aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* agent: Use SHA-256 for SSH fingerprint by defaultWerner Koch2021-05-121-2/+2
| | | | | | | | | | | * agent/gpg-agent.c (parse_rereadable_options): Change default ssh fingerprint digest. (main): Ditto. -- Co-authored-by: Jakub Jelen <[email protected]> GnuPG-bug-id: 5434 Signed-off-by: Werner Koch <[email protected]>
* A few minor code cleanups and typo fixes.Werner Koch2021-05-116-5/+10
| | | | | | | | | | * agent/command-ssh.c (ssh_handler_request_identities): Remove double check of ERR. * g10/getkey.c (get_pubkey_byname): Remove double use of break. * g10/pkglue.c (pk_encrypt): Handle possible NULL-ptr access due to failed malloc. Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix allocation for EXTRAHASH.NIIBE Yutaka2021-05-111-1/+1
| | | | | | | | | * g10/sign.c (clearsign_file): Fix the size to allocate. -- GnuPG-bug-id: 5430 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Serialize READER_TABLE access for PC/SC.NIIBE Yutaka2021-05-111-15/+19
| | | | | | | | | | | | | * scd/apdu.c (apdu_dev_list_start): Remove locking READER_TABLE_LOCK. Don't increment PCSC.COUNT here. (apdu_dev_list_finish): Don't decrement PCSC.COUNT here. (apdu_open_reader): Protect access with READER_TABLE_LOCK. -- GnuPG-bug-id: 5416 Fixes-commit: 8d81fd7c01e8dfacc719ff190f8e364014e32fdf Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Fix close_pcsc_reader.NIIBE Yutaka2021-05-101-9/+9
| | | | | | | | | | | * scd/apdu.c (close_pcsc_reader): Don't touch .RDRNAME field. (apdu_dev_list_finish): Clear .RDRNAME field and replace call of close_pcsc_reader by release_pcsc_context. Add assertion. -- GnuPG-bug-id: 5416 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Make sure releasing PC/SC context.NIIBE Yutaka2021-05-101-6/+16
| | | | | | | | | | | | * scd/apdu.c (release_pcsc_context): New. (close_pcsc_reader): Use release_pcsc_context. Add assertion. (apdu_dev_list_start): Replace call of close_pcsc_reader into release_pcsc_context, add condition. -- GnuPG-bug-id: 5416 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Increment PCSC.COUNT correctly.NIIBE Yutaka2021-05-071-2/+2
| | | | | | | | | * scd/apdu.c (open_pcsc_reader): PCSC.COUNT should be incremented before possible call of close_pcsc_reader. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Fix memory leak for RDRNAME and serialize access.NIIBE Yutaka2021-05-071-2/+6
| | | | | | | | | | * scd/apdu.c (close_pcsc_reader): Move locking to... (apdu_close_reader): ... here, as it's also needed for CCID driver. Free RDRNAME when closed. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Fix declarations for PC/SC access.NIIBE Yutaka2021-05-061-2/+2
| | | | | | | | * scd/apdu.c (pcsc_begin_transaction, pcsc_transmit): Use HANDLE. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Recover the partial match for PORTSTR for PC/SC.NIIBE Yutaka2021-05-061-1/+2
| | | | | | | | | * scd/apdu.c (apdu_open_reader): Allow partial match of PORTSTR again just like 2.2 does. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: When reader is specified, make sure only open once.NIIBE Yutaka2021-05-061-0/+5
| | | | | | | | | * scd/apdu.c (apdu_open_reader): Make sure not to try multiple times, when PORTSTR is specified. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Fix PC/SC removed card problemWerner Koch2021-04-291-0/+11
| | | | | | | | | | | * scd/apdu.c (pcsc_cancel): New. (pcsc_init): Load new function. (connect_pcsc_card): Use it after a removed card error. -- Well, that was easier than I expected yesterday. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Fix the name of a card.Werner Koch2021-04-281-1/+1
| | | | --
* scd: Fix problem with reader list becoming empty.Werner Koch2021-04-282-22/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/apdu.c (close_pcsc_reader): Do not decrement refcount if already zero. Always release context if or becomes zero. (apdu_dev_list_start): Unlock prior to close_pcsc_reader. For PC/SC increment the count. Always release the lock. (apdu_dev_list_finish): No more unlocking. Use close_pcsc_reader instead of code duplication. * scd/apdu.c (pcsc_error_string): Add an error code. * scd/scdaemon.c (scd_kick_the_loop): Fix a diagnostic. -- There was an obvious bug in that the pcsc.count could go below zero and thus there was no chance to get the context release. Releasing and recreating the context is at least under Windows important to get rit of the PCSC_E_SERVICE_STOPPED. Also removes a potential problem in holding the reader_table_lock between calls to apdu_dev_list_start apdu_dev_list_finish. There is no need for this. Instead we bump the pcsc.count. The reader_table_lock strategy should be reviewed; we may be able to remove it. Signed-off-by: Werner Koch <[email protected]>
* build: Allow running sign-release target from the dist dir.Werner Koch2021-04-281-1/+1
| | | | | | | -- This is a kludge to avoid a new configure run only to then cd down do dist. Just cd to dist and run make sign-release.
* scd: Fix unblock PIN by a Reset Code with KDF.Kirill Elagin2021-04-271-1/+1
| | | | | | | | | | * scd/app-openpgp.c (do_change_pin): Use correct CHVNO=1 for pin2hash_if_kdf, for user's PIN. -- GnuPG-bug-id: 5413 Signed-off-by: Kirill Elagin <[email protected]>
* gpg: Fix mailbox based search via AKL keyserver method.Werner Koch2021-04-265-13/+11
| | | | | | | | | | | | | | | | | * g10/keyserver.c (keyserver_import_name): Rename to ... (keyserver_import_mbox): this. And use mail search mode. * g10/getkey.c (get_pubkey_byname): Change the two callers. -- In contrast to a search via keyserver_import_ntds the older keyserver_import_name used a full match of the provided name despite that it is only called with an addr-spec (mbox). Due to the mode the pattern send to dirmngr was prefixed with a '=' and thus dirmngr used an exact search;. This did only work for provided user ids like "[email protected]" but not for "<[email protected]>" or "Foo <[email protected]>". The old code dates back to 2010. Signed-off-by: Werner Koch <[email protected]>
* gpg: Do not use import-clean for LDAP keyserver imports.Werner Koch2021-04-263-8/+23
| | | | | | | | | | | | | | | * g10/options.h (opts): New field expl_import_only. * g10/import.c (parse_import_options): Set it. * g10/keyserver.c (keyserver_get_chunk): Add special options for LDAP. -- I can be assumed that configured LDAP servers are somehow curated and not affected by rogue key signatures as the HKP servers are. Thus we don't clean the key anymore so that key certifications are kept even if the public key has not yet been imported. See-commit: 6c26e593df51475921410ac97e9227df6b258618 GnuPG-bug-id: 5387
* gpg: Auto import keys specified with --trusted-keys.Werner Koch2021-04-254-7/+47
| | | | | * g10/getkey.c (get_pubkey_with_ldap_fallback): New. * g10/trustdb.c (verify_own_keys): Use it.
* scd:p15: Fix last commit and improve D-TRUST detection.Werner Koch2021-04-252-8/+19
| | | | | | | | * scd/app-p15.c (read_p15_info): Improve D-TRUST card detection. (do_getattr): Fix faulty code for the last commit. Append the product name to MANUFACTURER. Signed-off-by: Werner Koch <[email protected]>
* scd:p15: Shorten the displayed s/n of RSCS cardsWerner Koch2021-04-251-1/+9
| | | | | | | | | | * scd/app-p15.c (get_dispserialno): Add dedicated handling for RSCS. -- In fact we fix the display of the s/n because the s/n was taken from a certificate. Signed-off-by: Werner Koch <[email protected]>
* gpg: Replace an obsolete trustdb function.Werner Koch2021-04-234-19/+7
| | | | | | | | * g10/trustdb.c (tdb_register_trusted_keyid): Make static. (tdb_register_trusted_key): Replace register_trusted_keyid by tdb_register_trusted_key. * g10/keygen.c (do_generate_keypair): Ditto. * g10/trust.c (register_trusted_keyid): Remove.
* agent,w32: Silence the get_peercred failed diagnosticWerner Koch2021-04-231-1/+6
| | | | --
* doc: Typo fixWerner Koch2021-04-232-5/+5
| | | | --
* gpg: Allow decryption w/o public key but with correct card inserted.Werner Koch2021-04-233-5/+64
| | | | | | | | | | | * agent/command.c (cmd_readkey): Add option --no-data and special handling for $SIGNKEYID and $AUTHKEYID. * g10/call-agent.c (agent_scd_getattr): Create shadow keys for KEY-FPR output. * g10/skclist.c (enum_secret_keys): Automagically get a missing public key for the current card. Signed-off-by: Werner Koch <[email protected]>
* agent: Require verbose level 2 for handler started/terminated notices.Werner Koch2021-04-231-2/+2
| | | | | * agent/gpg-agent.c (do_start_connection_thread): Silence diags even more.
* po: Update Simplified Chinese Translation.bobwxc2021-04-231-22/+16
| | | | | | | -- Reviewed-by: NIIBE Yutaka <[email protected]> Signed-off-by: bobwxc <[email protected]>
* tools: Fix for --disable-tpm2d.NIIBE Yutaka2021-04-231-0/+8
| | | | | | | | | * tools/gpgconf-comp.c: Conditionalize with BUILD_WITH_TPM2D. -- GnuPG-bug-id: 5408 Signed-off-by: NIIBE Yutaka <[email protected]>
* speedo: Automatically select Authenticode signing cert.Werner Koch2021-04-221-1/+1
| | | | | | | | | -- This is required because GlobalSign re-issued the certificate (which actually required to install InternetExploder in addition to Edge) and now we have two certs to select from. The /a option seems to use the latest generated certificate.
* scd: Fix PSO_CSV for 512 bit curvesWerner Koch2021-04-221-6/+20
| | | | | | * scd/iso7816.c (iso7816_pso_csv): Use BER-TLV instead of SIMPLE-TLV Signed-off-by: Werner Koch <[email protected]>
* tests: Make sure that the build keyboxd is used.Werner Koch2021-04-221-0/+1
| | | | | | | * tests/openpgp/defs.scm (create-gpghome): Add keyboxd-program. -- GnuPG-bug-id: 5406
* card: New option --shadow for command list.Werner Koch2021-04-213-29/+50
| | | | | | | * tools/card-call-scd.c (scd_readkey): Add arg create_shadow. * tools/gpg-card.c (list_one_kinfo): Add arg create_shadow and pass it down to scd-readkey. Change all callers to convey this arg. (cmd_list): Add option --shadow.
* agent: Silence error messages for READKEY --cardWerner Koch2021-04-212-6/+9
| | | | | * agent/command.c (cmd_readkey): Test for shadow key before creating it.
* gpg: Allow fingerprint based lookup with --locate-external-key.Werner Koch2021-04-217-46/+181
| | | | | | | | | | | | | | | | | * g10/keyserver.c (keyserver_import_fprint_ntds): New. * g10/getkey.c (get_pubkey_byname): Detect an attempt to search by fingerprint in no_local mode. -- See the man page. For testing use gpg --auto-key-locate local,wkd,keyserver --locate-external-key \ FINGERPRINT with at least one LDAP keyserver given in dirmngr.conf. On Windows "ntds" may be used instead or in addtion to "keyserver". Signed-off-by: Werner Koch <[email protected]>
* keyboxd: Fix searching for exact mail addresses.Werner Koch2021-04-214-4/+21
| | | | | | | | | | | | | | | | | | | * kbx/kbxserver.c (cmd_search): Use the openpgp hack for calling classify_user_id. * kbx/backend-sqlite.c (run_select_statement): Remove angle brackets in exact addrspec mode. * g10/call-keyboxd.c (keydb_search): Do not duplicate the left angle bracket. * sm/keydb.c (keydb_search): Ditto. -- Note that the openpgp hack flag of classify_user_id is actually a misnomer because we actually hack a round a problem in gpgsm. And it is only over there that we don't set it there. In keyboxd the flag should be set. And we need to remove the angle brackets of course because that is how we create the addrspec column values. Signed-off-by: Werner Koch <[email protected]>
* gpg,sm: Ignore the log-file option from common.conf.Werner Koch2021-04-212-14/+1
| | | | | | | | | | | * g10/gpg.c (main): Don't use the default log file from common.conf. * sm/gpgsm.c (main): Ditto. -- That was acutally not intended and contradicts the description in doc/example/common.conf. Signed-off-by: Werner Koch <[email protected]>
* po: Fix typo in German translation.Ingo Klöcker2021-04-201-1/+1
| | | | --
* Post release updatesWerner Koch2021-04-202-1/+8
| | | | --
* Release 2.3.1gnupg-2.3.1Werner Koch2021-04-201-2/+27
|
* po: Auto updateWerner Koch2021-04-2025-0/+100
| | | | --
* po: Update German translation.Werner Koch2021-04-201-13/+14
| | | | --
* Support log-file option from common.conf for all daemon.Werner Koch2021-04-204-5/+97
| | | | | | | | | | | | | | | | * agent/gpg-agent.c: Include comopt.h. (main): Read log-file option from common.conf. (reread_configuration): Ditto. * dirmngr/dirmngr.c: Include comopt.h. (main): Read log-file option from common.conf. (reread_configuration): Ditto. * kbx/keyboxd.c: Include comopt.h. (main): Read log-file option from common.conf. (reread_configuration): Ditto. * scd/scdaemon.c: Include comopt.h. (main): Read log-file option from common.conf. Signed-off-by: Werner Koch <[email protected]>
* gpgconf: Fix a diagnostic output.Werner Koch2021-04-202-2/+5
| | | | | | | * tools/gpgconf-comp.c (gc_component_launch): Fix diagnostic. * doc/examples/common.conf: Fix example. Signed-off-by: Werner Koch <[email protected]>
* sm: New command --show-certsWerner Koch2021-04-204-0/+120
| | | | | | | | | | | | | | | * sm/keylist.c (do_show_certs): New. (gpgsm_show_certs): New. * sm/gpgsm.c (aShowCerts): New. (opts): Add --show-certs. (main): Call gpgsm_show_certs. -- I have been using libksba test programs for countless times to look at certificates and I always wanted to add such a feature to gpgsm. This is simply much more convenient. Signed-off-by: Werner Koch <[email protected]>
* build: Fix build problems on macOS for gpgsm tests and gpg-card.Werner Koch2021-04-192-1/+2
| | | | | | | | | * tools/gpg-card.c: Include ctype.h. * sm/Makefile.am (t_common_ldadd): Add LIBICONV. -- GnuPG-bug-id: 5400 Signed-off-by: Werner Koch <[email protected]>
* build: Allow selection of TSS library.Damien Goutte-Gattat via Gnupg-devel2021-04-191-2/+18
| | | | | | | | | | | | | | | | | | | * configure.ac: New option --with-tss to force the use of a specific TSS library. -- While most systems will probably have only one of the two TPM libraries that we support (the IBM TSS or the Intel TSS), it would still be helpful to allow which one to use in the event that both are detected, instead of always using the IBM one. This patch does that by adding a --with-tss=TSS configure-time option, where TSS can be "ibm", "intel", or "autodetect". The default value is "autodetect", which triggers the original behavior (i.e. try to detect both libraries, and prefer the IBM one if both are found). Signed-off-by: Damien Goutte-Gattat <[email protected]>
* gpg: Fix showpref to list AEAD feature.Damien Goutte-Gattat via Gnupg-devel2021-04-191-1/+1
| | | | | | | | | | | * g10/keyedit.c (show_prefs): Show 'AEAD' if flags.aead is set. -- The terse 'pref' command in the key editor correctly shows '[aead]' if the uid->flags.aead is set, but the more verbose 'showpref' command does not, due to an inverted condition check. Signed-off-by: Damien Goutte-Gattat <[email protected]>
* doc: Fix an example in README.ldapWerner Koch2021-04-191-1/+1
| | | | --
* gpg,gpgsm: Move use-keyboxd to the new conf file common.confWerner Koch2021-04-1914-10/+296
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/comopt.c, common/comopt.h: New. * common/Makefile.am: Add them. * g10/gpg.c: Include comopt.h. (main): Also parse common.conf. * sm/gpgsm.c: Include comopt.h. (main): Set a flag for the --no-logfile option. Parse common.conf. * tools/gpgconf-comp.c (known_options_gpg): Remove "use-keyboxd", add pseudo option "use_keyboxd". (known_pseudo_options_gpg): Add pseudo option "use_keyboxd". (known_options_gpgsm): Remove "use-keyboxd". * tests/openpgp/defs.scm (create-gpghome): Create common.conf. * doc/examples/common.conf: New. -- Note that --use-keybox still works but prints a warning. We will eventually remove this option becuase it was marked as an experimental feature anyway. It would be too confusing if gpg and gpgsm use different key storages. Further, other components (e.g. dirmngr or gpg-wks-client) which call gpg or gpgsm need to be aware that the keyboxd is used and pass that option on the command line. Now that common.conf is always read (even if --no-options is used) those tools will work instantly.
* gpg: Lookup a missing public key of the current card via LDAP.Werner Koch2021-04-1611-41/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/getkey.c (get_seckey_default_or_card): Lookup a missing public key from the current card via LDAP. * g10/call-dirmngr.c: Include keyserver-intetnal.h. (gpg_dirmngr_ks_get): Rename arg quick into flags. Take care of the new LDAP flag. * g10/keyserver-internal.h (KEYSERVER_IMPORT_FLAG_QUICK): New. Replace the use of the value 1 for the former quick arg. (KEYSERVER_IMPORT_FLAG_LDAP): New. * g10/keyserver.c (keyserver_get_chunk): Increase the reserved line length. * dirmngr/ks-action.c (ks_action_get): Add arg ldap_only. * dirmngr/server.c (cmd_ks_get): Add option --ldap. -- This change makes it easy to start working with gnupg: Just insert the smartcard or token provided to you and the first time you sign a message the public key associated with the current card will be imported and everything is set without any configuration. This works only with an LDAP directory because it can be expected that the public key has been put into the LDAP during card personalization. Of course an LDAP server needs to be configured; in a Windows AD domain this can be a mere "keyserver ldap:///" in dirmngr.conf. Other configured keyservers are ignored. Requirements for the card driver: The $SIGNKEYID attribute must exists and a query for the KEY-FPR attribute needs to return the OpenPGP fingerprint for that key. This is currently supported for OpenPGP cards and certain PKCS#15 cards. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-20 16:51:27 +0000