gnupg.git
4 years agogpg: Allow import of large keys.
Werner Koch [Thu, 4 Dec 2014 09:53:10 +0000 (10:53 +0100)]
gpg: Allow import of large keys.

* g10/import.c (import): Skip too large keys.
* kbx/keybox-file.c (IMAGELEN_LIMIT): Change limit from 2MB to 5MB.
--

The key which triggered the problem was 0x57930DAB0B86B067.  With this
patch it can be imported.  Keys larger than the now increased limit of
5MB will are skipped and the already existing not_imported counter is
bumped up.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agoindentation: Update g10/import.c
Werner Koch [Thu, 4 Dec 2014 09:45:53 +0000 (10:45 +0100)]
indentation: Update g10/import.c

--

4 years agogpg: Remove option aliases --[no-]throw-keyid and --notation-data.
Werner Koch [Wed, 3 Dec 2014 10:28:10 +0000 (11:28 +0100)]
gpg: Remove option aliases --[no-]throw-keyid and --notation-data.

* g10/gpg.c (opts): Remove them.
* g10/options.h (opt): s/throw_keyid/throw_keyids/ and change users.
--

See mails starting
 http://lists.gnupg.org/pipermail/gnupg-devel/2014-November/029128.html

4 years agoagent: Replace some sprintf.
Werner Koch [Tue, 2 Dec 2014 13:13:53 +0000 (14:13 +0100)]
agent: Replace some sprintf.

* agent/call-scd.c (agent_card_pksign): Replace sprintf by bin2hex.
* agent/command-ssh.c (ssh_identity_register): Ditto.
* agent/pkdecrypt.c (agent_pkdecrypt): Replace sprintf by
put_membuf_printf.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agotools: Improve watchgnupg portability.
Werner Koch [Mon, 1 Dec 2014 14:55:28 +0000 (15:55 +0100)]
tools: Improve watchgnupg portability.

* configure.ac (AC_CHECK_HEADERS): Check for sys.select.h
* tools/watchgnupg.c: Include it.
--

It seems http://www.musl-libc.org/ is quite limited and requires
the use sys/select.h instead of unistd.h et al.

4 years agogpg: Fix export bug using exact search with only one key in the keybox.
Werner Koch [Mon, 1 Dec 2014 10:54:51 +0000 (11:54 +0100)]
gpg: Fix export bug using exact search with only one key in the keybox.

* g10/export.c (do_export_stream): Disable caching.
* g10/keyserver.c (keyidlist): Ditto.
--

GnuPG-bug-id: 1774

4 years agoscd: Implement socket redirection.
Werner Koch [Mon, 1 Dec 2014 09:45:06 +0000 (10:45 +0100)]
scd: Implement socket redirection.

* scd/scdaemon.c (ENAMETOOLONG): New.
(redir_socket_name): New.
(cleanup): Take care of a redirected socket.
(main): Pass redir_socket_name to create_server_socket.
(create_socket_name): Remove superfluous length check.
(create_server_socket): Add arg r_redir_name and implement
redirection.  Replace assert for older Assuan by an error message.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agodirmngr: Implement socket redirection.
Werner Koch [Mon, 1 Dec 2014 08:50:55 +0000 (09:50 +0100)]
dirmngr: Implement socket redirection.

* dirmngr/dirmngr.c (ENAMETOOLONG): new.
(redir_socket_name): New.
(main): Add Assuan socket redirection.
(cleanup): Adjust cleanup for redirection.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agoagent: Fix compile problem for old Libassuan.
Werner Koch [Mon, 1 Dec 2014 08:49:16 +0000 (09:49 +0100)]
agent: Fix compile problem for old Libassuan.

--

4 years agoagent: Implement socket redirection.
Werner Koch [Fri, 28 Nov 2014 20:34:35 +0000 (21:34 +0100)]
agent: Implement socket redirection.

* agent/gpg-agent.c (ENAMETOOLONG): New.
(redir_socket_name, redir_socket_name_extra)
(redir_socket_name_ssh): New.
(remove_socket): Take care of the redir names.
(main): Pass the redir names to create_server_socket.
(create_socket_name): Remove length check - that is anyway done later.
(create_server_socket): Add arg r_redir_name and implement redirection
if Libassuan is at least 2.14.

4 years agogpg: Change another BUG() call to a regular error message.
Werner Koch [Fri, 28 Nov 2014 11:20:42 +0000 (12:20 +0100)]
gpg: Change another BUG() call to a regular error message.

* g10/mainproc.c (proc_tree): Replace BUG by a proper error messages.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agoAdd option --no-autostart.
Werner Koch [Fri, 28 Nov 2014 08:44:19 +0000 (09:44 +0100)]
Add option --no-autostart.

* g10/gpg.c: Add option --no-autostart.
* sm/gpgsm.c: Ditto.
* g10/options.h (opt): Add field autostart.
* sm/gpgsm.h (opt): Ditto.
* g10/call-agent.c (start_agent): Print note if agent was not
autostarted.
* sm/call-agent.c (start_agent): Ditto.
* g10/call-dirmngr.c (create_context): Likewise.
* sm/call-dirmngr.c (start_dirmngr_ext): Ditto.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg-agent: Add restricted connection feature.
Мирослав Николић [Thu, 27 Nov 2014 19:41:37 +0000 (20:41 +0100)]
gpg-agent: Add restricted connection feature.

* agent/agent.h (opt): Add field extra_socket.
(server_control_s): Add field restricted.
* agent/command.c: Check restricted flag on many commands.
* agent/gpg-agent.c (oExtraSocket): New.
(opts): Add option --extra-socket.
(socket_name_extra): New.
(cleanup): Cleanup that socket name.
(main): Implement oExtraSocket.
(create_socket_name): Add arg homedir and change all callers.
(create_server_socket): Rename arg is_ssh to primary and change
callers.
(start_connection_thread): Take ctrl as arg.
(start_connection_thread_std): New.
(start_connection_thread_extra): New.
(handle_connections): Add arg listen_fd_extra and replace the
connection starting code by parameterized loop.
* common/asshelp.c (start_new_gpg_agent): Detect the use of the
restricted mode and don't fail on sending the pinentry environment.

* common/util.h (GPG_ERR_FORBIDDEN): New.

4 years agoagent: Make auditing of the option list easier.
Мирослав Николић [Thu, 27 Nov 2014 16:28:00 +0000 (17:28 +0100)]
agent: Make auditing of the option list easier.

* agent/gpg-agent.c (opts): Use ARGPARSE_ macros.

4 years agodirmngr: Only report hkps scheme when available
Kristian Fiskerstrand [Tue, 25 Nov 2014 18:24:18 +0000 (19:24 +0100)]
dirmngr: Only report hkps scheme when available

* dirmngr/ks-engine-hkp.c (ks_hkp_help): Make use of TLS macros.

--
Only report support for the hkps scheme when GnuPG / dirmngr
has been built with a TLS library.

This helps debuging and enable the user to detect whether support
for hkps is included by doing a
`gpg-connect-agent --dirmngr 'keyserver --help' /bye`.
Currently hkps will be listed as a supported scheme but trying to
add a keyserver using it will silently fail.

As a digression, https is never listed as a valid scheme.

4 years agogpg: Change a bug() call to a regular error message.
Werner Koch [Wed, 26 Nov 2014 09:21:01 +0000 (10:21 +0100)]
gpg: Change a bug() call to a regular error message.

* g10/decrypt-data.c (decrypt_data): Return an error code instead of
calling BUG().
--

This code path can be triggered by fuzzing gpg and thus with some
likeness also by corrupt messages for other reasons.

4 years agoFix buffer overflow in openpgp_oid_to_str.
Werner Koch [Tue, 25 Nov 2014 10:58:56 +0000 (11:58 +0100)]
Fix buffer overflow in openpgp_oid_to_str.

* common/openpgp-oid.c (openpgp_oid_to_str): Fix unsigned underflow.

* common/t-openpgp-oid.c (BADOID): New.
(test_openpgp_oid_to_str): Add test cases.
--

The code has an obvious error by not considering invalid encoding for
arc-2.  A first byte of 0x80 can be used to make a value of less then
80 and we then subtract 80 from that value as required by the OID
encoding rules.  Due to the unsigned integer this results in a pretty
long value which won't fit anymore into the allocated buffer.

The fix is obvious.  Also added a few simple test cases.  Note that we
keep on using sprintf instead of snprintf because managing the
remaining length of the buffer would probably be more error prone than
assuring that the buffer is large enough.  Getting rid of sprintf
altogether by using direct conversion along with membuf_t like code
might be possible.

Reported-by: Hanno Böck
Signed-off-by: Werner Koch <wk@gnupg.org>
Ported from libksba commit f715b9e156dfa99ae829fc694e5a0abd23ef97d7

4 years agobuild: Require libgpg-error 1.16.
Werner Koch [Mon, 24 Nov 2014 19:12:38 +0000 (20:12 +0100)]
build: Require libgpg-error 1.16.

--

1.15 has a bug which will lead to a segv when sending keys.  Better
updated the requirements to avoid bug reports.

4 years agogpg: Fix use of uninit.value in listing sig subpkts.
Werner Koch [Mon, 24 Nov 2014 17:05:45 +0000 (18:05 +0100)]
gpg: Fix use of uninit.value in listing sig subpkts.

* g10/parse-packet.c (dump_sig_subpkt): Print regex subpacket
sanitized.
--

We may not use "%s" to print an arbitrary buffer.  At least "%.*s"
should have been used.  However, it is in general preferable to escape
control characters while printf user data.

Reported-by: Hanno Böck
Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Fix off-by-one read in the attribute subpacket parser.
Werner Koch [Mon, 24 Nov 2014 16:28:25 +0000 (17:28 +0100)]
gpg: Fix off-by-one read in the attribute subpacket parser.

* g10/parse-packet.c (parse_attribute_subpkts): Check that the
attribute packet is large enough for the subpacket type.
--

Reported-by: Hanno Böck
Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Fix batch generation of ECC keys.
Werner Koch [Mon, 24 Nov 2014 10:56:49 +0000 (11:56 +0100)]
gpg: Fix batch generation of ECC keys.

* g10/keygen.c (get_parameter_algo): Map ECC algorithm strings
directly.
--

Interactive generation of the keys uses the OpenPGP algorithms numbers
but batch generation allows the use of strings.

Reported-by: Gaetan Bisson.
Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agodoc: Update dirmngr.texi
Werner Koch [Mon, 24 Nov 2014 10:23:22 +0000 (11:23 +0100)]
doc: Update dirmngr.texi

--

4 years agoDistinguish between ARGPARSE_AMBIGUOUS_{OPTION,COMMAND}
Daniel Kahn Gillmor [Fri, 21 Nov 2014 22:04:42 +0000 (17:04 -0500)]
Distinguish between ARGPARSE_AMBIGUOUS_{OPTION,COMMAND}

* common/argparse.c (initialize): Use correct value.
--
This avoids a dead path in the argparse code.

It's not clear that this is needed, however, since
ARGPARSE_AMBIGUOUS_COMMAND is never actually used in the code.
Another approach would be to trim out ARGPARSE_AMBIGUOUS_COMMAND
entirely.

4 years agogpg: Refer to --throw-keyids instead of --throw-keyid
Daniel Kahn Gillmor [Fri, 21 Nov 2014 22:33:01 +0000 (17:33 -0500)]
gpg: Refer to --throw-keyids instead of --throw-keyid

* g10/encrypt.c: adjust error message

--
The full option name is --throw-keyids, so we should refer to it
consistently.

4 years agospeedo: Distribute installer graphics.
Werner Koch [Mon, 24 Nov 2014 08:44:18 +0000 (09:44 +0100)]
speedo: Distribute installer graphics.

--

4 years agoUpdate NEWS
Werner Koch [Fri, 21 Nov 2014 20:38:00 +0000 (21:38 +0100)]
Update NEWS

--

4 years agogpg: Track number of skipped v3 keys on import.
Werner Koch [Wed, 19 Nov 2014 09:34:32 +0000 (10:34 +0100)]
gpg: Track number of skipped v3 keys on import.

* g10/import.c (stats_s): Add field v3keys.
(import): Update this field.
(import_print_stats): Print v3 key count.
(read_block): Skip v3 keys and return a count for them.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Fix regression in parse_key.
Werner Koch [Wed, 19 Nov 2014 09:34:32 +0000 (10:34 +0100)]
gpg: Fix regression in parse_key.

* g10/parse-packet.c (parse): Better return just the gpg_err_code.
(parse_key): Return the error code.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agospeedo: Add simple logos to the installer.
Werner Koch [Wed, 19 Nov 2014 09:34:32 +0000 (10:34 +0100)]
speedo: Add simple logos to the installer.

* build-aux/speedo/w32/README.txt: Include GnuPG Readme.
* build-aux/speedo/w32/gnupg-logo-150x57.bmp: New.
* build-aux/speedo/w32/gnupg-logo-164x314.bmp: New.
* build-aux/speedo/w32/inst.nsi: Add logos.
* build-aux/speedo.mk ($(bdir)/NEWS.tmp): Extract news items.
--

The welcome page logo is basically a placeholder until someone has
created a pretty one.

4 years agospeedo: Add libadns to the Windows installer.
Werner Koch [Wed, 19 Nov 2014 09:34:32 +0000 (10:34 +0100)]
speedo: Add libadns to the Windows installer.

--

4 years agogpg: Fix hash detection for ECDSA.
Werner Koch [Wed, 19 Nov 2014 09:34:32 +0000 (10:34 +0100)]
gpg: Fix hash detection for ECDSA.

* g10/sign.c (sign_file): Use DSA or ECDSA and not DSA|EdDSA.
--

This error was introduced with
commit b7f8dec6325f1c80640f878ed3080bbc194fbc78
while separating EdDSA from ECDSA.

Found due to a related bug report from Brian Minton.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agoFix linker problem on OS X.
Werner Koch [Wed, 19 Nov 2014 09:34:32 +0000 (10:34 +0100)]
Fix linker problem on OS X.

* common/init.c (default_errsource): Move to the .data segmemt.
--

See mails starting at
 http://lists.gnupg.org/pipermail/gnupg-devel/2014-November/029089.html

4 years agogpg-connect-agent: Add convenience option --uiserver.
Werner Koch [Wed, 19 Nov 2014 09:34:32 +0000 (10:34 +0100)]
gpg-connect-agent: Add convenience option --uiserver.

4 years agopo: Update German translation.
Werner Koch [Wed, 19 Nov 2014 09:34:32 +0000 (10:34 +0100)]
po: Update German translation.

--

4 years agoComment typo fixes.
Werner Koch [Wed, 19 Nov 2014 09:31:49 +0000 (10:31 +0100)]
Comment typo fixes.

--

4 years agoAdd "gpgconf --kill dirmngr" and avoid useless launch before a kill.
Werner Koch [Wed, 19 Nov 2014 09:31:34 +0000 (10:31 +0100)]
Add "gpgconf --kill dirmngr" and avoid useless launch before a kill.

* common/asshelp.c (start_new_gpg_agent): Add arg autostart.  Change
all callers to use 1 for it.
(start_new_dirmngr): Ditto.
* tools/gpg-connect-agent.c: Add option --no-autostart.
(main): Default autostart to 1.
(start_agent): Implement no-autostart.
* tools/gpgconf-comp.c (gpg_agent_runtime_change): Use --no-autostart.
(scdaemon_runtime_change): Ditto.
(dirmngr_runtime_change): New.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agocommon: Change a string to a simlar one to ease translation.
Werner Koch [Wed, 19 Nov 2014 09:24:56 +0000 (10:24 +0100)]
common: Change a string to a simlar one to ease translation.

--

4 years agopo: Update Ukrainian translation.
Werner Koch [Mon, 17 Nov 2014 14:00:06 +0000 (15:00 +0100)]
po: Update Ukrainian translation.

--

4 years agopo: Copied missing translations from the 2.0 branch.
Werner Koch [Mon, 17 Nov 2014 13:38:59 +0000 (14:38 +0100)]
po: Copied missing translations from the 2.0 branch.

* po/LINGUAS: Add new translations.
--

Note that be.ru and pt_BR.po have not been copied because they have
way too less translated strings (74, 290 out of 2054).  The current
stats are:

  ca.po: 464 translated, 1024 fuzzy translations, 566 untranslated.
  cs.po: 1719 translated, 317 fuzzy translations, 18 untranslated.
  da.po: 1468 translated, 444 fuzzy translations, 142 untranslated.
  de.po: 2052 translated, 1 fuzzy translation, 1 untranslated message.
  el.po: 460 translated, 1025 fuzzy translations, 569 untranslated.
  eo.po: 331 translated, 1109 fuzzy translations, 614 untranslated.
  es.po: 1455 translated, 461 fuzzy translations, 138 untranslated.
  et.po: 460 translated, 1025 fuzzy translations, 569 untranslated.
  fi.po: 460 translated, 1025 fuzzy translations, 569 untranslated.
  fr.po: 2052 translated, 1 fuzzy translation, 1 untranslated message.
  gl.po: 458 translated, 1044 fuzzy translations, 552 untranslated.
  hu.po: 460 translated, 1025 fuzzy translations, 569 untranslated.
  id.po: 460 translated, 1025 fuzzy translations, 569 untranslated.
  it.po: 460 translated, 1025 fuzzy translations, 569 untranslated.
  ja.po: 2022 translated, 23 fuzzy translations, 9 untranslated.
  nb.po: 684 translated, 635 fuzzy translations, 735 untranslated.
  pl.po: 1469 translated, 443 fuzzy translations, 142 untranslated.
  pt.po: 400 translated, 1057 fuzzy translations, 597 untranslated.
  ro.po: 874 translated, 726 fuzzy translations, 454 untranslated.
  ru.po: 1257 translated, 478 fuzzy translations, 319 untranslated.
  sk.po: 460 translated, 1025 fuzzy translations, 569 untranslated.
  sv.po: 1452 translated, 458 fuzzy translations, 144 untranslated.
  tr.po: 1386 translated, 494 fuzzy translations, 174 untranslated.
  uk.po: 2016 translated, 27 fuzzy translations, 11 untranslated.
  zh_CN.po: 927 translated, 690 fuzzy translations, 437 untranslated.
  zh_TW.po: 1471 translated, 447 fuzzy translations, 136 untranslated.

4 years agopo: Update Japanese Translation.
NIIBE Yutaka [Tue, 18 Nov 2014 04:03:23 +0000 (13:03 +0900)]
po: Update Japanese Translation.

--

Fixing previous commit.

4 years agopo: Update Japanese Translation.
NIIBE Yutaka [Tue, 18 Nov 2014 03:01:22 +0000 (12:01 +0900)]
po: Update Japanese Translation.

--

4 years agogpg: Fix a NULL-deref for invalid input data.
Werner Koch [Mon, 17 Nov 2014 12:08:23 +0000 (13:08 +0100)]
gpg: Fix a NULL-deref for invalid input data.

* g10/mainproc.c (proc_encrypted): Take care of canceled passpharse
entry.
--

GnuPG-bug-id: 1761
Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agospeedo: Install -dev files for the libraries.
Werner Koch [Thu, 13 Nov 2014 18:23:17 +0000 (19:23 +0100)]
speedo: Install -dev files for the libraries.

--

4 years agopo: Auto-update.
Werner Koch [Thu, 13 Nov 2014 16:51:09 +0000 (17:51 +0100)]
po: Auto-update.

--

4 years agogpg: Make the use of "--verify FILE" for detached sigs harder.
Werner Koch [Thu, 13 Nov 2014 16:39:31 +0000 (17:39 +0100)]
gpg: Make the use of "--verify FILE" for detached sigs harder.

* g10/openfile.c (open_sigfile): Factor some code out to ...
(get_matching_datafile): new function.
* g10/plaintext.c (hash_datafiles): Do not try to find matching file
in batch mode.
* g10/mainproc.c (check_sig_and_print): Print a warning if a possibly
matching data file is not used by a standard signatures.
--

Allowing to use the abbreviated form for detached signatures is a long
standing bug which has only been noticed by the public with the
release of 2.1.0.  :-(

What we do is to remove the ability to check detached signature in
--batch using the one file abbreviated mode.  This should exhibit
problems in scripts which use this insecure practice.  We also print a
warning if a matching data file exists but was not considered because
the detached signature was actually a standard signature:

  gpgv: Good signature from "Werner Koch (dist sig)"
  gpgv: WARNING: not a detached signature; \
  file 'gnupg-2.1.0.tar.bz2' was NOT verified!

We can only print a warning because it is possible that a standard
signature is indeed to be verified but by coincidence a file with a
matching name is stored alongside the standard signature.

Reported-by: Simon Nicolussi (to gnupg-users on Nov 7)
Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Fix a missing LF in debug output.
Werner Koch [Thu, 13 Nov 2014 16:01:17 +0000 (17:01 +0100)]
gpg: Fix a missing LF in debug output.

* g10/kbnode.c (dump_kbnode): Print a LF.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Re-indent two files.
Werner Koch [Thu, 13 Nov 2014 12:00:46 +0000 (13:00 +0100)]
gpg: Re-indent two files.

--

4 years agogpg: Remove PGP-2 related cruft.
Werner Koch [Thu, 13 Nov 2014 11:01:42 +0000 (12:01 +0100)]
gpg: Remove PGP-2 related cruft.

* g10/armor.c (parse_hash_header,carmor_filter): Ignore MD5 in hash
header.
(fake_packet): Remove pgp-2 workaround for white space stripping.
* g10/filter.h (armor_filter_context_t): Remove field pgp2mode.
* g10/options.h (opt): Remove field pgp2_workarounds.
* g10/gpg.c (main): Do not set this field.
* g10/gpgv.c (main): Ditto.
* g10/mainproc.c (proc_encrypted): Use SHA-1 as fallback s2k hash
  algo.  Using MD5 here is useless.
(proc_plaintext): Remove PGP-2 related woraround
(proc_tree): Remove another workaround but keep the one for PGP-5.
--

The removed code was either not anymore used or its use would have
caused an error message later anyway.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Improve perceived speed of secret key listings.
Werner Koch [Wed, 12 Nov 2014 11:41:20 +0000 (12:41 +0100)]
gpg: Improve perceived speed of secret key listings.

* g10/keylist.c (list_keyblock): Flush stdout for secret keys.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Fix regression in --refresh-keys
Werner Koch [Wed, 12 Nov 2014 11:14:32 +0000 (12:14 +0100)]
gpg: Fix regression in --refresh-keys

* g10/keyserver.c (keyserver_get): Factor all code out to ...
(keyserver_get_chunk): new.  Extimate line length.
(keyserver_get): Split up requests into chunks.
--

Note that refreshing all keys still requires way to much memory
because we build an in-memory list of all keys first.  It is required
to first get a list of all keys to avoid conflicts while updating the
key store in the process of receiving keys.  A better strategy would
be a background process and tracking the last update in the key store.

GnuPG-bug-id: 1755
Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Add import options "keep-ownertrust".
Werner Koch [Wed, 12 Nov 2014 08:56:40 +0000 (09:56 +0100)]
gpg: Add import options "keep-ownertrust".

* g10/options.h (IMPORT_KEEP_OWNERTTRUST): New.
* g10/import.c (parse_import_options): Add "keep-ownertrust".
(import_one): Act upon new option.
--

This option is in particular useful to convert from a pubring.gpg to
the new pubring.kbx in GnuPG 2.1 or vice versa:

gpg1 --export | gpg2 --import-options keep-ownertrust --import

4 years agoRemove use of gnulib (part 2)
Werner Koch [Tue, 11 Nov 2014 14:14:31 +0000 (15:14 +0100)]
Remove use of gnulib (part 2)

* configure.ac (strpbrk): Add to AC_CHECK_FUNCS.
(gl_EARLY): Remove.
* common/stringhelp.c (strpbrk) [!HAVE_STRPBRK]: New.
* common/sysutils.c (gnupg_mkdtemp): New.  Based on code from
glibc-2.6.
(gnupg_setenv): Rewrite.
(gnupg_unsetenv): Rewrite.
* g10/exec.c: Include sysutils.h and replace mkdtemp by gnupg_mkdtemp.
* g13/be-encfs.c: Ditto.
* g13/mount.c: Ditto.
* tools/symcryptrun.c (confucius_mktmpdir): Ditto.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agoRemove use of gnulib (part 1)
Werner Koch [Tue, 11 Nov 2014 09:13:10 +0000 (10:13 +0100)]
Remove use of gnulib (part 1)

* gl/: Remove entire tree.
* configure.ac: Remove gnulib tests and the gl/ Makefile.
(setenv): Add to AC_CHECK_FUNCS.
* autogen.rc (extra_aclocal_flags): Set to empty.
* Makefile.am (ACLOCAL_AMFLAGS): Remove -I gl/m4
(SUBDIRS): Remove gl/.
* agent/Makefile.am (common_libs): Remove ../gl/gnulib.a
* common/Makefile.am (t_common_ldadd): Ditto.
* dirmngr/Makefile.am (dirmngr_LDADD): Ditto.
(dirmngr_ldap_LDADD, dirmngr_client_LDADD): Ditto.
* g10/Makefile.am (needed_libs): Ditto.
* g13/Makefile.am (g13_LDADD): Ditto.
* kbx/Makefile.am (kbxutil_LDADD): Ditto.
($(PROGRAMS)): Ditto.
* scd/Makefile.am (scdaemon_LDADD): Ditto.
* sm/Makefile.am (common_libs): Ditto.
* tools/Makefile.am (common_libs, commonpth_libs): Ditto.

* agent/gpg-agent.c: Remove "mkdtemp.h"
* g10/exec.c: Ditto.
* scd/scdaemon.c: Ditto.
* tools/symcryptrun.c: Ditto.
* common/sysutils.c: Remove "setenv.h"

* common/t-timestuff.c: Use putenv if setenv is not available.
--

gnulib has always been a cause of trouble in GnuPG because we used
only a very few functions and the complex include machinery of gnulib
is quite complex and the cause for many build problems for example on
OS X.  This is not gnulib's fault but due to our limited use of gnulib
and that we only rarely update the gnulib code to avoid regressions.

In part two we will address the functions

 mkdtemp
 setenv
 unsetenv
 strpbrk

which may bot be implemented on all platforms.  They are not required
on a libc based system.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Remove warning message for non-implemented search modes.
Werner Koch [Fri, 7 Nov 2014 17:42:37 +0000 (18:42 +0100)]
gpg: Remove warning message for non-implemented search modes.

* kbx/keybox-search.c (keybox_search): Silently ignore.
* doc/specify-user-id.texi: Docuement '@", '+', and '.' search
prefixes.

4 years agow32: Fix http access module.
Werner Koch [Fri, 7 Nov 2014 17:21:50 +0000 (18:21 +0100)]
w32: Fix http access module.

* common/http.c (write_server) [W32]: Rework to use send() instead of
write even when build with npth.
(cookie_read) [W32]: Rework to use recv() instead of read even when
build with npth.

4 years agobuild: Add method to use a custom swdb.lst and use adns with Windows.
Werner Koch [Fri, 7 Nov 2014 17:20:06 +0000 (18:20 +0100)]
build: Add method to use a custom swdb.lst and use adns with Windows.

* build-aux/getswdb.sh: Add option --skip-verify.
* build-aux/speedo.mk: Add config var CUSTOM_SWDB.  Tage adns version
from swdb and build for Windows with adns.

4 years agobuild: Improve test for ADNS
Werner Koch [Fri, 7 Nov 2014 17:17:52 +0000 (18:17 +0100)]
build: Improve test for ADNS

* configure.ac <adns>: Use adns_free as probe function for libadns.
(HAVE_ADNS_FREE): Remove bogus tests to set this and remove the macro.
(ADNSLIBS): Do not ac_subst - it is only used within configure.
--

adns_free is required on Windows anyway (for robustness reasons) and
it has been around for so long now that we do not need a separate
test.  An upstream adns 1.5 has meanwhile been release but I doubt that
this has the required Windows code - and it is not libtool based
anyway.

4 years agodoc: Add announce text for 2.1
Werner Koch [Thu, 6 Nov 2014 09:03:39 +0000 (10:03 +0100)]
doc: Add announce text for 2.1

--

4 years agospeedo: Append the date to the Windows installer.
Werner Koch [Wed, 5 Nov 2014 20:40:52 +0000 (21:40 +0100)]
speedo: Append the date to the Windows installer.

* build-aux/speedo.mk (BUILD_DATESTR): New.
(dist-source, installer): Use it.

4 years agoPost release updates.
Werner Koch [Wed, 5 Nov 2014 15:46:52 +0000 (16:46 +0100)]
Post release updates.

--

4 years agoRelease 2.1.0 gnupg-2.1.0
Werner Koch [Wed, 5 Nov 2014 14:29:58 +0000 (15:29 +0100)]
Release 2.1.0

4 years agospeedo: Do not not assume GNU tar.
Werner Koch [Wed, 5 Nov 2014 07:56:52 +0000 (08:56 +0100)]
speedo: Do not not assume GNU tar.

--
Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agobuild: Update README.maint.
Werner Koch [Wed, 5 Nov 2014 07:42:56 +0000 (08:42 +0100)]
build: Update README.maint.

--
Also fixed some typos.

4 years agopo: Auto update.
Werner Koch [Wed, 5 Nov 2014 07:27:47 +0000 (08:27 +0100)]
po: Auto update.

--

Due to removed strings.

4 years agoAvoid sign extension when shifting the MSB.
Werner Koch [Wed, 5 Nov 2014 07:23:15 +0000 (08:23 +0100)]
Avoid sign extension when shifting the MSB.

* sm/fingerprint.c (gpgsm_get_short_fingerprint): Cast MSB before
shifting.
* g10/build-packet.c (delete_sig_subpkt): Ditto.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agoRemove all expired common CA certificates.
Werner Koch [Tue, 4 Nov 2014 20:47:03 +0000 (21:47 +0100)]
Remove all expired common CA certificates.

* doc/com-certs.pem: Remove certifciates.
--

They might be useful for the chain validation mode but I doubt that it
is used often enough to justify having all these expired certificates
in the store.

4 years agoTypo fixes.
Werner Koch [Tue, 4 Nov 2014 20:29:58 +0000 (21:29 +0100)]
Typo fixes.

--

4 years agodoc: Added What's new in 2.1 article.
Werner Koch [Tue, 4 Nov 2014 20:29:45 +0000 (21:29 +0100)]
doc: Added What's new in 2.1 article.

--

4 years agoAdd open card manufacturer 0x0008.
Werner Koch [Tue, 4 Nov 2014 15:32:30 +0000 (16:32 +0100)]
Add open card manufacturer 0x0008.

--

4 years agoRemove note about estream from AUTHORS.
Werner Koch [Tue, 4 Nov 2014 15:31:44 +0000 (16:31 +0100)]
Remove note about estream from AUTHORS.

--

estream has been moved to libgpg-error.

4 years agoChange a couple of files to use abbreviated copyright notes.
Werner Koch [Tue, 4 Nov 2014 15:28:03 +0000 (16:28 +0100)]
Change a couple of files to use abbreviated copyright notes.

--

Also fixed some of my own copyright notices due to the termination of
my assignment.  The one displayed by --version is kept at FSF because
we had contributors in 2014 with FSF assignments and it gives the FSF
some visibility.

4 years agogpg: Print use --full-gen-key note using the installed name of gpg.
Werner Koch [Tue, 4 Nov 2014 09:52:46 +0000 (10:52 +0100)]
gpg: Print use --full-gen-key note using the installed name of gpg.

--

4 years agopo: Update French translation
David Prévot [Tue, 2 Sep 2014 02:53:18 +0000 (22:53 -0400)]
po: Update French translation

--
Proofread-By: Frédéric Marchal <fmarchal@perso.be>
Proofread-By: appzer0 <appzer0@free.fr>
Proofread-By: Jean-Philippe Guérard
              <jean-philippe.guerard@tigreraye.org>

4 years agogpg: Avoid extra pinentries for each subkey in --export-secret-keys.
Werner Koch [Sun, 2 Nov 2014 16:51:30 +0000 (17:51 +0100)]
gpg: Avoid extra pinentries for each subkey in --export-secret-keys.

* agent/command.c (cmd_export_key): Actually implement the cache_nonce
feature.
* g10/export.c (do_export_stream): Make use of a cache_nonce.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Fix endless loop in keylisting with fingerprint.
Werner Koch [Sun, 2 Nov 2014 15:36:40 +0000 (16:36 +0100)]
gpg: Fix endless loop in keylisting with fingerprint.

* g10/getkey.c (getkey_next): Disable cache.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Minor cleanup for key listing related code.
Werner Koch [Sun, 2 Nov 2014 15:31:30 +0000 (16:31 +0100)]
gpg: Minor cleanup for key listing related code.

* g10/getkey.c (get_pubkey_next): Divert to getkey_next.
(get_pubkey_end): Move code to getkey_end.
* g10/keydb.c (keydb_search_reset): Add a debug statement.
(dump_search_desc): Add arg HD and print the handle.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Do not show an useless passphrase prompt in batch mode.
Werner Koch [Sun, 2 Nov 2014 14:43:52 +0000 (15:43 +0100)]
gpg: Do not show an useless passphrase prompt in batch mode.

* g10/keygen.c: Remove unused PASSPHRASE related code.
(proc_parameter_file): Remove useless asking for a passphrase in batch
mode.
--

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agospeedo: Use --disable-ntbtls for gnupg for now.
Werner Koch [Fri, 31 Oct 2014 20:33:18 +0000 (21:33 +0100)]
speedo: Use --disable-ntbtls for gnupg for now.

--

4 years agogpg: Remove superfluous check for Libgcrypt >= 1.4.0.
Werner Koch [Fri, 31 Oct 2014 13:47:02 +0000 (14:47 +0100)]
gpg: Remove superfluous check for Libgcrypt >= 1.4.0.

* g10/gpg.c (main): Remove check.
--

We require 1.6.0 anyway.

4 years agoAdd more signing keys.
Werner Koch [Fri, 31 Oct 2014 13:21:34 +0000 (14:21 +0100)]
Add more signing keys.

--
The keys which may be used to sign GnuPG packages are:

  rsa2048/4F25E3B6 2011-01-12 [expires: 2019-12-31]
  D869 2123 C406 5DEA 5E0F  3AB5 249B 39D2 4F25 E3B6
  Werner Koch (dist sig)

  rsa2048/E0856959 2014-10-29 [expires: 2019-12-31]
  46CC 7308 65BB 5C78 EBAB  ADCF 0437 6F3E E085 6959
  David Shaw (GnuPG Release Signing Key) <dshaw@jabberwocky.com>

  rsa2048/33BD3F06 2014-10-29 [expires: 2016-10-28]
  031E C253 6E58 0D8E A286  A9F2 2071 B08A 33BD 3F06
  NIIBE Yutaka (GnuPG Release Key) <gniibe@fsij.org>

  rsa2048/7EFD60D9 2014-10-19 [expires: 2020-12-31]
  D238 EA65 D64C 67ED 4C30  73F2 8A86 1B1C 7EFD 60D9
  Werner Koch (Release Signing Key)

These keys are all created and used on tokens.  7EFD60D9 is currently
not used but ready to replace 4F25E3B6 in case the former token break.

4 years agokbx: Let keydb_search skip unwanted blobs.
Werner Koch [Fri, 31 Oct 2014 11:15:34 +0000 (12:15 +0100)]
kbx: Let keydb_search skip unwanted blobs.

* kbx/keybox.h (keybox_blobtype_t): New.
* kbx/keybox-defs.h (BLOBTYPE_*): Replace by KEYBOX_BLOBTYPE_*.
* kbx/keybox-search.c (keybox_search): Add arg want_blobtype and skip
non-matching blobs.
* sm/keydb.c (keydb_search): Pass KEYBOX_BLOBTYPE_X509 to keybox_search.
* g10/keydb.c (keydb_search): Pass KEYBOX_BLOBTYPE_PGP to keybox_search.
--

Without this fix a listing of all keys would fail because the wrong
blob type would be returned for the gpg or gpgsm.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Fix --rebuild-keydb-caches.
Werner Koch [Fri, 31 Oct 2014 09:29:02 +0000 (10:29 +0100)]
gpg: Fix --rebuild-keydb-caches.

* g10/parse-packet.c (parse_key): Store even unsupported packet
versions.
* g10/keyring.c (keyring_rebuild_cache): Do not copy keys with
versions less than 4.
--

That function, which is implicitly called while checking the keydb, led
to corruption of v3 key packets in the keyring which would later spit
out "packet(6)too short" messages.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Fix testing for secret key availability.
Werner Koch [Fri, 31 Oct 2014 08:22:47 +0000 (09:22 +0100)]
gpg: Fix testing for secret key availability.

* g10/getkey.c (have_secret_key_with_kid): Do not change the search
mode.
--

The search mode was accidentally changed to search-next after finding
the first keyblock.  The intention was to look for a duplicate keyid
in the keydb which works by not doing a keydb_search_reset.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Remove commented code.
Werner Koch [Fri, 31 Oct 2014 08:14:03 +0000 (09:14 +0100)]
gpg: Remove commented code.

--

4 years agobuild: Avoid distributing backup files etc.
Werner Koch [Fri, 31 Oct 2014 07:04:38 +0000 (08:04 +0100)]
build: Avoid distributing backup files etc.

* Makefile.am (EXTRA_DIST): Do not include directories.
--

The make dist rules uses "cp -R" for each listed file.  Thus all cruft
from a directory is also put into the tarball.  Obviously we do not
want this.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agotests: Speed up the genkey1024.test by using not so strong random.
Werner Koch [Thu, 30 Oct 2014 08:55:51 +0000 (09:55 +0100)]
tests: Speed up the genkey1024.test by using not so strong random.

* agent/gpg-agent.c (oDebugQuickRandom): New.
(opts): New option --debug-quick-random.
(main): Use new option.
* common/asshelp.c (start_new_gpg_agent): Add hack to pass an
additional argument for the agent name.
* tests/openpgp/defs.inc: Pass --debug-quick-random to the gpg-agent
starting parameters.
* tests/openpgp/version.test: Ditto.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agopo: Add a new German translation
Werner Koch [Wed, 29 Oct 2014 16:10:03 +0000 (17:10 +0100)]
po: Add a new German translation

--
Also fixed a typo in the docs.

4 years agocommon: Check option arguments for a valid range.
Werner Koch [Wed, 29 Oct 2014 16:07:51 +0000 (17:07 +0100)]
common: Check option arguments for a valid range.

* common/argparse.h (ARGPARSE_INVALID_ARG): New.
* common/argparse.c: Include limits h and errno.h.
(initialize): Add error strings for new error constant.
(set_opt_arg): Add range checking.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agoFix stdint.h problem for Apple.
Werner Koch [Wed, 29 Oct 2014 14:41:28 +0000 (15:41 +0100)]
Fix stdint.h problem for Apple.

* gl/stdint_.h [__APPLE__]: Include hack.
--

Patch suggested by Patrick Brunschwig.

4 years agospeedo: Fixes for native build.
Werner Koch [Mon, 27 Oct 2014 17:02:46 +0000 (18:02 +0100)]
speedo: Fixes for native build.

* build-aux/speedo.mk (TARGETOS): Init with empty string.
(speedo_pkg_gnupg_configure): Use --enable-gpg2-is-gpg only for w32.
(INST_VERSION, INST_PROD_VERSION): Create only for w32.

4 years agopo: Fixed one wrong German string.
Werner Koch [Mon, 27 Oct 2014 13:12:51 +0000 (14:12 +0100)]
po: Fixed one wrong German string.

--

4 years agodoc: Re-formated some NEWS entries and added update notes to some.
Werner Koch [Sun, 26 Oct 2014 19:07:16 +0000 (20:07 +0100)]
doc: Re-formated some NEWS entries and added update notes to some.

--

4 years agoUpdate NEWS. gnupg-2.1.0-beta895
Werner Koch [Sun, 26 Oct 2014 11:48:34 +0000 (12:48 +0100)]
Update NEWS.

--

4 years agopo: Auto update
Werner Koch [Sun, 26 Oct 2014 11:40:30 +0000 (12:40 +0100)]
po: Auto update

--

4 years agopo: Translate new string to German.
Werner Koch [Sun, 26 Oct 2014 11:40:11 +0000 (12:40 +0100)]
po: Translate new string to German.

--

4 years agoagent: Support pinentries with integrated repeat passphrase feature.
Werner Koch [Fri, 24 Oct 2014 14:20:20 +0000 (16:20 +0200)]
agent: Support pinentries with integrated repeat passphrase feature.

* agent/agent.h (struct pin_entry_info_s): Add fields repeat_okay and
with_repeat.
* agent/call-pinentry.c (close_button_status_cb): Rewrite and check
for PIN_REPEAT.  Change users to check only the relevant bit.
(agent_askpin): Support repeat logic of new Pinentries.

* agent/command-ssh.c (ssh_identity_register): Use the new repeat
feature.
* agent/genkey.c (agent_ask_new_passphrase): Ditto.

--

If we need to confirm a passphrase entry (e.g. for new passphrase) we
set a flag into the pinentry info block.  The we try to use the new
pinentry command SETREPEATERROR; if that fails, we continue as usual.
If that succeeds we ask the pinentry to show the repeat (confirmation)
prompt and on successful return we set another flag in the pinentry
info block so that the caller can skip its own confirmation check. A
new status line from the pinentry indicates that the feature is
actually supported (it may not be supported on certain systems for
example when using the ncurses backend).

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agomisc: Add logo as used with PayPal.
Werner Koch [Fri, 24 Oct 2014 07:39:22 +0000 (09:39 +0200)]
misc: Add logo as used with PayPal.

--

4 years agogpg: Silence "packet with obsolete versoin" warnings.
Werner Koch [Sun, 19 Oct 2014 12:17:23 +0000 (14:17 +0200)]
gpg: Silence "packet with obsolete versoin" warnings.

* g10/parse-packet.c (parse_key): Print warning only in very verbose
mode.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agogpg: Make card key generation work again.
Werner Koch [Sun, 19 Oct 2014 12:09:04 +0000 (14:09 +0200)]
gpg: Make card key generation work again.

* g10/call-agent.c (agent_scd_learn): Rename from agent_learn.
(agent_learn): New.
* g10/keygen.c (gen_card_key): Call new agent-learn.
--

Without a shadow key we can't create the self-signatures.  Thus we
need to issue the learn command after each key generation.

Signed-off-by: Werner Koch <wk@gnupg.org>
4 years agodirmngr: Allow building without LDAP support.
Werner Koch [Fri, 17 Oct 2014 13:59:45 +0000 (15:59 +0200)]
dirmngr: Allow building without LDAP support.

* configure.ac: Add option --disable-ldap.
(USE_LDAP): New ac_define and am_conditional.
* dirmngr/Makefile.am: Take care of USE_LDAP.
* dirmngr/dirmngr.c (!USE_LDAP): Make all ldap options dummy options
and do not call any ldap function.
* dirmngr/server.c (!USE_LDAP): Do not call any ldap function.
* dirmngr/crlfetch.c (!USE_LDAP): Ditto.

Signed-off-by: Werner Koch <wk@gnupg.org>