aboutsummaryrefslogtreecommitdiffstats
path: root/g10/options.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* gpg: Add import option "keep-ownertrust".Werner Koch2014-11-121-0/+1
| | | | | | | | | | | | | | * g10/options.h (IMPORT_KEEP_OWNERTTRUST): New. * g10/import.c (parse_import_options): Add "keep-ownertrust". (import_one): Act upon new option. -- This option is in particular useful to convert from a pubring.gpg to the new pubring.kbx in GnuPG 2.1 or vice versa: gpg1 --export | gpg2 --import-options keep-ownertrust --import (cherry-picked from commit da95d0d37841b34e2f3d7047f14ab4d98a7c0c56)
* gpg: Add build and runtime support for larger RSA keysDaniel Kahn Gillmor2014-10-031-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | * configure.ac: Added --enable-large-secmem option. * g10/options.h: Add opt.flags.large_rsa. * g10/gpg.c: Contingent on configure option: adjust secmem size, add gpg --enable-large-rsa, bound to opt.flags.large_rsa. * g10/keygen.c: Adjust max RSA size based on opt.flags.large_rsa * doc/gpg.texi: Document --enable-large-rsa. -- Some older implementations built and used RSA keys up to 16Kib, but the larger secret keys now fail when used by more recent GnuPG, due to secure memory limitations. Building with ./configure --enable-large-secmem will make gpg capable of working with those secret keys, as well as permitting the use of a new gpg option --enable-large-rsa, which let gpg generate RSA keys up to 8Kib when used with --batch --gen-key. Debian-bug-id: 739424 Minor edits by wk. GnuPG-bug-id: 1732
* gpg: Change armor Version header to emit only the major version.Werner Koch2013-11-271-1/+5
| | | | | | | | | | | | | | | | | | * g10/options.h (opt): Rename field no_version to emit_version. * g10/gpg.c (main): Init opt.emit_vesion to 1. Change --emit-version to bump up opt.emit_version. * g10/armor.c (armor_filter): Implement different --emit-version values. -- GnuPG-bug-id: 1572 Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit e951782e937ce290be0d89d83e84b3daea997587) Resolved conflicts: NEWS g10/armor.c g10/gpg.c
* gpg: Protect against rogue keyservers sending secret keys.Werner Koch2013-10-041-3/+4
| | | | | | | | | | | | | | | | | | | | | * g10/options.h (IMPORT_NO_SECKEY): New. * g10/keyserver.c (keyserver_spawn, keyserver_import_cert): Set new flag. * g10/import.c (import_secret_one): Deny import if flag is set. -- By modifying a keyserver or a DNS record to send a secret key, an attacker could trick a user into signing using a different key and user id. The trust model should protect against such rogue keys but we better make sure that secret keys are never received from remote sources. Suggested-by: Stefan Tomanek Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit e7abed3448c1c1a4e756c12f95b665b517d22ebe) Resolved conflicts: g10/options.h
* First set of changes to backport the new card code from 2.0.Werner Koch2009-07-211-0/+1
| | | | | | | | For compatibility reasons a few new files had to be added. Also added estream-printf as this is now used in app-openpgp.c and provides a better and generic asprintf implementation than the hack we used for the W32 code in ttyio.c. Card code is not yet finished.
* Switched to GPLv3.Werner Koch2007-10-231-4/+2
| | | | | Updated gettext.
* * options.h, gpg.c (main), misc.c (compliance_option_string): AddDavid Shaw2007-10-171-4/+6
| | | | | | | | | --rfc4880, and make --openpgp an alias to it. --rfc2440 now stands alone. For now, use the old 2440 defaults for 4880. * keyedit.c (keyedit_menu): Use compliance_option_string() instead of printing the compliance modes here.
* Preparing 1.4.7gnupg-1.4.7Werner Koch2007-03-051-2/+2
|
* * options.h, gpg.c (main), passphrase.c (passphrase_to_dek): AddDavid Shaw2006-12-031-1/+1
| | | | | | | --passphrase-repeat option to control how many times gpg will re-prompt for a passphrase to ensure the user has typed it correctly. Defaults to 1.
* * parse-packet.c (parse_symkeyenc): Show the unpacked as well as theDavid Shaw2006-10-131-2/+4
| | | | | | | | | packed s2k iteration count. * main.h, options.h, gpg.c (encode_s2k_iterations, main), passphrase.c (hash_passphrase): Add --s2k-count option to specify the number of s2k hash iterations.
* * options.h, gpg.c (main), keygen.c (keygen_upd_std_prefs,David Shaw2006-06-221-1/+2
| | | | | | | keygen_add_std_prefs, proc_parameter_file): Add --default-keyserver-url to specify a keyserver URL at key generation time, and "Keyserver:" keyword for doing the same through a batch file.
* * options.h, gpg.c (main): Add --enable-dsa2 and --disable-dsa2. DefaultsDavid Shaw2006-04-201-0/+1
| | | | | | | | | | | | | | | | to disable. * pkclist.c (algo_available): If --enable-dsa2 is set, we're allowed to truncate hashes to fit DSA keys. * sign.c (match_dsa_hash): New. Return the best match hash for a given q size. (do_sign, hash_for, sign_file): When signing with a DSA key, if it has q==160, assume it is an old DSA key and don't allow truncation unless --enable-dsa2 is also set. q!=160 always allows truncation since they must be DSA2 keys. (make_keysig_packet): If the user doesn't specify a --cert-digest-algo, use match_dsa_hash to pick the best hash for key signatures.
* * gpg.c (print_mds), armor.c (armor_filter, parse_hash_header): AddDavid Shaw2006-04-201-1/+2
| | | | | | | | | | | | | | SHA-224. * sign.c (write_plaintext_packet), encode.c (encode_simple): Factor common literal packet setup code from here, to... * main.h, plaintext.c (setup_plaintext_name): Here. New. Make sure the literal packet filename field is UTF-8 encoded. * options.h, gpg.c (main): Make sure --set-filename is UTF-8 encoded and note when filenames are already UTF-8.
* * options.h, sign.c (mk_notation_policy_etc), gpg.c (add_notation_data):David Shaw2006-03-081-2/+2
| | | | | | | | | | Use it here for the various notation commands. * packet.h, main.h, keygen.c (keygen_add_notations), build-packet.c (string_to_notation, sig_to_notation) (free_notation): New "one stop shopping" functions to handle notations and start removing some code duplication.
* * options.h, mainproc.c (check_sig_and_print), gpg.c (main):David Shaw2006-03-081-5/+8
| | | | | | | | | pka-lookups, not pka-lookup. * options.h, gpg.c (main), keyedit.c [cmds], sig-check.c (signature_check2): Rename "backsign" to "cross-certify" as a more accurate name.
* * options.h, gpg.c (main, parse_trust_model), pkclist.cDavid Shaw2006-03-071-2/+2
| | | | | | | (check_signatures_trust), mainproc.c (check_sig_and_print, pka_uri_from_sig), trustdb.c (init_trustdb): Some tweaks to PKA so that it is a verify-option now.
* More tests added; make distcheck worksWerner Koch2006-03-071-0/+3
|
* * keydb.h, getkey.c (release_akl), gpg.c (main): AddDavid Shaw2006-02-241-2/+3
| | | | | | | | | | | | | | | --no-auto-key-locate. * options.h, gpg.c (main): Keep track of each keyserver registered so we can match on them later. * keyserver-internal.h, keyserver.c (cmp_keyserver_spec, keyserver_match), gpgv.c: New. Find a keyserver that matches ours and return its spec. * getkey.c (get_pubkey_byname): Use it here to get the per-keyserver options from an earlier keyserver.
* * options.c, gpg.c (main), keyserver.c (keyserver_spawn): No specialDavid Shaw2006-02-231-9/+6
| | | | | | treatment of include-revoked, include-subkeys, and try-dns-srv. These are keyserver features, and GPG shouldn't get involved here.
* * options.h, keyserver.c (add_canonical_option): New.David Shaw2006-02-231-0/+1
| | | | | | | (parse_keyserver_options): Moved from here. (parse_keyserver_uri): Use it here so each keyserver can have some private options in addition to the main keyserver-options (e.g. per-keyserver auth).
* * options.h, keyserver-internal.h, keyserver.c (keyserver_import_name),David Shaw2006-02-221-1/+2
| | | | | | getkey.c (free_akl, parse_auto_key_locate, get_pubkey_byname): The obvious next step: allow arbitrary keyservers in the auto-key-locate list.
* * options.h, keyserver.c (parse_keyserver_options): RemoveDavid Shaw2006-02-221-1/+0
| | | | | | auto-cert-retrieve as it is no longer meaningful. Add max-cert-size to allow users to pick a max key size retrieved via CERT.
* * options.h, gpg.c (main), mainproc.c (check_sig_and_print), keyserver.cDavid Shaw2006-02-221-1/+1
| | | | | | (keyserver_opts): Rename auto-pka-retrieve to honor-pka-record to be consistent with honor-keyserver-url.
* * options.h, keydb.h, g10.c (main), getkey.c (parse_auto_key_locate):David Shaw2006-02-221-0/+8
| | | | | | Parse a list of key access methods. (get_pubkey_byname): Walk the list here to try and retrieve keys we don't have locally.
* * keyserver.c (keyserver_import_pka): New. Moved fromDavid Shaw2005-12-231-0/+1
| | | | | | | | | | | | | getkey.c:get_pubkey_byname which was getting crowded. * keyserver.c (keyserver_import_cert): Import a key found in DNS via CERT records. Can handle both the PGP (actual key) and IPGP (URL) CERT types. * getkey.c (get_pubkey_byname): Call them both here. * options.h, keyserver.c (parse_keyserver_options): Add "auto-cert-retrieve" option with optional max size argument.
* Finished PKA featureWerner Koch2005-12-201-0/+2
|
* * options.h, keyserver.c (curl_cant_handle, keyserver_spawn,David Shaw2005-12-081-0/+4
| | | | | | | keyserver_fetch): Set a flag to indicate that we're doing a direct URI fetch so we can differentiate between a keyserver operation and a URI fetch for protocols like LDAP that can do either.
* * keyedit.c (keyedit_menu, menu_clean): Simplify clean options to justDavid Shaw2005-11-181-4/+3
| | | | | | | | | | | | | | "clean", and add "minimize". * import.c (parse_import_options): Make help text match the export versions of the options. * options.h, export.c (parse_export_options, do_export_stream): Reduce clean options to two: clean and minimize. * trustdb.h, trustdb.c (clean_one_uid): New function that joins uid and sig cleaning into one for a simple API outside trustdb.
* * trustdb.h, trustdb.c (clean_key): New function to handle keyDavid Shaw2005-11-121-2/+1
| | | | | | | | | | | cleaning from one convenient place. * options.h, import.c (parse_import_options, clean_sigs_from_all_uids, import_one): Reduce clean options to two: clean and minimize. * parse-packet.c (setup_user_id): Remove. (parse_user_id, parse_attribute): Just use xmalloc_clear instead.
* * options.h, import.c (parse_import_options, clean_sigs_from_all_uids,David Shaw2005-11-101-2/+3
| | | | | | import_one): Add import-minimal option. Similar to export-minimal, except it works on the way in.
* * options.h, getkey.c (merge_selfsigs_subkey), gpg.c (main), sig-check.cDavid Shaw2005-10-121-0/+7
| | | | | | (signature_check2): Add --require-backsigs and --no-require-backsigs. Currently defaults to --no-require-backsigs.
* auto retrieve keys from PKA. Thsi allows to specify an email addressWerner Koch2005-08-051-0/+1
| | | | | | so that gpg can get the key from DNS. This helps with opportunistic encryption. No integration with the trust modell yet.
* * gpg.sgml (http):Werner Koch2005-07-221-2/+7
| | | | | | * g10.c, options.h: New option --exit-on-status-write-error. * status.c (write_status_text): Make use of this option.
* * options.h, g10.c (main), keyedit.c (keyedit_menu): Use --interactiveDavid Shaw2005-07-221-1/+0
| | | | | | | | | to enable the uid walking when signing a key with no uids specified to sign. * keylist.c (list_keyblock_print): Fix silly typo. Noted by Greg Sabino Mullane.
* * g10.c, options.h: New option --limit-card-insert-tries.Werner Koch2005-07-191-0/+2
| | | | | * cardglue.c (open_card): Use it.
* * configure.ac [W32]: Always set DISABLE_KEYSERVER_PATH.Werner Koch2005-07-191-0/+1
| | | | | | | | | | * export.c (parse_export_options): New option export-reset-subkey-passwd. (do_export_stream): Implement it. * misc.c (get_libexecdir): New. * keyserver.c (keyserver_spawn): Use it
* * gpg.sgml: Document smartcard related options.Werner Koch2005-06-201-0/+1
| | | | | | * g10.c, options.h: New option --no-interactive-selection. * keyedit.c (keyedit_menu): Use it.
* * keygen.c (save_unprotected_key_to_card): Fix gcc4 warning.David Shaw2005-06-141-0/+1
| | | | | | | | | | * options.h, import.c (parse_import_options, import_one): Add import-clean-uids option to automatically compact unusable uids when importing. Like import-clean-sigs, this may nodify the local keyring. * trustdb.c (clean_uids_from_key): Only allow selfsigs to be a candidate for re-inclusion.
* * options.h, import.c (parse_import_options, clean_sigs_from_all_uids,David Shaw2005-06-121-0/+1
| | | | | | | | import_one): Add import-clean-sigs option to automatically clean a key when importing. Note that when importing a key that is already on the local keyring, the clean applies to the merged key - i.e. existing superceded or invalid signatures are removed.
* * options.h, import.c (parse_import_options, delete_inv_parts):David Shaw2005-06-101-1/+0
| | | | | import-unusable-sigs is now a noop.
* * options.h, export.c (do_export_stream), keyedit.c (keyedit_menu,David Shaw2005-06-101-1/+0
| | | | | | | | | menu_clean_subkeys_from_key), trustdb.h, trustdb.c (clean_subkeys_from_key): Remove subkey cleaning function. It is of very limited usefulness since it cannot be used on any subkey that can sign, and can only affect multiple selfsigs on encryption-only subkeys.
* * options.h, g10.c (main), export.c (parse_export_options,David Shaw2005-06-081-1/+3
| | | | | | | | do_export_stream): Add export-options export-clean-sigs, export-clean-uids, export-clean-subkeys, and export-clean which is all of the above. Export-minimal is the same except it also removes all non-selfsigs. export-unusable-sigs is now a noop.
* Updated FSF street address and preparations for a release candidate.Werner Koch2005-05-311-1/+2
|
* * build-packet.c (do_comment): Removed. (build_packet): IgnoreDavid Shaw2005-05-141-1/+0
| | | | | | | | | | | comment packets. * export.c (do_export_stream): Don't export comment packets any longer. * options.h, g10.c (main): Remove --sk-comments and --no-sk-comments options, and replace with no-op.
* * keygen.c (start_tree): New function to "prime" a KBNODE list.David Shaw2005-05-051-2/+0
| | | | | | | | | | | | (do_generate_keypair): Use it here rather than creating and deleting a comment packet. * keygen.c (gen_elg, gen_dsa): Do not put public factors in secret key as a comment. * options.h, encode.c (encode_simple, encode_crypt), keygen.c (do_create): Remove disabled comment packet code.
* * options.h, g10.c (main): Add new --default-sig-expire andDavid Shaw2005-05-051-0/+2
| | | | | | | | | | | | --default-cert-expire options. Suggested by Florian Weimer. * main.h, keygen.c (parse_expire_string, ask_expire_interval): Use defaults passed in, or "0" to control what default expiration is. * keyedit.c (sign_uids), sign.c (sign_file, clearsign_file, sign_symencrypt_file): Call them here, so that default expiration is used when --ask-xxxxx-expire is off.
* (pin_cb): Print a warning if the info string hack isWerner Koch2005-03-301-1/+1
| | | | | not there. This may happen due to typos in the translation.
* * options.h, keyserver.c (parse_keyserver_options, keyserver_spawn): Don'tDavid Shaw2005-03-171-11/+9
| | | | | | treat 'verbose' and 'include-disabled' as special. Just pass them through silently to the keyserver helper.
* * options.h, import.c (parse_import_options, delete_inv_parts): AddDavid Shaw2005-01-011-0/+2
| | | | | | | | | | import-unusable-sigs flag to enable importing unusable (currently: expired) sigs. * options.h, export.c (parse_export_options, do_export_stream): Add export-unusable-sigs flag to enable exporting unusable (currently: expired) sigs.
* * options.h, keyserver.c (parse_keyserver_uri): Properly parse auth dataDavid Shaw2004-12-221-0/+1
| | | | | from URLs and pass to keyserver helpers.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-22 17:47:22 +0000