From wk at gnupg.org Mon Apr 3 14:13:15 2006 From: wk at gnupg.org (Werner Koch) Date: Mon Apr 3 14:15:37 2006 Subject: [Announce] GnuPG 1.4.3 released Message-ID: <87lkum26xw.fsf@wheatstone.g10code.de> Hello! We are pleased to announce the availability of a new stable GnuPG release: Version 1.4.3 The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication and data storage. It is a complete and free replacement of PGP and can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. Getting the Software ==================== Please follow the instructions found at http://www.gnupg.org/download/ or read on: GnuPG 1.4.3 may be downloaded from one of the GnuPG mirror sites or direct from ftp://ftp.gnupg.org/gcrypt/ . The list of mirrors can be found at http://www.gnupg.org/mirrors.html . Note, that GnuPG is not available at ftp.gnu.org. On the mirrors you should find the following files in the *gnupg* directory: gnupg-1.4.3.tar.bz2 (3041k) gnupg-1.4.3.tar.bz2.sig GnuPG source compressed using BZIP2 and OpenPGP signature. gnupg-1.4.3.tar.gz (4219k) gnupg-1.4.3.tar.gz.sig GnuPG source compressed using GZIP and OpenPGP signature. gnupg-1.4.2.2-1.4.3.diff.bz2 (905k) A patch file to upgrade a 1.4.2.2 GnuPG source. Select one of them. To shorten the download time, you probably want to get the BZIP2 compressed file. Please try another mirror if exceptional your mirror is not yet up to date. In the *binary* directory, you should find these files: gnupg-w32cli-1.4.3.exe (1436k) gnupg-w32cli-1.4.3.exe.sig GnuPG compiled for Microsoft Windows and OpenPGP signature. Note that this is a command line version and now comes with a graphical installer tool. The source files are the same as given above. Note, that this is a minimal version and unless you are just in need for the gpg binary, you are better off using the full featured installer at http://www.gpg4win.org . Version 1.0 will be available in a few days - the currently available release candidate is pretty much up to GnuPG 1.4.3. Checking the Integrity ====================== In order to check that the version of GnuPG which you are going to install is an original and unmodified one, you can do it in one of the following ways: * If you already have a trusted version of GnuPG installed, you can simply check the supplied signature. For example to check the signature of the file gnupg-1.4.3.tar.bz2 you would use this command: gpg --verify gnupg-1.4.3.tar.bz2.sig This checks whether the signature file matches the source file. You should see a message indicating that the signature is good and made by that signing key. Make sure that you have the right key, either by checking the fingerprint of that key with other sources or by checking that the key has been signed by a trustworthy other key. Note, that you can retrieve the signing key using the command finger wk ,at' g10code.com or using a keyserver like gpg --recv-key 1CE0C630 The distribution key 1CE0C630 is signed by the well known key 5B0358A2. If you get an key expired message, you should retrieve a fresh copy as the expiration date might have been prolonged. NEVER USE A GNUPG VERSION YOU JUST DOWNLOADED TO CHECK THE INTEGRITY OF THE SOURCE - USE AN EXISTING GNUPG INSTALLATION! * If you are not able to use an old version of GnuPG, you have to verify the SHA-1 checksum. Assuming you downloaded the file gnupg-1.4.3.tar.bz2, you would run the sha1sum command like this: sha1sum gnupg-1.4.3.tar.bz2 and check that the output matches the first line from the following list: 9e96b36e4f4d1e8bc5028c99fac674482cbdb370 gnupg-1.4.3.tar.bz2 7c0f5db594bed9a901d9be43c31f6c80c6080141 gnupg-1.4.3.tar.gz 5477211551e96ad689c7618ee39a2b9c186721ef gnupg-1.4.2.2-1.4.3.diff.bz2 abf49fa5dc71e291144780d47f2811d83ae5e1ba gnupg-w32cli-1.4.3.exe Upgrade Information =================== If you are upgrading from a version prior to 1.0.7, you should run the script tools/convert-from-106 once. Please note also that due to a bug in versions prior to 1.0.6 it may not be possible to downgrade to such versions unless you apply the patch http://www.gnupg.org/developer/gpg-woody-fix.txt . If you have any problems, please see the FAQ and the mailing list archive at http://lists.gnupg.org. Please direct questions to the gnupg-users@gnupg.org mailing list. What's New =========== * If available, cURL-based keyserver helpers are built that can retrieve keys using HKP or any protocol that cURL supports (HTTP, HTTPS, FTP, FTPS, etc). If cURL is not available, HKP and HTTP are still supported using a built-in cURL emulator. To force building the old pre-cURL keyserver helpers, use the configure option --enable-old-keyserver-helpers. Note that none of this affects finger or LDAP support, which are unchanged. Note also that a future version of GnuPG will remove the old keyserver helpers altogether. * Implemented Public Key Association (PKA) signature verification. This uses special DNS records and notation data to associate a mail address with an OpenPGP key to prove that mail coming from that address is legitimate without the need for a full trust path to the signing key. * When exporting subkeys, those specified with a key ID or fingerpint and the '!' suffix are now merged into one keyblock. * Added "gpg-zip", a program to create encrypted archives that can interoperate with PGP Zip. * Added support for signing subkey cross-certification "back signatures". Requiring cross-certification to be present is currently off by default, but will be changed to on by default in the future, once more keys use it. A new "cross-certify" command in the --edit-key menu can be used to update signing subkeys to have cross-certification. * The key cleaning options for --import-options and --export-options have been further polished. "import-clean" and "export-clean" replace the older import-clean-sigs/import-clean-uids and export-clean-sigs/export-clean-uids option pairs. * New "minimize" command in the --edit-key menu removes everything that can be removed from a key, rendering it as small as possible. There are corresponding "export-minimal" and "import-minimal" commands for --export-options and --import-options. * New --fetch-keys command to retrieve keys by specifying a URI. This allows direct key retrieval from a web page or other location that can be specified in a URI. Available protocols are HTTP and finger, plus anything that cURL supplies, if built with cURL support. * Files containing several signed messages are not allowed any longer as there is no clean way to report the status of such files back to the caller. To partly revert to the old behaviour the new option --allow-multisig-verification may be used. * The keyserver helpers can now handle keys in either ASCII armor or binary format. * New auto-key-locate option that takes an ordered list of methods to locate a key if it is not available at encryption time (-r or --recipient). Possible methods include "cert" (use DNS CERT as per RFC2538bis, "pka" (use DNS PKA), "ldap" (consult the LDAP server for the domain in question), "keyserver" (use the currently defined keyserver), as well as arbitrary keyserver URIs that will be contacted for the key. * Able to retrieve keys using DNS CERT records as per RFC-2538bis (currently in draft): http://www.josefsson.org/rfc2538bis Internationalization ==================== GnuPG comes with support for 28 languages. Due to a lot of new and changed strings the translations are not entirely complete. Future Directions ================= GnuPG 1.4.x is the current stable branch and will be kept as the easy to use and build single-executable versions. We plan to backport new features from the development series to 1.4. GnuPG 1.9.x is the new development series of GnuPG. This version merged the code from the Aegypten project and thus it includes the gpg-agent, a smartcard daemon and gpg's S/MIME cousin gpgsm. The design is different to the previous versions and we may not support all ancient systems - thus POSIX compatibility will be an absolute requirement for supported platforms. 1.9 is as of now based on an somewhat older 1.3 code but will peacefully coexist with other GnuPG versions. IF YOU NEED GNUPG 1.9, IT IS HIGHLY SUGGESTED THAT YOU INSTALL IT IN ADDITION TO GNUPG 1.4! Both versions will peacefully coexist and extend each other. Support ======= Improving GnuPG is costly, but you can help! We are looking for organizations that find GnuPG useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or by donating money. Commercial support contracts for GnuPG are available, and they help finance continued maintenance. g10 Code GmbH, a Duesseldorf based company owned and headed by gpg's principal author, is currently funding GnuPG development. We are always looking for interesting development projects. A service directory has recently been started at: http://www.gnupg.org/service.html Thanks ====== We have to thank all the people who helped with this release, be it testing, coding, translating, suggesting, auditing, administering the servers, spreading the word or answering questions on the mailing lists. Happy Hacking, The GnuPG Team (David, Werner and the other contributors) -- Werner Koch The GnuPG Experts http://g10code.com Free Software Foundation Europe http://fsfeurope.org Join the Fellowship and protect your Freedom! http://www.fsfe.org -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 196 bytes Desc: not available Url : /pipermail/attachments/20060403/40f2df9e/attachment.pgp From wk at gnupg.org Fri Apr 7 13:56:17 2006 From: wk at gnupg.org (Werner Koch) Date: Fri Apr 7 13:58:43 2006 Subject: [Announce] Gpg4win 1.0.0 released Message-ID: <8764lld2fy.fsf@wheatstone.g10code.de> Hi! After struggling for 6 month with Windows pecularities, we are finally pleased to announce the *first stable release of Gpg4win*, version 1.0.0! The gpg4win project aims at updating the gpg4win Windows installation package with GnuPG encryption tool, associated applications and documentation on a regular basis. Especially the documentation (handbooks "Einsteiger" and "Durchblicker") are directly maintained as part of the gpg4win project. It is an international project. Due to the origin of the project the German language is fully supported. As of now the the handbooks are only available in German. People helping with translations are very welcome! The main difference compared to all other similar approaches (mainly GnuPP, GnuPT, Windows Privacy Tools and GnuPG-Basics) is that the first thing developed was the *gpg4win-Builder*. This builder allows to easily create new gpg4win.exe installers with updated components. The builder runs on any decent Unix system, preferable Debian GNU/Linux. Almost all products are automatically cross-compiled for integration into the installer. With this concept it is hoped to *prevent quick aging of the* *installer package*. This is due to easier updating and less dependancy on single developers. For installation instuctions, please visit http://www.gpg4win.org or read on. Developers who want to *build an installer* need to get the following files from http://wald.intevation.org/projects/gpg4win/ : gpg4win-1.0.0.tar.bz2 (4.0M) gpg4win-1.0.0.tar.bz2.sig The second file is a digital signature of the the first file. Either check that this signature is fine or compare with the checksums given below. (see also http://www.gnupg.org/download/integrity_check.html) The *ready to use installer* is available at: http://ftp.gpg4win.org/gpg4win-1.0.0.exe (6.8M) http://ftp.gpg4win.org/gpg4win-1.0.0.exe.sig Or using the ftp protocol at: ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.0.exe (6.8M) ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.0.exe.sig SHA1 and MD5 checksums for these files are given below. A separate installer with the the sources used to build the above installer is available at: ftp://ftp.gpg4win.org/gpg4win/gpg4win-src-1.0.0.exe (40M) ftp://ftp.gpg4win.org/gpg4win/gpg4win-src-1.0.0.exe.sig Most people don't need this source installer; it is merely stored on that server to satisfy the conditions of the GPL. In general it is better to get the gpg4win builder tarball (see above) and follow the instructions in the README to build new installers; building the installer is not possible on Windows machines and works best on current Debian GNU/Linux systems (we use the mingw32 package from Sid). SHA1 checksums are: 9525bb4947c02a764948cfe8d78f5400e39afc14 gpg4win-1.0.0.tar.bz2 c0ccd90c9aec23447bcd883cfd0602712967cfc6 gpg4win-1.0.0.exe 9c0bac7627a91ccbddd4dbdab522020b5ac91fe9 gpg4win-src-1.0.0.exe MD5 checksums are: 73d5f8e8c7e805fbf43075c6c6c09901 gpg4win-1.0.0.tar.bz2 299fa8567a484ea32706b11d318dbe9a gpg4win-1.0.0.exe 99f941d5d07b7c6e6860e490a081d1e7 gpg4win-src-1.0.0.exe We like to thank the authors of the included packages, the NSIS authors, all other contributors and first of all, those folks who stayed with us and tested the early releases of gpg4win. Happy hacking, Jan, Marcus, Timo and Werner -- Werner Koch The GnuPG Experts http://g10code.com Free Software Foundation Europe http://fsfeurope.org Join the Fellowship and protect your Freedom! http://www.fsfe.org -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 196 bytes Desc: not available Url : /pipermail/attachments/20060407/5d1b3076/attachment.pgp From wk at gnupg.org Wed Apr 26 13:29:06 2006 From: wk at gnupg.org (Werner Koch) Date: Wed Apr 26 13:31:13 2006 Subject: [Announce] Gpg4win 1.0.1 released In-Reply-To: <8764lld2fy.fsf@wheatstone.g10code.de> (Werner Koch's message of "Fri, 07 Apr 2006 13:56:17 +0200") References: <8764lld2fy.fsf@wheatstone.g10code.de> Message-ID: <871wvkk22l.fsf@wheatstone.g10code.de> Hi! We are pleased to announce the availibility of Gpg4win, version 1.0.1. The gpg4win project aims at updating the gpg4win Windows installation package with GnuPG encryption tool, associated applications and documentation on a regular basis. Especially the documentation (handbooks "Einsteiger" and "Durchblicker") are directly maintained as part of the gpg4win project. It is an international project. Due to the origin of the project the German language is fully supported. As of now the the handbooks are only available in German. People helping with translations are very welcome! The main difference compared to all other similar approaches (mainly GnuPP, GnuPT, Windows Privacy Tools and GnuPG-Basics) is that the first thing developed was the *gpg4win-Builder*. This builder allows to easily create new gpg4win.exe installers with updated components. The builder runs on any decent Unix system, preferable Debian GNU/Linux. Almost all products are automatically cross-compiled for integration into the installer. With this concept it is hoped to *prevent quick aging of the* *installer package*. This is due to easier updating and less dependancy on single developers. Major changes in this version are: * New: Another version of the installer without the PDF manuals is now build in addition to the standard one. * Manuals are not installed in the quick launch bar anymore. * The manuals are now searchable even for words with Umlauts. * Included components are: GnuPG: 1.4.3 WinPT: 0.11.12 [*] GPA: 0.7.3 GPGol: 0.9.10 [*] GPGee: 1.3.1 [*] Sylpheed-Claws: 1.9.100cvs124 Einsteiger: 2.0.1 [*] Durchblicker: 2.0.1 [*] (Marked packages are updated since the last release) For installation instuctions, please visit http://www.gpg4win.org or read on. Developers who want to *build an installer* need to get the following files from http://wald.intevation.org/projects/gpg4win/ : gpg4win-1.0.1.tar.bz2 (4.0M) gpg4win-1.0.1.tar.bz2.sig The second file is a digital signature of the the first file. Either check that this signature is fine or compare with the checksums given below. (see also http://www.gnupg.org/download/integrity_check.html) The *ready to use installer* is available at: http://ftp.gpg4win.org/gpg4win-1.0.1.exe (6.6M) http://ftp.gpg4win.org/gpg4win-1.0.1.exe.sig Or using the ftp protocol at: ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.1.exe (6.6M) ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.1.exe.sig SHA1 and MD5 checksums for these files are given below. If you don't need the German PDF manuals, you might alternatively download the "light" version of the installer: http://ftp.gpg4win.org/gpg4win-light-1.0.1.exe (4.5M) http://ftp.gpg4win.org/gpg4win-light- 1.0.1.exe.sig or using the ftp protocol at: ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.1.exe (4.5M) ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.1.exe.sig A separate installer with the the sources used to build the above installer is available at: ftp://ftp.gpg4win.org/gpg4win/gpg4win-src-1.0.1.exe (40M) ftp://ftp.gpg4win.org/gpg4win/gpg4win-src-1.0.1.exe.sig Most people don't need this source installer; it is merely stored on that server to satisfy the conditions of the GPL. In general it is better to get the gpg4win builder tarball (see above) and follow the instructions in the README to build new installers; building the installer is not possible on Windows machines and works best on current Debian GNU/Linux systems (we use the mingw32 package from Sid). SHA1 checksums are: 4d111814dfd4b0b7dd1a8a0fb81beaee477693dc gpg4win-1.0.1.tar.bz2 c55f73561a2e013599b1c9aa6cb1291abd06c18d gpg4win-1.0.1.exe f8e9dd1cf3225fbd6e66454e6eda603a21d436f7 gpg4win-light-1.0.1.exe 6eb5fe537cc2423d57c4e485b4c56804d5be0d93 gpg4win-src-1.0.1.exe MD5 checksums are: 7905750f45ebe967632d7010ffe377f6 gpg4win-1.0.1.tar.bz2 c61787a524a5b943488731ff48d4c48f gpg4win-1.0.1.exe 85d42c6f52caf0402910aa4f5e10f785 gpg4win-light-1.0.1.exe 3cb95e8ab38f95e16b9b2ed161a0cd9c gpg4win-src-1.0.1.exe We like to thank the authors of the included packages, the NSIS authors, all other contributors and first of all, those folks who stayed with us and tested the early releases of gpg4win. Happy hacking, Jan, Marcus, Timo and Werner -- Werner Koch The GnuPG Experts http://g10code.com Join the Fellowship and protect your Freedom! http://www.fsfe.org -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 196 bytes Desc: not available Url : /pipermail/attachments/20060426/2d229d1a/attachment-0001.pgp From mb at g10code.com Sat Jun 3 00:52:22 2006 From: mb at g10code.com (Marcus Brinkmann) Date: Sat Jun 3 03:45:20 2006 Subject: [Announce] Gpg4win 1.0.2 released Message-ID: <87odxbf9w9.wl%marcus.brinkmann@ruhr-uni-bochum.de> Hi! We are pleased to announce the availibility of Gpg4win, version 1.0.2. The gpg4win project aims at updating the gpg4win Windows installation package with GnuPG encryption tool, associated applications and documentation on a regular basis. Especially the documentation (handbooks "Einsteiger" and "Durchblicker") are directly maintained as part of the gpg4win project. It is an international project. Due to the origin of the project the German language is fully supported. As of now the the handbooks are only available in German. People helping with translations are very welcome! The main difference compared to all other similar approaches (mainly GnuPP, GnuPT, Windows Privacy Tools and GnuPG-Basics) is that the first thing developed was the *gpg4win-Builder*. This builder allows to easily create new gpg4win.exe installers with updated components. The builder runs on any decent Unix system, preferable Debian GNU/Linux. Almost all products are automatically cross-compiled for integration into the installer. With this concept it is hoped to *prevent quick aging of the* *installer package*. This is due to easier updating and less dependancy on single developers. Noteworthy changes in version 1.0.2 (2006-05-30) ------------------------------------------------ * Fixed a bug in GPA which led to a non-working backup on some Windows systems. * Updated Sylpheed-Claws to the latest stable version. * Included components are: GnuPG: 1.4.3 WinPT: 0.12.1 [*] GPA: 0.7.3 GPGol: 0.9.10 GPGee: 1.3.1 Sylpheed-Claws: 2.2.0 [*] Einsteiger: 2.0.2 [*] Durchblicker: 2.0.2 [*] (Marked packages are updated since the last release) For installation instuctions, please visit http://www.gpg4win.org or read on. Developers who want to *build an installer* need to get the following files from http://wald.intevation.org/projects/gpg4win/ : gpg4win-1.0.2.tar.bz2 (3.9M) gpg4win-1.0.2.tar.bz2.sig The second file is a digital signature of the the first file. Either check that this signature is fine or compare with the checksums given below. (see also http://www.gnupg.org/download/integrity_check.html) The *ready to use installer* is available at: http://ftp.gpg4win.org/gpg4win-1.0.2.exe (6.2M) http://ftp.gpg4win.org/gpg4win-1.0.2.exe.sig Or using the ftp protocol at: ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.2.exe (6.2M) ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.2.exe.sig SHA1 and MD5 checksums for these files are given below. If you don't need the German PDF manuals, you might alternatively download the "light" version of the installer: http://ftp.gpg4win.org/gpg4win-light-1.0.2.exe (4.6M) http://ftp.gpg4win.org/gpg4win-light- 1.0.2.exe.sig or using the ftp protocol at: ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.2.exe (4.6M) ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.2.exe.sig A separate installer with the the sources used to build the above installer is available at: ftp://ftp.gpg4win.org/gpg4win/gpg4win-src-1.0.2.exe (41M) ftp://ftp.gpg4win.org/gpg4win/gpg4win-src-1.0.2.exe.sig Most people don't need this source installer; it is merely stored on that server to satisfy the conditions of the GPL. In general it is better to get the gpg4win builder tarball (see above) and follow the instructions in the README to build new installers; building the installer is not possible on Windows machines and works best on current Debian GNU/Linux systems (we use the mingw32 package from Sid). SHA1 checksums are: 8d4aa1799096da33c8e961f44e5b5ceff0fc6647 gpg4win-1.0.2.exe ed93fc55e3cb221f2b0e0b96c660fb7d87f490bb gpg4win-light-1.0.2.exe 1d82a8f54819d487f6078aab4343fefa24504aa4 gpg4win-src-1.0.2.exe caa3c502645ece898281ca2f47cff4ce81657d0c gpg4win-1.0.2.tar.bz2 MD5 checksums are: ce25314e788c0434ead74cfe0662f6c5 gpg4win-1.0.2.exe 9886cbb42200393be5f3e0d019ee31ba gpg4win-light-1.0.2.exe c216828825d606dcdfe9e1b70cb3fcc7 gpg4win-src-1.0.2.exe 20f0588c5777cbe7834d751175fe98e2 gpg4win-1.0.2.tar.bz2 We like to thank the authors of the included packages, the NSIS authors, all other contributors and first of all, those folks who stayed with us and tested the early releases of gpg4win. Happy hacking, Jan, Marcus, Timo and Werner -- Marcus Brinkmann The GnuPG Experts http://g10code.com Join the Fellowship and protect your Freedom! http://www.fsfe.org From wk at gnupg.org Sun Jun 25 15:43:25 2006 From: wk at gnupg.org (Werner Koch) Date: Sun Jun 25 16:22:49 2006 Subject: [Announce] GnuPG 1.4.4 released (security bug fix) Message-ID: <87psgxic5e.fsf@wheatstone.g10code.de> Hello! We are pleased to announce the availability of a new stable GnuPG release: Version 1.4.4 This is maintenance release to fix a recently detected flaw in the handling of user IDs, see the NEWS part below. Updating to this version is recommended. The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication and data storage. It is a complete and free replacement of PGP and can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. Getting the Software ==================== Please follow the instructions found at http://www.gnupg.org/download/ or read on: GnuPG 1.4.4 may be downloaded from one of the GnuPG mirror sites or direct from ftp://ftp.gnupg.org/gcrypt/ . The list of mirrors can be found at http://www.gnupg.org/mirrors.html . Note, that GnuPG is not available at ftp.gnu.org. On the mirrors you should find the following files in the *gnupg* directory: gnupg-1.4.4.tar.bz2 (2976k) gnupg-1.4.4.tar.bz2.sig GnuPG source compressed using BZIP2 and OpenPGP signature. gnupg-1.4.4.tar.gz (4173k) gnupg-1.4.4.tar.gz.sig GnuPG source compressed using GZIP and OpenPGP signature. gnupg-1.4.3-1.4.5.diff.bz2 (405k) A patch file to upgrade a 1.4.3 GnuPG source. Select one of them. To shorten the download time, you probably want to get the BZIP2 compressed file. Please try another mirror if exceptional your mirror is not yet up to date. In the *binary* directory, you should find these files: gnupg-w32cli-1.4.4.exe (1441k) gnupg-w32cli-1.4.4.exe.sig GnuPG compiled for Microsoft Windows and OpenPGP signature. This is a command line only version; the source files are the same as given above. Note, that this is a minimal installer and unless you are just in need for the gpg binary, you are better off using the full featured installer at http://www.gpg4win.org . A new version of Gpg4win, including this version of GnuPG will be available and announced really soon. Checking the Integrity ====================== In order to check that the version of GnuPG which you are going to install is an original and unmodified one, you can do it in one of the following ways: * If you already have a trusted version of GnuPG installed, you can simply check the supplied signature. For example to check the signature of the file gnupg-1.4.4.tar.bz2 you would use this command: gpg --verify gnupg-1.4.4.tar.bz2.sig This checks whether the signature file matches the source file. You should see a message indicating that the signature is good and made by that signing key. Make sure that you have the right key, either by checking the fingerprint of that key with other sources or by checking that the key has been signed by a trustworthy other key. Note, that you can retrieve the signing key using the command finger wk ,at' g10code.com or using a keyserver like gpg --recv-key 1CE0C630 The distribution key 1CE0C630 is signed by the well known key 5B0358A2. If you get an key expired message, you should retrieve a fresh copy as the expiration date might have been prolonged. NEVER USE A GNUPG VERSION YOU JUST DOWNLOADED TO CHECK THE INTEGRITY OF THE SOURCE - USE AN EXISTING GNUPG INSTALLATION! * If you are not able to use an old version of GnuPG, you have to verify the SHA-1 checksum. Assuming you downloaded the file gnupg-1.4.4.tar.bz2, you would run the sha1sum command like this: sha1sum gnupg-1.4.4.tar.bz2 and check that the output matches the first line from the following list: 3414d67f22973576f31e354f44859bafbccb7eee gnupg-1.4.4.tar.bz2 3d504d7d31e6d9b81bf33a25bec08bc5e6c0fc0c gnupg-1.4.4.tar.gz 5d6d193c22a878a02afee08a7b8733876b344a92 gnupg-1.4.3-1.4.4.diff.bz2 8695eee22ce62aef384665034ee81bd491bee9ed gnupg-w32cli-1.4.4.exe Upgrade Information =================== If you are upgrading from a version prior to 1.0.7, you should run the script tools/convert-from-106 once. Please note also that due to a bug in versions prior to 1.0.6 it may not be possible to downgrade to such versions unless you apply the patch http://www.gnupg.org/developer/gpg-woody-fix.txt . If you have any problems, please see the FAQ and the mailing list archive at http://lists.gnupg.org. Please direct questions to the gnupg-users@gnupg.org mailing list. What's New =========== * User IDs are now capped at 2048 bytes. This avoids a memory allocation attack (see CVE-2006-3082). * Added support for the SHA-224 hash. Like the SHA-384 hash, it is mainly useful when DSS (the US Digital Signature Standard) compatibility is desired. * Added support for the latest update to DSA keys and signatures. This allows for larger keys than 1024 bits and hashes other than SHA-1 and RIPEMD/160. Note that not all OpenPGP implementations can handle these new keys and signatures yet. See "--enable-dsa2" in the manual for more information. Internationalization ==================== GnuPG comes with support for 28 languages. Due to a lot of new and changed strings the translations are not entirely complete. Future Directions ================= GnuPG 1.4.x is the current stable branch and will be kept as the easy to use and build single-executable versions. We plan to backport new features from the development series to 1.4. GnuPG 1.9.x is the new development series of GnuPG. This version merged the code from the Aegypten project and thus it includes the gpg-agent, a smartcard daemon and gpg's S/MIME cousin gpgsm. The design is different to the previous versions and we may not support all ancient systems - thus POSIX compatibility will be an absolute requirement for supported platforms. We are currently in the process of updating the gpg part of 1.9 to the one of this release. IF YOU NEED GNUPG 1.9, IT IS HIGHLY SUGGESTED THAT YOU INSTALL IT IN ADDITION TO GNUPG 1.4! Both versions will peacefully coexist and extend each other. Support ======= Improving GnuPG is costly, but you can help! We are looking for organizations that find GnuPG useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or by donating money. Commercial support contracts for GnuPG are available, and they help finance continued maintenance. g10 Code GmbH, a Duesseldorf based company owned and headed by gpg's principal author, is currently funding GnuPG development. We are always looking for interesting development projects. A service directory has recently been started at: http://www.gnupg.org/service.html Thanks ====== We have to thank all the people who helped with this release, be it testing, coding, translating, suggesting, auditing, administering the servers, spreading the word or answering questions on the mailing lists. Happy Hacking, The GnuPG Team (David, Werner and the other contributors) -- Werner Koch The GnuPG Experts http://g10code.com Join the Fellowship and protect your Freedom! http://www.fsfe.org -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 196 bytes Desc: not available Url : /pipermail/attachments/20060625/d500fc3b/attachment.pgp From wk at gnupg.org Mon Jun 26 16:00:09 2006 From: wk at gnupg.org (Werner Koch) Date: Mon Jun 26 16:01:40 2006 Subject: [Announce] Gpg4win 1.0.3 released (security fix) Message-ID: <873bdsf252.fsf@wheatstone.g10code.de> Hi! We are pleased to announce the availibility of Gpg4win, version 1.0.3. * This version contains security fixes for the GnuPG and Sylpheed-Claws components. *Updating to this version is strongly recommended*. * Please also make sure to subscribe to the new gpg4win announcement mailing list. We might stop in the future to cross post announcements to the general GnuPG annoucement list. See: http://lists.wald.intevation.org/mailman/listinfo/gpg4win-announce About Gpg4win ------------- The Gpg4win project aims at updating the Gpg4win Windows installation package with GnuPG encryption tool, associated applications and documentation on a regular basis. Especially the documentation (handbooks "Einsteiger" and "Durchblicker") are directly maintained as part of the gpg4win project. It is an international project. Due to the origin of the project the German language is fully supported. As of now the the handbooks are only available in German. People helping with translations are very welcome! The main difference compared to all other similar approaches (mainly GnuPP, GnuPT, Windows Privacy Tools and GnuPG-Basics) is that the first thing developed was the *gpg4win-Builder*. This builder allows to easily create new gpg4win.exe installers with updated components. The builder runs on any decent Unix system, preferable Debian GNU/Linux. Almost all products are automatically cross-compiled for integration into the installer. With this concept it is hoped to *prevent quick aging of the* *installer package*. This is due to easier updating and less dependancy on single developers. Noteworthy changes in version 1.0.3 (2006-06-26) ------------------------------------------------ * Fixed a security related bug in GnuPG (CVE-2006-3082). * Updated Sylpheed-Claws due to security problems. * Included components are: GnuPG: 1.4.4 [*] WinPT: 0.12.3 [*] GPA: 0.7.3 GPGol: 0.9.10 GPGee: 1.3.1 Sylpheed-Claws: 2.3.1 [*] Einsteiger: 2.0.2 Durchblicker: 2.0.2 (Marked packages are updated since the last release) Installation ------------ For installation instructions, please visit http://www.gpg4win.org or read on. Developers who want to *build an installer* need to get the following files from http://wald.intevation.org/projects/gpg4win/ : gpg4win-1.0.3.tar.bz2 (3.9M) gpg4win-1.0.3.tar.bz2.sig The second file is a digital signature of the the first file. Either check that this signature is fine or compare with the checksums given below. (see also http://www.gnupg.org/download/integrity_check.html) The *ready to use installer* is available at: http://ftp.gpg4win.org/gpg4win-1.0.3.exe (6.2M) http://ftp.gpg4win.org/gpg4win-1.0.3.exe.sig Or using the ftp protocol at: ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.3.exe (6.2M) ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.3.exe.sig SHA1 and MD5 checksums for these files are given below. If you don't need the German PDF manuals, you might alternatively download the "light" version of the installer: http://ftp.gpg4win.org/gpg4win-light-1.0.3.exe (4.6M) http://ftp.gpg4win.org/gpg4win-light-1.0.3.exe.sig or using the ftp protocol at: ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.3.exe (4.6M) ftp://ftp.gpg4win.org/gpg4win/gpg4win-1.0.3.exe.sig A separate installer with the the sources used to build the above installer is available at: ftp://ftp.gpg4win.org/gpg4win/gpg4win-src-1.0.3.exe (41M) ftp://ftp.gpg4win.org/gpg4win/gpg4win-src-1.0.3.exe.sig Most people don't need this source installer; it is merely stored on that server to satisfy the conditions of the GPL. In general it is better to get the gpg4win builder tarball (see above) and follow the instructions in the README to build new installers; building the installer is not possible on Windows machines and works best on current Debian GNU/Linux systems (we use the mingw32 package from Sid). SHA1 checksums are: fb010c9d4ee9e4d51b2b43034562f39eb6b88cbf gpg4win-1.0.3.exe bdb1065aaa8f72fcd13158712f2b479586d3d677 gpg4win-light-1.0.3.exe fa5e30e95227edda40f53dfc424239de06f0980a gpg4win-src-1.0.3.exe 7f0877dbde8e20e0b50288fefe4f77f1574bc50b gpg4win-1.0.3.tar.bz2 MD5 checksums are: 543343e59df88354627e018e0d3052ce gpg4win-1.0.3.exe c5ea9009beb27e16f955cc83ca5573ef gpg4win-light-1.0.3.exe 0d247c343c5623cb459b5debdadd30f7 gpg4win-src-1.0.3.exe 6ed1496b1edacfc7d7416e4155e3fe9e gpg4win-1.0.3.tar.bz2 We like to thank the authors of the included packages, the NSIS authors, all other contributors and first of all, those folks who stayed with us and tested the early releases of gpg4win. Happy hacking, Jan, Marcus, Timo and Werner -- Werner Koch The GnuPG Experts http://g10code.com Join the Fellowship and protect your Freedom! http://www.fsfe.org