aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* tkd: Support READCERT command.gniibe/t6364NIIBE Yutaka2023-03-223-36/+91
| | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* Merge branch 'master' into gniibe/t6364NIIBE Yutaka2023-03-2066-495/+1140
|\
| * dirmngr: Add framework to implement a fake CRL feature.Werner Koch2023-03-166-2/+87
| | | | | | | | | | | | | | | | | | * dirmngr/fakecrl.c: New. * dirmngr/dirmngr.h (opt): Add fake_crl. * dirmngr/dirmngr.c (enum cmd_and_opt_values): Add oFakeCRL. (opts): Add "fake-crl" (parse_rereadable_options): Set opt.fake_crl. * dirmngr/server.c (cmd_isvalid): Take care of fakce CRLs.
| * gpgsm: New option --no-pretty-dnWerner Koch2023-03-164-2/+25
| | | | | | | | | | | | | | | | * sm/gpgsm.c (oNoPrettyDN): New. (opts): Add --no-pretty-dn. (main): Implement. * sm/gpgsm.h (opt): Add no_pretty_dn. * sm/certdump.c (gpgsm_es_print_name): Act upon.
| * gpgtar: Do not allow the use of stdout for --status-fdWerner Koch2023-03-151-2/+6
| | | | | | | | | | | | | | | | | | | | | | * tools/gpgtar.c (main): Don't allow logging via the Registry. Forbid using stdout for status-fd in crypt mode. -- Without that check a status output would be mixed up with the input to the internal call of gpg. Using the Registry key to enable logging is very annoying.
| * gpgtar: Print a result status with skiupped files.Werner Koch2023-03-153-10/+69
| | | | | | | | | | | | | | * tools/gpgtar.h (struct tarinfo_s): Add new fields. * tools/gpgtar-extract.c (check_suspicious_name): Add arg info. (extract_regular): Count files. (gpgtar_extract): Print stats.
| * gpg: Delete secret key after "keytocard".Werner Koch2023-03-153-9/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/card-util.c (card_store_subkey): Add arg processed_keys. * g10/keyedit.c (keyedit_menu): Delete secret key. -- This used to work using the gpg-agent: learn we called at "save" time. However, the recent change inhibited the creation of a shadow key by learn if a regular key still exists. Now we do an explicit delete key at save time. This syncs the behaviour with the description of the man page. GnuPG-bug-id: 6378
| * scd,openpgp: Switch key attributes between RSA and ECC in writekey.Werner Koch2023-03-152-6/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/sexputil.c (get_rsa_pk_from_canon_sexp): Also allow private keys. (pubkey_algo_string): Ditto. * scd/app-openpgp.c (do_writekey): Switch key attributes -- The scd WRITEKEY command for OpenPGP cards missed proper support to aautomagically switch key attributes based on the new key. We had this only in GENKEY. GnuPG-bug-id: 6378
| * agent: Make --disable-extended-key-format a dummy option.Werner Koch2023-03-1311-285/+157
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/agent.h (opt): Remove enable_extended_key_format. * agent/gpg-agent.c (enum cmd_and_opt_values): Turn oDisableExtendedKeyFormat and oEnableExtendedKeyFormat into dummy options. * agent/protect.c (do_encryption): Remove arg use_ocb and corresponding code. (agent_protect): Ditto. Change all callers. * agent/findkey.c (agent_write_private_key): Simplify due to the removal of disable-extended-key-format. (write_extended_private_key): Fold into agent_write_private_key. -- This change is related to GnuPG-bug-id: 6386 but should have no visible effect except for the removal of option --disable-extended-key-format.
| * dirmngr: Add command "GETINFO stats".Werner Koch2023-03-108-35/+59
| | | | | | | | | | | | | | | | | | | | | | * dirmngr/server.c (cmd_getinfo): New sub-command "stats". (dirmngr_status_helpf): Allow for a CTRL of NULL. * dirmngr/certcache.c (cert_cache_print_stats): Add arg ctrl and use dirmngr_status_helpf. Adjust all callers. * dirmngr/domaininfo.c (domaininfo_print_stats): Ditto. * sm/certchain.c (ask_marktrusted): Flush stdout before printing the fingerprint.
| * agent: Try to SETREPEATOK if the pinentry supports it.Ben Kibbey2023-03-101-0/+21
| | | | | | | | | | | | | | * agent/call-pinentry.c (agent_get_passphrase): Do SETREPEATOK. (agent_askpin): Ditto. Signed-off-by: Ben Kibbey <[email protected]>
| * dirmngr: Distinguish between "no crl" and "crl not trusted".Werner Koch2023-03-098-12/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/crlcache.h (CRL_CACHE_NOTTRUSTED): New. * dirmngr/crlcache.c (cache_isvalid): Set this status. (crl_cache_cert_isvalid): Map it to GPG_ERR_NOT_TRUSTED. (crl_cache_reload_crl): Move diagnostic to ... * dirmngr/crlfetch.c (crl_fetch): here. * dirmngr/server.c (cmd_isvalid): Map it to GPG_ERR_NOT_TRUSTED. * dirmngr/validate.c (check_revocations): Handle new status. Improve diagnostics. * common/status.c (get_inv_recpsgnr_code): Map INV_CRL_OBJ. * common/audit.c (proc_type_verify): Ditto. -- This avoids repeated loading of CRLs in case of untrusted root certificates.
| * keyboxd: Allow import of v0 certificates.Werner Koch2023-03-081-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * kbx/backend-support.c (be_is_x509_blob): Loose detection. -- Here is a sample v0 cert: -----BEGIN CERTIFICATE----- MIIDAzCCAmwCEQC5L2DMiJ+hekYJuFtwbIqvMA0GCSqGSIb3DQEBBQUAMIHBMQsw CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xPDA6BgNVBAsTM0Ns YXNzIDIgUHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBH MjE6MDgGA1UECxMxKGMpIDE5OTggVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9y aXplZCB1c2Ugb25seTEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazAe Fw05ODA1MTgwMDAwMDBaFw0yODA4MDEyMzU5NTlaMIHBMQswCQYDVQQGEwJVUzEX MBUGA1UEChMOVmVyaVNpZ24sIEluYy4xPDA6BgNVBAsTM0NsYXNzIDIgUHVibGlj IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHMjE6MDgGA1UECxMx KGMpIDE5OTggVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1c2Ugb25s eTEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazCBnzANBgkqhkiG9w0B AQEFAAOBjQAwgYkCgYEAp4gBIXQs5xoD8JjhlzwPIQjxnNuX6Zr8wgQGE75fUsjM HiwSViy4AWkszJkfrbCWrnkE8hM5wXuYuggs6MKEEyyqaekJ9MepAqRCwiNPStjw DqL7MWzJ5m+ZJwf15vRMeJ5t60aG+rmGyVTyssSv1EYcWskVMP8NbPUtDm3Of3cC AwEAATANBgkqhkiG9w0BAQUFAAOBgQByLvl/0fFx+8Se9sVeUYpAmLho+Jscg9ji nb3/7aHmZuovCfTK1+qlK5X2JGCGTUQug6XELaDTrnhpb3LabK4I8GOSN+a7xDAX rXfMSTWqz9iP0b63GJZHc2pUIjRkLbYWm1lbtFFZOrMLFPQS32eg9K0yZF6xRnIn jBJ7xUS0rg== -----END CERTIFICATE-----
| * gpg,gpgsm: New option --log-timeWerner Koch2023-03-084-0/+27
| | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (oLogTime): New. (opts): Add "log-time". (opt_log_time): New var. (main): Implement. * sm/gpgsm.c (oLogTime): New. (opts): Add "log-time". (opt_log_time): New var. (main): Implement.
| * dirmngr: Minor code cleanup in the CRL cache.Werner Koch2023-03-081-10/+25
| | | | | | | | | | | | | | * dirmngr/crlcache.c (INVCRL_TOO_OLD): New. (INVCRL_UNKNOWN_EXTN, INVCRL_GENERAL): New. (open_dir, crl_cache_insert): Use the new constants. (list_one_crl_entry): Make diagnostics robust for new INVCRL codes.
| * gpgsm: Strip trailing zeroes from detached signatures.Werner Koch2023-03-085-7/+120
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/ksba-io-support.c: Include tlv.h (struct reader_cb_parm_s): Add new fields. (starts_with_sequence): New. (simple_reader_cb): Handle stripping. * common/ksba-io-support.h (GNUPG_KSBA_IO_STRIP): New. (gnupg_ksba_create_reader): Handle the new flag. * sm/verify.c (gpgsm_verify): Use the new flag for detached signatures. -- Note that this works only if --assume-binary is given. The use case for the feature is PDF signature checking where the PDF specs require that the detached signature is padded with zeroes.
| * scd: Fix checking memory allocation.NIIBE Yutaka2023-03-081-1/+1
| | | | | | | | | | | | | | | | * scd/app-openpgp.c (read_public_key): Fix the memory. -- Signed-off-by: NIIBE Yutaka <[email protected]>
| * doc: Typo fixes and new notes in DETAILSWerner Koch2023-03-032-1/+7
| | | | | | | | --
| * gpg: Actually encrypt to ADSKs.Werner Koch2023-03-013-14/+39
| | | | | | | | | | | | | | | | * g10/getkey.c (get_pubkey_fromfile): Add optional arg r_keyblock. * g10/pkclist.c (find_and_check_key): Also encrypt to RENC subkeys. -- GnuPG-bug-id: 6395
| * gpg: Allow adding of Additional Decryption Subkeys.Werner Koch2023-03-0113-78/+280
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/free-packet.c (copy_public_key): Factor some code out to ... (copy_public_key_basics): new. * g10/build-packet.c (build_sig_subpkt_from_sig): New arg signhints. * g10/packet.h (PUBKEY_USAGE_RENC): Fix value. (SIGNHINT_KEYSIG, SIGNHINT_SELFSIG): Moved from sign.c. (SIGNHINT_ADSK): New. (PKT_public_key): Change pubkey_usage from byte to u16. (PKT_user_id): Cosmetic fix: change help_key_usage from int to u16. * g10/getkey.c (parse_key_usage): Make public. * g10/misc.c (openpgp_pk_algo_usage): Take PUBKEY_USAGE_RENC in account. * g10/sign.c (update_keysig_packet): Set SIGNHINT_ADSK. (make_keysig_packet): Ditto. (do_sign): No time warp check in ADSK mode. * g10/sig-check.c (check_signature_metadata_validity): Ditto. * g10/keygen.c (struct opaque_data_usage_and_pk): Remove. (write_keybinding): Do not use the removed struct. (do_add_key_flags): Support PUBKEY_USAGE_RENC and others. (keygen_add_key_flags_and_expire): Rewrite and make public. * g10/keyedit.c (enum cmdids): Add cmdADDADSK. (keyedit_menu): Add command "addadsk". (menu_addadsk): New. -- This makes use of a new encryption flag: The "restricted encryption key" (2nd,0x04) does not take part in any automatic selection of encryption keys. It is only found on a subkey signature (type 0x18), one that refers to the key the flag applies to. Followup patches will add encryption support and a --quick command. GnuPG-bug-id: 6395
| * agent: Show "no secret key" instead of "card removed".Werner Koch2023-03-012-4/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/findkey.c (agent_key_from_file): Check the error of read_key_file again. * agent/pkdecrypt.c (agent_pkdecrypt): Restore error if no card was found. Also remove useless condition. -- The first patch fixes a likely merge error. The second is about the actual return code: If we have no smardcard but simply try to decrypt with the current smartcard we should return the originla error code. GnuPG-bug-id: 5170 Fixes-commit: eda3c688fc2e85c7cd63029cb9caf06552d203b4
| * gpgconf: Print some standard envvars with -XWerner Koch2023-02-281-0/+10
| | | | | | | | | | | | | | | | | | * tools/gpgconf.c (show_configs): Add a list of envvars and print them. -- Note that for simplicity we to not distinguish between Windows and Linux here.
| * gpgsm: Improve cert lookup callback from dirmngr.Werner Koch2023-02-263-5/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * sm/gpgsm.h (FIND_CERT_ALLOW_AMBIG): New. (FIND_CERT_WITH_EPHEM): New. * sm/certlist.c (gpgsm_find_cert): Replace arg allow_ambiguous by a generic flags arg. Implement the new flag FIND_CERT_WITH_EPHEM. * sm/call-dirmngr.c (inq_certificate): Return also ephemeral marked certs. -- The dirmngr may need to get a certificate from gpgsm's store in the course of verifying a CRL. In some cases the certificate is still marked as epehemeral - this needs to be returned as well. This _may_ also fix GnuPG-bug-id: 4436
| * sm: Fix dirmngr loadcrl for intermediate certsAndre Heinecke2023-02-241-2/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | * sm/call-dirmngr.c (run_command_inq_cb): Support ISTRUSTED. (inq_certificate): Distinguish unsupported inquiry error. -- When loading a CRL through "gpgsm --call-dirmngr loadcrl foo" dirmngr can ask gpgsm back if a certificate used ISTRUSTED, which previously resulted in an error. (cherry picked from commit 6b36c16f77722d17f4f317c788701cbc1e9552b2) That commit was from the 2.2 branch and we forgot to forward port it.
| * doc: Minor comment fixes.Werner Koch2023-02-232-2/+3
| | | | | | | | --
| * dirmngr: New debug flag "keeptmp".Werner Koch2023-02-232-1/+4
| | | | | | | | | | | | | | | | | | * dirmngr/dirmngr.c (debug_flags): Add "keeptmp". (set_debug): Don't set in with "guru". * dirmngr/dirmngr.h (DBG_KEEPTMP_VALUE): New. -- Note that flag is not yet used.
| * gpg: Prepare to accept shorter OIDs for ed25519 and cv25519.Werner Koch2023-02-211-6/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/openpgp-oid.c (oidtable): Add them. (oid_ed25519_v5, oid_cv25519_v5): New. (openpgp_oidbuf_is_ed25519): Take new OID in account. (openpgp_oidbuf_is_cv25519): Ditto. -- ed25519 is used in GnuPG and other implementations since 2015 and thus we can't simply switch to the shorter OIDs. However, we have not widely used them with v5 keys (only ed448 forced the use of v5) and thus it might be possible to use the new OIDs with v5 keys. Note that Libgcrypt supports the new OIDs even in 1.8.
* | agent: Add TKD command support.NIIBE Yutaka2023-03-204-1/+185
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | tkd: Fix PKSIGN.NIIBE Yutaka2023-03-201-6/+2
| | | | | | | | | | | | Clean up confusion of hashing. Signed-off-by: NIIBE Yutaka <[email protected]>
* | tkd: Add RESTART command.NIIBE Yutaka2023-03-201-0/+20
| | | | | | | | | | | | | | | | | | It will be useful, when TKDaemon will maintain a context for a connection. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* | agent: Fix diverting to TKDaemon.NIIBE Yutaka2023-03-176-45/+75
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | tkd: Fix RSA PKSIGN.NIIBE Yutaka2023-03-171-0/+5
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | Fix PKSIGN to get data by EXTRA.NIIBE Yutaka2023-03-172-1/+21
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | tkd: Implement READKEY, returning canon SEXP.NIIBE Yutaka2023-03-171-0/+11
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | tkd: sorted out entities and initialize PKCS#11 on demand.NIIBE Yutaka2023-03-173-89/+135
| | | | | | | | | | | | | | | | | | | | | | | | | | tkd: host side process which manages KEYs on TOKENs It's a KEYGRIP which identifies a KEY. it's TKD which administrates: where is a KEY on which TOKEN. cryptoki (ck): access object of PKCS#11 API. CRYPTOKI has slots. token: abstraction of a device. Each slots has slot_id. Slot_id corresponds a TOKEN. 1:1 map between slot_id and TOKEN. KEY: TOKEN may have multiple KEYs. Signed-off-by: NIIBE Yutaka <[email protected]>
* | tkd: Fix for rescanning the slot list.NIIBE Yutaka2023-03-163-78/+169
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | tkd: Check CKF_TOKEN_PRESENT, too.NIIBE Yutaka2023-03-151-0/+1
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | tkd: Implement finalizer.NIIBE Yutaka2023-03-153-8/+113
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | agent: Add oTkdaemonProgram.NIIBE Yutaka2023-03-132-2/+7
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | agent: Call TKDaemon READKEY command.NIIBE Yutaka2023-03-106-22/+117
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | agent: Add divert to tkdaemon.NIIBE Yutaka2023-03-094-0/+237
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | Implement READKEY command.NIIBE Yutaka2023-03-083-148/+60
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | Add login feature.NIIBE Yutaka2023-03-061-5/+27
| | | | | | | | | | | | Tested with YKCS#11 ECDSA and SoftHSM2 RSA. Signed-off-by: NIIBE Yutaka <[email protected]>
* | Use two-phase sign to match PKCS#11 API.NIIBE Yutaka2023-03-061-37/+73
| | | | | | | | | | | | Tested Scute for RSA and ECDSA. Signed-off-by: NIIBE Yutaka <[email protected]>
* | Fix the length of ECDSA.NIIBE Yutaka2023-03-061-1/+14
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | Fix keygrip computation.NIIBE Yutaka2023-03-031-1/+1
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | Fix listing keys.NIIBE Yutaka2023-03-032-55/+89
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | Implement token_keyinfo.NIIBE Yutaka2023-03-033-8/+114
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | Add key->flags member.NIIBE Yutaka2023-03-031-14/+43
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
* | Fix assuan context things.NIIBE Yutaka2023-03-034-135/+28
| | | | | | | | Signed-off-by: NIIBE Yutaka <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-10 20:10:15 +0000