aboutsummaryrefslogtreecommitdiffstats
path: root/sm (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* | common,gpg,sm,tools: Don't remove translate_sys2libc_fd_int.NIIBE Yutaka2023-06-271-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/sysutils.c (translate_sys2libc_fd_int): Recover. (translate_sys2libc_fdstr): Remove. (check_special_filename): Follow the change. * common/sysutils.h (translate_sys2libc_fd_int): Recover. (translate_sys2libc_fdstr): Remove. * g10/gpg.c, g10/gpgv.c, sm/gpgsm.c: Revert the changes. * tools/gpg-auth.c, tools/gpg-card.c, tools/gpg-pair-tool.c: Likewise. * tools/gpg-wks-client.c, tools/gpgconf.c: Likewise. -- GnuPG-bug-id: 6551 Signed-off-by: NIIBE Yutaka <[email protected]>
* | gpg,sm,tools: Use string for option --*-fd.NIIBE Yutaka2023-06-231-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/gpg.c (opts): Use string for oLoggerFD, oOverrideSessionKeyFD, oStatusFD, oAttributeFD, oCommandFD, and oPassphraseFD. (main): Use translate_sys2libc_fdstr. * g10/gpgv.c (opts): Use string for oLoggerFD, and oStatusFD. (main): Use translate_sys2libc_fdstr. * sm/gpgsm.c (opts): Use string for oLoggerFD, oStatusFD, and oPassphraseFD. (main): Use translate_sys2libc_fdstr. * tools/gpg-auth.c (opts): Use string for oStatusFD. (main): Use translate_sys2libc_fdstr. tools/gpg-card.c (opts): Use string for oStatusFD. (main): Use translate_sys2libc_fdstr. * tools/gpg-pair-tool.c (opts): Use string for oStatusFD. (main): Use translate_sys2libc_fdstr. * tools/gpg-wks-client.c (opts): Use string for oStatusFD. (main): Use translate_sys2libc_fdstr. * tools/gpgconf.c (opts): Use string for oStatusFD. (main): Use translate_sys2libc_fdstr. * tools/gpgtar-create.c (gpgtar_create): Fix for opt.status_fd. * tools/gpgtar-extract.c (gpgtar_extract): Fix for opt.status_fd. * tools/gpgtar-list.c (gpgtar_list): Fix for opt.status_fd. * tools/gpgtar.c (opts): Use string for oStatusFD. (main): Use translate_sys2libc_fdstr. * tools/gpgtar.h (opts): Use string for oStatusFD. -- GnuPG-bug-id: 6551 Signed-off-by: NIIBE Yutaka <[email protected]>
* | kbx: Fix datastream_thread and use the data pipe.NIIBE Yutaka2023-06-071-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/call-keyboxd.c (gpg_keyboxd_deinit_session_data): Release the assuan connection before kbx_client_data_release. (open_context): Enable use of the data pipe. * sm/keydb.c (gpgsm_keydb_deinit_session_data): Release the assuan connection before kbx_client_data_release. (open_context): Enable use of the data pipe. * kbx/kbx-client-util.c (struct kbx_client_data_s): Add THD field. (prepare_data_pipe): Close the pipe output end as it's been sent already. Remember the KCD->THD, so that it can be joined later. (datastream_thread): Finish when reading no data from the pipe. (kbx_client_data_release): Join the thread. Then, we can safely call es_fclose on the FP. -- GnuPG-bug-id: 6512 Signed-off-by: NIIBE Yutaka <[email protected]>
* | w32: Add missing supportedOS Ids for Windows-10Werner Koch2023-05-241-0/+1
| | | | | | | | --
* | w32: Add missing manifests and set a requestedExecutionLevel.Werner Koch2023-05-243-1/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/gpg-agent.w32-manifest.in: New. * dirmngr/dirmngr-client-w32info.rc: New. * dirmngr/dirmngr-client.w32-manifest.in: New. * dirmngr/dirmngr-w32info.rc: New. * dirmngr/dirmngr.w32-manifest.in: New. * dirmngr/dirmngr_ldap-w32info.rc: New. * dirmngr/dirmngr_ldap.w32-manifest.in: New. * g10/gpgv-w32info.rc: New. * g10/gpgv.w32-manifest.in: New. * kbx/keyboxd.w32-manifest.in: New. * scd/scdaemon.w32-manifest.in: New. * sm/gpgsm.w32-manifest.in: New. -- This avoids the use of the VirtualStore uner Windows. GnuPG-bug-id: 6503
* | sm: Emit STATUS_FAILURE for non-implemented commands.Werner Koch2023-05-241-4/+12
| | | | | | | | * sm/gpgsm.c (main): Do it here.
* | gpg: Improve error code for file already exists.Werner Koch2023-05-241-1/+1
|/ | | | * g10/plaintext.c (get_output_file): Fix error code.
* kbx: Use custom estream bufferingWerner Koch2023-05-081-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * kbx/keybox-init.c (ll_buffer_size): New var intialized to 128k (stream_buffers): New var. (keybox_set_buffersize): New. (_keybox_ll_open, _keybox_ll_close): Implement buffering. * sm/gpgsm.c (oKbxBufferSize): New. (opts): Add option --kbx-buffer-size. (main): Call keybox_set_buffersize. * g10/gpg.c: Include keybox.h. * (oKbxBufferSize): New. (opts): Add option --kbx-buffer-size. (main): Call keybox_set_buffersize. -- Running a test on Windows using a pubring.kbx with Total number of blobs: 2098 openpgp: 1294 x509: 803 and a size of 42MiB with gpgsm -k --with-validation --disable-dirmngr --kbx-buffer-size N >nul gives these performance figures using procmon | N(k) | file events | time(s) | |------+-------------+---------| | 0 | 4900000 | 86 | | 16 | 2456000 | 58 | | 32 | 1233000 | 43 | | 64 | 622000 | 37 | | 128 | 317000 | 32 | | 256 | 164000 | 31 | | 512 | 88000 | 30 | Using _open instead of CreateFile give the same number of file events but increased the time slight by one second for the measured buffer size of 64k and 128k. Benchmarks for gpg have not been conducted.
* kbx: Add extra flags to fopen for use by Windows.Werner Koch2023-05-041-1/+1
| | | | | | | | | | | | | | | | | | * kbx/keybox-search.c (open_file): Use sysopen and sequential. * kbx/keybox-update.c (create_tmp_file): Ditto. (blob_filecopy): Ditto. (keybox_set_flags): Ditto. (keybox_delete): Ditto. (keybox_compress): Ditto. -- Under Windows "sysopen" requests that direct API calls (CreateFile et al.) are used instead of the libc wrappers. This may or may not improve the performance. Using "sequential" is a hint to Windows to assume that a file is in general access in a sequential manner. This will have an affect only with a future libgpg-error.
* gpgsm: Cache the non-existence of the policy file.Werner Koch2023-05-041-2/+17
| | | | | | | | | * sm/certchain.c (check_cert_policy): Add simple static cache. -- It is quite common that a policy file does not exist. Thus we can avoid the overhead of trying to open it over and over again just to assert that it does not exists.
* Use the keyboxd for a fresh installWerner Koch2023-04-041-4/+24
| | | | | | | | | | | | * common/homedir.c (gnupg_maybe_make_homedir): Also create a common.conf. * g10/keydb.c: Include comopt.h. (maybe_create_keyring_or_box): Detect the creation of a common.conf. * g10/gpg.c (main): Avoid adding more resources in this case. * sm/keydb.c: Include comopt.h. (maybe_create_keybox): Detect the creation of a common.conf. * common/comopt.h (comopt): Remove the conditional "extern".
* agent: Add trustlist flag "de-vs".Werner Koch2023-04-033-2/+7
| | | | | | | | | | | | | | | | * agent/trustlist.c (struct trustitem_s): Add field de_vs. (read_one_trustfile): Parse it. (istrusted_internal): Emit TRUSTLISTFLAG status line. * sm/gpgsm.h (struct rootca_flags_s): Add field de_vs. * sm/call-agent.c (istrusted_status_cb): Detect the flags. * sm/sign.c (write_detached_signature): Remove unused vars. -- Right now this flag has no effect; we first need to specify the exact behaviour. GnuPG-bug-id: 5079
* gpgsm: Create binary detached sigs with definite form length octets.Werner Koch2023-04-031-4/+251
| | | | | | | | | * sm/sign.c: Include tlv.h. (write_detached_signature): New, (gpgsm_sign): Fixup binary detached signatures. -- This helps some other software to verify detached signatures.
* gpgsm: Remove conditional compilation for older libksba versions.Werner Koch2023-03-312-18/+5
| | | | | | | | | * sm/sign.c (add_signed_attribute): Return an error because the option --attribute is not yet working. -- We require libskba 1.6 anyway.
* gpgsm: New option --no-pretty-dnWerner Koch2023-03-163-2/+16
| | | | | | | | * sm/gpgsm.c (oNoPrettyDN): New. (opts): Add --no-pretty-dn. (main): Implement. * sm/gpgsm.h (opt): Add no_pretty_dn. * sm/certdump.c (gpgsm_es_print_name): Act upon.
* dirmngr: Add command "GETINFO stats".Werner Koch2023-03-101-0/+3
| | | | | | | | | | | * dirmngr/server.c (cmd_getinfo): New sub-command "stats". (dirmngr_status_helpf): Allow for a CTRL of NULL. * dirmngr/certcache.c (cert_cache_print_stats): Add arg ctrl and use dirmngr_status_helpf. Adjust all callers. * dirmngr/domaininfo.c (domaininfo_print_stats): Ditto. * sm/certchain.c (ask_marktrusted): Flush stdout before printing the fingerprint.
* dirmngr: Distinguish between "no crl" and "crl not trusted".Werner Koch2023-03-091-0/+1
| | | | | | | | | | | | | | | | | * dirmngr/crlcache.h (CRL_CACHE_NOTTRUSTED): New. * dirmngr/crlcache.c (cache_isvalid): Set this status. (crl_cache_cert_isvalid): Map it to GPG_ERR_NOT_TRUSTED. (crl_cache_reload_crl): Move diagnostic to ... * dirmngr/crlfetch.c (crl_fetch): here. * dirmngr/server.c (cmd_isvalid): Map it to GPG_ERR_NOT_TRUSTED. * dirmngr/validate.c (check_revocations): Handle new status. Improve diagnostics. * common/status.c (get_inv_recpsgnr_code): Map INV_CRL_OBJ. * common/audit.c (proc_type_verify): Ditto. -- This avoids repeated loading of CRLs in case of untrusted root certificates.
* gpg,gpgsm: New option --log-timeWerner Koch2023-03-081-0/+10
| | | | | | | | | | | * g10/gpg.c (oLogTime): New. (opts): Add "log-time". (opt_log_time): New var. (main): Implement. * sm/gpgsm.c (oLogTime): New. (opts): Add "log-time". (opt_log_time): New var. (main): Implement.
* gpgsm: Strip trailing zeroes from detached signatures.Werner Koch2023-03-081-2/+8
| | | | | | | | | | | | | | | | * common/ksba-io-support.c: Include tlv.h (struct reader_cb_parm_s): Add new fields. (starts_with_sequence): New. (simple_reader_cb): Handle stripping. * common/ksba-io-support.h (GNUPG_KSBA_IO_STRIP): New. (gnupg_ksba_create_reader): Handle the new flag. * sm/verify.c (gpgsm_verify): Use the new flag for detached signatures. -- Note that this works only if --assume-binary is given. The use case for the feature is PDF signature checking where the PDF specs require that the detached signature is padded with zeroes.
* gpgsm: Improve cert lookup callback from dirmngr.Werner Koch2023-02-263-5/+13
| | | | | | | | | | | | | | | | | * sm/gpgsm.h (FIND_CERT_ALLOW_AMBIG): New. (FIND_CERT_WITH_EPHEM): New. * sm/certlist.c (gpgsm_find_cert): Replace arg allow_ambiguous by a generic flags arg. Implement the new flag FIND_CERT_WITH_EPHEM. * sm/call-dirmngr.c (inq_certificate): Return also ephemeral marked certs. -- The dirmngr may need to get a certificate from gpgsm's store in the course of verifying a CRL. In some cases the certificate is still marked as epehemeral - this needs to be returned as well. This _may_ also fix GnuPG-bug-id: 4436
* sm: Fix dirmngr loadcrl for intermediate certsAndre Heinecke2023-02-241-2/+26
| | | | | | | | | | | | | * sm/call-dirmngr.c (run_command_inq_cb): Support ISTRUSTED. (inq_certificate): Distinguish unsupported inquiry error. -- When loading a CRL through "gpgsm --call-dirmngr loadcrl foo" dirmngr can ask gpgsm back if a certificate used ISTRUSTED, which previously resulted in an error. (cherry picked from commit 6b36c16f77722d17f4f317c788701cbc1e9552b2) That commit was from the 2.2 branch and we forgot to forward port it.
* sm: Fix compliance checking for ECC signature verification.Werner Koch2023-01-122-4/+16
| | | | | | | | | | | * common/compliance.c (gnupg_pk_is_compliant): Also consider the gcrypt vids for ECDSA et al. (gnupg_pk_is_allowed): Ditto. * sm/verify.c (gpgsm_verify): Consider the curve. Print a compliance notice for a non-compliant key. * sm/certchain.c (gpgsm_validate_chain): Silence the "switching to chain model".
* build: Remove Windows CE support.NIIBE Yutaka2022-12-091-2/+2
| | | | | | | | | | | | | | | | * agent/Makefile.am [HAVE_W32CE_SYSTEM]: Remove. * am/cmacros.am [HAVE_W32CE_SYSTEM]: Remove. * autogen.sh: Remove W32ce_ variables. * configure.ac: Likewise. * dirmngr/Makefile.am (extra_bin_ldflags): Remove. * g10/Makefile.am [HAVE_W32CE_SYSTEM]: Remove. * kbx/Makefile.am: Likewise. * sm/Makefile.am (extra_bin_ldflags): Remove. * tools/Makefile.am (extra_bin_ldflags): Remove. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* gpgsm: Print the revocation time also with --verify.Werner Koch2022-12-051-1/+16
| | | | * sm/certchain.c (is_cert_still_valid): Print revocation reason.
* gpgsm: Fix "problem re-searching certificate" case.Werner Koch2022-12-051-1/+1
| | | | * sm/keydb.c (keydb_set_cert_flags): Fix error test.
* gpgsm: Print revocation date and reason in cert listings.Werner Koch2022-12-055-3/+88
| | | | | | | | | | | | | | | | | | | | | | * dirmngr/ocsp.c (ocsp_isvalid): Add args r_revoked_at and r_revocation_reason. * dirmngr/server.c (cmd_isvalid): Emit a new REVOCATIONINFO status. (cmd_checkocsp): Ditto. * sm/call-dirmngr.c (struct isvalid_status_parm_s): Add new fields. (isvalid_status_cb): Parse REVOCATIONINFO. (gpgsm_dirmngr_isvalid): Add args r_revoked_at and r_revocation_reason. * sm/gpgsm.h (struct server_control_s): Add fields revoked_art and revocation_reason. * sm/keylist.c (list_cert_raw): Print revocation date. (list_cert_std): Ditto. -- Note that for now we do this only for OCSP because it is an important piece of information when using the chain model. For a sample key see commit 7fa1d3cc821dca1ea8e1c80a0bdd527177c185ee.
* gpgsm: Silence the "non-critical certificate policy not allowed".Werner Koch2022-12-051-2/+3
| | | | | * sm/certchain.c (check_cert_policy): Print non-critical policy warning only in verbose mode.
* gpgsm: Always use the chain model if the root-CA requests this.Werner Koch2022-12-053-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * sm/call-dirmngr.c (gpgsm_dirmngr_isvalid): Do not use option --force-default-responder. * sm/certchain.c (is_cert_still_valid): Rename arg for clarity. (gpgsm_validate_chain): Always switch to chain model. -- The trustlist.txt may indicate that a root CA issues certificates which shall be validated using the chain model. This is for example the case for qualified signatures. Before this change we did this only if the default shell model indicated that a certificate has expired. This optimization is technically okay but has one problem: The chain model requires the use of OCSP but we switch to this only when running the chain model validation. To catch revoked certificates using OCSP we need to always switch to the chain model unless OCSP has been enabled anyway. Note that the old --force-default-responder option is not anymore used. Test cases are certificates issued by # CN=TeleSec qualified Root CA 1 # O=Deutsche Telekom AG # C=DE # 2.5.4.97=USt-IdNr. DE 123475223 90:C6:13:6C:7D:EF:EF:E9:7C:C7:64:F9:D2:67:8E:AD:03:E5:52:96 \ S cm qual relax A sample revoked certificate is -----BEGIN CERTIFICATE----- MIIDTzCCAvSgAwIBAgIQIXfquQjq32B03CdaflIbiDAMBggqhkjOPQQDAgUAMHEx CzAJBgNVBAYTAkRFMRwwGgYDVQQKDBNEZXV0c2NoZSBUZWxla29tIEFHMSMwIQYD VQQDDBpUZWxlU2VjIFBLUyBlSURBUyBRRVMgQ0EgMTEfMB0GA1UEYQwWVVN0LUlk TnIuIERFIDEyMzQ3NTIyMzAeFw0yMDA2MjIxMDQ1NDJaFw0yMzA2MjUyMzU5MDBa MDAxCzAJBgNVBAYTAkRFMRUwEwYDVQQDDAxLb2NoLCBXZXJuZXIxCjAIBgNVBAUT ATMwWjAUBgcqhkjOPQIBBgkrJAMDAggBAQcDQgAEbkEXUuXTriWOwqQhjlh11oCc 6Z8lQdQDz3zY/OEh8fMJS7AKBNo8zkpPKDJ2olPph18b1goEbLiqHQsPRPahDaOC AaowggGmMB8GA1UdIwQYMBaAFP/0iep1rMXT0iQ0+WUqBvLM6bqBMB0GA1UdDgQW BBQEI3xsIUDnoOx+gLYbG63v5/f9kjAOBgNVHQ8BAf8EBAMCBkAwDAYDVR0TAQH/ BAIwADAgBgNVHREEGTAXgRV3ZXJuZXIua29jaEBnbnVwZy5jb20wPQYDVR0gBDYw NDAyBgcEAIvsQAECMCcwJQYIKwYBBQUHAgEWGWh0dHA6Ly9wa3MudGVsZXNlYy5k ZS9jcHMwgYQGCCsGAQUFBwEBBHgwdjBLBggrBgEFBQcwAoY/aHR0cDovL3RxcmNh MS5wa2kudGVsZXNlYy5kZS9jcnQvVGVsZVNlY19QS1NfZUlEQVNfUUVTX0NBXzEu Y3J0MCcGCCsGAQUFBzABhhtodHRwOi8vcGtzLnRlbGVzZWMuZGUvb2NzcHIwXgYI KwYBBQUHAQMEUjBQMAgGBgQAjkYBATAIBgYEAI5GAQQwOgYGBACORgEFMDAwLhYo aHR0cHM6Ly93d3cudGVsZXNlYy5kZS9zaWduYXR1cmthcnRlL2FnYhMCZW4wDAYI KoZIzj0EAwIFAANHADBEAiAqgB8gyZyj05CRdHD5KJcpG68DzQECYnYP6ZPasUYK AQIgI1GtRMJWvFTIKsZpgY+ty0pRb5/K09fbmvaSAKFpv/I= -----END CERTIFICATE-----
* gpgsm: Change default algo to AES-256.Werner Koch2022-12-011-1/+1
| | | | * sm/gpgsm.c (DEFAULT_CIPHER_ALGO): Change.
* dirmngr: Silence ocsp debug output.Werner Koch2022-11-251-2/+2
| | | | | | | * dirmngr/ocsp.c (check_signature_core): No debug output -- Also typo and doc fixes.
* gpgsm: Fix colon outout of ECC encryption certificatesWerner Koch2022-11-151-3/+3
| | | | | | | | | | * sm/keylist.c (print_capabilities): Add arg algo and use it to check for ECC capabilities. (list_cert_colon): Call with algo. -- This will mark certificates with only keyAgreement usage correctly in the --with-colons listing.
* gpgsm: Also announce AES256-CBC in signatures.Werner Koch2022-10-281-7/+10
| | | | | | | * sm/sign.c (gpgsm_sign): Add new capability. -- It might be better to have this. No concrete bug report, though.
* gpgsm: Allow ECC encryption keys with just keyAgreement specified.Werner Koch2022-10-253-1/+11
| | | | | | | | * sm/certlist.c (cert_usage_p): Allow keyAgreement for ECC. * sm/fingerprint.c (gpgsm_is_ecc_key): New. -- For ECC encryption keys keyAgreement is the keyUsage we want.
* gpgsm: Use macro constants for cert_usage_p.Werner Koch2022-10-251-15/+27
| | | | * sm/certlist.c (USE_MODE_): New. Use them for easier reading.
* gpg,common,scd,sm: Function prototype fixes for modern compiler.NIIBE Yutaka2022-09-131-1/+1
| | | | | | | | | | | | | | | | | | | | | | * common/gettime.c (gnupg_get_time): It has no arguments. * common/signal.c (gnupg_block_all_signals): Likewise. (gnupg_unblock_all_signals): Likewise. * common/utf8conv.c (get_native_charset): Likewise. * g10/cpr.c (is_status_enabled, cpr_enabled): Likewise. * g10/getkey.c (getkey_disable_caches): Likewise. * g10/keygen.c (ask_expiredate): Likewise. * g10/passphrase.c (have_static_passphrase): Likewise. (get_last_passphrase): Likewise. * g10/tdbio.c (tdbio_is_dirty, tdbio_sync): Likewise. (tdbio_get_dbname, open_db, tdbio_db_matches_options): Likewise. (tdbio_read_nextcheck): Likewise. * g10/trustdb.c (how_to_fix_the_trustdb): Likewise. * scd/scdaemon.c (scd_get_socket_name): Likewise. * sm/passphrase.c (have_static_passphrase): Likewise. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* sm: Fix reporting of bad passphrase errorIngo Klöcker2022-09-091-1/+4
| | | | | | | | * sm/minip12.c (p12_parse): Set badpass flag to result in ctx. -- Fixes-commit: a4e04375e84ecb7ea0d02e153cb27988fca4c2d0 GnuPG-bug-id: 5713, 6037
* common: New common option no-autostart.Werner Koch2022-08-221-0/+3
| | | | | | | | | | | | | | | | | | | | * common/comopt.c (opts): Add "no-autostart". (parse_comopt): Set it. * common/comopt.h (comopt): Add no_autostart. * g10/gpg.c (main): Take care of the new option. * sm/gpgsm.c (main): Ditto. * tools/gpg-connect-agent.c (INCLUDED_BY_MAIN_MODULE): Add. (main): Parse common options and handle new option. * tools/gpg-card.c (main): Ditto. (cmd_yubikey): Fix minor error reporting issue. * common/util.h (GNUPG_MODULE_NAME_CARD): New const. * common/homedir.c (gnupg_module_name): Support it. -- Having a global option makes it easier to use disable autostart on a server which is required to use a remote gpg-agent reliable.
* sm: Improve pkcs#12 debug output.Werner Koch2022-06-201-7/+9
| | | | | | | * sm/minip12.c (parse_shrouded_key_bag): Fix offset diagnostic. (parse_cert_bag): Ditto. (parse_bag_data): Remove debug output. Pass startoffset. Fix offset diagnostic.
* sm: Rework the PKCS#12 parser to support DFN issued keys.Werner Koch2022-06-201-177/+341
| | | | | | | | | | | | | | | | | | | * sm/minip12.c (struct p12_parse_ctx_s): New. Use this instead of passing several parameters to most functions. (parse_pag_data): Factor things out to ... parse_shrouded_key_bag): new. (parse_cert_bag): New. (parse_bag_data): New. (p12_parse): Setup the parse context. -- To support newer pkcs#12 files like those issued by the DFN we need to support another ordering of data elements. This rework reflects the P12 data structure a bit better than our old ad-hoc hacks. Tests could only be done with the certificate parts and not the encrypted private keys. GnuPG-bug-id: 6037
* gpgsm: New option --compatibility-flags.Werner Koch2022-06-134-9/+68
| | | | | | | | | | * sm/gpgsm.c (oCompatibilityFlags): New option. (compatibility_flags): new. (main): Parse and print them in verbose mode. * sm/gpgsm.h (opt): Add field compat_glags.: (COMPAT_ALLOW_KA_TO_ENCR): New. * sm/keylist.c (print_capabilities): Take care of the new flag. * sm/certlist.c (cert_usage_p): Ditto.
* Remove remaining support for WindowsCEWerner Koch2022-06-031-14/+1
| | | | --
* sm: Use gpg_err_code() instead of -1Todd Zullinger2022-04-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | * sm/verify.c (gpgsm_verify): use gpg_err_code instead of 'rc == -1' comparison. -- In ed6ebb696e (sm: Implement initial support for keyboxd., 2020-09-10), the return of keydb_search() was changed to use gpg_err_code(). Adjust gpgsm_verify() to use it. This provides a nicer error message to users when a certificate is not found -- the same error that is seen from 2.2. Prior to this change, when a cert was not found, gpgsm output: gpgsm: failed to find the certificate: Not found as opposed to the more human-readable message from 2.2: gpgsm: certificate not found They now return the same message. Signed-off-by: Todd Zullinger <[email protected]>
* w32: Do no use Registry item DefaultLogFile for the main tools.Werner Koch2022-04-201-1/+1
| | | | | | | | | | | | | | | | * g10/gpg.c (main): Set LOG_NO_REGISTRY. * sm/gpgsm.c (main): Ditto. * tools/gpg-connect-agent.c (main): Ditto. * tools/gpgconf.c (main): Ditto. (show_other_registry_entries): Print "DefaultLogFile". -- The intention of this mostly forgotten registry entry was to allow for easy debugging of the tools. However, with the global config file common.conf things are anyway better. We disable the use for the commonly used tools so that it does not look like calling gpg on the command line seems to block with no output if the log server (e.g. tcp://1.2.3.4:11111) is not reachable.
* sm: Print diagnostic about CRL problems due to Tor mode.Werner Koch2022-04-113-0/+79
| | | | | | | | | | | | | | | | | | | | | | * dirmngr/crlfetch.c (crl_fetch, crl_fetch_default) (ca_cert_fetch, start_cert_fetch): Factor Tor error out to ... (no_crl_due_to_tor): new. Print status note. * dirmngr/ks-engine-ldap.c (ks_ldap_get) (ks_ldap_search, ks_ldap_put): Factor Tor error out to ... (no_ldap_due_to_tor): new. Print status note. * dirmngr/ocsp.c (do_ocsp_request): Print status note. * sm/misc.c (gpgsm_print_further_info): New. * sm/call-dirmngr.c (warning_and_note_printer): New. (isvalid_status_cb): Call it. (lookup_status_cb): Ditto. (run_command_status_cb): Ditto. * common/asshelp2.c (vprint_assuan_status): Strip a possible trailing LF. --
* doc: Typo fix in commentWerner Koch2022-04-081-1/+1
| | | | --
* sm: Fix parsing encrypted data.NIIBE Yutaka2022-03-091-1/+14
| | | | | | | | | | | * sm/minip12.c (cram_octet_string): Finish when N==0. (parse_bag_encrypted_data): Support constructed data with multiple octet strings. -- GnuPG-bug-id: 5793 Signed-off-by: NIIBE Yutaka <[email protected]>
* gpgsm: New option --require-complianceWerner Koch2022-03-085-3/+35
| | | | | | | | | | | | * sm/gpgsm.c (oRequireCompliance): New. (opts): Add --require-compliance. (main): Set option. * sm/gpgsm.h (opt): Add field require_compliance. (gpgsm_errors_seen): Declare. * sm/verify.c (gpgsm_verify): Emit error if non de-vs compliant. * sm/encrypt.c (gpgsm_encrypt): Ditto. * sm/decrypt.c (gpgsm_decrypt): Ditto. --
* agent: New flag "qual" for the trustlist.txt.Werner Koch2022-02-273-3/+10
| | | | | | | | | | * agent/trustlist.c (struct trustitem_s): Add flag "qual". (read_one_trustfile): Rename arg "allow_include" to "systrust" and change callers. Parse new flag "qual". (istrusted_internal): Print all flags. * sm/call-agent.c (istrusted_status_cb): Detect the "qual" flag. * sm/gpgsm.h (struct rootca_flags_s): Add flag "qualified". * sm/certchain.c (do_validate_chain): Take care of the qualified flag.
* sm: Fix use of value NONE in gnupg_isotime_t type.NIIBE Yutaka2022-02-185-7/+13
| | | | | | | | | | | | | | * common/gettime.h (GNUPG_ISOTIME_NONE): New. * sm/call-dirmngr.c (gpgsm_dirmngr_isvalid): Use it. * sm/certlist.c (gpgsm_add_to_certlist): Likewise. * sm/import.c (check_and_store): Likewise. * sm/keylist.c (list_cert_colon, list_cert_raw): Likewise. (list_cert_std): Likewise. * sm/sign.c (gpgsm_sign): Likewise. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* sm: New option --ignore-cert-with-oid.Werner Koch2022-02-033-0/+44
| | | | | | | * sm/gpgsm.c (oIgnoreCertWithOID): New. (opts): Add option. (main): Store its value. * sm/call-agent.c (learn_cb): Test against that list.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-21 07:07:10 +0000