aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* common: Allow the use of the newer ksba_parser_t functions.HEADmasterWerner Koch2 days2-1/+247
| | | | | | * common/tlv.h: Prepare for use obn ksba 1.9.0 functions. * common/tlv-parser.c [KSBA_VERSION_NUMBER]: Add wrappers for using the ksba versions of the code.
* scd: Add askpin_inquiry for app-openpgp, not enabled for now.NIIBE Yutaka2 days3-82/+196
| | | | | | | | | | | | | | | * scd/app-openpgp.c (struct verify_info): New. (pincheck_cb): New. (USE_ASKPIN_INQUIR): Please enable this macro when ready. (verify_a_chv): Use pincheck_cb. [USE_ASKPIN_INQUIR] (verify_a_chv): Use askpin_inquiry. * scd/command.c (askpin_inquiry): New. * scd/scdaemon.h (askpin_inquiry): New. -- GnuPG-bug-id: 8353 Signed-off-by: NIIBE Yutaka <[email protected]>
* gpg: Fix colon listing for ietf25 and ietf27 curves.Werner Koch4 days1-0/+8
| | | | | | | | * g10/keylist.c (list_keyblock_colon): Print the fixed curve name for PUBKEY_ALGO_X25519 and ...ED25519 -- GnuPG-bug-id: 8521
* scd: Factor out pinpad_prompt, clean-up for app-openpgp.NIIBE Yutaka10 days6-150/+151
| | | | | | | | | | | | | | | | | | | | * scd/app-dinsig.c (verify_pin): Use pinpad_prompt for pinpad. * scd/app-nks.c (verify_pin): Likewise. * scd/app-openpgp.c (verify_a_chv): Factor in the SYNC_CHV handling originally in verify_chv2 and do_sign. Use pinpad_prompt for pinpad. (verify_chv2): Factor out the SYNC_CHV handling into verify_a_chv. (verify_chv3, do_change_pin): Use pinpad_prompt for pinpad. (do_sign): Factor out the SYNC_CHV handling. * scd/app-sc-hsm.c (verify_pin): Use pinpad_prompt for pinpad. * scd/command.c (pinpad_prompt): New. (askpin): Factor out to pinpad_prompt. (askpin): Factor out pinpad handling into pinpad_prompt. * scd/scdaemon.h (pinpad_prompt): New. -- GnuPG-bug-id: 8353 Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Implement ASKPIN/NEXTPIN/FINISHPIN inquiry in the agent side.NIIBE Yutaka11 days3-208/+507
| | | | | | | | | | | | | | | | | | * agent/agent.h: Include <npth.h>. (struct server_control_s): Add fields for new inquiries from scdaemon. (scd_getpin): Remove, it's now internal function in call-scd.c. * agent/divert-scd.c (scd_getpin): Move to .. * agent/call-scd.c (scd_getpin): .. here. (struct scd_local_s): Remove. (scd_check_cb, select_prompt, askpin_thread, start_askpin_thread) (finish_askpin_thread, scd_pin_request_start, scd_pin_request_next) (scd_pin_request_finish): New. (inq_needpin): Handle new inquiries ASKPIN, NEXTPIN, and FINISHPIN. -- GnuPG-bug-id: 8353 Signed-off-by: NIIBE Yutaka <[email protected]>
* Silence the compiler and add OIDs to gpgsm.Werner Koch12 days2-1/+15
| | | | | * sm/keylist.c (oidtranstbl): Add some algos. * tools/gpgconf.c: Silence compiler warning.
* gpg: Fill the curve field also for the RFC9980 algos.Werner Koch12 days1-6/+20
| | | | | * g10/keylist.c (list_keyblock_colon): Print curve name for the new composite algos.
* gpg:tdbio: Release the lock on error path.NIIBE Yutaka13 days1-8/+17
| | | | | | | | | * g10/tdbio.c (put_record_into_cache): Call release_write_lock. (tdbio_sync): Likewise. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* tests: Add a sample keypair from RFC9882.Werner Koch13 days3-0/+195
| | | | --
* gpgsm: Support creation of verification of ML-DSA signatures.Werner Koch13 days6-8/+65
| | | | | | | | | | | | | | | | | | | * common/sexputil.c (get_pk_algo_from_key): Enlarge buffer for algo name so that "dilithium3" can be detected. * agent/pksign.c (do_encode_mldsa): New. (agent_pksign_do): Call it. * sm/certcheck.c (pk_algo_from_sexp): Detected ML-DSA. (gpgsm_check_cms_signature): Support ML-DSA. Also rework error cleanup. * sm/sign.c (gpgsm_sign): Support ML-DSA. * sm/verify.c (gpgsm_verify): Fix a comment. -- Libgcrypt 1.12.5 and libksba 1.9.0 are required to work properly. GnuPG-bug-id: 8517
* gpgsm: Basic support for ML-DSA certificatesWerner Koch13 days4-3/+37
| | | | | | | | | | | * common/sexputil.c (pubkey_algo_string): Support GCRY_PK_MLDSA. * sm/certcheck.c (gpgsm_check_cert_sig): Ditto. * sm/keylist.c (oidtranstbl): Add 2 OIDs for ML-DSA. -- Libgcrypt 1.12.5 is required to work properly. GnuPG-bug-id: 8517
* gpgsm: Change signing fallback hash from SHA1 to SHA256.Werner Koch13 days1-3/+3
| | | | * sm/sign.c (gpgsm_sign): Change fallback algorithm
* gpgconf: Make gpg option --throw-keyids available.Werner Koch13 days1-0/+1
| | | | * tools/gpgconf-comp.c (known_options_gpg): Add it.
* Simplify the call-chain to scd_getpin.NIIBE Yutaka2026-10-093-87/+18
| | | | | | | | | | | | | | | | | | | | | * agent/agent.h (scd_getpin): Remove DESC_TEXT argument. (agent_card_pksign, agent_card_pkdecrypt): Remove unused DESC_TEXT argument. * agent/call-scd.c (struct inq_needpin_parm_s): Remove getpin_cb_desc field. (inq_needpin): Follow the change of scd_getpin. (agent_card_pksign): Remove unused DESC_TEXT argument. (agent_card_pkdecrypt, agent_card_writekey, agent_card_scd): Likewise. * agent/divert-scd.c (has_percent0A_suffix): Remove. (scd_getpin): Remove DESC_TEXT argument. (divert_pksign): Follow the change of agent_card_pksign. (divert_pkdecrypt, agent_card_ecc_kem): Follow the change of agent_card_pkdecrypt. -- GnuPG-bug-id: 8353 Signed-off-by: NIIBE Yutaka <[email protected]>
* agent: Expose scd_getpin and remove getpin_cb callback.NIIBE Yutaka2026-10-093-54/+26
| | | | | | | | | | | | | | | | | | | | | | * agent/agent.h (scd_getpin): New. (agent_card_pksign, agent_card_pkdecrypt, agent_card_writekey) (agent_card_scd): Remove getpin_cb and getpin_cb_arg arguments. * agent/call-scd.c (struct inq_needpin_parm_s): Remove getpin_cb and getpin_cb_arg fields. Add ctrl. (inq_needpin): Call scd_getpin, instead of the callback. (agent_card_pksign): Remove the callback arguments. (agent_card_pkdecrypt, agent_card_writekey, agent_card_scd): Likewise. * agent/divert-scd.c (scd_getpin): New, replacing getpin_cb. (divert_pksign): Follow the change of agent_card_pksign. (divert_pkdecrypt): Follow the change of agent_card_pkdecrypt. (agent_card_ecc_kem): Likewise. (divert_writekey): Follow the change of agent_card_writekey. (divert_generic_cmd): Follow the change of agent_card_scd. -- GnuPG-bug-id: 8353 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd: Simplify not to use internal PIN_CB callback.NIIBE Yutaka2026-10-0910-377/+166
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * scd/app-common.h (setattr, sign, auth, decipher, writecert, genkey) (change_pin, check_pin): Remove PIN_CB argument. (app_setattr, app_sign, app_auth, app_decipher, app_writecert) (app_writekey, app_genkey, app_change_pin, app_check_pin): Likewise. * scd/app-dinsig.c (verify_pin, do_sign, do_change_pin): Remove PIN_CB argument, and use askpin instead. * scd/app-nks.c (verify_pin, do_writecert, do_writekey, do_sign) (do_decipher, do_change_pin, do_check_pin): Likewise. * scd/app-openpgp.c (du_auth, change_keyattr_from_string, verify_a_chv) (verify_chv2, verify_chv3, do_setattr, do_writecert, do_change_pin) (change_keyattr, change_rsa_keyattr, rsa_writekey, ecc_writekey) (do_writekey, do_genkey, do_sign, do_decipher, do_check_pin): Likewise. * scd/app-p15.c (verify_pin, do_sign, do_auth, do_decipher) (do_check_pin): Likewise. * scd/app-piv.c (do_setattr, ask_and_prepare_chv, verify_chv) (do_change_chv, do_check_chv, do_sign, do_auth, do_decipher) (do_writekey, do_genkey, do_writecert): Likewise. * scd/app-sc-hsm.c (verify_pin, do_sign, du_auth, do_decipher): Likewise. * scd/app.c (app_setattr, app_sign, app_auth, app_decipher) (app_writecert, app_writekey, app_genkey, app_change_pin) (app_check_pin): Likewise. * scd/command.c (askpin): New. (cmd_pksign, cmd_pkauth, cmd_pkdecrypt, cmd_setattr, cmd_writecert) (cmd_writekey, cmd_genkey, cmd_passwd, cmd_checkpin): Likewise. * scd/scdaemon.h (askpin): New. -- GnuPG-bug-id: 8353 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:piv: Check PIN Policy to decide about the verification.NIIBE Yutaka2026-10-091-9/+91
| | | | | | | | | | | | * scd/app-piv.c (YKPIV_METADATA_POLICY_TAG): New. (get_cached_data): Support special tag 0xF7xx. (check_pin_policy): New. (do_sign): Use check_pin_policy. -- GnuPG-bug-id: 8442 Signed-off-by: NIIBE Yutaka <[email protected]>
* po: Update Japanese Translation.NIIBE Yutaka2026-10-061-8/+6
| | | | | | -- Signed-off-by: NIIBE Yutaka <[email protected]>
* Cleanup some minor compiler warningsWerner Koch2026-10-053-4/+5
| | | | | | | * dirmngr/server.c (proc_pkd_get): Init try_without_subdomain earlier to avoid a false error in the error code path. * dirmngr/dns.c (dns_so_check) [!__linux]: Do not define a label. * common/homedir.c (w32_myproc_self): Remove unused variable.
* gpgconf: Avoid warnings on macOS with --show-configs.Werner Koch2026-10-051-1/+6
| | | | | * tools/gpgconf.c (list_dirs): Try to open socket files only on Windows.
* tpm2d:intel: Fix use of Esys_TRSess_SetAttributes.NIIBE Yutaka2026-10-051-0/+4
| | | | | | | | | | | * tpm2d/intel-tss.h (intel_sess_helper): Skip when it's ESYS_TR_NONE or ESYS_TR_PASSWORD. -- GnuPG-bug-id: 8470 Reported-by: Aleksei Sviridkin <[email protected]> Signed-off-by: NIIBE Yutaka <[email protected]>
* tpm2d: Add GETINFO command to support concurrent requests.NIIBE Yutaka2026-10-053-14/+65
| | | | | | | | | | | | | | | * tpm2d/command.c (hlp_getinfo, cmd_getinfo): New. (register_commands): Add an entry for GETINFO. * tpm2d/tpm2daemon.c (tpm2d_kick_the_loop): Make it static. (tpm2d_get_socket_name): Move the exposed function at the end. * tpm2d/tpm2daemon.h (tpm2d_kick_the_loop): Remove. (tpm2d_get_socket_name, get_active_connection_count): Expose. -- GnuPG-bug-id: 8470 Suggested-by: Aleksei Sviridkin <[email protected]> Signed-off-by: NIIBE Yutaka <[email protected]>
* doc: Typo fixesWerner Koch2026-10-013-2/+5
| | | | --
* gpg,sm: Do not use the partial fileguard for /dev/null.Werner Koch2026-10-012-5/+14
| | | | | | | | | | | | | | | * g10/plaintext.c (get_output_file): Take care of /dev/null et al. * sm/gpgsm.c (main): Ditto. Also fix regression if no-partial-file-guard is used -- We consider all files below /dev/ as special and don't use the part thing. The regresion was that with no-partial-file-guard the output would be send to stdout. GnuPG-bug-id: 7873
* agent,dirmngr,g13,kbx,scd,gpgsm,tools: Fix help/usage strings.NIIBE Yutaka2026-09-298-21/+21
| | | | | | | | | | | | | | | | | * agent/command.c (hlp_get_passphrase, hlp_scd, hlp_putval): Fix. * dirmngr/server.c (hlp_checkcrl, hlp_ad_query, hlp_getinfo): Fix. * g13/server.c (hlp_create): Likewise. * kbx/kbxserver.c (hlp_delete, hlp_getinfo): Likewise. * scd/command.c (hlp_learn, hlp_getattr, hlp_setattr): Likewise. (hlp_writekey, hlp_getinfo, hlp_restart, hlp_apdu): Likewise. (hlp_keyinfo): Likewise. * sm/server.c (hlp_encrypt, hlp_export): Likewise. * tools/gpg-auth.c (my_strusage): Likewise. * tools/gpg-card.c (cmd_yubikey): Likewise. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* doc: Fix typo in last NEWS entryWerner Koch2026-09-281-1/+1
| | | | --
* tests: Add a test for T8469Werner Koch2026-09-283-2/+89
| | | | | | | | | * tests/openpgp/samplemsgs/basic-encrypted.eml: New, * tests/openpgp/issue8469.scm: New test. * tests/openpgp/Makefile.am (XTESTS): Add test. -- GnuPG-bug-id: 8469
* gpg: Use the canoncial name in imported unprotected private keys.Werner Koch2026-09-281-3/+25
| | | | | | | | | * g10/import.c (oid_to_canon_curve): New. (build_mode1003_sexp): Use it here. -- We should use the human readable curve names instead of the dotted decimal form if possible.
* gpg: Fix import of unprotected ECDH keysWerner Koch2026-09-281-2/+2
| | | | | | | | | | | * g10/import.c (build_mode1003_sexp): Skip the correct parameter. -- This bug was introduced when I used the new import code also for classic unprotected keys. GnuPG-bug-id: 8469 Fixes-commit: 2e6549f5de5307e3e84c1ffa5e762d14266546ba
* scd: Fix pinpad handling for macOS.NIIBE Yutaka2026-09-251-0/+6
| | | | | | | | | * scd/apdu.c [__APPLE__] (pcsc_init): Try SCardControl132 firstly. -- Co-authored-by: Mario Hoberg Signed-off-by: NIIBE Yutaka <[email protected]>
* Post release updatesWerner Koch2026-09-232-1/+11
| | | | --
* Release 2.5.24gnupg-2.5.24Werner Koch2026-09-231-2/+11
|
* po: msgmergeWerner Koch2026-09-2327-191/+452
| | | | --
* po: Translate two new strings to German.Werner Koch2026-09-231-9/+18
| | | | --
* scd: Fix a regression due to the new Nitrokey supportWerner Koch2026-09-231-32/+36
| | | | | | | | * scd/app.c (app_new_register): Do not bail out with an error when the nitrokey detection failed but continue to check for Zeitcontrol. -- Fixes-commit: bb7113d03dfc971cacdaae1c0e8fffc2ea21e5df
* Post release updatesWerner Koch2026-09-223-4/+8
| | | | --
* Release 2.5.23gnupg-2.5.23Werner Koch2026-09-222-7/+14
|
* common: Fix composite DO parsing.NIIBE Yutaka2026-09-221-1/+6
| | | | | | | | | | | * common/tlv.c (do_find_tlv): Don't forget the maximum length to N when call it recursively. -- GnuPG-bug-id: 8465 Reported-by: eris Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Add another validation in get_dns_cert_standard.NIIBE Yutaka2026-09-221-1/+1
| | | | | | | | | | | | | * dirmngr/dns-stuff.c (get_dns_cert_standard): Add a validation just like get_dns_cert_libdns does. -- See RFC 4398 for packet format. GnuPG-bug-id: 8464 Reported-by: eris Signed-off-by: NIIBE Yutaka <[email protected]>
* dirmngr: Add a mitigation for badly configured web key directoriesWerner Koch2026-09-211-4/+31
| | | | | | | | | | | * dirmngr/server.c (proc_wkd_get): Retry if the subdomain mode failed with WRONG_NAME. -- At some sites an openpgpkey.domain.org exists but redirects to domain.org in non-subdomain mode. If the certificate is missing for openpgpkey.domain.org and we get a "wrong name" error. In this very case we fallback to non-subdomain mode.
* Update NEWS fileWerner Koch2026-09-211-0/+35
| | | | --
* gpg: Minor code fix for correctness.Werner Koch2026-09-181-1/+4
| | | | | * g10/sign.c (mk_notation_policy_etc): Fix wrong code. However it ND was not used after that.
* gpg: Avoid wrong compiler warningWerner Koch2026-09-171-0/+3
| | | | * g10/pkglue.c (do_encrypt_kem): Init variable.
* gpgconf: Print more info from VERSION if found.Werner Koch2026-09-171-20/+49
| | | | * tools/gpgconf.c (show_version_gnupg): Print more info.
* scd:piv: Update comment.NIIBE Yutaka2026-09-161-4/+8
| | | | | | | -- GnuPG-bug-id: 8442 Signed-off-by: NIIBE Yutaka <[email protected]>
* scd:p15: Fix use of log_info.NIIBE Yutaka2026-09-151-1/+1
| | | | | | | | * scd/app-p15.c (micardo_mse): Fix arguments to call log_info. -- Signed-off-by: NIIBE Yutaka <[email protected]>
* gpgsm: Fix typo for debug output.NIIBE Yutaka2026-09-151-1/+1
| | | | | | | | | * sm/certcheck.c (gpgsm_check_cert_sig): Use log_printhex. -- Fixes-commit: b1694987bb6484405d41d34046a5290176feadd0 Signed-off-by: NIIBE Yutaka <[email protected]>
* Allow gettime.c to be build with -Wformat-nonliteral.Werner Koch2026-09-142-13/+42
| | | | | | | | | | | | | * configure.ac (mycflags): Add -Wformat-nonliteral. * common/gettime.c (asctimestamp): Factor code out to ... (format_time_nl_langinfo): new. Disable the format-nonliteral warning. Add a static initialization. -- Back in 2003 there was no way to disable the nonliteral warning and thus I disabled it entirely because some Linux distros used -Werror. See-also: 8ab35a7d26707dfa0032b3b0dbde6a984a9683cb
* Merge branch 'wk/rfc9980'Werner Koch2026-09-1186-767/+4981
|\ | | | | | | | | | | | | | | | | | | -- After 25 years the NSA could even convince GnuPG that their idea of using complex algorithm is better for someones(tm) security. But fortunately there is no need to enable it. Thus all guards of pretty good and gnu privacy won't enable --compliance=fips|de-vs or use the option --allow-9980.
| * gpg: Implictly set allow-9980 in de-vs compliance mode.wk/rfc9980Werner Koch2026-09-112-5/+7
| | | | | | | | * g10/gpg.c (set_compliance_option): Enable 9980 in de-vs mode.
generated by cgit (git 2.51.2) at 2026-10-25 15:44:05 +0100