aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* appimage: Add a few hacks that are currently needed to build an AppImageikloecker/t5598-appimageIngo Klöcker2021-09-154-0/+126
| | | | | | | | * Apply a patch to latest pinentry to make it build with Qt 5.9 * Copy appimage.desktop and speedo.mk with appimage support which are not yet available in gnupg (outside of the work branch) GnuPG-bug-id: 5598
* appimage: Add experimental scripts for building an AppImage of gpgIngo Klöcker2021-09-155-0/+187
| | | | GnuPG-bug-id: 5598
* speedo: Add appimage targets for Speedo buildsIngo Klöcker2021-09-151-7/+35
| | | | | | | | | | | | | | | | | | * build-aux/speedo.mk (appimage, git-appimage, this-appimage): New targets. (help): Add documentation. (define SETVARS, define SETVARS_W64): Set environment variables for cross-compiling only if TARGETOS is w32. -- The new appimage targets allow building those parts of GnuPG that are needed for creating an AppImage of gpg. Differences to a native build are: * gpgme is not built * pinentry-qt is built * documentation of gnupg is not built GnuPG-bug-id: 5598
* Update release signing keys.Werner Koch2021-09-141-0/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | -- These are now # ------------------------ >8 ------------------------ pub rsa3072 2017-03-17 [SC] [expires: 2027-03-15] 5B80C5754298F0CB55D8ED6ABCEF7E294B092E28 sig R BCEF7E294B092E28 2017-03-17 Andre Heinecke (Release Signing Key) uid Andre Heinecke (Release Signing Key) sig 3 BCEF7E294B092E28 2017-03-17 Andre Heinecke (Release Signing Key) sig 1FDF723CF462B6B1 2017-03-17 Andre Heinecke <[email protected]> pub ed25519 2020-08-24 [SC] [expires: 2030-06-30] 6DAA6E64A76D2840571B4902528897B826403ADA uid Werner Koch (dist signing 2020) sig 3 528897B826403ADA 2020-08-24 Werner Koch (dist signing 2020) sig 249B39D24F25E3B6 2020-08-24 Werner Koch (dist sig) sig 63113AE866587D0A 2020-08-24 [email protected] sig E3FDFF218E45B72B 2020-08-24 Werner Koch (wheatstone commit signing) sig F2AD85AC1E42B367 2020-08-24 Werner Koch <[email protected]> pub ed25519 2021-05-19 [SC] [expires: 2027-04-04] AC8E115BF73E2D8D47FA9908E98E9B2D19C6C8BD uid Niibe Yutaka (GnuPG Release Key) sig 3 E98E9B2D19C6C8BD 2021-05-19 Niibe Yutaka (GnuPG Release Key) sig 00B45EBD4CA7BABE 2021-09-14 NIIBE Yutaka <[email protected]> sig E267B052364F028D 2021-09-14 NIIBE Yutaka <[email protected]>
* scd: Remove context reference counting from pc/scWerner Koch2021-09-141-22/+16
| | | | | | | | | | | | | | | | | | | | * scd/apdu.c (pcsc): Add flag context_valid, remove count. (close_pcsc_reader): Use new flag instead of looking at magic context value. (pcsc_init): Set new flag. (open_pcsc_reader): Use new flag. (apdu_init): Clear new flag. * scd/apdu.c: Remove assert.h. Replace all assert by log_assert. -- The previous fix 192113552faa98f40cc91fe014ec55861474626c did not help, thus the new hypothesis is that PC/SC might return a valid context with the value -1. We now use a dedicated flag to track the validity of the context. The reference counting seems to be superfluous and is a relict due to backporting from 2.3. Removed.
* common: New envvar GNUPG_EXEC_DEBUG_FLAGS.Werner Koch2021-09-131-4/+16
| | | | | * common/exechelp-w32.c (gnupg_spawn_process_detached): Silence breakaway messages and turn them again into debug messages.
* doc: Clarify some gpg keyring optionsWerner Koch2021-09-091-15/+15
| | | | | -- GnuPG-bug-id: 5594
* scd: Support PC/SC for "getinfo reader_list".Werner Koch2021-09-083-12/+88
| | | | | | | | | | | | | | | | | | | | | * scd/apdu.c: Include membuf.h. (pcsc): Add reader_list field. (open_pcsc_reader): Fill that field. (apdu_get_reader_list): New. * scd/command.c: Remove header ccid-driver.h. (pretty_assuan_send_data): New. (cmd_getinfo): Print all reader names. -- Note that depending on the card backend (ccid or PC/SC) it might be necessary to first send a reset followed by SERIALNO to get an updated list of reader. Or well send KILLSCD. The pretty printing of Assuan data lines does only work if you connect direct to scdaemon because the wrapper in gpg-agent does not know about this and combines the Assuan lines again. Signed-off-by: Werner Koch <[email protected]>
* scd: Fix possible assertion in close_pcsc_reader.Werner Koch2021-09-071-6/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/apdu.c (close_pcsc_reader): Don't ref-count if the context is invalid. (open_pcsc_reader): Compare the context against -1 which is our indicator for an invalid context. -- I got a crash report for Windows: DBG: chan_0x000000a4 <- RESTART DBG: chan_0x000000a4 -> OK DBG: chan_0x000000a4 <- SERIALNO DBG: open_pcsc_reader(portstr=(null)) reader slot 0: not connected DBG: open_pcsc_reader => slot=0 DBG: enter: apdu_connect: slot=0 pcsc_connect failed: invalid PC/SC error code (0x6) reader slot 0: not connected DBG: leave: apdu_connect => sw=0x1000b DBG: enter: apdu_close_reader: slot=0 DBG: enter: apdu_disconnect: slot=0 DBG: leave: apdu_disconnect => sw=0x0 Ohhhh jeeee: Assertion "pcsc.count > 0" in close_pcsc_reader failed (...2.2.28/scd/apdu.c:817) no smartcard reader was connected but the box might sport a virtual reader. This patch should make it more robust. Signed-off-by: Werner Koch <[email protected]>
* agent: Fix segv in GET_PASSPHRASE (regression)Werner Koch2021-09-071-1/+1
| | | | | | | | | * agent/command.c (cmd_get_passphrase): Do not deref PI. PI is always NULL. -- Fixes-commit: db5dc7a91af3774cfbce0bc533e0f0b5498402fe GnuPG-bug-id: 5577
* gpg: Print a note about the obsolete option --secret-keyring.Werner Koch2021-08-281-1/+1
| | | | | | -- GnuPG-bug-id: 2749
* Fix announcement mail URLWerner Koch2021-08-271-1/+1
| | | | --
* common: Fix put_membuf.NIIBE Yutaka2021-08-271-1/+4
| | | | | | | | | | | | | * common/membuf.c (put_membuf): Allow NULL for the second arg. -- Cherry-picked from master commit of: f271c6916469c0054c143adb4cee0588866a2a61 There has been such a use case in keybox-blob.c. Signed-off-by: NIIBE Yutaka <[email protected]>
* build: Fix removal of AC_TYPE_SIGNAL.NIIBE Yutaka2021-08-271-0/+1
| | | | | | | | | * configure.ac: AC_TYPE_SIGNAL is still needed. -- Fixes-commit: d5f9481186eaf2ff28d7ab04fd36f0bbd1c9714d Signed-off-by: NIIBE Yutaka <[email protected]>
* po: Update Japanese Translation.NIIBE Yutaka2021-08-261-11/+7
| | | | | | -- Signed-off-by: NIIBE Yutaka <[email protected]>
* common: Fix get_signal_name for GNU/Linux.NIIBE Yutaka2021-08-262-2/+4
| | | | | | | | | | | | | * common/signal.c (get_signal_name): Use sigdescr_np if available. * configure.ac: Check the function. -- Backport master commit of: c4ba712736ddeda66055567874d573e79d22666b GnuPG-bug-id: 5568 Signed-off-by: NIIBE Yutaka <[email protected]>
* Post release updatesWerner Koch2021-08-262-1/+7
| | | | --
* Release 2.2.30gnupg-2.2.30Werner Koch2021-08-261-1/+20
|
* po: Auto updateWerner Koch2021-08-2626-10/+689
| | | | --
* po: Update German translationWerner Koch2021-08-261-1/+25
| | | | --
* wkd: Properly unescape the user-id from a key listing.Werner Koch2021-08-201-6/+16
| | | | * tools/wks-util.c (append_to_uidinfo_list): Unescape UID.
* common: New function decode_c_string.Werner Koch2021-08-202-0/+77
| | | | | | | | | | * common/miscellaneous.c (decode_c_string): New. -- This is basically a copy from the code we use in gpgme and gpa. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 6ecedd0b25b6b1a33be63b99f2a8256370000521)
* agent: Use the sysconfdir for a pattern file.Werner Koch2021-08-202-5/+35
| | | | * agent/genkey.c (do_check_passphrase_pattern): Use make_filename.
* agent: Ignore passphrase constraints for a generated passphrase.Werner Koch2021-08-204-35/+73
| | | | | | | | | | | | | | | | | | | | | * agent/agent.h (PINENTRY_STATUS_PASSWORD_GENERATED): New. (MAX_GENPIN_TRIES): Remove. * agent/call-pinentry.c (struct entry_parm_s): (struct inq_cb_parm_s): Add genpinhash and genpinhas_valid. (is_generated_pin): New. (inq_cb): Suppress constraints checking for a generated passphrase. No more need for several tries to generate the passphrase. (do_getpin): Store a generated passphrase/pin in the status field. (agent_askpin): Suppress constraints checking for a generated passphrase. (agent_get_passphrase): Ditto. * agent/command.c (cmd_get_passphrase): Ditto. -- A generated passphrase has enough entropy so that all kind of extra checks would only reduce the actual available entropy. We thus detect if a passphrase has been generated (and not changed) and skip all passphrase constraints checking.
* wkd: Fix client issue with leading or trailing spaces in user-ids.Werner Koch2021-08-206-18/+199
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * common/recsel.c (recsel_parse_expr): Add flag -t. * common/stringhelp.c (strtokenize): Factor code out to do_strtokenize. (strtokenize_nt): New. (do_strtokenize): Add arg trim to support the strtokenize_nt. * common/t-stringhelp.c (test_strtokenize_nt): New test cases. * tools/wks-util.c (wks_list_key): Use strtokenize_nt and the recsel flag -t. -- This fixes a bug with user ids with leading spaces because: wks-client lists all mail addresses from the key and matches them to the requested mail address. If there are several user-ids all with the same mail address wks-client picks one of them and then extracts exactly that user id. However, here it does not match by the mail address but by the full user-id so that we can be sure that there will be only one user-id in the final key. The filter built expression unfortunately strips leading blanks but requires a verbatim match. Thus it won't find the user id again and errors out. The new -t flag and a non-trimming strtokenize solves the problem. Signed-off-by: Werner Koch <[email protected]>
* gpg: Return SUCCESS/FAILURE status also for --card-edit/name.Werner Koch2021-08-201-3/+8
| | | | | | | * g10/card-util.c (change_name): Call write_sc_op_status. -- Reported-by: Joey Berkovitz
* agent: Improve the GENPIN callback.Werner Koch2021-08-181-9/+14
| | | | | | * agent/call-pinentry.c (DEFAULT_GENPIN_BYTES): Replace by ... (DEFAULT_GENPIN_BITS): this and increase to 150. (generate_pin): Make sure that we use at least 128 bits.
* agent: Fix for zero length help string in pinentry hints.Werner Koch2021-08-181-14/+31
| | | | | | | | | * agent/call-pinentry.c: Remove unused assert.h. (inq_cb): Fix use use of assuan_end_confidential in case of nested use. (do_getpin): Ditto. (setup_formatted_passphrase): Escape the help string. (setup_enforced_constraints): Ignore empty help strings.
* common,w32: Replace log_debug by log_info for InProcessJobsWerner Koch2021-08-181-3/+3
| | | | * common/exechelp-w32.c (gnupg_spawn_process_detached): Use log_info.
* w32: Move socketdir to LOCAL_APPDATAWerner Koch2021-08-175-77/+160
| | | | | | | | | | | | | | | | | | | | | | | | * common/homedir.c (is_gnupg_default_homedir): Use standard_homedir instead of the constant which makes a difference on Windows. (_gnupg_socketdir_internal) [W32]: Move the directory to LOCAL_APPDATA. (gnupg_cachedir): Remove unsued function. * common/sysutils.c (gnupg_rmdir): New. * tools/gpgconf.c (main): s/rmdir/gnupg_rmdir/. -- That is actually a more correct directory than APPDATA. This fixes a problem with installations where the APPDATA is non a network drive and the resulting socket filename is truncated in our socket helper function (because we use sockaddr also for our local socket emulation on Windows). LOCAL_APPDATA is expected to be on the local box and thus in the majority of cases the resulting socket file name will be short enough. GnuPG-bug-id: 5537 Signed-off-by: Werner Koch <[email protected]> Backport-from-master: 0802cbb59b21e06e16b4fd8596934c5565e7f659
* gpgconf,w32: Print more registry diagnostics with --list-dirs.Werner Koch2021-08-171-2/+36
| | | | | | * tools/gpgconf.c (list_dirs): Figure out classes with the key. Signed-off-by: Werner Koch <[email protected]>
* agent: Make QT_QPA_PLATFORMTHEME=qt5ct work for the pientWerner Koch2021-08-171-1/+8
| | | | * agent/call-pinentry.c (atfork_core): Pass DISPLAY.
* agent: New option --check-sym-passphrase-pattern.Werner Koch2021-08-176-30/+88
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/gpg-agent.c (oCheckSymPassphrasePattern): New. (opts): Add --check-sym-passphrase-pattern. (parse_rereadable_options): Set option. (main): Return option info. * tools/gpgconf-comp.c: Add new option. * agent/agent.h (opt): Add var check_sym_passphrase_pattern. (struct pin_entry_info_s): Add var constraints_flags. (CHECK_CONSTRAINTS_NOT_EMPTY): New to replace a hardwired 1. (CHECK_CONSTRAINTS_NEW_SYMKEY): New. * agent/genkey.c (check_passphrase_pattern): Rename to ... (do_check_passphrase_pattern): this to make code reading easier. Handle the --check-sym-passphrase-pattern option. (check_passphrase_constraints): Replace arg no_empty by a generic flags arg. Also handle --check-sym-passphrase-pattern here. * agent/command.c (cmd_get_passphrase): In --newsymkey mode pass CHECK_CONSTRAINTS_NEW_SYMKEY flag. * agent/call-pinentry.c (struct entry_parm_s): Add constraints_flags. (struct inq_cb_parm_s): New. (inq_cb): Use new struct for parameter passing. Pass flags to teh constraints checking. (do_getpin): Pass constraints flag down. (agent_askpin): Take constraints flag from the supplied pinentry struct. -- Requirements for a passphrase to protect a private key and for a passphrase used for symmetric encryption are different. Thus a the use of a different pattern file will be useful. Note that a pattern file can be used to replace the other passphrase constraints options and thus we don't need to duplicate them for symmetric encryption. GnuPG-bug-id: 5517 Signed-off-by: Werner Koch <[email protected]> Backported-from-master: 7c45a69eb988e9c0329d75900af0c5b1e47291b7 agent: New option --check-sym-passphrase-pattern.
* agent: Add checkpin inquiry for pinentryIngo Klöcker2021-08-171-8/+229
| | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/call-pinentry.c: Include zb32. (MAX_GENPIN_TRIES): New. (DEFAULT_GENPIN_BYTES): New. (generate_pin): New. (setup_genpin): New. (inq_quality): Rename to ... (inq_cb): this. Handle checkpin inquiry. (setup_enforced_constraints): New. (agent_get_passphrase): Call sertup_genpin. Call setup_enforced_constraints if new passphrase is requested. -- This implements the gpg-agent side for checking whether a new passphrase entered by the user in pinentry satisfies the passphrase constraints. Performing a checkpin inquiry is only allowed if the passphrase constraints are enforced. setup_enforced_constraints sends necessary options and translated strings to pinentry. The patch also merges 557ddbde32585c534626b57a595a2ccf28fd585e et al. from master to add the genpin inquiry machinery. The suggested passphrase has the required entropy of 128 bits. GnuPG-bug-id: 5517, 5532
* agent: New option --pinentry-formatted-passphraseIngo Klöcker2021-08-164-0/+73
| | | | | | | | | | | | | | | | | | * agent/agent.h (opt): Add field pinentry_formatted_passphrase. * agent/call-pinentry.c (setup_formatted_passphrase): New. (agent_get_passphrase): Pass option to pinentry. * agent/gpg-agent.c (oPinentryFormattedPassphrase): New. (opts): Add option. (parse_rereadable_options): Set option. -- GnuPG-bug-id: 5553, 5517 This is a squashed backport of two commits from master. Backport-from-master: bf20a80f68449cc83b67c53ba9a0a84c45827ac4 Backport-from-master: 99601778f4a9dc1c9fee792361c959f5e0732cfd Signed-off-by: Werner Koch <[email protected]>
* common: Pass XDG_SESSION_TYPE and QT_QPA_PLATFORM envvars to pinentryIngo Klöcker2021-08-161-0/+5
| | | | | | | | | | | | | * common/session-env.c (stdenvnames): Add XDG_SESSION_TYPE and QT_QPA_PLATFORM. -- On Unix systems (except Darwin), Qt uses those two environment variables additionally to DISPLAY and WAYLAND_DISPLAY to figure out whether to use X11 or Wayland. For example, QT_QPA_PLATFORM needs to be set to "wayland" to make Qt use Wayland on Gnome. GnuPG-bug-id: 3659
* tools: Extend gpg-check-pattern.Werner Koch2021-08-163-24/+255
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * tools/gpg-check-pattern.c: Major rewrite. -- Signed-off-by: Werner Koch <[email protected]> Backported-from-master: 73c03e02322880c740310207dd2151cfd843792e Here is a simple pattern file: ==================== # Pattern to reject passwords which do not comply to # - at least 1 uppercase letter # - at least 1 lowercase letter # - at least one number # - at least one special character # and a few extra things to show the reject mode # Reject is the default mode, ignore case is the default #[reject] #[icase] # If the password starts with "foo" (case insensitive) it is rejected. /foo.*/ [case] # If the password starts with "bar" (case sensitive) it is rejected. /bar.*/ # Switch to accept mode: Only if all patterns up to the next "accept" # or "reject" tag or EOF match, the password is accepted. Otherwise # the password is rejected. [accept] /[A-Z]+/ /[a-z]+/ /[0-9]+/ /[^A-Za-z0-9]+/ =================
* Post release updatesWerner Koch2021-07-042-1/+8
| | | | --
* Release 2.2.29gnupg-2.2.29Werner Koch2021-07-041-3/+28
|
* Update OpenPGP card vendor list.Werner Koch2021-07-041-1/+4
| | | | --
* po: Remove removed files.Werner Koch2021-07-021-1/+0
| | | | --
* dirmngr: Change the default keyserver.Werner Koch2021-06-257-57/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | * configure.ac (DIRMNGR_DEFAULT_KEYSERVER): Change to keyserver.ubuntu.com. * dirmngr/certcache.c (cert_cache_init): Disable default pool cert. * dirmngr/http-ntbtls.c (gnupg_http_tls_verify_cb): Ditto. * dirmngr/http.c (http_session_new): Ditto. * dirmngr/server.c (make_keyserver_item): Use a different mapping for the gnupg.net names. -- Due to the unfortunate shutdown of the keyserver pool, the long term defaults won't work anymore. Thus it is better to change them. For https access keyserver.ubuntu.com is now used because it can be expected that this server can stand the load from newer gnupg LTS versions. For http based access the Dutch Surfnet keyserver is used. However due to a non-standard TLS certificate this server can not easily be made the default for https. Note: that the default server will be changed again as soon as a new connected keyserver infrastructure has been established.
* gpg: Let --fetch-key return an exit code on failure.Werner Koch2021-06-252-4/+20
| | | | | | | | * g10/keyserver.c (keyserver_fetch): Return an error code. * g10/gpg.c (main) <aFetchKeys>: Return 1 in case of no data. -- GnuPG-bug-id: 5376
* scd:ccid: Handle LIBUSB_TRANSFER_OVERFLOW interrupt transfer.NIIBE Yutaka2021-06-231-0/+5
| | | | | | | | | * scd/ccid-driver.c (intr_cb): Ignore LIBUSB_TRANSFER_OVERFLOW. -- Backport-master-commit: 25ae80b8eb6e9011049d76440ad7d250c1d02f7c Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:ccid:spr532: Extend abort_cmd for initialization time.NIIBE Yutaka2021-06-231-11/+18
| | | | | | | | | | | | | | | * scd/ccid-driver.c (abort_cmd): Add INIT argument to support synchronize until success, even ignoring timeout. (bulk_in): Normal use case of abort_cmd. (ccid_vendor_specific_init): Initial use case of abort_cmd. -- Another backport to stabilize SCM SPR332/SPR532 card reader. GnuPG-bug-id: 5297 Backport-master-commit: a9aa30ed2c2c399c2baa6a5aa2624d8fdee6286f Signed-off-by: NIIBE Yutaka <[email protected]>
* tests: Cope with broken Libgcrypt versionsWerner Koch2021-06-221-11/+27
| | | | | | | | | | | | | | * common/t-sexputil.c (test_ecc_uncompress): Ignore unknwon curve errors. -- For unknown reasons some versions of Fedora or RHEL provide a patched version of Libgcrypt with Brainpool support removed. We better ignore this error because it is a regression in 2.2.28 although that older versions could not used Brainpool keys. GnuPG-bug-id: 5502 Signed-off-by: Werner Koch <[email protected]>
* w32: Add fallback in case the Windows console can't cope with Unicode.Werner Koch2021-06-221-4/+18
| | | | | | | | | | | | | | | | | | | | | * common/ttyio.c (w32_write_console): Fallback to WriteConsoleA on error. -- To test this switch the Windows Console to "legacy mode" set LANG=de gpg --card-edit and enter an invalid command. The response contains an Umlaut and old Windows versions (and the legacy console) don't have a proper font installed for this. Without this patch this runs into a log_fatal error. The mitigation we implement is to fallback to WriteConsoleA, that is accepting wrong encoding and to print a note about the problem. GnuPG-bug-id: 5491
* dirmngr: Fix regression in KS_GET for mail address pattern.Werner Koch2021-06-211-1/+39
| | | | | | | | | | | | | | | * dirmngr/ks-engine-hkp.c (ks_hkp_search): Munge mail address pattern. (ks_hkp_get): Allow for mail addresses. - Before the keyserver changes in 2.2.28 gpg passed dirmngr a pail address as an exact pattern (e.g. "[email protected]"). Since 2.2.28 the mail address is detected gpg gpg and we see for example "<[email protected]>". This patch fixes this to turn a mail address into an exact match again. GnuPG-bug-id: 5497 Signed-off-by: Werner Koch <[email protected]>
* po: Update Simplified Chinese Translation.NIIBE Yutaka2021-06-171-32/+24
| | | | | | | | | -- Backport-master-commit: 448ccd7f1da0324bd2d8dea1bc018895b165cfba GnuPG-bug-id: 5477 Reported-by: Zhongren Gu Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Error code map fix for older Yubikey.NIIBE Yutaka2021-06-141-0/+1
| | | | | | | | | | | | | | * scd/iso7816.c (map_sw): Recognize 6A86. -- Yubikey NEO does not support the YK4_GET_CAPA command (001D000000), and it will be screwed up with the command. GnuPG-bug-id: 5487 Back-port-master-commit: 13bc0431ff1ce51246694208df611cc4561fb4b3 Fixes-commit: ec56996029d95d4bd26e1badfe207232270c6247 Signed-off-by: NIIBE Yutaka <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-27 09:48:19 +0000