* g10/gpg.c (oOverrideComplianceCheck): New.
(opts): Add new option.
(main): Set option and add check for batch mode.
* g10/options.h (opt): Add flags.override_compliance_check.
* g10/sig-check.c (check_signature2): Factor complaince checking out
to ...
(check_key_verify_compliance): this. Turn error into a warning in
override mode.
--
There is one important use case for this: For systems configured
globally to use de-vs mode, Ed25519 and other key types are not
allowed because they are not listred in the BSI algorithm catalog.
Now, our release signing keys happen to be Ed25519 and thus we need to
offer a way for users to check new versions even if the system is in
de-vs mode. This does on purpose not work in --batch mode so that
scripted solutions won't accidently pass a signature check.
GnuPG-bug-id: 5655
* Makefile.am (all-local): New to setup symlinks.
(distclean-local): New.
* tests/Makefile.am: Remove the gpgconf related targets. Just keep
gpgconf.ctl.in in EXTRA_DIST
* tests/cms/Makefile.am (GNUPG_BUILD_ROOT):
* tests/gpgme/Makefile.am (GPGSCM_PATH):
* tests/openpgp/Makefile.am (GNUPG_BUILD_ROOT):
* tests/pkits/Makefile.am (GNUPG_BUILD_ROOT):
* tests/tpm2dtests/defs.scm (tools): Revert to the former values.
* tests/openpgp/defs.scm (tools): Ditto.
--
This
Fixes-commit: 399ebf6d873d4178c1d527aa4df34bf16a76360e
Fixes-commit: 84fcd8e6eb7e0786399e1f6461c3f60b0db2d070
because we ran into problems with the idea of first doing a
test-install for the checks. "make distcheck" turned out to
be too problematic. Symlinks are a better way of doing this.
Also fixes
GnuPG-bug-id: 5634
* common/i18n.c (i18n_init): Use gnupg_localedir() instead of LOCALEDIR.
(i18n_localegettext): Ditto.
* tools/gpgconf-comp.c (my_dgettext): Ditto.
--
On Unix, gnupg_localedir() returns the locale directory relative to
the root directory of the gnupg installation if specified in the
gpgconf.ctl. Otherwise, it returns the built-in LOCALEDIR.
GnuPG-bug-id: 5999
* dirmngr/dirmngr.h (struct fingerprint_list_s): Add field binlen.
(opt): Add field ignored_certs.
* dirmngr/dirmngr.c: Add option --ignore-cert
(parse_rereadable_options): Handle that option.
(parse_ocsp_signer): Rename to ...
(parse_fingerprint_item): this and add two args.
* dirmngr/certcache.c (put_cert): Ignore all to be igored certs.
Change callers to handle the new error return.
--
This option is useful as a workaround in case we ill run into other
chain validation errors like what we fixed in
GnuPG-bug-id: 5639
* agent/protect.c (USE_CLOCK_GETTIME): New macro.
(calibrate_get_time): Only use clock_gettime if USE_CLOCK_GETTIME.
--
GnuPG-bug-id: 5623
Fixes-commit: 380bce13d94ff03c96e39ac1d834f382c5c730a1
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* tests/openpgp/defs.scm: We expect that stuff is now installed.
(tools): Fix the names.
(intsalled?, bin-prefix): Remove.
(tool-hardcoded): Simplify.
(gpg-conf'): Simplify.
(GNUPG_BUILDDIR): Do not anymore set this envvar.
* tests/tpm2dtests/defs.scm: Ditto.
--
This simplifies things a bit.
* tests/gpgconf.ctl.in: New.
* tests/Makefile.am (EXTRA_DIST): Add new file.
(TESTINST_DIRS): New.
(clean-local): New.
(clean-local-testinst): New.
(check-recursive): New hook.
(bin/gpgconf.ctl): Run a test install.
* tests/cms/Makefile.am (TESTS_ENVIRONMENT): Set new envvar
GNUPG_BUILD_ROOT.
* tests/gpgme/Makefile.am (TESTS_ENVIRONMENT): Ditto.
* tests/openpgp/Makefile.am (TESTS_ENVIRONMENT): Ditto.
* tests/pkits/Makefile.am (TESTS_ENVIRONMENT): Ditto.
* tests/tpm2dtests/Makefile.am (TESTS_ENVIRONMENT): Ditto.
--
Right now this helps only with the global configuraion dir which is
now not set and thus the build host'ss own /etc/gnupg does not anymore
affect the build.
Signed-off-by: Werner Koch <wk@gnupg.org>
* common/homedir.c (MYPROC_SELF_EXE): New.
(unix_rootdir): Use it here. Also support GNUPG_BUILD_ROOT as
fallback.
--
In addition this adds a fallback method for AIX etc which do not have
an easy way to get the info.
* common/homedir.c (unix_rootdir): Add arg want_sysconfdir.
(gnupg_sysconfdir): Return it.
--
Our regression test suite has the problem that we can't disable the
use of the global config files or test them using the regualr
binaries. This new keyword will allow us to overcome the problem.
* po/it.po: Fix italian translation.
--
In English, "too" has two different meanings (eg. "too much" vs "change
it too").
Italian translation used wrong meaning, and the sentence made no sense.
Signed-off-by: Andre Heinecke <aheinecke@gnupg.org>
* common/homedir.c (unix_rootdir): New.
(gnupg_bindir): Use it.
(gnupg_libexecdir): Use it.
(gnupg_libdir): Use it.
(gnupg_datadir): Use it.
(gnupg_localedir): Use it.
--
This feature is useful for building and using an AppImage version of
gnupg and probably also for some other use cases.
GnuPG-bug-id: 5999
Here is a sample gpgconf.ctl file
--8<---------------cut here---------------start------------->8---
# gpgconf.ctl
#
# This file is used to change the directories where the gpg components
# are installed. It does not change the configuration directories.
# The file is expected in the same directory as gpgconf. The physical
# installation directories are evaluated and no symlinks. Blank lines
# and lines starting with pound signed are ignored. No errors are
# printed for unknown keywords or commands. The only defined key for
# now is "rootdir" which must be followed by one optional space, an
# equal sign, and the value for the root directory. Environment
# variables are substituted in standard shell manner, the final value
# must start with a slash, trailing slashed are stripped.
rootdir = $APPDIR/gnupg
--8<---------------cut here---------------end--------------->8---
* common/stringhelp.c (substitute_envvars): New. Based on code in
gpg-connect-agent.
* common/t-stringhelp.c: Include sysutils.h.
(test_substitute_envvars): New.
--
GnuPG-bug-id: 5599
* sm/certdump.c (parse_dn_part): Translate OID to "Callsign"
* sm/keylist.c (oidtranstbl): Some more OIDs.
--
This is Ham thingy to make it easier to read LotW certificates.
Signed-off-by: Werner Koch <wk@gnupg.org>
* agent/command.c (cmd_get_passphrase): Do not deref PI. PI is always
NULL.
--
Fixes-commit: b89b1f35c29ceaebe39b31444936aa66c9297f2c
GnuPG-bug-id: 5577
--
This is per OpenPGP WG design team decision from 2021-08-13
(raising a new wall after exactly 60 years ;-)
Signed-off-by: Werner Koch <wk@gnupg.org>
* kbx/keybox-blob.c (create_blob_header): Fix the flag to match no
UBID entry,
(create_blob_finish): Fix the length of data to be hashed.
--
GnuPG-bug-id: 5573
Fixes-commit: 915297705af6f1db74dacf0d6665b83eb0a58459
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* common/membuf.c (put_membuf): Allow NULL for the second arg.
--
There has been such a use case in keybox-blob.c.
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* configure.ac (DIRMNGR_DEFAULT_KEYSERVER): Change to
keyserver.ubuntu.com.
* dirmngr/certcache.c (cert_cache_init): Disable default pool cert.
* dirmngr/http-ntbtls.c (gnupg_http_tls_verify_cb): Ditto.
* dirmngr/http.c (http_session_new): Ditto.
* dirmngr/server.c (make_keyserver_item): Use a different mapping for
the gnupg.net names.
--
Due to the unfortunate shutdown of the keyserver pool, the long term
defaults won't work anymore. Thus it is better to change them.
For https access keyserver.ubuntu.com is now used because it can be
expected that this server can stand the load from newer gnupg LTS
versions.
For http based access the Dutch Surfnet keyserver is used. However
due to a non-standard TLS certificate this server can not easily be
made the default for https.
Note: that the default server will be changed again as soon as a new
connected keyserver infrastructure has been established.
(cherry picked from commit 47c4e3e00a7ef55f954c14b3c237496e54a853c1)
--
This is a several decade old debate how to name this. Meanwhile in
Germany it seems to be more clean to use the term "Passwort" instead
of "Passphrase" (or that "Mantra" thing). It is easier to explain to
users that a password may include spaces etc than to to explain the
difference between passphrase and password.
So let's keep the things in the code as is but change the
translations.
Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit c9859967c0d85e36c56ff481d402b97d2fd386bb)
and adjusted for 2.3.
* g10/mainproc.c (proc_encrypted): Fix the condition to report
NO_SECKEY even when the key was not considered by get_session_key.
--
GnuPG-bug-id: 5562
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
* common/recsel.c (recsel_parse_expr): Add flag -t.
* common/stringhelp.c: Remove assert.h.
(strtokenize): Factor code out to do_strtokenize.
(strtokenize_nt): New.
(do_strtokenize): Add arg trim to support the strtokenize_nt.
* common/t-stringhelp.c (test_strtokenize_nt): New test cases.
* tools/wks-util.c (wks_list_key): Use strtokenize_nt and the recsel
flag -t.
--
This fixes a bug with user ids with leading spaces because:
wks-client lists all mail addresses from the key and matches them to the
requested mail address.
If there are several user-ids all with the same mail address
wks-client picks one of them and then extracts exactly that user id.
However, here it does not match by the mail address but by the full
user-id so that we can be sure that there will be only one user-id in
the final key.
The filter built expression unfortunately strips leading blanks but
requires a verbatim match. Thus it won't find the user id again and
errors out.
The new -t flag and a non-trimming strtokenize solves the problem.
Signed-off-by: Werner Koch <wk@gnupg.org>
