aboutsummaryrefslogtreecommitdiffstats
path: root/doc/gpg-agent.texi (follow)
Commit message (Collapse)AuthorAgeFilesLines
* agent: New option --change-std-env-name.Werner Koch2025-02-121-0/+10
| | | | | | | | | | | | | * common/session-env.c (stdenvnames): Add field "disabled". (INITIAL_ARRAYSIZE): Increase size a bit. (session_env_mod_stdenvnames): New. (session_env_list_stdenvnames): Handle the disabled flag. * agent/gpg-agent.c (oChangeStdEnvName): New. (opts): Add --change-std-env-name. (main): Implement option. -- GnuPG-bug-id: 7522
* Stronger deprecate the --supervised option.Werner Koch2025-01-081-8/+4
| | | | | | | | | | | | | | | | | | | | * agent/gpg-agent.c (opts): Rename option supervised. * dirmngr/dirmngr.c (opts): Ditto. -- The --supervised way to start gpg-agent has been deprecated for 2.5 years and will probably entirely removed with version 2.6.0. To allow its use until its removal the systemd service description need to be adjusted to use this option. The reason for the deprecation are conflicts with the way systemd starts gpg-agent and gpg expects how gpg-agent is started. In particular gpg expects that the gpg-agent matching its own version is started. Further the systemd way is not portable to other platforms and long term experience on Windows has show that the standard way of starting gpg-agent is less error prone. Note to those who want to re-introduse this option: Pretty please do not use socket names conflicting with our standard socket names. For example use /run/user/1000/foo-gnupg/S.gpg-agent.
* Merge branch 'STABLE-BRANCH-2-4'Werner Koch2024-03-121-3/+3
|\ | | | | | | | | | | | | | | -- Resolved conflicts: NEWS common/exechelp-w32.c configure.ac
| * doc: Fix spelling errors found by lintian.Werner Koch2024-01-291-3/+3
| | | | | | | | | | | | -- Reported-by: Andreas Metzler <[email protected]>
* | Merge branch 'STABLE-BRANCH-2-4'Werner Koch2024-01-261-5/+16
|\| | | | | | | | | | | | | | | -- Fixed conflicts: NEWS configure.ac doc/gpg.texi
| * doc: Describe the ssh-agent protocol options for Windows.Werner Koch2024-01-151-5/+16
| | | | | | | | | | | | -- Also fix a typo in a macro.
* | doc: Fix to avoid using en-dash for command options.NIIBE Yutaka2023-11-021-1/+1
| | | | | | | | | | | | | | -- GnuPG-bug-id: 6746 Signed-off-by: NIIBE Yutaka <[email protected]>
* | Minor style fixes.NIIBE Yutaka2023-10-051-12/+12
|/ | | | | | -- Signed-off-by: NIIBE Yutaka <[email protected]>
* ssh: Allow to prefer on-disk keys over active card keys.Werner Koch2023-04-181-1/+36
| | | | | | | | * agent/command-ssh.c (ssh_send_available_keys): Redefine the order of keys. -- GnuPG-bug-id: 6212
* agent: Add trustlist flag "de-vs".Werner Koch2023-04-031-0/+5
| | | | | | | | | | | | | | | | * agent/trustlist.c (struct trustitem_s): Add field de_vs. (read_one_trustfile): Parse it. (istrusted_internal): Emit TRUSTLISTFLAG status line. * sm/gpgsm.h (struct rootca_flags_s): Add field de_vs. * sm/call-agent.c (istrusted_status_cb): Detect the flags. * sm/sign.c (write_detached_signature): Remove unused vars. -- Right now this flag has no effect; we first need to specify the exact behaviour. GnuPG-bug-id: 5079
* agent: Make --disable-extended-key-format a dummy option.Werner Koch2023-03-131-9/+5
| | | | | | | | | | | | | | | | | | | | | * agent/agent.h (opt): Remove enable_extended_key_format. * agent/gpg-agent.c (enum cmd_and_opt_values): Turn oDisableExtendedKeyFormat and oEnableExtendedKeyFormat into dummy options. * agent/protect.c (do_encryption): Remove arg use_ocb and corresponding code. (agent_protect): Ditto. Change all callers. * agent/findkey.c (agent_write_private_key): Simplify due to the removal of disable-extended-key-format. (write_extended_private_key): Fold into agent_write_private_key. -- This change is related to GnuPG-bug-id: 6386 but should have no visible effect except for the removal of option --disable-extended-key-format.
* doc: Typo fixesWerner Koch2022-12-161-1/+1
| | | | | | | -- Reported-by: Andreas Metzler GnuPG-bug-id: 6309
* agent: Don't start in --supervised mode if no-autostart is enabled.Werner Koch2022-09-071-0/+3
| | | | | * agent/gpg-agent.c (main): Print an error message if no-autostart is set in common.conf.
* agent: New option --no-user-trustlist and --sys-trustlist-name.Werner Koch2022-06-141-1/+18
| | | | | | | | | | | | | | | | | | | | | | | | * agent/gpg-agent.c (oNoUserTrustlist,oSysTrustlistName): New. (opts): Add new option names. (parse_rereadable_options): Parse options. (finalize_rereadable_options): Reset allow-mark-trusted for the new option. * agent/agent.h (opt): Add fields no_user_trustlist and sys_trustlist_name. * agent/trustlist.c (make_sys_trustlist_name): New. (read_one_trustfile): Use here. (read_trustfiles): Use here. Implement --no-user-trustlist. -- With the global options we can now avoid that a user changes the Root-CA trust by editing the trustlist.txt. However, to implement this we need a new option so that we don't need to rely on some magic like --no-allow-mark-trusted has been put into a force section. The second option makes system administration easier as it allows to keep the trustlist in a non-distributed file. GnuPG-bug-id: 5990
* Deprecate the --supervised options.Werner Koch2022-04-251-3/+2
| | | | | | | | * agent/gpg-agent.c (main): Mark --supervised as deprecated. * dirmngr/dirmngr.c (main): Ditto. -- The supervised thing causes more trouble than it pretends to solve.
* agent: New flag "qual" for the trustlist.txt.Werner Koch2022-02-271-0/+6
| | | | | | | | | | * agent/trustlist.c (struct trustitem_s): Add flag "qual". (read_one_trustfile): Rename arg "allow_include" to "systrust" and change callers. Parse new flag "qual". (istrusted_internal): Print all flags. * sm/call-agent.c (istrusted_status_cb): Detect the "qual" flag. * sm/gpgsm.h (struct rootca_flags_s): Add flag "qualified". * sm/certchain.c (do_validate_chain): Take care of the qualified flag.
* agent,dirmngr: New option --steal-socketWerner Koch2021-11-131-0/+9
| | | | | | | | | | | | | | | | | | | * agent/gpg-agent.c (oStealSocket): New. (opts): Add option. (steal_socket): New file global var. (main): Set option. (create_server_socket): Implement option. * dirmngr/dirmngr.c (oStealSocket): New. (opts): Add option. (steal_socket): New file global var. (main): Set option. Add comment to eventually implement it. -- Note that --steal-socket has currently no effect on dirmngr because dirmngr does this anway. Signed-off-by: Werner Koch <[email protected]>
* agent: Use the sysconfdir for a pattern file.Werner Koch2021-08-181-4/+6
| | | | * agent/genkey.c (do_check_passphrase_pattern): Use make_filename.
* agent: Ignore passphrase constraints for a generated passphrase.Werner Koch2021-08-181-1/+5
| | | | | | | | | | | | | | | | | | | | | * agent/agent.h (PINENTRY_STATUS_PASSWORD_GENERATED): New. (MAX_GENPIN_TRIES): Remove. * agent/call-pinentry.c (struct entry_parm_s): (struct inq_cb_parm_s): Add genpinhash and genpinhas_valid. (is_generated_pin): New. (inq_cb): Suppress constraints checking for a generated passphrase. No more need for several tries to generate the passphrase. (do_getpin): Store a generated passphrase/pin in the status field. (agent_askpin): Suppress constraints checking for a generated passphrase. (agent_get_passphrase): Ditto. * agent/command.c (cmd_get_passphrase): Ditto. -- A generated passphrase has enough entropy so that all kind of extra checks would only reduce the actual available entropy. We thus detect if a passphrase has been generated (and not changed) and skip all passphrase constraints checking.
* agent: New option --check-sym-passphrase-pattern.Werner Koch2021-08-131-4/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/gpg-agent.c (oCheckSymPassphrasePattern): New. (opts): Add --check-sym-passphrase-pattern. (parse_rereadable_options): Set option. (main): Return option info. * tools/gpgconf-comp.c: Add new option. * agent/agent.h (opt): Add var check_sym_passphrase_pattern. (struct pin_entry_info_s): Add var constraints_flags. (CHECK_CONSTRAINTS_NOT_EMPTY): New to replace a hardwired 1. (CHECK_CONSTRAINTS_NEW_SYMKEY): New. * agent/genkey.c (check_passphrase_pattern): Rename to ... (do_check_passphrase_pattern): this to make code reading easier. Handle the --check-sym-passphrase-pattern option. (check_passphrase_constraints): Replace arg no_empty by a generic flags arg. Also handle --check-sym-passphrase-pattern here. * agent/command.c (cmd_get_passphrase): In --newsymkey mode pass CHECK_CONSTRAINTS_NEW_SYMKEY flag. * agent/call-pinentry.c (struct entry_parm_s): Add constraints_flags. (struct inq_cb_parm_s): New. (inq_cb): Use new struct for parameter passing. Pass flags to teh constraints checking. (do_getpin): Pass constraints flag down. (agent_askpin): Take constrainst flag from the supplied pinentry struct. -- Requirements for a passphrase to protect a private key and for a passphrase used for symmetric encryption are different. Thus a the use of a different pattern file will be useful. Note that a pattern file can be used to replace the other passphrase constraints options and thus we don't need to duplicate them for symmetric encryption. GnuPG-bug-id: 5517 Signed-off-by: Werner Koch <[email protected]>
* agent: Make --pinentry-formatted-passphrase a simple flagIngo Klöcker2021-08-121-18/+3
| | | | | | | | | | | | | | * agent/agent.h (opt): Change type of pinentry_formatted_passphrase to int (as for other flags). * agent/call-pinentry.c (setup_formatted_passphrase): Remove no longer needed translated strings. Write option without value to Assuan connection. * agent/gpg-agent.c (opts): Use ARGPARSE_s_n for oPinentryFormattedPassphrase. (parse_rereadable_options): Set option to 1. -- GnuPG-bug-id: 5553, 5517
* agent: New option --pinentry-formatted-passphraseIngo Klöcker2021-08-101-0/+24
| | | | | | | | | | | | * agent/agent.h (opt): Add field pinentry_formatted_passphrase. * agent/call-pinentry.c (setup_formatted_passphrase): New. (agent_get_passphrase): Pass option to pinentry. * agent/gpg-agent.c (oPinentryFormattedPassphrase): New. (opts): Add option. (parse_rereadable_options): Set option. -- GnuPG-bug-id: 5517
* doc: Fix typosGavin L. Rebeiro2020-08-281-1/+1
| | | | --
* doc: Update description of --debugWerner Koch2019-09-051-24/+5
| | | | | | -- Signed-off-by: Werner Koch <[email protected]>
* doc: clarify CARD event counter.Daniel Kahn Gillmor2019-08-201-1/+1
| | | | | | | | | | | | | * doc/gpg-agent.texi: improve documentation of CARD entry in GETEVENTCOUNTER description. -- "stati" is unclear and confusing, and describing something in the singular is almost always less ambiguous than leaving it in the plural. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* agent: Re-introduce --enable-extended-key-format.Werner Koch2019-03-061-6/+9
| | | | | | | | | | | | | * agent/gpg-agent.c (oEnableExtendedKeyFormat): Re-introduce. (parse_rereadable_options): Handle it in a special way. * agent/protect.c (agent_protect): Be safe and set use_ocb only to 1 or 0. * tools/gpgconf-comp.c: Add --enable-extended-key-format again. -- This is required for backward compatible with profiles. Signed-off-by: Werner Koch <[email protected]>
* agent: Default to extended key format.Werner Koch2019-03-061-10/+10
| | | | | | | | | | | | | | | * agent/gpg-agent.c (oDisableExtendedKeyFormat, oNoop): New. (oEnableExtendedKeyFormat): Remove. (opts): Make --enable-extended-key-format a dummy option. Add disable-extended-key-format. (parse_rereadable_options): Implement oDisableExtendedKeyFormat. -- Extended key format is supported since vesion 2.1.12 which should have long been replaced by a newer version inh all installations. Thus for 2.3 we will make use of the extended-key-format by default. Signed-off-by: Werner Koch <[email protected]>
* agent: Make the S2K calibration time runtime configurabe.Werner Koch2018-12-111-2/+9
| | | | | | | | | | | | | | | | | | * agent/protect.c (s2k_calibration_time): New file global var. (calibrate_s2k_count): Use it here. (get_calibrated_s2k_count): Replace function static var by ... (s2k_calibrated_count): new file global var. (set_s2k_calibration_time): New function. * agent/gpg-agent.c (oS2KCalibration): New const. (opts): New option --s2k-calibration. (parse_rereadable_options): Parse that option. -- Note that using an unrelistic high value (like 60000) takes quite some time for calibration. GnuPG-bug-id: 3399 Signed-off-by: Werner Koch <[email protected]>
* agent: New OPTION pretend-request-originWerner Koch2018-03-231-0/+21
| | | | | | | | | | | | | * common/shareddefs.h (request_origin_t): New. * common/agent-opt.c (parse_request_origin): New. (str_request_origin): New. * agent/command.c (option_handler): Implement new option. -- This allows to pretend that a request originated from the extra or browser socket. Signed-off-by: Werner Koch <[email protected]>
* agent: Also evict cached items via a timer.Werner Koch2018-03-061-1/+4
| | | | | | | | | | | | * agent/cache.c (agent_cache_housekeeping): New func. * agent/gpg-agent.c (handle_tick): Call it. -- This change mitigates the risk of having cached items in a post mortem dump. GnuPG-bug-id: 3829 Signed-off-by: Werner Koch <[email protected]>
* Change backlog from 5 to 64 and provide option --listen-backlog.Werner Koch2017-12-121-0/+3
| | | | | | | | | | | | | | * agent/gpg-agent.c (oListenBacklog): New const. (opts): New option --listen-backlog. (listen_backlog): New var. (main): Parse new options. (create_server_socket): Use var instead of 5. * dirmngr/dirmngr.c: Likewise. * scd/scdaemon.c: Likewise. -- GnuPG-bug-id: 3473 Signed-off-by: Werner Koch <[email protected]>
* doc: Typo fixWerner Koch2017-12-111-1/+1
| | | | --
* agent: New option --auto-expand-secmem.Werner Koch2017-11-241-0/+11
| | | | | | | | | | | | * agent/gpg-agent.c (oAutoExpandSecmem): New enum value. (opts): New option --auto-expand-secmem. (main): Implement that option. -- Note that this option has an effect only if Libgcrypt >= 1.8.2 is used. GnuPG-bug-id: 3530
* agent: New GETINFO sub-commands "s2k_count_cal" and "s2k_time".Werner Koch2017-11-061-8/+18
| | | | | | | | | | * agent/command.c (cmd_getinfo): New sub-commands. * agent/protect.c (get_standard_s2k_count): Factor some code out to ... (get_calibrated_s2k_count): new. (get_standard_s2k_time): New. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit 52d41c8b0f4af6278d18d8935399ddad16a26856)
* agent: New option --s2k-count.Werner Koch2017-11-061-0/+14
| | | | | | | | | | | | | | | * agent/agent.h (opt): New field 's2k_count'. * agent/gpg-agent.c (oS2KCount): New enum value. (opts): New option --s2k-count. (parse_rereadable_options): Set opt.s2k_count. -- This option is useful to speed up the starting of gpg-agent and in cases where the auto-calibration runs into problems due to a broken time measurement facility. Signed-off-by: Werner Koch <[email protected]> (cherry picked from commit f7212f1d11aad5d910d2c77b2e5c6ab31a0e786e)
* agent: Make --no-grab the default.Werner Koch2017-08-041-3/+7
| | | | | | | | | | | * agent/gpg-agent.c (oGrab): New const. (opts): New option --grab. Remove description for --no-grab. (parse_rereadable_options): Make --no-grab the default. (finalize_rereadable_options): Allow --grab to override --no-grab. (main) <gpgconflist>: Add "grab". * tools/gpgconf-comp.c (gc_options_gpg_agent): Add "grab". Signed-off-by: Werner Koch <[email protected]>
* agent: Make digest algorithms for ssh fingerprints configurable.Justus Winter2017-05-241-0/+7
| | | | | | | | | | | | | | | | | | | | | * agent/agent.h (opt): New field 'ssh_fingerprint_digest'. * agent/command-ssh.c (data_sign, ssh_identity_register): Honor the option for strings used to communicate with the user. * agent/findkey.c (agent_modify_description): Likewise. * agent/gpg-agent.c (cmd_and_opt_values): New value. (opts): New option '--ssh-fingerprint-digest'. (parse_rereadable_options): Set the default to MD5 for now. (main): Handle the new option. * doc/gpg-agent.texi: Document the new option. -- OpenSSH has transitioned from using MD5 to compute key fingerprints to SHA256. This patch makes the digest used when communicating key fingerprints to the user (e.g. in pinentry dialogs) configurable. For now this patch conservatively defaults to MD5. GnuPG-bug-id: 2106 Signed-off-by: Justus Winter <[email protected]>
* doc: Fix name of program.Justus Winter2017-05-111-1/+1
| | | | | -- Signed-off-by: Justus Winter <[email protected]>
* Spelling fixes in docs and comments.NIIBE Yutaka2017-04-281-1/+1
| | | | | | | | | | -- In addition, fix trailing spaces in tests/inittests. GnuPG-bug-id: 3121 Reported-by: ka7 (klemens) Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Use OCB for key protection with --enable-extended-key-format.Werner Koch2017-04-021-1/+2
| | | | | | | | * agent/protect.c (PROT_DEFAULT_TO_OCB): Remove macro. (agent_protect): Make the default protection mode depend on the extend key format option. Signed-off-by: Werner Koch <[email protected]>
* agent: New option --enable-extended-key-format.Werner Koch2017-03-241-0/+9
| | | | | | | | | | * agent/gpg-agent.c (oEnableExtendedKeyFormat): New const. (opts): New option --enable-extended-key-format. (parse_rereadable_options): Set option * agent/findkey.c (write_extended_private_key): Add arg 'update'. (agent_write_private_key): Implement new option. Signed-off-by: Werner Koch <[email protected]>
* Clean up word replication.Yuri Chornoivan2017-02-211-3/+3
| | | | | | | | | -- This fixes extra word repetitions (like "the the" or "is is") in the code and docs. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* doc: Document how to manually shut down gpg-agent.Daniel Kahn Gillmor2016-10-171-0/+9
| | | | | | | | | * doc/gpg-agent.texi: document "gpgconf --kill gpg-agent" for manual agent termination. This was requested in a side-comment in https://bugs.debian.org/840669 Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* doc: Point gpg-agent(1) at the right gpg manpage in SEE ALSO.Daniel Kahn Gillmor2016-10-171-1/+1
| | | | | | | * doc/gpg-agent.texi (SEE ALSO): refer to @gpgname, instead of hard-coding "gpg2". Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* agent: Streamline the supervised mode code.Werner Koch2016-10-041-3/+5
| | | | | | | | | | | * agent/gpg-agent.c (get_socket_path): Rename to ... (get_socket_name): this. This is to comply with the GNU coding guide. Use xtrymalloc instead of malloc. Do not build for W32. (map_supervised_sockets): Use strtokenize and set the the socket names here. (main): Adjust for above change. Do not close the socket. Signed-off-by: Werner Koch <[email protected]>
* agent: Implement --supervised command (for systemd, etc).Daniel Kahn Gillmor2016-10-041-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * agent/gpg-agent.c (get_socket_path): New function for POSIX systems to return the path for a provided unix-domain socket. (map_supervised_sockets): New function to inspect $LISTEN_FDS and $LISTEN_FDNAMES and map them to the specific functionality offered by the agent. (main): Add --supervised command. When used, listen on already-open file descriptors instead of opening our own. * doc/gpg-agent.texi: Document --supervised option. -- "gpg-agent --supervised" is a way to invoke gpg-agent such that a system supervisor like systemd can provide socket-activated startup, log management, and scheduled shutdown. When running in this mode, gpg-agent: * Does not open its own listening socket; rather, it expects to be given a listening socket on incoming file descriptors. * Does not detach from the invoking process, staying in the foreground instead. Unless otherwise specified, logs are sent to stderr. Signed-off-by: Daniel Kahn Gillmor <[email protected]>
* agent: Kludge to allow disabling of the extra sockets.Werner Koch2016-09-301-2/+3
| | | | | | * agent/gpg-agent.c (main): Check for special socket names. Signed-off-by: Werner Koch <[email protected]>
* agent: Enable restricted, browser, and ssh socket by default.Justus Winter2016-09-301-1/+5
| | | | | | | | | | | | | | | | | * agent/gpg-agent.c (main): Provide defaults for 'extra-socket' and 'browser-socket', enable ssh socket by default, but do not emit the 'SSH_AUTH_SOCK' variable unless it has been explicitly requested. * configure.ac (GPG_AGENT_{EXTRA,BROWSER}_SOCK_NAME): New definitions. * doc/gpg-agent.texi: Update documentation. -- This change enables the restricted, browser, and ssh socket by default. Note that in all cases, the user has to do some additional configuration to her setup to make use of these features. Therefore, this should not break any existing setups, but makes it simpler to discover and use these features. Signed-off-by: Justus Winter <[email protected]>
* doc: Do not end section names with "."Ineiev2016-09-201-1/+1
|
* doc: Fix fix "Not(e) that you can(not) abbreviate".Werner Koch2016-09-201-1/+1
| | | | | | | | | | | -- The commands --help, --version, --dump-options are special in that they can't be abbreciated on the command line. This is to avoid problems with regular options with the same prefix. Fixes-commit: 0a27d8a57c4c990fcada4278a1ce2e6fc9043e9 Signed-off-by: Werner Koch <[email protected]>
generated by cgit v1.2.3 (git 2.25.1) at 2025-04-27 09:40:03 +0000