aboutsummaryrefslogtreecommitdiffstats
path: root/doc (unfollow)
Commit message (Collapse)AuthorFilesLines
2021-03-15gpg: New option --no-auto-trust-new-key.Beta-2.3.0-beta1655Werner Koch1-0/+6
* g10/gpg.c (oNoAutoTrustNewKey): New. (opts): Add --no-auto-trust-new-key. (main): Set it. * g10/options.h (opt): Add flags.no_auto_trust_new_key. Signed-off-by: Werner Koch <[email protected]>
2021-03-14doc: Typo fix in scdaemon.texiWerner Koch1-1/+1
--
2021-03-12doc: add documentation for gpg's keytotpm commandJames Bottomley1-0/+20
-- The tpm2d patches introduced a new --edit-key command: keytotpm. Add a descriptive entry explaining what it does and how it works. Signed-off-by: James Bottomley <[email protected]>
2021-03-12scd: New option --pcsc-shared.Werner Koch1-0/+6
* scd/scdaemon.h (opt): Add field opcsc_shared. * scd/scdaemon.c (opcscShared): New. (opts): Add "--pcsc-shared". (main): Set flag. * scd/apdu.c (connect_pcsc_card): Use it. (pcsc_get_status): Take flag in account. * scd/app-openpgp.c (cache_pin): Bypass in shared mode. (verify_chv2: Do not auto verify chv1 in shared mode. * scd/app-piv.c (cache_pin): By pass caceh in shared mode. -- This option should in general not be used. The patch tries to limit bad effects but using shared mode is somewhat dangerous depending on the other PC/SC users.
2021-03-11scd:piv: Improve APT parser compatibility.Valtteri Vuorikoski1-0/+1
* scd/app-piv.c (app_select_piv): Allow for full AID. -- It appears that SP-800-73-x is not too clear about the format of these objects. Many current cards (such as the Yubikey 5 series) apparently have only the PIX in DO 0x4F and only the RID in object 0x79/0x4F. However, other cards as well as the PivApplet Javacard applet have the full AID in 0x4F (which actually seems closer to what the standard says). PivApplet also has the full AID in 0x79/0x4F, but this is probably incorrect. (Here is a long discussion of the matter from an OpenSC author: https://github.com/arekinath/PivApplet/issues/43#issuecomment-772649709) [Taken from a mail to gnupg-devel date 2021-02-03.] Signed-off-by: Werner Koch <[email protected]>
2021-03-11doc: Add a sending patches section to HACKING.Werner Koch1-1/+40
-- This is based on a patch by Co-authored-by: Thorsten Behrens <[email protected]> Co-authored-by: Todd Zullinger <[email protected]> regarding Libassuan sent to gnupg-devel on 2018-02-02
2021-03-11doc: Always use --edit-key and not just the --edit abbreviation.Werner Koch3-7/+7
-- Reported-by: Carl Michael Skog
2021-03-11gpg: New option --force-sign-keyWerner Koch1-9/+20
* g10/gpg.c (oForceSignKey,opts): New option "--force-sign-key". (main): Set it. * g10/options.h (opt): New flag flags.force_sign_key. * g10/keyedit.c (sign_uids): Use new flag. -- GnuPG-bug-id: 4584
2021-03-10scd:p15: Support special extended usage flags for OpenPGP keys.Werner Koch1-0/+5
* scd/app-p15.c (struct gpgusage_flags_s): New. (struct prkdf_object_s): Add field gpgusage. (struct app_local_s): Add field any_gpgusage. (dump_gpgusage_flags): New. (read_p15_info): Parse athe gpgusage flags. (do_getattr): Take care of the gpgusage flags. -- This features allows to mark keys to be used for OpenPGP. This is done by putting additional extended key infos into the certificate stored on the cards. Only if any such extended key usage is detected for a stored certificate this new mode chimes in. This feature gives the card issuer a high flexibility on how to make sure certain keys are used with OpenPGP.
2021-03-05w32: Always use Unicode for console input and output.Werner Koch1-6/+13
* common/init.c (_init_common_subsystems) [W32]: Set the codepage to UTF-8 for input and putput. Switch gettext to UTF-8. * tools/gpgconf.c (main): Display the input and output codepage if they differ. * g10/gpg.c (utf8_strings) [W32]: Make sure this is always set. -- With this patch the former patch to use ReadConsoleW and WriteConsoleW in ttyio.c are kind of superfluous because the ANSI version of these functions are also able to read/write UTF-8 directly given the console code page has been set correctly. However, this seems to work only with recent versions of Windows-10. GnuPG-bug-id: 4365
2021-02-25doc: Typo fixes for dirmngr.texiWerner Koch1-3/+3
--
2021-02-24doc: Explain how Tor is detected.Werner Koch1-1/+4
--
2021-02-19wkd: Install gpg-wks-client under bin and add wrapper for libexecWerner Koch1-9/+0
-- gpg-wks-client is a pretty useful command on the command line. Thus we now install it at bin and provide a compatibility wrapper.
2021-02-17dirmngr: Support new gpgNtds parameter in LDAP keyserver URLs.Werner Koch3-8/+17
* dirmngr/ldap-parse-uri.c (ldap_parse_uri): Support a new gpgNtds extension. * dirmngr/ks-engine-ldap.c (my_ldap_connect): Do ldap_init always with hostname - which is NULL and thus the same if not given. Fix minor error in error code handling. -- Note that "gpgNtds" is per RFC-4512 case insensitive and has not yet been officially regisetered. Thus for correctness the OID can be used: 1.3.6.1.4.1.11591.2.5 LDAP URL extensions 1.3.6.1.4.1.11591.2.5.1 gpgNtds=1 (auth. with current user) Note that the value must be 1; all other values won't enable AD authentication and are resevered for future use. This has been cherry-picked from the 2.2 branch, commit 55f46b33df08e8e0ea520ade5f73b321bc01d705 Signed-off-by: Werner Koch <[email protected]>
2021-02-11doc: Improve the gpg-card man page.Werner Koch1-2/+195
--
2021-02-10gpg: Do not allow old cipher algorithms for encryption.Werner Koch1-5/+16
* g10/gpg.c: New option --allow-old-cipher-algos. (set_compliance_option): Set --rfc4880bis explictly to SHA256 and AES256. Allow old cipher algos for OpenPGP, rfc4880, and rfc2440. * g10/options.h (opt): Add flags.allow_old_cipher_algos. * g10/misc.c (print_sha1_keysig_rejected_note): Always print the note unless in --quiet mode. * g10/encrypt.c (setup_symkey): Disallow by default algos with a blocklengt < 128. (encrypt_crypt): Ditto. Fallback by default to AES instead of 3DES. * g10/pkclist.c (algo_available): Take care of old cipher also. (select_algo_from_prefs): Use AES as implicit algorithm by default. * tests/openpgp/defs.scm (create-gpghome): Set allow-old-cipher-algos. -- GnuPG-bug-id: 3415
2021-02-09tools: Remove the symcryptrun tool.Werner Koch2-124/+1
* tools/symcryptrun.c: Remove. * tools/Makefile.am: Ditto. * doc/tools.texi: Remove man page. * configure.ac: Remove build option and tests used only by this tool. * Makefile.am (AM_DISTCHECK_CONFIGURE_FLAGS): Do not build symcryptrun. -- symcryptrun is too ancient to be of any use and has not been tested in many years. Thus we should not distribute it anymore.
2021-02-02gpg: Remove support for PKA.Werner Koch1-34/+5
* g10/gpg.c (oPrintPKARecords): Remove. (opts): Remove --print-pka-records. (main): Remove "pka-lookups","pka-trust-increase" and other PKA stuff. * g10/options.h (EXPORT_DANE_FORMAT): Remove. (VERIFY_PKA_LOOKUPS, VERIFY_PKA_TRUST_INCREASE): Remove. (KEYSERVER_HONOR_PKA_RECORD): Remove. * g10/packet.h (pka_info_t): Remove. (PKT_signature): Remove flags.pka_tried and pka_info. * g10/parse-packet.c (register_known_notation): Remove "[email protected]". * g10/pkclist.c (check_signatures_trust): Remove PKA stuff. * g10/call-dirmngr.c (gpg_dirmngr_get_pka): Remove. * g10/export.c (parse_export_options): Remove "export-pka". (do_export): Adjust for this. (write_keyblock_to_output): Ditto. (do_export_stream): Ditto. (print_pka_or_dane_records): Rename to ... (print_dane_records): this and remove two args. Remove PKA printing. * g10/free-packet.c (free_seckey_enc, cp_pka_info): Adjust for removed pka_info field. * g10/getkey.c (get_pubkey_byname): Make AKL_PKA a dummy. * g10/keyserver.c: Remove "honor-pka-record". (keyserver_import_pka): Remove. * g10/mainproc.c (get_pka_address): Remove. (pka_uri_from_sig): Remove. (check_sig_and_print): Remove code for PKA. -- PKA (Public Key Association) was a DNS based key discovery method which looked up fingerprint by mail addresses in the DNS. This goes back to the conference where DKIM was suggested to show that we already had a better method for this available with PGP/MIME. PKA was was later superseded by an experimental DANE method and is today not anymore relevant. It is anyway doubtful whether PKA was ever widely used. Signed-off-by: Werner Koch <[email protected]>
2021-02-02gpg: Remove experimental feature to export w/o user-ids.Werner Koch1-10/+0
* g10/options.h (IMPORT_DROP_UIDS, EXPORT_DROP_UIDS): Remove. * g10/import.c (parse_import_options): Remove option import-drop-uids. (import_one_real): Remove drop uids code. (remove_all_uids): Remove function. * g10/export.c (parse_export_options): Remove option export-drop-uids. (do_export_one_keyblock): Remove drop uids code.
2020-12-28Update Traditional Chinese doc/help.zh_TW.txtYao Wei1-102/+224
-- Signed-off-by: Yao Wei <[email protected]>
2020-12-23doc: Add instructions on how to setup an Active Directory.Werner Koch2-9/+89
--
2020-12-23doc: Update Simplified Chinese doc/help.zh_CN.txt.bobwxc1-57/+206
-- GnuPG-bug-id: 5189 Signed-off-by: bobwxc <[email protected]>
2020-12-23doc: Update Japanese doc/help.ja.txt.NIIBE Yutaka1-10/+43
-- Signed-off-by: NIIBE Yutaka <[email protected]>
2020-12-21doc: Explain LDAP keyserver parametersWerner Koch1-1/+20
2020-12-17gpg: New AKL method "ntds"Werner Koch1-0/+3
* dirmngr/ks-engine-ldap.c (keyspec_to_ldap_filter): Change the new support for KEYDB_SEARCH_MODE_MAIL. (ks_ldap_get): Add a debug. * g10/options.h (AKL_NTDS): New. * g10/keyserver.c (keyserver_import_ntds): New. (keyserver_get_chunk): Allow KEYDB_SEARCH_MODE_MAIL. * g10/getkey.c (parse_auto_key_locate): Support "ntds". (get_pubkey_byname): Ditto.
2020-12-17dirmngr: Finalize Active Directory LDAP SchemaWerner Koch3-5/+7
-- With these modifications it is now possible to store and retrieve keys from an AD without manually tweaking the schema. Permissions need to be set manuallay, though.
2020-12-15dirmngr: Remove superfluous attribute from the LDAP schema.Werner Koch2-27/+10
-- I accidently added a gpgSubCertID attribute not realizing that the pgpSubKeyID already carries the long keyid. Remove that. Note that the pgpkeyID has the short keyid and the long keyid has the name pgpCertID. Signed-off-by: Werner Koch <[email protected]>
2020-12-14dirmngr: Support the new Active Directory schemaWerner Koch3-4/+382
* dirmngr/ks-engine-ldap.c (SERVERINFO_): New constants. (my_ldap_connect): Relace args pgpkeyattrp and real_ldapp by a new serverinfo arg. Set the new info flags. (ks_ldap_get): Adjust for change. (ks_ldap_search): Ditto. (ks_ldap_put): Ditto. Replace xmalloc by xtrymalloc. Change the DN for use with NTDS (aka Active Directory). * doc/ldap/gnupg-ldap-init.ldif (pgpSoftware): Update definition of pgpVersion. * doc/ldap/gnupg-ldap-ad-init.ldif: New. * doc/ldap/gnupg-ldap-ad-schema.ldif: New. -- This is a first take on better Active Directory support. The main change for NTDS in the code is that the an top-RDN of CN is used instead of the old pgpCertID. More changes to come; for example using and storing the fingerprint. Signed-off-by: Werner Koch <[email protected]>
2020-12-01doc: Add parameters for batch generation of ECC keys.Jens Meißner1-0/+8
* doc/gpg.texi: Add parameters for batch generation of ECC keys. -- There are parameters required for batch generation of ECC keys which weren't mentioned in the documentation. Signed-off-by: Jens Meißner <[email protected]>
2020-11-26scd: Add special serialno compare for OpenPGP cards.Werner Koch1-0/+1
* scd/app.c (is_same_serialno): New. (check_application_conflict): Use this. (select_application): Ditto. (app_switch_current_card): Ditto. * scd/app-openpgp.c (check_keyidstr): Ignore the card version and also compare case insensitive. -- This is required because we change what we emit as serialno of OpenPGP cards but existing keys still use the old form of the serial number (i.e. with a firmware version). See-commit: 3a8250c02031080c6c8eebd5dea03f5f87f9ddd7 Signed-off-by: Werner Koch <[email protected]>
2020-11-23doc: Fix typosGavin L. Rebeiro2-5/+5
-- GnuPG-bug-id: 5071 Also fixed one in keyformat.txt [wk].
2020-11-13gpg: Fix the encrypt+sign hash algo preference selection for ECDSA.Werner Koch1-0/+1
* g10/keydb.h (pref_hint): Change from union to struct and add field 'exact'. Adjust callers. * g10/pkclist.c (algo_available): Take care of the exact hint. * g10/sign.c (sign_file): Rework the hash detection from recipient prefs. -- This fixes a encrypt+sign case like: One recipient key has SHA512 as highest ranked hash preference but the the signing key is a 256 bit curve. Because we don't want to use a truncated hash with ECDSA, we need to have an exact match - this is in particular important for smartcard which check that the hash matches the curves. Signed-off-by: Werner Koch <[email protected]> Ported-from-stable: aeed0b93ff660fe271d8f98f8d5ce60aa5bf3ebe
2020-11-09card: Run factory-reset in locked stated.Werner Koch1-0/+1
* scd/command.c (reset_notify): Add option --keep-lock. (do_reset): Add arg keep_lock. (cmd_lock): Send progress status. * g10/call-agent.c (agent_scd_apdu): Add more pseudo APDUs. * g10/card-util.c (send_apdu): Ditto. (factory_reset): Use lock commands. -- This is required so that for example Kleopatra does not detect the RESET and issues a SERIALNO of its own, thus conflicting with our SERIALNO undefined. Signed-off-by: Werner Koch <[email protected]>
2020-11-04speedo,w32: Install gpg-check-pattern and example profiles.Werner Koch3-2/+18
* doc/examples/vsnfd.prf: Rename to VS-NfD.prf. * doc/examples/Automatic.prf: New. * doc/Makefile.am (examples): Adjust. * build-aux/speedo/w32/inst.nsi: Install gpg-check-pattern.exe and 3 example files. * build-aux/speedo/w32/wixlib.wxs: Add new files. -- Note that we renamed the existing example profile so that kleopatra shows a nicer name. In fact the gpg4win installer just copies of theses file but it is better to maintain them here. gpg-check-pattern.exe can no be installed because we meanwhile have a regex lib which works also on Windows. Signed-off-by: Werner Koch <[email protected]>
2020-10-28gpg: New command --quick-revoke-sigWerner Koch1-0/+11
* g10/gpg.c (enum cmd_and_opt_values): Add aQuickRevSig. (opts): Add --quick-revoke-sig. (main): Implement. * g10/keyedit.c (quick_find_keyblock): Add arg 'want_secret' and adjust all callers. (keyedit_quick_revsig): new. * g10/revoke.c (get_default_sig_revocation_reason): New. * g10/keylist.c (cmp_signodes): Make global. -- GnuPG-bug-id: 5093
2020-10-27gpg: Sort the signatures in standard key listings.Werner Koch1-0/+8
* g10/gpg.c (parse_list_options): Add "sort-sigs". (main): Make it the default. * g10/options.h (LIST_SORT_SIGS): New. * g10/keylist.c (cmp_signodes): New. (list_keyblock_print): Sort signatures and factor signature printing code out to ... (list_signature_print): new. -- In particular together with --full-timestamps this makes it easier to see the history of key signatures and their revocations. The self-signatures are also printed first. To disable this --list-options no-sort-sigs can be used. Also don't print the annoying "no recocation reason specified" message. Signed-off-by: Werner Koch <[email protected]>
2020-10-23common: Allow building with released libgpg-error.Werner Koch1-1/+2
* common/sysutils.c (gnupg_access) [W32]: Fix for older libgpgrt. -- Fixes-commit: c94ee1386e0d5cdac51086c4d5b92de59c09c9b5 Signed-off-by: Werner Koch <[email protected]>
2020-10-07doc: Add notes on how to setup LDAPWerner Koch3-0/+681
--
2020-10-05dirmngr: Add warning on the use of --add-servers.Werner Koch1-11/+16
* tools/gpgconf-comp.c (known_options_dirmngr): Degrade add-servers to expert mode.
2020-10-01doc: Remove enable-extended-key-format in vsnfdAndre Heinecke1-1/+0
* doc/examples/vsnfd.prf: Remove enable-extended-key-format -- This is no longer a valid option for gpg-agent because it is now the default. (cherry picked from commit d833030f8cf646b5de83d01fc3e412ad77ec4b1c)
2020-09-24gpg: New experimental import option "bulk-import"Werner Koch1-0/+4
* g10/options.h (IMPORT_BULK): New. * g10/import.c (parse_import_options): Add "bulk-import". * g10/call-keyboxd.c (in_transaction): New var. (gpg_keyboxd_deinit_session_data): Run a commit if in bulk import mode. (create_new_context): Run a begin transaction if in bulk import mode. -- Initial tests with this option are not very promising. Importing about 3000 real world keys with --use-keyboxd and full logging took: real 33m31.724s user 19m54.265s sys 2m49.662s With bulk-import this saves a mere 12%: real 29m36.542s user 19m3.391s sys 2m46.728s Signed-off-by: Werner Koch <[email protected]>
2020-09-22keyboxd: Extend PUBKEY_INFO status line with an uid ordinal.Werner Koch1-1/+5
* kbx/backend-sqlite.c (table_definitions): Add column UINO to userids. (be_sqlite_local_s): Add fields select_col_uidno and select_col_subkey. (run_select_statement): Also select subkey or uidno column. (be_sqlite_search): Return their values. (store_into_userid): Store the UIDNO. * kbx/backend-support.c (be_return_pubkey): Extend PUBKEY_INFO. -- For an existing database adding the new column to the table userid is straightforward. However if the original version of the schema used an integer for the keyid column, that column has likely be renamed. Make sure that the NOT NULL constraint has also be removed; check the SQLite documentation on how this can be done. Signed-off-by: Werner Koch <[email protected]>
2020-09-21scd: Extend KEYPAIRINFO with an algorithm string.Werner Koch1-4/+5
* scd/app-openpgp.c (send_keypair_info): Emit the algo string as part of a KEYPAIRINFO. * scd/command.c (do_readkey): Ditto. * scd/app-piv.c (do_readkey): Ditto. * scd/app-nks.c (do_learn_status_core): Ditto. (struct fid_cache_s): Add field algostr. (flush_fid_cache): Release it. (keygripstr_from_pk_file): Fill it and add it to the cache. Use a single exit label. * scd/app-help.c (app_help_get_keygrip_string_pk): Add new arg r_algostr. Change all callers. -- This is helpful so that callers do not need to parse the key for this basic information. Use "scd readkey --info-only" to return the info status line instead of the key material; using just --info returns the info in addition to the key material. Signed-off-by: Werner Koch <[email protected]>
2020-09-21doc: Some documentation updates.Werner Koch3-10/+77
-- Also fixed some typos and documented soon to be used OIDs
2020-09-11keyboxd: Add ephemeral and revoked flag to the sqlite backend.Werner Koch1-1/+5
* kbx/backend-support.c (be_return_pubkey): Add args is_ephemeral and is_revoked. Adjust callers. * kbx/backend-sqlite.c: Alter table pubkey to add new columns. (run_select_statement): Add new column to all selects. (be_sqlite_search): Return the new flags. -- For existing test databases the new column can be added with: alter table pubkey add ephemeral integer not null default 0; alter table pubkey add revoked integer not null default 0; Signed-off-by: Werner Koch <[email protected]>
2020-09-10doc: Update and extend module overviewAndre Heinecke1-90/+274
* doc/gnupg-module-overview.svg: Add examples of GPGME aware applications -- Whenever I used this overview I needed to explain what this meant so giving examples might help a bit and also illustrate the codesharing between GpgOL, Kleopatra and KMail.
2020-09-04scd: Parse "Algorithm Information" data object in scdaemon.NIIBE Yutaka1-0/+6
* scd/app-openpgp.c (data_objects): 0x00FA for binary data. (do_getattr): Parse the data and send it in status lines. (get_algorithm_attribute_string): New. Signed-off-by: NIIBE Yutaka <[email protected]>
2020-08-28doc: Fix typosGavin L. Rebeiro2-2/+2
--
2020-08-27doc: Add a remark about keyservers.Werner Koch1-0/+5
--
2020-08-25examples: Simplify vsnfd.prfWerner Koch1-1/+0
* doc/examples/vsnfd.prf: Remove default-new-key-algo option.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-20 22:35:58 +0000