mirror of
git://git.gnupg.org/gnupg.git
synced 2024-12-22 10:19:57 +01:00
Werner Koch
7fa1d3cc82
gpgsm: Always use the chain model if the root-CA requests this.
* sm/call-dirmngr.c (gpgsm_dirmngr_isvalid): Do not use option --force-default-responder. * sm/certchain.c (is_cert_still_valid): Rename arg for clarity. (gpgsm_validate_chain): Always switch to chain model. -- The trustlist.txt may indicate that a root CA issues certificates which shall be validated using the chain model. This is for example the case for qualified signatures. Before this change we did this only if the default shell model indicated that a certificate has expired. This optimization is technically okay but has one problem: The chain model requires the use of OCSP but we switch to this only when running the chain model validation. To catch revoked certificates using OCSP we need to always switch to the chain model unless OCSP has been enabled anyway. Note that the old --force-default-responder option is not anymore used. Test cases are certificates issued by # CN=TeleSec qualified Root CA 1 # O=Deutsche Telekom AG # C=DE # 2.5.4.97=USt-IdNr. DE 123475223 90:C6:13:6C:7D:EF:EF:E9:7C:C7:64:F9:D2:67:8E:AD:03:E5:52:96 \ S cm qual relax A sample revoked certificate is -----BEGIN CERTIFICATE----- MIIDTzCCAvSgAwIBAgIQIXfquQjq32B03CdaflIbiDAMBggqhkjOPQQDAgUAMHEx CzAJBgNVBAYTAkRFMRwwGgYDVQQKDBNEZXV0c2NoZSBUZWxla29tIEFHMSMwIQYD VQQDDBpUZWxlU2VjIFBLUyBlSURBUyBRRVMgQ0EgMTEfMB0GA1UEYQwWVVN0LUlk TnIuIERFIDEyMzQ3NTIyMzAeFw0yMDA2MjIxMDQ1NDJaFw0yMzA2MjUyMzU5MDBa MDAxCzAJBgNVBAYTAkRFMRUwEwYDVQQDDAxLb2NoLCBXZXJuZXIxCjAIBgNVBAUT ATMwWjAUBgcqhkjOPQIBBgkrJAMDAggBAQcDQgAEbkEXUuXTriWOwqQhjlh11oCc 6Z8lQdQDz3zY/OEh8fMJS7AKBNo8zkpPKDJ2olPph18b1goEbLiqHQsPRPahDaOC AaowggGmMB8GA1UdIwQYMBaAFP/0iep1rMXT0iQ0+WUqBvLM6bqBMB0GA1UdDgQW BBQEI3xsIUDnoOx+gLYbG63v5/f9kjAOBgNVHQ8BAf8EBAMCBkAwDAYDVR0TAQH/ BAIwADAgBgNVHREEGTAXgRV3ZXJuZXIua29jaEBnbnVwZy5jb20wPQYDVR0gBDYw NDAyBgcEAIvsQAECMCcwJQYIKwYBBQUHAgEWGWh0dHA6Ly9wa3MudGVsZXNlYy5k ZS9jcHMwgYQGCCsGAQUFBwEBBHgwdjBLBggrBgEFBQcwAoY/aHR0cDovL3RxcmNh MS5wa2kudGVsZXNlYy5kZS9jcnQvVGVsZVNlY19QS1NfZUlEQVNfUUVTX0NBXzEu Y3J0MCcGCCsGAQUFBzABhhtodHRwOi8vcGtzLnRlbGVzZWMuZGUvb2NzcHIwXgYI KwYBBQUHAQMEUjBQMAgGBgQAjkYBATAIBgYEAI5GAQQwOgYGBACORgEFMDAwLhYo aHR0cHM6Ly93d3cudGVsZXNlYy5kZS9zaWduYXR1cmthcnRlL2FnYhMCZW4wDAYI KoZIzj0EAwIFAANHADBEAiAqgB8gyZyj05CRdHD5KJcpG68DzQECYnYP6ZPasUYK AQIgI1GtRMJWvFTIKsZpgY+ty0pRb5/K09fbmvaSAKFpv/I= -----END CERTIFICATE-----
The GNU Privacy Guard 2 ========================= Version 2.3 Copyright 1997-2019 Werner Koch Copyright 1998-2021 Free Software Foundation, Inc. Copyright 2003-2022 g10 Code GmbH * INTRODUCTION GnuPG is a complete and free implementation of the OpenPGP standard as defined by RFC4880 (also known as PGP). GnuPG enables encryption and signing of data and communication, and features a versatile key management system as well as access modules for public key directories. GnuPG, also known as GPG, is a command line tool with features for easy integration with other applications. A wealth of frontend applications and libraries are available that make use of GnuPG. Starting with version 2 GnuPG provides support for S/MIME and Secure Shell in addition to OpenPGP. GnuPG is Free Software (meaning that it respects your freedom). It can be freely used, modified and distributed under the terms of the GNU General Public License. * BUILD INSTRUCTIONS GnuPG 2.3 depends on the following GnuPG related packages: npth (https://gnupg.org/ftp/gcrypt/npth/) libgpg-error (https://gnupg.org/ftp/gcrypt/libgpg-error/) libgcrypt (https://gnupg.org/ftp/gcrypt/libgcrypt/) libksba (https://gnupg.org/ftp/gcrypt/libksba/) libassuan (https://gnupg.org/ftp/gcrypt/libassuan/) You should get the latest versions of course, the GnuPG configure script complains if a version is not sufficient. Several other standard libraries are also required. The configure script prints diagnostic messages if one of these libraries is not available and a feature will not be available.. You also need the Pinentry package for most functions of GnuPG; however it is not a build requirement. Pinentry is available at https://gnupg.org/ftp/gcrypt/pinentry/ . After building and installing the above packages in the order as given above, you may continue with GnuPG installation (you may also just try to build GnuPG to see whether your already installed versions are sufficient). As with all packages, you just have to do ./configure make make check make install The "make check" is optional but highly recommended. To run even more tests you may add "--enable-all-tests" to the configure run. Before running the "make install" you might need to become root. If everything succeeds, you have a working GnuPG with support for OpenPGP, S/MIME, ssh-agent, and smartcards. In case of problem please ask on the gnupg-users@gnupg.org mailing list for advise. Instruction on how to build for Windows can be found in the file doc/HACKING in the section "How to build an installer for Windows". This requires some experience as developer. You may run gpgconf --list-dirs to view the directories used by GnuPG. To quickly build all required software without installing it, the Speedo method may be used: make -f build-aux/speedo.mk native This method downloads all required libraries and does a native build of GnuPG to PLAY/inst/. GNU make is required and you need to set LD_LIBRARY_PATH to $(pwd)/PLAY/inst/lib to test the binaries. ** Specific build problems on some machines: *** Apple OSX 10.x using XCode On some versions the correct location of a header file can't be detected by configure. To fix that you should run configure like this ./configure gl_cv_absolute_stdint_h=/usr/include/stdint.h Add other options as needed. *** Systems without a full C99 compiler If you run into problems with your compiler complaining about dns.c you may use ./configure --disable-libdns Add other options as needed. * RECOMMENDATIONS ** Socket directory GnuPG uses Unix domain sockets to connect its components (on Windows an emulation of these sockets is used). Depending on the type of the file system, it is sometimes not possible to use the GnuPG home directory (i.e. ~/.gnupg) as the location for the sockets. To solve this problem GnuPG prefers the use of a per-user directory below the the /run (or /var/run) hierarchy for the sockets. It is thus suggested to create per-user directories on system or session startup. For example, the following snippet can be used in /etc/rc.local to create these directories: [ ! -d /run/user ] && mkdir /run/user awk -F: </etc/passwd '$3 >= 1000 && $3 < 65000 {print $3}' \ | ( while read uid rest; do if [ ! -d "/run/user/$uid" ]; then mkdir /run/user/$uid chown $uid /run/user/$uid chmod 700 /run/user/$uid fi done ) * DOCUMENTATION The complete documentation is in the texinfo manual named `gnupg.info'. Run "info gnupg" to read it. If you want a a printable copy of the manual, change to the "doc" directory and enter "make pdf" For a HTML version enter "make html" and point your browser to gnupg.html/index.html. Standard man pages for all components are provided as well. An online version of the manual is available at [[https://gnupg.org/documentation/manuals/gnupg/]] . A version of the manual pertaining to the current development snapshot is at [[https://gnupg.org/documentation/manuals/gnupg-devel/]] . * Using the legacy version GnuPG 1.4 The 1.4 version of GnuPG is only intended to allow decryption of old data material using legacy keys which are not anymore supported by GnuPG 2.x. To install both versions alongside, it is suggested to rename the 1.4 version of "gpg" to "gpg1" as well as the corresponding man page. Newer releases of the 1.4 branch will likely do this by default. * HOW TO GET MORE INFORMATION A description of new features and changes since version 2.1 can be found in the file "doc/whats-new-in-2.1.txt" and online at "https://gnupg.org/faq/whats-new-in-2.1.html" . The primary WWW page is "https://gnupg.org" The primary FTP site is "https://gnupg.org/ftp/gcrypt/" See [[https://gnupg.org/download/mirrors.html]] for a list of mirrors and use them if possible. You may also find GnuPG mirrored on some of the regular GNU mirrors. We have some mailing lists dedicated to GnuPG: gnupg-announce@gnupg.org For important announcements like new versions and such stuff. This is a moderated list and has very low traffic. Do not post to this list. gnupg-users@gnupg.org For general user discussion and help. gnupg-devel@gnupg.org GnuPG developers main forum. You subscribe to one of the list by sending mail with a subject of "subscribe" to x-request@gnupg.org, where x is the name of the mailing list (gnupg-announce, gnupg-users, etc.). See https://gnupg.org/documentation/mailing-lists.html for archives of the mailing lists. Please direct bug reports to [[https://bugs.gnupg.org]] or post them direct to the mailing list <gnupg-devel@gnupg.org>. Please direct questions about GnuPG to the users mailing list or one of the PGP newsgroups; please do not direct questions to one of the authors directly as we are busy working on improvements and bug fixes. The mailing lists are watched by the authors and we try to answer questions as time allows us. Commercial grade support for GnuPG is available; for a listing of offers see https://gnupg.org/service.html . Maintaining and improving GnuPG requires a lot of time. Since 2001, g10 Code GmbH, a German company owned and headed by GnuPG's principal author Werner Koch, is bearing the majority of these costs. To keep GnuPG in a healthy state, they need your support. # This file is Free Software; as a special exception the authors gives # unlimited permission to copy and/or distribute it, with or without # modifications, as long as this notice is preserved. For conditions # of the whole package, please see the file COPYING. This file is # distributed in the hope that it will be useful, but WITHOUT ANY # WARRANTY, to the extent permitted by law; without even the implied # warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # # Local Variables: # mode:org # End:
Description
Languages
C
89.5%
Scheme
3.1%
TeX
2.2%
M4
1.9%
Shell
1.5%
Other
1.6%