1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-10-30 19:58:44 +01:00
Commit Graph

9145 Commits

Author SHA1 Message Date
Werner Koch
15564fa3f6
po: Update some translations for the |R| prompt flag.
--
2024-04-09 13:37:22 +02:00
Werner Koch
1f31dc6200
gpg: Do not allow to accidently set the RENC usage.
* g10/keygen.c (print_key_flags): Print "RENC" if set.
(ask_key_flags_with_mask): Remove RENC from the possible set of
usages.  Add a direct way to set it iff the key is encryption capable.
--

This could be done by using "set your own capabilities" for an RSA
key.  In fact it was always set in this case.

GnuPG-bug-id: 7072
2024-04-04 16:49:50 +02:00
Werner Koch
72c5c70871
gpgconf: Change layout of the gpgconf -X output.
* tools/gpgconf.c (list_dirs): Change the config mode output.
(my_copy_file): Adjust output for org-mode style.
(show_configs_one_file): Ditto.
(show_other_registry_entries): Ditto.
(show_registry_entries_from_file): Ditto.
(show_configs): Ditto.
2024-04-04 15:54:32 +02:00
Werner Koch
8a4069527a
build: Update nPth configure macros.
* m4/npth.m4: Update.
2024-03-18 14:55:46 +01:00
Werner Koch
ce1e671cdc
Update NEWS
--
2024-03-18 14:02:53 +01:00
Werner Koch
5ccfc2101a
gpgconf: Check readability of some files with -X
* tools/gpgconf.c (list_dirs): Rename arg from special to
show_config_mode. Add "S.Uiserver" test and test existsing files for
readability.
2024-03-18 11:15:08 +01:00
Werner Koch
82b39fe254
gpg: Make sure a DECRYPTION_OKAY is never issued for a bad OCB tag.
* g10/mainproc.c (proc_encrypted): Force a decryption failure if any
error has been seen.
* g10/decrypt-data.c (aead_checktag): Issue an ERROR line.
--

GnuPG-bug-id: 7042

Note that gpg in any case returns a failure exit code but due to
double forking GPGME would not see it.
2024-03-14 21:53:19 +01:00
Werner Koch
509d0f76ce
gpg-check-pattern: Consider an empty pattern file as valid
* tools/gpg-check-pattern.c (read_file): Check length before calling
fread.
--

The problem with an empty file is that es_fread is called to read one
element of length zero which seems to be undefined behaviour and
results in ENOENT on my test box.
2024-03-13 15:32:10 +01:00
Werner Koch
5999d95e04
wks: Make gpg-wks-client --mirror work w/o args.
* tools/gpg-wks-client.c (mirror_one_key): Test for no domain
specified.
--

The code did not really work if no domain was given.  It worked but
filtered out all keys so that no key was actually exported.
2024-03-06 11:44:19 +01:00
Werner Koch
8cd920f6aa
gpg: Fix mixed invocation with --trusted-keys and --no-options.
* g10/trustdb.c: Move some definitions around.
(user_utk_list): Rename to trusted_key_list.  Change all users.
(any_trusted_key_seen): New.
(tdb_register_trusted_key): Set it here.  Handle the new value "none".
(verify_own_keys): Do not delete a trusted key from the trustdb if a
trusted-key option was not used.
--

GnuPG-bug-id: 7025
2024-03-04 15:24:40 +01:00
NIIBE Yutaka
f50c543326
agent: Allow simple KEYINFO command when restricted.
* agent/command.c (cmd_keyinfo): Only forbid list command.

--

GnuPG-bug-id: 7003
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2024-03-01 13:59:43 +09:00
NIIBE Yutaka
41c0220725
dirmngr: Fix keep-alive flag handling.
* dirmngr/http.c (run_proxy_connect): Set KEEP_ALIVE if not Basic
Authentication.  Fix resource leak of FP_WRITE.

--

GnuPG-bug-id: 6997
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2024-02-21 15:12:16 +01:00
NIIBE Yutaka
c33c4fdf10
dirmngr: Fix the regression of use of proxy for TLS connection.
* dirmngr/http.c (run_proxy_connect): Don't set keep_alive, since it
causes resource leak of FP_WRITE.
Don't try to read response body to fix the hang.

--

GnuPG-bug-id: 6997
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2024-02-21 15:11:31 +01:00
NIIBE Yutaka
d6c428699d
dirmngr: Fix proxy with TLS.
* dirmngr/http.c (proxy_get_token, run_proxy_connect): Always
available regardless of USE_TLS.
(send_request): Remove USE_TLS.

--

Since quite some time building w/o TLS won't work.

GnuPG-bug-id: 6997
2024-02-21 15:09:07 +01:00
Werner Koch
23d9093d9b
More NEWS.
--
2024-02-05 13:03:16 +01:00
Ángel González
3d46eb6cf7
common: Update requisites
* configure.ac: Require libgpg-error 1.38 and libksba 1.4.0
* common/util.h: Remove error number substitutes.
--

These versions were already needed for a successful compilation,
but it was not reflected by configure.

GnuPG-bug-id: 6974
Signed-off-by: Ángel González <angel@pgp.16bits.net>

util.h patch by wk.
2024-02-05 08:24:09 +01:00
Werner Koch
cbe0956df0
gpgsm: Increase salt size in pkcs#12 parser.
* sm/minip12.c (parse_bag_encrypted_data): Need 32 bytes.
--

GnuPG-bug-id: 6757
2024-02-05 07:59:02 +01:00
Werner Koch
ce69c103f4
scd:openpgp: Allow PIN length of 6 also with a reset code.
* scd/app-openpgp.c (do_change_pin): Fix PIN length check.  Add "R"
flag to the reset code prompt.
--

When using the reset code it was not possible to set a PIN of length
6.  The "R" flags fixes a funny prompt.

Fixes-commit: efe325ffdf
2024-01-30 15:50:09 +01:00
Werner Koch
573098a2f2
Prepare NEWS for 2.2.43
--
2024-01-29 10:48:49 +01:00
NIIBE Yutaka
efe325ffdf
scd:openpgp: Add the length check for new PIN.
* scd/app-openpgp.c (do_change_pin): Make sure new PIN length
is longer than MINLEN.

--

GnuPG-bug-id: 6843
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
(cherry picked from commit 2376cdff13)
2024-01-26 15:14:02 +01:00
Werner Koch
20e85585ed
scd:openpgp: Restructure the pin2hash_id_kdf function.
* scd/app-openpgp.c (wipe_and_free_string, wipe_and_free): Enable
functions.
(pin2hash_if_kdf): Change interface.  The input PIN is not anymore
changed.  Further there are no more assumptions about the length of
the provided buffer.
(verify_a_chv): Adjust for changed pin2hash_if_kdf.
(verify_chv2): Ditto
(verify_chv3): Ditto.
(do_change_pin): Ditto.
(do_sign): Ditto.
--

Note that this a part of the patch
63bda3aad8 which we used in 2.4 to
implement a PIN cache.  For easier backporting we need to add this
here.
2024-01-26 15:11:54 +01:00
NIIBE Yutaka
97b01ad3f8
tools: Fix argparse table of gpgconf.
* tools/gpgconf.c (opts): Use ARGPARSE macros.

--

GnuPG-bug-id: 6902
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
(cherry picked from commit 2be53b214d)
2024-01-26 13:47:22 +01:00
Werner Koch
935b5a49b4
dirmngr: For CRL issuer verification trust the system's root CA.
* dirmngr/crlcache.c (crl_parse_insert): Add
VALIDATE_FLAG_TRUST_SYSTEM.
--

GnuPG-bug-id: 6963
2024-01-26 13:14:14 +01:00
Werner Koch
535c5cf769
common,w32: Fix use of GNUPG_SPAWN_KEEP_STDERR.
* common/exechelp-w32.c (gnupg_spawn_process): Fix macro.
--

Fixes-commit: 7ba44d15ca
GnuPG-bug-id: 6961
2024-01-26 10:27:40 +01:00
Werner Koch
ccd201d7db
doc: Minor typo fix.
--

Was already fixed in 2.4. A 2.2 user reported this to g10 Code.
2024-01-24 15:09:59 +01:00
Werner Koch
3b69d8bf71
gpg: Fix leftover unprotected card backup key.
* agent/command.c (cmd_learn): Add option --reallyforce.
* agent/findkey.c (agent_write_private_key): Implement reallyforce.
Also add arg reallyforce and pass it along the call chain.

* g10/call-agent.c (agent_scd_learn): Pass --reallyforce with a
special force value.
* g10/keygen.c (card_store_key_with_backup): Use that force value.
--

This was a regression in 2.2.42.  We took the easy path to fix it by
getting the behaviour back to what we did prior to 2.2.42.  With GnuPG
2.4.4 we use an entire different and safer approach by introducing an
ephemeral private key store.

GnuPG-bug-id: 6944
2024-01-24 11:45:31 +01:00
Werner Koch
9938e8d3f4
common: Fix unused variable warning on Unix.
--
2024-01-10 17:21:32 +01:00
Werner Koch
89c7eccba5
gpg: Allow to create revocations even with non-compliant algos.
* g10/sign.c (do_sign): Skip compliance check for revocation certs.
--

It just does not make sense to inhibit the creation of revocations
depending on the compliance mode.  We do this only for key revocation
but not for another kind of revocation because the rationale for uid
or subkey revocation is more complicated to explain.
2024-01-10 17:18:58 +01:00
Werner Koch
6400672904
gpgconf: Adjust -X command for the new VERSION file format
* tools/gpgconf.c (show_version_gnupg): Read and parse the entire
VERSION file.
--

GnuPG-bug-id: 6918
2024-01-09 12:52:11 +01:00
Werner Koch
cc9568cd59
common,w32: Remove duplicated backslashes when setting the homedir.
* common/homedir.c (copy_dir_with_fixup) [W32]: Fold double
backslashes.
--

This is in general no problem but when we hash or compare the directory
to test whether tit is the standard home directory, we may use a
different socket file and thus a second instance of a daemon.

GnuPG-bug-id: 6833
2024-01-09 10:09:45 +01:00
Builder account for the GnuPG engine
5ce7f8189e Post release updates 2023-11-28 16:08:42 +01:00
Werner Koch
6f5c72a2b5
Release 2.2.42 2023-11-28 15:27:41 +01:00
Werner Koch
e020b59ff6
po: Update po files
* g10/keyserver.c (keyserver_refresh): Use ngettext to avoid msgmerge
warnings.
2023-11-28 15:26:37 +01:00
Werner Koch
a6eefa9996
gpgsm: Set validity flag in keylisting to n for untrusted root cert.
* sm/keylist.c (list_cert_colon): Map not_trusted to 'n' for non-root
certs like we do for root certs.
--

GnuPG-bug-id: 6841
2023-11-27 12:34:38 +01:00
Werner Koch
1d472e4934
scd:openpgp: Print a diagnostic for the use of default ECDH params.
* scd/app-openpgp.c (ecc_writekey): Remove the useless check and print
a diagnostic if the default params are used.
--

Note that here in 2.2 we use different default ECDH parameters than in
2.4 (AES192 instead of AES256 for 384 bit curves).

GnuPG-bug-id: 6378
2023-11-23 16:06:15 +01:00
Werner Koch
4c700e3afe
Update NEWS
--
2023-11-21 12:37:35 +01:00
Werner Koch
a91f268d6c
agent: Update the key file only if changed (slight return).
* agent/findkey.c (read_key_file): Add optional arg r_orig_key_value
to return the old Key value.  Change all callers.
(agent_write_private_key): Detect whether the Key entry was really
changed.
--

GnuPG-bug-id: 6829
2023-11-21 12:13:50 +01:00
Werner Koch
5bab257d3a
agent: Update the key file only if not changed.
* common/name-value.c (struct name_value_container): Add flag
"modified".
(nvc_modified): New.
(nvc_new): Set flag.
(_nvc_add): Set flag.
(nvc_delete): Set flag.
(nve_set): Add arg PK.  Change the caller.  Check whether to change at
all.
* agent/findkey.c (agent_write_private_key): Update only if modified.
--

This helps software which uses a file system watcher to track changes
to private keys.  In particular smartcard triggered changes are a
problem for such software because this may at worst trigger another
smartcard read.

GnuPG-bug-id: 6829
2023-11-21 09:06:00 +01:00
NIIBE Yutaka
6236a52d0e
po: Update Japanese Translation.
--

Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2023-11-20 10:48:16 +09:00
Werner Koch
59ec691381
po: Update the German translation
--
2023-11-17 10:09:07 +01:00
Werner Koch
a5dbd985c2
w32: Actually add the manifest to the dirmngr.
* dirmngr/Makefile.am (dirmngr_LDADD): Fix type in dirmngr_rc_objs.
--

We had a dependency but due to the typo the resource file was not
linked.
2023-11-15 14:34:08 +01:00
Werner Koch
cdc28c59fe
gpg,gpgsm: Hide password in debug output also for asked passwords.
* g10/call-agent.c (agent_get_passphrase): Call
assuan_begin_confidential and assuan_end_confidential.
* sm/call-agent.c (gpgsm_agent_ask_passphrase): Ditto.
--

GnuPG-bug-id: 6654

The drawback of this solution is that we don't see any IPC lines from
the assuan_transact.  Everything else would require larger changes to
libassuan.
2023-11-14 15:08:20 +01:00
Werner Koch
697d54ceca
gpgsm: Re-introduce the bad passphrase hint for pkcs#12.
* sm/minip12.c (parse_bag_encrypted_data): Set the badpass flag.
(parse_shrouded_key_bag): Ditto.
--
2023-11-14 09:48:04 +01:00
Werner Koch
6d3b52a94b
Update NEWS.
--
2023-11-10 10:06:29 +01:00
NIIBE Yutaka
3654fee3a4
gpg,sm: Set confidential in assuan communication for password.
* g10/call-agent.c (default_inq_cb): Call assuan_begin_confidential
and assuan_end_confidential.
* sm/call-agent.c (default_inq_cb): Likewise.

--

Cherry pick from master commit of:
	ec1446f944

GnuPG-bug-id: 6654
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2023-11-10 08:55:40 +01:00
Werner Koch
77fb089835
gpgsm: Support ECDSA in de-vs mode.
* common/compliance.h (PK_ALGO_FLAG_ECC18): New.
* common/compliance.c (gnupg_pk_is_allowed): Implement.
* sm/decrypt.c (gpgsm_decrypt): Pass new flag.
* sm/sign.c (gpgsm_sign): Ditto.
* sm/verify.c (gpgsm_verify): Ditto.
--

GnuPG-bug-id: 6802
2023-11-08 17:16:31 +01:00
Werner Koch
7340d4ecd7
gpgsm: Cleanup of legacy variable name use.
* sm/encrypt.c (gpgsm_encrypt): Unify use of RC and ERR.
* sm/sign.c (gpgsm_sign): ditto.
--

Initially we didn't used the gpg_error_t thingy and while migrating
we sometimes used RC and ERR for tracking the error.  This is pretty
error prone and thus we better remove it (after 20 years).
2023-11-08 17:11:30 +01:00
Werner Koch
600e69b461
scd:openpgp: Fix a segv for cards supporting unknown curves.
* common/openpgp-oid.c (get_keyalgo_string): Do not strdup NULL.
--

Cherry pick 2.4/master commit of:
	385f484133

GnuPG-bug-id: 5963
2023-11-07 17:47:11 +09:00
Werner Koch
ad2d578cba
w32: Use utf8 for the asctimestamp function.
* common/gettime.c (asctimestamp) [W32]: Use ".UTF8" for the locale.
--

This has been suggested by the reporter of
GnuPG-bug-id: 6741
2023-10-27 14:18:59 +02:00
Werner Koch
92af3f88a9
gpg: Pass ECDH parameters to OpenPGP smartcards
* g10/call-agent.c (agent_keytocard): Add arg ecdh_param_str.
* g10/keyid.c (ecdh_param_str_from_pk): New.
* g10/card-util.c (card_store_subkey): Pass ECDH params to writekey.
* g10/keygen.c (card_store_key_with_backup): Ditto.
--

Backported from 2.4 - here the gpg part.

See-commit: c03ba92576
This is related to
GnuPG-bug-id: 6378
2023-10-27 13:56:02 +02:00