aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tests: Speed up the genkey1024.test by using not so strong random.Werner Koch2014-10-308-17/+72
| | | | | | | | | | | | | * agent/gpg-agent.c (oDebugQuickRandom): New. (opts): New option --debug-quick-random. (main): Use new option. * common/asshelp.c (start_new_gpg_agent): Add hack to pass an additional argument for the agent name. * tests/openpgp/defs.inc: Pass --debug-quick-random to the gpg-agent starting parameters. * tests/openpgp/version.test: Ditto. Signed-off-by: Werner Koch <[email protected]>
* po: Add a new German translationWerner Koch2014-10-292-2/+9
| | | | | -- Also fixed a typo in the docs.
* common: Check option arguments for a valid range.Werner Koch2014-10-292-8/+46
| | | | | | | | | * common/argparse.h (ARGPARSE_INVALID_ARG): New. * common/argparse.c: Include limits h and errno.h. (initialize): Add error strings for new error constant. (set_opt_arg): Add range checking. Signed-off-by: Werner Koch <[email protected]>
* Fix stdint.h problem for Apple.Werner Koch2014-10-291-0/+7
| | | | | | | * gl/stdint_.h [__APPLE__]: Include hack. -- Patch suggested by Patrick Brunschwig.
* speedo: Fixes for native build.Werner Koch2014-10-271-2/+24
| | | | | | * build-aux/speedo.mk (TARGETOS): Init with empty string. (speedo_pkg_gnupg_configure): Use --enable-gpg2-is-gpg only for w32. (INST_VERSION, INST_PROD_VERSION): Create only for w32.
* po: Fixed one wrong German string.Werner Koch2014-10-271-2/+2
| | | | --
* doc: Re-formated some NEWS entries and added update notes to some.Werner Koch2014-10-261-91/+95
| | | | --
* Update NEWS.gnupg-2.1.0-beta895Werner Koch2014-10-261-0/+8
| | | | --
* po: Auto updateWerner Koch2014-10-263-12/+33
| | | | --
* po: Translate new string to German.Werner Koch2014-10-261-6/+9
| | | | --
* agent: Support pinentries with integrated repeat passphrase feature.Werner Koch2014-10-244-19/+52
| | | | | | | | | | | | | | | | | | | | | | | | | | * agent/agent.h (struct pin_entry_info_s): Add fields repeat_okay and with_repeat. * agent/call-pinentry.c (close_button_status_cb): Rewrite and check for PIN_REPEAT. Change users to check only the relevant bit. (agent_askpin): Support repeat logic of new Pinentries. * agent/command-ssh.c (ssh_identity_register): Use the new repeat feature. * agent/genkey.c (agent_ask_new_passphrase): Ditto. -- If we need to confirm a passphrase entry (e.g. for new passphrase) we set a flag into the pinentry info block. The we try to use the new pinentry command SETREPEATERROR; if that fails, we continue as usual. If that succeeds we ask the pinentry to show the repeat (confirmation) prompt and on successful return we set another flag in the pinentry info block so that the caller can skip its own confirmation check. A new status line from the pinentry indicates that the feature is actually supported (it may not be supported on certain systems for example when using the ncurses backend). Signed-off-by: Werner Koch <[email protected]>
* misc: Add logo as used with PayPal.Werner Koch2014-10-241-0/+0
| | | | --
* gpg: Silence "packet with obsolete versoin" warnings.Werner Koch2014-10-191-1/+2
| | | | | | | * g10/parse-packet.c (parse_key): Print warning only in very verbose mode. Signed-off-by: Werner Koch <[email protected]>
* gpg: Make card key generation work again.Werner Koch2014-10-194-5/+44
| | | | | | | | | | | | * g10/call-agent.c (agent_scd_learn): Rename from agent_learn. (agent_learn): New. * g10/keygen.c (gen_card_key): Call new agent-learn. -- Without a shadow key we can't create the self-signatures. Thus we need to issue the learn command after each key generation. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Allow building without LDAP support.Werner Koch2014-10-176-42/+178
| | | | | | | | | | | | * configure.ac: Add option --disable-ldap. (USE_LDAP): New ac_define and am_conditional. * dirmngr/Makefile.am: Take care of USE_LDAP. * dirmngr/dirmngr.c (!USE_LDAP): Make all ldap options dummy options and do not call any ldap function. * dirmngr/server.c (!USE_LDAP): Do not call any ldap function. * dirmngr/crlfetch.c (!USE_LDAP): Ditto. Signed-off-by: Werner Koch <[email protected]>
* w32: Set SYSROOT to help finding config scripts.Werner Koch2014-10-171-1/+1
| | | | * autogen.sh <build-w32>: Set SYSROOT.
* gpg: Remove all support for v3 keys and always create v4-signatures.Werner Koch2014-10-1715-478/+224
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/build-packet.c (do_key): Remove support for building v3 keys. * g10/parse-packet.c (read_protected_v3_mpi): Remove. (parse_key): Remove support for v3-keys. Add dedicated warnings for v3-key packets. * g10/keyid.c (hash_public_key): Remove v3-key support. (keyid_from_pk): Ditto. (fingerprint_from_pk): Ditto. * g10/options.h (opt): Remove fields force_v3_sigs and force_v4_certs. * g10/gpg.c (cmd_and_opt_values): Remove oForceV3Sigs, oNoForceV3Sigs, oForceV4Certs, oNoForceV4Certs. (opts): Turn --force-v3-sigs, --no-force-v3-sigs, --force-v4-certs, --no-force-v4-certs int dummy options. (main): Remove setting of the force_v3_sigs force_v4_certs flags. * g10/revoke.c (gen_revoke, create_revocation): Always create v4 certs. * g10/sign.c (hash_uid): Remove support for v3-signatures (hash_sigversion_to_magic): Ditto. (only_old_style): Remove this v3-key function. (write_signature_packets): Remove support for creating v3-signatures. (sign_file): Ditto. (sign_symencrypt_file): Ditto. (clearsign_file): Ditto. Remove code to emit no Hash armor line if only v3-keys are used. (make_keysig_packet): Remove arg SIGVERSION and force using v4-signatures. Change all callers to not pass a value for this arg. Remove all v3-key related code. (update_keysig_packet): Remove v3-signature support. * g10/keyedit.c (sign_uids): Always create v4-signatures. * g10/textfilter.c (copy_clearsig_text): Remove arg pgp2mode and change caller. -- v3 keys are deprecated for about 15 years and due the severe weaknesses of MD5 it does not make any sense to keep code around to use these old and broken keys. Users who need to decrypt old messages should use gpg 1.4 and best re-encrypt them to modern standards. verification of old (i.e. PGP2) created signatures is thus also not anymore possible but such signatures have no values anyway - MD5 is just too broken. We have also kept support for v3 signatures until now. With the removal of support for v3 keys it is questionable whether it makes any sense to keep support for v3-signatures. What we do now is to keep support for verification of v3-signatures but we force the use of v4-signatures. The latter makes the --pgp6 and --pgp7 switch a bit obsolete because those PGP versions require v3-signatures for messages. These versions of PGP are also really old and not anymore maintained so they have not received any bug fixes and should not be used anyway. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Minor usage output fix.Werner Koch2014-10-171-2/+2
| | | | --
* doc: Minor doc fix for --quick-lsign-key.Werner Koch2014-10-151-1/+1
| | | | --
* gpg: Remove extra RSA import status line.Werner Koch2014-10-133-10/+6
| | | | | | | | | | | | * g10/import.c (stats_s): Remove field "imported_rsa". (import_print_stats): Do not print separate value for RSA. (import_one): Remove the RSA counter. -- RSA is the standard key format and thus there is no more need to have a separate counter. This is a remain from the RSA patent times. Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix informative printing of user ids.Werner Koch2014-10-135-28/+103
| | | | | | | | | | | | | | | | | | | | | | * g10/getkey.c (keyid_list): Add field "fpr". (cache_user_id): Store fpr and check for dups only by fpr. (get_pubkey_byfpr): New. (get_user_id_string): Make static and use xasprintf. (get_long_user_id_string): Use xasprintf. (get_user_id_byfpr): New. (get_user_id_byfpr_native): New. * g10/keyid.c (fingerprint_from_pk): Make arg RET_LEN optional. * g10/import.c (import_one): Use get_user_id_byfpr_native. -- We now cache the userids using the fingerprint. This allows to print the correct user id for keys with a duplicated key id. We should eventually start to retire the use of all the old keyid based functions. However, at some places we only have the keyid and thus some of them will need to be kept (maybe changed with an indication to show that more than several user ids are matching). Signed-off-by: Werner Koch <[email protected]>
* gpg: Allow importing keys with duplicated long key ids.Werner Koch2014-10-134-20/+51
| | | | | | | | | | | | | | | * g10/keydb.c (keydb_handle): Add field no_caching. (keyblock_cache): Repalce field kid by fpr. (keydb_disable_caching): New. (keydb_search): Use the fingerprint as cache index. * g10/import.c (import_one): Use the fingerprint and not the kid to lookup the key. Call keydb_disable_caching beofre re-searching for update. * tests/openpgp/import.test: Add a test case. Signed-off-by: Werner Koch <[email protected]>
* tests: Add sample keys with colliding long keu ids.Werner Koch2014-10-134-1/+63
| | | | | | | -- Thanks to David Leon Gil <[email protected]> who posted these keys to [email protected] on Fri, 13 Dec 2013 07:09:54 -0800 (PST).
* tests: Speed up conventional encryption tests for gpg.Werner Koch2014-10-132-6/+14
| | | | | | | | | | | | * tests/openpgp/conventional-mdc.test: Add an s2k-count option. * tests/openpgp/conventional.test: Ditto. -- Due to measuring the iteration count for the passphrase hashing, the conventional encryption tests are running quite slow. This patch fixes it by using a fixed and lower value for the iteration count. Signed-off-by: Werner Koch <[email protected]>
* gpg: Minor change for better readability.Werner Koch2014-10-121-13/+3
| | | | | | | * g10/build-packet.c (write_version): Remove. (do_pubkey_enc, do_onepass_sig): Write version directly. Signed-off-by: Werner Koch <[email protected]>
* Use a unique capitalization for "Note:".Werner Koch2014-10-1020-114/+190
| | | | --
* po: Fix some grammar buglets in the German translation.Werner Koch2014-10-101-19/+22
| | | | | | | | | | | | | | | | | | | | | | | | | -- Reported-by: Thomas Gries 1) "GnuPG erstellt eine User-ID,[Komma fehlt] um Ihren Schlüssel …" 2) "Die Karte wird nun konfiguriert,[<<< Komma fehlt] um einen …" in gpg-agent 3) "verbite" → "verbiete" 4) in gpg-agent --help ich fände eine einheitliche Groß- bzw. Kleinschreibung der Befehle besser, derzeit gibt es einen Mix aus Groß- und Kleinschreibung "Benutze... ", "benutze..." usw: Item 3 was already fixed. Also fixed some capitalization inconsistencies. Signed-off-by: Werner Koch <[email protected]>
* doc: Fix a man page rendering problem.Werner Koch2014-10-101-7/+7
| | | | | * doc/gpg-agent.texi (Agent Configuration): Fix rendering of the sshcontrol example.
* gpg: Add build and runtime support for larger RSA keysDaniel Kahn Gillmor2014-10-105-3/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * configure.ac: Added --enable-large-secmem option. * g10/options.h: Add opt.flags.large_rsa. * g10/gpg.c: Contingent on configure option: adjust secmem size, add gpg --enable-large-rsa, bound to opt.flags.large_rsa. * g10/keygen.c: Adjust max RSA size based on opt.flags.large_rsa * doc/gpg.texi: Document --enable-large-rsa. -- This is a cherry-pick of 534e2876acc05f9f8d9b54c18511fe768d77dfb5 from STABLE-BRANCH-1-4 against master Some older implementations built and used RSA keys up to 16Kib, but the larger secret keys now fail when used by more recent GnuPG, due to secure memory limitations. Building with ./configure --enable-large-secmem will make gpg capable of working with those secret keys, as well as permitting the use of a new gpg option --enable-large-rsa, which let gpg generate RSA keys up to 8Kib when used with --batch --gen-key. Debian-bug-id: 739424 Minor edits by wk. GnuPG-bug-id: 1732
* gpg: Skip overlong keys and a print a warning.Werner Koch2014-10-096-5/+29
| | | | | | | | | | | | | * kbx/keybox-search.c (keybox_search): Add arg r_skipped and skip too long blobs. * sm/keydb.c (keydb_search): Call keybox_search with a dummy param. * g10/keydb.c (struct keydb_handle): Add field skipped_long_blobs. (keydb_search_reset): Reset that field. (keydb_search): Update that field. (keydb_get_skipped_counter): New. * g10/keylist.c (list_all): Print count of skipped keys. Signed-off-by: Werner Koch <[email protected]>
* gpg: Sync keylist output and warning messages.Werner Koch2014-10-092-2/+11
| | | | | | | | | | * g10/keylist.c (list_all): Flush stdout before logging. * g10/misc.c (print_pubkey_algo_note): Ditto. (print_cipher_algo_note): Ditto. (print_digest_algo_note): Ditto. (print_md5_rejected_note): Ditto. Signed-off-by: Werner Koch <[email protected]>
* kbx: Fix handling of overlong keys.Werner Koch2014-10-092-7/+41
| | | | | | | | | | | | | | | | | * kbx/keybox-file.c (IMAGELEN_LIMIT): Change limit from 10^6 to 2MiB. (_keybox_read_blob2): Skip too long record records. (_keybox_write_blob): Do not accept too long record. * kbx/keybox-dump.c (file_stats_s): Add field skipped_long_blobs. (_keybox_dump_file): Print new counter. (_keybox_dump_file): Skip too long records. ---- To test this feature you may set the limit back to 1MiB and use key F7F0E70F307D56ED which is in my local copy close to 2MiB. Without this patch it was possible to import the key but access to that key and all keys stored after it was not possible. Signed-off-by: Werner Koch <[email protected]>
* gpg: Take care to use pubring.kbx if it has ever been used.Werner Koch2014-10-099-50/+154
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * kbx/keybox-defs.h (struct keybox_handle): Add field for_openpgp. * kbx/keybox-file.c (_keybox_write_header_blob): Set openpgp header flag. * kbx/keybox-blob.c (_keybox_update_header_blob): Add arg for_openpgp and set header flag. * kbx/keybox-init.c (keybox_new): Rename to do_keybox_new, make static and add arg for_openpgp. (keybox_new_openpgp, keybox_new_x509): New. Use them instead of the former keybox_new. * kbx/keybox-update.c (blob_filecopy): Add arg for_openpgp and set the openpgp header flags. * g10/keydb.c (rt_from_file): New. Factored out and extended from keydb_add_resource. (keydb_add_resource): Switch to the kbx file if it has the openpgp flag set. * kbx/keybox-dump.c (dump_header_blob): Print header flags. -- The problem was reported by dkg on gnupg-devel (2014-10-07): I just discovered a new problem, though, which will affect people on systems that have gpg and gpg2 coinstalled: 0) create a new keyring with gpg2, and use it exclusively with gpg2 for a while. 1) somehow (accidentally?) use gpg (1.4.x) again -- this creates ~/.gnupg/pubring.gpg 2) future runs of gpg2 now only look at pubring.gpg and ignore pubring.kbx -- the keys you had accumulated in the keybox are no longer listed in the output of gpg2 --list-keys Note that gpgsm has always used pubring.kbx and thus this file might already be there but without gpg ever inserted a key. The new flag in the KBX header gives us an indication whether a KBX file has ever been written by gpg >= 2.1. If that is the case we will use it instead of the default pubring.gpg. Signed-off-by: Werner Koch <[email protected]>
* gpg: Change wording of a migration error message.Werner Koch2014-10-091-2/+3
| | | | --
* doc: Add missing entry for allow-preset-passphaseKristian Fiskerstrand2014-10-091-0/+6
| | | | --
* Avoid unnecessary library linkageDaniel Kahn Gillmor2014-10-094-6/+6
| | | | | | | | | | | | | | | | | | | | * dirmngr/Makefile.am: Avoid $(DNSLIBS) for dirmngr_ldap * g10/Makefile.am: $(LIBREADLINE) is only for gpg2; gpgv2 does not need $(LIBASSUAN_LIBS) * sm/Makefile.am: gpgsm does not need $(ZLIBS) * tools/Makefile.am: gpgconf does not need $(NPTH_LIBS) -- In the course of building GnuPG 2.1.0 beta864 on debian, i found that several of the installed executables were linked to libraries that they did not need to be linked to, which would cause unnecessary package dependencies at runtime. The changeset here removes these unnecessary libraries from linking. Something similar could possibly also be done by passing --as-needed to the linker, but trimming the depenencies seems more parsimonious.
* gpg: Avoid error exit if keygrip computations fails in a key listing.Werner Koch2014-10-081-1/+2
| | | | | | | | | | | * g10/keyid.c (keygrip_from_pk): Use log_info and clear array on error. -- This may happen due to algorithms or curves not supported by Libgcrypt. We should only print a warning and not have gpg return with failure for a secret key listing. Signed-off-by: Werner Koch <[email protected]>
* doc: Minor fix.Werner Koch2014-10-032-2/+9
| | | | | | | | | | | | | | | | -- Due to todays reminder: On Tue 2014-04-22 18:46:15 -0400, Daniel Kahn Gillmor wrote: > With --trust-model=always, all keys and user IDs are considered > automatically valid; they are not automatically trusted (setting > universal ownertrust to anything other than "ultimate" would be > insufficient to acheive the effect of --trust-model=always, due to > --max-cert-depth and certificate path reachability). > > Thanks to Nicolai Josuttis for pointing out this documentation error.
* Release 2.1.0-beta864.gnupg-2.1.0-beta864Werner Koch2014-10-031-1/+18
|
* speedo: Add INSTALL_PREFIX feature.Werner Koch2014-10-031-2/+11
| | | | | | | | | | | -- With this it is now possible build and install gnupg 2.1 properly below /usr/local: make -f TOPSRC/build-aux/speed.ml native INSTALL_PREFIX=/usr/local Of course you need installation priviliges for the /usr/local tree.
* gpg: Allow creating a cert-only primary key.Werner Koch2014-10-031-0/+7
| | | | | | | * g10/keygen.c (ask_key_flags): Allow a 'c' in direct entry. -- GnuPG-bug-id: 1726
* Some doc fixes and a fix for "make distcheck".Werner Koch2014-10-033-34/+42
| | | | --
* build: Add configure options --disable-{ntb,gnu}tls.Werner Koch2014-10-031-6/+18
| | | | * configure.ac: Add --disable-ntbtls and --disable-gnutls.
* gpg: Check gpg-agent version before 2.1 migration.Andre Heinecke2014-10-033-0/+55
| | | | | | | | | | | | | | | * g10/call-agent.c, g10/call-agent.h (agent_get_version): New. * g10/migrate.c (migrate_secring): Abort migration if agent_get_version returns not at least 2.1.0 -- GnuPG-bug-id: 1718 On the first installation of GnuPG 2.1 it is likely that an old gpg-agent is still running in the environment. In that case the migration would fail. Signed-off-by: Andre Heinecke <[email protected]>
* po: Auto update translations.Werner Koch2014-10-033-104/+199
| | | | --
* po: Update German translation.Werner Koch2014-10-031-39/+61
|
* Remove support for the GPG_AGENT_INFO envvar.Werner Koch2014-10-0315-532/+215
| | | | | | | | | | | | | | | | | | | | | | | | | | * agent/agent.h (opt): Remove field use_standard_socket. * agent/command.c (cmd_killagent): Always allow killing. * agent/gpg-agent.c (main): Turn --{no,}use-standard-socket and --write-env-file into dummy options. Always return true for --use-standard-socket-p. Do not print the GPG_AGENT_INFO envvar setting or set that envvar. (create_socket_name): Simplify by removing non standard socket support. (check_for_running_agent): Ditto. * common/asshelp.c (start_new_gpg_agent): Remove GPG_AGENT_INFO use. * common/simple-pwquery.c (agent_open): Ditto. * configure.ac (GPG_AGENT_INFO_NAME): Remove. * g10/server.c (gpg_server): Do not print the AgentInfo comment. * g13/server.c (g13_server): Ditto. * sm/server.c (gpgsm_server): Ditto. * tools/gpgconf.c (main): Simplify by removing non standard socket support. -- The indented fix to allow using a different socket than the one in the gnupg home directory is to change Libassuan to check whether the socket files exists as a regualr file with a special keyword to redirect to another socket file name.
* gpg: Fix regression removing SHA256.Werner Koch2014-10-022-5/+1
| | | | | | | | | * g10/misc.c (map_md_openpgp_to_gcry): Always use SHA256. -- Regression due to commit d33246700578cddd1cb8ed8164cfbba50aba4ef3 GnuPG-bug-id: 1733.
* First changes for future use of NTBTLS.Werner Koch2014-10-028-54/+302
| | | | | | | | | | | | | | * configure.ac (NEED_NTBTLS_ABI, NEED_NTBTLS_VERSION): New. (HTTP_USE_NTBTLS): New. Prefer over GNUTLS. * m4/ntbtls.m4: New. * m4/Makefile.am (EXTRA_DIST): Add new file. * common/http.c: Add conditionals to eventually use NTBTLS. -- This is only the configure stuff. If you have NTBTLS installed GNUTLS will not be used but there won't be any https support either :-(. This patch is used to have a real world test bench for the forthcoming library.
* build: Update m4 scriptsWerner Koch2014-10-023-22/+84
| | | | | | | * m4/gpg-error.m4: Update from Libgpg-error git master. * m4/libgcrypt.m4: Update from Libgcrypt git master. * configure.ac: Declare SYSROOT a precious variable. Add extra error message for library configuration mismatches.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-14 21:36:40 +0000