aboutsummaryrefslogtreecommitdiffstats
path: root/doc/gpg.texi (unfollow)
Commit message (Collapse)AuthorFilesLines
2025-04-29gpg: New command --quick-tsign-key.Werner Koch1-0/+13
* g10/gpg.c (aQuickTSignKey): New. (opts): Add new command. (main): Parse args for it. * g10/keyedit.c: Include mbox-util.h. (parse_trustsig_string): New. (sign_uids): Add arg trustsig for use in quick mode. (keyedit_quick_sign): Also add arg trustsig and print a diagnostic on error.
2025-04-29gpg: New list options "show-trustsig"Werner Koch1-0/+9
* g10/options.h (LIST_SHOW_TRUSTSIG): New. * g10/gpg.c (parse_list_options): Add "show-trustsig". * g10/keylist.c (parse_trust_name): New. (list_signature_print): Print trust signature info.
2025-04-04gpg: New key generation parameter "User-Id".Werner Koch1-5/+7
* g10/keygen.c (read_parameter_file): Add keyword "User-Id".
2025-03-12common: Add a flag for left anchored substring match to recsel.Werner Koch1-2/+4
* common/recsel.c (struct recsel_expr_s): Add field lefta. (recsel_parse_expr): Parse it. (recsel_select): Implement selection. -- This flags makes it for example easy to select keys last updated from an ldap server: gpg --list-filter 'select=origin=ks && -^ url =~ ldap' \ -k --with-key-origin
2025-02-06gpg: New option --disable-pqc-encryption.Werner Koch1-0/+7
* g10/options.h (flags): Add field disable_pqc_encryption. * g10/gpg.c (oDisablePQCEncryption): New. (opts): Add --option. (main): Set option. * g10/getkey.c (finish_lookup): Skip subkeys if option is set. -- This option can be used to avoid the use of Kyber encryption subkeys if this does not make sense (i.e. protection of local files).
2025-02-03gpg: Simplify the compliance settings.Werner Koch1-1/+3
* g10/gpg.c (set_compliance_option): Base most settings on oGnuPG. For oGnuPG explictly clear the allow_old_cipher_algos flag. -- Note that --allow-old-cipher-algos must now come after a compliance settings. This avoids a bug when first setting oRFC2440 and then oGnuPG which would not clear the flag. GnuPG-bug-id: T7501
2025-02-03doc: Record that gpg policy compliance options are last-one-winsDaniel Kahn Gillmor via Gnupg-devel1-1/+2
* doc/gpg.texi (Compliance options): Explain that when multiple --compliance options are given, the final one supersedes any previous option. -- Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2025-01-06gpg: Force the use of AES-256 in some casesDamien Goutte-Gattat via Gnupg-devel1-4/+6
* g10/encrypt.c (create_dek_with_warnings): Forcefully use AES-256 if PQC encryption was required or if all recipient keys are Kyber keys. -- If --require-pqc-encryption was set, then it should be safe to always force AES-256, without even checking if we are encrypting to Kyber keys (if some recipients do not have Kyber keys, --require-pqc-encryption will fail elsewhere). Otherwise, we force AES-256 if we encrypt *only* to Kyber keys -- unless the user explicitly requested another algo, in which case we assume they know what they are doing. GnuPG-bug-id: 7472 Signed-off-by: Damien Goutte-Gattat <[email protected]> Man page entry extended Signed-off-by: Werner Koch <[email protected]>
2024-11-08gpg: Improve wording for only-pubkeys.Werner Koch1-1/+1
* g10/import.c (parse_import_options): Add a description to only-pubkeys. -- See gnupg-devel for a brief discussion.
2024-10-07Implement GNUPG_ASSUME_COMPLIANCE envvar for testingWerner Koch1-0/+8
* common/compliance.c (assumed_de_vs_compliance): New. (get_compliance_cache): Check envvar and fake compliance. (gnupg_status_compliance_flag): Return 2023 for de-vs if in faked mode. * g10/gpg.c (gpgconf_list): For compliance_de_vs return 23 or 2023. -- The user visible changes are that GNUPG_ASSUME_COMPLIANCE=de-vs gpgconf --list-options gpg \ | awk -F: '$1=="compliance_de_vs" {print $8}' returns 2023 if "compliance de-vs" is found in gpg.conf. If eventually the software is arpproved the returned value will be 23 and not 1 as it was before. Consumers should check whether they see value of true (Kleopatra does this right now) and also check whether the value is > 2000 and in this case print a beta/non-approved warning. The envvar is currently used to assume that the underlying libgcrypt is compliant and approved. This is not yet the case but eventually libgcrypt will announce this itself and from then on the envvar is not anymore required for testing.
2024-09-11build: Remove configure option --enable-gpg-is-gpg2Werner Koch1-35/+2
* configure.ac (--enable-gpg-is-gpg2): Remove option. (USE_GPG2_HACK): Remove var. * common/homedir.c (gnupg_module_name): Remove code for gpg2 installation option. * g10/keygen.c (generate_keypair): Ditto. * g10/Makefile.am (noinst_PROGRAMS): Ditto. * doc/gpg.texi: Ditto. * doc/gpgv.texi: Ditto. -- This option and all its build stuff does not make anymore sense. gpg1 is way too old for anyone to use on a regualar base along with a standard gpg. It is better to rename that single gpg (1.4) binary to gpg1 and adjust any scripts.
2024-08-29doc: Minor fix for the description of gpg's --default-*-expireWerner Koch1-2/+2
--
2024-08-23gpg: New option --proc-all-sigsWerner Koch1-0/+11
* g10/options.h (flags): Add proc_all_sigs. * g10/mainproc.c (proc_tree): Do not stop signature checking if this new option is used. * g10/gpg.c (oProcAllSigs): New. (opts): Add "proc-all-sigs". (main): Set it. -- GnuPG-bug-id: 7261
2024-08-12gpg: Improve decryption diagnostic for an ADSK key.Werner Koch1-1/+1
* g10/keydb.h (GET_PUBKEYBLOCK_FLAG_ADSK): New constant. * g10/packet.h (PUBKEY_USAGE_XENC_MASK): New constant. * g10/pubkey-enc.c (get_session_key): Consider an ADSK also as "marked for encryption use". (get_it): Print a note if an ADSK key was used. Use the new get_pubkeyblock flag. * g10/getkey.c (struct getkey_ctx_s): Add field allow_adsk. (get_pubkeyblock): Factor all code out to ... (get_pubkeyblock_ext): new. (finish_lookup): Add new arg allow_adsk and make use of it. -- This patch solves two purposes: - We write a note that the ADSK key was used for decryption - We avoid running into a "oops: public key not found for preference check\n" due to ADSK keys. The error is mostly harmless but lets gpg return with an exit code of 2.
2024-08-08doc: Explain that sort-sigs has no effect in colon mode.Werner Koch1-1/+2
--
2024-06-24gpg: New option --show-only-session-keyWerner Koch1-0/+4
* g10/options.h (opt): Add show_only_session_key and turn show_session_key into a bit flag. * g10/gpg.c (oShowOnlySessionKey): New. (opts): Add "show-only-session-key". (main): Set flag. * g10/mainproc.c (proc_encrypted): Handle the new option. * g10/decrypt-data.c (decrypt_data): Ditto. Add compliance error flag to the DECRYPTION_INFO status line. -- This new option is somehow related to GnuPG-bug-id: 1825
2024-06-24gpg: Rename recently added import option no-seckeys to only-pubkeys.Werner Koch1-1/+1
* g10/import.c (parse_import_options): Rename option. * g10/options.h (IMPORT_NO_SECKEY): Rename to IMPORT_ONLY_PUBKEYS. Change all users. -- GnuPG-bug-id: 7146
2024-06-11gpg: Add --import-option "no-seckeys".Werner Koch1-0/+3
* g10/import.c (parse_import_options): Add "no-seckeys". -- GnuPG-bug-id: 7146
2024-06-11gpg: Allow shortcut algo string "pqc" for --quick-gen-key.Werner Koch1-6/+8
* g10/keygen.c (PQC_STD_KEY_PARAM): New. (quickgen_set_para): Always store the provided NBITS. (parse_key_parameter_string): Detect the special value "pqc". (quick_generate_keypair): Ditto. -- With this change we can finally do a gpg --quick-gen-key --batch --passphrase='' [email protected] pqc and get a full key. Currently with a brainpoolp386r1 primary key and a Kyber768_brainpoolp256 subkey.
2024-06-05gpg: Add magic parameter "default" to --quick-add-adsk.Werner Koch1-1/+3
* g10/getkey.c (has_key_with_fingerprint): New. * g10/keyedit.c (menu_addadsk): Replace code by new function. (keyedit_quick_addadsk): Handle magic arg "default". * g10/keygen.c (append_all_default_adsks): New. -- GnuPG-bug-id: 6882
2024-06-04gpg: Implement the LDAP AKL method.Werner Koch1-4/+4
* g10/keyserver.c (keyserver_import_mbox): Add arg flags and change callers. (keyserver_import_ldap): Remove. It has always returned a not implemented error since 2.1. * g10/getkey.c (get_pubkey_byname): Repurpose LDAP to do basically the same as KEYSERVER. -- The old LDAP mechanism to locate a server via SRV records has long been gone (since 2014) due to the dropping of the keyserver helpers. The new purpose better reflects reality and can be used in environments where keys are provided by an in-house LDAP server.
2024-06-03gpg: New option --default-new-key-adsk.Werner Koch1-5/+18
* g10/options.h (opt): Add field def_new_key_adsks. * g10/gpg.c (oDefaultNewKeyADSK): New. (opts): Add --default-new-key-adsk. (main): Parse option. * g10/keyedit.c (menu_addadsk): Factor some code out to ... (append_adsk_to_key): new. Add compliance check. * g10/keygen.c (pADSK): New. (para_data_s): Add adsk to the union. (release_parameter_list): Free the adsk. (prepare_adsk): New. (get_parameter_adsk): New. (get_parameter_revkey): Remove unneeded arg key and change callers. (proc_parameter_file): Prepare adsk parameter from the configured fingerprints. (do_generate_keypair): Create adsk. -- GnuPG-bug-id: 6882
2024-05-31indent: Fix spellingDaniel Kahn Gillmor1-3/+3
-- These are non-substantive corrections for minor spelling mistakes within the GnuPG codebase. With something like this applied to the codebase, and a judiciously tuned spellchecker integrated as part of a standard test suite, it should be possible to keep a uniform orthography within the project. GnuPG-bug-id: 7116
2024-04-24gpg: New option --require-pqc-encryptionWerner Koch1-0/+9
* g10/gpg.c (oRequirePQCEncryption): New. (opts): Add option. (main): Set option. * g10/mainproc.c (print_pkenc_list): Print a warning. * g10/options.h (flags): Add flag require_pqc_encryption. * g10/getkey.c (finish_lookup): Skip non-pqc keys if the option is set. -- GnuPG-bug-id: 6815
2024-04-17gpg: Mark disabled keys and add show-ownertrust list option.Werner Koch1-0/+5
* g10/options.h (LIST_SHOW_OWNERTRUST): New. * g10/keylist.c (print_key_line): Show wonertrust and always show whether a key is disabled. * g10/gpg.c (parse_list_options): Add "show-ownertrust". * g10/gpgv.c (get_ownertrust_string): Add stub. * g10/test-stubs.c (get_ownertrust_string): Add stub. -- Note that in a --with-colons listing the ownertrust has always been emitted and the disabled state is marked in that listing with a special 'D' usage.
2024-04-17gpg: New command --quick-set-ownertrust.Werner Koch1-1/+8
* g10/gpg.c (aQuickSetOwnertrust): New. (opts): Add new command. (main): Implement it. * g10/keyedit.c (keyedit_quick_set_ownertrust): New.
2024-04-17gpg: Mark disabled keys and add show-ownertrust list option.Werner Koch1-0/+5
* g10/options.h (LIST_SHOW_OWNERTRUST): New. * g10/keylist.c (print_key_line): Show wonertrust and always show whether a key is disabled. * g10/gpg.c (parse_list_options): Add "show-ownertrust". * g10/gpgv.c (get_ownertrust_string): Add stub. * g10/test-stubs.c (get_ownertrust_string): Add stub. -- Note that in a --with-colons listing the ownertrust has always been emitted and the disabled state is marked in that listing with a special 'D' usage.
2024-04-17gpg: New command --quick-set-ownertrust.Werner Koch1-1/+8
* g10/gpg.c (aQuickSetOwnertrust): New. (opts): Add new command. (main): Implement it. * g10/keyedit.c (keyedit_quick_set_ownertrust): New.
2024-04-16gpg: Make --with-subkey-fingerprint the default.Werner Koch1-2/+5
* g10/gpg.c (oWithoutSubkeyFingerprint): New. (opts): Add "without-subkey-fingerprint". (main): Make --with-subkey-fingerprint the default. Implementation the without option. -- Given that the default for the keyid format is none, the subkey fingerprints are important to do anything with a subkey. Thus we make the old option the default and provide a new option to revert it.
2024-03-26gpg,gpgsm: New option --disable-fd-translation.Werner Koch1-0/+6
* common/sysutils.c (no_translate_sys2libc_fd) [W32]: New global. (disable_translate_sys2libc_fd): New. (translate_sys2libc_fd): Make static and cobuild only for Windows. (translate_sys2libc_fd_int): Use no_translate_sys2libc_fd flag. * g10/gpg.c, sm/gpgsm.c (oDisableFdTranslation): New const. (opts): Add option "disable-fd-translation". (main): Set option. -- GnuPG-bug-id: 7060
2024-03-14gpg: new list-option store-x509-notations.Werner Koch1-0/+6
* g10/options.h (LIST_STORE_X509_NOTATIONS): New. * g10/gpg.c (parse_list_options): Add "store-x509-notations". * g10/keylist.c (print_x509_notations): Add arg PK and code to write a file. (list_signature_print): Add arg lastpk and handle new option. (list_keyblock_print): Track last key or subkey and pass to list_signature_print.
2024-03-12gpg: new list-option show-x509-notationsWerner Koch1-0/+6
* g10/gpg.c (parse_list_options): Add new option. * g10/options.h (LIST_SHOW_X509_NOTATIONS): New. * g10/build-packet.c (search_sig_notations): New. * g10/keylist.c (print_x509_notations): New. (list_signature_print): Use macros for the sig classes. Call print_x509_notations. (list_keyblock_print): Call list_signature_print if x509 notation printing is enabled.
2024-03-04gpg: Fix mixed invocation with --trusted-keys and --no-options.Werner Koch1-1/+3
* g10/trustdb.c: Move a function and some definitions around. (user_utk_list): Rename to trusted_key_list. Change all users. (any_trusted_key_seen): New. (tdb_register_trusted_key): Set it here. Handle the new value "none". (verify_own_keys): Do not delete a trusted key from the trustdb if a trusted-key option was not used. -- GnuPG-bug-id: 7025
2024-02-10gpg: Add option --assert-pubkey_algo.Werner Koch1-0/+23
* g10/keyid.c (parse_one_algo_string): New. (compare_pubkey_string_part): New. (compare_pubkey_string): New. * g10/verify.c (check_assert_signer_list): New. * g10/mainproc.c (check_sig_and_print): Call check_assert_pubkey_algo. * g10/options.h (opt): Add field assert_pubkey_algos. * g10/gpg.c (oAssertPubkeyAlgo): New. (opts): Add "--assert-pubkey_algo". (assert_pubkey_algo_false): New. (main): Parse option. (g10_exit): Reorder RC modifications. Check assert_pubkey_algo_false. * common/status.h (ASSERT_PUBKEY_ALGOS): new. * common/t-support.h (LEAN_T_SUPPORT): Use a simplified version if this macro is set. * g10/gpgv.c (oAssertPubkeyAlgo): New. (opts): Add "--assert-pubkey_algo". (assert_pubkey_algo_false): New. (main): Parse option. (g10_exit): Check assert_pubkey_algo_false. * g10/t-keyid.c: New. * g10/Makefile.am: Add t-keyid. * g10/test-stubs.c: Add assert_pubkey_algos and assert_signer_list and remove from other tests. (check_assert_signer_list): Ditto. (check_assert_pubkey_algo): Ditto. -- GnuPG-bug-id: 6946
2024-02-05doc: Suggest the use of a fingerprint for --default-key.Werner Koch1-18/+23
-- GnuPG-bug-id: 6975
2024-02-05doc: Improve warning for --use-embedded-filename.Werner Koch1-1/+15
-- GnuPG-bug-id: 6972
2024-01-29doc: Mark --textmode as legacy option.Werner Koch1-18/+19
--
2024-01-29doc: Fix spelling errors found by lintian.Werner Koch1-8/+8
-- Reported-by: Andreas Metzler <[email protected]>
2024-01-24gpg: Add sub-option ignore-attributes to --import-options.Werner Koch1-0/+4
* g10/options.h (IMPORT_IGNORE_ATTRIBUTES): New. * g10/import.c (parse_import_options): Add new sub-option. (read_block): Implement sub-option. -- Suggested-by: Robin H. Johnson Tested using the import-export feature: gpg --export KEY_WITH_PICTURE \ | gpg --import --import-options import-export,ignore-attributes \ | gpg --show-key
2024-01-22doc: Fix description of gpg --unwrapWerner Koch1-6/+5
--
2024-01-11gpg: Fix regression in the Revoker keyword of the parmeter file.Werner Koch1-3/+4
* g10/keygen.c (parse_revocation_key): Actually allow for v4 fingerprints. -- Note that the use of the parameter file is deprecated. GnuPG-bug-id: 6923
2023-11-07doc: Use the em dash to mark a break in a sentence.NIIBE Yutaka1-15/+15
-- Signed-off-by: NIIBE Yutaka <[email protected]>
2023-11-02doc: Fix to avoid using en-dash for command options.NIIBE Yutaka1-15/+15
-- GnuPG-bug-id: 6746 Signed-off-by: NIIBE Yutaka <[email protected]>
2023-10-05Minor style fixes.NIIBE Yutaka1-28/+28
-- Signed-off-by: NIIBE Yutaka <[email protected]>
2023-09-15gpg: Add --list-filter properties sig_expires/sig_expires_dRobin H. Johnson via Gnupg-devel1-0/+6
Modelled after key_expires/key_expires_d. This should be useful to detect upcoming certification expiry, so the certifications can be renewed in advance of the expiry. Signed-off-by: Robin H. Johnson <[email protected]>
2023-09-04gpg: Add option --with-v5-fingerprintWerner Koch1-0/+5
* g10/gpg.c (oWithV5Fingerprint): New. (opts): Add new option. (main): Set option. * g10/options.h (opt): Add with_v5_fingerprint. * g10/keyid.c (hash_public_key): Factor out to ... (do_hash_public_key): this. Add new arg to foce v5 style hashing. (v5_fingerprint_from_pk): New. (v5hexfingerprint): New. * g10/keylist.c (print_fingerprint): Print v5 fingerprint for v4 keys if the option is set. -- GnuPG-bug-id: 6705
2023-09-04gpg: Add option --with-v5-fingerprintWerner Koch1-0/+5
* g10/gpg.c (oWithV5Fingerprint): New. (opts): Add new option. (main): Set option. * g10/options.h (opt): Add with_v5_fingerprint. * g10/keyid.c (hash_public_key): Factor out to ... (do_hash_public_key): this. Add new arg to foce v5 style hashing. (v5_fingerprint_from_pk): New. (v5hexfingerprint): New. * g10/keylist.c (print_fingerprint): Print v5 fingerprint for v4 keys if the option is set. -- GnuPG-bug-id: 6705
2023-06-15gpg: New option --no-compress as alias for -z0.Werner Koch1-7/+12
2023-06-09gpg: Add --list-filter properties key_expires and key_expires_d.Werner Koch1-0/+6
* g10/import.c (impex_filter_getval): Support new filter properties. -- Here is how to list all subkeys expiring in the year 2061: gpg --list-keys --list-filter 'select= sub/key_expires_d -gt 2061-01-01 \ && sub/key_expires_d -lt 2061-12-31' To list all primary key expirations, use the "pub/" prefix and to list all expiration dates use no prefix. GnuPG-bug-id: 6509
2023-05-09gpg: New option --debug-ignore-expiration to help with testing.Werner Koch1-4/+9
* g10/gpg.c (oDebugIgnoreExpiration): New. (opts): Add option. (main): Set flag. * g10/options.h (opt): Add field ignore_expiration. * g10/pkclist.c (do_we_trust): Handle the option. * g10/getkey.c (skip_unusable): Ditto. (finish_lookup): Ditto. -- GnuPG-bug-id: 2703
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-24 15:52:38 +0000