aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* gpg: Allow searching for user ids in a keybox.Werner Koch2013-01-071-20/+37
| | | | | | | | | | * kbx/keybox-search.c (blob_cmp_name): Add arg X509 and adjust for PGP use. Change callers. (blob_cmp_mail): Add arg X509 and find the mailbox offset for PGP. Chnage callers. (has_subject_or_alt): Rename to has_username. (has_username): Allow blobtype PGP. (has_mail): Ditto.
* gpg: Allow generation of more than 4096 keys in one run.Werner Koch2013-01-071-6/+20
| | | | | | | | | | | * g10/getkey.c (cache_public_key): Make room in the cache if needed. -- To create the selfsigs, the key generation code makes use of the key cache. However, after 4096 the cache is filled up and then disabled. Thus generating more than 4096 keys in one run was not possible. We now clear the first half the inserted keys every time the cache gets full.
* gpg: Add signature cache support to the keybox.Werner Koch2012-12-287-27/+155
| | | | | | | | | | | | | | | | | | | * g10/keydb.c (parse_keyblock_image): Add arg SIGSTATUS. (keydb_get_keyblock): Handle it. (build_keyblock_image): Add arg SIGSTATUS. (keydb_insert_keyblock): Handle it. * kbx/keybox-blob.c (pgp_create_sig_part): Add arg SIGSTATUS. (_keybox_create_openpgp_blob): Ditto. * kbx/kbxutil.c (import_openpgp): Adjust for above change. * kbx/keybox.h (KEYBOX_FLAG_SIG_INFO): New. * kbx/keybox-search.c (_keybox_get_flag_location): Handle new flag. (keybox_get_keyblock): Add arg R_SIGSTATUS. * kbx/keybox-update.c (keybox_insert_keyblock): Add arg SIGSTATUS. -- With this change a key listing using the keybox format is now double as fast as using a keyring. The memory use dropped as well. Measured with about 1500 keys.
* kbxutil: Improve format of the Sig-Expire lines.Werner Koch2012-12-281-2/+2
| | | | * kbx/keybox-dump.c (_keybox_dump_blob): Print the expirate timestamp.
* gpg: First working support for keyboxes.Werner Koch2012-12-289-179/+426
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * g10/getkey.c (get_pubkey_fast): Improve the assertion. * kbx/keybox.h: Include iobuf.h. * kbx/keybox-blob.c (keyboxblob_uid): Add field OFF. (KEYBOX_WITH_OPENPGP): Remove use of this macro. (pgp_create_key_part_single): New. (pgp_temp_store_kid): Change to use the keybox-openpgp parser. (pgp_create_key_part): Ditto. (pgp_create_uid_part): Ditto. (pgp_create_sig_part): Ditto. (pgp_create_blob_keyblock): Ditto. (_keybox_create_openpgp_blob): Ditto. * kbx/keybox-search.c (keybox_get_keyblock): New. * kbx/keybox-update.c (keybox_insert_keyblock): New. * g10/keydb.c (parse_keyblock_image): (keydb_get_keyblock): Support keybox. (build_keyblock_image): New. (keydb_insert_keyblock): Support keybox. * kbx/kbxutil.c (import_openpgp, main): Add option --dry-run and print a kbx file to stdout. * kbx/keybox-file.c (_keybox_read_blob2): Allow keyblocks up to 10^6 bytes. -- Import and key listing does now work with the keybox format. It is still quite slow and signature caching is completely missing. Increasing the maximum allowed length for a keyblock was required due to a 700k keyblock which inhibited kbxutil to list the file. kbxutil's option name --import-openpgp is not quite appropriate because it only creates KBX blobs from OpenPGP data.
* kbxutil: Print algo number and fold similar lines.Werner Koch2012-12-284-23/+51
| | | | | | | | * kbx/keybox-defs.h (_keybox_openpgp_key_info): Add field ALGO. * kbx/keybox-openpgp.c (parse_key): Store algo. * kbx/kbxutil.c (dump_openpgp_key): Print algo number. * kbx/keybox-dump.c (_keybox_dump_blob): Print identical Sig-Expire value lines with a range of indices.
* gpg: First patches to support a keybox storage backend.Werner Koch2012-12-278-79/+242
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * kbx/keybox-defs.h (_keybox_write_header_blob): Move prototype to .. * kbx/keybox.h: here. * kbx/keybox-init.c (keybox_lock): Add dummy function * g10/keydb.c: Include keybox.h. (KeydbResourceType): Add KEYDB_RESOURCE_TYPE_KEYBOX. (struct resource_item): Add field kb. (maybe_create_keyring_or_box): Add error descriptions to diagnostics. Add arg IS_BOX. Write a header for a new keybox file. (keydb_add_resource): No more need for the force flag. Rename the local variable "force" to "create". Add URL scheme "gnupg-kbx". Add magic test to detect a keybox file. Add basic support for keybox. (keydb_new, keydb_get_resource_name, keydb_delete_keyblock) (keydb_locate_writable, keydb_search_reset, keydb_search2): Add support for keybox. (lock_all, unlock_all): Ditto. * g10/Makefile.am (needed_libs): Add libkeybox.a. (gpg2_LDADD, gpgv2_LDADD): Add KSBA_LIBS as a workaround. * g10/keydb.h (KEYDB_RESOURCE_FLAG_PRIMARY) KEYDB_RESOURCE_FLAG_DEFAULT, KEYDB_RESOURCE_FLAG_READONLY): New. * g10/gpg.c, g10/gpgv.c (main): Use new constants. -- I did most of these changes back in 2011 and only cleaned them up now. More to follow soon.
* gpg: Import only packets which are allowed in a keyblock.Werner Koch2012-12-201-1/+22
| | | | | | | | | | | | | | * g10/import.c (valid_keyblock_packet): New. (read_block): Store only valid packets. -- A corrupted key, which for example included a mangled public key encrypted packet, used to corrupt the keyring. This change skips all packets which are not allowed in a keyblock. GnuPG-bug-id: 1455 (cherry-picked from commit f795a0d59e197455f8723c300eebf59e09853efa)
* gpg: Make commit 2b3cb2ee actually workWerner Koch2012-12-191-2/+3
| | | | | | * g10/sign.c (update_keysig_packet): Use digest_algo. (cherry-picked from commit d23ec86095714d388acac14b515445fe69f019e9)
* gpg: Suppress "public key already present" in quiet mode.Werner Koch2012-12-191-3/+5
| | | | | * g10/pkclist.c (find_and_check_key, build_pk_list): Print a diagnostic only in non-quiet mode.
* faq: Add a section on copyright assignmentsWerner Koch2012-12-191-2/+10
| | | | --
* State that disclaimers are not anymore needed for translations.Werner Koch2012-12-181-2/+6
| | | | --
* common: Add meta option ignore-invalid-option.Werner Koch2012-12-182-6/+154
| | | | | | | | | | | | | | | | | | | | | | | | * common/argparse.c (iio_item_def_s, IIO_ITEM_DEF): New. (initialize): Init field IIO_LIST. (ignore_invalid_option_p): New. (ignore_invalid_option_add): New. (ignore_invalid_option_clear): New. (optfile_parse): Implement meta option. -- This option is currently of no use. However, as soon as it has been deployed in all stable versions of GnuPG, it will allow the use of the same configuration file with an old and a new version of GnuPG. For example: If a new version implements the option "foobar", and a user uses it in gpg.conf, an old version of gpg would bail out with the error "invalid option". To avoid that the following line can be put above that option in gpg.conf ignore-invalid-option foobar This meta option may be given several times or several option names may be given as arguments (space delimited). Note that this option is not available on the command line.
* utf8conv.c: Add hacks for Android.Werner Koch2012-12-131-14/+55
| | | | | | | | | | | | | * common/utf8conv.c [HAVE_ANDROID_SYSTEM]: Do not include iconv.h. (iconv_open, iconv_close, load_libiconv) [HAVE_ANDROID_SYSTEM]: New dummy functions. (set_native_charset) [HAVE_ANDROID_SYSTEM]: Force use of "utf-8". (jnlib_iconv_open) [HAVE_ANDROID_SYSTEM]: Act the same as under W32. (jnlib_iconv) [HAVE_ANDROID_SYSTEM]: Ditto. (jnlib_iconv_close) [HAVE_ANDROID_SYSTEM]: Ditto. -- Co-authored-by: Hans of Guardian <[email protected]>
* SCD: Fix the process of writing key or generating key.NIIBE Yutaka2012-12-131-2/+2
| | | | * scd/app-openpgp.c (store_fpr): Flush KEY-FPR and KEY-TIME.
* ssh: Support ECDSA keys.Werner Koch2012-12-124-106/+384
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/command-ssh.c (SPEC_FLAG_IS_ECDSA): New. (struct ssh_key_type_spec): Add fields CURVE_NAME and HASH_ALGO. (ssh_key_types): Add types ecdsa-sha2-nistp{256,384,521}. (ssh_signature_encoder_t): Add arg spec and adjust all callers. (ssh_signature_encoder_ecdsa): New. (sexp_key_construct, sexp_key_extract, ssh_receive_key) (ssh_convert_key_to_blob): Support ecdsa. (ssh_identifier_from_curve_name): New. (ssh_send_key_public): Retrieve and pass the curve_name. (key_secret_to_public): Ditto. (data_sign): Add arg SPEC and change callers to pass it. (ssh_handler_sign_request): Get the hash algo from SPEC. * common/ssh-utils.c (get_fingerprint): Support ecdsa. * agent/protect.c (protect_info): Add flag ECC_HACK. (agent_protect): Allow the use of the "curve" parameter. * agent/t-protect.c (test_agent_protect): Add a test case for ecdsa. * agent/command-ssh.c (ssh_key_grip): Print a better error code. -- The 3 standard curves are now supported in gpg-agent's ssh-agent protocol implementation. I tested this with all 3 curves and keys generated by OpenSSH 5.9p1. Using existing non-ssh generated keys will likely fail for now. To fix this, the code should first undergo some more cleanup; then the fixes are pretty straightforward. And yes, the data structures are way too complicated.
* ssh: Rewrite a function for better maintainabilityWerner Koch2012-12-111-40/+41
| | | | | | | | * agent/command-ssh.c (ssh_signature_encoder_dsa): Rewrite. -- Using es_fopenmem instead of a preallocated buffer is safer and easier to read.
* ssh: Improve key lookup for many keys.Werner Koch2012-12-101-154/+166
| | | | | | | | | | | | | | | | | | | * agent/command-ssh.c: Remove dirent.h. (control_file_s): Add struct item. (rewind_control_file): New. (search_control_file): Factor code out to ... (read_control_file_item): New. (ssh_handler_request_identities): Change to iterate over entries in sshcontrol. -- Formerly we scanned the private key directory for matches of entries in sshcontrol. This patch changes it to scan the sshcontrol file and thus considers only keys configured there. The rationale for this is that it is common to have only a few ssh keys but many private keys. Even if that assumption does not hold true, the scanning of the sshcontrol file is faster than reading the directory and only then scanning the ssh control for each directory entry.
* ssh: Cleanup sshcontrol file access code.Werner Koch2012-12-101-61/+104
| | | | | | | | * agent/command-ssh.c (SSH_CONTROL_FILE_NAME): New macro to replace the direct use of the string. (struct control_file_s, control_file_t): New. (open_control_file, close_control_file): New. Use them instead of using fopen/fclose directly.
* agent: Add envvar "gnupg_SSH_AUTH_SOCK_by"Werner Koch2012-12-101-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/gpg-agent.c (main): Pass new envar gnupg_SSH_AUTH_SOCK_by to an invoked process. -- This environment variable is useful for debugging if --use-standard-socket is used (which is the default since 2.1). Commonly you should have this in your init script (e.g. ~/.bashrc): unset GPG_AGENT_INFO unset SSH_AGENT_PID SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh" export SSH_AUTH_SOCK The problem is that gpg-agent won't be able to override the SSH_AUTH_SOCK envvar if gpg-agent has been invoked as gpg-agent --enable-ssh-support --daemon /bin/bash To fix this you should instead use this code in the init script: unset GPG_AGENT_INFO unset SSH_AGENT_PID if [ ${gnupg_SSH_AUTH_SOCK_by:-0} -ne $$ ]; then export SSH_AUTH_SOCK="${HOME}/.gnupg/S.gpg-agent.ssh" fi This will work in all cases and thus allows to start gpg-agent for testing purposes with a different homedir and use this gpg-agent as an ssh-agent. Example: GNUPGHOME=$(pwd) gpg-agent --enable-ssh-support --daemon /bin/bash gnupg_SSH_AUTH_SOCK_by is set to the PID of the exec-ed process and thus will work safely if called recursively.
* config: Update npth.m4.Werner Koch2012-12-101-9/+32
| | | | * m4/npth.m4: Take from current npth master.
* Revert SCD changes of 2010-05-03.NIIBE Yutaka2012-12-044-40/+7
| | | | | | | | | | | | | | | | * scd/apdu.c (pcsc_no_service): Remove. (open_pcsc_reader_direct, open_pcsc_reader_wrapped): Remove pcsc_no_service support. (apdu_open_reader): Remove R_NO_SERVICE. * scd/apdu.h (apdu_open_reader): Remove R_NO_SERVICE. * scd/command.c (reader_disabled): Remove. (get_current_reader): Follow the change of R_NO_SERVICE. (open_card, cmd_serialno, scd_command_handler): Remove reader_disabled support. * scd/sc-copykeys.c (main): Follow the change of R_NO_SERVICE. -- Daemon should handle all possible cases. Even if such a difficult case like reader_disabled, it should not exit.
* Don't keep opening unavailable card reader.NIIBE Yutaka2012-12-041-5/+0
| | | | | | | | | | * scd/command.c (update_reader_status_file): Don't call get_current_reader. -- This fix has a impact that the insertion of a card reader will not be detected upon the insertion, but will be deferred until user tries to access his card.
* Refresh sample keysDavid Shaw2012-11-301-400/+880
|
* Adjust awk to not add trailing whitespace.David Shaw2012-11-301-3/+2
| | | | | * mksamplekeys: Tweak awk script to not add trailing whitespace to blank lines (makes git pre-commit hook unhappy)
* The keyserver search menu should honor --keyid-formatDavid Shaw2012-11-291-5/+11
| | | | | | * keyserver.c (print_keyrec): Honor --keyid-format when getting back full fingerprints from the keyserver (the comment in the code was correct, the code was not).
* Fix printing of ECC algo names in hkp keyserver listings.Werner Koch2012-11-271-2/+4
| | | | * g10/keyserver.c (print_keyrec): Map OpenPGP algorithm ids.
* Check for inet_addr() in -lnsl.Ben Kibbey2012-11-261-0/+2
| | | | | | | * configure.ac: Check for inet_addr() in libnsl. -- OpenSolaris/OpenIndiana requires this.
* Do not use a broken ttyname.Werner Koch2012-11-206-9/+24
| | | | | | | | | | | | * configure.ac (HAVE_BROKEN_TTYNAME): New ac_define set for Android systems. * common/util.h (gnupg_ttyname): New macro. Change all callers of ttyname to use this macro instead. (ttyname) [W32]: Rename to _gnupg_ttyname and use also if HAVE_BROKEN_TTYNAME is defined. * common/simple-pwquery.c (agent_send_all_options): Keep on using ttyname unless HAVE_BROKEN_TTYNAME is set. This is because this file may be used standalone.
* Fix non-portable use of chmod in autogen.sh.Werner Koch2012-11-161-2/+2
| | | | * autogen.sh: Remove option -c from chmod.
* Improve parsing of the GIT revision number.Werner Koch2012-11-161-2/+2
| | | | * configure.ac (mmm4_revision): Use git rev-parse.
* Add an OpenPGP card vendor.Werner Koch2012-11-161-1/+2
| | | | * g10/card-util.c (get_manufacturer): Add Yubico.
* Fix description of validity flag 'n'.Werner Koch2012-11-121-1/+1
| | | | | -- Thanks to Hauke Laging for spotting this.
* agent: Use wipememory instead of memset in one place.Werner Koch2012-11-061-1/+1
| | | | | * agent/command.c (clear_outbuf): Use wipememory. Suggested by Ben Kibbey.
* Allow decryption with card keys > 3072 bitsWerner Koch2012-11-063-17/+58
| | | | | | | | | | | | | | | | * scd/command.c (MAXLEN_SETDATA): New. (cmd_setdata): Add option --append. * agent/call-scd.c (agent_card_pkdecrypt): Use new option for long data. * scd/app-openpgp.c (struct app_local_s): Add field manufacturer. (app_select_openpgp): Store manufacturer. (do_decipher): Print a note for broken cards. -- Please note that I was not able to run a full test because I only have broken cards (S/N < 346) available.
* agent: Fix wrong use of gcry_sexp_build_arrayNIIBE Yutaka2012-11-021-4/+4
| | | | | | | | | | | | | | | | | | | | * findkey.c (agent_public_key_from_file): Fix use of gcry_sexp_build_array. -- A test case leading to a segv in Libgcrypt is gpg-connect-agent \ "READKEY 9277C5875C8AFFCB727661C18BE4E0A0DEED9260" /bye The keygrip was created by "monkeysphere s", which has a comment. gcry_sexp_build_array expects pointers to the arguments which is quite surprising. Probably ARG_NEXT was accidentally implemented wrongly. Anyway, we can't do anything about it and thus need to fix the check the users of this function. Some-comments-by: Werner Koch <[email protected]>
* SCD: Upon error, open_pcsc_reader_wrapped does same as _direct.NIIBE Yutaka2012-10-311-1/+10
| | | | | | * scd/apdu.c (PCSC_E_NO_SERVICE): New. (open_pcsc_reader_direct): Use PCSC_E_NO_SERVICE. (open_pcsc_reader_wrapped): Set pcsc_no_service.
* Update and enable French translationWerner Koch2012-08-242-2911/+4205
| | | | | * po/fr.po: Update. * po/LINGUAS: Enable fr.
* Add POT file to .gitignoreWerner Koch2012-08-241-0/+1
| | | | --
* Update German translationWerner Koch2012-08-241-26/+56
| | | | | -- Actually only updates due to typo fixes in the English source.
* Fix typos spotted during translationsDavid Prévot2012-08-2415-27/+27
| | | | | | | | | | | | | | | * agent/genkey.c: s/to to/to/ * sm/*.c: s/failed to allocated/failed to allocate/ * sm/certlist.c, ./dirmngr/validate.c: s/should have not/should not have/ * g10/seskey.c: missing closing parenthesis * dirmngr/crlcache.c: s/may has/may have/ Consistency fix: * g10/gpg.c, kbx/kbxutil.c, sm/gpgsm.c: uppercase after Syntax * dirmngr/dirmngr_ldap: no period in Syntax * dirmngr/dirmngr-client.c: infinitive for option description: s/certificates are expected/expect certificates/
* Actually show translators comments in PO filesDavid Prévot2012-08-244-9/+8
| | | | --
* Keep previous msgids of translated messagesDavid Prévot2012-08-241-2/+2
| | | | * po/Makefile.in.in: Use --previous with msgmerge.
* Fix build system for Android by disabling tests since its x-compiledHans-Christoph Steiner2012-08-242-10/+20
| | | | | | * configure.ac (HAVE_ANDROID_SYSTEM, RUN_TESTS): New. (AH_BOTTOM) [__ANDROID__]: Do not re-define ttyname. * Makefile.am: Depend tests on new RUN_TESTS conditional.
* Fix left over use of jnlib on some platformsWerner Koch2012-08-244-4/+4
| | | | | | | | * tools/watchgnupg.c: Take mischelp.h from common/ and not jnlib/. -- Also fixed in some comments.
* Fix incorrect description of --delete-secret-keyWerner Koch2012-08-091-1/+1
| | | | | | -- This is bug#1429.
* scd: handle reader/token removal.NIIBE Yutaka2012-06-251-0/+1
| | | | | * scd/apdu.c (pcsc_error_to_sw): PCSC_E_UNKNOWN_READER means SW_HOST_NO_READER.
* Change all quotes in strings and comments to the new GNU standard.Werner Koch2012-06-05175-4869/+4857
| | | | | | | | | | | | | | | | | | | The asymmetric quotes used by GNU in the past (`...') don't render nicely on modern systems. We now use two \x27 characters ('...'). The proper solution would be to use the correct Unicode symmetric quotes here. However this has the disadvantage that the system requires Unicode support. We don't want that today. If Unicode is available a generated po file can be used to output proper quotes. A simple sed script like the one used for en@quote is sufficient to change them. The changes have been done by applying sed -i "s/\`\([^'\`]*\)'/'\1'/g" to most files and fixing obvious problems by hand. The msgid strings in the po files were fixed with a similar command.
* Print the hash algorithm in colon mode key listing.Werner Koch2012-05-243-8/+10
| | | | * g10/keylist.c (list_keyblock_colon): Print digest_algo.
* Fix type conflict warning.Werner Koch2012-05-241-2/+2
| | | | * g10/keylist.c: Change min_cert_level to a byte.
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-11 10:52:09 +0000