summaryrefslogtreecommitdiff
path: root/security/gnupg2
AgeCommit message (Collapse)AuthorFilesLines
2022-11-23massive revision bump after textproc/icu updateadam1-2/+2
2022-10-26*: bump PKGREVISION for libunistring shlib major bumpwiz1-1/+2
2022-10-17gnupg2: add new patchadam1-0/+16
2022-10-17gnupg2: updated to 2.2.40adam2-6/+7
Noteworthy changes in version 2.2.40 (2022-10-10) ------------------------------------------------- * gpg: Do not consider unknown public keys as non-compliant while decrypting. * gpg: Avoid to emit a compliance mode line if Libgcrypt is non-compliant. * gpg: In de-vs mode use AES-128 instead of 3-DES as implicit preference. * gpgsm: Fix reporting of bad passphrase error during PKCS-11 import. * dirmngr: Fix CRL Distribution Point fallback to other schemes. * dirmngr: New LDAP server flag "areconly" (A-record-only). * dirmngr: Fix upload of multiple keys for an LDAP server specified using the colon format. * dirmngr: Use LDAP schema v2 when a Base DN is specified. * wkd: New command --mirror for gpg-wks-client.
2022-09-27gnupg2: updated to 2.2.39adam2-6/+6
Noteworthy changes in version 2.2.39 (2022-09-02) ------------------------------------------------- * agent: Fix regression in 2.2.37 related to non-extended format private keys. Noteworthy changes in version 2.2.38 (2022-09-01) ------------------------------------------------- * gpg: Make --require-compliance work for sign+encrypt. * gpg: Fix an encoding problem under Windows in the printed timezone. * gpg: Emit a FAILURE status for --require-compliance errors. * dirmngr: Avoid caching expired certificates.
2022-08-31gnupg2: updated to 2.2.37adam3-7/+8
Noteworthy changes in version 2.2.37 (2022-08-24) ------------------------------------------------- * gpg: In de-vs mode use SHA-256 instead of SHA-1 as implicit preference. [T6043] * gpg: Actually show symmetric+pubkey encrypted data as de-vs compliant. Add extra compliance checks for symkey_enc packets. [T6119] * gpg: Request keygrip of key to be added via command-fd interface. [T5771] * gpg: Look up user ID to revoke by UID hash. [T5936] * gpg: Fix wrong error message for "keytocard". [T6122] * gpg: --card-status shows the application type for non-openpgp cards again. [rG8e393e2592] * gpg: The options --auto-key-import and --include-key-block are again listed by gpgconf. [T6138] * gpgsm: New option --compatibility-flags. [rG77b6896f7a] * agent: New options --no-user-trustlist and --sys-trustlist-name. [T5990] * agent: Track and update the Display-S/N of cards so that the "please insert card" prompt may now show more information. Use "gpg --card-status" to update stored card meta data. [T6135] * scd:openpgp: Fix problem with ECC algorithm attributes on Yubikeys. [rG225c66f13b87] * scd:openpgp: Fix problem with Yubikey 5.4 firmware. [T6070] * dirmngr: Ask keyservers to provide the key fingerprints. [T5741] * ssh: Allow authentication as used by OpenSSH's PQ crypto support. [T5935] * wkd: Fix path traversal attack in gpg-wks-server. Add the mail address to the pending request data. [rGc1489ca0e1, T6098] * gpgconf: Improve registry dumping. [rG6bc9592318] * Silence warnings from AllowSetForegroundWindow. [rG6583abedf3]
2022-08-09*: Remove hardcoded -liconv / -lintl on SunOS.jperkin1-2/+2
This is now handled centrally via OPSYS_EXPLICIT_LIBDEPS support in libiconv and gettext-lib.
2022-07-12gnupg2: updated to 2.2.36adam3-48/+6
Noteworthy changes in version 2.2.36 (2022-07-06) ------------------------------------------------- * g10: Fix possibly garbled status messages in NOTATION_DATA. This bug could trick GPGME and other parsers to accept faked status lines. [T6027, CVE-2022-34903] * gpg: Handle leading zeroes in Ed25519 private keys and reverse change regarding Ed25519 SOS encoding as introduced with 2.2.34. [T5120] * gpg: Allow Unicode file names for iobuf_cancel under Windows. * gpgsm: Improve pkcs#12 import. [T6037,T5793,T4921,T4757] * scd,p15: Fix reading certificates w/o length info. * scd,p15: Improve the displayed S/N for Technology Nexus cards. * scd,openpgp: Add workaround for ECC attribute on Yubikey. [T5963] * scd: Fix use of SCardListReaders for PC/SC. [T5979] * gpgconf: New short options -X and -V. * Make sure to always set CONFIDENTIAL flag in Assuan.
2022-06-30gnupg2: fix possible security issuewiz3-2/+44
Per https://www.openwall.com/lists/oss-security/2022/06/30/1 using upstream patch. Bump PKGREVISION.
2022-04-26gnupg2: updated to 2.2.35adam2-7/+6
Noteworthy changes in version 2.2.35 (2022-04-25) ------------------------------------------------- * gpg,gpgsm: New option --require-compliance. * gpgtar: New option --with-log. * gpg: Threefold decryption speedup for large files. * gpgtar: Support file names longer than MAX_PATH. * scdaemon: Add support for GeNUA cards. * gpg: Allow decryption of symmetric encrypted data even for non-compliant cipher. * gpg: Avoid possible race condition in --edit-card/factory-reset. * gpg: Emit an ERROR status as hint for a bad passphrase. * gpg: Avoid NULL-ptr access due to corrupted packets. * gpgsm: Fix parsing of certain PKCS#12 files. * gpgtar: Use a pipe for decryption and thus avoid memory exhaustion. * scdaemon: Use extended mode for pkcs#15 already for rsa2048. * dirmngr: Make WKD lookups work for resolvers not handling SRV records. * dirmngr: Escape more characters in WKD requests. * gpgconf: Silence warnings from parsing the option files. * Improve removing of stale lockfiles under Unix.
2022-04-18revbump for textproc/icu updateadam1-1/+2
2022-02-16gnupg2: updated to 2.2.34adam2-7/+6
Noteworthy changes in version 2.2.34 (2022-02-07) ------------------------------------------------- * gpgconf: Backport the improved option reading and writing code from 2.3. [rG7a3a1ef370,T4788] * gpgconf: Do not list ignored options and mark forced options as read-only. [T5732] * gpgconf: Correctly show registry entries with --show-configs. [T5724] * gpgconf: Add command aliases -L, -K, and -R. [rGf16c535eee] * gpgconf: Tweak the use of the ldapserver option. [T5801] * gpgconf: Make "--launch gpg-agent" work again. [rG5a7ed6dd8f] * gpg: Accept Ed25519 private keys in modernized encoding. [T5120] * gpg: Fix adding the list of ultimate trusted keys. [T5742] * gpgsm: New option --ignore-cert-with-oid. [rGbcf446b70c] * dirmngr: Avoid initial delay on the first keyserver access in presence of --no-use-tor. [rGdde88897e2] * scdaemon: Also prefer Yubikeys if no reader port is given. [rG38c666ec3f] * agent: Make missing strings translatable and update German and Japanese translations. [T4777] * ssh: Fix adding an ed25519 key with a zero length comment. [T5794] * gpgtar: Create and handle extended headers to support long file names. [T5754] * Fix the creation of socket directories under Windows for non-ascii account names. [rG7d1215cb9c] * Improve the registry HKCU->HKLM fallback. [rG96db487a4d] * Prettify the --help output of most commands.
2022-01-19gnupg2: Fix building on Solaris 10nia1-2/+2
PR pkg/56638
2021-12-08revbump for icu and libffiadam1-1/+2
2021-12-02gnupg2: gmake is not required to build as of 2.2.33ryoon1-2/+2
2021-11-25gnupg2: Update to 2.2.33ryoon2-6/+6
Changelog: Noteworthy changes in version 2.2.33 (2021-11-23) ------------------------------------------------- * gpg: New option --min-rsa-length. [rG6ee01c1d26] * gpg: New option --forbid-gen-key. [rG985fb25c46] * gpg: New option --override-compliance-check. [T5655] * gpgconf: New command --show-configs. [rG8fe3f57643] * agent,dirmngr: New option --steal-socket. [rG6507c6ab10] * scd: Improve the selection of the default PC/SC reader. [T5644] * gpg: Fix printing of binary notations. [T5667] * gpg: Remove stale ultimately trusted keys from the trustdb. [T5685] * gpgsm: Detect circular chains in --list-chain. [rGc9343bec83] * gpgconf: Create the local option file even if the global file exists. [T5650] * dirmngr: Make reading resolv.conf more robust. [T5657] * gpg-wks-server: Fix created file permissions. [rGf54feb4470] * scd: Support longer data for ssh-agent authentication with openpgp cards. [T5682] * Support gpgconf.ctl for NetBSD and Solaris. [T5656,T5671] * Silence "Garbled console data" warning under Windows in most cases. * Silence warning about the rootdir under Unices w/o a mounted /proc file system. * Fix possible build problems about missing include files. [T5592] * i18n: Replace the term "PIN-Cache" by "Passswort-Cache" in the German translation. [rgf453d52e53] * i18n: Update the Russian translation. Release-info: https://dev.gnupg.org/T5641 See-also: gnupg-announce/2021q4/000467.html
2021-10-26security: Replace RMD160 checksums with BLAKE2s checksumsnia1-2/+2
All checksums have been double-checked against existing RMD160 and SHA512 hashes Unfetchable distfiles (fetched conditionally?): ./security/cyrus-sasl/distinfo cyrus-sasl-dedad73e5e7a75d01a5f3d5a6702ab8ccd2ff40d.patch.v2
2021-10-12gnupg2: updated to 2.2.32adam2-6/+6
Noteworthy changes in version 2.2.32 (2021-10-06) ------------------------------------------------- * dirmngr: Fix Let's Encrypt certificate chain validation. * dirmngr: New option --ignore-cert. * gpg: Fix --list-packets for AEAD packets with unknown key.
2021-10-07security: Remove SHA1 hashes for distfilesnia1-2/+1
2021-10-05gnupg2: updated to 2.2.31adam3-10/+9
Noteworthy changes in version 2.2.31 (2021-09-15) ------------------------------------------------- * agent: Fix a regression in GET_PASSPHRASE. * scd: Fix an assertion failure in close_pcsc_reader. * scd: Add support for PC/SC in "GETINFO reader_list". Noteworthy changes in version 2.2.30 (2021-08-26) ------------------------------------------------- * gpg: Extended gpg-check-pattern to support accept rules, conjunctions, and case-sensitive matching. * agent: New option --pinentry-formatted-passphrase. * agent: New option --check-sym-passphrase-pattern. * agent: Use the sysconfdir for the pattern files. * agent: Add "checkpin" inquiry for use by pinentry. * wkd: Fix client issue with leading or trailing spaces in user-ids. * Pass XDG_SESSION_TYPE and QT_QPA_PLATFORM envvars to Pinentry. * Under Windows use LOCAL_APPDATA for the socket directory. Noteworthy changes in version 2.2.29 (2021-07-04) ------------------------------------------------- * Fix regression in 2.2.28 for Yubikey NEO. * Change the default keyserver to keyserver.ubuntu.com. This is a temporary change due to the shutdown of the SKS keyserver pools. * gpg: Let --fetch-key return an exit code on failure. * dirmngr: Fix regression in KS_GET for mail address pattern. * Add fallback in case the Windows console can't cope with Unicode. * Improve initialization of SPR532 in the CCID driver and make the driver more robust. * Make test suite work in presence of a broken Libgcrypt installation. * Make configure option --disable-ldap work again. Noteworthy changes in version 2.2.28 (2021-06-10) ------------------------------------------------- * gpg: Auto import keys specified with --trusted-keys. * gpg: Allow decryption w/o public key but with correct card inserted. * gpg: Allow fingerprint based lookup with --locate-external-key. * gpg: Lookup a missing public key of the current card via LDAP. * gpg: New option --force-sign-key. * gpg: Use a more descriptive password prompt for symmetric decryption. * gpg: Do not use the self-sigs-only option for LDAP keyserver imports. * gpg: Keep temp files when opening images via xdg-open. * gpg: Fix mailbox based search via AKL keyserver method. * gpg: Fix sending an OpenPGP key with umlaut to an LDAP keyserver. * gpg: Allow ECDH with a smartcard returning only the x-coordinate. * gpgsm: New option --ldapserver as an alias for --keyserver. Note that configuring servers in gpgsm and gpg is deprecated; please use the dirmngr configuration options. * gpgsm: Support AES-GCM decryption. * gpgsm: Support decryption of password protected files. * gpgsm: Lock keyboxes also during a search to fix lockups on Windows. * agent: Skip unknown unknown ssh curves seen on cards. * scdaemon: New option --pcsc-shared. * scdaemon: Backport PKCS#15 card support from GnuPG 2.3 * scdaemon: Fix CCID driver for SCM SPR332/SPR532. * scdaemon: Fix possible PC/SC removed card problem. * scdaemon: Fix unblock PIN by a Reset Code with KDF. * scdaemon: Support compressed points. * scdaemon: Prettify S/N for Yubikeys and fix reading for early Yubikey 5 tokens. * dirmngr: New option --ldapserver to avoid the need for the separate dirmngr_ldapservers.conf file. * dirmngr: The dirmngr_ldap wrapper has been rewritten to properly support ldap-over-tls and starttls for X.509 certificates and CRLs. * dirmngr: OpenPGP LDAP keyservers may now also be configured using the same syntax as used for X.509 and CRL LDAP servers. This avoids the former cumbersome quoting rules and adds a flexible set of flags to control the connection. * dirmngr: The "ldaps" scheme of an OpenPGP keyserver URL is now interpreted as ldap-with-starttls on port 389. To use the non-standardized ldap-over-tls the new LDAP configuration method of the new attribute "gpgNtds" needs to be used. * dirmngr: Return the fingerprint as search result also for LDAP OpenPGP keyservers. This requires the modernized LDAP schema. * dirmngr: An OpenPGP LDAP search by a mailbox now ignores revoked keys. * gpgconf: Make runtime changes with non-default homedir work. * gpgconf: Do not translate an empty string to the PO file's meta data. * gpgconf: Fix argv overflow if --homedir is used. * gpgconf: Return a new pseudo option "compliance_de_vs". * gpgtar: Fix file size computation under Windows. * Full Unicode support for the Windows command line. * Fix problem with Windows Job objects and auto start of our daemons. * i18n: In German always use "Passwort" instead of "Passphrase" in prompts.
2021-09-29revbump for boost-libsadam1-2/+2
2021-04-21revbump for boost-libsadam1-2/+2
2021-04-21revbump for textproc/icuadam1-1/+2
2021-01-12gnupg2: updated to 2.2.27adam2-7/+7
Noteworthy changes in version 2.2.27 (2021-01-11) ------------------------------------------------- * gpg: Fix regression in 2.2.24 for gnupg_remove function under Windows. * gpgconf: Fix case with neither local nor global gpg.conf. * gpgconf: Fix description of two new options. * Build Windows installer without timestamps. Note that the Authenticode signatures still carry a timestamp. Release-info: https://dev.gnupg.org/T5234 See-also: gnupg-announce/2021q1/000452.html Noteworthy changes in version 2.2.26 (2020-12-21) ------------------------------------------------- * gpg: New AKL method "ntds". * gpg: Fix --trusted-key with fingerprint arg. * scd: Fix writing of ECC keys to an OpenPGP card. * scd: Make an USB error fix specific to SPR532 readers. * dirmngr: With new LDAP keyservers store the new attributes. Never store the useless pgpSignerID. Fix a long standing bug storing some keys on an ldap server. * dirmngr: Support the new Active Direcory LDAP schema for keyservers. * dirmngr: Allow LDAP OpenPGP searches via fingerprint. * dirmngr: Do not block other threads during keyserver LDAP calls. * Support global configuration files. * Fix the iconv fallback handling to UTF-8. Release-info: https://dev.gnupg.org/T5153 See-also: gnupg-announce/2020q4/000451.html
2020-12-03gnupg2: updated to 2.2.25adam2-7/+7
Noteworthy changes in version 2.2.25 * scd: Fix regression in 2.2.24 requiring gpg --card-status before signing or decrypting. * gpgsm: Using Libksba 1.5.0 signatures with a rarely used combination of attributes can now be verified.
2020-11-18gnupg2: updated to 2.2.24adam3-10/+10
Noteworthy changes in version 2.2.24 ------------------------------------ * Allow Unicode file names on Windows almost everywhere. Note that it is still not possible to use Unicode strings on the command line. This change also fixes a regression in 2.2.22 related to non-ascii file names. * Fix localized time printing on Windows. * gpg: New command --quick-revoke-sig. * gpg: Do not use weak digest algos if selected by recipient preference during sign+encrypt. * gpg: Switch to AES256 for symmetric encryption in de-vs mode. * gpg: Silence weak digest warnings with --quiet. * gpg: Print new status line CANCELED_BY_USER for a cancel during symmetric encryption. * gpg: Fix the encrypt+sign hash algo preference selection for ECDSA. This is in particular needed for keys created from existing smartcard based keys. * agent: Fix secret key import of GnuPG 2.3 generated Ed25519 keys. * agent: Keep some permissions of private-keys-v1.d. * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and gnutls builds. * dirmngr: Fix the pool keyserver case for a single host in the pool. * scd: Fix the use case of verify_chv2 by CHECKPIN. * scd: Various improvements to the ccid-driver. * scd: Minor fixes for Yubikey * gpgconf: New option --show-versions. * w32: Install gpg-check-pattern and example profiles. Install Windows subsystem variant of gpgconf (gpgconf-w32). * i18n: Complete overhaul and completion of the Italian translation. Thanks to Denis Renzi. * Require Libgcrypt 1.8 because 1.7 has long reached end-of-life.
2020-11-05*: Recursive revbump from textproc/icu-68.1ryoon1-1/+2
2020-09-05Update security/gnupg2 to 2.2.23js3-8/+9
Fixes a criticial vulnerability: https://dev.gnupg.org/T5050 Noteworthy changes in version 2.2.22 ==================================== * gpg: Change the default key algorithm to rsa3072. * gpg: Add regular expression support for Trust Signatures on all platforms. [#4843] * gpg: Fix regression in 2.2.21 with non-default --passphrase-repeat option. [#4991] * gpg: Ignore --personal-digest-prefs for ECDSA keys. [#5021] * gpgsm: Make rsaPSS a de-vs compliant scheme. * gpgsm: Show also the SHA256 fingerprint in key listings. * gpgsm: Do not require a default keyring for --gpgconf-list. [#4867] * gpg-agent: Default to extended key format and record the creation time of keys. Add new option --disable-extended-key-format. * gpg-agent: Support the WAYLAND_DISPLAY envvar. [#5016] * gpg-agent: Allow using --gpgconf-list even if HOME does not exist. [#4866] * gpg-agent: Make the Pinentry work even if the envvar TERM is set to the empty string. [#4137] * scdaemon: Add a workaround for Gnuk tokens <= 2.15 which wrongly incremented the error counter when using the "verify" command of "gpg --edit-key" with only the signature key being present. * dirmngr: Better handle systems with disabled IPv6. [#4977] * gpgpslit: Install tool. It was not installed in the past to avoid conflicts with the version installed by GnuPG 1.4. [#5023] * gpgtar: Handle Unicode file names on Windows correctly (requires libgpg-error 1.39). [#4083] * gpgtar: Make --files-from and --null work as documented. [#5027] * Build the Windows installer with the new Ntbtls 0.2.0 so that TLS connections succeed for servers demanding GCM. Release-info: https://dev.gnupg.org/T5030 Noteworthy changes in version 2.2.23 ==================================== * gpg: Fix AEAD preference list overflow. [#5050] * gpg: Fix a possible segv in the key cleaning code. * gpgsm: Fix a minor RFC2253 parser bug. [#5037] * scdaemon: Fix a PIN verify failure on certain OpenPGP card implementations. Regression in 2.2.22. [#5039] * po: Fix bug in the Hungarian translation. Updates for the Czech, Polish, and Ukrainian translations. Release-info: https://dev.gnupg.org/T5045
2020-08-18Provide a definition of IN_EXCL_UNLINK for Linux < 2.6.36, and link with -lrt.schmonz3-2/+21
Fixes build on CentOS 6. Still builds on CentOS 7, Debian 9 and 10, Devuan 3.
2020-07-24gnupg2: updated to 2.2.21adam2-8/+7
Noteworthy changes in version 2.2.21 * gpg: Improve symmetric decryption speed by about 25%. * gpg: Support decryption of AEAD encrypted data packets. * gpg: Add option --no-include-key-block. * gpg: Allow for extra padding in ECDH. * gpg: Only a single pinentry is shown for symmetric encryption if the pinentry supports this. * gpg: Print a note if no keys are given to --delete-key. * gpg,gpgsm: The ridiculous passphrase quality bar is not anymore shown. * gpgsm: Certificates without a CRL distribution point are now considered valid without looking up a CRL. The new option --enable-issuer-based-crl-check can be used to revert to the former behaviour. * gpgsm: Support rsaPSS signature verification. * gpgsm: Unless CRL checking is disabled lookup a missing issuer certificate using the certificate's authorityInfoAccess. * gpgsm: Print the certificate's serial number also in decimal notation. * gpgsm: Fix possible NULL-deref in messages of --gen-key. * scd: Support the CardOS 5 based D-Trust Card 3.1. * dirmngr: Allow http URLs with "LOOKUP --url". * wkd: Take name of sendmail from configure. Fixes an OpenBSD specific bug.
2020-06-02Revbump for icuadam1-2/+2
2020-05-22revbump after updating security/nettleadam1-2/+2
2020-04-12Recursive revision bump after textproc/icu updateadam1-1/+2
2020-04-05gnupg2: continue the OPSYS-specific -lintl cargo culttnn1-1/+2
This probably has nothing to do with OPSYS ...
2020-03-21gnupg2: updated to 2.2.20adam2-8/+7
Noteworthy changes in version 2.2.20: * Protect the error counter against overflow to guarantee that the tools can't be tricked into returning success after an error. * gpg: Make really sure that --verify-files always returns an error. * gpg: Fix key listing --with-secret if a pattern is given. * gpg: Fix detection of certain keys used as default-key. * gpg: Fix default-key selection when a card is available. * gpg: Fix key expiration and key usage for keys created with a creation date of zero. * gpgsm: Fix import of some CR,LF terminated certificates. * gpg: New options --include-key-block and --auto-key-import to allow encrypted replies after an initial signed message. * gpg: Allow the use of a fingerprint with --trusted-key. * gpg: New property "fpr" for use by --export-filter. * scdaemon: Disable the pinpad if a KDF DO is used. * dirmngr: Improve finding OCSP certificates. * Avoid build problems with LTO or gcc-10.
2020-03-08*: recursive bump for libffiwiz1-2/+2
2020-01-18*: Recursive revision bump for openssl 1.1.1.jperkin1-1/+2
2019-12-09gnupg2: updated to 2.2.19adam2-7/+7
Noteworthy changes in version 2.2.19: * gpg: Fix double free when decrypting for hidden recipients. Regression in 2.2.18. * gpg: Use auto-key-locate for encryption even for mail addressed given with angle brackets. * gpgsm: Add special case for certain expired intermediate certificates.
2019-11-27Update to 2.2.18ryoon2-8/+7
Changelog: Noteworthy changes in version 2.2.18 (2019-11-25) ------------------------------------------------- * gpg: Changed the way keys are detected on a smartcards; this allows the use of non-OpenPGP cards. In the case of a not very likely regression the new option --use-only-openpgp-card is available. [#4681] * gpg: The commands --full-gen-key and --quick-gen-key now allow direct key generation from supported cards. [#4681] * gpg: Prepare against chosen-prefix SHA-1 collisions in key signatures. This change removes all SHA-1 based key signature newer than 2019-01-19 from the web-of-trust. Note that this includes all key signature created with dsa1024 keys. The new option --allow-weak-key-signatues can be used to override the new and safer behaviour. [#4755,CVE-2019-14855] * gpg: Improve performance for import of large keyblocks. [#4592] * gpg: Implement a keybox compression run. [#4644] * gpg: Show warnings from dirmngr about redirect and certificate problems (details require --verbose as usual). * gpg: Allow to pass the empty string for the passphrase if the '--passphase=' syntax is used. [#4633] * gpg: Fix printing of the KDF object attributes. * gpg: Avoid surprises with --locate-external-key and certain --auto-key-locate settings. [#4662] * gpg: Improve selection of best matching key. [#4713] * gpg: Delete key binding signature when deletring a subkey. [#4665,#4457] * gpg: Fix a potential loss of key sigantures during import with self-sigs-only active. [#4628] * gpg: Silence "marked as ultimately trusted" diagnostics if option --quiet is used. [#4634] * gpg: Silence some diagnostics during in key listsing even with option --verbose. [#4627] * gpg, gpgsm: Change parsing of agent's pkdecrypt results. [#4652] * gpgsm: Support AES-256 keys. * gpgsm: Fix a bug in triggering a keybox compression run if --faked-system-time is used. * dirmngr: System CA certificates are no longer used for the SKS pool if GNUTLS instead of NTBTLS is used as TLS library. [#4594] * dirmngr: On Windows detect usability of IPv4 and IPv6 interfaces to avoid long timeouts. [#4165] * scd: Fix BWI value for APDU level transfers to make Gemalto Ezio Shield and Trustica Cryptoucan work. [#4654,#4566] * wkd: gpg-wks-client --install-key now installs the required policy file.
2019-07-20*: recursive bump for nettle 3.5.1wiz1-1/+2
2019-07-10gnupg2: updated to 2.2.17adam2-7/+7
Noteworthy changes in version 2.2.17: * gpg: Ignore all key-signatures received from keyservers. This change is required to mitigate a DoS due to keys flooded with faked key-signatures. The old behaviour can be achieved by adding keyserver-options no-self-sigs-only,no-import-clean to your gpg.conf. * gpg: If an imported keyblocks is too large to be stored in the keybox (pubring.kbx) do not error out but fallback to an import using the options "self-sigs-only,import-clean". * gpg: New command --locate-external-key which can be used to refresh keys from the Web Key Directory or via other methods configured with --auto-key-locate. * gpg: New import option "self-sigs-only". * gpg: In --auto-key-retrieve prefer WKD over keyservers. * dirmngr: Support the "openpgpkey" subdomain feature from draft-koch-openpgp-webkey-service-07. * dirmngr: Add an exception for the "openpgpkey" subdomain to the CSRF protection. * dirmngr: Fix endless loop due to http errors 503 and 504. * dirmngr: Fix TLS bug during redirection of HKP requests. * gpgconf: Fix a race condition when killing components.
2019-06-02gnupg2: updated to 2.2.16adam2-8/+7
Noteworthy changes in version 2.2.16: * gpg,gpgsm: Fix deadlock on Windows due to a keybox sharing violation. * gpg: Allow deletion of subkeys with --delete-key. This finally makes the bang-suffix work as expected for that command. * gpg: Replace SHA-1 by SHA-256 in self-signatures when updating them with --quick-set-expire or --quick-set-primary-uid. * gpg: Improve the photo image viewer selection. * gpg: Fix decryption with --use-embedded-filename. * gpg: Remove hints on using the --keyserver option. * gpg: Fix export of certain secret keys with comments. * gpg: Reject too long user-ids in --quick-gen-key. * gpg: Fix a double free in the best key selection code. * gpg: Fix the key generation dialog for switching back from EdDSA to ECDSA. * gpg: Use AES-192 with SHA-384 to comply with RFC-6637. * gpg: Use only the addrspec from the Signer's UID subpacket to mitigate a problem with another implementation. * gpg: Skip invalid packets during a keyring listing and sync diagnostics with the output. * gpgsm: Avoid confusing diagnostic when signing with the default key. * agent: Do not delete any secret key in --dry-run mode. * agent: Fix failures on 64 bit big-endian boxes related to URIs in a keyfile. * agent: Stop scdaemon after a reload with disable-scdaemon newly configured. * dirmngr: Improve caching algorithm for WKD domains. * dirmngr: Support other hash algorithms than SHA-1 for OCSP. * gpgconf: Make --homedir work for --launch. * gpgconf: Before --launch check for a valid config file. * wkd: Do not import more than 5 keys from one WKD address. * wkd: Accept keys which are stored in armored format in the directory. * The installer for Windows now comes with signed binaries.
2019-04-03Recursive revbump from textproc/icuryoon1-1/+2
2019-04-01gnupg2: updated to 2.2.15adam3-90/+7
Noteworthy changes in version 2.2.15: * sm: Fix --logger-fd and --status-fd on Windows for non-standard file descriptors. * sm: Allow decryption even if expired keys are configured. * agent: Change command KEYINFO to print ssh fingerprints with other hash algos. * dirmngr: Fix build problems on Solaris due to the use of reserved symbol names. * wkd: New commands --print-wkd-hash and --print-wkd-url for gpg-wks-client.
2019-03-27gnupg2: Fix build.jperkin2-1/+84
2019-03-20gnupg2: updated to 2.2.14adam3-17/+24
Noteworthy changes in version 2.2.14: * gpg: Allow import of PGP desktop exported secret keys. Also avoid importing secret keys if the secret keyblock is not valid. * gpg: Do not error out on version 5 keys in the local keyring. * gpg: Make invalid primary key algo obvious in key listings. * sm: Do not mark a certificate in a key listing as de-vs compliant if its use for a signature will not be possible. * sm: Fix certificate creation with key on card. * sm: Create rsa3072 bit certificates by default. * sm: Print Yubikey attestation extensions with --dump-cert. * agent: Fix cancellation handling for scdaemon. * agent: Support --mode=ssh option for CLEAR_PASSPHRASE. * scd: Fix flushing of the CA-FPR DOs in app-openpgp. * scd: Avoid a conflict error with the "undefined" app. * dirmngr: Add CSRF protection exception for protonmail. * dirmngr: Fix build problems with gcc 9 in libdns. * gpgconf: New option --show-socket for use wity --launch. * gpgtar: Make option -C work for archive creation.
2019-02-13gnupg2: updated to 2.2.13adam2-8/+8
Noteworthy changes in version 2.2.13: * gpg: Implement key lookup via keygrip (using the & prefix). * gpg: Allow generating Ed25519 key from existing key. * gpg: Emit an ERROR status line if no key was found with -k. * gpg: Stop early when trying to create a primary Elgamal key. * gpgsm: Print the card's key algorithms along with their keygrips in interactive key generation. * agent: Clear bogus pinentry cache in the error case. * scd: Support "acknowledge button" feature. * scd: Fix for USB INTERRUPT transfer. * wks: Do no use compression for the the encrypted challenge and response
2019-02-02gnupg2: teach about PKG_SYSCONFDIR and VARBASEmarkd1-1/+4
2018-12-20gnupg2: updated to 2.2.12adam2-8/+7
Noteworthy changes in version 2.2.12: * tools: New commands --install-key and --remove-key for gpg-wks-client. This allows to prepare a Web Key Directory on a local file system for later upload to a web server. * gpg: New --list-option "show-only-fpr-mbox". This makes the use of the new gpg-wks-client --install-key command easier on Windows. * gpg: Improve processing speed when --skip-verify is used. * gpg: Fix a bug where a LF was accidentally written to the console. * gpg: --card-status now shwos whether a card has the new KDF feature enabled. * agent: New runtime option --s2k-calibration=MSEC. New configure option --with-agent-s2k-calibration=MSEC. * dirmngr: Try another keyserver from the pool on receiving a 502, 503, or 504 error. * dirmngr: Avoid possible CSRF attacks via http redirects. A HTTP query will not anymore follow a 3xx redirect unless the Location header gives the same host. If the host is different only the host and port is taken from the Location header and the original path and query parts are kept. * dirmngr: New command FLUSHCRL to flush all CRLS from disk and memory. * New simplified Chinese translation (zh_CN).
2018-12-09revbump after updating textproc/icuadam1-1/+2
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-07 12:00:45 +0000