gnupg, branch gnupg-2.2.55

Release 2.2.55

2026-08-27T10:16:46Z

gpgsm: Fix condition for de-vs compliance status line.

2026-08-26T13:28:52Z

* sm/decrypt.c (gpgsm_decrypt): Also check other conditions for de-vs compliance before emitting status line. -- Also check DFPARM.IS_DE_VS which helps to track de-vs compliance state. Updates-commit: 9de5b8b22981c644aaeed2c15389dae262cc7e97 (cherry picked from commit a09f16f2b17a47b3f215e2d257ef256f3b2b724e)

gpgsm: Only display de-vs compliance status in de-vs compliance mode.

2026-08-26T13:27:39Z

* sm/decrypt.c (gpgsm_decrypt): Check cert chain only in de-vs compliance mode. -- We need to check the certificate chain for validity and the de-vs flag only in de-vs compliance mode. GnuPG-bug-id: 8333 (cherry picked from commit 4a8f177f390b270df9a86ea47d8eced85420d7d4)

gpgsm: Fix regression in gpgsm_verify with expired certificates.

2026-08-26T13:27:17Z

* sm/verify.c (gpgsm_verify): Display information about signers with expired certificate. -- The loop over signers skipped the parsing of the current signer's information if the certificate is expired. GnuPG-bug-id: 8188 Fixes-commit: fa1ac5c23d167dde6899536d6d80d9391737d21e (cherry picked from commit 32f56a2732f0ac6204aad946388789cdbb0e26eb) The check_assert_signer_listcall was removed because --assert-signer is not supported in 2.2

gpg: Fix TOFU trust models to actually check UTK signatures.

2026-08-10T14:00:39Z

* g10/tofu.c (signed_by_utk): Add arg ctrl. Use macros fro the sigclass. Check the signature before returning true. -- This bug sits here since the introduction of the TOFU models. It is just another nail into the coffin of _this_ TOFU implementation. What we do in gpg is way to complicated and maybe even more complicate than the WoT it tried to simplify. One major problem with our implementation with all its heuristics, is that one may only check a file once to not mess up the statistics. This is highly impractical in real life. Tofu checking belongs to the caller, for example the address book of the mail client. GnuPG-bug-id: 8404 Reported-by: arthur.chan@adalogics.com Fixes-commit: 8df8aa13c795e400324a782fbaea578c8f2a1398

gpg: Remove local secret key file after bkuptocard.

2026-07-06T07:36:38Z

* agent/agent.h (agent_do_remove_key_file): New. * agent/command.c (cmd_remove_key_file): New. Remove secret key file. * (hlp_remove_key_file): Help text for above. * agent/findkey.c (agent_do_remove_key_file): Map to static function that does the actual removing. * g10/call-agent.h (agent_remove_key_file): New. * g10/call-agent.c (agent_remove_key_file): Send REMOVE_KEY_FILE command to the agent. * g10/keyedit.c (keyedit_menu): Get the keygrip from the backup file and call the agent_remove_key_file. -- This fix is for GnuPG 2.2 only. In versions after GnuPG 2.2 we use agent_set_ephemeral_mode instead of importing the secret key locally and deleting it after use. GnuPG-bug-id: 8312

build: Update ldap.m4 for POSIX with no LDAP_DEPRECATED.

2026-06-23T14:29:22Z

* m4/ldap.m4: Check ldap_err2string, instead. -- GnuPG-bug-id: 8298 Signed-off-by: NIIBE Yutaka Backported-from-master: d3822099fdd4d84323afae4bacaadfeab9cb3e27

gpgsm: Require a minimum tag length for GCM decryption.

2026-06-18T08:53:12Z

* sm/decrypt.c (gpgsm_decrypt): Require a minimum authtaglen. -- Reported-by: Thai Duong This is similar to OpenSSL's CVE-id: CVE-2026-34182

po: Clarify German description of max-cache-ttl

2026-06-09T12:24:14Z

-- Reported-by: ebo@gnupg.org

gpg: New options --show-session-hash and --show-only-session-hash.

2026-05-11T12:04:07Z

* g10/options.h (opt): Add field show_session_hash and show_only_session_hash. * g10/gpg.c (oShowOnlySessionHash,oShowSessionHash): New. (opts): Add options. (main): Set flags. * common/status.h (STATUS_SESSION_HASH): New. * g10/decrypt-data.c (decrypt_data): Emit new status code. Make opt.show_only_session_hash work. -- Backported-from-master: ecd0f7afa1cf3f1c2ecf90be6ede329dfa082823 with changes because 2.2 has no --show-only-session-key.