldap.c (keyspec_to_ldap_filter): Change the new support for KEYDB_SEARCH_MODE_MAIL. (ks_ldap_get): Add a debug. * g10/options.h (AKL_NTDS): New. * g10/keyserver.c (keyserver_import_ntds): New. (keyserver_get_chunk): Allow KEYDB_SEARCH_MODE_MAIL. * g10/getkey.c (parse_auto_key_locate): Support "ntds". (get_pubkey_byname): Ditto.
* | dirmngr: Support "ldap:///" for the current AD user.Werner Koch2020-12-173-16/+55
| | | | | | | | | | | | * dirmngr/http.h (struct parsed_uri_s): Add field ad_current. * dirmngr/ldap-parse-uri.c (ldap_parse_uri): Set it. * dirmngr/ks-engine-ldap.c (my_ldap_connect): Take care of ad_current.
* | dirmngr: Allow LDAP searches via fingerprint.Werner Koch2020-12-171-22/+40
| | | | | | | | | | | | | | | | | | * dirmngr/ks-engine-ldap.c (keyspec_to_ldap_filter): Add arg serverinfo and allow searching by fingerprint. (ks_ldap_get, ks_ldap_search): First connect then create teh filter. -- With the new schema we can finally search by fingerprint.
* | dirmngr: Store all version 2 schema attributes.Werner Koch2020-12-172-44/+87
| | | | | | | | | | | | | | | | | | | | | | | | * g10/call-dirmngr.c (ks_put_inq_cb): Emit "fpr" records. * dirmngr/ks-engine-ldap.c (extract_attributes): Add args extract-state and schemav2. Add data for the new schema version. remove the legacy code to handle UIDs in the "pub" line. (ks_ldap_put): Set new attributes for NTDS use the fingerprint as CN. Signed-off-by: Werner Koch <[email protected]> This is a backport from 2.3
* | dirmngr: Support the new Active Directory schemaWerner Koch2020-12-171-106/+141
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/ks-engine-ldap.c (SERVERINFO_): New constants. (my_ldap_connect): Relace args pgpkeyattrp and real_ldapp by a new serverinfo arg. Set the new info flags. (ks_ldap_get): Adjust for change. (ks_ldap_search): Ditto. (ks_ldap_put): Ditto. Replace xmalloc by xtrymalloc. Change the DN for use with NTDS (aka Active Directory). -- This is a first take on better Active Directory support. The main change for NTDS in the code is that the an top-RDN of CN is used instead of the old pgpCertID. More changes to come; for example using and storing the fingerprint. Signed-off-by: Werner Koch <[email protected]> This is a backport from 2.3 without the new schema samples - they can be found in the repo. Signed-off-by: Werner Koch <[email protected]>
* | dirmngr: Do not store the useless pgpSignerID in the LDAP.Werner Koch2020-12-174-25/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/ks-engine-ldap.c (extract_attributes): Do not store the pgpSignerID. * g10/call-dirmngr.c (ks_put_inq_cb): Do not emit sig records. -- The pgpSignerID has no use in the LDAP and thus don't store it. David's idea back in 2004 was /* This bit is really for the benefit of people who store their keys in LDAP servers. It makes it easy to do queries for things like "all keys signed by Isabella". */ See-commit: 3ddd4410aef928827e1c8d4fb02c1ccd3f8eaea5 I consider this dangerous because such a query is not able to validate the signature, does not get revocation signatures, and also has no information about the validity of the signatures. Further many keys are spammed tehse days with faked signatures and it does not make sense to blow up the LDAP with such garbage. Signed-off-by: Werner Koch <[email protected]>
* | dirmngr: Fix adding keys to an LDAP server.Werner Koch2020-12-171-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/ks-engine-ldap.c (ks_ldap_put): Extract attribites into addlist. -- The code used the wrong list which resulting in adding attributes marked for deletion. In particular Active Directory does not accept such an data and rejects them. The bug was introduced into 2.1 while porting the code from the old keyserver helpers to dirmngr. Fixes-commit: 51341badb623927f2a358588c725a356fc77dbe7 Signed-off-by: Werner Koch <[email protected]>
* | scd:ccid: Call libusb_clear_halt in ccid_vendor_specific_setup.NIIBE Yutaka2020-12-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | * scd/ccid-driver.c (ccid_vendor_specific_setup): Only for SPR532, call libusb_clear_halt. -- Backport master commit of: f50373027222f28ab9d37843178a5d44cc1e3cc0 GnuPG-bug-id: 5167 Signed-off-by: NIIBE Yutaka <[email protected]>
* | scd:ccid: Revert the addition of libusb_clear_halt for EP_INTR.NIIBE Yutaka2020-12-161-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | * scd/ccid-driver.c (ccid_setup_intr): Don't call libusb_clear_halt. -- Backport master commit of: ffabc29d5eadfe81b9f62b7d4fe6e858b191354d GnuPG-bug-id: 5167 Signed-off-by: NIIBE Yutaka <[email protected]>
* | scd:openpgp: Fix writing ECC key to card.NIIBE Yutaka2020-12-071-6/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (build_privkey_template): Adding another argument of ecc_d_fixed_len to handle variable-size MPI. -- Backport from master commit of: a25c99b156ca9acaa7712e9c09a6df0a7a23c833 GnuPG-bug-id: 5163 Signed-off-by: NIIBE Yutaka <[email protected]>
* | kbx: Better error message in case of a crippled Libgcrypt.Werner Koch2020-12-021-2/+10
| | | | | | | | * kbx/keybox-openpgp.c (keygrip_from_keyparm): Detect missing curve.
* | doc: Add parameters for batch generation of ECC keys.Jens Meißner2020-12-011-0/+8
|/ | | | | | | | | | | * doc/gpg.texi: Add parameters for batch generation of ECC keys. -- There are parameters required for batch generation of ECC keys which weren't mentioned in the documentation. Signed-off-by: Jens Meißner <[email protected]>
* common: Fix fallback handling to utf-8.NIIBE Yutaka2020-11-271-1/+1
| | | | | | | | | | | * common/utf8conv.c (handle_iconv_error): Set NO_TRANSLATION. -- GnuPG-bug-id: 5038 Fixes-commit: 99c9bf7defd6c1ac9cc49c84e6c78eeb886a6952 Signed-off-by: NIIBE Yutaka <[email protected]> (cherry picked from commit 393dcdd61c3b2da00a97176c647d9bd1c908ceba)
* Post release updatesWerner Koch2020-11-232-1/+7
| | | | --
* Release 2.2.25gnupg-2.2.25Werner Koch2020-11-231-2/+8
|
* doc: Fix typosGavin L. Rebeiro2020-11-234-7/+7
| | | | | | | | | -- GnuPG-bug-id: 5071 Also fixed one in keyformat.txt [wk]. (cherry picked from commit 572bcacc287d24d0a2cc56442f9fb6a9ac49e12d)
* gpgconf: Also print revision of libksba.Werner Koch2020-11-191-3/+4
| | | | | | | | | | | | | * dirmngr/dirmngr.c (get_revision_from_blurb): Fix detection of empty string. (gpgconf_versions): Print ksba revision. -- The latest Libksba version support retrieving of the revision (commit) id. We now use that or print a question mark. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 4070f302e4decc8d54d1305cbd30f6dab052ef7e)
* po: Update Polish translationJakub Bogusz2020-11-191-31/+21
|
* scd:openpgp: Public keys should be available for check_keyidstr.NIIBE Yutaka2020-11-191-0/+5
| | | | | | | | | | * scd/app-openpgp.c (check_keyidstr): Call get_public_key. -- GnuPG-bug-id: 5065 Fixes-commit: 1049f06c6d2e1a833af4c73ea67a05417bbd0967 Signed-off-by: NIIBE Yutaka <[email protected]>
* Post release updatesWerner Koch2020-11-172-1/+8
| | | | --
* Release 2.2.24gnupg-2.2.24Werner Koch2020-11-171-1/+5
|
* po: Auto updateWerner Koch2020-11-1625-296/+552
| | | | --
* scd:openpgp: Drop support for GnuPG 1.Werner Koch2020-11-161-36/+1
| | | | | | | | | | -- It does not make sense to keep support form GnuPG 1 here given that we don't intend to ever backport any of the current stuff to the legacy version. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Allow keygrip to be used to reference a keyWerner Koch2020-11-161-141/+129
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): Add keygrip_str. (store_keygrip): New. (read_public_key): Store the keygrip. (get_public_key): Sitto. (send_keypair_info): USe the stored keygrip. (check_keyidstr): New. Factored out from other functions and extended. (do_sign): Use check_keyidstr. (do_auth): Ditto. (do_decipher): Ditto. (do_check_pin): Ditto. -- This code is a backport of commits: b0f0791e4ade845b2a0e2a94dbda4f3bf1ceb039 cd: Factor out a function to check keyidstr. 4c4999b8185ace55eb5f3a6fa7d3dc0a77267b63 scd:openpgp: Allow PKSIGN with keygrip also for OPENPGP.3. e769609cd3c12d2e26955538399172016f78d2d4 scd: Allow KEYGRIP as KEYIDSTR. Co-authored-by: NIIBE Yutaka <[email protected]> Signed-off-by: Werner Koch <[email protected]>
* gpg: Provide better diagnostic for replaced card keys.Werner Koch2020-11-137-5/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/divert-scd.c (divert_pksign): Add arg 'grip'. Replace OPENPGP key reference to keygrips. (divert_pkdecrypt): Ditto. * agent/protect.c (parse_shadow_info): Trim spaces. * agent/pkdecrypt.c (agent_pkdecrypt): Pass the keygrip. * agent/pksign.c (agent_pksign_do): Ditto. * g10/mainproc.c (print_pkenc_list): Print extra info for an invalid id error. * g10/sign.c (do_sign): Ditto. -- Using the keygrip instead of the identifier works on OpenPGP cards and thus we use that to make sure that we are working on the right card. For other cards we better don't do that to avoid regressions. Those other cards are also usually provided and do not allow to self-generate the keys. Note that old versions of the code (gpg 1.4) used the fingerprint as additional check but that was eventually removed and now that we use the keygrip all over the place, it is best to use this to identify a key. Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix the encrypt+sign hash algo preference selection for ECDSA.Werner Koch2020-11-133-38/+58
| | | | | | | | | | | | | | | | | * g10/keydb.h (pref_hint): Change from union to struct and add field 'exact'. Adjust callers. * g10/pkclist.c (algo_available): Take care of the exact hint. * g10/sign.c (sign_file): Fix indentation. Rework the hash from recipient prefs. -- This fixes a encrypt+sign case like: One recipient key has SHA512 as highest ranked hash preference but the the signing key is a 256 bit curve. Because we don't want to use a truncated hash with ECDSA, we need to have an exact match - this is in particular important for smartcard which check that the hash matches the curves. Signed-off-by: Werner Koch <[email protected]>
* gpgconf: Yet another fix for --apply-profile.Werner Koch2020-11-121-4/+4
| | | | | | | | | * tools/gpgconf.c (main): Use gnupg_homedir instead of default_homedir. Check for existance of the directory. -- Fixes-commit: 1fbf085bc8b4a92772d1da8bfea507f4f97434b1 Signed-off-by: Werner Koch <[email protected]>
* scd: Skip unknown options in command SERIALNOWerner Koch2020-11-121-0/+2
| | | | | | | | | | | | * scd/command.c (cmd_serialno): Skip options. -- SERIALNO --all works only in 2.3 and thus naive use with 2.2 vesions would conserer "--all" as the reqyested applications. Fix is easy and should be done anyway. Signed-off-by: Werner Koch <[email protected]>
* po: Update Japanese Translations.NIIBE Yutaka2020-11-121-15/+22
| | | | | | -- Signed-off-by: NIIBE Yutaka <[email protected]>
* po: Update the German translationWerner Koch2020-11-111-13/+21
| | | | --
* gpg: Support brainpool keygen with "key from card".Werner Koch2020-11-111-0/+4
| | | | | | | * g10/keygen.c (ask_algo): Add brainpool hack in the same as for Nist curves. Signed-off-by: Werner Koch <[email protected]>
* scd: Do not print reader status change with --debug cardio.Werner Koch2020-11-111-1/+1
| | | | | | | | -- ... but use --debug reader for this. Signed-off-by: Werner Koch <[email protected]>
* w32: Revert use of one gnupg_fopen in a test toolWerner Koch2020-11-101-1/+1
| | | | --
* w32: Support Unicode also for config files etc.Werner Koch2020-11-1020-25/+76
| | | | | | | | | | | | | | * common/sysutils.c (gnupg_fopen) [W32]: Use _wfopen if needed. Use new function in most places where fopen is used. -- The config files in 2.2 are still read using fopen - we need to change this to allow Unicode directory names. There is also one case where files are written using the old fopen. The new option parser in 2.3 does not have this problem but at some places fopen is also still used. GnuPG-bug-id: 5098 Signed-off-by: Werner Koch <[email protected]>
* w32: Support utf8 for getcwd even if build with gpgrt < 1.40.Werner Koch2020-11-101-8/+28
| | | | | | | | | | | * common/sysutils.c (gnupg_getcwd) [W32]: Use Unicode version. -- gpgrt 1.40 has not yet been released, so to make getcwd work properly on Windows we need to have the code here as well. GnuPG-bug-id: 5098 Signed-off-by: Werner Koch <[email protected]>
* Prepare NEWS for the next release.Werner Koch2020-11-091-1/+53
| | | | --
* scd: Internal CCID driver: Fix a race condition on close.NIIBE Yutaka2020-11-091-12/+25
| | | | | | | | | | | | | | | | | | | | | | * scd/ccid-driver.c (ccid_require_get_status): For VENDOR_SCM reader, return 0 only at the initial call. (bulk_in): Don't detect an error for VENDOR_SCM reader, just kicking the loop, to invoke scd_update_reader_status_file, which calls ccid_slot_status again. (ccid_slot_status): Move the call of ccid_vendor_specific_setup to... (ccid_get_atr): ... here. -- For readers with interrupt transfer support, it is only intr_cb which sets handle->powered_off to 1. Keeping this condition makes no race. The function ccid_slot_status can also detect a communication error, which causes apdu_close_reader (but not setting ->powered_off). GnuPG-bug-id: 5121 Fixes-commit: 920f258eb6018ecec1d63bad6a0fb0772f72affa Signed-off-by: NIIBE Yutaka <[email protected]> (cherry picked from commit 484bafda4dbf5ffe9e7c41ef24fbc5bd791a3b32)
* card: Run factory-reset in locked stated.Werner Koch2020-11-094-17/+58
| | | | | | | | | | | | | | | | * scd/command.c (reset_notify): Add option --keep-lock. (do_reset): Add arg keep_lock. (cmd_lock): Send progress status. * g10/call-agent.c (agent_scd_apdu): Add more pseudo APDUs. * g10/card-util.c (send_apdu): Ditto. (factory_reset): Use lock commands. -- This is required so that for example Kleopatra does not detect the RESET and issues a SERIALNO of its own, thus conflicting with our SERIALNO undefined. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-18 05:21:25 +0000