gnupg/sm, branch debian-unstable-patch-queue

Return better error code for some getinfo IPC commands.

2019-06-03T14:33:50Z

* agent/command.c (cmd_getinfo): Return GPG_ERR_FALSE as boolean False. * g13/server.c (cmd_getinfo): Ditto. * sm/server.c (cmd_getinfo): Ditto. -- GPG_ERR_FALSE was introduced with libgpg-error 1.21 and we now require a later version for gnupg 2. Thus we can switch to this more descriptive code. Signed-off-by: Werner Koch

sm: Avoid confusing diagnostic for the default key.

2019-05-27T13:48:41Z

* sm/certlist.c (cert_usage_p): Add arg 'silent' and change all callers. (gpgsm_cert_use_sign_p): Add arg 'silent' and pass to cert_usage_p. Change all callers. * sm/sign.c (gpgsm_get_default_cert): Set SILENT when calling gpgsm_cert_use_sign_p -- GnuPG-bug-id: 4535 Signed-off-by: Werner Koch

sm: Fix a warning in an es_fopencooie function.

2019-05-12T18:41:32Z

* sm/certdump.c (format_name_writer): Take care of a flush request. -- We won't see a flush here so that fix does not solve a real bug but we want to be correct. Note that this function seems to predate the es_fopenmem function and thus in master (2.3) we should replace it entirely. GnuPG-bug-id: 4495 Signed-off-by: Werner Koch

sm: Allow decryption even if expired other keys are configured.

2019-03-26T12:35:18Z

* sm/gpgsm.c (main): Add special handling for bad keys in decrypt mode. -- The problem can easily be tested by adding --encrypt-to EXPIRED_KEY to a decryption command. With that patch the errors are printed but decryption continues and the process returns success unless other errors occur. GnuPG-bug-id: 4431 Signed-off-by: Werner Koch

sm, w32: Translate logger and status fd to handles

2019-03-25T13:09:46Z

* sm/gpgsm.c (main): Call translate_sys2libc_fd_int to convert the FDs. -- This is required to actually pass gpgsm an fd on windows and not a windows handle. For the passphrase-fd this was already done. (cherry picked from commit e4e0804ed123516fa00f8a876a862b2c6d34ba5c)

sm: Print Yubikey attestation extensions with --dump-cert.

2019-03-07T09:53:52Z

* sm/keylist.c (oidtranstbl): Add Yubikey OIDs. (OID_FLAG_HEX): New. (print_hex_extn): New. (list_cert_raw): Make use of that flag. Signed-off-by: Werner Koch (cherry picked from commit 86c241a8c9a952ea8007066b70b04f435e2e483e)

sm: Don't mark a cert as de-vs compliant if it leads to SHA-1 sigs.

2019-02-28T14:13:22Z

* sm/keylist.c (print_compliance_flags): Also check the digest_algo. Add new arg 'cert'. -- A certificate with algorithm sha1WithRSAEncryption can be de-vs compliant (e.g. if the next in the chain used sha256WithRSAEncryption to sign it and RSA is long enough) but flagging it as such is useless because that certificate can't be used because it will create signatures using the non-compliant SHA-1 algorithm. Well, it could be used for encryption. But also evaluating the key-usage flags here would make it harder for the user to understand why certain certificates are listed as de-vs compliant and others are not. Signed-off-by: Werner Koch (cherry picked from commit 2c75af9f65d15653ed1bc191f1098ae316607041) Reworked to also pass the CERT. Note that 2.2 won't get the PK Screening feature. Signed-off-by: Werner Koch

gpgsm: default to 3072-bit keys.

2019-02-28T10:00:31Z

* doc/gpgsm.texi, doc/howto-create-a-server-cert.texi: : update default to 3072 bits. * sm/certreqgen-ui.c (gpgsm_gencertreq_tty): update default to 3072 bits. * sm/certreqgen.c (proc_parameters): update default to 3072 bits. * sm/gpgsm.c (main): print correct default_pubkey_algo. -- 3072-bit RSA is widely considered to be 128-bit-equivalent security. This is a sensible default in 2017. Signed-off-by: Daniel Kahn Gillmor Gbp-Pq: Topic update-defaults Gbp-Pq: Name 0014-gpgsm-default-to-3072-bit-keys.patch (cherry picked from commit 7955262151a5c755814dd23414e6804f79125355)

sm: Fix certificate creation with key on card.

2019-02-25T07:49:59Z

* sm/certreqgen.c (create_request): Fix for certmode. -- When using an existing key from a card for certificate signing (in contrast to the default of generating a CSR), the code tried to use the same key for signing instead of the Signing-Key parameter. It is perfectly okay to use the regular signing path via gpg-agent for certificate creation - only self-signed certificates with a key on the card require the direct use of the card key (via "SCD PKSIGN"). Signed-off-by: Werner Koch (cherry picked from commit c1000c673814e552923cf1361346d7dfeee55608)

sm: In --gen-key with "key from card" show also the algorithm.

2019-02-11T09:59:36Z

* sm/certreqgen-ui.c (gpgsm_gencertreq_tty): Get and show algo. -- This extends the prompt to show something like Serial number of the card: FF020001008A77F6 Available keys: (1) 4130F84FA3704F4645924AEC3FFA48AD26D33656 PIV.9A nistp384 (2) AB2988FB8C227BCD5175BF92F66AA3A95AE83214 PIV.9E rsa2048 (3) DB7DDAEAA88534BA45CCD7A9B761425103EA2090 PIV.9C rsa2048 (4) BABB48C3D80ACCF9839F101DF2910966C8B988DF PIV.9D nistp256 Your selection? 1 Having the algorithm here is helpful in particular because right now we support only RSA with X.509. Take care: PIV card based certificate creation does not yet work. Signed-off-by: Werner Koch (cherry picked from commit 0328976c94adc2c518c7a7763a35319a0000c5e2) Note that 2.2 does not support PIV cards, but the feature also works also with other cards.