* g10/parse-packet.c (parse_signature): Increase the cap for hashed
subpackets to 30000. Print the value in the error message. Do not
return an error but skip a too long signature.
--
The limit of 10000 served us well for decades but given the option to
put a key into the signature, a larger limit will eventually be
useful. The second part makes things a bit robust against rogue
subpackets on a keyserver.
* configure.ac (NEED_GPGRT_VERSION): Bump to 1.51.
* g10/keydb.c (internal_keydb_update_keyblock) [!USE_TOFU]: Mark an
arg unused.
* common/homedir.c (create_common_conf) [!BUILD_WITH_KEYBOXD]: Mark an
arg unused.
* common/compliance.c (get_assumed_de_vs_compliance): Also consider a
registry entry.
--
On Windows it is easier to set the registry key than to use an envvar.
--
- Follow conventions from other zh_TW user interfaces
- Use "確定" for "OK" like KDE
- Remove extra space between keyboard accelerator like in "取消(_C)"
- Follow conventions of modern zh_TW
- Character -> 字元
- 衹有 -> 「只」有
- Fix some "pinentry" translations
Sometimes it was translated as an entry of PIN codes among a list and
not the "pinentry" tool
Signed-off-by: Kisaragi Hiu <mail@kisaragi-hiu.com>
* g10/pkglue.c (pk_verify): When fixing R and S, make sure those are
copies.
--
GnuPG-bug-id: 7426
Fixing-commit: 0a5a854510fda6e6990938a3fca424df868fe676
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
Also avoid clearing the error by the S code of a failed mpi_print of
R.
Signed-off-by: Werner Koch <wk@gnupg.org>
* common/asshelp.c (SECS_TO_WAIT_FOR_AGENT): Change from 5 to 8
seconds.
(SECS_TO_WAIT_FOR_KEYBOXD): Ditto.
(SECS_TO_WAIT_FOR_DIRMNGR): Ditto.
--
Experience on Windows showed that right after re-booting we may need
some more time to get things up.
* scd/app.c (new_card_lock): New.
(select_application): Scanning is serialized by NEW_CARD_LOCK.
For app_new_register, we hold the W-lock.
(initialize_module): Initialize NEW_CARD_LOCK.
--
GnuPG-bug-id: 7402
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* tools/gpg-mail-tube.c (mail_tube_encrypt): Fix content type for an
attached message.
--
We can't use message/rfc822 if we encrypt this message as a simple PGP
file.
* scd/app.c (send_card_and_app_list): Only handle the case with
WANTCARD=NULL.
(app_send_card_list): Follow the change.
(app_send_active_apps): Factor out the case with WANTCARD!=NULL.
--
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* tools/gpgtar-extract.c (extract_directory): Factor parent directory
creation out to ..
(try_mkdir_p): new.
(extract_regular): Create directory on ENOENT.
* g10/pubkey-enc.c (get_it): Use log_info instead of log_error if the
public key was not found for preference checking.
--
If tarball was created with
tar cf tarball file1.txt foo/file2.txt
the tarball has no entry for foo/ and thus the extraction fails. This
patch fixes this.
GnuPG-bug-id: 7380
The second patch avoid a wrong exist status status line due to the use
of log_error. But the actual cause needs stuill needs tobe
investigated.
* tools/gpg-mail-tube.c (mail_tube_encrypt): Rename var ct_text for
clarity. Replace debug diagnostic by log_info. Assume text/plain for
missing content-type.
--
Without this fix we would create message/rfc822 attachment instead of
a text/plain attachment with the encrypted body.
* g10/packet.h (PKT_public_key): Increased size of req_usage to 16.
* g10/getkey.c (key_byname): Set allow_adsk in the context if ir was
requested via req_usage.
(finish_lookup): Allow RENC usage matching.
* g10/keyedit.c (append_adsk_to_key): Adjust the assert.
* g10/keygen.c (prepare_adsk): Also allow to find an RENC subkey.
--
If an ADSK is to be added it may happen that an ADSK subkey is found
first and this should then be used even that it does not have the E
usage. However, it used to have that E usage when it was added.
While testing this I found another pecularity: If you do
gpg -k ADSK_SUBKEY_FPR
without the '!' suffix and no corresponding encryption subkey is dound,
you will get an unusabe key error. I hesitate to fix that due to
possible side-effects.
GnuPG-bug-id: 6882
* agent/trustlist.c (istrusted_internal): When LISTMODE is enabled,
TRUSTLISTFPR status output should be done.
--
GnuPG-bug-id: 7363
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
Fixes-commit: 4275d5fa7a51731544d243ba16628a9958ffe3ce
* g10/trustdb.c (validate_keys): Use log_info instead of log_error for
not found or expired UTKs.
--
Actually the not-found case used log_error for decades. The
semantically simialr expired case did thus the same. The actual
problem is for example in the import case where gpg exits with a
failure despite that a key validation was requested.
GnuPG-bug-id: 7351
* build-aux/speedo.mk (speedo_w32_cflags): Remove -mms-bitfields
because it is for a long time the gcc default. Enable control flow
protection.
--
Note that due to mingw static linking problems with libssp the stack
protector is not yet enabled.
(cherry picked from commit afe87ffc08e14317f4ef5bbe2940d07203a43808)
* sm/keylist.c (list_internal_keys): Detect write errors to the output
stream.
* sm/server.c (any_failure_printed): New var.
(gpgsm_status2): Handle new var. Move statusfp init to ...
(gpgsm_init_statusfp): new function.
(gpgsm_exit_failure_status): New.
* sm/gpgsm.c (main): Explicit statusfp init.
(gpgsm_exit): Print failure status on error.
--
Test by using
gpgsm -k >/dev/full
gpgsm -k --wit-colons >/dev/full
and also by redirecting to a file on a small partition.
GnuPG-bug-id: 6185
* common/compliance.c (gnupg_status_compliance_flag): Fix test.
--
In general the cache is used to query this flag but in this function
it is used directly and we need to adjust the test.
Thanks to Ingo for reporting this.
* common/homedir.c (_gnupg_socketdir_internal): Check return code
of gnupg_mkdir and handle the case of GPG_ERR_EEXIST.
--
GnuPG-bug-id: 7332
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* dirmngr/crlcache.c (crl_cache_list): Print a summary of URLs.
* sm/call-dirmngr.c (gpgsm_dirmngr_run_command): Print a notice to
stdout if the dirmngr has been disabled.
--
GnuPG-bug-id: 7337
* acinclude.m4 (GNUPG_CHECK_ENDIAN): Remove.
* configure.ac (BIG_ENDIAN_HOST): Use AC_C_BIGENDIAN
to detect endian and set BIG_ENDIAN_HOST.
--
Reported-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* common/compliance.c (assumed_de_vs_compliance): New.
(get_compliance_cache): Check envvar and fake compliance.
(gnupg_status_compliance_flag): Return 2023 for de-vs if in faked
mode.
* g10/gpg.c (gpgconf_list): For compliance_de_vs return 23 or 2023.
--
The user visible changes are that
GNUPG_ASSUME_COMPLIANCE=de-vs gpgconf --list-options gpg \
| awk -F: '$1=="compliance_de_vs" {print $8}'
returns 2023 if "compliance de-vs" is found in gpg.conf. If
eventually the software is arpproved the returned value will be 23 and
not 1 as it was before. Consumers should check whether they see value
of true (Kleopatra does this right now) and also check whether the
value is > 2000 and in this case print a beta/non-approved warning.
The envvar is currently used to assume that the underlying libgcrypt
is compliant and approved. This is not yet the case but eventually
libgcrypt will announce this itself and from then on the envvar is not
anymore required for testing.
