aboutsummaryrefslogtreecommitdiffstats
path: root/doc/gpg.texi (follow)
Commit message (Collapse)AuthorAgeFilesLines
* gpg: Add magic parameter "default" to --quick-add-adsk.Werner Koch2024-09-261-1/+3
| | | | | | | | | | | * g10/getkey.c (has_key_with_fingerprint): New. * g10/keyedit.c (menu_addadsk): Replace code by new function. (keyedit_quick_addadsk): Handle magic arg "default". * g10/keygen.c (append_all_default_adsks): New. -- GnuPG-bug-id: 6882 (cherry picked from commit 77afc9ee1c75a28083edf6d98888f9b472c3e39d)
* gpg: New command --quick-add-adskWerner Koch2024-09-261-0/+9
| | | | | | | | | | | | * g10/gpg.c (enum cmd_and_opt_values): Add aQuickAddADSK. (opts): Add --quick-add-adsk. (main): Call the actual function. * g10/keyedit.c (keyedit_quick_addadsk): New. (menu_addadsk): Add arg adskfpr and change caller. -- GnuPG-bug-id: 6395 (cherry picked from commit 9f27e448bf1f825906f3c53e3428087d34bbd8fc)
* gpg: New option --default-new-key-adsk and "addadsk" for edit-key.Werner Koch2024-09-261-6/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/free-packet.c (copy_public_key): Factor some code out to ... (copy_public_key_basics): new. * keygen.c (keygen_add_key_flags_and_expire): Rewrite and make public. * g10/keyedit.c (enum cmdids): Add cmdADDADSK. (keyedit_menu): Add command "addadsk". (menu_addadsk): New. * g10/options.h (opt): Add field def_new_key_adsks. * g10/gpg.c (oDefaultNewKeyADSK): New. (opts): Add --default-new-key-adsk. (main): Parse option. * g10/keyedit.c (menu_addadsk): Factor some code out to ... (append_adsk_to_key): new. Add compliance check. * g10/keygen.c (pADSK): New. (para_data_s): Add adsk to the union. (release_parameter_list): Free the adsk. (prepare_adsk): New. (get_parameter_adsk): New. (get_parameter_revkey): Remove unneeded arg key and change callers. (proc_parameter_file): Prepare adsk parameter from the configured fingerprints. (do_generate_keypair): Create adsk. -- GnuPG-bug-id: 6882 (cherry picked from commit ed118e2ed521d82c1be7765a0a19d5b4f19afe10) and modified to adjust to other code changes
* gpg: New option --proc-all-sigsWerner Koch2024-08-231-0/+10
| | | | | | | | | | | | | | * g10/options.h (flags): Add proc_all_sigs. * g10/mainproc.c (check_sig_and_print): Do not stop signature checking if this new option is used. * g10/gpg.c (oProcAllSigs): New. (opts): Add "proc-all-sigs". (main): Set it. -- GnuPG-bug-id: 7261 Backported-from-master: 1eb382fb1f431575872b47dc160807858b7df3e5 (cherry picked from commit cb739bb2a5796b8d48cbb92c615538bf53bcd482)
* gpg: Rename recently added import option no-seckeys to only-pubkeys.Werner Koch2024-06-241-1/+1
| | | | | | | | | * g10/import.c (parse_import_options): Rename option. * g10/options.h (IMPORT_NO_SECKEY): Rename to IMPORT_ONLY_PUBKEYS. Change all users. -- GnuPG-bug-id: 7146
* gpg: Add --import-option "no-seckeys".Werner Koch2024-06-111-0/+3
| | | | | | | * g10/import.c (parse_import_options): Add "no-seckeys". -- GnuPG-bug-id: 7146
* gpg: Fix mixed invocation with --trusted-keys and --no-options.Werner Koch2024-03-041-1/+3
| | | | | | | | | | | | * g10/trustdb.c: Move some definitions around. (user_utk_list): Rename to trusted_key_list. Change all users. (any_trusted_key_seen): New. (tdb_register_trusted_key): Set it here. Handle the new value "none". (verify_own_keys): Do not delete a trusted key from the trustdb if a trusted-key option was not used. -- GnuPG-bug-id: 7025
* doc: Minor typo fix.Werner Koch2024-01-241-1/+1
| | | | | | -- Was already fixed in 2.4. A 2.2 user reported this to g10 Code.
* gpg: New option --add-desig-revokerWerner Koch2023-09-071-0/+13
| | | | | | | | | | | | | | | | | | | * g10/gpg.c (oAddDesigRevoker): New. (opts): Add new option. * g10/options.h (opt): Add field desig_revokers. * g10/keygen.c (get_parameter_idx): New. (get_parameter): Make use of get_parameter_idx. (prepare_desig_revoker): New. (get_parameter_revkey): Add arg idx. (proc_parameter_file): Add designated revokers. (do_generate_keypair): Write all designated revokers. -- (cherry picked from commit 3d094e2bcf6c9ed2cd405623f2dbc6131d04366f) Support for v5 desig revokers has been removed. However, we should check whether we can add a longer v4 desig revoker fingerprint in addition to the regular v4 desig revoker.
* gpg: New option --no-compress as alias for -z0.Werner Koch2023-07-051-7/+12
|
* agent: Do not consider --min-passphrase-len for the magic wand.Werner Koch2023-02-161-3/+4
| | | | | | | * agent/call-pinentry.c (generate_pin): Lock to exactly 30 octets. * g10/gpg.c (main) <aGenRandom>: Add Level 30. (cherry picked from commit ae2f1f0785e429d6dbb577a1fcf9a880aaff8e49)
* gpg: Replace --override-compliance-check by a real fix.Werner Koch2023-01-201-7/+1
| | | | | | | | | | | | | | | | | | * common/compliance.c (gnupg_pk_is_allowed): Handle EdDSA. * g10/gpg.c (oOverrideComplianceCheck): Remove. (opts): Turn --override-compliance-check into a dummy option. * g10/options.h (opt): Remove override_compliance_check. * g10/sig-check.c (check_key_verify_compliance): Remove use of that option. -- The introduction of --override-compliance-check actually hid the real cause for the signature verification problem in de-vs mode for the Ed25519 key. The real fix is to handle the EdDSA algorithm in gnupg_pk_is_allowed. Fixes-commit: 773b8fbbe915449c723302f5268d7906b40d84d3 GnuPG-bug-id: 5655
* gpg: Detect already compressed data also when using a pipe.Werner Koch2023-01-191-3/+14
| | | | | | | | | | | | | | | | | | | | | | | | | * common/iobuf.c (file_filter_ctx_t): Add fields for the peek feature. (file_filter): Implement peeking. (iobuf_ioctl): Add new IOBUF_IOCTL_PEEK. * common/iobuf.h (IOBUF_IOCTL_PEEK, IOBUFCTRL_PEEK): New. * common/miscellaneous.c (is_file_compressed): Rewrite. Detect PDF. * g10/encrypt.c (encrypt_simple): Peek before detecting compression. (encrypt_crypt): Ditto. * g10/sign.c (sign_file): Also detect already compressed data. * g10/options.h (opt): Add explicit_compress_option. * g10/gpg.c (main): Set opt.explicit_compress_option for -z. -- Note that this patch also introduces a compression check for signing which was never done in the past. GnuPG-bug-id: 6332 Backported-from-master: 60963d98cfd8e60f88ee43c2d992f6dd3bbbd74c Note that sign.c (sign_file) has been re-indented to ease future backports.
* Merge branch 'STABLE-BRANCH-2-2.40' into STABLE-BRANCH-2-2Werner Koch2022-12-231-0/+5
|\ | | | | | | --
| * gpg: New export-filter export-revocsWerner Koch2022-11-301-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/options.h (EXPORT_REVOCS): New. * g10/export.c (export_select_filter): New. (struct export_filter_attic_s): Add field. (cleanup_export_globals): Cleanup. (parse_export_options): Add option "export-revocs". (parse_and_set_export_filter): Parse the select type. (do_export_revocs): New. (do_export_stream): Add a way to select things for export. -- Backported-from-master: c985b52e71a83d14099f00f80e3588bd3ad28b98
| * gpg: New option --compatibility-flagsWerner Koch2022-11-251-0/+8
| | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (oCompatibilityFlags): New. (opts): Add option. (compatibility_flags): New list. (main): Set flags and print help. * g10/options.h (opt): Add field compatibility_flags. -- No flags are yet defined but it is good to have the framework.
* | gpg: New option --quick-update-pref.Werner Koch2022-11-151-1/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (aQuickUpdatePref): New. (opts): Add --quick-update-pref. (main): Implement. * g10/keyedit.c (keyedit_quick_update_pref): New. (menu_set_preferences): Add arg 'unattended' and adjust caller. -- This new quick command is in particular useful to update existing keys so that they can be used with OCB mode. (cherry picked from commit d40d23b233f0b2e6fc25937f1632ac5b9d4f61e5)
* | gpg: New option --compatibility-flagsWerner Koch2022-10-311-0/+8
| | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (oCompatibilityFlags): New. (opts): Add option. (compatibility_flags): New list. (main): Set flags and print help. * g10/options.h (opt): Add field compatibility_flags. -- No flags are yet defined but it is good to have the framework.
* | gpg: Support OCB encryption.Werner Koch2022-10-311-0/+8
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/build-packet.c (do_encrypted_aead): New. (do_symkey_enc): Handle version 5. (build_packet): Support the ENCRYPTED_AEAD packet. * g10/cipher.c (MIN_PARTIAL_SIZE): Remove unused macro. (AEAD_ENC_BUFFER_SIZE): New macro. (my_iobuf_write): New. (write_header): Rename to write_cfb_header. Adjust caller. (set_ocb_nonce_and_ad): New. (write_ocb_header): New. (write_ocb_auth_tag): New. (write_ocb_final_chunk): New. (do_ocb_flush): New. (do_ocb_free): New. (cipher_filter_ocb): New. * g10/filter.h (cipher_filter_context_t): Add fields for AEAD. * g10/encrypt.c (encrypt_symmetric): For the use of a session key in OCB mode. (encrypt_seskey): Revamp to support OCB. (use_aead): New. (encrypt_simple): Support OCB. (write_symkey_enc): Ditto. (encrypt_crypt): Ditto. (encrypt_filter): Handle OCB. * g10/options.h (opt): Add field force_ocb. * g10/gpg.c (oForceOCB): New. (opts): New option "--force-ocb". (main): Set force_ocb option. * g10/gpgcompose.c (encrypt_seskey): New. * g10/keygen.c (aead_available): New global var. (keygen_set_std_prefs): Set AEAD feature by default in GNUPG mode. Add parings of aead feature flag. (keygen_get_std_prefs): Set aead flag. (add_feature_aead): New. (keygen_upd_std_prefs): Set OCB as preference if AEAD is enabled. * g10/pkclist.c (select_aead_from_pklist): New. (warn_missing_aead_from_pklist): New. (select_mdc_from_pklist): Remove this unused function. -- This extends the long available OCB and EAX decryption feature. Due to the meanwhile expired patent on OCB there is no more reason for using EAX. Thus we forcefully use OCB if the AEAD feature flag is set on a key. In GNUPG mode new keys are now created with the AEAD feature flag set. Option --rfc4880 is one way to disable this. GnuPG-bug-id: 6263
* common: Silence warnings from AllowSetForegroundWindow.Werner Koch2022-08-031-0/+6
| | | | | * common/sysutils.c (gnupg_allow_set_foregound_window): Print warning only with debug flag set.
* gpg: New option --require-compliance.Werner Koch2022-03-081-0/+11
| | | | | | | | | | | | | | * g10/options.h (opt): Add field flags.require_compliance. * g10/gpg.c (oRequireCompliance): New. (opts): Add --require-compliance. (main): Set option. * g10/mainproc.c (proc_encrypted): Emit error if non de-vs compliant. (check_sig_and_print): Ditto. * g10/encrypt.c (encrypt_crypt): Ditto. -- Note that in the --encrypt and --verify cased other checks may kick in earlier than this new --require-compliance controlled one.
* gpg: New option --forbid-gen-key.Werner Koch2021-11-221-0/+6
| | | | | | | | | | | | * g10/gpg.c (oForbidGenKey, opts): New option. (mopt): New local struct (gen_key_forbidden): New. (main): Set and handle the option. -- In large system installation it is sometimes useful to make it a bit harder for users to generate their own keys. An example is a policy to not use on-disk keys.
* gpg,gpgsm: Add option --min-rsa-length.Werner Koch2021-11-181-1/+7
| | | | | | | | | | | | | | | * common/compliance.c (min_compliant_rsa_length): New. (gnupg_pk_is_compliant): Take in account. (gnupg_pk_is_allowed): Ditto. (gnupg_set_compliance_extra_info): New. * g10/gpg.c (oMinRSALength): New. (opts): Add --min-rsa-length. (main): Set value. * g10/options.h (opt): Add field min_rsa_length. * sm/gpgsm.c (oMinRSALength): New. (opts): Add --min-rsa-length. (main): Set value. * sm/gpgsm.h (opt): Add field min_rsa_length.
* doc: Clarify the "ntds" AKL mechanism.Werner Koch2021-11-121-1/+3
| | | | --
* common: Support gpgconf.ctl also for BSDs.Werner Koch2021-11-021-0/+6
| | | | | | | | | | * common/homedir.c (MYPROC_SELF_EXE): New. (unix_rootdir): Use it here. Also support GNUPG_BUILD_ROOT as fallback. -- In addition this adds a fallback method for AIX etc which do not have an easy way to get the info.
* gpg: New option --override-compliance-checkWerner Koch2021-10-131-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (oOverrideComplianceCheck): New. (opts): Add new option. (main): Set option and add check for batch mode. * g10/options.h (opt): Add flags.override_compliance_check. * g10/sig-check.c (check_signature2): Factor complaince checking out to ... (check_key_verify_compliance): new. Turn error into a warning in override mode. -- There is one important use case for this: For systems configured globally to use de-vs mode, Ed25519 and other key types are not allowed because they are not listred in the BSI algorithm catalog. Now, our release signing keys happen to be Ed25519 and thus we need to offer a way for users to check new versions even if the system is in de-vs mode. This does on purpose not work in --batch mode so that scripted solutions won't accidently pass a signature check. GnuPG-bug-id: 5655 Backported-from-master: fb26e144adfd93051501d58f5d0d4f8826ddf436
* doc: Clarify some gpg keyring optionsWerner Koch2021-09-091-15/+15
| | | | | -- GnuPG-bug-id: 5594
* wkd: Fix client issue with leading or trailing spaces in user-ids.Werner Koch2021-08-201-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/recsel.c (recsel_parse_expr): Add flag -t. * common/stringhelp.c (strtokenize): Factor code out to do_strtokenize. (strtokenize_nt): New. (do_strtokenize): Add arg trim to support the strtokenize_nt. * common/t-stringhelp.c (test_strtokenize_nt): New test cases. * tools/wks-util.c (wks_list_key): Use strtokenize_nt and the recsel flag -t. -- This fixes a bug with user ids with leading spaces because: wks-client lists all mail addresses from the key and matches them to the requested mail address. If there are several user-ids all with the same mail address wks-client picks one of them and then extracts exactly that user id. However, here it does not match by the mail address but by the full user-id so that we can be sure that there will be only one user-id in the final key. The filter built expression unfortunately strips leading blanks but requires a verbatim match. Thus it won't find the user id again and errors out. The new -t flag and a non-trimming strtokenize solves the problem. Signed-off-by: Werner Koch <[email protected]>
* w32: Always use Unicode for console input and output.Werner Koch2021-06-081-6/+13
| | | | | | | | | | | | | | | | | * common/init.c (_init_common_subsystems) [W32]: Set the codepage to UTF-8 for input and putput. Switch gettext to UTF-8. * g10/gpg.c (utf8_strings) [W32]: Make sure this is always set. -- With this patch the former patch to use ReadConsoleW and WriteConsoleW in ttyio.c are kind of superfluous because the ANSI version of these functions are also able to read/write UTF-8 directly given the console code page has been set correctly. However, this seems to work only with recent versions of Windows-10. GnuPG-bug-id: 4365 (cherry picked from commit 8c41b8aac3efb78178fe1eaf52d8d1bbc44941a8) Removed changes for "gpgconf --show-codepages" of the original patch.
* gpg,sm: Simplify keyserver spec parsing.Werner Koch2021-05-261-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | * common/keyserver.h: Remove. * sm/gpgsm.h (struct keyserver_spec): Remove. (opt): Change keyserver to a strlist_t. * sm/gpgsm.c (keyserver_list_free): Remove. (parse_keyserver_line): Remove. (main): Store keyserver in an strlist. * sm/call-dirmngr.c (prepare_dirmngr): Adjust for the strlist. Avoid an ambiguity in dirmngr by adding a prefix if needed. * g10/options.h (struct keyserver_spec): Move definition from keyserver.h to here. Remove most fields. * g10/keyserver.c (free_keyserver_spec): Adjust. (cmp_keyserver_spec): Adjust. (parse_keyserver_uri): Simplify. (keyidlist): Remove fakev3 arg which does not make any sense because we don't even support v3 keys. -- We now rely on the dirmngr to parse the keyserver specs. Thus a bad specification will not be caught immediately. However, even before that dirmngr had stricter tests. Signed-off-by: Werner Koch <[email protected]>
* gpg: Auto import keys specified with --trusted-keys.Werner Koch2021-05-041-5/+6
| | | | | | | * g10/getkey.c (get_pubkey_with_ldap_fallback): New. * g10/trustdb.c (verify_own_keys): Use it. (cherry picked from commit 100037ac0f558e8959fc065d4703c85c2962489e)
* gpg: Allow fingerprint based lookup with --locate-external-key.Werner Koch2021-05-031-9/+20
| | | | | | | | | | | | | | | | | | * g10/keyserver.c (keyserver_import_fprint_ntds): New. * g10/getkey.c (get_pubkey_byname): Detect an attempt to search by fingerprint in no_local mode. -- See the man page. For testing use gpg --auto-key-locate local,wkd,keyserver --locate-external-key \ FINGERPRINT with at least one LDAP keyserver given in dirmngr.conf. On Windows "ntds" may be used instead or in addtion to "keyserver". Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit ec36eca08cdbf6653e7362e8e0e6c5f2c75b4a60)
* doc: Fix option name.Werner Koch2021-04-291-1/+1
| | | | --
* gpg: Do not use self-sigs-only for LDAP keyserver imports.Werner Koch2021-04-131-1/+3
| | | | | | | | | | | | | | * dirmngr/ks-engine-ldap.c (ks_ldap_get): Print a SOURCE status. * g10/options.h (opts): New field expl_import_self_sigs_only. * g10/import.c (parse_import_options): Set it. * g10/keyserver.c (keyserver_get_chunk): Add special options for LDAP. -- I can be assumed that configured LDAP servers are somehow curated and not affected by rogue key signatures as the HKP servers are. Thus we can allow the import of key signature from LDAP keyservers by default. GnuPG-bug-id: 5387
* gpg: New option --force-sign-keyWerner Koch2021-03-111-9/+20
| | | | | | | | | | * g10/gpg.c (oForceSignKey,opts): New option "--force-sign-key". (main): Set it. * g10/options.h (opt): New flag flags.force_sign_key. * g10/keyedit.c (sign_uids): Use new flag. -- GnuPG-bug-id: 4584
* dirmngr: Support new gpgNtds parameter in LDAP keyserver URLs.Werner Koch2021-02-171-7/+7
| | | | | | | | | | | | | | | | | | | * dirmngr/ldap-parse-uri.c (ldap_parse_uri): Support a new gpgNtds extension. * dirmngr/ks-engine-ldap.c (my_ldap_connect): Do ldap_init always with hostname - which is NULL and thus the same if not given. Fix minor error in error code handling. -- Note that "gpgNtds" is per RFC-4512 case insensitive and has not yet been officially regisetered. Thus for correctness the OID can be used: 1.3.6.1.4.1.11591.2.5 LDAP URL extensions 1.3.6.1.4.1.11591.2.5.1 gpgNtds=1 (auth. with current user) Note that the value must be 1; all other values won't enable AD authentication and are resevered for future use.
* gpg: New AKL method "ntds"Werner Koch2020-12-171-0/+3
| | | | | | | | | | | * dirmngr/ks-engine-ldap.c (keyspec_to_ldap_filter): Change the new support for KEYDB_SEARCH_MODE_MAIL. (ks_ldap_get): Add a debug. * g10/options.h (AKL_NTDS): New. * g10/keyserver.c (keyserver_import_ntds): New. (keyserver_get_chunk): Allow KEYDB_SEARCH_MODE_MAIL. * g10/getkey.c (parse_auto_key_locate): Support "ntds". (get_pubkey_byname): Ditto.
* doc: Add parameters for batch generation of ECC keys.Jens Meißner2020-12-011-0/+8
| | | | | | | | | | | * doc/gpg.texi: Add parameters for batch generation of ECC keys. -- There are parameters required for batch generation of ECC keys which weren't mentioned in the documentation. Signed-off-by: Jens Meißner <[email protected]>
* doc: Fix typosGavin L. Rebeiro2020-11-231-2/+2
| | | | | | | | | -- GnuPG-bug-id: 5071 Also fixed one in keyformat.txt [wk]. (cherry picked from commit 572bcacc287d24d0a2cc56442f9fb6a9ac49e12d)
* gpg: New command --quick-revoke-sigWerner Koch2020-10-281-0/+11
| | | | | | | | | | | | | | | * g10/gpg.c (enum cmd_and_opt_values): Add aQuickRevSig. (opts): Add --quick-revoke-sig. (main): Implement. * g10/keyedit.c (quick_find_keyblock): Add arg 'want_secret' and adjust all callers. (keyedit_quick_revsig): new. * g10/revoke.c (get_default_sig_revocation_reason): New. * g10/keylist.c (cmp_signodes): New. -- GnuPG-bug-id: 5093 Backported-from-master: 243f9176e799b2328f2e5bed93099bfc474fdc5a
* doc: Add a remark about keyservers.Werner Koch2020-08-271-0/+5
| | | | --
* doc: Describe the relation between pubring.gpg and pubring.kbxWerner Koch2020-08-201-6/+34
| | | | | -- GnuPG-bug-id: 4958
* gpg: Fix regression for non-default --passphrase-repeat option.Werner Koch2020-08-201-1/+4
| | | | | | | | * agent/command.c (cmd_get_passphrase): Take care of --repeat with --newsymkey. -- GnuPG-bug-id: 4997
* gpg: Update --trusted-key to accept fingerprint as well as long key id.Daniel Kahn Gillmor2020-03-181-2/+2
| | | | | | | | | | | | | | | | | | | | * g10/trustdb.c (tdb_register_trusted_key): accept fingerprint as well as long key ID. * doc/gpg.texi: document that --trusted-key can accept a fingerprint. -- GnuPG-bug-id: 4855 Signed-off-by: Daniel Kahn Gillmor <[email protected]> Fixed uses or return and kept the old string to avoid breaking translations. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 810ea2cc684480c6aadceb2a10dd00f3fa67f2fb) Remove the test for FPRLEN which we do not have in 2.2 Signed-off-by: Werner Koch <[email protected]>
* gpg: New option --auto-key-importWerner Koch2020-03-141-4/+22
| | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (opts): New options --auto-key-import, --no-auto-key-import, and --no-include-key-block. (gpgconf_list): Add them. * g10/options.h (opt): Add field flags.auto_key_import. * g10/mainproc.c (check_sig_and_print): Use flag to enable that feature. * tools/gpgconf-comp.c: Give the new options a Basic config level. -- Note that the --no variants of the options are intended for easy disabling at the command line. GnuPG-bug-id: 4856 Signed-off-by: Werner Koch <[email protected]> Backported from master. Signed-off-by: Werner Koch <[email protected]>
* gpg: New option --include-key-block.Werner Koch2020-03-141-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/openpgpdefs.h (SIGSUBPKT_KEY_BLOCK): New. * g10/gpg.c (oIncludeKeyBlock): New. (opts): New option --include-key-block. (main): Implement. * g10/options.h (opt): New flag include_key_block. * g10/parse-packet.c (dump_sig_subpkt): Support SIGSUBPKT_KEY_BLOCK. (parse_one_sig_subpkt): Ditto. (can_handle_critical): Ditto. * g10/sign.c (mk_sig_subpkt_key_block): New. (write_signature_packets): Call it for data signatures. -- This patch adds support for a to be proposed OpenPGP ferature: Introduce the Key Block subpacket to align OpenPGP with CMS. This new subpacket may be used similar to the CertificateSet of CMS (RFC-5652) and thus allows to start encrypted communication after having received a signed message. In practice a stripped down version of the key should be including having only the key material and the self-signatures which are really useful and shall be used by the recipient to reply encrypted. #### Key Block (1 octet with value 0, N octets of key data) This subpacket MAY be used to convey key data along with a signature of class 0x00, 0x01, or 0x02. It MUST contain the key used to create the signature; either as the primary key or as a subkey. The key SHOULD contain a primary or subkey capable of encryption and the entire key must be a valid OpenPGP key including at least one User ID packet and the corresponding self-signatures. Implementations MUST ignore this subpacket if the first octet does not have a value of zero or if the key data does not represent a valid transferable public key. GnuPG-bug-id: 4856 Signed-off-by: Werner Koch <[email protected]> Backported from master. Signed-off-by: Werner Koch <[email protected]>
* gpg: Add property "fpr" for use by --export-filter.Werner Koch2020-03-141-0/+4
| | | | | | | | | | | | | | | | * g10/export.c (push_export_filters): New. (pop_export_filters): New. (export_pubkey_buffer): Add args prefix and prefixlen. Adjust callers. * g10/import.c (impex_filter_getval): Add property "fpr". * g10/main.h (struct impex_filter_parm_s): Add field hexfpr. -- The push and pop feature will help us to use the export filter internally in gpg. Same for the export_pubkey_buffer change. GnuPG-bug-id: 4856 Signed-off-by: Werner Koch <[email protected]>
* doc: Improve the warning section of the gpg man page.Werner Koch2020-02-101-11/+17
| | | | | | | * doc/gpg.texi: Update return value and warning sections. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 113a8288b85725f7726bb2952431deea745997d8)
* doc: Clarify how to use --log-file in gpg.Werner Koch2019-11-181-1/+3
| | | | | | -- Note that in 2.3 --batch is not anymore required.
* gpg: Add option --allow-weak-key-signatures.Werner Koch2019-11-111-3/+12
| | | | | | | | | | | | | | * g10/gpg.c (oAllowWeakKeySignatures): New. (opts): Add --allow-weak-key-signatures. (main): Set it. * g10/options.h (struct opt): Add flags.allow_weak_key_signatures. * g10/misc.c (print_sha1_keysig_rejected_note): New. * g10/sig-check.c (check_signature_over_key_or_uid): Print note and act on new option. -- Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit e624c41dbafd33af82c1153188d14de72fcc7cd8)
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-23 20:58:03 +0000