aboutsummaryrefslogtreecommitdiffstats
path: root/g10/options.h (unfollow)
Commit message (Collapse)AuthorFilesLines
2014-11-12gpg: Add import option "keep-ownertrust".Werner Koch1-0/+1
* g10/options.h (IMPORT_KEEP_OWNERTTRUST): New. * g10/import.c (parse_import_options): Add "keep-ownertrust". (import_one): Act upon new option. -- This option is in particular useful to convert from a pubring.gpg to the new pubring.kbx in GnuPG 2.1 or vice versa: gpg1 --export | gpg2 --import-options keep-ownertrust --import (cherry-picked from commit ffc2307843ce6c4ac3c8d99ba8c70ffa1ae28e39)
2014-10-03gpg: Add build and runtime support for larger RSA keysDaniel Kahn Gillmor1-0/+1
* configure.ac: Added --enable-large-secmem option. * g10/options.h: Add opt.flags.large_rsa. * g10/gpg.c: Contingent on configure option: adjust secmem size, add gpg --enable-large-rsa, bound to opt.flags.large_rsa. * g10/keygen.c: Adjust max RSA size based on opt.flags.large_rsa * doc/gpg.texi: Document --enable-large-rsa. -- This is a cherry-pick of 534e2876acc05f9f8d9b54c18511fe768d77dfb5 from STABLE-BRANCH-1-4 against STABLE-BRANCH-2-0 Some older implementations built and used RSA keys up to 16Kib, but the larger secret keys now fail when used by more recent GnuPG, due to secure memory limitations. Building with ./configure --enable-large-secmem will make gpg capable of working with those secret keys, as well as permitting the use of a new gpg option --enable-large-rsa, which let gpg generate RSA keys up to 8Kib when used with --batch --gen-key. Debian-bug-id: 739424 Minor edits by wk. GnuPG-bug-id: 1732
2014-06-03gpg: Reject signatures made with MD5.Werner Koch1-0/+1
* g10/gpg.c: Add option --allow-weak-digest-algos. (main): Set option also in PGP2 mode. * g10/options.h (struct opt): Add flags.allow_weak_digest_algos. * g10/sig-check.c (do_check): Reject MD5 signatures. * tests/openpgp/gpg.conf.tmpl: Add allow_weak_digest_algos. -- (cherry picked from commit f90cfe6b66269de0154d810c5cee1fe9a5af475c) Resolved conflicts: g10/gpg.c - adjust. tests/openpgp/defs.inc - no changes
2013-11-27gpg: Change armor Version header to emit only the major version.Werner Koch1-1/+5
* g10/options.h (opt): Rename field no_version to emit_version. * g10/gpg.c (main): Init opt.emit_vesion to 1. Change --emit-version to bump up opt.emit_version. * g10/armor.c (armor_filter): Implement different --emit-version values. -- GnuPG-bug-id: 1572 Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit e951782e937ce290be0d89d83e84b3daea997587) Resolved conflicts: NEWS g10/armor.c g10/gpg.c
2013-10-04gpg: Protect against rogue keyservers sending secret keys.Werner Koch1-5/+6
* g10/options.h (IMPORT_NO_SECKEY): New. * g10/keyserver.c (keyserver_spawn, keyserver_import_cert): Set new flag. * g10/import.c (import_secret_one): Deny import if flag is set. -- By modifying a keyserver or a DNS record to send a secret key, an attacker could trick a user into signing using a different key and user id. The trust model should protect against such rogue keys but we better make sure that secret keys are never received from remote sources. Suggested-by: Stefan Tomanek Signed-off-by: Werner Koch <[email protected]>
2010-01-11Implement command --passwd for GPG.Werner Koch1-1/+1
2009-07-07Reworked passing of envars to Pinentry.Werner Koch1-5/+4
2008-06-11Made --fixed-list-mode obsolete.Werner Koch1-1/+0
2008-04-08Enhanced --auto-key-locate.Werner Koch1-1/+9
2007-11-19Started to implement the audit log feature.Werner Koch1-0/+2
Pass PINENTRY_USER_DATA and XAUTHORITY to Pinentry. Improved support for the quality bar. Minor internal restructuring. Translation fixes.
2007-10-25Ported changes from 1.4.Werner Koch1-3/+6
Add copyright notices.
2007-07-04Changed to GPLv3.Werner Koch1-4/+2
Removed intl/.
2007-03-05Ported multiple-messages protection.Werner Koch1-2/+1
2007-02-26Add new SVN only file README.maintWerner Koch1-0/+1
doc/ * gpg.texi (GPG Configuration): Document envvar LANGUAGE. (GPG Configuration Options): Document show-primary-uid-only. g10/ * gpg.c (main): Add verify option show-primary-uid-only. * options.h (VERIFY_SHOW_PRIMARY_UID_ONLY): New. * mainproc.c (check_sig_and_print): Implement it. * encr-data.c (decrypt_data): Correctly test for unknown algorithm. * import.c (check_prefs): Ditto. * keyedit.c (show_prefs): Ditto. * mainproc.c (proc_symkey_enc): Ditto.
2006-12-21Started to code a --server mode. Werner Koch1-0/+6
It is far from being ready!
2006-12-03* options.h, gpg.c (main), passphrase.c (passphrase_to_dek): AddDavid Shaw1-2/+2
--passphrase-repeat option to control how many times gpg will re-prompt for a passphrase to ensure the user has typed it correctly. Defaults to 1.
2006-10-13* parse-packet.c (parse_symkeyenc): Show the unpacked as well as theDavid Shaw1-2/+4
packed s2k iteration count. * main.h, options.h, gpg.c (encode_s2k_iterations, main), passphrase.c (hash_passphrase): Add --s2k-count option to specify the number of s2k hash iterations.
2006-10-04Fixed agent access for gpg.Werner Koch1-1/+1
2006-10-02Fix for bug 537Werner Koch1-8/+8
2006-06-27Ported patches from 1.4.x Werner Koch1-1/+2
2006-06-22* options.h, gpg.c (main), keygen.c (keygen_upd_std_prefs,David Shaw1-1/+2
keygen_add_std_prefs, proc_parameter_file): Add --default-keyserver-url to specify a keyserver URL at key generation time, and "Keyserver:" keyword for doing the same through a batch file.
2006-05-23g10/ does build again.Werner Koch1-1/+0
2006-04-28Merged recent changes from 1.4Werner Koch1-1/+4
2006-04-21Still merging 1.4.3 code backWerner Koch1-0/+2
2006-04-20* options.h, gpg.c (main): Add --enable-dsa2 and --disable-dsa2. DefaultsDavid Shaw1-0/+1
to disable. * pkclist.c (algo_available): If --enable-dsa2 is set, we're allowed to truncate hashes to fit DSA keys. * sign.c (match_dsa_hash): New. Return the best match hash for a given q size. (do_sign, hash_for, sign_file): When signing with a DSA key, if it has q==160, assume it is an old DSA key and don't allow truncation unless --enable-dsa2 is also set. q!=160 always allows truncation since they must be DSA2 keys. (make_keysig_packet): If the user doesn't specify a --cert-digest-algo, use match_dsa_hash to pick the best hash for key signatures.
2006-04-20* gpg.c (print_mds), armor.c (armor_filter, parse_hash_header): AddDavid Shaw1-1/+2
SHA-224. * sign.c (write_plaintext_packet), encode.c (encode_simple): Factor common literal packet setup code from here, to... * main.h, plaintext.c (setup_plaintext_name): Here. New. Make sure the literal packet filename field is UTF-8 encoded. * options.h, gpg.c (main): Make sure --set-filename is UTF-8 encoded and note when filenames are already UTF-8.
2006-04-19Merged with gpg 1.4.3 code. Werner Koch1-179/+263
The gpg part does not yet build.
2006-03-08* options.h, sign.c (mk_notation_policy_etc), gpg.c (add_notation_data):David Shaw1-2/+2
Use it here for the various notation commands. * packet.h, main.h, keygen.c (keygen_add_notations), build-packet.c (string_to_notation, sig_to_notation) (free_notation): New "one stop shopping" functions to handle notations and start removing some code duplication.
2006-03-08* options.h, mainproc.c (check_sig_and_print), gpg.c (main):David Shaw1-5/+8
pka-lookups, not pka-lookup. * options.h, gpg.c (main), keyedit.c [cmds], sig-check.c (signature_check2): Rename "backsign" to "cross-certify" as a more accurate name.
2006-03-07* options.h, gpg.c (main, parse_trust_model), pkclist.cDavid Shaw1-2/+2
(check_signatures_trust), mainproc.c (check_sig_and_print, pka_uri_from_sig), trustdb.c (init_trustdb): Some tweaks to PKA so that it is a verify-option now.
2006-03-07More tests added; make distcheck worksWerner Koch1-0/+3
2006-02-24* keydb.h, getkey.c (release_akl), gpg.c (main): AddDavid Shaw1-2/+3
--no-auto-key-locate. * options.h, gpg.c (main): Keep track of each keyserver registered so we can match on them later. * keyserver-internal.h, keyserver.c (cmp_keyserver_spec, keyserver_match), gpgv.c: New. Find a keyserver that matches ours and return its spec. * getkey.c (get_pubkey_byname): Use it here to get the per-keyserver options from an earlier keyserver.
2006-02-23* options.c, gpg.c (main), keyserver.c (keyserver_spawn): No specialDavid Shaw1-9/+6
treatment of include-revoked, include-subkeys, and try-dns-srv. These are keyserver features, and GPG shouldn't get involved here.
2006-02-23* options.h, keyserver.c (add_canonical_option): New.David Shaw1-0/+1
(parse_keyserver_options): Moved from here. (parse_keyserver_uri): Use it here so each keyserver can have some private options in addition to the main keyserver-options (e.g. per-keyserver auth).
2006-02-22* options.h, keyserver-internal.h, keyserver.c (keyserver_import_name),David Shaw1-1/+2
getkey.c (free_akl, parse_auto_key_locate, get_pubkey_byname): The obvious next step: allow arbitrary keyservers in the auto-key-locate list.
2006-02-22* options.h, keyserver.c (parse_keyserver_options): RemoveDavid Shaw1-1/+0
auto-cert-retrieve as it is no longer meaningful. Add max-cert-size to allow users to pick a max key size retrieved via CERT.
2006-02-22* options.h, gpg.c (main), mainproc.c (check_sig_and_print), keyserver.cDavid Shaw1-1/+1
(keyserver_opts): Rename auto-pka-retrieve to honor-pka-record to be consistent with honor-keyserver-url.
2006-02-22* options.h, keydb.h, g10.c (main), getkey.c (parse_auto_key_locate):David Shaw1-0/+8
Parse a list of key access methods. (get_pubkey_byname): Walk the list here to try and retrieve keys we don't have locally.
2005-12-23* keyserver.c (keyserver_import_pka): New. Moved fromDavid Shaw1-0/+1
getkey.c:get_pubkey_byname which was getting crowded. * keyserver.c (keyserver_import_cert): Import a key found in DNS via CERT records. Can handle both the PGP (actual key) and IPGP (URL) CERT types. * getkey.c (get_pubkey_byname): Call them both here. * options.h, keyserver.c (parse_keyserver_options): Add "auto-cert-retrieve" option with optional max size argument.
2005-12-20Finished PKA featureWerner Koch1-0/+2
2005-12-08* options.h, keyserver.c (curl_cant_handle, keyserver_spawn,David Shaw1-0/+4
keyserver_fetch): Set a flag to indicate that we're doing a direct URI fetch so we can differentiate between a keyserver operation and a URI fetch for protocols like LDAP that can do either.
2005-11-18* keyedit.c (keyedit_menu, menu_clean): Simplify clean options to justDavid Shaw1-4/+3
"clean", and add "minimize". * import.c (parse_import_options): Make help text match the export versions of the options. * options.h, export.c (parse_export_options, do_export_stream): Reduce clean options to two: clean and minimize. * trustdb.h, trustdb.c (clean_one_uid): New function that joins uid and sig cleaning into one for a simple API outside trustdb.
2005-11-12* trustdb.h, trustdb.c (clean_key): New function to handle keyDavid Shaw1-2/+1
cleaning from one convenient place. * options.h, import.c (parse_import_options, clean_sigs_from_all_uids, import_one): Reduce clean options to two: clean and minimize. * parse-packet.c (setup_user_id): Remove. (parse_user_id, parse_attribute): Just use xmalloc_clear instead.
2005-11-10* options.h, import.c (parse_import_options, clean_sigs_from_all_uids,David Shaw1-2/+3
import_one): Add import-minimal option. Similar to export-minimal, except it works on the way in.
2005-10-12* options.h, getkey.c (merge_selfsigs_subkey), gpg.c (main), sig-check.cDavid Shaw1-0/+7
(signature_check2): Add --require-backsigs and --no-require-backsigs. Currently defaults to --no-require-backsigs.
2005-08-05auto retrieve keys from PKA. Thsi allows to specify an email addressWerner Koch1-0/+1
so that gpg can get the key from DNS. This helps with opportunistic encryption. No integration with the trust modell yet.
2005-07-22* gpg.sgml (http):Werner Koch1-2/+7
* g10.c, options.h: New option --exit-on-status-write-error. * status.c (write_status_text): Make use of this option.
2005-07-22* options.h, g10.c (main), keyedit.c (keyedit_menu): Use --interactiveDavid Shaw1-1/+0
to enable the uid walking when signing a key with no uids specified to sign. * keylist.c (list_keyblock_print): Fix silly typo. Noted by Greg Sabino Mullane.
2005-07-19* g10.c, options.h: New option --limit-card-insert-tries.Werner Koch1-0/+2
* cardglue.c (open_card): Use it.
2005-07-19* configure.ac [W32]: Always set DISABLE_KEYSERVER_PATH.Werner Koch1-0/+1
* export.c (parse_export_options): New option export-reset-subkey-passwd. (do_export_stream): Implement it. * misc.c (get_libexecdir): New. * keyserver.c (keyserver_spawn): Use it
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-22 19:24:42 +0000