aboutsummaryrefslogtreecommitdiffstats
path: root/doc/gpgsm.texi (unfollow)
Commit message (Collapse)AuthorFilesLines
2025-03-17gpgsm: Extend --learn-card by an optional s/n argument.Werner Koch1-4/+5
* agent/command.c (cmd_learn): Allow for s/n argument. * agent/learncard.c (agent_handle_learn): Ditto. * agent/call-scd.c (agent_card_learn): Ditto. Pass it on to scd. * scd/command.c (cmd_switchcard): Factor most code out to ... (switchcard_core): new. (cmd_learn): Add option --demand to specify a s/n. * sm/gpgsm.c (main): Allow a s/n argument for --learn-card. -- This help Kleopatra to get a stable certificate listing. GnuPG-bug-id: 7379
2025-01-29gpgsm: Allow unattended PKCS#12 export without passphrase.Werner Koch1-1/+14
* sm/gpgsm.c (oNoProtection): New. (opts): Add "--no-protection". (main): PArse it. * sm/gpgsm.h (struct server_control_s): Add field no_protection. * sm/server.c (option_handler): Add option "no-protection". (reset_notify): Clear option. * sm/export.c (export_p12): Use empty passphrase if option is set.
2025-01-29gpgsm: Allow CSR generation with an unprotected key.Werner Koch1-0/+3
* sm/call-agent.c (gpgsm_agent_genkey): Add arg no_protection. * sm/certreqgen.c (struct reqgen_ctrl_s): Add field no_protection. (read_parameters): Add keyword "%no-protection". (proc_parameters): Pass no_protection to gpgsm_agent_genkey.
2024-11-22doc: Explain that qualified.txt is a legacy method.Werner Koch1-10/+14
--
2024-09-11gpgsm: New option --assert-signerWerner Koch1-0/+15
* sm/gpgsm.c (oAssertSigner, oNoop): New. (opts): Add option --assert-signer. (assert_signer_true): New var. (main): Set new option. (gpgsm_exit): Handle assert_signer_true. * sm/gpgsm.h (opt): Add field assert_signer_list. * sm/verify.c (is_x509_fingerprint): New. (check_assert_signer_list): New. (gpgsm_verify): Handle option. -- GnuPG-bug-id: 7286
2024-03-26gpg,gpgsm: New option --disable-fd-translation.Werner Koch1-0/+12
* common/sysutils.c (no_translate_sys2libc_fd) [W32]: New global. (disable_translate_sys2libc_fd): New. (translate_sys2libc_fd): Make static and cobuild only for Windows. (translate_sys2libc_fd_int): Use no_translate_sys2libc_fd flag. * g10/gpg.c, sm/gpgsm.c (oDisableFdTranslation): New const. (opts): Add option "disable-fd-translation". (main): Set option. -- GnuPG-bug-id: 7060
2024-01-29doc: Fix spelling errors found by lintian.Werner Koch1-1/+1
-- Reported-by: Andreas Metzler <[email protected]>
2023-11-07doc: Use the em dash to mark a break in a sentence.NIIBE Yutaka1-5/+5
-- Signed-off-by: NIIBE Yutaka <[email protected]>
2023-11-06doc: Remove stray .RE in doc/gpgsm.texi.NIIBE Yutaka1-1/+0
-- Signed-off-by: NIIBE Yutaka <[email protected]>
2023-11-02doc: Fix to avoid using en-dash for command options.NIIBE Yutaka1-2/+2
-- GnuPG-bug-id: 6746 Signed-off-by: NIIBE Yutaka <[email protected]>
2023-10-05Minor style fixes.NIIBE Yutaka1-14/+14
-- Signed-off-by: NIIBE Yutaka <[email protected]>
2023-08-31gpgsm: Add --always-trust feature.Werner Koch1-0/+20
* sm/gpgsm.h (opt): Re-purpose unused flag always_trust. (struct server_control_s): Add "always_trust". (VALIDATE_FLAG_BYPASS): New. * sm/gpgsm.c (oAlwaysTrust): New. (opts): Add "--always-trust" (main): Set option. * sm/server.c (option_handler): Add option "always-trust". (reset_notify): Clear that option. (cmd_encrypt): Ditto. (cmd_getinfo): Add sub-command always-trust. * sm/certchain.c (gpgsm_validate_chain): Handle VALIDATE_FLAG_BYPASS. * sm/certlist.c (gpgsm_add_to_certlist): Set that flag for recipients in always-trust mode. -- GnuPG-bug-id: 6559
2023-06-15gpgsm: New option --input-size-hint.Werner Koch1-0/+10
* sm/gpgsm.c (oInputSizeHint): New. (opts): Add "--input-size-hint". (main): Set option. * sm/server.c (option_handler): Add option "input-size-hint". * sm/gpgsm.h (struct server_control_s): Add field input_size_hint. * sm/encrypt.c (gpgsm_encrypt): Set the toatl file size. * sm/decrypt.c (gpgsm_decrypt): Ditto. * sm/sign.c (gpgsm_sign): Ditto. * sm/verify.c (gpgsm_verify): Ditto. -- This option allows to set a value for the progress output line. Note that as of now there is no other way to set the file size. GnuPG-bug-id: 6534
2023-06-01doc: Replace remaining "gpg2" by "gpg".Werner Koch1-1/+1
--
2023-06-01doc: Replace remaining "gpg2" by "gpg".Werner Koch1-1/+1
--
2023-03-16gpgsm: New option --no-pretty-dnWerner Koch1-0/+9
* sm/gpgsm.c (oNoPrettyDN): New. (opts): Add --no-pretty-dn. (main): Implement. * sm/gpgsm.h (opt): Add no_pretty_dn. * sm/certdump.c (gpgsm_es_print_name): Act upon.
2023-03-08gpg,gpgsm: New option --log-timeWerner Koch1-0/+4
* g10/gpg.c (oLogTime): New. (opts): Add "log-time". (opt_log_time): New var. (main): Implement. * sm/gpgsm.c (oLogTime): New. (opts): Add "log-time". (opt_log_time): New var. (main): Implement.
2023-03-08gpgsm: Strip trailing zeroes from detached signatures.Werner Koch1-2/+4
* common/ksba-io-support.c: Include tlv.h (struct reader_cb_parm_s): Add new fields. (starts_with_sequence): New. (simple_reader_cb): Handle stripping. * common/ksba-io-support.h (GNUPG_KSBA_IO_STRIP): New. (gnupg_ksba_create_reader): Handle the new flag. * sm/verify.c (gpgsm_verify): Use the new flag for detached signatures. -- Note that this works only if --assume-binary is given. The use case for the feature is PDF signature checking where the PDF specs require that the detached signature is padded with zeroes.
2022-06-13gpgsm: New option --compatibility-flags.Werner Koch1-0/+8
* sm/gpgsm.c (oCompatibilityFlags): New option. (compatibility_flags): new. (main): Parse and print them in verbose mode. * sm/gpgsm.h (opt): Add field compat_glags.: (COMPAT_ALLOW_KA_TO_ENCR): New. * sm/keylist.c (print_capabilities): Take care of the new flag. * sm/certlist.c (cert_usage_p): Ditto.
2022-03-08gpgsm: New option --require-complianceWerner Koch1-0/+11
* sm/gpgsm.c (oRequireCompliance): New. (opts): Add --require-compliance. (main): Set option. * sm/gpgsm.h (opt): Add field require_compliance. (gpgsm_errors_seen): Declare. * sm/verify.c (gpgsm_verify): Emit error if non de-vs compliant. * sm/encrypt.c (gpgsm_encrypt): Ditto. * sm/decrypt.c (gpgsm_decrypt): Ditto. --
2022-02-03sm: New option --ignore-cert-with-oid.Werner Koch1-0/+10
* sm/gpgsm.c (oIgnoreCertWithOID): New. (opts): Add option. (main): Store its value. * sm/call-agent.c (learn_cb): Test against that list.
2022-01-27gpgsm: Retire the new --ldapserver.Werner Koch1-9/+7
* sm/gpgsm.c (oKeyServer_deprecated): New. (opts): Assign "ldapserver" to the new option and mark it as obsolete. -- We want to use "ldapserver" in dirmngr but need to keep using "keyserver" in gpgsm for existant versions of Kleopatra etc. GnuPG-bug-id: 5801
2021-11-18gpg,gpgsm: Add option --min-rsa-length.Werner Koch1-0/+10
* common/compliance.c (min_compliant_rsa_length): New. (gnupg_pk_is_compliant): Take in account. (gnupg_pk_is_allowed): Ditto. (gnupg_set_compliance_extra_info): New. * g10/gpg.c (oMinRSALength): New. (opts): Add --min-rsa-length. (main): Set value. * g10/options.h (opt): Add field min_rsa_length. * sm/gpgsm.c (oMinRSALength): New. (opts): Add --min-rsa-length. (main): Set value. * sm/gpgsm.h (opt): Add field min_rsa_length.
2021-06-16sm: New option --ldapserver as an alias for --keyserver.Werner Koch1-28/+9
* sm/gpgsm.c (opts): Add option --ldapserver and make --keyserver an alias. -- We should use "keyserver" for OpenPGP and thus it is better to allow for "ldapserver" here - it is the same convention as now used in dirmngr. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit d6df1bf84969bf5f5781e33bc1c2f6cb2aee0093)
2021-04-20sm: New command --show-certsWerner Koch1-0/+11
* sm/keylist.c (do_show_certs): New. (gpgsm_show_certs): New. * sm/gpgsm.c (aShowCerts): New. (opts): Add --show-certs. (main): Call gpgsm_show_certs. -- I have been using libksba test programs for countless times to look at certificates and I always wanted to add such a feature to gpgsm. This is simply much more convenient. Signed-off-by: Werner Koch <[email protected]>
2021-04-19gpg,gpgsm: Move use-keyboxd to the new conf file common.confWerner Koch1-0/+5
* common/comopt.c, common/comopt.h: New. * common/Makefile.am: Add them. * g10/gpg.c: Include comopt.h. (main): Also parse common.conf. * sm/gpgsm.c: Include comopt.h. (main): Set a flag for the --no-logfile option. Parse common.conf. * tools/gpgconf-comp.c (known_options_gpg): Remove "use-keyboxd", add pseudo option "use_keyboxd". (known_pseudo_options_gpg): Add pseudo option "use_keyboxd". (known_options_gpgsm): Remove "use-keyboxd". * tests/openpgp/defs.scm (create-gpghome): Create common.conf. * doc/examples/common.conf: New. -- Note that --use-keybox still works but prints a warning. We will eventually remove this option becuase it was marked as an experimental feature anyway. It would be too confusing if gpg and gpgsm use different key storages. Further, other components (e.g. dirmngr or gpg-wks-client) which call gpg or gpgsm need to be aware that the keyboxd is used and pass that option on the command line. Now that common.conf is always read (even if --no-options is used) those tools will work instantly.
2020-11-23doc: Fix typosGavin L. Rebeiro1-3/+3
-- GnuPG-bug-id: 5071 Also fixed one in keyformat.txt [wk].
2020-09-21doc: Some documentation updates.Werner Koch1-1/+1
-- Also fixed some typos and documented soon to be used OIDs
2020-08-06gpgsm: New option --chuid.Werner Koch1-0/+11
* sm/gpgsm.c (oChUid, opts): New option --chuid. (main): Implement option. -- This option will at least be useful for Scute. Signed-off-by: Werner Koch <[email protected]>
2020-05-19sm: Create ECC certificates with AKI and SKI by default.Werner Koch1-2/+18
* sm/certreqgen.c (create_request): Create AKI and SKI by default. -- GnuPG-bug-id: 4098 Signed-off-by: Werner Koch <[email protected]>
2020-04-16sm: Always allow authorityInfoAccess lookup if CRLs are also enabled.Werner Koch1-3/+8
* sm/certchain.c (find_up): Disable external lookups in offline mode. Always allow AKI lookup if CRLs are also enabled. -- GnuPG-bug-id: 4898 Signed-off-by: Werner Koch <[email protected]>
2020-03-27sm: Consider certificates w/o CRL DP as valid.Werner Koch1-0/+8
* sm/certchain.c (is_cert_still_valid): Shortcut if tehre is no DP. * common/audit.c (proc_type_verify): Print "n/a" if a cert has no distribution point. * sm/gpgsm.h (opt): Add field enable_issuer_based_crl_check. * sm/gpgsm.c (oEnableIssuerBasedCRLCheck): New. (opts): Add option --enable-issuer-based-crl-check. (main): Set option. -- If the issuer does not provide a DP and the user wants such an issuer, we expect that a certificate does not need revocation checks. The new option --enable-issuer-based-crl-check can be used to revert to the old behaviour which requires that a suitable LDAP server has been configured to lookup a CRL by issuer. Signed-off-by: Werner Koch <[email protected]>
2019-11-09gpgsm: Allow sepcification of ldaps servers.Werner Koch1-2/+16
* sm/gpgsm.h (struct keyserver_spec): Add field use_ldaps. * sm/gpgsm.c (parse_keyserver_line): Parse flags. * sm/call-dirmngr.c (prepare_dirmngr): Send ldaps flag to the dirmngr. * dirmngr/dirmngr.h (struct ldap_server_s): Add field use_ldaps. * dirmngr/ldapserver.c (ldapserver_parse_one): Parse flags. * dirmngr/ldap.c (start_cert_fetch_ldap): Call wrapper with --tls. * dirmngr/dirmngr_ldap.c: New option --tls. (fetch_ldap): Make use of that option. -- There was no way to specify an LDAPS server in dirmngr_ldapserver.socnf or with gpgsm's --keyserver option. This patch fixes this. Eventually we should allow to replace host and port by a partial URI in the same way ldap_initialize does it. For backward compatibility we do not yet do that. Although the dirmngr code accepts an URL (eg. taken from a certificate), I can't see how the scheme was ever used. Thus the patch also detects an ldaps scheme and uses this. That part has not been tested, though. Signed-off-by: Werner Koch <[email protected]>
2019-11-07doc: Document gpgsm's --keyserver option.Werner Koch1-0/+16
-- Also fix a few related entries. Signed-off-by: Werner Koch <[email protected]>
2019-09-05doc: Update description of --debugWerner Koch1-23/+5
-- Signed-off-by: Werner Koch <[email protected]>
2019-08-20doc: fix minor spelling and tense errorsDaniel Kahn Gillmor1-1/+1
* doc/{gpg,gpgsm,wks}.texi: minor orthographic cleanup. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2019-06-14fix up 6562de7475b21cd03c7b1a83a591fa563c589f5bDaniel Kahn Gillmor1-1/+1
Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2019-06-11doc/gpgsm: explain what "policy-file" refers to.Daniel Kahn Gillmor1-1/+2
A new user who sees "policy-file" and searches naively through the documentation to find it again won't be able to tell what this refers to, since "policies.txt" doesn't otherwise match the search string "policy". This gives them a fighting chance at finding the documentation. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2018-03-23gpg,sm: New option --request-origin.Werner Koch1-0/+9
* g10/gpg.c (oRequestOrigin): New const. (opts): New option --request-origin. (main): Parse that option. * g10/options.h (struct opt): Add field request_origin. * g10/call-agent.c (start_agent): Send option to the agent. * sm/gpgsm.c (oRequestOrigin): New const. (opts): New option --request-origin. (main): Parse that option. * sm/gpgsm.h (struct opt): Add field request_origin. * sm/call-agent.c (start_agent): Send option to the agent. Signed-off-by: Werner Koch <[email protected]>
2018-02-22doc: Fix recently introduced typo in gpgsm.texi.Werner Koch1-1/+1
--
2018-02-22doc: Clarify -export-secret-key-p12Werner Koch1-3/+3
-- GnuPG-bug-id: 3788 Signed-off-by: Werner Koch <[email protected]>
2017-09-11sm: Move qualified.txt from datadir into sysconfdirAlon Bar-Lev1-9/+3
* doc/Makefile.am: Move qualified.txt into examples. * doc/qualified.txt: Move into examples, remove trailing spaces. * doc/examples/README: Document qualified.txt. * doc/gpgsm.texi: Move qualified.txt from datadir into sysconfdir. * sm/qualified.c (read_list): Move qualified.txt from datadir into sysconfdir. -- The qualified.txt is maintained by Administrator it is a configuration file. In the past it was a hybrid, provided by package and controlled by the Administrator, however, it is no longer maintained by package. Signed-off-by: Alon Bar-Lev <[email protected]>
2017-09-08gpgsm: default to 3072-bit keys.Daniel Kahn Gillmor1-1/+1
* doc/gpgsm.texi, doc/howto-create-a-server-cert.texi: : update default to 3072 bits. * sm/certreqgen-ui.c (gpgsm_gencertreq_tty): update default to 3072 bits. * sm/certreqgen.c (proc_parameters): update default to 3072 bits. * sm/gpgsm.c (main): print correct default_pubkey_algo. -- 3072-bit RSA is widely considered to be 128-bit-equivalent security. This is a sensible default in 2017. Signed-off-by: Daniel Kahn Gillmor <[email protected]> Gbp-Pq: Topic update-defaults Gbp-Pq: Name 0014-gpgsm-default-to-3072-bit-keys.patch
2017-07-01doc: Document obsolete option in gpgsm. Closes T2231.Marcus Brinkmann1-4/+1
* doc/gpgsm.texi: Mark --prefer-system-dirmngr as obsolete. Signed-off-by: Marcus Brinkmann <[email protected]> GnuPG-bug-id: 2231
2017-05-31doc: Improve documentation.Justus Winter1-1/+1
* doc/gpgsm.texi: Mention that '--with-key-data' implies '--with-colons'. Signed-off-by: Justus Winter <[email protected]>
2017-04-28Spelling fixes in docs and comments.NIIBE Yutaka1-2/+2
-- In addition, fix trailing spaces in tests/inittests. GnuPG-bug-id: 3121 Reported-by: ka7 (klemens) Signed-off-by: NIIBE Yutaka <[email protected]>
2017-02-21Clean up word replication.Yuri Chornoivan1-1/+1
-- This fixes extra word repetitions (like "the the" or "is is") in the code and docs. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2016-12-15doc: Add aliases of all changed options.Justus Winter1-0/+4
* doc/gpg.texi: Add the old version of every option that was updated with the last change set. * doc/gpgsm.texi: Likewise. GnuPG-bug-id: 2700 Signed-off-by: Justus Winter <[email protected]>
2016-12-13g10,sm: Spell out --passwd.Justus Winter1-2/+2
* g10/gpg.c (opts): Spell out option. * sm/gpgsm.c (opts): Likewise. * doc/gpg.texi: Update accordingly. * doc/gpgsm.texi: Likewise. GnuPG-bug-id: 2700 Signed-off-by: Justus Winter <[email protected]>
2016-12-13g10,sm: Spell out --gen-key.Justus Winter1-3/+3
* g10/gpg.c (opts): Spell out option. * sm/gpgsm.c (opts): Likewise. * doc/gpg.texi: Update accordingly. GnuPG-bug-id: 2700 Signed-off-by: Justus Winter <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-20 16:03:00 +0000