aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* doc: clarify intent for show-only-fpr-mboxdkg/fix-T4507Daniel Kahn Gillmor2019-05-141-2/+3
| | | | | | | | | | | | * doc/gpg.texi: clarify documentation for list-options show-only-fpr-mbox -- This avoids unclear use of the term "valid". Gnupg-Bug-Id: 4057 Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* gpg: Change update_keysig_packet to replace SHA-1 by SHA-256.Werner Koch2019-05-131-0/+11
| | | | | | | | | | | | | | | * g10/sign.c (update_keysig_packet): Convert digest algo when needed. -- Several gpg commands try to keep most properties of a key signature when updating (i.e. creating a new version of a key signature). This included the use of the current hash-algorithm. This patch changes this so that SHA-1 or RMD160 are replaced by SHA-256 if possible (i.e. for RSA signatures). Affected commands are for example --quick-set-expire and --quick-set-primary-uid. GnuPG-bug-id: 4508 Signed-off-by: Werner Koch <[email protected]>
* gpg: Cleanup use of make_keysig_packet.Werner Koch2019-05-137-44/+48
| | | | | | | | | | * g10/sign.c (make_keysig_packet): Remove obsolete arg diegst_algo which was always passed as 0. Change all callers. * g10/gpgcompose.c (signature): Warn when trying to set a digest algo. -- Signed-off-by: Werner Koch <[email protected]>
* build: Update m4/iconv.m4.NIIBE Yutaka2019-05-131-57/+165
| | | | | | | | | | | * m4/iconv.m4: Update from gettext 0.20.1. -- This includes fixes of file descriptor leaks. GnuPG-bug-id: 4504 Signed-off-by: NIIBE Yutaka <[email protected]>
* doc: correct documentation for gpgconf --killDaniel Kahn Gillmor2019-05-101-5/+6
| | | | | | * doc/tools.texi(gpgconf): Correct documentation for gpgconf --kill. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* dirmngr: Add a CSRF expection for pm.meWerner Koch2019-05-092-3/+4
| | | | | | -- Also comment typo fix.
* agent: If a Label is make sure that label is part of the prompt.Werner Koch2019-05-071-0/+40
| | | | | | | | | | | | | | * agent/findkey.c (has_comment_expando): New. (agent_key_from_file): Modify DESC_TEXT. -- A Label entry in the keyfile is always set manually and thus we can assume that the user wants to have this label in the prompt. In case the prompt template does not demand a comment this patch appends a comment to thhe template. This is a common case for on-disk keys used by gpg. Signed-off-by: Werner Koch <[email protected]>
* agent: Allow the use of "Label:" in a key file.Werner Koch2019-05-072-25/+82
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/findkey.c (linefeed_to_percent0A): New. (read_key_file): Add optional arg 'keymeta' and change all callers. (agent_key_from_file): Prefer "Label:" over the comment for protected keys. -- If in the extended key format an item Label: This is my key is found, "This is my key" will be displayed instead of the comment intially recorded in the s-expression. This is pretty useful for the ssh keys because often there is only the original file name recorded in the comment. If no Label is found or it is empty the S-expression comment is used. To show more than one line, the standard name-value syntax can be used, for example: Label: The Ssh key <blank line> <space>I registered on fencepost. Signed-off-by: Werner Koch <[email protected]>
* common: New functions nvc_delete_named and nvc_get_string.Werner Koch2019-05-073-0/+65
| | | | | | | * common/name-value.c (nvc_delete_named): New. (nvc_get_string): New. Signed-off-by: Werner Koch <[email protected]>
* scd: Support direct use of app with PKSIGN/PKAUTH/PKDECRYPT.NIIBE Yutaka2019-05-071-11/+76
| | | | | | | * scd/command.c (cmd_pksign, cmd_pkauth, cmd_pkdecrypt): When length of keyidstr is 40, it is considered as a keygrip for direct use. Signed-off-by: NIIBE Yutaka <[email protected]>
* doc: Minor doc fix to dirmngr.Werner Koch2019-05-031-3/+1
| | | | | | -- Reported-by: dkg
* agent: Put Token lines into the key files.Werner Koch2019-05-039-32/+121
| | | | | | | | | | | | | | | * agent/findkey.c (write_extended_private_key): Add args serialno and keyref. Write a Token line if that does not yet exist. (agent_write_private_key): Add args serialno and keyref and change all callers. (agent_write_shadow_key): Skip leading spaces. * agent/keyformat.txt: Improve extended key format docs. -- Noet that the extended key forma is the defaqult in 2.3. This patch is a first step to better handle tokens which carray the same key. Signed-off-by: Werner Koch <[email protected]>
* common: In private key mode write "Key:" always last in name-value.Werner Koch2019-05-031-13/+40
| | | | | | | | | | | | * common/name-value.c (nvc_write): Take care of Key. Factor some code out to ... (write_one_entry): new. -- The key item is in general not manual editable thus we put it at the end of a file. Signed-off-by: Werner Koch <[email protected]>
* gpg: Use just the addrspec from the Signer's UID.Werner Koch2019-05-031-0/+9
| | | | | | | | | | | | | * g10/parse-packet.c (parse_signature): Take only rthe addrspec from a Signer's UID subpacket. -- This is to address a problem in the currentr OpenKeychain which put the entire UID into the subpacket. For example our Tofu code can only use the addrspec and not the entire UID. Reported-by: Wiktor Kwapisiewicz <[email protected]> Signed-off-by: Werner Koch <[email protected]>
* tools: Some changes to the ccidmon.c debug helper.Werner Koch2019-04-301-16/+31
| | | | --
* sm: Add yet inactive options to support authenticodeWerner Koch2019-04-304-3/+142
| | | | | | | | | | | | * sm/gpgsm.c (opts): New options --authenticode and --attribute. * sm/gpgsm.h (opt): Add vars authenticode and attribute_list. * sm/sign.c (add_signed_attribute): New but inactive. (gpgsm_sign): Use new options. -- Because libksba 1.4 is not yet ready the new code is not yet active. Signed-off-by: Werner Koch <[email protected]>
* common,w32: Breakaway detached childs when in jobAndre Heinecke2019-04-291-0/+45
| | | | | | | | | | | | | | | | | | | * common/exechelp-w32.c (gnupg_spawn_process_detached): Add CREATE_BREAKAWAY_FROM_JOB creation flag if required. -- When the gpg process is assigned to a W32 "Job" the child processes are killed once the Job is finished. As we want our detached processes to linger e.g. gpg-agent the breakaway flag is required in that case. GnuPG-Bug-Id: T4333 Thanks to Jan Echternach for reporting this and providing a patch. Signed-off-by: Andre Heinecke <[email protected]>
* scd: Add new command: KEYINFO.NIIBE Yutaka2019-04-255-1/+159
| | | | | | | | | | | | | | | * scd/app-common.h (struct app_ctx_s): Add with_keygrip function. * scd/app-openpgp.c (do_with_keygrip): New. * scd/app.c (app_do_with_keygrip): New. * scd/command.c (cmd_keyinfo): New. (send_keyinfo): New. -- KEYGRIP_ACTION_LOOKUP is not yet used. It will be used for directly asking PK* action to determine an APP. Signed-off-by: NIIBE Yutaka <[email protected]>
* po: Update Japanese Translation.NIIBE Yutaka2019-04-231-149/+267
| | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Allow KEYGRIP as KEYIDSTR.NIIBE Yutaka2019-04-231-15/+52
| | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): Add keygrip_str. (store_keygrip): New. (read_public_key): Call store_keygrip to hold keygrip. (get_public_key): Likewise. (send_keypair_info): Use stored keygrip_str. (check_keyidstr): Allow use of KEYGRIP. (do_check_pin): Allow use of KEYGRIP of signing slot. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Factor out a function to check keyidstr.NIIBE Yutaka2019-04-221-126/+59
| | | | | | | * scd/app-openpgp.c (check_keyidstr): New. (do_sign, do_auth, do_decipher, do_check_pin): Use check_keyidstr. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpgconf: correct capitalization of "Tor"Daniel Kahn Gillmor2019-04-191-1/+1
| | | | | | | | | | | | | | | | | * tools/gpgconf-comp.cb (gc_options_dirmngr): correct capitalization of Tor. -- https://www.torproject.org/docs/faq.html.en#WhyCalledTor says: > Note: even though it originally came from an acronym, Tor is not > spelled "TOR". Only the first letter is capitalized. In fact, we can > usually spot people who haven't read any of our website (and have > instead learned everything they know about Tor from news articles) by > the fact that they spell it wrong. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* g10: Fix double free when locating by mboxAndre Heinecke2019-04-181-2/+1
| | | | | | | | | | | | | | | | * g10/getkey.c (get_best_pubkey_byname): Set new.uid always to NULL after use. -- pubkey_cmp is not guranteed to set new.uid. So if the diff < 0 case is reached best is set to new. If then diff > 0 is reached without modifying new.uid e.g. if the key has no matching mboxes. new.uid is free'd even though the uid is still referenced in best. GnuPG-Bug-Id: T4462
* g10: Fix a memory leak.NIIBE Yutaka2019-04-171-0/+7
| | | | | | | | | | * g10/import.c (import): Care PNDING_PKT on error. -- GnuPG-bug-id: 4461 Reported-by: Philippe Antoine Signed-off-by: NIIBE Yutaka <[email protected]>
* common: Fix AWK portability.NIIBE Yutaka2019-04-162-7/+7
| | | | | | | | | | * common/Makefile.am: Use pkg_namespace. * common/mkstrtable.awk: Use pkg_namespace. Regexp fix. -- GnuPG-bug-Bug: 4459 Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: New caching functions.Werner Koch2019-04-135-119/+702
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/objcache.c: New. * g10/objcache.h: New. * g10/Makefile.am (common_source): Add them. * g10/gpg.c: Include objcache.h. (g10_exit): Call objcache_dump_stats. * g10/getkey.c: Include objcache.h. (get_primary_uid, release_keyid_list): Remove. (cache_user_id): Remove. (finish_lookup): Call the new cache_put_keyblock instead of cache_user_id. (get_user_id_string): Remove code for mode 2. (get_user_id): Implement using cache_get_uid_bykid. -- This generic caching module is better than the ad-hoc code we used in getkey.c. More cleanup in getkey is still required but it is a start. There is also a small performance increase with the new cache: With a large keyring and --list-sigs I get these numbers: | | before | after | |------+------------+------------| | real | 14m1.028s | 12m16.186s | | user | 2m18.484s | 1m36.040s | | sys | 11m42.420s | 10m40.044s | Note the speedup in the user time which is due to the improved cache algorithm. This is obvious, because the old cache was just a long linked list; the new cache are two hash tables. Signed-off-by: Werner Koch <[email protected]>
* gpg: Cache a once computed fingerprint in PKT_public_key.Werner Koch2019-04-122-72/+51
| | | | | | | | | | | | | | * g10/packet.h (PKT_public_key): Add fields fpr and fprlen. * g10/keyid.c (do_fingerprint_md): Remove. (compute_fingerprint): New. (keyid_from_pk): Simplify. (fingerprint_from_pk): Simplify. (hexfingerprint): Avoid using extra array. -- This is similar to what we are doing with the keyid for a long time. Signed-off-by: Werner Koch <[email protected]>
* gpg: Accept also armored data from the WKD.Werner Koch2019-04-111-2/+3
| | | | | | | | | | | * g10/keyserver.c (keyserver_import_wkd): Clear NO_ARMOR. -- We may even adjust the specs to allow that. It should not be a problem for any OpenPGP implementation because armored keys are very common and de-armoring code is de-facto a mandatory feature. Signed-off-by: Werner Koch <[email protected]>
* gpg: Set a limit of 5 to the number of keys imported from the WKD.Werner Koch2019-04-111-4/+21
| | | | | | | | | | | | | | | | | | | | | * g10/import.c (import): Limit the number of considered keys to 5. (import_one): Return the first fingerprint in case of WKD. -- The Web Key Directory should carry only one key. However, some providers like to put old or expired keys also into the WKD. I don't thunk that this is a good idea but I heard claims that this is needed for them to migrate existing key data bases. This patch puts a limit on 5 on it (we had none right now) and also fixes the issue that gpg could not work immediately with the requested key because the code uses the fingerprint of the key to use the imported key. Now the first key is used. On a second try (w/o accessing the WKD) the regular key selection mechanism would be in effect. I think this is the most conservative approach. Let's see whether it helps. Signed-off-by: Werner Koch <[email protected]>
* speedo,w32: Install gpg-card.exeAndre Heinecke2019-04-111-0/+2
| | | | * build-aux/speedo/w32/inst.nsi: Install gpg-card.exe
* gpg: Fix printing of the user id during import.Werner Koch2019-04-053-14/+17
| | | | | | | | | | | | | * g10/getkey.c (struct keyid_list): Add field fprlen. (cache_user_id): Set and test it. (get_user_id_byfpr): Make static, add arg fprlen and use it. (get_user_id_byfpr_native): Add arg fprlen and change all callers. -- This was a regression in the 2.3 base. GnuPG-bug-id: 3801 Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Fix RSA decryption.Werner Koch2019-04-041-6/+25
| | | | | | | * scd/app-piv.c (do_decipher): Fixup leading zero byte. -- Signed-off-by: Werner Koch <[email protected]>
* doc: Minor change to the included yat2m.Werner Koch2019-04-042-12/+148
| | | | | | | | | -- Getting the rendering of man pages is not really easy; let's see whether this is better. The change has also been done upstream. Signed-off-by: Werner Koch <[email protected]>
* scd: Better handling of timeout and time extension.NIIBE Yutaka2019-04-041-7/+4
| | | | | | | | | * scd/ccid-driver.c (CCID_CMD_TIMEOUT_LONGER): Remove. (ccid_transceive): Don't use x4 blindly for bBWI, but use dynamically determined value. Use value from variable wait_more for bulk_in. Set wait_more by the value of time extension request. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Improve the code to decrypt using PIV cards.Werner Koch2019-04-034-25/+26
| | | | | | | | | | | | | | * g10/call-agent.c (agent_scd_keypairinfo): Add arg 'keyref'. * g10/keygen.c (ask_algo): Adjust. * g10/skclist.c (enum_secret_keys): Request the keyref directly. -- This improves commit ec6a6779236a89d4784a6bb7de0def9cc0f9e8a4 to avoid looping over all keypairinfos. This way scdaemon does not need to compute all the keypairinfos for all keys of a card. This patch is possible due the enhanced READKEY command in scdaemon. Signed-off-by: Werner Koch <[email protected]>
* scd: New options --info and --info-only for READKEY.Werner Koch2019-04-037-50/+147
| | | | | | | | | | | | | | | | | | | | | | * scd/command.c (cmd_readkey): New options --info and --info-only. * scd/app.c (app_readkey): New arg 'flags'. * scd/app-common.h (APP_READKEY_FLAG_INFO): New. (struct app_ctx_s): New args 'ctrl' and 'flags' for member readkey. Change all implementers. * scd/app-nks.c (do_readkey): Stub implementation of APP_READKEY_FLAG_INFO. * scd/app-openpgp.c (do_readkey): Implement APP_READKEY_FLAG_INFO. * scd/app-piv.c (do_readkey): Ditto. -- This feature allows to quickly get the keygrip and in most cases also the usage flags for one specific keyref. Example: <- readkey --info-only PIV.9D -> S KEYPAIRINFO FC6061FB457224370B85C6F34DD56CD29E669620 PIV.9D e -> OK Signed-off-by: Werner Koch <[email protected]>
* gpg: Allow decryption using PIV cards.Werner Koch2019-04-034-8/+146
| | | | | | | | | | | * g10/call-agent.c (struct getattr_one_parm_s): New. (getattr_one_status_cb): New. (agent_scd_getattr_one): New. * g10/pubkey-enc.c (get_it): Allow the standard leading zero byte from pkcs#1. * g10/skclist.c (enum_secret_keys): Handle non-OpenPGP cards. Signed-off-by: Werner Koch <[email protected]>
* scd: New standard attributes $ENCRKEYID and $SIGNKEYID.Werner Koch2019-04-034-3/+29
| | | | | | | | | | | | | | | | * g10/call-agent.c (agent_scd_keypairinfo): Use --keypairinfo. * sm/call-agent.c (gpgsm_agent_scd_keypairinfo): Ditto. * scd/app-openpgp.c (do_getattr): Add attributes "$ENCRKEYID" and "$SIGNKEYID". * scd/app-piv.c (do_getattr): Ditto. -- We already have $AUTHKEYID to locate the keyref of the key to be used with ssh. It will also be useful to have default keyref for encryption and signing. For example, this will allow us to repalce the use of "OPENPGP.2" by a app type specific keyref. Signed-off-by: Werner Koch <[email protected]>
* gpg: Avoid endless loop if a card's serial number can't be read.Werner Koch2019-04-031-0/+1
| | | | | | | | | | * g10/skclist.c (enum_secret_keys): Move list forward on error. -- The error is not easy to reproduce but may occur if a card is removed at the wrong time. Tested by changing the code. Signed-off-by: Werner Koch <[email protected]>
* card: Allow card selection with LIST.Werner Koch2019-04-032-37/+90
| | | | | | | | | | | | * tools/card-call-scd.c (start_agent): Request serialno only whean started. (scd_serialno): Allow NULL for r_serialno. * tools/gpg-card.c (cmd_factoryreset): Use changed scd_serialno. (cmd_list): New. (dispatch_command): Use cmd_list for cmdLIST. (interactive_loop): Ditto. Signed-off-by: Werner Koch <[email protected]>
* gpg: Print modern style key info for non-decryptable keys.Werner Koch2019-04-032-9/+9
| | | | | | | | | | | | | | | | | | | * g10/mainproc.c (print_pkenc_list): Simplify. -- This changes the output from # ------------------------ >8 ------------------------ gpg: encrypted with 2048-bit RSA key, ID D20073D46DF6C97D, created 2019-04-02 "Test with PIV card" to gpg: encrypted with rsa2048 key, ID D20073D46DF6C97D, created 2019-04-02 "Test with PIV card" Signed-off-by: Werner Koch <[email protected]> # ------------------------ 8< ------------------------
* gpg: Allow direct key generation from card with --full-gen-key.Werner Koch2019-04-025-28/+213
| | | | | | | | | | | | | | | * g10/call-agent.c (agent_scd_readkey): New. * g10/keygen.c (ask_key_flags): Factor code out to .. (ask_key_flags_with_mask): new. (ask_algo): New mode 14. -- Note that this new menu 14 is always displayed. The usage flags can be changed only in --expert mode, though. Creating and using signing keys works but decryption does not yet work; we will need to tweak a couple of other places for that. Tested with a Yubikey's PIV app. Signed-off-by: Werner Koch <[email protected]>
* common: Extend function pubkey_algo_string.Werner Koch2019-04-024-5/+10
| | | | | | | | * common/sexputil.c (pubkey_algo_string): Add arg R_ALGOID. * sm/certreqgen-ui.c (gpgsm_gencertreq_tty): Adjust. * tools/gpg-card.c (list_one_kinfo): Ditto. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Improve domaininfo cache update algorithm.Werner Koch2019-04-021-19/+106
| | | | | | | | | | | | | | | | | * dirmngr/domaininfo.c (struct domaininfo_s): Add field keepmark. (insert_or_update): Implement new update algorithm. -- The old algorithm limited the length of a bucket chain by purging the last 50% or the entries. Thus the first domains entered into the cache were never purged. The new algorithm is a bit better: It also limits the chain length on overflow to 50% but tries to keep the entries indicating that a WKD is available in the cache. If there is still space to keep more, those which clearly do not support WKD are also kept. Signed-off-by: Werner Koch <[email protected]>
* sm: Show the usage flags when generating a key from a card.Werner Koch2019-04-013-8/+61
| | | | | | | | | * g10/call-agent.c (scd_keypairinfo_status_cb): Also store the usage flags. * sm/call-agent.c (scd_keypairinfo_status_cb): Ditto. * sm/certreqgen-ui.c (gpgsm_gencertreq_tty): Print the usage flags. Signed-off-by: Werner Koch <[email protected]>
* gpg: Prepare card code to allow other than OpenPGP cards.Werner Koch2019-04-012-16/+30
| | | | | | | | * g10/call-agent.c (start_agent): Use card app auto selection. * g10/card-util.c (current_card_status): Print the Application type. (card_status): Put empty line between card listings. Signed-off-by: Werner Koch <[email protected]>
* gpg: New card function agent_scd_keypairinfo.Werner Koch2019-04-012-3/+82
| | | | | | | * g10/call-agent.c (scd_keypairinfo_status_cb) (agent_scd_keypairinfo): New. Taken from gpgsm. Signed-off-by: Werner Koch <[email protected]>
* gpg: Remove two unused card related functions.Werner Koch2019-04-013-98/+76
| | | | | | * g10/call-agent.c (inq_writekey_parms): Remove. (agent_scd_writekey): Remove. (agent_clear_pin_cache): Remove this stub.
* gpg: Remove unused arg in a card related function.Werner Koch2019-04-014-34/+33
| | | | | | * g10/call-agent.c (agent_scd_setattr): Remove unused arg serialno. Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Better for error code for http status 413.Werner Koch2019-03-293-0/+12
| | | | | | | | | * dirmngr/ks-engine-hkp.c (send_request): New case for 413. * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto. * dirmngr/ocsp.c (do_ocsp_request): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-10 14:05:25 +0000