Commit Graph

9440 Commits

Author SHA1 Message Date
NIIBE Yutaka d080720939 experiment: Handle S=0 in EdDSA by SOS("0").
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-12-22 20:11:42 +09:00
NIIBE Yutaka aa4b138f4d experiment: Fix for signature R+S in OpenPGP R part.
This fix also allows having only OpenPGP R part,
and OpenPGP S part == NULL.

--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-12-14 17:59:06 +09:00
NIIBE Yutaka a461eae58d experiment: Rename the names of functions.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-11-25 14:17:31 +09:00
NIIBE Yutaka 16fe6cdf72 experiment:agent: Allow importing v5 secret key.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-29 09:23:40 +09:00
NIIBE Yutaka b1a2e1904e experiment: Fix exporting protecte secret key for new448.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-28 14:23:15 +09:00
NIIBE Yutaka 0683e88d30 experiment: Fix importing new448 secret key.
--

Because secret key may be encrypted one, it can be only fixed up
(removing the prefix) at gpg-agent side.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-27 15:33:06 +09:00
NIIBE Yutaka a07ae85ec7 experiment: Support exporting new 448 key (public/secret).
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-22 15:20:00 +09:00
NIIBE Yutaka 0d74c3c896 experiment: Support importing new 448 secret keys.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-22 15:00:47 +09:00
NIIBE Yutaka cfe3752bd1 experiment: Fix keygrip and signature for 448.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-21 15:58:34 +09:00
NIIBE Yutaka 7965049441 experiment: Fix for 448 pubkey.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-21 15:15:06 +09:00
NIIBE Yutaka 98010a02c4 experiment: Also support new ECDH encryption with 448.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-21 14:58:39 +09:00
NIIBE Yutaka 9948f3c133 experiment: Fix ECC key handling.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-21 14:38:44 +09:00
NIIBE Yutaka 2b08e84849 experiment: Support keygen for new Ed448/X448 keys.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-21 14:07:30 +09:00
NIIBE Yutaka d506ec2685 experiment: Generate new Ed448 signature.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-21 13:28:04 +09:00
NIIBE Yutaka b5b81005fa experiment: Add copyright notice.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-11 13:41:44 +09:00
NIIBE Yutaka e6002e16c9 experiment: Fix keygrip computation for new 448 key on gpg-agent.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-08 22:25:05 +09:00
NIIBE Yutaka f2b54b3309 experiment: Add forgotten open-misc.c.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-08 22:07:14 +09:00
NIIBE Yutaka 7b0a7c7148 gpg: Support MPI(0) by sos_read and mpi_print.
* g10/misc.c (mpi_print): Handle the case for MPI(0).
* g10/parse-packet.c (sos_read): Likewise.

--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-08 17:23:33 +09:00
NIIBE Yutaka c450eb1ccb experiment: Try to support new 448 key and signature.
--

Keygrip computation is still wrong, need to fix soon.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-08 17:22:15 +09:00
Ingo Klöcker e99b9890c2 common: Respect gpgconf.ctl when looking up translations
* common/i18n.c (i18n_init): Use gnupg_localedir() instead of LOCALEDIR.
(i18n_localegettext): Ditto.
* tools/gpgconf-comp.c (my_dgettext): Ditto.
--

On Unix, gnupg_localedir() returns the locale directory relative to
the root directory of the gnupg installation if specified in the
gpgconf.ctl. Otherwise, it returns the built-in LOCALEDIR.

GnuPG-bug-id: 5999
2021-10-06 13:42:50 +02:00
Werner Koch 4b3e9a44b5
dirmngr: New option --ignore-cert
* dirmngr/dirmngr.h (struct fingerprint_list_s): Add field binlen.
(opt): Add field ignored_certs.
* dirmngr/dirmngr.c: Add option --ignore-cert
(parse_rereadable_options): Handle that option.
(parse_ocsp_signer): Rename to ...
(parse_fingerprint_item): this and add two args.
* dirmngr/certcache.c (put_cert): Ignore all to be igored certs.
Change callers to handle the new error return.
--

This option is useful as a workaround in case we ill run into other
chain validation errors like what we fixed in
GnuPG-bug-id: 5639
2021-10-06 10:35:51 +02:00
Werner Koch 6879937885
dirmngr: Fix Let's Encrypt certificate chain validation.
* dirmngr/certcache.c (find_cert_bysubject): Return the first trusted
certififcate if any.
--

This is basically the same as using OpenSSL with ist
X509_V_FLAG_TRUSTED_FIRST flag. See
https://www.openssl.org/blog/blog/2021/09/13/LetsEncryptRootCertExpire/

GnuPG-bug-id: 5639
2021-10-06 10:35:51 +02:00
NIIBE Yutaka 3918fa1a94 agent,dirmngr,kbx,scd,tpm2d: Use gnupg_sleep.
* agent/findkey.c (unprotect): Use gnupg_sleep.
* agent/gpg-agent.c (handle_connections): Likewise.
* dirmngr/crlfetch.c (handle_connections): Likewise.
* kbx/keyboxd.c (handle_connections): Likewise.
* tpm2d/tpm3daemon.c (handle_connections): Likewise.
* scd/scdaemon.c (handle_connections): Likewise.
* scd/command.c (cmd_lock): Likewise.
* dirmngr/ldap-wrapper.c (ldap_reaper_thread): Likewise.
(ldap_wrapper_wait_connections): Use gnupg_usleep.

--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-05 14:05:56 +09:00
NIIBE Yutaka eeb25df6f8 agent: Fix calibrate_get_time use of clock_gettime.
* agent/protect.c (USE_CLOCK_GETTIME): New macro.
(calibrate_get_time): Only use clock_gettime if USE_CLOCK_GETTIME.

--

GnuPG-bug-id: 5623
Fixes-commit: 380bce13d9
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-10-05 11:53:29 +09:00
Werner Koch 84fcd8e6eb
tests: Use the new gpgconf.ctl based method.
* tests/openpgp/defs.scm:  We expect that stuff is now installed.
(tools): Fix the names.
(intsalled?, bin-prefix): Remove.
(tool-hardcoded): Simplify.
(gpg-conf'): Simplify.
(GNUPG_BUILDDIR): Do not anymore set this envvar.
* tests/tpm2dtests/defs.scm: Ditto.
--

This simplifies things a bit.
2021-10-01 15:05:01 +02:00
Werner Koch 399ebf6d87
build: Prepare for using installed versions for tests.
* tests/gpgconf.ctl.in: New.
* tests/Makefile.am (EXTRA_DIST): Add new file.
(TESTINST_DIRS): New.
(clean-local): New.
(clean-local-testinst): New.
(check-recursive): New hook.
(bin/gpgconf.ctl): Run a test install.
* tests/cms/Makefile.am (TESTS_ENVIRONMENT): Set new envvar
GNUPG_BUILD_ROOT.
* tests/gpgme/Makefile.am (TESTS_ENVIRONMENT): Ditto.
* tests/openpgp/Makefile.am (TESTS_ENVIRONMENT): Ditto.
* tests/pkits/Makefile.am (TESTS_ENVIRONMENT): Ditto.
* tests/tpm2dtests/Makefile.am (TESTS_ENVIRONMENT): Ditto.
--

Right now this helps only with the global configuraion dir which is
now not set and thus the build host'ss own /etc/gnupg does not anymore
affect the build.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-10-01 14:46:16 +02:00
Werner Koch dbe1b237a6
common: Support gpgconf.ctl also for BSDs.
* common/homedir.c (MYPROC_SELF_EXE): New.
(unix_rootdir): Use it here.  Also support GNUPG_BUILD_ROOT as
fallback.
--

In addition this adds a fallback method for AIX etc which do not have
an easy way to get the info.
2021-10-01 14:44:06 +02:00
Werner Koch ec847cf17f
common: Add keyword sysconfdir to the optional gpgconf.ctl file.
* common/homedir.c (unix_rootdir): Add arg want_sysconfdir.
(gnupg_sysconfdir): Return it.
--

Our regression test suite has the problem that we can't disable the
use of the global config files or test them using the regualr
binaries.  This new keyword will allow us to overcome the problem.
2021-10-01 09:18:17 +02:00
NIIBE Yutaka ca54d3f148 kbx: Let it include keybox.h to avoid multiple typedefs.
* kbx/backend.h: Include keybox.h.

--

GnuPG-bug-id: 5630
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-09-30 10:14:37 +09:00
NIIBE Yutaka dd2e092339 gpg: Handle backsig for v5 signature.
* g10/getkey.c (merge_selfsigs_subkey): Check v5 signature correctly.

--

GnuPG-bug-id: 5628
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-09-29 11:30:00 +09:00
NIIBE Yutaka 86cb04a23d gpg: Ed448 and X448 are only for v5 (for subkey).
* g10/keygen.c (generate_subkeypair): Specify
KEYGEN_FLAG_CREATE_V5_KEY for Ed448 or X448 key.

--

Reported-by: William Holmes
Fixes-commit: 36355394d8
GnuPG-bug-id: 5609
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-09-29 09:56:58 +09:00
NIIBE Yutaka 08a3a4db27 kbx: A 20 byte fingerprint is right filled in version 2 blob.
* kbx/keybox-blob.c (create_blob_header): Fix creating FPR20 key
in blob with 32-byte fingerprint.

--

GnuPG-bug-id: 5609
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-09-28 17:12:26 +09:00
NIIBE Yutaka cc6152b802 gpg: Skip the packet when not used for AEAD.
* g10/free-packet.c (free_packet): Add the case for case
PKT_ENCRYPTED_AEAD.

--

GnuPG-bug-id: 5464
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-09-28 14:49:21 +09:00
Ingo Klöcker e2069d5632 build: Fix several "include file not found" problems
* dirmngr/Makefile.am (t_ldap_parse_uri_CFLAGS): Add KSBA_CFLAGS.
* kbx/Makefile.am (libkeybox_a_CFLAGS, libkeybox509_a_CFLAGS): Add
NPTH_CFLAGS.
* tools/Makefile.am (gpgtar_CFLAGS, gpg_wks_server_CFLAGS,
gpg_wks_client_CFLAGS, gpg_pair_tool_CFLAGS): Add LIBGCRYPT_CFLAGS.
--

The tools include gcrypt.h via common/util.h.

GnuPG-bug-id: 5592
2021-09-20 12:39:29 +02:00
giomba 548ff03983
po: Fixed Italian translation for key expiration
* po/it.po: Fix italian translation.

--
In English, "too" has two different meanings (eg. "too much" vs "change
it too").
Italian translation used wrong meaning, and the sentence made no sense.

Signed-off-by: Andre Heinecke <aheinecke@gnupg.org>
2021-09-20 08:29:53 +02:00
Werner Koch d4768bb982
common: Support a gpgconf.ctl file under Unix.
* common/homedir.c (unix_rootdir): New.
(gnupg_bindir): Use it.
(gnupg_libexecdir): Use it.
(gnupg_libdir): Use it.
(gnupg_datadir): Use it.
(gnupg_localedir): Use it.
--

This feature is useful for building and using an AppImage version of
gnupg and probably also for some other use cases.

GnuPG-bug-id: 5999

Here is a sample gpgconf.ctl file
--8<---------------cut here---------------start------------->8---
# gpgconf.ctl
#
# This file is used to change the directories where the gpg components
# are installed.  It does not change the configuration directories.
# The file is expected in the same directory as gpgconf.  The physical
# installation directories are evaluated and no symlinks.  Blank lines
# and lines starting with pound signed are ignored.  No errors are
# printed for unknown keywords or commands.  The only defined key for
# now is "rootdir" which must be followed by one optional space, an
# equal sign, and the value for the root directory.  Environment
# variables are substituted in standard shell manner, the final value
# must start with a slash, trailing slashed are stripped.

rootdir = $APPDIR/gnupg
--8<---------------cut here---------------end--------------->8---
2021-09-17 17:39:07 +02:00
Werner Koch 9c272dc245
common: New function substitute_envvars.
* common/stringhelp.c (substitute_envvars): New.  Based on code in
gpg-connect-agent.
* common/t-stringhelp.c: Include sysutils.h.
(test_substitute_envvars): New.
--

GnuPG-bug-id: 5599
2021-09-17 17:33:21 +02:00
Werner Koch 7f8ccb67e3
doc: Clarify some gpg keyring options
--
GnuPG-bug-id: 5594
2021-09-14 15:15:05 +02:00
Werner Koch dbfb7f809b
gpg: Print a warning when importing a bad cv25519 secret key.
* g10/import.c (transfer_secret_keys): Add simple check.
--

Note that the requirement for a set high bit is not yet checked.
GnuPG-bug-id: 5464
2021-09-14 13:00:40 +02:00
Werner Koch 18e94c7229
Update release signing keys.
--

These are now

# ------------------------ >8 ------------------------
pub   rsa3072 2017-03-17 [SC] [expires: 2027-03-15]
      5B80C5754298F0CB55D8ED6ABCEF7E294B092E28
sig    R     BCEF7E294B092E28 2017-03-17  Andre Heinecke (Release Signing Key)
uid                      Andre Heinecke (Release Signing Key)
sig 3        BCEF7E294B092E28 2017-03-17  Andre Heinecke (Release Signing Key)
sig          1FDF723CF462B6B1 2017-03-17  Andre Heinecke <aheinecke@intevation.de>

pub   ed25519 2020-08-24 [SC] [expires: 2030-06-30]
      6DAA6E64A76D2840571B4902528897B826403ADA
uid                      Werner Koch (dist signing 2020)
sig 3        528897B826403ADA 2020-08-24  Werner Koch (dist signing 2020)
sig          249B39D24F25E3B6 2020-08-24  Werner Koch (dist sig)
sig          63113AE866587D0A 2020-08-24  wk@gnupg.org
sig          E3FDFF218E45B72B 2020-08-24  Werner Koch (wheatstone commit signing)
sig          F2AD85AC1E42B367 2020-08-24  Werner Koch <wk@gnupg.org>

pub   ed25519 2021-05-19 [SC] [expires: 2027-04-04]
      AC8E115BF73E2D8D47FA9908E98E9B2D19C6C8BD
uid                      Niibe Yutaka (GnuPG Release Key)
sig 3        E98E9B2D19C6C8BD 2021-05-19  Niibe Yutaka (GnuPG Release Key)
sig          00B45EBD4CA7BABE 2021-09-14  NIIBE Yutaka <gniibe@fsij.org>
sig          E267B052364F028D 2021-09-14  NIIBE Yutaka <gniibe@fsij.org>
2021-09-14 10:15:20 +02:00
Werner Koch f2b01025c3
common: New envvar GNUPG_EXEC_DEBUG_FLAGS.
* common/exechelp-w32.c (gnupg_spawn_process_detached): Silence
breakaway messages and turn them again into debug messages.
2021-09-13 17:13:38 +02:00
Werner Koch 265d993c76
doc: Minor update of the AD schema.
--
2021-09-09 13:30:22 +02:00
Werner Koch 255d4d5815
sm: Add LotW support to the key listing
* sm/certdump.c (parse_dn_part): Translate OID to "Callsign"
* sm/keylist.c (oidtranstbl): Some more OIDs.
--

This is Ham thingy to make it easier to read LotW certificates.

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-09-09 13:30:22 +02:00
Ingo Klöcker 08f227052f build: Fix "ksba.h not found" problem
* sm/Makefile.am (t_minip12_CFLAGS): Add KSBA_CFLAGS.
--

GnuPG-bug-id: 5592
2021-09-08 15:18:38 +02:00
Werner Koch af3b190154
agent: Fix segv in GET_PASSPHRASE (regression)
* agent/command.c (cmd_get_passphrase): Do not deref PI.  PI is always
NULL.
--

Fixes-commit: b89b1f35c2
GnuPG-bug-id: 5577
2021-09-07 08:57:44 +02:00
Werner Koch fdb726f77d
gpg: Print a note about the obsolete option --secret-keyring.
--

GnuPG-bug-id: 2749
2021-08-28 18:34:26 +02:00
Werner Koch ad3dabc9fb
gpg: Change default and max AEAD chunk size to 4 MiB
--

This is per OpenPGP WG design team decision from 2021-08-13
(raising a new wall after exactly 60 years ;-)

Signed-off-by: Werner Koch <wk@gnupg.org>
2021-08-27 12:06:57 +02:00
NIIBE Yutaka 0b64c27446 kbx: Fix checksum computation for no UBID entry on disk.
* kbx/keybox-blob.c (create_blob_header): Fix the flag to match no
UBID entry,
(create_blob_finish): Fix the length of data to be hashed.

--

GnuPG-bug-id: 5573
Fixes-commit: 915297705a
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-08-27 17:04:53 +09:00
NIIBE Yutaka f271c69164 common: Fix put_membuf.
* common/membuf.c (put_membuf): Allow NULL for the second arg.

--

There has been such a use case in keybox-blob.c.

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-08-27 16:55:25 +09:00
NIIBE Yutaka c4ba712736 common: Fix get_signal_name for GNU/Linux.
* common/signal.c (get_signal_name): Use sigdescr_np if available.
* configure.ac: Check the function.

--

GnuPG-bug-id: 5568
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2021-08-26 14:22:19 +09:00