-*- outline -*-
-
* src/base64
** Make parsing more robust
Currently we don't cope with overlong lines in the best way.
* sm/certchain.c
** When a certificate chain was sucessfully verified, make ephemeral certs used in this chain permanent.
-** figure out how to auto retrieve a key by serialno+issuer.
- Dirmngr is currently not able to parse more than the CN.
-* sm/certlist.c
-** ocspSigning usage is not fully implemented
- We should review the entire CRL and OCSP validation system.
* sm/decrypt.c
** replace leading zero in integer hack by a cleaner solution
** mark all unimplemented commands and options.
** Print a hint when MD2 is the cause for a problem.
** Implement --default-key
-** Using --export-secret-key-p12 with a non-pth agent
- This leads to a lockup because gpgsm is still accessing the agent
- while gpg-protect-tool wants to pop up the pinentry. Solution is
- to release the connection. This is not trivial, thus we are going
- to do that while changing gpgsm to allow concurrent operations.
** support the anyPolicy semantic
** Check that we are really following the verification procedures in rfc3280.
+** Implement a --card-status command.
+ This is useful to check whether a card is supported at all.
+
* sm/keydb.c
** Check file permissions
** Remove the inter-module dependencies between gpgsm and keybox
** Add an source_of_key field
-* agent/gpg-agent.c
-** A SIGHUP should also restart the scdaemon
- But do this only after all connections terminated. As of now we
- only send a RESET.
-
* agent/command.c
** Make sure that secure memory is used where appropriate
** Don't use stdio to return results.
** Support DSA
-* agent/divert-scd.c
- Remove the agent_reset_scd kludge.
-
* Move pkcs-1 encoding into libgcrypt.
-* Use a MAC to protect some files.
+* Use a MAC to protect sensitive files.
+ The problem here is that we need yet another key and it is unlikely
+ that users are willing to remember that key too. It is possible to
+ do this with a smartcard, though.
* sm/export.c
** Return an error code or a status info per user ID.
-* Where is http.c, regcomp.c, srv.c, w32reg.c ?
-
-* scd/sc-investigate
-** Enhance with card compatibility check
-
+* scd/tlv.c
+ The parse_sexp fucntion should not go into this file. Check whether
+ we can change all S-expression handling code to make use of this
+ function.
+
+* scd
+** Application context vs. reader slot
+ We have 2 concurrent method of tracking whether a read is in use:
+ Using the session_list in command.c and the lock_table in app.c. IT
+ would be better to do this just at one place. First we need to see
+ how we can support cards with multiple applications.
+
* tests
** Makefile.am
We use printf(1) to setup the library path, this is not portable.
* doc/
** Explain how to setup a root CA key as trusted
** Explain how trustlist.txt might be managed.
-** Document watchgnupg
** Write a script to generate man pages from texi.
+ In progress (yatm)
-* Requirements by the BSI
-** Support authorityKeyIdentifier.keyIdentifier
- This needs support in libksba/src/cert.c as well as in sm/*.c.
- Need test certs as well. Same goes for CRL authorityKeyIdentifier.
-** For pkcs#10 request header.
- We use "NEW CERTIFICATE REQUEST" the specs say "CERTIFICATE
- REQUEST" should be used. However it seems that their CA software
- is also able to use our header. Binary pkcs#10 request are not
- allowed.
+* Windows port
+** gpgsm's LISTKEYS does not yet work
+ Fix is to change everything to libestream
+** Signals are not support
+ This means we can't reread a configuration
+** No card status notifications.
-** Dirmngr: name subordination (nameRelativeToCRLIssuer)
- is not yet supported by Dirmngr.
-** Dirmngr: CRL DP URI
- The CRL DP shall use an URI for LDAP without a host name. The host
- name shall be looked by using the DN in the URI. We don't implement
- this yet. Solution is to have a mapping DN->host in our ldapservers
- configuration file.
+* sm/
+** --include-certs is as of now still a dummy command line option
projects / gnupg.git / blobdiff