aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* scd: Enable card removal check after select_application.NIIBE Yutaka2017-11-214-12/+18
| | | | | | | | | | | | | | | | | | | | | | * scd/apdu.c (open_ccid_reader): Fix error handling of ccid_get_atr. * scd/app.c (select_application): Always kick the loop if new APP. * scd/ccid-driver.c (ccid_open_usb_reader): Don't setup at open. (ccid_slot_status): Setup interrupt transfer when !ON_WIRE. -- We can use the interrupt transfer to be notified about card status change. In this case, we don't need to issue PC_to_RDR_GetSlotStatus command. This change improve the setup the notification; it should be done after registration of APP. When the setup is done just after opening the USB connection (before issuing PC_to_RDR_IccPowerOn), a reader might notifies about no card availability (because of not yet powered on), even though the card is ready to be powered on. GnuPG-bug-id: 3508 Signed-off-by: NIIBE Yutaka <[email protected]>
* Post release updatesWerner Koch2017-11-202-1/+5
| | | | --
* Release 2.2.3gnupg-2.2.3Werner Koch2017-11-202-9/+26
|
* build: Use -Werror only for the check.Werner Koch2017-11-201-1/+1
| | | | | | | | | | | | * configure.ac: Do not add -Werror to mycflags. -- On Windows and possible also on other platforms we expect to a get a few errors or warnins. Thus we can't use -Werror by default. This is why we have a separate configure options --enable-werror ;-). Fixes-commit: 3ecd1a41be7c880976987d13e88342c98f37e064 Signed-off-by: Werner Koch <[email protected]>
* gpg-agent: Avoid getting stuck in shutdown pending state.Werner Koch2017-11-201-15/+22
| | | | | | | | | | | | | | | | | | | | | | | | * agent/gpg-agent.c (handle_connections): Always check inotify fds. -- I noticed a gpg-agent processed, probably in shutdown_pending state, which was selecting on only these two inotify fds. The select returned immediately but because we did not handle the fds in shutdown_pending state they were not read and the next select call returned one of them immediately again. Actually that should not hanppen because the if (active_connections == 0) break; /* ready */ should have terminated the loop. For unknown reasons (maybe be just a connection thread terminated in a gdb session) that did not happen. By moving the check outside of the shutdown_pending condition and closing the fd after they have been triggered the code should be more robust. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 5d83eb9226c0ce608ec284d8c9bc22ce84a00c25)
* agent: Use clock or clock_gettime for calibration.NIIBE Yutaka2017-11-202-6/+10
| | | | | | | | | | | | | | | | | | * agent/protect.c (calibrate_get_time): Use clock or clock_gettime. -- For calibration, clock(3) is better than times(3) among UNIXen. Tested on NetBSD 7.1 and FreeBSD 11.1, using QEMU. Thanks to Damien Goutte-Gattat for the information of use of CLOCKS_PER_SEC; The old code with times(3) is not 100% correct, in terms of POSIX. It should have used sysconf (_SC_CLK_TCK) instead of CLOCKS_PER_SEC. CLOCKS_PER_SEC is specifically for clock(3). GnuPG-bug-id: 3056, 3276, 3472 Signed-off-by: NIIBE Yutaka <[email protected]> (cherry picked from commit 380bce13d94ff03c96e39ac1d834f382c5c730a1)
* build: Check -Wlogical-op flag availability with -Werror.NIIBE Yutaka2017-11-201-3/+11
| | | | | | | | | | * configure.ac: Use -Werror. -- Using clang, -Wlogical-op doesn't fail but generates warning. Signed-off-by: NIIBE Yutaka <[email protected]>
* build: BSD make support for yat2m.NIIBE Yutaka2017-11-202-3/+12
| | | | | | | | | | | | * configure.ac (YAT2M): Only define when found. * doc/Makefile.am: Portability fix. -- This is not intended to apply to master, but 2.2 branch only. When new libgpg-error is required, installation of yat2m can be assumed. Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Fix double free of a hash context in the error case.Werner Koch2017-11-171-6/+6
| | | | | | | | | | | | * dirmngr/crlcache.c: Clearly document that this fucntions takes ownership of MD. (abort_sig_check): Allow NULL for MD. (crl_parse_insert): Immediately set MD to NULL. Remove check for md before a calling abort_sig_check. -- GnuPG-bug-id: 3510 Signed-off-by: Werner Koch <[email protected]>
* w32: Fix default registry pathAndre Heinecke2017-11-151-1/+1
| | | | | | | | | | | | | * configure.ac (GNUPG_REGISTRY_DIR): Remove leading backslash. -- Windows does not like the leading backslash and won't read the key. Problem reported in the Gpg4win Message boards. This bug was introduced by rev. 75ba215e Signed-off-by: Andre Heinecke <[email protected]>
* doc: Add man page for gpgtarWerner Koch2017-11-152-38/+102
| | | | | | | | | -- This also removes the documentation for gpg-zip which is not distributed anymore. Signed-off-by: Werner Koch <[email protected]>
* gpgtar: Prefer --set-filename over implicit nameAndre Heinecke2017-11-151-6/+6
| | | | | | | | | | | | | * tools/gpgtar-extract.c: Prefer opt.filename over filename for the directory prefix. -- If you would extract from stdin (filename -) and use set-filename to provide a real filename the "-" would be used for the directory name. With this change an explicit filename is prefered. GnuPG-Bug-Id: T3500 Signed-off-by: Andre Heinecke <[email protected]>
* doc: fix NEWSIG documentationWill Thompson2017-11-151-3/+2
| | | | | | | | | -- 08c82b1 introduced one optional argument for this status message. Due to an apparent editing error, the sentence fragment "arguments are currently defined." was left in the documentation. Signed-off-by: Will Thompson <[email protected]>
* doc: expand documentation of PROGRESS messageWill Thompson2017-11-151-4/+7
| | | | | | | | -- This answers two questions that I was only able to answer by examining each site where PROGRESS messages are emitted, and fixes a typo. Signed-off-by: Will Thompson <[email protected]>
* gpg: Print AKL info only in verbose mode.Werner Koch2017-11-151-2/+3
| | | | | | | | * g10/getkey.c (get_pubkey_byname): Print info only in verbose mode. -- GnuPG-bug-id: 3504 Signed-off-by: Werner Koch <[email protected]>
* sm, w32: Fix initial keybox creationAndre Heinecke2017-11-141-1/+1
| | | | | | | | | | * sm/keydb.c (maybe_create_keybox): Open new keybox in bin mode. -- As the header contains a timestamp we will have the conversion problems if the keybox is not opened in binary mode. Signed-off-by: Andre Heinecke <[email protected]>
* po/da: Fix Danish confusion between "compressed" and "compromised"Daniel Kahn Gillmor2017-11-111-1/+1
| | | | | | | | | | | | | -- In https://bugs.debian.org/881393 , Jonas Smedegaard reports: > In option number 1, the word "komprimeret" means "compressed". > > I am pretty sure it should say "kompromitteret" instead, which means > "compromised". Debian-Bug-Id: 881393 Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* Post release updates.Werner Koch2017-11-072-1/+5
| | | | --
* Release 2.2.2gnupg-2.2.2Werner Koch2017-11-073-174/+47
| | | | Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Reduce default LDAP timeout to 15 seconds.Werner Koch2017-11-073-3/+3
| | | | | | | | | * dirmngr/dirmngr.c (DEFAULT_LDAP_TIMEOUT): Change to 15. * dirmngr/dirmngr_ldap.c (DEFAULT_LDAP_TIMEOUT): Ditto. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit ab7ac827041b5cd97bbca7a75b0930072dd6611f) GnuPG-bug-id: 3487
* speedo: Include software versions in the W32 READMEWerner Koch2017-11-073-39/+295
| | | | | Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit f9f72ffbfa9fd7d1a7a1823697d116d76155b407)
* po: Update Russian translationIneiev2017-11-071-11/+11
|
* po: Update Japanese translationNIIBE Yutaka2017-11-071-5/+3
|
* agent: New GETINFO sub-commands "s2k_count_cal" and "s2k_time".Werner Koch2017-11-064-24/+69
| | | | | | | | | | * agent/command.c (cmd_getinfo): New sub-commands. * agent/protect.c (get_standard_s2k_count): Factor some code out to ... (get_calibrated_s2k_count): new. (get_standard_s2k_time): New. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 52d41c8b0f4af6278d18d8935399ddad16a26856)
* agent: New option --s2k-count.Werner Koch2017-11-064-0/+30
| | | | | | | | | | | | | | | * agent/agent.h (opt): New field 's2k_count'. * agent/gpg-agent.c (oS2KCount): New enum value. (opts): New option --s2k-count. (parse_rereadable_options): Set opt.s2k_count. -- This option is useful to speed up the starting of gpg-agent and in cases where the auto-calibration runs into problems due to a broken time measurement facility. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit f7212f1d11aad5d910d2c77b2e5c6ab31a0e786e)
* g10: Unattended key generation "Key-Grip" and "Subkey-Grip".NIIBE Yutaka2017-11-061-9/+16
| | | | | | | | | | | | | | | * g10/keygen.c (pSUBKEYGRIP): New. (read_parameter_file): Add "Key-Grip" and "Subkey-Grip". (do_generate_keypair): Support pSUBKEYGRIP. -- In the manual, it says "Key-Grip". gpgsm also supports "Key-Grip". Adding "Subkey-Grip" now, adding "Key-Grip" makes sense. GnuPG-bug-id: 3478 Signed-off-by: NIIBE Yutaka <[email protected]> (cherry picked from commit 6c63a04569c07c9c2817c7c530a92ccfa58155cc)
* g10: Simplify "factory-reset" procedure.NIIBE Yutaka2017-11-061-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | * g10/card-util.c (factory_reset): Simplify. -- In this summer, I got report about old code before this change didn't work with newer Yubikey. I got another report test version of OpenPGP card V3.3 implementation didn't work, either. Then, I confirmed that according to the OpenPGP card specification, the procedure of old code is not expected by its author. This change simplify "factory-reset" as simple. Only versions of Gnuk 1.2.2, 1.2.3, 1.2.4, won't work with this change. That's because the factory-reset feature of Gnuk was introduced by reading the implementation of GnuPG, instead of reading the specification. Gnuk 1.2.5 and later works well. All OpenPGPcard implementations I have work well (2.0, 2.1, 2.2, test version of 3). GnuPG-bug-id: 3286 Signed-off-by: NIIBE Yutaka <[email protected]> (cherry picked from commit d63b7966cdd72548c60466c620de5cd6104a779e)
* po: Update Russian translationIneiev2017-11-021-103/+100
|
* po: Fixed one string wrongly marked as fuzzy.Werner Koch2017-11-0225-235/+455
| | | | | | | | | | -- These seems to a a small gettext bug which claimed that "NOTE: There is no guarantee that the card supports[...]" was changed. Also committed changes due to msgmerge. Signed-off-by: Werner Koch <[email protected]>
* po: Update German translationWerner Koch2017-11-021-11/+16
| | | | --
* gpg: Introduce magic value 25519 to switch a card to ECC.Werner Koch2017-11-021-21/+54
| | | | | | | | | | | | | | | * g10/card-util.c (ask_card_keyattr): Handle special value 25519. (do_change_keyattr): Allow changing to cv25519/ed25519. (generate_card_keys): Ditto. (card_generate_subkey): Ditto. -- This is kludge to make it easier for gnuk to be switched into ECC mode. This is basically the same change as commit ea09b6cded9d31a8ebd91878553c3eaa2b76e817 but without the string change in show_keysize_warning. Signed-off-by: Werner Koch <[email protected]>
* gpg: Rename two card related functions in card-util.Werner Koch2017-11-021-6/+6
| | | | | | | | | | | | * g10/card-util.c (ask_card_rsa_keysize): Rename to ask_card_keyattr. (do_change_rsa_keysize): Rename to do_change_keyattr. -- We want to support other algos than RSA and thus we need a better name for the functions. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit f795f4529d8ab5a05db1cc1960abd34390bfae1b)
* agent: Fix returning GPG_ERR_NOT_FOUND wrongly.NIIBE Yutaka2017-11-021-7/+5
| | | | | | | | | | | | * agent/learncard.c (agent_handle_learn): Find SERIALNO. -- Bug is: "gpg-connect-agent learn /bye" just fails wrongly. Fixes-commit: 8c8ce8711d9c938fcb982b0341e6b052742cb887 Signed-off-by: NIIBE Yutaka <[email protected]> (cherry picked from commit 5e96fe72e477d09e35ccee48af0fd9ab2b3ae409)
* common: Accept the Z-suffix for yymmddThhmmssZ format.NIIBE Yutaka2017-11-011-3/+6
| | | | | | | | | | | | * common/gettime.c (isotime_p): Accept the Z suffix. -- The intention is use for human interface. GnuPG-bug-id: 3278 Signed-off-by: NIIBE Yutaka <[email protected]> (cherry picked from commit ba8afc4966cca1f6aaf9b2a9bfc3220782306c2b)
* agent: Clean up pinentry access locking.NIIBE Yutaka2017-10-272-67/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/agent.h (struct server_control_s): Rename PINENTRY_ACTIVE. * agent/call-pinentry.c (entry_owner): Remove. (agent_reset_query): Use thread private object of PINENTRY_ACTIVE. (unlock_pinentry): Add CTRL to arguments to access thread private. Check and decrement PINENTRY_ACTIVE for recursive use. (start_pinentry): Check and increment PINENTRY_ACTIVE for recursion. (agent_askpin): Follow the change of unlock_pinentry API. (agent_get_passphrase, agent_get_confirmation): Likewise. (agent_show_message, agent_popup_message_start): Likewise. (agent_popup_message_stop, agent_clear_passphrase): Likewise. -- We use the member PINENTRY_ACTIVE as a thread private object. It's only valid for a single thread at a time. It would be possible to have a thread shared object of PINENTRY_ACTIVE, keeping ENTRY_OWNER for distinguishing its owner (which is also a thread shared object). But, in this case, access to ENTRY_OWNER is tricky (only comparison to accessing thread would be OK with no lock), or we need to introduce another lock for accessing ENTRY_OWNER, which complicates the code too much. So, simply have a thread private object for recursive pinentry access. GnuPG-bug-id: 3190 Signed-off-by: NIIBE Yutaka <[email protected]> (cherry picked from commit fb7828676cc2c01047498898378711e049f73fee)
* agent: Allow recursive use of pinentry.NIIBE Yutaka2017-10-272-11/+26
| | | | | | | | | | | | | | * agent/agent.h (struct server_control_s): Add pinentry_level. * agent/call-pinentry.c (agent_popup_message_stop): Not clear ENTRY_CTX here. (unlock_pinentry): Handle recursion. Clear ENTRY_CTX here. (start_pinentry): Allow recursive use. -- GnuPG-bug-id: 3190 Signed-off-by: NIIBE Yutaka <[email protected]> (cherry picked from commit 3b66a256e3760e88066ca11b7b49d924e42aa46b)
* agent, tests: Support --disable-scdaemon build case.NIIBE Yutaka2017-10-263-5/+12
| | | | | | | | | | | | | | | * agent/command.c (cmd_scd): Support !BUILD_WITH_SCDAEMON. * tests/openpgp/defs.scm (create-gpghome): Likewise. * tests/gpgsm/gpgsm-defs.scm (create-gpgsmhome): Likewise. -- We could modify gpg-agent to remove all support of scdaemon, with no inclusion of call-scd.c, divert-scd.c, and learncard.c, but it would not be worth to do that. GnuPG-bug-id: 3316 Signed-off-by: NIIBE Yutaka <[email protected]>
* Fix comment of configure.NIIBE Yutaka2017-10-261-1/+1
| | | | | | * configure.ac (BUILD_WITH_DIRMNGR): Comment fix. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Avoid superfluous sig check info during import.Werner Koch2017-10-241-47/+96
| | | | | | | | | | | | | | * g10/key-check.c (print_info): New. (key_check_all_keysigs): Print sig checking results only in debug mode. Prettify the stats info and suppress them in quiet mode. -- This also makes usable stats by prefixing them with the key and the program name. GnuPG-bug-id: 3397 Signed-off-by: Werner Koch <[email protected]>
* build: New configure option --enable-werrorWerner Koch2017-10-241-0/+11
| | | | | | | | | | * configure.ac: Implement that option. -- This can be used as a workaround in case of bogus autoconf tests. GnuPG-bug-id: 2423 Signed-off-by: Werner Koch <[email protected]>
* build: Do not mess with CFLAGS in configure.Werner Koch2017-10-241-11/+0
| | | | | | | | | | | | | | | | | | | | | * configure.ac: Do not mess with the user provided CFLAGS. -- A problem was claimed with some configure tests if the user provided CFLAGS=-Werror. The commit introducing this Fixes-commit: 02eb9fc9d5863abcfed6af704e618f8cac7cc2e8 does not mention a concrete case. Anyway, messing with CFLAGS is a bad idea because configure tests will then test something different than what is used later (cf. autoconf manual). Tests which depend on the whether -Werror is used needsto be fixed. Note that in certain cases we modify CFLAGS. This is only done for some configure options or if the platform requires the use of special compiler flags (e.g. on HP/UX). GnuPG-bug-id: 2423
* sm: Do not expect X.509 keyids to be uniqueRainer Perske2017-10-245-6/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * sm/certlist.c (gpgsm_find_cert): Add arg allow_ambiguous and use it. * sm/call-dirmngr.c (inq_certificate): Pass true to ALLOW_AMBIGUOUS (run_command_inq_cb): Ditto. * sm/gpgsm.c (main): Pass false. * sm/server.c (cmd_passwd): Pass false. -- As described in my report T1644, it is possible that multiple certificates exist with the same Distinguished Name and the same key. In this case, verifying S/MIME signatures and other actions fail with "certificate not found: Ambiguous name". For details see the bug report. To circumvent the problem, I am patching GnuPG since 2014 so that in this case the newest of the ambiguous certificates is used. This is not an ultimate solution of the problem: You should try every certificate with the same DN until verification succeeds or until all certificates fail, and if multiple certificates of a chain are ambiguous you even have to check every combination. You may even consider checking the keyUsage attributes of the ambiguous certificates to reduce the number of combinations. But in the existing case of the certificates in the German Research Network (DFN) PKI where the newest one is the valid one and all ambiguous certificates have the same keyUsage attributes, this patch has proven to be sufficient over the last three years. With every GnuPG update, I have adapted the patch, luckily I never needed to change anything except line numbers. GnuPG-bug-id: 1644 ChangeLog log written by wk, comment taken from mail. Signed-off line was missing in the plain diff. However the mail with the patch and the DCO posted as reply to that mail were both signed. Signed-off-by: Werner Koch <[email protected]>
* gpgconf: Ignore non-installed components with --apply-profile.Werner Koch2017-10-241-4/+13
| | | | | | | | | | | | | | * tools/gpgconf-comp.c (retrieve_options_from_program): Add arg only_installed. (gc_component_retrieve_options): Use this if we want to process all components. -- Note that this also also ignores them in --with-defaults. This is useful for systems which come without scdaemon. GnuPG-bug-id: 3313 Signed-off-by: Werner Koch <[email protected]>
* gpg: Improve the "secret key available" notice in keyedit.cWerner Koch2017-10-241-10/+26
| | | | | | | | | | | | | | | | * g10/keyedit.c (KEYEDIT_NEED_SUBSK): New. (cmds): Add this flag to keytocard, bkuptocard, expire, and passwd. (keyedit_menu): Check whether only subkeys are available and take care of that in the command check and in the HELP listing. Also print a different notice if only subkeys are available. -- Print "Secret key is available" and the bailing out in all commands which require the _primary_ secret key was surprising. Now we print another notice and adjust the checks. GnuPG-bug-id: 3463 Signed-off-by: Werner Koch <[email protected]>
* gpg: Remove unused flags from keyedit.c.Werner Koch2017-10-241-39/+35
| | | | | | | | | | | * g10/keyedit.c (KEYEDIT_NOT_SK, KEYEDIT_ONLY_SK): Remove. (cmds): Remove them. -- These flags were cruft from the time we had to switch between secret and public key view. Signed-off-by: Werner Koch <[email protected]>
* doc: Fix "SEE ALSO" section of gpgv.Werner Koch2017-10-201-1/+1
| | | | --
* gpg: Fix creating on-disk subkey with on-card primary key.Werner Koch2017-10-191-0/+3
| | | | | | | | | | | | | | | | * g10/keygen.c (generate_subkeypair): Ignore error code issued for trying to verify a card based key. -- We try to verify the primary key and thus seed the passphrase cache before generating the subkey. However, the verification does not yet work for on-card keys and thus the PASSWD --verify send to the agent returns an error. This patch detects this error and continues without a seeded passphrase cache. After all that pre-seeding is just a convenience. GnuPG-bug-id: 3280 Signed-off-by: Werner Koch <[email protected]>
* gpg: Print sec/sbb with --import-option import-show or show-only.Werner Koch2017-10-192-2/+3
| | | | | | | | | | | | | * g10/import.c (import_one): Pass FROM_SK to list_keyblock_direct. -- Note that this will likely add the suffix '#' top "sec" because the secret key has not yet (or will not be) imported. If the secret key already exists locally another suffix might be printed. The upshot is that the suffix has no usefulness. GnuPG-bug-id: 3431 Signed-off-by: Werner Koch <[email protected]>
* gpg: Make --dry-run and show-only work for secret keys.Werner Koch2017-10-191-1/+2
| | | | | | | | | | | | | * g10/import.c (import_secret_one): Check for dry-run before transferring keys. -- The use of --dry-run or --import-option show-only had no effect when importing a secret key and the public key already existed. If the public key did not exist an error message inhibited the import of the secret key. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Do not follow https-to-http redirects.Damien Goutte-Gattat2017-10-191-4/+6
| | | | | | | | | * dirmngr/ks-engine-http.c (ks_http_fetch): Forbid redirects from a https URI to a http URI. -- GnuPG-bug-id: 3436 Signed-off-by: Damien Goutte-Gattat <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-13 22:17:27 +0000