aboutsummaryrefslogtreecommitdiffstats
path: root/doc (unfollow)
Commit message (Collapse)AuthorFilesLines
2018-03-06agent: Also evict cached items via a timer.Werner Koch1-1/+4
* agent/cache.c (agent_cache_housekeeping): New func. * agent/gpg-agent.c (handle_tick): Call it. -- This change mitigates the risk of having cached items in a post mortem dump. GnuPG-bug-id: 3829 Signed-off-by: Werner Koch <[email protected]>
2018-02-22doc: Fix recently introduced typo in gpgsm.texi.Werner Koch1-1/+1
--
2018-02-22doc: Clarify -export-secret-key-p12Werner Koch1-3/+3
-- GnuPG-bug-id: 3788 Signed-off-by: Werner Koch <[email protected]>
2018-02-21doc: Add extra hint on unattended use of gpg.Werner Koch1-0/+13
--
2018-02-20wks: Add special mode to --install-key.Werner Koch1-10/+7
* tools/gpg-wks-client.c (get_key_status_parm_s) (get_key_status_cb, get_key): Move to ... * tools/wks-util.c: ...here. (get_key): Rename to wks_get_key. * tools/gpg-wks-server.c: Include userids.h. (command_install_key): Allow use of a fingerprint. Signed-off-by: Werner Koch <[email protected]>
2018-02-20wks: Implement server command --install-key.Werner Koch1-4/+8
* tools/wks-util.c (wks_filter_uid): Add arg 'binary'. * tools/gpg-wks-server.c (main): Expect 2 args for --install-key. (write_to_file): New. (check_and_publish): Factor some code out to ... (compute_hu_fname): ... new. (command_install_key): Implement. Signed-off-by: Werner Koch <[email protected]>
2018-02-09doc: Add compliance de-vs to gpgsm in vsnfd.prfAndre Heinecke1-0/+1
* doc/examples/vsnfd.prf: Set complaince mode for gpgsm.
2018-01-25doc: Note --quick-gen-key as an alias for --quick-generate-keyWerner Koch1-0/+2
--
2018-01-24gpg: New maintainer option --debug-set-iobuf-size.Werner Koch1-0/+6
* g10/gpg.c (opts): Add new option. (opt_set_iobuf_size): New var. (set_debug): Set the option. * tests/openpgp/armor.scm: Use this option to revert the buffer size to the one which used to exhibit the tested bugs. Signed-off-by: Werner Koch <[email protected]>
2018-01-23gpg: New option --chunk-size.Werner Koch1-7/+49
* g10/gpg.c (opts): New option --chunk-size. (oChunkSize): New const. (build_list_aead_test_algo, build_list_aead_algo_name): New. (my_strusage): List AEAD algos. (main): Implement --chunk-size.. * g10/options.h (struct opt): Add field 'chunk_size'. (DBG_IPC): Remove duplicated macro. * g10/main.h (DEFAULT_AEAD_ALGO): Depend on Libgcrypt version. * g10/misc.c (openpgp_aead_test_algo): Ditto. * g10/cipher-aead.c: Silence if not in debug mode. * g10/decrypt-data.c: Ditto. -- And that new option immediatley revealed bugs in our chunking code :-(.
2018-01-21gpg: First take on PKT_ENCRYPTED_AEAD.Werner Koch1-2/+5
* common/openpgpdefs.h (PKT_ENCRYPTED_AEAD): New const. * g10/dek.h (DEK): Increase size of use_aead to 4 bits. * g10/filter.h (cipher_filter_context_t): Add new fields for AEAD. * g10/packet.h (PKT_encrypted): Add fields aead_algo, cipher_algo, and chunkbyte. * g10/build-packet.c (do_encrypted_aead): New. (build_packet): Call it. * g10/parse-packet.c (dump_sig_subpkt): Handle SIGSUBPKT_PREF_AEAD. (parse_one_sig_subpkt, can_handle_critical): Ditto. (parse_encrypted): Clear new PKT_ENCRYPTED fields. (parse_encrypted_aead): New. (parse): Call it. * g10/gpg.c (main): Take care of --rfc4880bis option when checking compliance. * g10/cipher-aead.c: Replace the stub by real code. * g10/decrypt-data.c (decode_filter_ctx_t): Add fields for use with AEAD. (aead_set_nonce): New. (aead_set_ad): New. (decrypt_data): Support AEAD. (aead_underflow): New. (aead_decode_filter): New. * g10/encrypt.c (use_aead): Make that new fucntion work. (encrypt_simple): Use default_aead_algo() instead of EAX. * g10/mainproc.c (proc_encrypted): Support AEAD. (do_proc_packets): Support PKT_ENCRYPTED_AEAD. -- This code has seen only a very few manual tests. Encrypting always uses a 64k chunks and decryption has not been tested with larger chunks. Those small chunks make debugging much faster. Tests can be done using: gpg --rfc4880bis --pinentry-mode=loopback --passphrase abc \ --force-aead --aead-algo ocb --s2k-mode 0 --cipher AES \ -v -z 0 --status-fd 2 -c <INFILE >OUTFILE and gpg --rfc4880bis --pinentry-mode=loopback --passphrase=abc \ --status-fd 2 -v -d <INFILE >OUTFILE Signed-off-by: Werner Koch <[email protected]>
2018-01-09doc: Note pinentry-mode for passphrase optsAndre Heinecke1-6/+11
* doc/gpg.texi (--passphrase, --passphrase-file, --passphrase-fd): Note that pinentry-mode needs to be loopback. Signed-off-by: Andre Heinecke <[email protected]>
2017-12-19wks: New server options --check, --with-dir, with-file.Werner Koch1-4/+33
* tools/gpg-wks-server.c (aCheck, oWithDir, oWithFile): New const. (opts): New options --check, --with-dir, and --with-file. (main): Call command_check_key. (command_list_domains): Implement option --with-dir. (fname_from_userid): New. (command_check_key): New. (command_remove_key): Implement existsing command. (command_revoke_key): Call command_remove_key as a simple implementation. Signed-off-by: Werner Koch <[email protected]>
2017-12-18conf: New option --status-fd.Werner Koch1-0/+8
* tools/gpgconf.c (oStatusFD): New const. (opts): New option --status-fd. (statusfp): New var. (set_status_fd): New. (gpgconf_write_status): New. (gpgconf_failure): New. (main): Set status fd and replace exit by gpgconf_failure. * tools/gpgconf-comp.c: Repalce exit by gpgconf_failure. (gc_process_gpgconf_conf): Print a few warning status messages. Signed-off-by: Werner Koch <[email protected]>
2017-12-18sm: Allow explicit setting of the default --compliance=gnupgWerner Koch1-4/+3
* sm/gpgsm.c (main): Allow setting of the default compliance. * tools/gpgconf-comp.c (gc_options_gpgsm): Add "compliance". -- This is required so that we can use this option in in gpgconf.conf. Signed-off-by: Werner Koch <[email protected]>
2017-12-12Change backlog from 5 to 64 and provide option --listen-backlog.Werner Koch3-0/+13
* agent/gpg-agent.c (oListenBacklog): New const. (opts): New option --listen-backlog. (listen_backlog): New var. (main): Parse new options. (create_server_socket): Use var instead of 5. * dirmngr/dirmngr.c: Likewise. * scd/scdaemon.c: Likewise. -- GnuPG-bug-id: 3473 Signed-off-by: Werner Koch <[email protected]>
2017-12-11doc: Typo fixWerner Koch1-1/+1
--
2017-12-08doc: Clarify C90 exceptions and add a new commit tag.Werner Koch1-7/+4
-- The variable definition inside a for statement require to use a c99 option for gcc which we do not want. It has never been used and thus we drop it. Signed-off-by: Werner Koch <[email protected]>
2017-12-08doc: Fix DijkstraWerner Koch1-0/+1
-- Edsger Wybe Dijkstra (1930 --2002) - Dutch computer scientist
2017-11-30doc: clarify that --encrypt refers to public key encryptionDaniel Kahn Gillmor1-5/+7
-- A simple read of gpg(1) is ambiguous about whether --encrypt could be for either symmetric or pubkey encryption. Closer inference suggests that --encrypt is about pubkey encryption only. Make that clearer on a first read. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2017-11-24agent: New option --auto-expand-secmem.Werner Koch1-0/+11
* agent/gpg-agent.c (oAutoExpandSecmem): New enum value. (opts): New option --auto-expand-secmem. (main): Implement that option. -- Note that this option has an effect only if Libgcrypt >= 1.8.2 is used. GnuPG-bug-id: 3530
2017-11-21doc: clarify that --encrypt refers to public key encryptionDaniel Kahn Gillmor1-5/+7
-- A simple read of gpg(1) is ambiguous about whether --encrypt could be for either symmetric or pubkey encryption. Closer inference suggests that --encrypt is about pubkey encryption only. Make that clearer on a first read. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2017-11-20Revert "build: BSD make support for yat2m."Werner Koch1-10/+2
-- This reverts commit e1984969cac06a88c7e6f5e49e5c3104d10a847d because that was 2.2 only.
2017-11-20build: BSD make support for yat2m.NIIBE Yutaka1-2/+10
* configure.ac (YAT2M): Only define when found. * doc/Makefile.am: Portability fix. -- This is not intended to apply to master, but 2.2 branch only. When new libgpg-error is required, installation of yat2m can be assumed. Signed-off-by: NIIBE Yutaka <[email protected]>
2017-11-15doc: Add man page for gpgtarWerner Koch2-38/+102
-- This also removes the documentation for gpg-zip which is not distributed anymore. Signed-off-by: Werner Koch <[email protected]>
2017-11-15doc: fix NEWSIG documentationWill Thompson1-3/+2
-- 08c82b1 introduced one optional argument for this status message. Due to an apparent editing error, the sentence fragment "arguments are currently defined." was left in the documentation. Signed-off-by: Will Thompson <[email protected]>
2017-11-15doc: expand documentation of PROGRESS messageWill Thompson1-4/+7
-- This answers two questions that I was only able to answer by examining each site where PROGRESS messages are emitted, and fixes a typo. Signed-off-by: Will Thompson <[email protected]>
2017-11-07dirmngr: Reduce default LDAP timeout to 15 seconds.Werner Koch1-1/+1
* dirmngr/dirmngr.c (DEFAULT_LDAP_TIMEOUT): Change to 15. * dirmngr/dirmngr_ldap.c (DEFAULT_LDAP_TIMEOUT): Ditto. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit ab7ac827041b5cd97bbca7a75b0930072dd6611f) GnuPG-bug-id: 3487
2017-11-07dirmngr: Reduce default LDAP timeout to 15 seconds.Werner Koch1-1/+1
* dirmngr/dirmngr.c (DEFAULT_LDAP_TIMEOUT): Change to 15. * dirmngr/dirmngr_ldap.c (DEFAULT_LDAP_TIMEOUT): Ditto. Signed-off-by: Werner Koch <[email protected]>
2017-11-06agent: New GETINFO sub-commands "s2k_count_cal" and "s2k_time".Werner Koch1-8/+18
* agent/command.c (cmd_getinfo): New sub-commands. * agent/protect.c (get_standard_s2k_count): Factor some code out to ... (get_calibrated_s2k_count): new. (get_standard_s2k_time): New. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 52d41c8b0f4af6278d18d8935399ddad16a26856)
2017-11-06agent: New option --s2k-count.Werner Koch1-0/+14
* agent/agent.h (opt): New field 's2k_count'. * agent/gpg-agent.c (oS2KCount): New enum value. (opts): New option --s2k-count. (parse_rereadable_options): Set opt.s2k_count. -- This option is useful to speed up the starting of gpg-agent and in cases where the auto-calibration runs into problems due to a broken time measurement facility. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit f7212f1d11aad5d910d2c77b2e5c6ab31a0e786e)
2017-11-06agent: New GETINFO sub-commands "s2k_count_cal" and "s2k_time".Werner Koch1-8/+18
* agent/command.c (cmd_getinfo): New sub-commands. * agent/protect.c (get_standard_s2k_count): Factor some code out to ... (get_calibrated_s2k_count): new. (get_standard_s2k_time): New. Signed-off-by: Werner Koch <[email protected]>
2017-11-06agent: New option --s2k-count.Werner Koch1-0/+14
* agent/agent.h (opt): New field 's2k_count'. * agent/gpg-agent.c (oS2KCount): New enum value. (opts): New option --s2k-count. (parse_rereadable_options): Set opt.s2k_count. -- This option is useful to speed up the starting of gpg-agent and in cases where the auto-calibration runs into problems due to a broken time measurement facility. Signed-off-by: Werner Koch <[email protected]>
2017-10-20doc: Fix "SEE ALSO" section of gpgv.Werner Koch1-1/+1
--
2017-10-19gpg: Print sec/sbb with --import-option import-show or show-only.Werner Koch1-1/+2
* g10/import.c (import_one): Pass FROM_SK to list_keyblock_direct. -- Note that this will likely add the suffix '#' top "sec" because the secret key has not yet (or will not be) imported. If the secret key already exists locally another suffix might be printed. The upshot is that the suffix has no usefulness. GnuPG-bug-id: 3431 Signed-off-by: Werner Koch <[email protected]>
2017-10-17gpg,sm: New option --with-key-screening.Werner Koch1-1/+3
* common/pkscreening.c: New. * common/pkscreening.h: New. * common/Makefile.am (common_sources): Add them. * g10/gpg.c (opts): New option --with-key-screening. * g10/options.h (struct opt): New field with_key_screening. * g10/keylist.c: Include pkscreening.h. (print_pk_screening): New. (list_keyblock_print): Call it. (print_compliance_flags): Call it. * sm/gpgsm.c (opts): New option --with-key-screening. * sm/gpgsm.h (scruct opt): New field with_key_screening. * sm/keylist.c: Include pkscreening.h. (print_pk_screening): New. (print_compliance_flags): Call it. Add new arg cert. (list_cert_colon): Pass arg cert (list_cert_std): Call print_pk_screening. * sm/fingerprint.c (gpgsm_get_rsa_modulus): New. -- This new option can be used to detect ROCA affected keys. To scan an entire keyring and print the affected fingerprints use this: gpg -k --with-key-screening --with-colons | gawk -F: \ '$1~/pub|sub|sec|ssb|crt/ && $18~/\<6001\>/ {found=1;next}; $1=="fpr" && found {print $10}; {found=0}' The same works for gpgsm. Note that we need gawk due to the "\<" in the r.e. Signed-off-by: Werner Koch <[email protected]>
2017-09-27doc: Make --check-sigs more prominent.Werner Koch1-39/+42
-- It seems people are using --list-sigs instead of --check-sigs and do not realize that the signatures are not checked at all. We better highlight the use of --check-sigs to avoid this UI problem. Suggested-by: Andrew Gallagher Signed-off-by: Werner Koch <[email protected]>
2017-09-27doc: Make --check-sigs more prominent.Werner Koch1-39/+42
-- It seems people are using --list-sigs instead of --check-sigs and do not realize that the signatures are not checked at all. We better highlight the use of --check-sigs to avoid this UI problem. Suggested-by: Andrew Gallagher Signed-off-by: Werner Koch <[email protected]>
2017-09-18wks: Create a new user id if provider wants mailbox-only.Werner Koch1-1/+3
* tools/gpg-wks-client.c (get_key): Add arg 'exact'. (add_user_id): New. (command_send): Create new user id. Signed-off-by: Werner Koch <[email protected]>
2017-09-11sm: Move qualified.txt from datadir into sysconfdirAlon Bar-Lev4-17/+13
* doc/Makefile.am: Move qualified.txt into examples. * doc/qualified.txt: Move into examples, remove trailing spaces. * doc/examples/README: Document qualified.txt. * doc/gpgsm.texi: Move qualified.txt from datadir into sysconfdir. * sm/qualified.c (read_list): Move qualified.txt from datadir into sysconfdir. -- The qualified.txt is maintained by Administrator it is a configuration file. In the past it was a hybrid, provided by package and controlled by the Administrator, however, it is no longer maintained by package. Signed-off-by: Alon Bar-Lev <[email protected]>
2017-09-08gpg: default to 3072-bit RSA keys.Daniel Kahn Gillmor1-2/+2
* agent/command.c (hlp_genkey): update help text to suggest the use of 3072 bits. * doc/wks.texi: Make example match default generation. * g10/keygen.c (DEFAULT_STD_KEY_PARAM): update to rsa3072/cert,sign+rsa3072/encr, and fix neighboring comment, (gen_rsa, get_keysize_range): update default from 2048 to 3072). * g10/keyid.c (pubkey_string): update comment so that first example is the default 3072-bit RSA. -- 3072-bit RSA is widely considered to be 128-bit-equivalent security. This is a sensible default in 2017. Signed-off-by: Daniel Kahn Gillmor <[email protected]> Gbp-Pq: Topic update-defaults Gbp-Pq: Name 0015-gpg-default-to-3072-bit-RSA-keys.patch
2017-09-08gpgsm: default to 3072-bit keys.Daniel Kahn Gillmor2-8/+8
* doc/gpgsm.texi, doc/howto-create-a-server-cert.texi: : update default to 3072 bits. * sm/certreqgen-ui.c (gpgsm_gencertreq_tty): update default to 3072 bits. * sm/certreqgen.c (proc_parameters): update default to 3072 bits. * sm/gpgsm.c (main): print correct default_pubkey_algo. -- 3072-bit RSA is widely considered to be 128-bit-equivalent security. This is a sensible default in 2017. Signed-off-by: Daniel Kahn Gillmor <[email protected]> Gbp-Pq: Topic update-defaults Gbp-Pq: Name 0014-gpgsm-default-to-3072-bit-keys.patch
2017-08-28Release 2.2.0gnupg-2.2.0Werner Koch1-13/+36
2017-08-11gpg: default to --no-auto-key-retrieve.Daniel Kahn Gillmor1-1/+1
* g10/gpg.c (main): remove KEYSERVER_AUTO_KEY_RETRIEVE from the default keyserver options. * doc/gpg.texi: document this change. -- This is a partial reversion of 7e1fe791d188b078398bf83c9af992cb1bd2a4b3. Werner and i discussed it earlier today, and came to the conclusion that: * the risk of metadata leakage represented by a default --auto-key-retrieve, both in e-mail (as a "web bug") and in other contexts where GnuPG is used to verified signatures, is quite high. * the advantages of --auto-key-retrieve (in terms of signature verification) can sometimes be achieved in other ways, such as when a signed message includes a copy of its own key. * when those other ways are not useful, a graphical, user-facing application can still offer the user the opportunity to choose to fetch the key; or it can apply its own policy about when to set --auto-key-retrieve, without needing to affect the defaults. Note that --auto-key-retrieve is specifically about signature verification. Decisions about how and whether to look up a key during message encryption are governed by --auto-key-locate. This change does not touch the --auto-key-locate default of "local,wkd". The user deliberately asking gpg to encrypt to an e-mail address is a different scenario than having an incoming e-mail trigger a potentially unique network request. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2017-08-08sm: Always print the keygrip in colon mode.Werner Koch1-4/+6
* sm/keylist.c (list_cert_colon): Always print the keygrip as described in the manual. Signed-off-by: Werner Koch <[email protected]>
2017-08-08gpg: Add option '--disable-dirmngr'.Justus Winter1-0/+3
* doc/gpg.texi: Document new option. * g10/call-dirmngr.c (create_context): Fail if option is given. * g10/gpg.c (cmd_and_opt_values): New value. (opts): New option. (gpgconf_list): Add new option. (main): Handle new option. * g10/options.h (struct opt): New field 'disable_dirmngr'. * tools/gpgconf-comp.c (gc_options_gpg): New option. GnuPG-bug-id: 3334 Signed-off-by: Justus Winter <[email protected]>
2017-08-07systemd-user: Drop redundant After=*.socket.Daniel Kahn Gillmor2-2/+0
* doc/examples/systemd-user/*.service: Drop redundant After=*.socket directive. -- systemd.socket(5) says: Socket units will have a Before= dependency on the service which they trigger added implicitly. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2017-08-07systemd-user: Drop RefuseManualStart=true.Daniel Kahn Gillmor2-4/+0
* doc/examples/systemd-user/*.service: drop RefuseManualStart=true -- These user services can be safely started manually as long as at least their primary sockets are available. They'll just start with nothing to do, which should be fine. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2017-08-07Fix spelling.Daniel Kahn Gillmor1-1/+1
* doc/gpg.texi: s/occured/occurred/ Signed-off-by: Daniel Kahn Gillmor <[email protected]>
2017-08-04gpg: Default to --auto-key-locate "local,wkd" and --auto-key-retrieve.Werner Koch1-9/+13
* g10/gpg.c (main): Add KEYSERVER_AUTO_KEY_RETRIEVE to the default keyserver options. Set the default for --auto-key-locate to "local,wkd". Reset that default iff --auto-key-locate has been given in the option file or in the commandline. * g10/getkey.c (parse_auto_key_locate): Work on a copy of the arg. -- GnuPG-bug-id: 3324 Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-18 20:45:27 +0000