1
0
mirror of git://git.gnupg.org/gnupg.git synced 2024-10-30 19:58:44 +01:00
Commit Graph

9174 Commits

Author SHA1 Message Date
Werner Koch
67088b1ce2
gpgconf: Add missing linefeed to the -X output.
* tools/gpgconf.c (show_registry_entries_from_file): Add missing LF.
2024-09-03 11:15:47 +02:00
Werner Koch
5276a1373c
gpg: New option --proc-all-sigs
* g10/options.h (flags): Add proc_all_sigs.
* g10/mainproc.c (check_sig_and_print): Do not stop signature checking
if this new option is used.
* g10/gpg.c (oProcAllSigs): New.
(opts): Add "proc-all-sigs".
(main): Set it.
--

GnuPG-bug-id: 7261
Backported-from-master: 1eb382fb1f
(cherry picked from commit cb739bb2a5)
2024-08-23 11:50:58 +02:00
Werner Koch
a891e55f15
w32: Add two more registry entries for use with -X
* tools/gpgconf.c (show_other_registry_entries): Add entries.
2024-08-21 11:26:34 +02:00
Werner Koch
080fca9f94
Post release updates
--
2024-08-16 13:45:28 +02:00
Werner Koch
148a25f3de
Release 2.2.44 2024-08-12 17:12:01 +02:00
Werner Koch
377d28e1db
speedo,w32: Add extra flags for gpgrt and fix SO name of libassuan.
--

Due to the recently introduced use of STARTUPINFOEXW in gpgrt we now
need at least Windows Vista.  Version 8 of Mingw defaults to XP SP2
which requires us to explicit override that default.

The SO number of libassuan needs an update too.

(cherry picked from commit d56b63a661)
2024-08-12 17:11:58 +02:00
Werner Koch
cf21e473a5
gpgconf: Print the full commit id.
* autogen.sh: Update to version 2024-07-04 from libgpg-error.
* configure.ac (BUILD_REVISION): Rename the ac_define by
BUILD_COMMITID.
* tools/gpgconf.c (show_version_gnupg): Use it here.
--

(cherry picked from commit 736579331b)
2024-08-12 16:46:16 +02:00
Werner Koch
ce73691bd3
po: msgmerge
--
2024-08-12 16:46:15 +02:00
Werner Koch
99e1eae051
po: Add German translation for a new string.
--
2024-08-12 16:46:12 +02:00
Werner Koch
861dc01994
gpg: Improve decryption diagnostic for an ADSK key.
* g10/keydb.h (GET_PUBKEYBLOCK_FLAG_ADSK): New constant.
* g10/packet.h (PUBKEY_USAGE_XENC_MASK): New constant.
* g10/pubkey-enc.c (get_it): Print a note if an ADSK key was used.
Use the new get_pubkeyblock flag.
* g10/getkey.c (struct getkey_ctx_s): Add field allow_adsk.
(get_pubkeyblock): Factor all code out to ...
(get_pubkeyblock_ext): new.
(finish_lookup): Add new arg allow_adsk and make use of it.
--

This patch solves two purposes:
- We write a note that the ADSK key was used for decryption
- We avoid running into a
  "oops: public key not found for preference check\n"
  due to ADSK keys.  The error is mostly harmless but lets gpg return
  with an exit code of 2.

Backported-from-master: 882ab7fef9
2024-08-12 15:31:25 +02:00
Andre Heinecke
6f78219d0f
speedo,w32: Update libassuan dll name in wxs
* build-aux/speedo/w32/wixlib.wxs: Update name and UID for
libassuan
2024-08-12 15:07:04 +02:00
Werner Koch
80f25fab90
agent: Fix an unitialized variable in an error path.
* agent/findkey.c (agent_write_private_key): Init FP.
--

With
Fixes-commit: 3b69d8bf71
we took a shortcut but forgot to init FP which is usually set after
the new check.  At least in the AppImage this always triggered a segv
and gpg or Kleopatra had to restart the agent.  Not a problem in 2.4
becuase this code is a hack we don't need in 2.4 due to that new
ephemeral key storing feature.

GnuPG-bug-id: 6944
2024-08-08 17:13:47 +02:00
Werner Koch
62bd291dcc
common: Allow building with libgpg-error < 1.47
* common/util.h (GPG_ERR_BAD_RESET_CODE): New replacement.
(GPG_ERR_NO_RESET_CODE): New.
(GPG_ERR_BAD_PUK): New.
--

But as least 1.38 is required.  Tested with 1.42
2024-08-08 15:57:23 +02:00
Werner Koch
bc150995e4
common: Add missing file to repo
--
Fixes-commit: 0dcd1504ba
2024-08-08 14:20:44 +02:00
Werner Koch
0dcd1504ba
sm: More improvements for PKCS#12 parsing for latest IVBB changes.
* common/tlv.h (TLV_PARSER_FLAG_T5793): New.
(tlv_parser_new): New macro.  Rename function with an underscore.
(tlv_next_with_flag): New.
* common/tlv-parser.c (struct tlv_parser_s): Remove const from buffer.
Add fields crammed, lasttlv, and origoff.  Remove bufferlist ands ist
definition.
(dump_to_file): New but disabled debug helper.
(parse_tag): Print more info on error.
(_tlv_parser_new): Add args lasttlv and LNO.  Take a copy of the data.
(_tlv_parser_release): Free the copy of the buffer and return the
recorded TLV object from tlv_parser_new.
(_tlv_peek, tlv_parser_peek, _tlv_parser_peek_null): Remove.
(_tlv_push): Record crammed length.
(_tlv_pop): Restore crammed length.
(_tlv_parser_next): Add arg flags.  More debug output.  Handle cramming
here.  Take care of cramming here.
(tlv_expect_object): Simplify to adjust for changes in _tlv_parser_next.
(tlv_expect_octet_string): Remove arg encapsulates.  Adjust for
changes in _tlv_parser_next.  Change all allers.
(tlv_expect_null): New.
(cram_octet_string): Rewrite.
(need_octet_string_cramming): Remove.

* sm/minip12.c (dump_to_file): New.  Enable in debug mode and if an
envvar ist set.  Replace all explict but disabled dumping to call this
function.
(parse_bag_encrypted_data): Replace tlv_peek_null and a peeking for an
optional SET by non-peeking code.
(parse_cert_bag): Ditto.
(parse_shrouded_key_bag): Replace tlv_peek_null by non-peeking code.
(parse_bag_encrypted_data): Use the new TLV_PARSER_FLAG_T5793 to
enable the Mozilla workaround.
(parse_bag_encrypted_data): Replace the 'renewed_tlv' code by the new
tlv_parser_release semantics.
(parse_shrouded_key_bag): Ditto.
(parse_shrouded_key_bag): Create a new context instead of using the
former encapsulated mechanism for tlv_expect_octet_string.
(parse_bag_data): Ditto.
(p12_parse): Ditto.

* common/tlv-parser.c: New
* common/Makefile.am: Add new file.
--

GnuPG-bug-id: 7213
Backported-from-master: 690fd61a0c

This backport required to introduce the new tlv-parser.c file and
remove most source copied stuff from minip12.c.  Thus the above
ChangeList is not fully correct.
2024-08-07 11:21:35 +02:00
Werner Koch
1d0874c3d2
scd: New getinfo subcommand "manufacturer"
* scd/command.c (cmd_getinfo): Add subcommand "manufacturer".
* scd/app-openpgp.c (get_manufacturer): Rename to ...
(app_openpgp_manufacturer): this and make global.
--

Example:

  $ gpg-connect-agent 'scd getinfo manufacturer 42' /bye
  D Magrathea
  OK

Backported-from-master: a8cef7ebc2
2024-08-07 11:21:31 +02:00
Werner Koch
dfc400a2d9
doc: Fix URL to the OpenPGP card specs
--
2024-08-07 10:34:10 +02:00
Werner Koch
e208ccc66c
gpg: Rename recently added import option no-seckeys to only-pubkeys.
* g10/import.c (parse_import_options): Rename option.
* g10/options.h (IMPORT_NO_SECKEY): Rename to IMPORT_ONLY_PUBKEYS.
Change all users.
--

GnuPG-bug-id: 7146
2024-06-24 11:51:54 +02:00
Werner Koch
7788aba7d8
gpg: Add --import-option "no-seckeys".
* g10/import.c (parse_import_options): Add "no-seckeys".
--

GnuPG-bug-id: 7146
2024-06-11 15:57:01 +02:00
Werner Koch
c489bf7e7e
gpg: Do not bail out on secret keys with an unknown algo
* g10/getkey.c (lookup): Skip keys with unknown algos.
--

If the local store has private keys with an algorithm not supported by
thi version of gpg, gpg used to bail out.  Thus decryption of proper
messages was not possible.  This fix skips such secret keys.
2024-06-11 12:44:25 +02:00
Werner Koch
1d91252205
gpg: Do not show RENC if no key capabilities are found for a key.
* g10/packet.h (PUBKEY_USAGE_BASIC_MASK): New.
* g10/getkey.c (merge_selfsigs_subkey): Mask the default.
(merge_selfsigs_main): Ditto.
--
2024-06-05 11:20:14 +02:00
Jakub Jelen
bc43812358
gpgsm: Avoid double free when checking rsaPSS signatures.
* sm/certcheck.c (gpgsm_check_cms_signature): Do not free s_sig on
error. Its owned and freed by the caller.

--
This is part of
GnuPG-bug-id: 7129
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Fixes-commit: 969abcf40c
(cherry picked from commit dcb0b6fd48)
2024-05-29 11:58:27 +02:00
Jakub Jelen
a1f85fdc40
agent: Avoid uninitialized access in GENKEY command on parameter error.
* agent/command.c (cmd_genkey): Moved init_membuf to the top.
--

Signed-off-by: Jakub Jelen <jjelen@redhat.com>

This is part of
GnuPG-bug-id: 7129

(cherry picked from commit 379fc5569d)
2024-05-29 11:57:30 +02:00
Werner Koch
ebf9e3b824
wks: Make sure that ERR is always initialized.
* tools/wks-util.c (install_key_from_spec_file): Initialize ERR in case
the loop is never run.
--

This is part of
GnuPG-bug-id: 7129
Co-authored-by: Jakub Jelen <jjelen@redhat.com>

(cherry picked from commit 021c27510b)
2024-05-29 11:55:56 +02:00
NIIBE Yutaka
bb57c808b2
scd:openpgp: Fix PIN pin2hash_if_kdf.
* scd/app-openpgp.c (pin2hash_if_kdf): DEK had been changed to pointer
to allocated memory, so, we need to use DEKLEN for the length.

--

GnuPG-bug-id: 7121
Fixes-commit: 20e85585ed
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2024-05-16 10:28:38 +09:00
Werner Koch
97b37db144
gpg,gpgsm: Remove compatibility_flags allow-ecc-encr and vsd-allow-encr.
* g10/options.h (COMPAT_VSD_ALLOW_OCB): Remove.
* g10/gpg.c (compatibility_flags): Remove "vsd-allow_ocb".
(main): Alwas set CO_EXTRA_INFO_VSD_ALLOW_OCB.
* g10/keygen.c (keygen_set_std_prefs): Always set OCB feature flag.
* g10/encrypt.c (use_aead): Always OCB also in de-vs mode.
* sm/gpgsm.h (COMPAT_ALLOW_ECC_ENCR): Remove.
* sm/gpgsm.c (compatibility_flags): Remove "allow-ecc-encr".
* sm/encrypt.c (encrypt_dek): Always allow ecc encryption.
* sm/certreqgen.c (proc_parameters): Likewise.
--

Both feature are meanwhile approved in de-vs mode thus there is no
more need for the flags.
2024-05-06 14:34:48 +02:00
Werner Koch
6228bb0012
tests: Avoid new C23 keyword true.
* tests/asschk.c (eval_boolean): s/true/tru/
--

GnuPG-bug-is: 7093
2024-04-22 08:05:45 +02:00
Werner Koch
7ed15f7548
Post release updates
--
2024-04-16 11:45:35 +02:00
Werner Koch
398cbbbf8d
Release 2.2.43 2024-04-16 09:50:46 +02:00
Werner Koch
15564fa3f6
po: Update some translations for the |R| prompt flag.
--
2024-04-09 13:37:22 +02:00
Werner Koch
1f31dc6200
gpg: Do not allow to accidently set the RENC usage.
* g10/keygen.c (print_key_flags): Print "RENC" if set.
(ask_key_flags_with_mask): Remove RENC from the possible set of
usages.  Add a direct way to set it iff the key is encryption capable.
--

This could be done by using "set your own capabilities" for an RSA
key.  In fact it was always set in this case.

GnuPG-bug-id: 7072
2024-04-04 16:49:50 +02:00
Werner Koch
72c5c70871
gpgconf: Change layout of the gpgconf -X output.
* tools/gpgconf.c (list_dirs): Change the config mode output.
(my_copy_file): Adjust output for org-mode style.
(show_configs_one_file): Ditto.
(show_other_registry_entries): Ditto.
(show_registry_entries_from_file): Ditto.
(show_configs): Ditto.
2024-04-04 15:54:32 +02:00
Werner Koch
8a4069527a
build: Update nPth configure macros.
* m4/npth.m4: Update.
2024-03-18 14:55:46 +01:00
Werner Koch
ce1e671cdc
Update NEWS
--
2024-03-18 14:02:53 +01:00
Werner Koch
5ccfc2101a
gpgconf: Check readability of some files with -X
* tools/gpgconf.c (list_dirs): Rename arg from special to
show_config_mode. Add "S.Uiserver" test and test existsing files for
readability.
2024-03-18 11:15:08 +01:00
Werner Koch
82b39fe254
gpg: Make sure a DECRYPTION_OKAY is never issued for a bad OCB tag.
* g10/mainproc.c (proc_encrypted): Force a decryption failure if any
error has been seen.
* g10/decrypt-data.c (aead_checktag): Issue an ERROR line.
--

GnuPG-bug-id: 7042

Note that gpg in any case returns a failure exit code but due to
double forking GPGME would not see it.
2024-03-14 21:53:19 +01:00
Werner Koch
509d0f76ce
gpg-check-pattern: Consider an empty pattern file as valid
* tools/gpg-check-pattern.c (read_file): Check length before calling
fread.
--

The problem with an empty file is that es_fread is called to read one
element of length zero which seems to be undefined behaviour and
results in ENOENT on my test box.
2024-03-13 15:32:10 +01:00
Werner Koch
5999d95e04
wks: Make gpg-wks-client --mirror work w/o args.
* tools/gpg-wks-client.c (mirror_one_key): Test for no domain
specified.
--

The code did not really work if no domain was given.  It worked but
filtered out all keys so that no key was actually exported.
2024-03-06 11:44:19 +01:00
Werner Koch
8cd920f6aa
gpg: Fix mixed invocation with --trusted-keys and --no-options.
* g10/trustdb.c: Move some definitions around.
(user_utk_list): Rename to trusted_key_list.  Change all users.
(any_trusted_key_seen): New.
(tdb_register_trusted_key): Set it here.  Handle the new value "none".
(verify_own_keys): Do not delete a trusted key from the trustdb if a
trusted-key option was not used.
--

GnuPG-bug-id: 7025
2024-03-04 15:24:40 +01:00
NIIBE Yutaka
f50c543326
agent: Allow simple KEYINFO command when restricted.
* agent/command.c (cmd_keyinfo): Only forbid list command.

--

GnuPG-bug-id: 7003
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2024-03-01 13:59:43 +09:00
NIIBE Yutaka
41c0220725
dirmngr: Fix keep-alive flag handling.
* dirmngr/http.c (run_proxy_connect): Set KEEP_ALIVE if not Basic
Authentication.  Fix resource leak of FP_WRITE.

--

GnuPG-bug-id: 6997
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2024-02-21 15:12:16 +01:00
NIIBE Yutaka
c33c4fdf10
dirmngr: Fix the regression of use of proxy for TLS connection.
* dirmngr/http.c (run_proxy_connect): Don't set keep_alive, since it
causes resource leak of FP_WRITE.
Don't try to read response body to fix the hang.

--

GnuPG-bug-id: 6997
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
2024-02-21 15:11:31 +01:00
NIIBE Yutaka
d6c428699d
dirmngr: Fix proxy with TLS.
* dirmngr/http.c (proxy_get_token, run_proxy_connect): Always
available regardless of USE_TLS.
(send_request): Remove USE_TLS.

--

Since quite some time building w/o TLS won't work.

GnuPG-bug-id: 6997
2024-02-21 15:09:07 +01:00
Werner Koch
23d9093d9b
More NEWS.
--
2024-02-05 13:03:16 +01:00
Ángel González
3d46eb6cf7
common: Update requisites
* configure.ac: Require libgpg-error 1.38 and libksba 1.4.0
* common/util.h: Remove error number substitutes.
--

These versions were already needed for a successful compilation,
but it was not reflected by configure.

GnuPG-bug-id: 6974
Signed-off-by: Ángel González <angel@pgp.16bits.net>

util.h patch by wk.
2024-02-05 08:24:09 +01:00
Werner Koch
cbe0956df0
gpgsm: Increase salt size in pkcs#12 parser.
* sm/minip12.c (parse_bag_encrypted_data): Need 32 bytes.
--

GnuPG-bug-id: 6757
2024-02-05 07:59:02 +01:00
Werner Koch
ce69c103f4
scd:openpgp: Allow PIN length of 6 also with a reset code.
* scd/app-openpgp.c (do_change_pin): Fix PIN length check.  Add "R"
flag to the reset code prompt.
--

When using the reset code it was not possible to set a PIN of length
6.  The "R" flags fixes a funny prompt.

Fixes-commit: efe325ffdf
2024-01-30 15:50:09 +01:00
Werner Koch
573098a2f2
Prepare NEWS for 2.2.43
--
2024-01-29 10:48:49 +01:00
NIIBE Yutaka
efe325ffdf
scd:openpgp: Add the length check for new PIN.
* scd/app-openpgp.c (do_change_pin): Make sure new PIN length
is longer than MINLEN.

--

GnuPG-bug-id: 6843
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
(cherry picked from commit 2376cdff13)
2024-01-26 15:14:02 +01:00
Werner Koch
20e85585ed
scd:openpgp: Restructure the pin2hash_id_kdf function.
* scd/app-openpgp.c (wipe_and_free_string, wipe_and_free): Enable
functions.
(pin2hash_if_kdf): Change interface.  The input PIN is not anymore
changed.  Further there are no more assumptions about the length of
the provided buffer.
(verify_a_chv): Adjust for changed pin2hash_if_kdf.
(verify_chv2): Ditto
(verify_chv3): Ditto.
(do_change_pin): Ditto.
(do_sign): Ditto.
--

Note that this a part of the patch
63bda3aad8 which we used in 2.4 to
implement a PIN cache.  For easier backporting we need to add this
here.
2024-01-26 15:11:54 +01:00