aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* | g10: Fix find_and_check_key for multiple keyrings.NIIBE Yutaka2017-10-191-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/pkclist.c (find_and_check_key): Call get_validity on a specific keyblock. -- When we have multiple keyrings, get_validity after get_best_pubkey_byname should access same keyring. Or else, the situation of an expired key in keyring A but valid key in keyring B causes SEGV. Thanks to Guido Günther for the use case and the log. Debian-bug-id: 878812 Signed-off-by: NIIBE Yutaka <[email protected]>
* | gpg: Keep a lock during the read-update/insert cycle in import.Werner Koch2017-10-183-3/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/keydb.c (keydb_handle): New field 'keep_lock'. (keydb_release): Clear that flag. (keydb_lock): New function. (unlock_all): Skip if KEEP_LOCK is set. * g10/getkey.c (get_keyblock_byfprint_fast): Call keep_lock if requested. -- That change is straightforward. It helps to avoid the race condition that another gpg process inserts a key while the first process is between the search and the insert. A similar change is due for gpgsm. Note that the key edit operations may still suffer from a race. GnuPG-bug-id: 3446
* | gpg: Improve keydb handling in the main import function.Werner Koch2017-10-183-60/+95
| | | | | | | | | | | | | | | | | | | | * g10/getkey.c (get_pubkey_byfprint_fast): Factor most code out to ... (get_keyblock_byfprint_fast): .. new function. * g10/import.c (revocation_present): s/int rc/gpg_error_t err/. (import_one): Use get_keyblock_byfprint_fast to get the keyblock and a handle. Remove the now surplus keyblock fetch in the merge branch. Signed-off-by: Werner Koch <[email protected]>
* | gpg: Simplify keydb handling of the main import function.Werner Koch2017-10-182-81/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/import.c (import_keys_internal): Return gpg_error_t instead of int. Change var names. (import_keys_es_stream): Ditto. (import_one): Ditto. Use a single keydb_new and simplify the use of of keydb_release. -- Note that this opens a keydb handle before we call get_pubkey_byfprint_fast which internally uses another key db handle. A further patch will cleanup this double use. Note that we also disable the keydb caching for the insert case. The s/int/gpg_error_t/ has been done while checking the call chains of the import functions and making sure that gpg_err_code is always used. Signed-off-by: Werner Koch <[email protected]>
* | gpg: Fix wrong Tofu DB consistency check.Werner Koch2017-10-181-4/+7
| | | | | | | | | | | | | | | | | | | | | | * g10/tofu.c (build_conflict_set): Do not assume MAX_FINGERPRINT_LEN is the size of the fingerprint. -- This problem was exhibited by commit ecbbafb88d920e713439b6b1b8e1b41a6f8d0e38. Signed-off-by: Werner Koch <[email protected]>
* | gpg,sm: New option --with-key-screening.Werner Koch2017-10-1711-5/+358
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/pkscreening.c: New. * common/pkscreening.h: New. * common/Makefile.am (common_sources): Add them. * g10/gpg.c (opts): New option --with-key-screening. * g10/options.h (struct opt): New field with_key_screening. * g10/keylist.c: Include pkscreening.h. (print_pk_screening): New. (list_keyblock_print): Call it. (print_compliance_flags): Call it. * sm/gpgsm.c (opts): New option --with-key-screening. * sm/gpgsm.h (scruct opt): New field with_key_screening. * sm/keylist.c: Include pkscreening.h. (print_pk_screening): New. (print_compliance_flags): Call it. Add new arg cert. (list_cert_colon): Pass arg cert (list_cert_std): Call print_pk_screening. * sm/fingerprint.c (gpgsm_get_rsa_modulus): New. -- This new option can be used to detect ROCA affected keys. To scan an entire keyring and print the affected fingerprints use this: gpg -k --with-key-screening --with-colons | gawk -F: \ '$1~/pub|sub|sec|ssb|crt/ && $18~/\<6001\>/ {found=1;next}; $1=="fpr" && found {print $10}; {found=0}' The same works for gpgsm. Note that we need gawk due to the "\<" in the r.e. Signed-off-by: Werner Koch <[email protected]>
* | sm: Fix colon listing of fields > 12 in crt records.Werner Koch2017-10-171-2/+1
| | | | | | | | | | | | | | | | | | * sm/keylist.c (print_capabilities): Move colon printing ... (list_cert_colon): to here. -- Fixes-commit: 7af008bfe1641938a6c2c995cb065829fa05a693 Signed-off-by: Werner Koch <[email protected]>
* | gpg: Fix comparison.Neal H. Walfield2017-10-061-1/+1
| | | | | | | | | | | | | | * g10/gpgcompose.c (literal_name): Complain if passed zero arguments, not one or fewer. Signed-off-by: Neal H. Walfield <[email protected]>
* | doc: Make --check-sigs more prominent.Werner Koch2017-09-271-39/+42
| | | | | | | | | | | | | | | | | | | | | | -- It seems people are using --list-sigs instead of --check-sigs and do not realize that the signatures are not checked at all. We better highlight the use of --check-sigs to avoid this UI problem. Suggested-by: Andrew Gallagher Signed-off-by: Werner Koch <[email protected]>
* | gpg: Prepare for a longer fingerprintWerner Koch2017-09-278-22/+65
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/card-util.c (change_cafpr): Use MAX_FINGERPRINT_LEN. * g10/cipher.c (write_header): Use snprintf. * g10/gpg.h (MAX_FINGERPRINT_LEN): Change to 32. (MAX_FORMATTED_FINGERPRINT_LEN): Change to 59 * g10/keyid.c (format_hexfingerprint): Add v5 fingerprint format. * g10/tofu.c (get_policy): Use MAX_FINGERPRINT_LEN for the buffer but keep the raw length for now. -- Note that this patch only increases the size of the buffer and adds a new formatting for v5 fingerprints. Moe work is required to fix internal data structures like those in trustdb.gpg and the tofu tables. Signed-off-by: Werner Koch <[email protected]>
* | common: Add constant KEYGRIP_LEN.Werner Koch2017-09-273-4/+9
| | | | | | | | | | | | | | | | * common/util.h (KEYGRIP_LEN): New. * g10/call-agent.c (agent_probe_any_secret_key): Use that constant. * g10/keyid.c (keygrip_from_pk): Ditto. Signed-off-by: Werner Koch <[email protected]>
* | gpg: Let --debug clock time sign and verify.Werner Koch2017-09-274-6/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * configure.ac (ENABLE_LOG_CLOCK): New ac_define and option. * common/logging.c (log_clock): Use ENABLE_LOG_CLOCK to enable timestamp printing. * g10/call-agent.c (agent_pksign): Time signing. * g10/sig-check.c (check_signature_end_simple): Time verification. -- Timing for verification is limited to data signatures because this is the most common thing to evaluate. We should consider to change log_clock to printf style so that we could print the signature class and other info. Signed-off-by: Werner Koch <[email protected]>
* | Merge branch 'STABLE-BRANCH-2-2' into masterWerner Koch2017-09-2615-114/+513
|\| | | | | | | | | | | | | | | | | -- Signed-off-by: Werner Koch <[email protected]> Conflicts: NEWS - include release info from 2.2.1 configure.ac - keep master.
| * po: Remove trailing colon from a German pinentry string.Werner Koch2017-09-261-2/+2
| | | | | | | | --
| * po: Fix German translation.Werner Koch2017-09-241-2/+2
| | | | | | | | | | | | -- Reported-by: engelmarkus
| * Post release updatesWerner Koch2017-09-192-1/+5
| | | | | | | | --
| * Release 2.2.1gnupg-2.2.1Werner Koch2017-09-191-1/+21
| |
| * dirmngr: Use system certs if --hkp-cacert is not used.Werner Koch2017-09-183-1/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * dirmngr/certcache.c (any_cert_of_class): New var. (put_cert): Set it. (cert_cache_deinit): Clear it. (cert_cache_any_in_class): New func. * dirmngr/http-ntbtls.c (gnupg_http_tls_verify_cb): Add hack to override empty list of HKP certs. -- This patch carries the changes for GNUTLS from commit 7c1613d41566f7d8db116790087de323621205fe over to NTBTLS. NTBTLS works quite different and thus we need to do it this way. Signed-off-by: Werner Koch <[email protected]>
| * po: Minor Grammar update of the Greek translationDimitris Maroulidis2017-09-181-7/+8
| | | | | | | | | | | | | | -- GnuPG-bug-id: 3409 Signed-off-by: Werner Koch <[email protected]>
| * wks: Create a new user id if provider wants mailbox-only.Werner Koch2017-09-182-9/+72
| | | | | | | | | | | | | | | | * tools/gpg-wks-client.c (get_key): Add arg 'exact'. (add_user_id): New. (command_send): Create new user id. Signed-off-by: Werner Koch <[email protected]>
| * wks: Send only the newest UID to the server.Werner Koch2017-09-184-22/+158
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * tools/wks-util.c (list_key_status_cb): Rename to key_status_cb. (wks_filter_uid): New. (wks_list_key): Allow FPR to be NULL. Return an error if no fingerprint was found. * tools/gpg-wks-server.c (process_new_key) (check_and_publish): Remove now useless extra check for FPR. * tools/gpg-wks-client.c (command_check): Ditto. (command_send): Filter out the newest uid. -- This fixes the case of having several userids with all the the same mailbox. Now we use the latest user id created. This patch is also a prerequisite to automatically create a new user id for providers with the mailbox-only policy. Signed-off-by: Werner Koch <[email protected]>
| * wks: Print the UID creation time with gpg-wks-client --check.Werner Koch2017-09-183-2/+6
| | | | | | | | | | | | | | | | | | * tools/gpg-wks.h (uidinfo_list_s): Add field 'created'. * tools/wks-util.c (append_to_uidinfo_list): Add arf 'created'. (wks_list_key): Pass timestamp to append_to_uidinfo_list. * tools/gpg-wks-client.c (command_check): Print UID creation time. Signed-off-by: Werner Koch <[email protected]>
| * wks: Use dedicated type to convey user ids.Werner Koch2017-09-184-32/+91
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * tools/gpg-wks.h (uidinfo_list_s, uidinfo_list_t): New. * tools/wks-util.c (append_to_uidinfo_list): New. (free_uidinfo_list): New. (wks_list_key): Change arg r_mboxes to uidinfo_list_t. Use append_to_uidinfo_list. * tools/gpg-wks-server.c (sserver_ctx_s): Replace strlist_t by uidinfo_list_t. (process_new_key): Ditto. (check_and_publish): Ditto. (command_receive_cb): Replace free_strlist by free_uidinfo_list. * tools/gpg-wks-client.c (command_check): Replace strlist_t by uidinfo_list_t. Also print user id in verbose mode. Signed-off-by: Werner Koch <[email protected]>
| * gpgv: Initialize compliance checker.Werner Koch2017-09-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/gpgv.c (main): Call gnupg_initialize_compliance. -- The compliance checker needs to be initialize so that it won't let spit out a "not suitable" message. We use the module name of gpg. Because there is no option to change the compliance mode in gpgv we will always be in the default (CO_GNUPG) mode. It also does not make much sense to have it here because gpgv expects a "curated" keyring. GnuPG-bug-id: 3404 Signed-off-by: Werner Koch <[email protected]>
| * wks: Add hack for the broken posteo systemWerner Koch2017-09-121-2/+18
| | | | | | | | | | | | | | * tools/gpg-wks-client.c (command_send): Additional hack for posteo. Check the protocol-version flag. Signed-off-by: Werner Koch <[email protected]>
| * wks: Add new policy flag protocol-versionWerner Koch2017-09-122-2/+13
| | | | | | | | | | | | | | * tools/gpg-wks.h (policy_flags_s): Add field protocol_version. * tools/wks-util.c (wks_parse_policy): Add new policy flag. Signed-off-by: Werner Koch <[email protected]>
| * gpg: Fix "Fix key generation with only an email part".Werner Koch2017-09-121-1/+1
| | | | | | | | | | | | | | | | | | * g10/keygen.c (proc_parameter_file): Don't check the result of stpcpy. -- Fixes-commit: 7089dcc54099a4909ce7d386c07ab87e1398e2eb Signed-off-by: Werner Koch <[email protected]>
| * wks: Use unencrypted draft-1 mode for posteo.deWerner Koch2017-09-121-39/+81
| | | | | | | | | | | | | | | | | | | | | | | | | | * tools/gpg-wks-client.c (command_send): Allow sending in draft-1 mode. -- Obviously Posteo did not implement the current draft and thus it was not possible to send a request to them. This hack uses the old method for posteo.de. Not sending it encrypted is okay here because they use authenticated sending anyway. Signed-off-by: Werner Koch <[email protected]>
| * tools: New function mime_maker_add_body_data.Werner Koch2017-09-122-1/+14
| | | | | | | | | | | | * tools/mime-maker.c (mime_maker_add_body_data): New. Signed-off-by: Werner Koch <[email protected]>
| * tests: Fix a test which specifies expiration date.NIIBE Yutaka2017-09-111-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * tests/openpgp/quick-key-manipulation.scm: Fix expiration time comparison. -- This is a bug fix for Amelia Earhart who is probably in UTC-12. When expiration date is specified, GnuPG interprets it as noon of the date in local time. Before this fix, the test compared the value by 2145916800 which is 2038-01-01 00:00:00 in UTC with allowance of 1 day. When the test was ran in UTC-12 timezone, it failed because of noon in the timezone is midnight of the next day in UTC. GnuPG-bug-id: 3393 Reported-by: Daniel Kahn Gillmor Signed-off-by: NIIBE Yutaka <[email protected]>
| * scd: Fix for large ECC keys.NIIBE Yutaka2017-09-111-8/+32
| | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (do_decipher): Support larger length. -- Reported-by: Achim Pietig <[email protected]> Signed-off-by: NIIBE Yutaka <[email protected]>
| * gpg: Fix key generation with only an email part.Werner Koch2017-09-111-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/keygen.c (proc_parameter_file): Special case the email only case. -- Using a parameter file like %ask-passphrase key-type: RSA key-length: 2048 key-usage: sign subkey-type: RSA subkey-length: 2048 subkey-usage: encrypt name-email: [email protected] with "gpg --gen-key --patch" the result was this key pub rsa2048 2017-09-11 [SC] 63A8C1BA12CC289A0E8072C971C7F8D4A18CE0BE uid [ultimate] <[email protected]> sub rsa2048 2017-09-11 [E] At least the the extra leading space the left angle bracket is wrong. Further some mail providers reject keys which consist of more than just a plain mail address. Using just a mail address is anyway the new new suggested content for a user id. With this patch the key will be pub rsa2048 2017-09-11 [SC] B302343C20EA6DECDB6A155135352F2520397080 uid [ultimate] [email protected] sub rsa2048 2017-09-11 [E] Signed-off-by: Werner Koch <[email protected]>
| * Post release updatesWerner Koch2017-08-282-1/+5
| | | | | | | | --
* | g10: Select a secret key by checking availability under gpg-agent.NIIBE Yutaka2017-09-261-4/+11
| | | | | | | | | | | | | | | | | | | | | | * g10/getkey.c (finish_lookup): Add WANT_SECRET argument to confirm by agent_probe_secret_key. (get_pubkey_fromfile, lookup): Supply WANT_SECRET argument. -- GnuPG-bug-id: 1967 Signed-off-by: NIIBE Yutaka <[email protected]>
* | agent: Fix cancellation handling for scdaemon.NIIBE Yutaka2017-09-201-41/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/call-scd.c (cancel_inquire): Remove. (agent_card_pksign, agent_card_pkdecrypt, agent_card_writekey) (agent_card_scd): Don't call cancel_inquire. -- Since libassuan 2.1.0, cancellation command "CAN" is handled within the library, by assuan_transact. So, cancel_inquire just caused spurious "CAN" command to scdaemon which resulted an error. Signed-off-by: NIIBE Yutaka <[email protected]>
* | scd: Distinguish cancel by user and protocol error.NIIBE Yutaka2017-09-203-3/+6
| | | | | | | | | | | | | | | | | | | | * scd/apdu.h (SW_HOST_CANCELLED): New. * scd/apdu.c (host_sw_string): Support SW_HOST_CANCELLED. (pcsc_error_to_sw): Return SW_HOST_CANCELLED for PCSC_E_CANCELLED. * scd/iso7816.c (map_sw): Return GPG_ERR_INV_RESPONSE for SW_HOST_ABORTED and GPG_ERR_CANCELED for SW_HOST_CANCELLED. Signed-off-by: NIIBE Yutaka <[email protected]>
* | common: Accept the Z-suffix for yymmddThhmmssZ format.NIIBE Yutaka2017-09-191-3/+6
| | | | | | | | | | | | | | | | | | | | | | * common/gettime.c (isotime_p): Accept the Z suffix. -- The intention is use for human interface. GnuPG-bug-id: 3278 Signed-off-by: NIIBE Yutaka <[email protected]>
* | common: Fix gnupg_wait_processes.NIIBE Yutaka2017-09-191-24/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/exechelp-posix.c (gnupg_wait_processes): Loop for r_exitcodes even if we already see an error. -- The value stored by waitpid for exit code is encoded; It requires decoded by WEXITSTATUS macro, regardless of an error. For example, when one of processes is already exited and another is still running, it resulted wrong value of in r_exitcodes[n]. Signed-off-by: NIIBE Yutaka <[email protected]>
* | sm: Move qualified.txt from datadir into sysconfdirAlon Bar-Lev2017-09-115-18/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * doc/Makefile.am: Move qualified.txt into examples. * doc/qualified.txt: Move into examples, remove trailing spaces. * doc/examples/README: Document qualified.txt. * doc/gpgsm.texi: Move qualified.txt from datadir into sysconfdir. * sm/qualified.c (read_list): Move qualified.txt from datadir into sysconfdir. -- The qualified.txt is maintained by Administrator it is a configuration file. In the past it was a hybrid, provided by package and controlled by the Administrator, however, it is no longer maintained by package. Signed-off-by: Alon Bar-Lev <[email protected]>
* | agent: compile-time configuration of s2k calibration.Daniel Kahn Gillmor2017-09-082-4/+12
| | | | | | | | | | | | | | | | | | | | * configure.ac: add --with-agent-s2k-calibration=MSEC, introduces AGENT_S2K_CALIBRATION (measured in milliseconds) * agent/protect.c (calibrate_s2k_count): Calibrate based on AGENT_S2K_CALIBRATION. Signed-off-by: Daniel Kahn Gillmor <[email protected]> GnuPG-bug-id: 3399
* | gpg: default to AES-256.Daniel Kahn Gillmor2017-09-081-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/main.h (DEFAULT_CIPHER_ALGO): Prefer AES256 by default. -- It's 2017, and pretty much everyone has AES-256 available. Symmetric crypto is also rarely the bottleneck (asymmetric crypto is much more expensive). AES-256 provides some level of protection against large-scale decryption efforts, and longer key lengths provide a hedge against unforseen cryptanalysis. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* | gpg: default to 3072-bit RSA keys.Daniel Kahn Gillmor2017-09-084-10/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/command.c (hlp_genkey): update help text to suggest the use of 3072 bits. * doc/wks.texi: Make example match default generation. * g10/keygen.c (DEFAULT_STD_KEY_PARAM): update to rsa3072/cert,sign+rsa3072/encr, and fix neighboring comment, (gen_rsa, get_keysize_range): update default from 2048 to 3072). * g10/keyid.c (pubkey_string): update comment so that first example is the default 3072-bit RSA. -- 3072-bit RSA is widely considered to be 128-bit-equivalent security. This is a sensible default in 2017. Signed-off-by: Daniel Kahn Gillmor <[email protected]> Gbp-Pq: Topic update-defaults Gbp-Pq: Name 0015-gpg-default-to-3072-bit-RSA-keys.patch
* | gpgsm: default to 3072-bit keys.Daniel Kahn Gillmor2017-09-085-12/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * doc/gpgsm.texi, doc/howto-create-a-server-cert.texi: : update default to 3072 bits. * sm/certreqgen-ui.c (gpgsm_gencertreq_tty): update default to 3072 bits. * sm/certreqgen.c (proc_parameters): update default to 3072 bits. * sm/gpgsm.c (main): print correct default_pubkey_algo. -- 3072-bit RSA is widely considered to be 128-bit-equivalent security. This is a sensible default in 2017. Signed-off-by: Daniel Kahn Gillmor <[email protected]> Gbp-Pq: Topic update-defaults Gbp-Pq: Name 0014-gpgsm-default-to-3072-bit-keys.patch
* | tests: Fix a test which specifies expiration date.NIIBE Yutaka2017-09-081-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * tests/openpgp/quick-key-manipulation.scm: Fix expiration time comparison. -- This is a bug fix for Amelia Earhart who is probably in UTC-12. When expiration date is specified, GnuPG interprets it as noon of the date in local time. Before this fix, the test compared the value by 2145916800 which is 2038-01-01 00:00:00 in UTC with allowance of 1 day. When the test was ran in UTC-12 timezone, it failed because of noon in the timezone is midnight of the next day in UTC. GnuPG-bug-id: 3393 Reported-by: Daniel Kahn Gillmor Signed-off-by: NIIBE Yutaka <[email protected]>
* | scd: Fix for large ECC keys.NIIBE Yutaka2017-08-291-8/+32
| | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (do_decipher): Support larger length. -- Reported-by: Achim Pietig <[email protected]> Signed-off-by: NIIBE Yutaka <[email protected]>
* | Post release updatesgnupg-2.4-basegnupg-2.3-baseWerner Koch2017-08-282-1/+10
|/ | | | --
* Release 2.2.0gnupg-2.2.0Werner Koch2017-08-284-32/+68
|
* po: Auto updateWerner Koch2017-08-282-3/+5
| | | | --
* scd: Convey the correct length for LeWerner Koch2017-08-271-2/+2
| | | | | | | | | | | | | | | | | | | | | * scd/app-openpgp.c (determine_rsa_response): Round bits up. -- Co-authored-by: Arnaud Fontaine <[email protected]> Arnaud wrote: Actually, when the incorrect expected response length (i.e. Le field) is transmitted to the card, the card's answer is missing a byte (i.e. ... 6101) so an additional command has to be sent to the card to retrieve the last byte. Using the correct length avoids to send the additional command to retrieve the missing byte, when the computed length is wrong. Note that an value of 65537 for E is pretty standard and thus we can avoid the 6101 return code inmost cases. Signed-off-by: Werner Koch <[email protected]>
* gpg: Fix memory leak while running --check-trustdb.Werner Koch2017-08-241-0/+3
| | | | | | | | | * g10/trustdb.c (update_min_ownertrust): Free PK. -- This bug was revealed by the new trust-pgp-2.scm test. Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-20 15:42:35 +0000