aboutsummaryrefslogtreecommitdiffstats
path: root/g10 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* gpg: Allow creating a cert-only primary key.Werner Koch2014-10-031-0/+7
| | | | | | | * g10/keygen.c (ask_key_flags): Allow a 'c' in direct entry. -- GnuPG-bug-id: 1726
* gpg: Check gpg-agent version before 2.1 migration.Andre Heinecke2014-10-033-0/+55
| | | | | | | | | | | | | | | * g10/call-agent.c, g10/call-agent.h (agent_get_version): New. * g10/migrate.c (migrate_secring): Abort migration if agent_get_version returns not at least 2.1.0 -- GnuPG-bug-id: 1718 On the first installation of GnuPG 2.1 it is likely that an old gpg-agent is still running in the environment. In that case the migration would fail. Signed-off-by: Andre Heinecke <[email protected]>
* Remove support for the GPG_AGENT_INFO envvar.Werner Koch2014-10-031-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | * agent/agent.h (opt): Remove field use_standard_socket. * agent/command.c (cmd_killagent): Always allow killing. * agent/gpg-agent.c (main): Turn --{no,}use-standard-socket and --write-env-file into dummy options. Always return true for --use-standard-socket-p. Do not print the GPG_AGENT_INFO envvar setting or set that envvar. (create_socket_name): Simplify by removing non standard socket support. (check_for_running_agent): Ditto. * common/asshelp.c (start_new_gpg_agent): Remove GPG_AGENT_INFO use. * common/simple-pwquery.c (agent_open): Ditto. * configure.ac (GPG_AGENT_INFO_NAME): Remove. * g10/server.c (gpg_server): Do not print the AgentInfo comment. * g13/server.c (g13_server): Ditto. * sm/server.c (gpgsm_server): Ditto. * tools/gpgconf.c (main): Simplify by removing non standard socket support. -- The indented fix to allow using a different socket than the one in the gnupg home directory is to change Libassuan to check whether the socket files exists as a regualr file with a special keyword to redirect to another socket file name.
* gpg: Fix regression removing SHA256.Werner Koch2014-10-021-4/+0
| | | | | | | | | * g10/misc.c (map_md_openpgp_to_gcry): Always use SHA256. -- Regression due to commit d33246700578cddd1cb8ed8164cfbba50aba4ef3 GnuPG-bug-id: 1733.
* gpg: Default to SHA-256 for all signature types on RSA keys.Werner Koch2014-09-272-2/+2
| | | | | | | | * g10/main.h (DEFAULT_DIGEST_ALGO): Use SHA256 in --gnupg and SHA1 in strict RFC or PGP modes. * g10/sign.c (make_keysig_packet): Use DEFAULT_DIGEST_ALGO also for RSA key signatures. * configure.ac: Do not allow to disable sha256.
* gpg: Simplify command --gen-key and add --full-gen-key.Werner Koch2014-09-274-32/+86
| | | | | | | | | | | | | | | | * g10/gpg.c (aFullKeygen): New. (opts): Add command --full-key-gen. (main): Implement it. * g10/keygen.c (DEFAULT_STD_ALGO): Replace wrong GCRY_PK_RSA although the value is identical. (DEFAULT_STD_CURVE): New. (DEFAULT_STD_SUBALGO): New. (DEFAULT_STD_SUBKEYSIZE): New. (DEFAULT_STD_SUBCURVE): New. (quick_generate_keypair): Use new macros here. (generate_keypair): Add arg "full" and fix call callers. Do not ask for keysize in non-full node. (ask_user_id): Add arg "full" and simplify for non-full mode.
* gpg: Add shortcut for setting key capabilities.Werner Koch2014-09-261-1/+17
| | | | | * g10/keygen.c (ask_key_flags): Add shortcut '='. * doc/help.txt (gpg.keygen.flags): New.
* gpg: Do not always print dashes in obsolete_option.Werner Koch2014-09-252-19/+15
| | | | | | | * g10/gpg.c (main): Pass option names to obsolete_option without double dash. * g10/misc.c (obsolete_option, obsolete_scdaemon_option): Print double dash only for command line options.
* gpg: Warn about (but don't fail) on scdaemon options in gpg.conf.Daniel Kahn Gillmor2014-09-253-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c: Add config options that should belong in scdaemon.conf * g10/main.h, g10/misc.c (obsolete_scdaemon_option): New. -- In gpg2, the following options are only relevant for scdaemon: reader-port ctapi-driver pcsc-driver disable-ccid but in gpg1, they are options for gpg itself. Some users of gpg1 might have these options in their ~/.gnupg/gpg.conf, which causes gpg2 to fail hard if it reads that config file. gpg2 should not fail hard, though giving a warning (and suggesting a move to scdaemon.conf) seems OK. This patch does *not* reintroduce any documentation for these options in gpg.texi, even to indicate that they are "dummy" options, since scdaemon.texi contains the appropriate documentation. Debian-bug-id: 762844 - Program names factored out from obsolete_scdaemon_option to make reuse without new translations easier. -wk
* gpg: Create default keyring with .kbx suffix.Werner Koch2014-09-221-11/+33
| | | | | | * g10/keydb.c (maybe_create_keyring_or_box): Rename arg for clarity. (keydb_add_resource): Fix order of args to maybe_create_keyring_or_box and check and create .kbx.
* gpg: --delete-secret-key - check that a secret key exists.Werner Koch2014-09-201-0/+9
| | | | | | | * g10/delkey.c (do_delete_key): Check availibility of a secret key. -- Actually we check that at least one secret subkey exists.
* gpg: Make algorithm selection prompt for ECC more clear.Werner Koch2014-09-201-1/+1
| | | | * g10/keygen.c (ask_algo): Change 9 to "ECC and ECC".
* gpg: Silence a compiler warning.Werner Koch2014-09-181-5/+4
| | | | * g10/parse-packet.c (enum_sig_subpkt): Replace hack.
* gpg: Replace a hash algo test function.Werner Koch2014-09-181-18/+18
| | | | | | | | | | | | | * g10/gpg.c (print_mds): Replace openpgp_md_test_algo. -- This is actually not required because as of now the used OpenPGP and Gcrypt hash algorithm numbers are identical. But that might change in the future. This changes the behavior of GnuPG in case it has been build with some algorithms disabled: If those algorithms are available in Libgcrypt, their results will be used printed anyway.
* gpg: Re-indent a function.Werner Koch2014-09-181-78/+89
| | | | --
* gpg: Print a warning if the subkey expiration may not be what you want.Werner Koch2014-09-171-0/+63
| | | | | | | | | | * g10/keyedit.c (subkey_expire_warning): New. (keyedit_menu): Call it when needed. -- GnuPG-bug-id: 1715 The heuristic to detect a problem is not very advanced but it should catch the most common cases.
* gpg: Improve passphrase caching.Werner Koch2014-09-173-8/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/cache.c (last_stored_cache_key): New. (agent_get_cache): Allow NULL for KEY. (agent_store_cache_hit): New. * agent/findkey.c (unprotect): Call new function and try to use the last stored key. * g10/revoke.c (create_revocation): Add arg CACHE_NONCE and pass to make_keysig_packet. (gen_standard_revoke): Add arg CACHE_NONCE and pass to create_revocation. * g10/keygen.c (do_generate_keypair): Call gen_standard_revoke with cache nonce. -- This patch adds two features: 1. The key for the last passphrase successfully used for unprotecting a key is stored away. On a cache miss the stored away passphrase is tried as well. This helps for the common GPG use case of having a signing and encryption (sub)key with the same passphrase. See the code for more comments. 2. The now auto-generated revocation certificate does not anymore popup a passphrase prompt. Thus for standard key generation the passphrase needs to be given only once (well, two with the confirmation).
* gpg: Use algorithm id 22 for EdDSA.Werner Koch2014-09-121-6/+2
| | | | | | | | | * common/openpgpdefs.h (PUBKEY_ALGO_EDDSA): Change to 22. * g10/keygen.c (ask_curve): Reword the Curve25519 warning note. -- In the hope that the IETF will eventually assign 22 for EdDSA using the draft-koch-eddsa-for-openpgp-01 specs we start using this number.
* gpg: Stop early on bogus old style comment packets.Werner Koch2014-09-111-1/+3
| | | | | | | | * g10/parse-packet.c (parse_key): Take care of too short packets for old style commet packets. -- GnuPG-bug-id: 1714
* gpg: Fix memory leak in ECC encryption.Werner Koch2014-09-081-26/+29
| | | | | * g10/pkglue.c (pk_encrypt): Fix memory leak and streamline error handling.
* gpg: Fix export of ecc secret keys by adjusting check ordering.Kyle Butt2014-09-011-1/+5
| | | | | | * g10/export.c (transfer_format_to_openpgp): Move the check against PUBKEY_MAX_NSKEY to after the ECC code adjusts the number of parameters.
* gpg: Do not show "MD5" and triplicated "RSA" in --version.Werner Koch2014-08-281-0/+11
| | | | | * g10/gpg.c (build_list_pk_test_algo): Ignore RSA aliases (build_list_md_test_algo): Ignore MD5.
* gpg: Remove CAST5 from the default prefs and order SHA-1 last.Werner Koch2014-08-261-11/+4
| | | | * g10/keygen.c (keygen_set_std_prefs): Update prefs.
* gpg: Allow for positional parameters in the passphrase prompt.Werner Koch2014-08-261-23/+12
| | | | | | | | | * g10/passphrase.c (passphrase_get): Replace sprintf by xasprintf. -- Without that at least the French translation does not always work because it requires positional parameters. Windows for example does not support them as they are not defined by C99 but by POSIX.
* gpg: Fix "can't handle public key algorithm" warning.Werner Koch2014-08-201-4/+21
| | | | | * g10/parse-packet.c (unknown_pubkey_warning): Check for encr/sign capabilities.
* gpg: Install the current release signing pubkey.Werner Koch2014-08-182-1/+4
| | | | | | | * g10/distsigkey.gpg: New. -- This might be useful to help installing updates.
* agent: Return NO_SECKEY instead of ENONET for PKSIGN and others.Werner Koch2014-08-181-2/+2
| | | | | | * agent/pksign.c (agent_pksign_do): Replace ENONET by NO_SECKEY. * agent/findkey.c (agent_key_from_file): No diagnostic for NO_SECKEY. * agent/pkdecrypt.c (agent_pkdecrypt): Replace checking for ENOENT.
* gpg: Change default cipher for --symmetric from CAST5 to AES-128.Werner Koch2014-08-182-3/+10
| | | | | | * g10/main.h (DEFAULT_CIPHER_ALGO): Chhange to AES or CAST5 or 3DES depending on configure option. * g10/gpg.c (main): Set opt.s2k_cipher_algo to DEFAULT_CIPHER_ALGO.
* Release 2.1.0-beta783gnupg-2.1.0-beta783Werner Koch2014-08-141-1/+3
|
* gpg: Screen keyserver responses.Werner Koch2014-08-143-25/+143
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/main.h (import_screener_t): New. * g10/import.c (import): Add screener callbacks to param list. (import_one): Ditto. (import_secret_one): Ditto. (import_keys_internal): Ditto. (import_keys_stream): Ditto. * g10/keyserver.c (struct ks_retrieval_screener_arg_s): New. (keyserver_retrieval_screener): New. (keyserver_get): Pass screener to import_keys_es_stream(). -- These changes introduces import functions that apply a constraining filter to imported keys. These filters can verify the fingerprints of the keys returned before importing them into the keyring, ensuring that the keys fetched from the keyserver are in fact those selected by the user beforehand. Signed-off-by: Stefan Tomanek <[email protected]> This is an extended and fixed versions of Stefan's patch. In addition to the changes done in gnupg 2.0, namely the commits 5e933008beffbeae7255ece02383606481f9c169 044847a0e2013a2833605c1a9f80cfa6ef353309 088f82c0b5e39687f70e44d3ab719854e808eeb6 the symbol names have been changed to "screener" to void mixing them up with the iobuf filter feature and it has been changed to be used with the dirmngr based keyserver lookup. Signed-off-by: Werner Koch <[email protected]>
* gpg: Disable an MD5 workaround for pgp2 by default.Werner Koch2014-08-144-22/+32
| | | | | | | * g10/sig-check.c (do_check): Move some code to ... * g10/misc.c (print_md5_rejected_note): new function. * g10/mainproc.c (proc_tree, proc_plaintext): Enable MD5 workaround only if option --allow-weak-digest-algos is used.
* gpg: Remove options --pgp2 and --rfc1991.Werner Koch2014-08-1411-235/+37
| | | | | | | | | | | | | | * g10/gpg.c (oRFC1991, oPGP2): Remove (opts): Remove --pgp2 and --rfc1991. * g10/options.h (CO_PGP2, CO_RFC1991): Remove. Remove all users. (RFC2440, PGP2): Remove. Remove all code only enabled by these conditions. * tests/openpgp/clearsig.test: Remove --rfc1991 test. -- The use of PGP 2.c is considered insecure for quite some time now (e.g. due to the use of MD5). Thus we remove all support for _creating_ PGP 2 compatible messages.
* gpg: Remove --compress-keys and --compress-sigs feature.Werner Koch2014-08-144-18/+8
| | | | | | | | | | | | | * g10/gpg.c (oCompressKeys, oCompressSigs): Remove. (opts): Turn --compress-keys and --compress-signs in NOPs. * g10/options.h (opt): Remove fields compress_keys and compress_sigs. * g10/export.c (do_export): Remove compress_keys feature. * g10/sign.c (sign_file): Remove compress_sigs feature. -- These features are disabled in GnuPG since the very early days and they fulfill no real purpose. For now we keep the command line options as dummys.
* gpg: Add list-option "show-usage".Werner Koch2014-08-136-4/+15
| | | | | | | * g10/gpg.c (parse_list_options): Add "show-usage". * g10/options.h (LIST_SHOW_USAGE): New. * g10/keyid.c (usagestr_from_pk): Add arg FILL. Change caller. * g10/keylist.c (list_keyblock_print): Print usage info.
* gpg: Make --with-colons work again for --search-keys.Werner Koch2014-08-121-2/+2
| | | | | * g10/keyserver.c (search_line_handler): Replace log_debug by es_printf.
* gpg: Switch to an EdDSA format with prefix byte.Werner Koch2014-07-251-8/+18
| | | | * g10/keygen.c (gen_ecc): USe "comp" for EdDSA.
* gpg: Add command --quick-gen-keyWerner Koch2014-07-234-0/+153
| | | | | | | | | | | * g10/gpg.c (aQuickKeygen): New. * g10/misc.c (is_valid_user_id): New stub. * g10/keygen.c (quickgen_set_para): New. (quick_generate_keypair): New. -- Note that the validation of the specified user id has not yet been implemented.
* common: Add cpr_get_answer_is_yes_def()Werner Koch2014-07-232-2/+10
| | | | | * g10/cpr.c (cpr_get_answer_is_yes): Factor code out to .... (cpr_get_answer_is_yes_def): ...new.
* gpg: Make --quick-sign-key promote local key signatures.Werner Koch2014-07-231-3/+1
| | | | * g10/keyedit.c (sign_uids): Promote local sigs in quick mode.
* gpg: Improve --list-packets output for faulty packets.Werner Koch2014-07-211-0/+50
| | | | * g10/parse-packet.c: Add list_mode output for certain failures.
* gpg: Cap size of attribute packets at 16MB.Werner Koch2014-07-211-1/+13
| | | | | | | | | | | | | | | * g10/parse-packet.c (parse_attribute): Avoid xmalloc failure and cap size of packet. -- Tavis Ormandy reported a fatal error for attribute packets with a zero length payload. This is due to a check in Libgcrypt's xmalloc which rejects a malloc(0) instead of silently allocating 1 byte. The fix is obvious. In addition we cap the size of attribute packets similar to what we do with user id packets. OpenPGP keys are not the proper way to store movies.
* gpg: Make show-uid-validity the default.Werner Koch2014-07-031-1/+3
|
* gpg: Auto-create revocation certificates.Werner Koch2014-06-307-7/+131
| | | | | | | | | | | | | * configure.ac (GNUPG_OPENPGP_REVOC_DIR): New config define. * g10/revoke.c (create_revocation): Add arg "leadin". (gen_standard_revoke): New. * g10/openfile.c (get_openpgp_revocdir): New. (open_outfile): Add MODE value 3. * g10/keyid.c (hexfingerprint): New. * g10/keygen.c (do_generate_keypair): Call gen_standard_revoke. -- GnuPG-bug-id: 1042
* gpg: Rearrange code in gen_revoke.Werner Koch2014-06-301-51/+73
| | | | | * g10/revoke.c (gen_revoke): Factor some code out to ... (create_revocation): new.
* gpg: Create exported secret files and revocs with mode 700.Werner Koch2014-06-3010-23/+31
| | | | | | | | | | | | | | | * common/iobuf.c (direct_open): Add arg MODE700. (iobuf_create): Ditto. * g10/openfile.c (open_outfile): Add arg RESTRICTEDPERM. Change call callers to pass 0 for it. * g10/revoke.c (gen_desig_revoke, gen_revoke): Here pass true for new arg. * g10/export.c (do_export): Pass true for new arg if SECRET is true. -- GnuPG-bug-id: 1653. Note that this works only if --output has been used.
* po: Update the German (de) translationWerner Koch2014-06-271-1/+1
|
* gpg: Limit keysize for unattended key generation to useful values.Werner Koch2014-06-261-2/+12
| | | | | | | | | | | | | * g10/keygen.c (gen_elg): Enforce keysize 1024 to 4096. (gen_rsa): Enforce keysize 1024 to 4096. (gen_dsa): Enforce keysize 768 to 3072. -- It was possible to create 16k RSA keys in batch mode. In addition to the silliness of such keys, they have the major drawback that under GnuPG and Libgcrypt, with their limited amount of specially secured memory areas, the use of such keys may lead to an "out of secure memory" condition.
* gpg,gpgsm: Simplify wrong_args function.Werner Koch2014-06-261-4/+2
|
* gpg: Allow key-to-card upload for cert-only keysWerner Koch2014-06-251-1/+1
| | | | | | | * g10/card-util.c (card_store_subkey): Allo CERT usage for key 0. -- Suggested-by: Dominik Heidler <[email protected]>
* gpg: Make export of ECC keys work again.Werner Koch2014-06-201-55/+96
| | | | | | | | * agent/cvt-openpgp.c (convert_to_openpgp): Use the curve name instead of the curve parameters. * g10/export.c (canon_pubkey_algo): Rename to ... (canon_pk_algo): this. Support ECC. (transfer_format_to_openpgp): Expect curve name.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-12 03:03:00 +0000