aboutsummaryrefslogtreecommitdiffstats
path: root/g10 (unfollow)
Commit message (Collapse)AuthorFilesLines
2014-10-03gpg: Allow creating a cert-only primary key.Werner Koch1-0/+7
* g10/keygen.c (ask_key_flags): Allow a 'c' in direct entry. -- GnuPG-bug-id: 1726
2014-10-03gpg: Check gpg-agent version before 2.1 migration.Andre Heinecke3-0/+55
* g10/call-agent.c, g10/call-agent.h (agent_get_version): New. * g10/migrate.c (migrate_secring): Abort migration if agent_get_version returns not at least 2.1.0 -- GnuPG-bug-id: 1718 On the first installation of GnuPG 2.1 it is likely that an old gpg-agent is still running in the environment. In that case the migration would fail. Signed-off-by: Andre Heinecke <[email protected]>
2014-10-03Remove support for the GPG_AGENT_INFO envvar.Werner Koch1-3/+0
* agent/agent.h (opt): Remove field use_standard_socket. * agent/command.c (cmd_killagent): Always allow killing. * agent/gpg-agent.c (main): Turn --{no,}use-standard-socket and --write-env-file into dummy options. Always return true for --use-standard-socket-p. Do not print the GPG_AGENT_INFO envvar setting or set that envvar. (create_socket_name): Simplify by removing non standard socket support. (check_for_running_agent): Ditto. * common/asshelp.c (start_new_gpg_agent): Remove GPG_AGENT_INFO use. * common/simple-pwquery.c (agent_open): Ditto. * configure.ac (GPG_AGENT_INFO_NAME): Remove. * g10/server.c (gpg_server): Do not print the AgentInfo comment. * g13/server.c (g13_server): Ditto. * sm/server.c (gpgsm_server): Ditto. * tools/gpgconf.c (main): Simplify by removing non standard socket support. -- The indented fix to allow using a different socket than the one in the gnupg home directory is to change Libassuan to check whether the socket files exists as a regualr file with a special keyword to redirect to another socket file name.
2014-10-02gpg: Fix regression removing SHA256.Werner Koch1-4/+0
* g10/misc.c (map_md_openpgp_to_gcry): Always use SHA256. -- Regression due to commit d33246700578cddd1cb8ed8164cfbba50aba4ef3 GnuPG-bug-id: 1733.
2014-09-27gpg: Default to SHA-256 for all signature types on RSA keys.Werner Koch2-2/+2
* g10/main.h (DEFAULT_DIGEST_ALGO): Use SHA256 in --gnupg and SHA1 in strict RFC or PGP modes. * g10/sign.c (make_keysig_packet): Use DEFAULT_DIGEST_ALGO also for RSA key signatures. * configure.ac: Do not allow to disable sha256.
2014-09-27gpg: Simplify command --gen-key and add --full-gen-key.Werner Koch4-32/+86
* g10/gpg.c (aFullKeygen): New. (opts): Add command --full-key-gen. (main): Implement it. * g10/keygen.c (DEFAULT_STD_ALGO): Replace wrong GCRY_PK_RSA although the value is identical. (DEFAULT_STD_CURVE): New. (DEFAULT_STD_SUBALGO): New. (DEFAULT_STD_SUBKEYSIZE): New. (DEFAULT_STD_SUBCURVE): New. (quick_generate_keypair): Use new macros here. (generate_keypair): Add arg "full" and fix call callers. Do not ask for keysize in non-full node. (ask_user_id): Add arg "full" and simplify for non-full mode.
2014-09-26gpg: Add shortcut for setting key capabilities.Werner Koch1-1/+17
* g10/keygen.c (ask_key_flags): Add shortcut '='. * doc/help.txt (gpg.keygen.flags): New.
2014-09-25gpg: Do not always print dashes in obsolete_option.Werner Koch2-19/+15
* g10/gpg.c (main): Pass option names to obsolete_option without double dash. * g10/misc.c (obsolete_option, obsolete_scdaemon_option): Print double dash only for command line options.
2014-09-25gpg: Warn about (but don't fail) on scdaemon options in gpg.conf.Daniel Kahn Gillmor3-0/+43
* g10/gpg.c: Add config options that should belong in scdaemon.conf * g10/main.h, g10/misc.c (obsolete_scdaemon_option): New. -- In gpg2, the following options are only relevant for scdaemon: reader-port ctapi-driver pcsc-driver disable-ccid but in gpg1, they are options for gpg itself. Some users of gpg1 might have these options in their ~/.gnupg/gpg.conf, which causes gpg2 to fail hard if it reads that config file. gpg2 should not fail hard, though giving a warning (and suggesting a move to scdaemon.conf) seems OK. This patch does *not* reintroduce any documentation for these options in gpg.texi, even to indicate that they are "dummy" options, since scdaemon.texi contains the appropriate documentation. Debian-bug-id: 762844 - Program names factored out from obsolete_scdaemon_option to make reuse without new translations easier. -wk
2014-09-22gpg: Create default keyring with .kbx suffix.Werner Koch1-11/+33
* g10/keydb.c (maybe_create_keyring_or_box): Rename arg for clarity. (keydb_add_resource): Fix order of args to maybe_create_keyring_or_box and check and create .kbx.
2014-09-20gpg: --delete-secret-key - check that a secret key exists.Werner Koch1-0/+9
* g10/delkey.c (do_delete_key): Check availibility of a secret key. -- Actually we check that at least one secret subkey exists.
2014-09-20gpg: Make algorithm selection prompt for ECC more clear.Werner Koch1-1/+1
* g10/keygen.c (ask_algo): Change 9 to "ECC and ECC".
2014-09-18gpg: Silence a compiler warning.Werner Koch1-5/+4
* g10/parse-packet.c (enum_sig_subpkt): Replace hack.
2014-09-18gpg: Replace a hash algo test function.Werner Koch1-18/+18
* g10/gpg.c (print_mds): Replace openpgp_md_test_algo. -- This is actually not required because as of now the used OpenPGP and Gcrypt hash algorithm numbers are identical. But that might change in the future. This changes the behavior of GnuPG in case it has been build with some algorithms disabled: If those algorithms are available in Libgcrypt, their results will be used printed anyway.
2014-09-18gpg: Re-indent a function.Werner Koch1-78/+89
--
2014-09-17gpg: Print a warning if the subkey expiration may not be what you want.Werner Koch1-0/+63
* g10/keyedit.c (subkey_expire_warning): New. (keyedit_menu): Call it when needed. -- GnuPG-bug-id: 1715 The heuristic to detect a problem is not very advanced but it should catch the most common cases.
2014-09-17gpg: Improve passphrase caching.Werner Koch3-8/+10
* agent/cache.c (last_stored_cache_key): New. (agent_get_cache): Allow NULL for KEY. (agent_store_cache_hit): New. * agent/findkey.c (unprotect): Call new function and try to use the last stored key. * g10/revoke.c (create_revocation): Add arg CACHE_NONCE and pass to make_keysig_packet. (gen_standard_revoke): Add arg CACHE_NONCE and pass to create_revocation. * g10/keygen.c (do_generate_keypair): Call gen_standard_revoke with cache nonce. -- This patch adds two features: 1. The key for the last passphrase successfully used for unprotecting a key is stored away. On a cache miss the stored away passphrase is tried as well. This helps for the common GPG use case of having a signing and encryption (sub)key with the same passphrase. See the code for more comments. 2. The now auto-generated revocation certificate does not anymore popup a passphrase prompt. Thus for standard key generation the passphrase needs to be given only once (well, two with the confirmation).
2014-09-12gpg: Use algorithm id 22 for EdDSA.Werner Koch1-6/+2
* common/openpgpdefs.h (PUBKEY_ALGO_EDDSA): Change to 22. * g10/keygen.c (ask_curve): Reword the Curve25519 warning note. -- In the hope that the IETF will eventually assign 22 for EdDSA using the draft-koch-eddsa-for-openpgp-01 specs we start using this number.
2014-09-11gpg: Stop early on bogus old style comment packets.Werner Koch1-1/+3
* g10/parse-packet.c (parse_key): Take care of too short packets for old style commet packets. -- GnuPG-bug-id: 1714
2014-09-08gpg: Fix memory leak in ECC encryption.Werner Koch1-26/+29
* g10/pkglue.c (pk_encrypt): Fix memory leak and streamline error handling.
2014-09-01gpg: Fix export of ecc secret keys by adjusting check ordering.Kyle Butt1-1/+5
* g10/export.c (transfer_format_to_openpgp): Move the check against PUBKEY_MAX_NSKEY to after the ECC code adjusts the number of parameters.
2014-08-28gpg: Do not show "MD5" and triplicated "RSA" in --version.Werner Koch1-0/+11
* g10/gpg.c (build_list_pk_test_algo): Ignore RSA aliases (build_list_md_test_algo): Ignore MD5.
2014-08-28gpg: Do not show "MD5" and triplicated "RSA" in --version.Werner Koch1-0/+11
* g10/gpg.c (build_list_pk_test_algo): Ignore RSA aliases (build_list_md_test_algo): Ignore MD5.
2014-08-26gpg: Remove CAST5 from the default prefs and order SHA-1 last.Werner Koch1-11/+4
* g10/keygen.c (keygen_set_std_prefs): Update prefs.
2014-08-26gpg: Allow for positional parameters in the passphrase prompt.Werner Koch1-23/+12
* g10/passphrase.c (passphrase_get): Replace sprintf by xasprintf. -- Without that at least the French translation does not always work because it requires positional parameters. Windows for example does not support them as they are not defined by C99 but by POSIX.
2014-08-20gpg: Fix "can't handle public key algorithm" warning.Werner Koch1-4/+21
* g10/parse-packet.c (unknown_pubkey_warning): Check for encr/sign capabilities.
2014-08-18gpg: Install the current release signing pubkey.Werner Koch2-1/+4
* g10/distsigkey.gpg: New. -- This might be useful to help installing updates.
2014-08-18agent: Return NO_SECKEY instead of ENONET for PKSIGN and others.Werner Koch1-2/+2
* agent/pksign.c (agent_pksign_do): Replace ENONET by NO_SECKEY. * agent/findkey.c (agent_key_from_file): No diagnostic for NO_SECKEY. * agent/pkdecrypt.c (agent_pkdecrypt): Replace checking for ENOENT.
2014-08-18gpg: Change default cipher for --symmetric from CAST5 to AES-128.Werner Koch2-3/+10
* g10/main.h (DEFAULT_CIPHER_ALGO): Chhange to AES or CAST5 or 3DES depending on configure option. * g10/gpg.c (main): Set opt.s2k_cipher_algo to DEFAULT_CIPHER_ALGO.
2014-08-14Release 2.1.0-beta783gnupg-2.1.0-beta783Werner Koch1-1/+3
2014-08-14gpg: Screen keyserver responses.Werner Koch3-25/+143
* g10/main.h (import_screener_t): New. * g10/import.c (import): Add screener callbacks to param list. (import_one): Ditto. (import_secret_one): Ditto. (import_keys_internal): Ditto. (import_keys_stream): Ditto. * g10/keyserver.c (struct ks_retrieval_screener_arg_s): New. (keyserver_retrieval_screener): New. (keyserver_get): Pass screener to import_keys_es_stream(). -- These changes introduces import functions that apply a constraining filter to imported keys. These filters can verify the fingerprints of the keys returned before importing them into the keyring, ensuring that the keys fetched from the keyserver are in fact those selected by the user beforehand. Signed-off-by: Stefan Tomanek <[email protected]> This is an extended and fixed versions of Stefan's patch. In addition to the changes done in gnupg 2.0, namely the commits 5e933008beffbeae7255ece02383606481f9c169 044847a0e2013a2833605c1a9f80cfa6ef353309 088f82c0b5e39687f70e44d3ab719854e808eeb6 the symbol names have been changed to "screener" to void mixing them up with the iobuf filter feature and it has been changed to be used with the dirmngr based keyserver lookup. Signed-off-by: Werner Koch <[email protected]>
2014-08-14gpg: Disable an MD5 workaround for pgp2 by default.Werner Koch4-22/+32
* g10/sig-check.c (do_check): Move some code to ... * g10/misc.c (print_md5_rejected_note): new function. * g10/mainproc.c (proc_tree, proc_plaintext): Enable MD5 workaround only if option --allow-weak-digest-algos is used.
2014-08-14gpg: Remove options --pgp2 and --rfc1991.Werner Koch11-235/+37
* g10/gpg.c (oRFC1991, oPGP2): Remove (opts): Remove --pgp2 and --rfc1991. * g10/options.h (CO_PGP2, CO_RFC1991): Remove. Remove all users. (RFC2440, PGP2): Remove. Remove all code only enabled by these conditions. * tests/openpgp/clearsig.test: Remove --rfc1991 test. -- The use of PGP 2.c is considered insecure for quite some time now (e.g. due to the use of MD5). Thus we remove all support for _creating_ PGP 2 compatible messages.
2014-08-14gpg: Remove --compress-keys and --compress-sigs feature.Werner Koch4-18/+8
* g10/gpg.c (oCompressKeys, oCompressSigs): Remove. (opts): Turn --compress-keys and --compress-signs in NOPs. * g10/options.h (opt): Remove fields compress_keys and compress_sigs. * g10/export.c (do_export): Remove compress_keys feature. * g10/sign.c (sign_file): Remove compress_sigs feature. -- These features are disabled in GnuPG since the very early days and they fulfill no real purpose. For now we keep the command line options as dummys.
2014-08-13gpg: Add list-option "show-usage".Werner Koch6-4/+15
* g10/gpg.c (parse_list_options): Add "show-usage". * g10/options.h (LIST_SHOW_USAGE): New. * g10/keyid.c (usagestr_from_pk): Add arg FILL. Change caller. * g10/keylist.c (list_keyblock_print): Print usage info.
2014-08-12gpg: Make --with-colons work again for --search-keys.Werner Koch1-2/+2
* g10/keyserver.c (search_line_handler): Replace log_debug by es_printf.
2014-07-25gpg: Switch to an EdDSA format with prefix byte.Werner Koch1-8/+18
* g10/keygen.c (gen_ecc): USe "comp" for EdDSA.
2014-07-23gpg: Add command --quick-gen-keyWerner Koch4-0/+153
* g10/gpg.c (aQuickKeygen): New. * g10/misc.c (is_valid_user_id): New stub. * g10/keygen.c (quickgen_set_para): New. (quick_generate_keypair): New. -- Note that the validation of the specified user id has not yet been implemented.
2014-07-23common: Add cpr_get_answer_is_yes_def()Werner Koch2-2/+10
* g10/cpr.c (cpr_get_answer_is_yes): Factor code out to .... (cpr_get_answer_is_yes_def): ...new.
2014-07-23gpg: Make --quick-sign-key promote local key signatures.Werner Koch1-3/+1
* g10/keyedit.c (sign_uids): Promote local sigs in quick mode.
2014-07-21gpg: Improve --list-packets output for faulty packets.Werner Koch1-0/+50
* g10/parse-packet.c: Add list_mode output for certain failures.
2014-07-21gpg: Cap size of attribute packets at 16MB.Werner Koch1-1/+13
* g10/parse-packet.c (parse_attribute): Avoid xmalloc failure and cap size of packet. -- Tavis Ormandy reported a fatal error for attribute packets with a zero length payload. This is due to a check in Libgcrypt's xmalloc which rejects a malloc(0) instead of silently allocating 1 byte. The fix is obvious. In addition we cap the size of attribute packets similar to what we do with user id packets. OpenPGP keys are not the proper way to store movies.
2014-07-03gpg: Make show-uid-validity the default.Werner Koch1-1/+3
2014-06-30gpg: Auto-create revocation certificates.Werner Koch7-7/+131
* configure.ac (GNUPG_OPENPGP_REVOC_DIR): New config define. * g10/revoke.c (create_revocation): Add arg "leadin". (gen_standard_revoke): New. * g10/openfile.c (get_openpgp_revocdir): New. (open_outfile): Add MODE value 3. * g10/keyid.c (hexfingerprint): New. * g10/keygen.c (do_generate_keypair): Call gen_standard_revoke. -- GnuPG-bug-id: 1042
2014-06-30gpg: Rearrange code in gen_revoke.Werner Koch1-51/+73
* g10/revoke.c (gen_revoke): Factor some code out to ... (create_revocation): new.
2014-06-30gpg: Create exported secret files and revocs with mode 700.Werner Koch10-23/+31
* common/iobuf.c (direct_open): Add arg MODE700. (iobuf_create): Ditto. * g10/openfile.c (open_outfile): Add arg RESTRICTEDPERM. Change call callers to pass 0 for it. * g10/revoke.c (gen_desig_revoke, gen_revoke): Here pass true for new arg. * g10/export.c (do_export): Pass true for new arg if SECRET is true. -- GnuPG-bug-id: 1653. Note that this works only if --output has been used.
2014-06-27po: Update the German (de) translationWerner Koch1-1/+1
2014-06-26gpg: Limit keysize for unattended key generation to useful values.Werner Koch1-2/+12
* g10/keygen.c (gen_elg): Enforce keysize 1024 to 4096. (gen_rsa): Enforce keysize 1024 to 4096. (gen_dsa): Enforce keysize 768 to 3072. -- It was possible to create 16k RSA keys in batch mode. In addition to the silliness of such keys, they have the major drawback that under GnuPG and Libgcrypt, with their limited amount of specially secured memory areas, the use of such keys may lead to an "out of secure memory" condition.
2014-06-26gpg,gpgsm: Simplify wrong_args function.Werner Koch1-4/+2
2014-06-25gpg: Allow key-to-card upload for cert-only keysWerner Koch1-1/+1
* g10/card-util.c (card_store_subkey): Allo CERT usage for key 0. -- Suggested-by: Dominik Heidler <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-25 13:29:50 +0000