aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* card: Remove command "key-attr" and hack on "generate".Werner Koch2020-02-103-398/+203
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * tools/gpg-card.h (struct key_attr): Remove. (struct key_info_s): Remove key_attr. Add keyalgo and keyalgo_id. * tools/card-call-scd.c (learn_status_cb): Rework the key-attr info. * tools/gpg-card.c (list_one_kinfo): Always show the algorithm; if there is no key show the key attributes instead. (list_openpgp): Do not print the "Key attributes". (generate_key): Factor the repalce key pormpt out to ... (ask_replace_keys): new. (generate_openpgp): Rename to generate_all_openpgp_card_keys and add an algo parameter. (generate_generic): Rename to generate_key. Prepare generation of a single OpenPGP key. (cmd_generate): Revamp. (ask_card_rsa_keysize): Remove. (ask_card_keyattr): Remove. (do_change_keyattr): Remove. (cmd_keyattr): Remove. (enum cmdids): Remove cmdKEYATTR. (cmds): Ditto. (dispatch_command): Ditto. (interactive_loop): Ditto. -- This change shows the key attributes of an OpenPGP card instead of the key's algorithm if no key exists. It also remove the key-attr command because for uniformity it is better to do this directly in scd/app-openpgp.c At least for this new gpg-card tool. There a couple of other changes but to the generate command but they are not yet ready. Signed-off-by: Werner Koch <[email protected]>
* scd:openpgp: Let the genkey function also accept a full keyref.Werner Koch2020-02-092-4/+13
| | | | | | | | | | | * scd/app-openpgp.c (send_key_attr): Use log_assert. (do_genkey): Allow prefix. -- It is more uniform to always use full keyref (e.g. "OPENPGP.1") instead of just the key number. Signed-off-by: Werner Koch <[email protected]>
* common: Extend the new get_keyalgo_string functionWerner Koch2020-02-092-5/+29
| | | | | | | | | | | | * common/openpgp-oid.c (openpgp_oid_or_name_to_curve): New. (get_keyalgo_string): Use it. -- We do not always have an OID, so except the name or the alias of the curve as well. This creates a second entry mapping to the same name but that does not matter. Signed-off-by: Werner Koch <[email protected]>
* common: Remove duplicated call to a function.Werner Koch2020-02-091-1/+0
| | | | | | | | | | * common/openpgp-oid.c (openpgp_oid_to_str): Remove duplicated call. -- The removed function was already called. No memleak etc, though. Fixes-commit: 4a1558d0c7190cf13d35385e47291a7aa121be3e Signed-off-by: Werner Koch <[email protected]>
* common: New function get_keyalgo_string.Werner Koch2020-02-094-3/+198
| | | | | | | | | | | | | | | | | * common/openpgp-oid.c (struct keyalgo_string_s): New. (keyalgo_strings): New. (keyalgo_strings_size, keyalgo_strings_used): New. (get_keyalgo_string): New. -- This function is intended as a more general version of gpg's pubkey_string function. It has the advantage to avoid mallocs and uses static table of algorithm strings instead. There should be only a few dozen of such strings (if at all) and thus all those allocations we do internally in gpg's pubkey_string and the static buffers all over the place are not too nice. Signed-off-by: Werner Koch <[email protected]>
* common: Add OpenPGP<->Gcrypt pubkey id mapping functions.Werner Koch2020-02-095-21/+41
| | | | | | | | | * g10/misc.c (map_pk_gcry_to_openpgp): Move to ... * common/openpgp-oid.c (map_gcry_pk_to_openpgp): here and rename. Change all 4 callers. (map_openpgp_pk_to_gcry): New. Signed-off-by: Werner Koch <[email protected]>
* card: Support brainpool curves in the generate command.Werner Koch2020-02-091-11/+26
| | | | | | | * tools/gpg-card.c (cmd_generate): Add brainpool curves and dummy name "help". Signed-off-by: Werner Koch <[email protected]>
* sm: New option --issuer-der for the listkey commands.Werner Koch2020-02-031-7/+73
| | | | | | | | | | | | | | | | | | | | | * sm/server.c (do_listkeys): Implement new option. -- This option can be used by clients who can only provide a DER encoded form of the issuer. For example in PKCS#11 providers. Testing: Put the DER encoded issuer DN into a file, say issuer.der. The run gpg-connect-agent -E -- gpgsm --server > /definqfile ISSUER_DER issuer.der > list-keys --issuer-der 01020304 and if the local keyring has a certifictate with that issuer and a s/n of 0x01020304 that certificate will be listed. Signed-off-by: Werner Koch <[email protected]>
* card: Add new OpenPGP card vendor.Werner Koch2020-01-282-0/+2
| | | | | | -- Signed-off-by: Werner Koch <[email protected]>
* dirmngr: Fix building w/o LDAP supportWerner Koch2020-01-211-0/+6
| | | | | | * dirmngr/Makefile.am: Conditionally build dirmngr_ldap. Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix printing of keyring name (regression in master)Werner Koch2020-01-211-1/+1
| | | | | | | | * g10/keydb.c (keydb_get_resource_name): -- Fixes-commit: aba82684fe14289cf62b4694bc398f3a274b4762 Signed-off-by: Werner Koch <[email protected]>
* card: Add new OpenPGP card vendorWerner Koch2020-01-212-0/+2
| | | | --
* build: Require libgpg-error 1.37Werner Koch2020-01-212-2/+2
| | | | --
* tools: Let watchgnupg determine the socket name via gpgconf.Werner Koch2020-01-202-26/+159
| | | | | | | | | | | | | | * tools/watchgnupg.c: Include sys/wait.h. (GNUPG_DEF_COPYRIGHT_LINE): Add a default value for standalone building. (get_logname): New. (main): Use a default socket name and add option --homedir. -- This is quite convenient and saves a lot of typing or shell alias definitions. Signed-off-by: Werner Koch <[email protected]>
* gpgconf,w32: Print a warning for a suspicious homedir.Werner Koch2020-01-172-0/+17
| | | | | | | | * tools/gpgconf.c (list_dirs): Check whether the homedir has been taken from the registry. -- Signed-off-by: Werner Koch <[email protected]>
* gpg: Prefer card key on use in multiple subkeys situation.NIIBE Yutaka2020-01-172-42/+80
| | | | | | | | | | | | | * g10/call-agent.c (keyinfo_status_cb): Parse more fields. (agent_probe_secret_key): Use KEYINFO and returns bigger value representing the preference. * g10/getkey.c (finish_lookup): For subkeys, select one by using value of agent_probe_secret_key. -- GnuPG-bug-id: 3416 Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Prepare enhancement of agent_probe_secret_key.NIIBE Yutaka2020-01-178-26/+32
| | | | | | | | | | | | | | | | | | | * g10/call-agent.c (agent_probe_secret_key): Change semantics of return value. * g10/call-agent.h (agent_probe_secret_key): Change comment. * g10/delkey.c (do_delete_key): Follow the change. * g10/getkey.c (get_seckey, parse_def_secret_key): Likewise. (finish_lookup, have_secret_key_with_kid): Likewise. * g10/gpgv.c (agent_probe_secret_key): Likewise. * g10/keyedit.c (keyedit_menu, quick_find_keyblock): Likewise. (show_key_with_all_names_colon): Likewise. * g10/revoke.c (gen_desig_revoke, gen_revoke): Likewise * g10/test-stubs.c (agent_probe_secret_key): Likewise. -- GnuPG-bug-id: 3416 Signed-off-by: NIIBE Yutaka <[email protected]>
* card: Allow switching of cards and applications.Werner Koch2020-01-163-24/+193
| | | | | | | | | | | | | | | | | | | | | * tools/card-call-scd.c (struct card_cardlist_parm_s): Add field with_apps. (card_cardlist_cb): Handle the new with_apps flag. (scd_switchcard): New. (scd_switchapp): New. (scd_applist): New. (scd_serialno): Pass --all also in --demand mode. * tools/gpg-card.c (cmd_list): Simplify switching of cards. Add switching of alls. Print a list of apps per card. -- Note that the output format of "list --card" slightly changes: The current card is indicated with an asterisk. That should not harm any robust parsers which might already be in use. It is anyway a development version. Signed-off-by: Werner Koch <[email protected]>
* scd: New commands SWITCHCARD and SWITCHAPP.Werner Koch2020-01-163-13/+262
| | | | | | | | | | | | | | | | | | | | * scd/app.c: Include membuf.h. (app_switch_current_card): New. (send_card_and_app_list): Factor code out to ... (send_serialno_and_app_status): new. (app_send_card_list): New. (app_send_active_apps): New. (app_switch_active_app): New. * scd/command.c (cmd_switchcard): New. (cmd_switchapp): New. (register_commands): Register new commands. (cmd_getinfo): New sub-commands "active_apps" and "all_active_apps". -- These new commands allow to switch between known cards and are in particular useful for the gpg-card tool. Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Remove debug code from a recent commit.Werner Koch2020-01-161-2/+1
| | | | | | | | | | * scd/app-piv.c (ask_and_prepare_chv): here. -- The test code from the last PIV change was accidently kept enabled. Fixes-commit: 2dd6b4b998dd6e156e2e75ede0f40fb768c69f40 Signed-off-by: Werner Koch <[email protected]>
* gpg: Print better debug info in case of broken sig subpackets.Werner Koch2020-01-161-1/+4
| | | | | | | | | | | | | | | | | * g10/parse-packet.c (enum_sig_subpkt): Print a hexdump. -- A test key for this is 02DF08F5FD356BF27F5F7B838921B5DCCD15A883 . A key listing in verbose mode will now yield gpg: DBG: buffer shorter than subpacket (10/9/25);\ dump: 19100d87e54973647cff The error here is that the packet length is 0x19 but what follows is a long keyid (subpacket 16) which is shorter. The debug output might be helpful to better analyze broken signatures. Signed-off-by: Werner Koch <[email protected]>
* gpg: Use "SCD KEYINFO" to get available card keys.NIIBE Yutaka2020-01-161-80/+29
| | | | | | | | | | | | | * g10/skclist.c (enum_secret_keys): Don't use agent_scd_cardlist and agent_scd_serialno, but agent_scd_keyinfo. -- When there are multiple cards/tokens, this change can avoid switching card of foreground access. GnuPG-bug-id: 4784 Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Add agent_scd_keyinfo to retrieve available card keys.NIIBE Yutaka2020-01-162-1/+178
| | | | | | | | * g10/call-agent.c (card_keyinfo_cb, agent_scd_free_keyinfo) (agent_scd_keyinfo): New. * g10/call-agent.h: Define new functions. Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: default-key: Simply don't limit by capability.NIIBE Yutaka2020-01-161-5/+0
| | | | | | | | | | * g10/getkey.c (parse_def_secret_key): Remove the check. -- GnuPG-bug-id: 4810 Fixes-commit: e573e6188dada4d70f6897aa2fda3c3af8c50441 Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Cert only key should be usable with --default-key.NIIBE Yutaka2020-01-151-1/+2
| | | | | | | | | | * g10/getkey.c (parse_def_secret_key): Allow cert-only key. -- GnuPG-bug-id: 4810 Fixes-commit: e573e6188dada4d70f6897aa2fda3c3af8c50441 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Make the PIN cache robust against wrongdoing of gpg-agent.Werner Koch2020-01-132-4/+81
| | | | | | | | | | | | * scd/app-openpgp.c (struct app_local_s): New field pincache. (cache_pin): Set it. (pin_from_cache): Consult it. * scd/app-piv.c (struct app_local_s): New field pincache. (cache_pin): Set it. (pin_from_cache): Consult it. -- Signed-off-by: Werner Koch <[email protected]>
* scd:piv: Implement PIN cache.Werner Koch2020-01-135-29/+100
| | | | | | | | | | | | | | | | | | | | | | * scd/command.c (pincache_put): Add arg pinlen and change all callers to provide it. * scd/app-piv.c (cache_pin): New. (pin_from_cache): New. (ask_and_prepare_chv): Add args no_cache and r_unpaddedpinlen. Take PIN from the cache. Return the unpadded length. (verify_chv): Add arg ctrl. Cache the PIN. (do_change_chv): Clear PIN cache. -- The PIV pins are padded but we want to store the unpadded PIN. Thus the changes to the function. Code has has been tested by commenting the no_cache parameter because we the current test certificate was created for PIV.9C which requires a verification for each use. More testing is required. GnuPG-bug-id: 4791 Signed-off-by: Werner Koch <[email protected]>
* agent: Avoid multiple calls to scd for KEYINFO.Werner Koch2020-01-131-2/+45
| | | | | | | | | | | | | | | | | | | | * agent/command.c (struct server_local_s): Add last_card_keyinfo. (eventcounter): Add maybe_key_change. (cmd_genkey, cmd_scd, cmd_import_key, cmd_delete_key): Bump new counter. (cmd_keyinfo): Cache the keyinfo from the card. (start_command_handler): Release the cache. -- This cache speeds up processing of commands like "gpg -K" because scdaemon does not need to be asked for each key as long as nothing changed with the card. We should have a better notification service from scdaemon to make sure that we get only the relevant events. What we do right now is a bit course but sufficient. Signed-off-by: Werner Koch <[email protected]>
* agent: Replace free by xfree in recently added code.Werner Koch2020-01-131-3/+3
| | | | | | * agent/call-scd.c (agent_card_free_keyinfo): Use xfree. Signed-off-by: Werner Koch <[email protected]>
* gpg,sm: Avoid useless ASFW diagnostic in loopback mode.Werner Koch2020-01-134-0/+39
| | | | | | | | | | | * common/sysutils.c (inhibit_set_foregound_window): New var. (gnupg_inhibit_set_foregound_window): New func. (gnupg_allow_set_foregound_window): Use var. * g10/gpg.c (main): Inhibit in loopback mode. * sm/gpgsm.c (main): Ditto. -- Signed-off-by: Werner Koch <[email protected]>
* scd: Fix memory leak in command READKEY.Werner Koch2020-01-132-3/+9
| | | | | | | * scd/command.c (cmd_readcert): Replace xstrdup by xtrystrdup. (cmd_readkey): Ditto. Fix memory leak. Signed-off-by: Werner Koch <[email protected]>
* scd: Make SERIALNO --all work correctly and use it.Werner Koch2020-01-135-57/+94
| | | | | | | | | | | | | | * scd/app.c (maybe_switch_app): Factor reselect code out to ... (run_reselect): new. (app_write_learn_status): Tweak diagnostics. (app_do_with_keygrip): Run reselect if a card has more than one switchable application. * agent/call-scd.c (agent_card_serialno): Ditto. * tools/card-call-scd.c (start_agent): Use option --all with SERIALNO. (scd_serialno): Ditto. Signed-off-by: Werner Koch <[email protected]>
* agent: handle SSH operation by KEYGRIP.NIIBE Yutaka2020-01-131-86/+15
| | | | | | | | | | * agent/command-ssh.c (card_key_available): Supply KEYINFO argument. Call agent_card_readkey by KEYGRIP of KEYINFO. Don't use $AUTHKEYID, but IDSTR of KEYINFO. (ssh_handler_request_identities): Follow the change of card_key_available. Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Extend agent_card_getattr with KEYGRIP.NIIBE Yutaka2020-01-133-5/+11
| | | | | | | | | | * agent/agent.h (struct card_key_info_s): KEYGRIP null terminated. (agent_card_getattr): Add KEYGRIP argument. * agent/call-scd.c (agent_card_getattr): Handle KEYGRIP argument. (card_keyinfo_cb): Make KEYGRIP null terminated. * agent/command.c (cmd_readkey): Follow the change. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Implement direct access by KEYGRIP for GETATTR and READKEY.NIIBE Yutaka2020-01-102-50/+119
| | | | | | | | | * scd/app-openpgp.c (do_readkey): Handle KEYGRIP access. * scd/command.c (do_readkey): New. (cmd_readkey): Use do_readkey supporting KEYGRIP access. (cmd_getattr): Supporting KEYGRIP access. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:openpgp: Implement PIN cache.Werner Koch2020-01-091-104/+229
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (wipe_and_free, wipe_and_free_string): Use them everywere where we do a wipememory followed by a free. (pin2hash_if_kdf): Change interface. The input PIN is not anymore changed. Further there are no more assumptions about the length of the provided buffer. (cache_pin): Restructure. (chvno_to_keyref): New. (pin_from_cache): New. (verify_a_chv): Add arg CTRL. Adjust for changed pin2hash_if_kdf. Chache and retrieve the PIN here. (verify_chv2): Do not cache the PIN here. (build_enter_admin_pin_prompt): Add arg 'r_remaining'. (verify_chv3): Adjust for changed pin2hash_if_kdf. Implement the PIN cache. (do_change_pin): Clear the PIN cache. Do not change the PIN here. Lots of adjustments to cope with the chnaged pin2hash_if_kdf. (do_sign): Do not cache the PIN here. -- Note that some of the changes are required because we can't rely that the PIN is always cached in secure memory. Thus it is better to do an explicit wipe. Testing the PIN cache can currently only be done my modifying the code to do a verification for each operation. Only some basic testing has been done. Clearing the PIN cache is also not fully implemented. With the forthcoming changes to app-piv we should be enter able to test the PIN cache. Missing stuff: - The agent should be able to selectively clear the cache on a per slot base. - We should replace AESWRAP by OCB. Signed-off-by: Werner Koch <[email protected]>
* scd: Use a scdaemon internal key to protect the PIN cache IPC.Werner Koch2020-01-094-112/+148
| | | | | | | | | | | | | | | | | | | * agent/call-scd.c (handle_pincache_put): Do not decrypt. (handle_pincache_get): New. (inq_needpin): Call it. * scd/command.c (set_key_for_pincache): New. (pincache_put): Restructure and set key. (pincache_get): Ditto. -- This change does away with encrypting and decrypting the cached PIN in the agent. There is no need for this we can simply cache the cryptogram and let scdaemon decrypt after retrieving it from the agent. This way we do not need to share a key between gpg-agent and scdaemon and further the cached content is invalid after the scdaemon process has been replaced. Signed-off-by: Werner Koch <[email protected]>
* agent: SSH: SCD KEYINFO to list available keys.NIIBE Yutaka2020-01-095-116/+39
| | | | | | | | | | | | | | * agent/agent.h (agent_card_cardlist): Remove. (agent_card_keyinfo): Add CAP argument. * agent/call-scd.c (card_cardlist_cb): Remove. (agent_card_cardlist): Remove. (agent_card_keyinfo): Support CAP constraint. * agent/command-ssh.c (card_key_list): Remove. (ssh_handler_request_identities): Use SCD KEYINFO command. * agent/command.c (cmd_keyinfo): Follow the API change. * agent/divert-scd.c (ask_for_card): Likewise. Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: First changes to implement a PIN cache.Werner Koch2020-01-0711-85/+418
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/command.c (pincache_put): New. Uses a dummy key for now. (pincache_get): New. * scd/app.c (select_application): Flush the PIN cache. (scd_update_reader_status_file): Ditto. (maybe_switch_app): Call the new prep_reselect function. (app_write_learn_status): Ditto. * scd/app-openpgp.c (cache_pin): New helper to cache a PIN. (verify_chv2): Call it. (verify_chv3): Call it. (clear_chv_status): Call it. (do_change_pin): Call it. * scd/app-common.h (struct app_ctx_s): Add function 'prep_select'. * scd/app-openpgp.c (do_prep_reselect): New stub function. (app_select_openpgp): Set new stub function. * scd/app-piv.c (do_prep_reselect): New stub function. (app_select_piv): Set new stub function. * scd/app-common.h (struct app_ctx_s): Add parameter ctrl to setattr, sign, auth, decipher, and check_pin. Change all implementations and callers to pass such a parameter. -- This is work in progress. Signed-off-by: Werner Koch <[email protected]>
* agent: First changes to support a PIN cache for scdaemon.Werner Koch2020-01-074-29/+217
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/agent.h (CACHE_MODE_PIN): New. * agent/cache.c (housekeeping): Special handling of new new mode. (agent_flush_cache): Ditto. Add arg 'pincache_only' and change caller. (agent_put_cache): Support new mode. (agent_get_cache): Ditto. * agent/call-scd.c (wait_child_thread): Flush the entire PIN cache. (start_scd): Ditto. (agent_card_killscd): Ditto. (handle_pincache_put): New. Uses a dummy encryption key for now. (pincache_put_cb): New. (inq_needpin): Prepare for PINCACHE_GET inquiry. (learn_status_cb): Handle the PINENTRY_PUT status line. (get_serialno_cb): Ditto (agent_card_pksign): Ditto. (padding_info_cb): Ditto. (agent_card_readcert): Ditto. (agent_card_readkey): Ditto. (agent_card_writekey): Ditto. (card_getattr_cb): Ditto. (card_cardlist_cb): Ditto. (card_keyinfo_cb): Ditto. (pass_status_thru): Ditto. -- Take care: This is not finished. Signed-off-by: Werner Koch <[email protected]>
* kbx: Make sure the tables are joined in a select.Werner Koch2020-01-071-3/+3
| | | | | | | | * kbx/backend-sqlite.c (run_select_statement): Join the tables. -- For whatever reasons that part was missing or got lost before committing.
* scd: Minor fix for readibility.Werner Koch2020-01-033-3/+3
| | | | | | | | | | | | * scd/command.c (open_card_with_request): Use NULL instead of APPTYPE_NULL. -- Using the enum is wrong because a string is expected. However it did harm anything because the value of the enum is 0 and thus equivalent to NULL. Signed-off-by: Werner Koch <[email protected]>
* kbx: Initial support for an SQLite backendWerner Koch2020-01-029-87/+1424
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * kbx/backend-sqlite.c: New. * kbx/Makefile.am (keyboxd_SOURCES): Add it. (keyboxd_CFLAGS, keyboxd_LDADD): Add SQLite flags. * kbx/backend.h (enum database_types): Add DB_TYPE_SQLITE. (be_sqlite_local_t): New typedef. (struct db_request_part_s): Add field besqlite. * kbx/backend-support.c (strdbtype): Add string for DB_TYPE_SQLITE. (be_generic_release_backend): Support SQLite. (be_release_request): Ditto. (be_find_request_part): Ditto. (is_x509_blob): Rename to ... (be_is_x509_blob): this and make global. * kbx/frontend.c (kbxd_set_database): Detect ".db" suffix and use that for SQLite. (kbxd_search): Support SQLite (kbxd_store): Ditto. (kbxd_delete): Ditto. * kbx/frontend.h (kbxd_store_modes): Move to ... * kbx/keyboxd.h (enum kbxd_store_modes): here. * kbx/keyboxd.c (main): USe pubring.db for now. This is a temporary hack. * kbx/backend-kbx.c (be_kbx_delete): Remove unused var cert. -- Take care: This is not finished and in particular filling the database takes quite long. Signed-off-by: Werner Koch <[email protected]>
* Update wk's signing keyWerner Koch2020-01-011-0/+0
| | | | | | -- The expiration time of that smartcard based key has been prolonged by 2 years.
* gpg: Fix output of --with-secret if a pattern is given.Werner Koch2019-12-231-8/+25
| | | | | | | | | | | | | * g10/keylist.c (list_one): Probe for a secret key in --with-secret mode. -- In contrast to list_all(), list_one() did not tests for a secret key and took MARK_TRUSTED verbatim as an indication for "secret key available". GnuPG-bug: 4061 Signed-off-by: Werner Koch <[email protected]>
* doc: Typ fix in commentWerner Koch2019-12-231-1/+1
| | | | --
* kbx: Change keyboxd to work only with one database.Werner Koch2019-12-233-162/+112
| | | | | | | | | | | | | | | | | | * kbx/frontend.c (the_database): New var. (db_desc_t): Remove. (kbxd_add_resource): Renamed to ... (kbxd_set_database): this. Simplify. (kbxd_search): Change to use only one database. (kbxd_store): Ditto. (kbxd_delete): Ditto. -- The original implementation was way to complicated and would have only brought back the problems deciding which database to use for each key. The new scheme used one configured database and only that. That database needs to be set right at the start. Signed-off-by: Werner Koch <[email protected]>
* scd: Enhance KEYINFO command to limit listing with capability.NIIBE Yutaka2019-12-195-35/+79
| | | | | | | | | | | | | | | | | | * scd/app-common.h: Add CAPABILITY argument to the WITH_KEYGRIP. (app_do_with_keygrip): Likewise. * scd/app-openpgp.c (send_keyinfo_if_available): New. (do_with_keygrip): Support listing with CAPABILITY. * scd/app-piv.c (do_with_keygrip): Likewise. * scd/app.c (maybe_switch_app): Supply the argument. (app_do_with_keygrip): Add CAPABILITY argument. * scd/command.c (cmd_pksign, cmd_pkauth): Supply the argument. (cmd_pkdecrypt): Likewise. (cmd_keyinfo): Support listing with CAPABILITY. -- GnuPG-bug-id: 4784 Signed-off-by: NIIBE Yutaka <[email protected]>
* Include release information from 2.2.17 to 2.2.19Werner Koch2019-12-091-1/+121
| | | | --
* sm: Add special case for expired intermediate certificates.Werner Koch2019-12-062-17/+91
| | | | | | | | | | | | | | | | | | | | | | | | | * sm/gpgsm.h (struct server_control_s): Add field 'current_time'. * sm/certchain.c (find_up_search_by_keyid): Detect a corner case. Also simplify by using ref-ed cert objects in place of an anyfound var. -- See the code for a description of the problem. Tested using the certs from the bug report and various command lines gpgsm --faked-system-time=XXXX --disable-crl-checks \ -ea -v --debug x509 -r 0x95599828 with XXXX being 20190230T000000 -> target cert too young with XXXX being 20190330T000000 -> okay with XXXX being 20190830T000000 -> okay, using the long term cert with XXXX being 20220330T000000 -> target cert expired The --disabled-crl-checks option is required because in our a simple test setting dirmngr does not know about the faked time. GnuPG-bug-id: 4696 Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-24 23:31:36 +0000