From cvs at cvs.gnupg.org Mon Dec 1 10:44:46 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 01 Dec 2014 10:44:46 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-54-g2f90b7c Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 2f90b7c21b2f84ca2bf5f4555da9233e84606b4e (commit) via eede0e59bf6281777da7391752ae4191f3e51204 (commit) via cdd451d5c2bdd7e157edfee6e9b2b327a86ddeae (commit) from e1f515b19c7f63b6d0b0253319b9fc41dabed657 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 2f90b7c21b2f84ca2bf5f4555da9233e84606b4e Author: Werner Koch Date: Mon Dec 1 10:45:06 2014 +0100 scd: Implement socket redirection. * scd/scdaemon.c (ENAMETOOLONG): New. (redir_socket_name): New. (cleanup): Take care of a redirected socket. (main): Pass redir_socket_name to create_server_socket. (create_socket_name): Remove superfluous length check. (create_server_socket): Add arg r_redir_name and implement redirection. Replace assert for older Assuan by an error message. Signed-off-by: Werner Koch diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c index 7576cf9..de40e3b 100644 --- a/agent/gpg-agent.c +++ b/agent/gpg-agent.c @@ -1525,8 +1525,8 @@ create_socket_name (char *standard_name, int with_homedir) /* Create a Unix domain socket with NAME. Returns the file descriptor or terminates the process in case of an error. Note that this function needs to be used for the regular socket first (indicated - by PRIMARY) and only then for the extra and the ssh sockets. if - the soecket has been redirected the name of the real socket is + by PRIMARY) and only then for the extra and the ssh sockets. If + the socket has been redirected the name of the real socket is stored as a malloced string at R_REDIR_NAME. */ static gnupg_fd_t create_server_socket (char *name, int primary, diff --git a/scd/scdaemon.c b/scd/scdaemon.c index 77b6283..763ce2d 100644 --- a/scd/scdaemon.c +++ b/scd/scdaemon.c @@ -55,6 +55,9 @@ #include "asshelp.h" #include "../common/init.h" +#ifndef ENAMETOOLONG +# define ENAMETOOLONG EINVAL +#endif enum cmd_and_opt_values { aNull = 0, @@ -194,6 +197,8 @@ static int pipe_server; /* Name of the communication socket */ static char *socket_name; +/* Name of the redirected socket or NULL. */ +static char *redir_socket_name; /* We need to keep track of the server's nonces (these are dummies for POSIX systems). */ @@ -207,6 +212,7 @@ static int ticker_disabled; static char *create_socket_name (char *standard_name); static gnupg_fd_t create_server_socket (const char *name, + char **r_redir_name, assuan_sock_nonce_t *nonce); static void *start_connection_thread (void *arg); @@ -357,14 +363,17 @@ cleanup (void) { if (socket_name && *socket_name) { + char *name; char *p; - remove (socket_name); - p = strrchr (socket_name, '/'); + name = redir_socket_name? redir_socket_name : socket_name; + + gnupg_remove (name); + p = strrchr (name, '/'); if (p) { *p = 0; - rmdir (socket_name); + rmdir (name); *p = '/'; } *socket_name = 0; @@ -736,7 +745,8 @@ main (int argc, char **argv ) if (multi_server) { socket_name = create_socket_name (SCDAEMON_SOCK_NAME); - fd = FD2INT(create_server_socket (socket_name, &socket_nonce)); + fd = FD2INT(create_server_socket (socket_name, + &redir_socket_name, &socket_nonce)); } res = npth_attr_init (&tattr); @@ -788,7 +798,8 @@ main (int argc, char **argv ) /* Create the socket. */ socket_name = create_socket_name (SCDAEMON_SOCK_NAME); - fd = FD2INT (create_server_socket (socket_name, &socket_nonce)); + fd = FD2INT (create_server_socket (socket_name, + &redir_socket_name, &socket_nonce)); fflush (NULL); @@ -1025,26 +1036,28 @@ create_socket_name (char *standard_name) log_error (("'%s' are not allowed in the socket name\n"), PATHSEP_S); scd_exit (2); } - if (strlen (name) + 1 >= DIMof (struct sockaddr_un, sun_path) ) - { - log_error (_("name of socket too long\n")); - scd_exit (2); - } return name; } /* Create a Unix domain socket with NAME. Returns the file descriptor - or terminates the process in case of an error. */ + or terminates the process in case of an error. If the socket has + been redirected the name of the real socket is stored as a malloced + string at R_REDIR_NAME. */ static gnupg_fd_t -create_server_socket (const char *name, assuan_sock_nonce_t *nonce) +create_server_socket (const char *name, char **r_redir_name, + assuan_sock_nonce_t *nonce) { - struct sockaddr_un *serv_addr; + struct sockaddr *addr; + struct sockaddr_un *unaddr; socklen_t len; gnupg_fd_t fd; int rc; + xfree (*r_redir_name); + *r_redir_name = NULL; + fd = assuan_sock_new (AF_UNIX, SOCK_STREAM, 0); if (fd == GNUPG_INVALID_FD) { @@ -1052,26 +1065,55 @@ create_server_socket (const char *name, assuan_sock_nonce_t *nonce) scd_exit (2); } - serv_addr = xmalloc (sizeof (*serv_addr)); - memset (serv_addr, 0, sizeof *serv_addr); - serv_addr->sun_family = AF_UNIX; - assert (strlen (name) + 1 < sizeof (serv_addr->sun_path)); - strcpy (serv_addr->sun_path, name); - len = SUN_LEN (serv_addr); + unaddr = xmalloc (sizeof (*unaddr)); + addr = (struct sockaddr*)unaddr; + +#if ASSUAN_VERSION_NUMBER >= 0x020104 /* >= 2.1.4 */ + { + int redirected; + + if (assuan_sock_set_sockaddr_un (name, addr, &redirected)) + { + if (errno == ENAMETOOLONG) + log_error (_("socket name '%s' is too long\n"), name); + else + log_error ("error preparing socket '%s': %s\n", + name, gpg_strerror (gpg_error_from_syserror ())); + scd_exit (2); + } + if (redirected) + { + *r_redir_name = xstrdup (unaddr->sun_path); + if (opt.verbose) + log_info ("redirecting socket '%s' to '%s'\n", name, *r_redir_name); + } + } +#else /* Assuan < 2.1.4 */ + memset (unaddr, 0, sizeof *unaddr); + unaddr->sun_family = AF_UNIX; + if (strlen (name) + 1 >= sizeof (unaddr->sun_path)) + { + log_error (_("socket name '%s' is too long\n"), name); + scd_exit (2); + } + strcpy (unaddr->sun_path, name); +#endif /* Assuan < 2.1.4 */ + + len = SUN_LEN (unaddr); - rc = assuan_sock_bind (fd, (struct sockaddr*) serv_addr, len); + rc = assuan_sock_bind (fd, addr, len); if (rc == -1 && errno == EADDRINUSE) { - remove (name); - rc = assuan_sock_bind (fd, (struct sockaddr*) serv_addr, len); + gnupg_remove (unaddr->sun_path); + rc = assuan_sock_bind (fd, addr, len); } if (rc != -1 - && (rc=assuan_sock_get_nonce ((struct sockaddr*)serv_addr, len, nonce))) + && (rc=assuan_sock_get_nonce (addr, len, nonce))) log_error (_("error getting nonce for the socket\n")); if (rc == -1) { log_error (_("error binding socket to '%s': %s\n"), - serv_addr->sun_path, + unaddr->sun_path, gpg_strerror (gpg_error_from_syserror ())); assuan_sock_close (fd); scd_exit (2); @@ -1086,7 +1128,7 @@ create_server_socket (const char *name, assuan_sock_nonce_t *nonce) } if (opt.verbose) - log_info (_("listening on socket '%s'\n"), serv_addr->sun_path); + log_info (_("listening on socket '%s'\n"), unaddr->sun_path); return fd; } commit eede0e59bf6281777da7391752ae4191f3e51204 Author: Werner Koch Date: Mon Dec 1 09:50:55 2014 +0100 dirmngr: Implement socket redirection. * dirmngr/dirmngr.c (ENAMETOOLONG): new. (redir_socket_name): New. (main): Add Assuan socket redirection. (cleanup): Adjust cleanup for redirection. -- Signed-off-by: Werner Koch diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c index 95f9058..d3424c1 100644 --- a/dirmngr/dirmngr.c +++ b/dirmngr/dirmngr.c @@ -79,6 +79,10 @@ # define USE_W32_SERVICE 1 #endif +#ifndef ENAMETOOLONG +# define ENAMETOOLONG EINVAL +#endif + enum cmd_and_opt_values { aNull = 0, @@ -237,8 +241,11 @@ static ARGPARSE_OPTS opts[] = { #define DEFAULT_MAX_REPLIES 10 #define DEFAULT_LDAP_TIMEOUT 100 /* arbitrary large timeout */ -/* For the cleanup handler we need to keep track of the socket's name. */ +/* For the cleanup handler we need to keep track of the socket's name. */ static const char *socket_name; +/* If the socket has been redirected, this is the name of the + redirected socket.. */ +static const char *redir_socket_name; /* We need to keep track of the server's nonces (these are dummies for POSIX systems). */ @@ -1047,12 +1054,6 @@ main (int argc, char **argv) dirmngr_exit (1); } #endif - if (strlen (socket_name)+1 >= sizeof serv_addr.sun_path ) - { - log_error (_("name of socket too long\n")); - dirmngr_exit (1); - } - fd = assuan_sock_new (AF_UNIX, SOCK_STREAM, 0); if (fd == ASSUAN_INVALID_FD) { @@ -1061,9 +1062,41 @@ main (int argc, char **argv) dirmngr_exit (1); } +#if ASSUAN_VERSION_NUMBER >= 0x020104 /* >= 2.1.4 */ + { + int redirected; + + if (assuan_sock_set_sockaddr_un (socket_name, + (struct sockaddr*)&serv_addr, + &redirected)) + { + if (errno == ENAMETOOLONG) + log_error (_("socket name '%s' is too long\n"), socket_name); + else + log_error ("error preparing socket '%s': %s\n", + socket_name, + gpg_strerror (gpg_error_from_syserror ())); + dirmngr_exit (1); + } + if (redirected) + { + redir_socket_name = xstrdup (serv_addr.sun_path); + if (opt.verbose) + log_info ("redirecting socket '%s' to '%s'\n", + socket_name, redir_socket_name); + } + } +#else /* Assuan < 2.1.4 */ memset (&serv_addr, 0, sizeof serv_addr); serv_addr.sun_family = AF_UNIX; + if (strlen (socket_name)+1 >= sizeof serv_addr.sun_path ) + { + log_error (_("socket name '%s' is too long\n"), socket_name); + dirmngr_exit (1); + } strcpy (serv_addr.sun_path, socket_name); +#endif /* Assuan < 2.1.4 */ + len = SUN_LEN (&serv_addr); rc = assuan_sock_bind (fd, (struct sockaddr*) &serv_addr, len); @@ -1075,7 +1108,7 @@ main (int argc, char **argv) )) { /* Fixme: We should test whether a dirmngr is already running. */ - gnupg_remove (socket_name); + gnupg_remove (redir_socket_name? redir_socket_name : socket_name); rc = assuan_sock_bind (fd, (struct sockaddr*) &serv_addr, len); } if (rc != -1 @@ -1084,7 +1117,8 @@ main (int argc, char **argv) if (rc == -1) { log_error (_("error binding socket to '%s': %s\n"), - serv_addr.sun_path, gpg_strerror (gpg_error_from_errno (errno))); + serv_addr.sun_path, + gpg_strerror (gpg_error_from_errno (errno))); assuan_sock_close (fd); dirmngr_exit (1); } @@ -1098,7 +1132,7 @@ main (int argc, char **argv) } if (opt.verbose) - log_info (_("listening on socket '%s'\n"), socket_name ); + log_info (_("listening on socket '%s'\n"), serv_addr.sun_path); es_fflush (NULL); @@ -1132,7 +1166,7 @@ main (int argc, char **argv) /* Create the info string: :: */ if (asprintf (&infostr, "%s=%s:%lu:1", - DIRMNGR_INFO_NAME, socket_name, (ulong)pid ) < 0) + DIRMNGR_INFO_NAME, serv_addr.sun_path, (ulong)pid ) < 0) { log_error (_("out of core\n")); kill (pid, SIGTERM); @@ -1412,7 +1446,9 @@ cleanup (void) if (cleanup_socket) { cleanup_socket = 0; - if (socket_name && *socket_name) + if (redir_socket_name) + gnupg_remove (redir_socket_name); + else if (socket_name && *socket_name) gnupg_remove (socket_name); } } commit cdd451d5c2bdd7e157edfee6e9b2b327a86ddeae Author: Werner Koch Date: Mon Dec 1 09:49:16 2014 +0100 agent: Fix compile problem for old Libassuan. -- diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c index 3ad2c1d..7576cf9 100644 --- a/agent/gpg-agent.c +++ b/agent/gpg-agent.c @@ -1574,7 +1574,6 @@ create_server_socket (char *name, int primary, } } #else /* Assuan < 2.1.4 */ - redirected = 0; memset (unaddr, 0, sizeof *unaddr); unaddr->sun_family = AF_UNIX; if (strlen (name) + 1 >= sizeof (unaddr->sun_path)) ----------------------------------------------------------------------- Summary of changes: agent/gpg-agent.c | 5 ++- dirmngr/dirmngr.c | 60 +++++++++++++++++++++++++++------- scd/scdaemon.c | 92 ++++++++++++++++++++++++++++++++++++++--------------- 3 files changed, 117 insertions(+), 40 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 1 11:54:21 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 01 Dec 2014 11:54:21 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-55-gf1c3eb4 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via f1c3eb4b16ca43b5d3712a3b54c22d17ce85af47 (commit) from 2f90b7c21b2f84ca2bf5f4555da9233e84606b4e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f1c3eb4b16ca43b5d3712a3b54c22d17ce85af47 Author: Werner Koch Date: Mon Dec 1 11:54:51 2014 +0100 gpg: Fix export bug using exact search with only one key in the keybox. * g10/export.c (do_export_stream): Disable caching. * g10/keyserver.c (keyidlist): Ditto. -- GnuPG-bug-id: 1774 diff --git a/g10/export.c b/g10/export.c index a92eace..b65fb8d 100644 --- a/g10/export.c +++ b/g10/export.c @@ -804,6 +804,8 @@ do_export_stream (ctrl_t ctrl, iobuf_t out, strlist_t users, int secret, sl->d, gpg_strerror (err)); } + keydb_disable_caching (kdbhd); /* We are looping the search. */ + /* It would be nice to see which of the given users did actually match one in the keyring. To implement this we need to have a found flag for each entry in desc. To set this flag we diff --git a/g10/keydb.c b/g10/keydb.c index bafae18..a578c7c 100644 --- a/g10/keydb.c +++ b/g10/keydb.c @@ -1424,6 +1424,9 @@ keydb_search (KEYDB_HANDLE hd, KEYDB_SEARCH_DESC *desc, if (DBG_CACHE) dump_search_desc (hd, "keydb_search", desc, ndesc); + /* NB: If one of the exact search modes below is used in a loop to + walk over all keys (with the same fingerprint) the caching must + have been disabled for the handle. */ if (!hd->no_caching && ndesc == 1 && (desc[0].mode == KEYDB_SEARCH_MODE_FPR20 diff --git a/g10/keyserver.c b/g10/keyserver.c index 5bc1eba..e3ad707 100644 --- a/g10/keyserver.c +++ b/g10/keyserver.c @@ -1229,7 +1229,8 @@ keyidlist(strlist_t users,KEYDB_SEARCH_DESC **klist,int *count,int fakev3) *klist=xmalloc(sizeof(KEYDB_SEARCH_DESC)*num); - kdbhd=keydb_new (); + kdbhd = keydb_new (); + keydb_disable_caching (kdbhd); /* We are looping the search. */ if(!users) { ----------------------------------------------------------------------- Summary of changes: g10/export.c | 2 ++ g10/keydb.c | 3 +++ g10/keyserver.c | 3 ++- 3 files changed, 7 insertions(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 1 15:55:21 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 01 Dec 2014 15:55:21 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-56-g0367a4b Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 0367a4b8cfbf1f197e093ca2b83b27e0a409c3c7 (commit) from f1c3eb4b16ca43b5d3712a3b54c22d17ce85af47 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 0367a4b8cfbf1f197e093ca2b83b27e0a409c3c7 Author: Werner Koch Date: Mon Dec 1 15:55:28 2014 +0100 tools: Improve watchgnupg portability. * configure.ac (AC_CHECK_HEADERS): Check for sys.select.h * tools/watchgnupg.c: Include it. -- It seems http://www.musl-libc.org/ is quite limited and requires the use sys/select.h instead of unistd.h et al. diff --git a/configure.ac b/configure.ac index 95711cb..4ea0bbe 100644 --- a/configure.ac +++ b/configure.ac @@ -1190,7 +1190,7 @@ fi AC_MSG_NOTICE([checking for header files]) AC_HEADER_STDC AC_CHECK_HEADERS([string.h unistd.h langinfo.h termio.h locale.h getopt.h \ - pty.h utmp.h pwd.h inttypes.h signal.h]) + pty.h utmp.h pwd.h inttypes.h signal.h sys/select.h]) AC_HEADER_TIME diff --git a/tools/watchgnupg.c b/tools/watchgnupg.c index 4f4d54d..8ad2a13 100644 --- a/tools/watchgnupg.c +++ b/tools/watchgnupg.c @@ -34,6 +34,9 @@ #include #include #include +#ifdef HAVE_SYS_SELECT_H +# include +#endif #define PGM "watchgnupg" ----------------------------------------------------------------------- Summary of changes: configure.ac | 2 +- tools/watchgnupg.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Tue Dec 2 14:13:18 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Tue, 02 Dec 2014 14:13:18 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-57-gfabcf14 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via fabcf1440a6900b9471f11e4f2a015e9f2d1a74c (commit) from 0367a4b8cfbf1f197e093ca2b83b27e0a409c3c7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit fabcf1440a6900b9471f11e4f2a015e9f2d1a74c Author: Werner Koch Date: Tue Dec 2 14:13:53 2014 +0100 agent: Replace some sprintf. * agent/call-scd.c (agent_card_pksign): Replace sprintf by bin2hex. * agent/command-ssh.c (ssh_identity_register): Ditto. * agent/pkdecrypt.c (agent_pkdecrypt): Replace sprintf by put_membuf_printf. Signed-off-by: Werner Koch diff --git a/agent/call-scd.c b/agent/call-scd.c index 289b2d9..ade7ef1 100644 --- a/agent/call-scd.c +++ b/agent/call-scd.c @@ -822,8 +822,8 @@ agent_card_pksign (ctrl_t ctrl, const unsigned char *indata, size_t indatalen, unsigned char **r_buf, size_t *r_buflen) { - int rc, i; - char *p, line[ASSUAN_LINELENGTH]; + int rc; + char line[ASSUAN_LINELENGTH]; membuf_t data; struct inq_needpin_s inqparm; @@ -835,10 +835,8 @@ agent_card_pksign (ctrl_t ctrl, if (indatalen*2 + 50 > DIM(line)) return unlock_scd (ctrl, gpg_error (GPG_ERR_GENERAL)); - sprintf (line, "SETDATA "); - p = line + strlen (line); - for (i=0; i < indatalen ; i++, p += 2 ) - sprintf (p, "%02X", indata[i]); + bin2hex (indata, indatalen, stpcpy (line, "SETDATA ")); + rc = assuan_transact (ctrl->scd_local->ctx, line, NULL, NULL, NULL, NULL, NULL, NULL); if (rc) diff --git a/agent/command-ssh.c b/agent/command-ssh.c index 493011c..2d00512 100644 --- a/agent/command-ssh.c +++ b/agent/command-ssh.c @@ -3063,7 +3063,6 @@ ssh_identity_register (ctrl_t ctrl, ssh_key_type_spec_t *spec, char *comment = NULL; char *key_fpr = NULL; const char *initial_errtext = NULL; - unsigned int i; struct pin_entry_info_s *pi = NULL, *pi2; err = ssh_key_grip (key, key_grip_raw); @@ -3139,9 +3138,7 @@ ssh_identity_register (ctrl_t ctrl, ssh_key_type_spec_t *spec, goto out; /* Cache this passphrase. */ - for (i = 0; i < 20; i++) - sprintf (key_grip + 2 * i, "%02X", key_grip_raw[i]); - + bin2hex (key_grip_raw, 20, key_grip); err = agent_put_cache (key_grip, CACHE_MODE_SSH, pi->pin, ttl); if (err) goto out; diff --git a/agent/pkdecrypt.c b/agent/pkdecrypt.c index 945de3c..8c09b8c 100644 --- a/agent/pkdecrypt.c +++ b/agent/pkdecrypt.c @@ -94,14 +94,9 @@ agent_pkdecrypt (ctrl_t ctrl, const char *desc_text, goto leave; } - { - char tmpbuf[60]; - - sprintf (tmpbuf, "(5:value%u:", (unsigned int)len); - put_membuf (outbuf, tmpbuf, strlen (tmpbuf)); - put_membuf (outbuf, buf, len); - put_membuf (outbuf, ")", 2); - } + put_membuf_printf (outbuf, "(5:value%u:", (unsigned int)len); + put_membuf (outbuf, buf, len); + put_membuf (outbuf, ")", 2); } else { /* No smartcard, but a private key */ ----------------------------------------------------------------------- Summary of changes: agent/call-scd.c | 10 ++++------ agent/command-ssh.c | 5 +---- agent/pkdecrypt.c | 11 +++-------- 3 files changed, 8 insertions(+), 18 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Wed Dec 3 10:01:11 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 03 Dec 2014 10:01:11 +0100 Subject: [git] GPG-ERROR - branch, master, updated. libgpg-error-1.17-9-g149fe98 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Error codes used by GnuPG et al.". The branch, master has been updated via 149fe98e1279b065edb06958d9a73a0c013c2db9 (commit) from 210126d38096e764dd3a82da45f8b5f66309ecd5 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 149fe98e1279b065edb06958d9a73a0c013c2db9 Author: Werner Koch Date: Wed Dec 3 10:01:38 2014 +0100 Add GPG_ERR_FORBIDDEN. diff --git a/NEWS b/NEWS index 3404f7d..d6a3eb4 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,10 @@ Noteworthy changes in version 1.18 (unreleased) [C13/A13/R_] ----------------------------------------------- + * Interface changes relative to the 1.17 release: + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + GPG_ERR_FORBIDDEN NEW. + Noteworthy changes in version 1.17 (2014-10-15) [C13/A13/R0] ----------------------------------------------- diff --git a/doc/errorref.txt b/doc/errorref.txt index 07b7cd4..886a304 100644 --- a/doc/errorref.txt +++ b/doc/errorref.txt @@ -718,6 +718,10 @@ GPG_ERR_BOGUS_STRING Bogus string possible dangerous characters (e.g. control characters in a domain name). +GPG_ERR_FORBIDDEN Forbidden + + The use of a features is not allowed to to insuffcient rights. + Use by gpg-agent as aerror codes for restricted commands. GPG_ERR_KEY_DISABLED Key disabled diff --git a/src/err-codes.h.in b/src/err-codes.h.in index 704049c..5990bd0 100644 --- a/src/err-codes.h.in +++ b/src/err-codes.h.in @@ -274,8 +274,7 @@ 248 GPG_ERR_BAD_HS_SERVER_KEX Bad server key exchange message in handshake 249 GPG_ERR_BAD_HS_CLIENT_KEX Bad client key exchange message in handshake 250 GPG_ERR_BOGUS_STRING Bogus string -# 251 is free to be used. - +251 GPG_ERR_FORBIDDEN Forbidden 252 GPG_ERR_KEY_DISABLED Key disabled 253 GPG_ERR_KEY_ON_CARD Not possible with a card based key 254 GPG_ERR_INV_LOCK_OBJ Invalid lock object ----------------------------------------------------------------------- Summary of changes: NEWS | 4 ++++ doc/errorref.txt | 4 ++++ src/err-codes.h.in | 3 +-- 3 files changed, 9 insertions(+), 2 deletions(-) hooks/post-receive -- Error codes used by GnuPG et al. http://git.gnupg.org From cvs at cvs.gnupg.org Thu Dec 4 10:52:47 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 04 Dec 2014 10:52:47 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-60-g63e7891 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 63e7891f0f9f0228d93c6cd979fbf2797da2b67d (commit) via 2d37e0c800623c3704d9167153507df83b75745e (commit) via 17b4662984b4669d8dcbbd6705ccfbe6c263319c (commit) from fabcf1440a6900b9471f11e4f2a015e9f2d1a74c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 63e7891f0f9f0228d93c6cd979fbf2797da2b67d Author: Werner Koch Date: Thu Dec 4 10:53:10 2014 +0100 gpg: Allow import of large keys. * g10/import.c (import): Skip too large keys. * kbx/keybox-file.c (IMAGELEN_LIMIT): Change limit from 2MB to 5MB. -- The key which triggered the problem was 0x57930DAB0B86B067. With this patch it can be imported. Keys larger than the now increased limit of 5MB will are skipped and the already existing not_imported counter is bumped up. Signed-off-by: Werner Koch diff --git a/NEWS b/NEWS index 7643a02..9b17fe1 100644 --- a/NEWS +++ b/NEWS @@ -26,6 +26,8 @@ Noteworthy changes in version 2.1.1 (unreleased) * gpg: Removed the option aliases --throw-keyid and --notation-data; use --throw-keyids and --set-notation instead. + * gpg: Skip too large keys during import. + Noteworthy changes in version 2.1.0 (2014-11-06) ------------------------------------------------ diff --git a/g10/import.c b/g10/import.c index c41ff63..4ae9135 100644 --- a/g10/import.c +++ b/g10/import.c @@ -341,10 +341,20 @@ import (ctrl_t ctrl, IOBUF inp, const char* fname,struct stats_s *stats, log_info (_("skipping block of type %d\n"), keyblock->pkt->pkttype); } release_kbnode (keyblock); - /* fixme: we should increment the not imported counter but this - does only make sense if we keep on going despite of errors. */ - if (rc) + + /* fixme: we should increment the not imported counter but + this does only make sense if we keep on going despite of + errors. For now we do this only if the imported key is too + large. */ + if (gpg_err_code (rc) == GPG_ERR_TOO_LARGE + && gpg_err_source (rc) == GPG_ERR_SOURCE_KEYBOX) + { + stats->not_imported++; + rc = 0; + } + else if (rc) break; + if (!(++stats->count % 100) && !opt.quiet) log_info (_("%lu keys processed so far\n"), stats->count ); } diff --git a/kbx/keybox-file.c b/kbx/keybox-file.c index 98808ed..21d6038 100644 --- a/kbx/keybox-file.c +++ b/kbx/keybox-file.c @@ -27,7 +27,7 @@ #include "keybox-defs.h" -#define IMAGELEN_LIMIT (2*1024*1024) +#define IMAGELEN_LIMIT (5*1024*1024) #if !defined(HAVE_FTELLO) && !defined(ftello) commit 2d37e0c800623c3704d9167153507df83b75745e Author: Werner Koch Date: Thu Dec 4 10:45:53 2014 +0100 indentation: Update g10/import.c -- diff --git a/g10/import.c b/g10/import.c index a33690b..c41ff63 100644 --- a/g10/import.c +++ b/g10/import.c @@ -1,6 +1,5 @@ /* import.c - import a key into our key storage. - * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, - * 2007, 2010, 2011 Free Software Foundation, Inc. + * Copyright (C) 1998-2007, 2010-2011 Free Software Foundation, Inc. * Copyright (C) 2014 Werner Koch * * This file is part of GnuPG. @@ -41,23 +40,24 @@ #include "call-agent.h" #include "../common/membuf.h" -struct stats_s { - ulong count; - ulong no_user_id; - ulong imported; - ulong n_uids; - ulong n_sigs; - ulong n_subk; - ulong unchanged; - ulong n_revoc; - ulong secret_read; - ulong secret_imported; - ulong secret_dups; - ulong skipped_new_keys; - ulong not_imported; - ulong n_sigs_cleaned; - ulong n_uids_cleaned; - ulong v3keys; /* Number of V3 keys seen. */ +struct stats_s +{ + ulong count; + ulong no_user_id; + ulong imported; + ulong n_uids; + ulong n_sigs; + ulong n_subk; + ulong unchanged; + ulong n_revoc; + ulong secret_read; + ulong secret_imported; + ulong secret_dups; + ulong skipped_new_keys; + ulong not_imported; + ulong n_sigs_cleaned; + ulong n_uids_cleaned; + ulong v3keys; /* Number of V3 keys seen. */ }; @@ -65,34 +65,34 @@ static int import (ctrl_t ctrl, IOBUF inp, const char* fname, struct stats_s *stats, unsigned char **fpr, size_t *fpr_len, unsigned int options, import_screener_t screener, void *screener_arg); -static int read_block (IOBUF a, PACKET **pending_pkt, KBNODE *ret_root, +static int read_block (IOBUF a, PACKET **pending_pkt, kbnode_t *ret_root, int *r_v3keys); static void revocation_present (ctrl_t ctrl, kbnode_t keyblock); static int import_one (ctrl_t ctrl, - const char *fname, KBNODE keyblock,struct stats_s *stats, + const char *fname, kbnode_t keyblock,struct stats_s *stats, unsigned char **fpr, size_t *fpr_len, unsigned int options, int from_sk, int silent, import_screener_t screener, void *screener_arg); -static int import_secret_one (ctrl_t ctrl, const char *fname, KBNODE keyblock, +static int import_secret_one (ctrl_t ctrl, const char *fname, kbnode_t keyblock, struct stats_s *stats, int batch, unsigned int options, int for_migration, import_screener_t screener, void *screener_arg); -static int import_revoke_cert( const char *fname, KBNODE node, +static int import_revoke_cert( const char *fname, kbnode_t node, struct stats_s *stats); -static int chk_self_sigs( const char *fname, KBNODE keyblock, +static int chk_self_sigs (const char *fname, kbnode_t keyblock, PKT_public_key *pk, u32 *keyid, int *non_self ); -static int delete_inv_parts( const char *fname, KBNODE keyblock, +static int delete_inv_parts (const char *fname, kbnode_t keyblock, u32 *keyid, unsigned int options ); -static int merge_blocks( const char *fname, KBNODE keyblock_orig, - KBNODE keyblock, u32 *keyid, +static int merge_blocks (const char *fname, kbnode_t keyblock_orig, + kbnode_t keyblock, u32 *keyid, int *n_uids, int *n_sigs, int *n_subk ); -static int append_uid( KBNODE keyblock, KBNODE node, int *n_sigs, +static int append_uid (kbnode_t keyblock, kbnode_t node, int *n_sigs, const char *fname, u32 *keyid ); -static int append_key( KBNODE keyblock, KBNODE node, int *n_sigs, +static int append_key (kbnode_t keyblock, kbnode_t node, int *n_sigs, const char *fname, u32 *keyid ); -static int merge_sigs( KBNODE dst, KBNODE src, int *n_sigs, +static int merge_sigs (kbnode_t dst, kbnode_t src, int *n_sigs, const char *fname, u32 *keyid ); -static int merge_keysigs( KBNODE dst, KBNODE src, int *n_sigs, +static int merge_keysigs (kbnode_t dst, kbnode_t src, int *n_sigs, const char *fname, u32 *keyid ); int @@ -136,19 +136,22 @@ parse_import_options(char *str,unsigned int *options,int noisy) return parse_options(str,options,import_opts,noisy); } + void * import_new_stats_handle (void) { - return xmalloc_clear ( sizeof (struct stats_s) ); + return xmalloc_clear ( sizeof (struct stats_s) ); } + void import_release_stats_handle (void *p) { - xfree (p); + xfree (p); } -/**************** + +/* * Import the public keys from the given filename. Input may be armored. * This function rejects all keys which are not validly self signed on at * least one userid. Only user ids which are self signed will be imported. @@ -177,7 +180,6 @@ import_release_stats_handle (void *p) * - Proceed with next signature. * * Key revocation certificates have special handling. - * */ static int import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames, @@ -185,64 +187,70 @@ import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames, unsigned int options, import_screener_t screener, void *screener_arg) { - int i, rc = 0; - struct stats_s *stats = stats_handle; + int i; + int rc = 0; + struct stats_s *stats = stats_handle; - if (!stats) - stats = import_new_stats_handle (); + if (!stats) + stats = import_new_stats_handle (); - if (inp) { + if (inp) + { rc = import (ctrl, inp, "[stream]", stats, fpr, fpr_len, options, screener, screener_arg); } - else { - if( !fnames && !nnames ) - nnames = 1; /* Ohh what a ugly hack to jump into the loop */ - - for(i=0; i < nnames; i++ ) { - const char *fname = fnames? fnames[i] : NULL; - IOBUF inp2 = iobuf_open(fname); - if( !fname ) - fname = "[stdin]"; - if (inp2 && is_secured_file (iobuf_get_fd (inp2))) - { - iobuf_close (inp2); - inp2 = NULL; - gpg_err_set_errno (EPERM); - } - if( !inp2 ) - log_error(_("can't open '%s': %s\n"), fname, strerror(errno) ); - else - { - rc = import (ctrl, inp2, fname, stats, fpr, fpr_len, options, - screener, screener_arg); - iobuf_close(inp2); - /* Must invalidate that ugly cache to actually close it. */ - iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, - 0, (char*)fname); - if( rc ) - log_error("import from '%s' failed: %s\n", fname, - g10_errstr(rc) ); - } - if( !fname ) - break; + else + { + if (!fnames && !nnames) + nnames = 1; /* Ohh what a ugly hack to jump into the loop */ + + for (i=0; i < nnames; i++) + { + const char *fname = fnames? fnames[i] : NULL; + IOBUF inp2 = iobuf_open(fname); + + if (!fname) + fname = "[stdin]"; + if (inp2 && is_secured_file (iobuf_get_fd (inp2))) + { + iobuf_close (inp2); + inp2 = NULL; + gpg_err_set_errno (EPERM); + } + if (!inp2) + log_error (_("can't open '%s': %s\n"), fname, strerror (errno)); + else + { + rc = import (ctrl, inp2, fname, stats, fpr, fpr_len, options, + screener, screener_arg); + iobuf_close (inp2); + /* Must invalidate that ugly cache to actually close it. */ + iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname); + if (rc) + log_error ("import from '%s' failed: %s\n", + fname, g10_errstr(rc) ); + } + if (!fname) + break; } } - if (!stats_handle) { - import_print_stats (stats); - import_release_stats_handle (stats); + + if (!stats_handle) + { + import_print_stats (stats); + import_release_stats_handle (stats); } - /* If no fast import and the trustdb is dirty (i.e. we added a key - or userID that had something other than a selfsig, a signature - that was other than a selfsig, or any revocation), then - update/check the trustdb if the user specified by setting - interactive or by not setting no-auto-check-trustdb */ + /* If no fast import and the trustdb is dirty (i.e. we added a key + or userID that had something other than a selfsig, a signature + that was other than a selfsig, or any revocation), then + update/check the trustdb if the user specified by setting + interactive or by not setting no-auto-check-trustdb */ - if(!(options&IMPORT_FAST)) - check_or_update_trustdb (); + if (!(options & IMPORT_FAST)) + check_or_update_trustdb (); - return rc; + return rc; } @@ -295,56 +303,58 @@ import (ctrl_t ctrl, IOBUF inp, const char* fname,struct stats_s *stats, unsigned char **fpr,size_t *fpr_len, unsigned int options, import_screener_t screener, void *screener_arg) { - PACKET *pending_pkt = NULL; - KBNODE keyblock = NULL; /* Need to initialize because gcc can't + PACKET *pending_pkt = NULL; + kbnode_t keyblock = NULL; /* Need to initialize because gcc can't grasp the return semantics of read_block. */ - int rc = 0; - int v3keys; + int rc = 0; + int v3keys; - getkey_disable_caches(); + getkey_disable_caches (); - if( !opt.no_armor ) { /* armored reading is not disabled */ - armor_filter_context_t *afx; + if (!opt.no_armor) /* Armored reading is not disabled. */ + { + armor_filter_context_t *afx; - afx = new_armor_context (); - afx->only_keyblocks = 1; - push_armor_filter (afx, inp); - release_armor_context (afx); + afx = new_armor_context (); + afx->only_keyblocks = 1; + push_armor_filter (afx, inp); + release_armor_context (afx); } - while( !(rc = read_block( inp, &pending_pkt, &keyblock, &v3keys) )) { - stats->v3keys += v3keys; - if( keyblock->pkt->pkttype == PKT_PUBLIC_KEY ) - rc = import_one (ctrl, fname, keyblock, - stats, fpr, fpr_len, options, 0, 0, - screener, screener_arg); - else if( keyblock->pkt->pkttype == PKT_SECRET_KEY ) - rc = import_secret_one (ctrl, fname, keyblock, stats, - opt.batch, options, 0, - screener, screener_arg); - else if( keyblock->pkt->pkttype == PKT_SIGNATURE - && keyblock->pkt->pkt.signature->sig_class == 0x20 ) - rc = import_revoke_cert( fname, keyblock, stats ); - else { - log_info( _("skipping block of type %d\n"), - keyblock->pkt->pkttype ); + while (!(rc = read_block (inp, &pending_pkt, &keyblock, &v3keys))) + { + stats->v3keys += v3keys; + if (keyblock->pkt->pkttype == PKT_PUBLIC_KEY) + rc = import_one (ctrl, fname, keyblock, + stats, fpr, fpr_len, options, 0, 0, + screener, screener_arg); + else if (keyblock->pkt->pkttype == PKT_SECRET_KEY) + rc = import_secret_one (ctrl, fname, keyblock, stats, + opt.batch, options, 0, + screener, screener_arg); + else if (keyblock->pkt->pkttype == PKT_SIGNATURE + && keyblock->pkt->pkt.signature->sig_class == 0x20 ) + rc = import_revoke_cert( fname, keyblock, stats ); + else + { + log_info (_("skipping block of type %d\n"), keyblock->pkt->pkttype); } - release_kbnode(keyblock); - /* fixme: we should increment the not imported counter but this - does only make sense if we keep on going despite of errors. */ - if( rc ) - break; - if( !(++stats->count % 100) && !opt.quiet ) - log_info(_("%lu keys processed so far\n"), stats->count ); + release_kbnode (keyblock); + /* fixme: we should increment the not imported counter but this + does only make sense if we keep on going despite of errors. */ + if (rc) + break; + if (!(++stats->count % 100) && !opt.quiet) + log_info (_("%lu keys processed so far\n"), stats->count ); } - stats->v3keys += v3keys; - if( rc == -1 ) - rc = 0; - else if( rc && gpg_err_code (rc) != G10ERR_INV_KEYRING ) - log_error( _("error reading '%s': %s\n"), fname, g10_errstr(rc)); + stats->v3keys += v3keys; + if (rc == -1) + rc = 0; + else if (rc && gpg_err_code (rc) != G10ERR_INV_KEYRING) + log_error (_("error reading '%s': %s\n"), fname, g10_errstr(rc)); - return rc; + return rc; } @@ -404,50 +414,54 @@ import_old_secring (ctrl_t ctrl, const char *fname) void import_print_stats (void *hd) { - struct stats_s *stats = hd; - - if( !opt.quiet ) { - log_info(_("Total number processed: %lu\n"), - stats->count + stats->v3keys); - if( stats->v3keys) - log_info(_(" skipped PGP-2 keys: %lu\n"), stats->v3keys); - if( stats->skipped_new_keys ) - log_info(_(" skipped new keys: %lu\n"), - stats->skipped_new_keys ); - if( stats->no_user_id ) - log_info(_(" w/o user IDs: %lu\n"), stats->no_user_id ); - if( stats->imported) { - log_info(_(" imported: %lu"), stats->imported ); - log_printf ("\n"); - } - if( stats->unchanged ) - log_info(_(" unchanged: %lu\n"), stats->unchanged ); - if( stats->n_uids ) - log_info(_(" new user IDs: %lu\n"), stats->n_uids ); - if( stats->n_subk ) - log_info(_(" new subkeys: %lu\n"), stats->n_subk ); - if( stats->n_sigs ) - log_info(_(" new signatures: %lu\n"), stats->n_sigs ); - if( stats->n_revoc ) - log_info(_(" new key revocations: %lu\n"), stats->n_revoc ); - if( stats->secret_read ) - log_info(_(" secret keys read: %lu\n"), stats->secret_read ); - if( stats->secret_imported ) - log_info(_(" secret keys imported: %lu\n"), stats->secret_imported ); - if( stats->secret_dups ) - log_info(_(" secret keys unchanged: %lu\n"), stats->secret_dups ); - if( stats->not_imported ) - log_info(_(" not imported: %lu\n"), stats->not_imported ); - if( stats->n_sigs_cleaned) - log_info(_(" signatures cleaned: %lu\n"),stats->n_sigs_cleaned); - if( stats->n_uids_cleaned) - log_info(_(" user IDs cleaned: %lu\n"),stats->n_uids_cleaned); + struct stats_s *stats = hd; + + if (!opt.quiet) + { + log_info(_("Total number processed: %lu\n"), + stats->count + stats->v3keys); + if (stats->v3keys) + log_info(_(" skipped PGP-2 keys: %lu\n"), stats->v3keys); + if (stats->skipped_new_keys ) + log_info(_(" skipped new keys: %lu\n"), + stats->skipped_new_keys ); + if (stats->no_user_id ) + log_info(_(" w/o user IDs: %lu\n"), stats->no_user_id ); + if (stats->imported) + { + log_info(_(" imported: %lu"), stats->imported ); + log_printf ("\n"); + } + if (stats->unchanged ) + log_info(_(" unchanged: %lu\n"), stats->unchanged ); + if (stats->n_uids ) + log_info(_(" new user IDs: %lu\n"), stats->n_uids ); + if (stats->n_subk ) + log_info(_(" new subkeys: %lu\n"), stats->n_subk ); + if (stats->n_sigs ) + log_info(_(" new signatures: %lu\n"), stats->n_sigs ); + if (stats->n_revoc ) + log_info(_(" new key revocations: %lu\n"), stats->n_revoc ); + if (stats->secret_read ) + log_info(_(" secret keys read: %lu\n"), stats->secret_read ); + if (stats->secret_imported ) + log_info(_(" secret keys imported: %lu\n"), stats->secret_imported ); + if (stats->secret_dups ) + log_info(_(" secret keys unchanged: %lu\n"), stats->secret_dups ); + if (stats->not_imported ) + log_info(_(" not imported: %lu\n"), stats->not_imported ); + if (stats->n_sigs_cleaned) + log_info(_(" signatures cleaned: %lu\n"),stats->n_sigs_cleaned); + if (stats->n_uids_cleaned) + log_info(_(" user IDs cleaned: %lu\n"),stats->n_uids_cleaned); } - if( is_status_enabled() ) { - char buf[15*20]; - snprintf (buf, sizeof buf, - "%lu %lu %lu 0 %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu", + if (is_status_enabled ()) + { + char buf[15*20]; + + snprintf (buf, sizeof buf, + "%lu %lu %lu 0 %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu", stats->count + stats->v3keys, stats->no_user_id, stats->imported, @@ -460,9 +474,9 @@ import_print_stats (void *hd) stats->secret_imported, stats->secret_dups, stats->skipped_new_keys, - stats->not_imported, + stats->not_imported, stats->v3keys ); - write_status_text( STATUS_IMPORT_RES, buf ); + write_status_text (STATUS_IMPORT_RES, buf); } } @@ -497,71 +511,80 @@ valid_keyblock_packet (int pkttype) * keyblocks. */ static int -read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root, int *r_v3keys) +read_block( IOBUF a, PACKET **pending_pkt, kbnode_t *ret_root, int *r_v3keys) { - int rc; - PACKET *pkt; - KBNODE root = NULL; - int in_cert, in_v3key; + int rc; + PACKET *pkt; + kbnode_t root = NULL; + int in_cert, in_v3key; - *r_v3keys = 0; + *r_v3keys = 0; - if( *pending_pkt ) { - root = new_kbnode( *pending_pkt ); - *pending_pkt = NULL; - in_cert = 1; + if (*pending_pkt) + { + root = new_kbnode( *pending_pkt ); + *pending_pkt = NULL; + in_cert = 1; } - else - in_cert = 0; - pkt = xmalloc( sizeof *pkt ); - init_packet(pkt); - in_v3key = 0; - while( (rc=parse_packet(a, pkt)) != -1 ) { - if (rc && (gpg_err_code (rc) == GPG_ERR_INV_PACKET - && (pkt->pkttype == PKT_PUBLIC_KEY - || pkt->pkttype == PKT_SECRET_KEY) - && (pkt->pkt.public_key->version == 2 - || pkt->pkt.public_key->version == 3))) { - in_v3key = 1; - ++*r_v3keys; - free_packet (pkt); - init_packet (pkt); - continue; + else + in_cert = 0; + + pkt = xmalloc (sizeof *pkt); + init_packet (pkt); + in_v3key = 0; + while ((rc=parse_packet(a, pkt)) != -1) + { + if (rc && (gpg_err_code (rc) == GPG_ERR_INV_PACKET + && (pkt->pkttype == PKT_PUBLIC_KEY + || pkt->pkttype == PKT_SECRET_KEY) + && (pkt->pkt.public_key->version == 2 + || pkt->pkt.public_key->version == 3))) + { + in_v3key = 1; + ++*r_v3keys; + free_packet (pkt); + init_packet (pkt); + continue; } - else if (rc ) { /* ignore errors */ - if (gpg_err_code (rc) == GPG_ERR_UNKNOWN_PACKET) - ; /* Do not show a diagnostic. */ - else { - log_error("read_block: read error: %s\n", g10_errstr(rc) ); - rc = G10ERR_INV_KEYRING; - goto ready; - } - free_packet( pkt ); - init_packet(pkt); - continue; + else if (rc ) /* (ignore errors) */ + { + if (gpg_err_code (rc) == GPG_ERR_UNKNOWN_PACKET) + ; /* Do not show a diagnostic. */ + else + { + log_error("read_block: read error: %s\n", g10_errstr(rc) ); + rc = G10ERR_INV_KEYRING; + goto ready; + } + free_packet( pkt ); + init_packet(pkt); + continue; } if (in_v3key && !(pkt->pkttype == PKT_PUBLIC_KEY - || pkt->pkttype == PKT_SECRET_KEY)) { + || pkt->pkttype == PKT_SECRET_KEY)) + { free_packet( pkt ); init_packet(pkt); continue; - } + } in_v3key = 0; - if( !root && pkt->pkttype == PKT_SIGNATURE - && pkt->pkt.signature->sig_class == 0x20 ) { - /* this is a revocation certificate which is handled - * in a special way */ + if (!root && pkt->pkttype == PKT_SIGNATURE + && pkt->pkt.signature->sig_class == 0x20 ) + { + /* This is a revocation certificate which is handled in a + * special way. */ root = new_kbnode( pkt ); pkt = NULL; goto ready; - } + } - /* make a linked list of all packets */ - switch( pkt->pkttype ) { + /* Make a linked list of all packets. */ + switch (pkt->pkttype) + { case PKT_COMPRESSED: - if(check_compress_algo(pkt->pkt.compressed->algorithm)) + if (check_compress_algo (pkt->pkt.compressed->algorithm)) { rc = G10ERR_COMPR_ALGO; goto ready; @@ -577,44 +600,48 @@ read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root, int *r_v3keys) break; case PKT_RING_TRUST: - /* skip those packets */ + /* Skip those packets. */ free_packet( pkt ); init_packet(pkt); break; case PKT_PUBLIC_KEY: case PKT_SECRET_KEY: - if( in_cert ) { /* store this packet */ + if (in_cert ) /* Store this packet. */ + { *pending_pkt = pkt; pkt = NULL; goto ready; - } + } in_cert = 1; default: - if (in_cert && valid_keyblock_packet (pkt->pkttype)) { - if( !root ) - root = new_kbnode( pkt ); + if (in_cert && valid_keyblock_packet (pkt->pkttype)) + { + if (!root ) + root = new_kbnode (pkt); else - add_kbnode( root, new_kbnode( pkt ) ); - pkt = xmalloc( sizeof *pkt ); - } + add_kbnode (root, new_kbnode (pkt)); + pkt = xmalloc (sizeof *pkt); + } init_packet(pkt); break; - } + } } - ready: - if( rc == -1 && root ) - rc = 0; - - if( rc ) - release_kbnode( root ); - else - *ret_root = root; - free_packet( pkt ); - xfree( pkt ); - return rc; + + ready: + if (rc == -1 && root ) + rc = 0; + + if (rc ) + release_kbnode( root ); + else + *ret_root = root; + free_packet( pkt ); + xfree( pkt ); + return rc; } + /* Walk through the subkeys on a pk to find if we have the PKS disease: multiple subkeys with their binding sigs stripped, and the sig for the first subkey placed after the last subkey. That is, @@ -623,61 +650,64 @@ read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root, int *r_v3keys) and sub3, as they are already lost, but we can try and rescue sub1 by reordering the keyblock so that it reads "pk uid sig sub1 bind1 sub2 sub3". Returns TRUE if the keyblock was modified. */ - static int -fix_pks_corruption(KBNODE keyblock) +fix_pks_corruption (kbnode_t keyblock) { - int changed=0,keycount=0; - KBNODE node,last=NULL,sknode=NULL; + int changed = 0; + int keycount = 0; + kbnode_t node; + kbnode_t last = NULL; + kbnode_t sknode=NULL; /* First determine if we have the problem at all. Look for 2 or more subkeys in a row, followed by a single binding sig. */ - for(node=keyblock;node;last=node,node=node->next) + for (node=keyblock; node; last=node, node=node->next) { - if(node->pkt->pkttype==PKT_PUBLIC_SUBKEY) + if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY) { keycount++; if(!sknode) sknode=node; } - else if(node->pkt->pkttype==PKT_SIGNATURE && - node->pkt->pkt.signature->sig_class==0x18 && - keycount>=2 && node->next==NULL) + else if (node->pkt->pkttype == PKT_SIGNATURE + && node->pkt->pkt.signature->sig_class == 0x18 + && keycount >= 2 + && !node->next) { /* We might have the problem, as this key has two subkeys in a row without any intervening packets. */ /* Sanity check */ - if(last==NULL) + if (!last) break; /* Temporarily attach node to sknode. */ - node->next=sknode->next; - sknode->next=node; - last->next=NULL; + node->next = sknode->next; + sknode->next = node; + last->next = NULL; /* Note we aren't checking whether this binding sig is a selfsig. This is not necessary here as the subkey and binding sig will be rejected later if that is the case. */ - if(check_key_signature(keyblock,node,NULL)) + if (check_key_signature (keyblock,node,NULL)) { /* Not a match, so undo the changes. */ - sknode->next=node->next; - last->next=node; - node->next=NULL; + sknode->next = node->next; + last->next = node; + node->next = NULL; break; } else { sknode->flag |= 1; /* Mark it good so we don't need to check it again */ - changed=1; + changed = 1; break; } } else - keycount=0; + keycount = 0; } return changed; @@ -742,28 +772,31 @@ print_import_ok (PKT_public_key *pk, unsigned int reason) write_status_text (STATUS_IMPORT_OK, buf); } + static void print_import_check (PKT_public_key * pk, PKT_user_id * id) { - char * buf; - byte fpr[24]; - u32 keyid[2]; - size_t i, pos = 0, n; - - buf = xmalloc (17+41+id->len+32); - keyid_from_pk (pk, keyid); - sprintf (buf, "%08X%08X ", keyid[0], keyid[1]); - pos = 17; - fingerprint_from_pk (pk, fpr, &n); - for (i = 0; i < n; i++, pos += 2) - sprintf (buf+pos, "%02X", fpr[i]); - strcat (buf, " "); - pos += 1; - strcat (buf, id->name); - write_status_text (STATUS_IMPORT_CHECK, buf); - xfree (buf); + char * buf; + byte fpr[24]; + u32 keyid[2]; + size_t i, n; + size_t pos = 0; + + buf = xmalloc (17+41+id->len+32); + keyid_from_pk (pk, keyid); + sprintf (buf, "%08X%08X ", keyid[0], keyid[1]); + pos = 17; + fingerprint_from_pk (pk, fpr, &n); + for (i = 0; i < n; i++, pos += 2) + sprintf (buf+pos, "%02X", fpr[i]); + strcat (buf, " "); + pos += 1; + strcat (buf, id->name); + write_status_text (STATUS_IMPORT_CHECK, buf); + xfree (buf); } + static void check_prefs_warning(PKT_public_key *pk) { @@ -771,6 +804,7 @@ check_prefs_warning(PKT_public_key *pk) "algorithms on these user IDs:\n"), keystr_from_pk(pk)); } + static void check_prefs (ctrl_t ctrl, kbnode_t keyblock) { @@ -787,9 +821,9 @@ check_prefs (ctrl_t ctrl, kbnode_t keyblock) && node->pkt->pkt.user_id->created && node->pkt->pkt.user_id->prefs) { - PKT_user_id *uid=node->pkt->pkt.user_id; - prefitem_t *prefs=uid->prefs; - char *user=utf8_to_native(uid->name,strlen(uid->name),0); + PKT_user_id *uid = node->pkt->pkt.user_id; + prefitem_t *prefs = uid->prefs; + char *user = utf8_to_native(uid->name,strlen(uid->name),0); for(;prefs->type;prefs++) { @@ -855,13 +889,14 @@ check_prefs (ctrl_t ctrl, kbnode_t keyblock) if(!opt.batch) { - strlist_t sl=NULL,locusr=NULL; + strlist_t sl = NULL; + strlist_t locusr = NULL; size_t fprlen=0; - byte fpr[MAX_FINGERPRINT_LEN],*p; + byte fpr[MAX_FINGERPRINT_LEN], *p; char username[(MAX_FINGERPRINT_LEN*2)+1]; unsigned int i; - p=fingerprint_from_pk(pk,fpr,&fprlen); + p = fingerprint_from_pk (pk,fpr,&fprlen); for(i=0;ipkt->pkt.public_key; + pk = node->pkt->pkt.public_key; - fingerprint_from_pk (pk, fpr2, &fpr2len); - for (an = fpr2len; an < MAX_FINGERPRINT_LEN; an++) - fpr2[an] = 0; - keyid_from_pk( pk, keyid ); - uidnode = find_next_kbnode( keyblock, PKT_USER_ID ); + fingerprint_from_pk (pk, fpr2, &fpr2len); + for (an = fpr2len; an < MAX_FINGERPRINT_LEN; an++) + fpr2[an] = 0; + keyid_from_pk( pk, keyid ); + uidnode = find_next_kbnode( keyblock, PKT_USER_ID ); - if (opt.verbose && !opt.interactive && !silent) - { - log_info( "pub %s/%s %s ", - pubkey_string (pk, pkstrbuf, sizeof pkstrbuf), - keystr_from_pk(pk), datestr_from_pk(pk) ); - if (uidnode) - print_utf8_buffer (log_get_stream (), - uidnode->pkt->pkt.user_id->name, - uidnode->pkt->pkt.user_id->len ); - log_printf ("\n"); - } + if (opt.verbose && !opt.interactive && !silent) + { + log_info( "pub %s/%s %s ", + pubkey_string (pk, pkstrbuf, sizeof pkstrbuf), + keystr_from_pk(pk), datestr_from_pk(pk) ); + if (uidnode) + print_utf8_buffer (log_get_stream (), + uidnode->pkt->pkt.user_id->name, + uidnode->pkt->pkt.user_id->len ); + log_printf ("\n"); + } - if( !uidnode ) - { - if (!silent) - log_error( _("key %s: no user ID\n"), keystr_from_pk(pk)); - return 0; - } + if (!uidnode ) + { + if (!silent) + log_error( _("key %s: no user ID\n"), keystr_from_pk(pk)); + return 0; + } - if (screener && screener (keyblock, screener_arg)) - { - log_error (_("key %s: %s\n"), keystr_from_pk (pk), - _("rejected by import screener")); - return 0; - } + if (screener && screener (keyblock, screener_arg)) + { + log_error (_("key %s: %s\n"), keystr_from_pk (pk), + _("rejected by import screener")); + return 0; + } - if (opt.interactive && !silent) { - if(is_status_enabled()) - print_import_check (pk, uidnode->pkt->pkt.user_id); - merge_keys_and_selfsig (keyblock); - tty_printf ("\n"); - show_basic_key_info (keyblock); - tty_printf ("\n"); - if (!cpr_get_answer_is_yes ("import.okay", - "Do you want to import this key? (y/N) ")) - return 0; + if (opt.interactive && !silent) + { + if (is_status_enabled()) + print_import_check (pk, uidnode->pkt->pkt.user_id); + merge_keys_and_selfsig (keyblock); + tty_printf ("\n"); + show_basic_key_info (keyblock); + tty_printf ("\n"); + if (!cpr_get_answer_is_yes ("import.okay", + "Do you want to import this key? (y/N) ")) + return 0; } - collapse_uids(&keyblock); - - /* Clean the key that we're about to import, to cut down on things - that we have to clean later. This has no practical impact on - the end result, but does result in less logging which might - confuse the user. */ - if(options&IMPORT_CLEAN) - clean_key(keyblock,opt.verbose,options&IMPORT_MINIMAL,NULL,NULL); - - clear_kbnode_flags( keyblock ); - - if((options&IMPORT_REPAIR_PKS_SUBKEY_BUG) && fix_pks_corruption(keyblock) - && opt.verbose) - log_info(_("key %s: PKS subkey corruption repaired\n"), - keystr_from_pk(pk)); - - rc = chk_self_sigs( fname, keyblock , pk, keyid, &non_self ); - if( rc ) - return rc== -1? 0:rc; - - /* If we allow such a thing, mark unsigned uids as valid */ - if( opt.allow_non_selfsigned_uid) - for( node=keyblock; node; node = node->next ) - if( node->pkt->pkttype == PKT_USER_ID && !(node->flag & 1) ) - { - char *user=utf8_to_native(node->pkt->pkt.user_id->name, - node->pkt->pkt.user_id->len,0); - node->flag |= 1; - log_info( _("key %s: accepted non self-signed user ID \"%s\"\n"), - keystr_from_pk(pk),user); - xfree(user); + collapse_uids(&keyblock); + + /* Clean the key that we're about to import, to cut down on things + that we have to clean later. This has no practical impact on the + end result, but does result in less logging which might confuse + the user. */ + if (options&IMPORT_CLEAN) + clean_key (keyblock,opt.verbose,options&IMPORT_MINIMAL,NULL,NULL); + + clear_kbnode_flags( keyblock ); + + if ((options&IMPORT_REPAIR_PKS_SUBKEY_BUG) && fix_pks_corruption(keyblock) + && opt.verbose) + log_info (_("key %s: PKS subkey corruption repaired\n"), + keystr_from_pk(pk)); + + rc = chk_self_sigs( fname, keyblock , pk, keyid, &non_self ); + if (rc ) + return rc== -1? 0:rc; + + /* If we allow such a thing, mark unsigned uids as valid */ + if (opt.allow_non_selfsigned_uid) + { + for (node=keyblock; node; node = node->next ) + if (node->pkt->pkttype == PKT_USER_ID && !(node->flag & 1) ) + { + char *user=utf8_to_native(node->pkt->pkt.user_id->name, + node->pkt->pkt.user_id->len,0); + node->flag |= 1; + log_info( _("key %s: accepted non self-signed user ID \"%s\"\n"), + keystr_from_pk(pk),user); + xfree(user); } + } - if( !delete_inv_parts( fname, keyblock, keyid, options ) ) { - if (!silent) { - log_error( _("key %s: no valid user IDs\n"), keystr_from_pk(pk)); - if( !opt.quiet ) - log_info(_("this may be caused by a missing self-signature\n")); + if (!delete_inv_parts( fname, keyblock, keyid, options ) ) + { + if (!silent) + { + log_error( _("key %s: no valid user IDs\n"), keystr_from_pk(pk)); + if (!opt.quiet ) + log_info(_("this may be caused by a missing self-signature\n")); } - stats->no_user_id++; - return 0; + stats->no_user_id++; + return 0; } - /* do we have this key already in one of our pubrings ? */ - pk_orig = xmalloc_clear( sizeof *pk_orig ); - rc = get_pubkey_byfprint_fast (pk_orig, fpr2, fpr2len); - if( rc && rc != G10ERR_NO_PUBKEY && rc != G10ERR_UNU_PUBKEY ) - { - if (!silent) - log_error (_("key %s: public key not found: %s\n"), - keystr(keyid), g10_errstr(rc)); - } - else if ( rc && (opt.import_options&IMPORT_MERGE_ONLY) ) - { - if( opt.verbose && !silent ) - log_info( _("key %s: new key - skipped\n"), keystr(keyid)); - rc = 0; - stats->skipped_new_keys++; - } - else if( rc ) { /* insert this key */ - KEYDB_HANDLE hd = keydb_new (); - - rc = keydb_locate_writable (hd, NULL); - if (rc) { - log_error (_("no writable keyring found: %s\n"), g10_errstr (rc)); - keydb_release (hd); - return G10ERR_GENERAL; + /* Do we have this key already in one of our pubrings ? */ + pk_orig = xmalloc_clear( sizeof *pk_orig ); + rc = get_pubkey_byfprint_fast (pk_orig, fpr2, fpr2len); + if (rc && rc != G10ERR_NO_PUBKEY && rc != G10ERR_UNU_PUBKEY ) + { + if (!silent) + log_error (_("key %s: public key not found: %s\n"), + keystr(keyid), g10_errstr(rc)); + } + else if ( rc && (opt.import_options&IMPORT_MERGE_ONLY) ) + { + if (opt.verbose && !silent ) + log_info( _("key %s: new key - skipped\n"), keystr(keyid)); + rc = 0; + stats->skipped_new_keys++; + } + else if (rc ) /* Insert this key. */ + { + KEYDB_HANDLE hd = keydb_new (); + + rc = keydb_locate_writable (hd, NULL); + if (rc) + { + log_error (_("no writable keyring found: %s\n"), g10_errstr (rc)); + keydb_release (hd); + return G10ERR_GENERAL; } - if( opt.verbose > 1 ) - log_info (_("writing to '%s'\n"), keydb_get_resource_name (hd) ); - - rc = keydb_insert_keyblock (hd, keyblock ); - if (rc) - log_error (_("error writing keyring '%s': %s\n"), - keydb_get_resource_name (hd), g10_errstr(rc)); - else if (!(opt.import_options & IMPORT_KEEP_OWNERTTRUST)) - { - /* This should not be possible since we delete the - ownertrust when a key is deleted, but it can happen if - the keyring and trustdb are out of sync. It can also - be made to happen with the trusted-key command and by - importing and locally exported key. */ - - clear_ownertrusts (pk); - if(non_self) - revalidation_mark (); - } - keydb_release (hd); - - /* we are ready */ - if( !opt.quiet && !silent) - { - char *p = get_user_id_byfpr_native (fpr2); - log_info (_("key %s: public key \"%s\" imported\n"), - keystr(keyid), p); - xfree(p); - } - if( is_status_enabled() ) - { - char *us = get_long_user_id_string( keyid ); - write_status_text( STATUS_IMPORTED, us ); - xfree(us); - print_import_ok (pk, 1); - } - stats->imported++; - new_key = 1; + if (opt.verbose > 1 ) + log_info (_("writing to '%s'\n"), keydb_get_resource_name (hd) ); + + rc = keydb_insert_keyblock (hd, keyblock ); + if (rc) + log_error (_("error writing keyring '%s': %s\n"), + keydb_get_resource_name (hd), g10_errstr(rc)); + else if (!(opt.import_options & IMPORT_KEEP_OWNERTTRUST)) + { + /* This should not be possible since we delete the + ownertrust when a key is deleted, but it can happen if + the keyring and trustdb are out of sync. It can also + be made to happen with the trusted-key command and by + importing and locally exported key. */ + + clear_ownertrusts (pk); + if (non_self) + revalidation_mark (); + } + keydb_release (hd); + + /* We are ready. */ + if (!opt.quiet && !silent) + { + char *p = get_user_id_byfpr_native (fpr2); + log_info (_("key %s: public key \"%s\" imported\n"), + keystr(keyid), p); + xfree(p); + } + if (is_status_enabled()) + { + char *us = get_long_user_id_string( keyid ); + write_status_text( STATUS_IMPORTED, us ); + xfree(us); + print_import_ok (pk, 1); + } + stats->imported++; + new_key = 1; } - else { /* merge */ - KEYDB_HANDLE hd; - int n_uids, n_sigs, n_subk, n_sigs_cleaned, n_uids_cleaned; - - /* Compare the original against the new key; just to be sure nothing - * weird is going on */ - if( cmp_public_keys( pk_orig, pk ) ) - { - if (!silent) - log_error( _("key %s: doesn't match our copy\n"),keystr(keyid)); - goto leave; - } + else /* merge */ + { + KEYDB_HANDLE hd; + int n_uids, n_sigs, n_subk, n_sigs_cleaned, n_uids_cleaned; - /* Now read the original keyblock again so that we can use - that handle for updating the keyblock. */ - hd = keydb_new (); - keydb_disable_caching (hd); - rc = keydb_search_fpr (hd, fpr2); - if( rc ) - { - log_error (_("key %s: can't locate original keyblock: %s\n"), - keystr(keyid), g10_errstr(rc)); - keydb_release (hd); - goto leave; - } - rc = keydb_get_keyblock (hd, &keyblock_orig); - if (rc) - { - log_error (_("key %s: can't read original keyblock: %s\n"), - keystr(keyid), g10_errstr(rc)); - keydb_release (hd); - goto leave; - } + /* Compare the original against the new key; just to be sure nothing + * weird is going on */ + if (cmp_public_keys( pk_orig, pk ) ) + { + if (!silent) + log_error( _("key %s: doesn't match our copy\n"),keystr(keyid)); + goto leave; + } - /* Make sure the original direct key sigs are all sane. */ - n_sigs_cleaned = fix_bad_direct_key_sigs (keyblock_orig, keyid); - if (n_sigs_cleaned) - commit_kbnode (&keyblock_orig); - - /* and try to merge the block */ - clear_kbnode_flags( keyblock_orig ); - clear_kbnode_flags( keyblock ); - n_uids = n_sigs = n_subk = n_uids_cleaned = 0; - rc = merge_blocks( fname, keyblock_orig, keyblock, - keyid, &n_uids, &n_sigs, &n_subk ); - if( rc ) - { - keydb_release (hd); - goto leave; - } + /* Now read the original keyblock again so that we can use + that handle for updating the keyblock. */ + hd = keydb_new (); + keydb_disable_caching (hd); + rc = keydb_search_fpr (hd, fpr2); + if (rc ) + { + log_error (_("key %s: can't locate original keyblock: %s\n"), + keystr(keyid), g10_errstr(rc)); + keydb_release (hd); + goto leave; + } + rc = keydb_get_keyblock (hd, &keyblock_orig); + if (rc) + { + log_error (_("key %s: can't read original keyblock: %s\n"), + keystr(keyid), g10_errstr(rc)); + keydb_release (hd); + goto leave; + } - if(options&IMPORT_CLEAN) - clean_key(keyblock_orig,opt.verbose,options&IMPORT_MINIMAL, - &n_uids_cleaned,&n_sigs_cleaned); - - if( n_uids || n_sigs || n_subk || n_sigs_cleaned || n_uids_cleaned) { - mod_key = 1; - /* keyblock_orig has been updated; write */ - rc = keydb_update_keyblock (hd, keyblock_orig); - if (rc) - log_error (_("error writing keyring '%s': %s\n"), - keydb_get_resource_name (hd), g10_errstr(rc) ); - else if(non_self) - revalidation_mark (); - - /* we are ready */ - if( !opt.quiet && !silent) - { - char *p = get_user_id_byfpr_native (fpr2); - if( n_uids == 1 ) - log_info( _("key %s: \"%s\" 1 new user ID\n"), - keystr(keyid),p); - else if( n_uids ) - log_info( _("key %s: \"%s\" %d new user IDs\n"), - keystr(keyid),p,n_uids); - if( n_sigs == 1 ) - log_info( _("key %s: \"%s\" 1 new signature\n"), - keystr(keyid), p); - else if( n_sigs ) - log_info( _("key %s: \"%s\" %d new signatures\n"), - keystr(keyid), p, n_sigs ); - if( n_subk == 1 ) - log_info( _("key %s: \"%s\" 1 new subkey\n"), - keystr(keyid), p); - else if( n_subk ) - log_info( _("key %s: \"%s\" %d new subkeys\n"), - keystr(keyid), p, n_subk ); - if(n_sigs_cleaned==1) - log_info(_("key %s: \"%s\" %d signature cleaned\n"), - keystr(keyid),p,n_sigs_cleaned); - else if(n_sigs_cleaned) - log_info(_("key %s: \"%s\" %d signatures cleaned\n"), - keystr(keyid),p,n_sigs_cleaned); - if(n_uids_cleaned==1) - log_info(_("key %s: \"%s\" %d user ID cleaned\n"), - keystr(keyid),p,n_uids_cleaned); - else if(n_uids_cleaned) - log_info(_("key %s: \"%s\" %d user IDs cleaned\n"), - keystr(keyid),p,n_uids_cleaned); - xfree(p); - } + /* Make sure the original direct key sigs are all sane. */ + n_sigs_cleaned = fix_bad_direct_key_sigs (keyblock_orig, keyid); + if (n_sigs_cleaned) + commit_kbnode (&keyblock_orig); + + /* and try to merge the block */ + clear_kbnode_flags( keyblock_orig ); + clear_kbnode_flags( keyblock ); + n_uids = n_sigs = n_subk = n_uids_cleaned = 0; + rc = merge_blocks( fname, keyblock_orig, keyblock, + keyid, &n_uids, &n_sigs, &n_subk ); + if (rc ) + { + keydb_release (hd); + goto leave; + } + + if ((options & IMPORT_CLEAN)) + clean_key (keyblock_orig,opt.verbose,options&IMPORT_MINIMAL, + &n_uids_cleaned,&n_sigs_cleaned); + + if (n_uids || n_sigs || n_subk || n_sigs_cleaned || n_uids_cleaned) + { + mod_key = 1; + /* KEYBLOCK_ORIG has been updated; write */ + rc = keydb_update_keyblock (hd, keyblock_orig); + if (rc) + log_error (_("error writing keyring '%s': %s\n"), + keydb_get_resource_name (hd), g10_errstr(rc) ); + else if (non_self) + revalidation_mark (); + + /* We are ready. */ + if (!opt.quiet && !silent) + { + char *p = get_user_id_byfpr_native (fpr2); + if (n_uids == 1 ) + log_info( _("key %s: \"%s\" 1 new user ID\n"), + keystr(keyid),p); + else if (n_uids ) + log_info( _("key %s: \"%s\" %d new user IDs\n"), + keystr(keyid),p,n_uids); + if (n_sigs == 1 ) + log_info( _("key %s: \"%s\" 1 new signature\n"), + keystr(keyid), p); + else if (n_sigs ) + log_info( _("key %s: \"%s\" %d new signatures\n"), + keystr(keyid), p, n_sigs ); + if (n_subk == 1 ) + log_info( _("key %s: \"%s\" 1 new subkey\n"), + keystr(keyid), p); + else if (n_subk ) + log_info( _("key %s: \"%s\" %d new subkeys\n"), + keystr(keyid), p, n_subk ); + if (n_sigs_cleaned==1) + log_info(_("key %s: \"%s\" %d signature cleaned\n"), + keystr(keyid),p,n_sigs_cleaned); + else if (n_sigs_cleaned) + log_info(_("key %s: \"%s\" %d signatures cleaned\n"), + keystr(keyid),p,n_sigs_cleaned); + if (n_uids_cleaned==1) + log_info(_("key %s: \"%s\" %d user ID cleaned\n"), + keystr(keyid),p,n_uids_cleaned); + else if (n_uids_cleaned) + log_info(_("key %s: \"%s\" %d user IDs cleaned\n"), + keystr(keyid),p,n_uids_cleaned); + xfree(p); + } - stats->n_uids +=n_uids; - stats->n_sigs +=n_sigs; - stats->n_subk +=n_subk; - stats->n_sigs_cleaned +=n_sigs_cleaned; - stats->n_uids_cleaned +=n_uids_cleaned; + stats->n_uids +=n_uids; + stats->n_sigs +=n_sigs; + stats->n_subk +=n_subk; + stats->n_sigs_cleaned +=n_sigs_cleaned; + stats->n_uids_cleaned +=n_uids_cleaned; - if (is_status_enabled () && !silent) - print_import_ok (pk, ((n_uids?2:0)|(n_sigs?4:0)|(n_subk?8:0))); + if (is_status_enabled () && !silent) + print_import_ok (pk, ((n_uids?2:0)|(n_sigs?4:0)|(n_subk?8:0))); } - else - { - same_key = 1; - if (is_status_enabled ()) - print_import_ok (pk, 0); + else + { + same_key = 1; + if (is_status_enabled ()) + print_import_ok (pk, 0); - if( !opt.quiet && !silent) - { - char *p = get_user_id_byfpr_native (fpr2); - log_info( _("key %s: \"%s\" not changed\n"),keystr(keyid),p); - xfree(p); - } + if (!opt.quiet && !silent) + { + char *p = get_user_id_byfpr_native (fpr2); + log_info( _("key %s: \"%s\" not changed\n"),keystr(keyid),p); + xfree(p); + } - stats->unchanged++; - } + stats->unchanged++; + } - keydb_release (hd); hd = NULL; + keydb_release (hd); hd = NULL; } leave: - if (mod_key || new_key || same_key) - { - /* A little explanation for this: we fill in the fingerprint - when importing keys as it can be useful to know the - fingerprint in certain keyserver-related cases (a keyserver - asked for a particular name, but the key doesn't have that - name). However, in cases where we're importing more than - one key at a time, we cannot know which key to fingerprint. - In these cases, rather than guessing, we do not - fingerprinting at all, and we must hope the user ID on the - keys are useful. Note that we need to do this for new - keys, merged keys and even for unchanged keys. This is - required because for example the --auto-key-locate feature - may import an already imported key and needs to know the - fingerprint of the key in all cases. */ - if (fpr) - { - xfree (*fpr); - /* Note that we need to compare against 0 here because - COUNT gets only incremented after returning form this - function. */ - if (stats->count == 0) - *fpr = fingerprint_from_pk (pk, NULL, fpr_len); - else - *fpr = NULL; - } - } + if (mod_key || new_key || same_key) + { + /* A little explanation for this: we fill in the fingerprint + when importing keys as it can be useful to know the + fingerprint in certain keyserver-related cases (a keyserver + asked for a particular name, but the key doesn't have that + name). However, in cases where we're importing more than + one key at a time, we cannot know which key to fingerprint. + In these cases, rather than guessing, we do not + fingerprinting at all, and we must hope the user ID on the + keys are useful. Note that we need to do this for new + keys, merged keys and even for unchanged keys. This is + required because for example the --auto-key-locate feature + may import an already imported key and needs to know the + fingerprint of the key in all cases. */ + if (fpr) + { + xfree (*fpr); + /* Note that we need to compare against 0 here because + COUNT gets only incremented after returning form this + function. */ + if (!stats->count) + *fpr = fingerprint_from_pk (pk, NULL, fpr_len); + else + *fpr = NULL; + } + } - /* Now that the key is definitely incorporated into the keydb, we - need to check if a designated revocation is present or if the - prefs are not rational so we can warn the user. */ + /* Now that the key is definitely incorporated into the keydb, we + need to check if a designated revocation is present or if the + prefs are not rational so we can warn the user. */ - if (mod_key) - { - revocation_present (ctrl, keyblock_orig); - if (!from_sk && have_secret_key_with_kid (keyid)) - check_prefs (ctrl, keyblock_orig); - } - else if (new_key) - { - revocation_present (ctrl, keyblock); - if (!from_sk && have_secret_key_with_kid (keyid)) - check_prefs (ctrl, keyblock); - } + if (mod_key) + { + revocation_present (ctrl, keyblock_orig); + if (!from_sk && have_secret_key_with_kid (keyid)) + check_prefs (ctrl, keyblock_orig); + } + else if (new_key) + { + revocation_present (ctrl, keyblock); + if (!from_sk && have_secret_key_with_kid (keyid)) + check_prefs (ctrl, keyblock); + } - release_kbnode( keyblock_orig ); - free_public_key( pk_orig ); + release_kbnode( keyblock_orig ); + free_public_key( pk_orig ); - return rc; + return rc; } @@ -1578,14 +1623,14 @@ sec_to_pub_keyblock (kbnode_t sec_keyblock) * with the trust calculation. */ static int -import_secret_one (ctrl_t ctrl, const char *fname, KBNODE keyblock, +import_secret_one (ctrl_t ctrl, const char *fname, kbnode_t keyblock, struct stats_s *stats, int batch, unsigned int options, int for_migration, import_screener_t screener, void *screener_arg) { PKT_public_key *pk; struct seckey_info *ski; - KBNODE node, uidnode; + kbnode_t node, uidnode; u32 keyid[2]; int rc = 0; int nr_prev; @@ -1727,121 +1772,123 @@ import_secret_one (ctrl_t ctrl, const char *fname, KBNODE keyblock, * Import a revocation certificate; this is a single signature packet. */ static int -import_revoke_cert( const char *fname, KBNODE node, struct stats_s *stats ) +import_revoke_cert( const char *fname, kbnode_t node, struct stats_s *stats ) { - PKT_public_key *pk=NULL; - KBNODE onode, keyblock = NULL; - KEYDB_HANDLE hd = NULL; - u32 keyid[2]; - int rc = 0; + PKT_public_key *pk = NULL; + kbnode_t onode; + kbnode_t keyblock = NULL; + KEYDB_HANDLE hd = NULL; + u32 keyid[2]; + int rc = 0; - (void)fname; + (void)fname; - assert( !node->next ); - assert( node->pkt->pkttype == PKT_SIGNATURE ); - assert( node->pkt->pkt.signature->sig_class == 0x20 ); + assert( !node->next ); + assert( node->pkt->pkttype == PKT_SIGNATURE ); + assert( node->pkt->pkt.signature->sig_class == 0x20 ); - keyid[0] = node->pkt->pkt.signature->keyid[0]; - keyid[1] = node->pkt->pkt.signature->keyid[1]; + keyid[0] = node->pkt->pkt.signature->keyid[0]; + keyid[1] = node->pkt->pkt.signature->keyid[1]; - pk = xmalloc_clear( sizeof *pk ); - rc = get_pubkey( pk, keyid ); - if( rc == G10ERR_NO_PUBKEY ) - { - log_error(_("key %s: no public key -" - " can't apply revocation certificate\n"), keystr(keyid)); - rc = 0; - goto leave; - } - else if( rc ) - { - log_error(_("key %s: public key not found: %s\n"), - keystr(keyid), g10_errstr(rc)); - goto leave; - } + pk = xmalloc_clear( sizeof *pk ); + rc = get_pubkey( pk, keyid ); + if (rc == G10ERR_NO_PUBKEY ) + { + log_error(_("key %s: no public key -" + " can't apply revocation certificate\n"), keystr(keyid)); + rc = 0; + goto leave; + } + else if (rc ) + { + log_error(_("key %s: public key not found: %s\n"), + keystr(keyid), g10_errstr(rc)); + goto leave; + } - /* read the original keyblock */ - hd = keydb_new (); + /* Read the original keyblock. */ + hd = keydb_new (); + { + byte afp[MAX_FINGERPRINT_LEN]; + size_t an; + + fingerprint_from_pk (pk, afp, &an); + while (an < MAX_FINGERPRINT_LEN) + afp[an++] = 0; + rc = keydb_search_fpr (hd, afp); + } + if (rc) { - byte afp[MAX_FINGERPRINT_LEN]; - size_t an; + log_error (_("key %s: can't locate original keyblock: %s\n"), + keystr(keyid), g10_errstr(rc)); + goto leave; + } + rc = keydb_get_keyblock (hd, &keyblock ); + if (rc) + { + log_error (_("key %s: can't read original keyblock: %s\n"), + keystr(keyid), g10_errstr(rc)); + goto leave; + } - fingerprint_from_pk (pk, afp, &an); - while (an < MAX_FINGERPRINT_LEN) - afp[an++] = 0; - rc = keydb_search_fpr (hd, afp); + /* it is okay, that node is not in keyblock because + * check_key_signature works fine for sig_class 0x20 in this + * special case. */ + rc = check_key_signature( keyblock, node, NULL); + if (rc ) + { + log_error( _("key %s: invalid revocation certificate" + ": %s - rejected\n"), keystr(keyid), g10_errstr(rc)); + goto leave; } - if (rc) - { - log_error (_("key %s: can't locate original keyblock: %s\n"), - keystr(keyid), g10_errstr(rc)); - goto leave; - } - rc = keydb_get_keyblock (hd, &keyblock ); - if (rc) - { - log_error (_("key %s: can't read original keyblock: %s\n"), - keystr(keyid), g10_errstr(rc)); - goto leave; - } - /* it is okay, that node is not in keyblock because - * check_key_signature works fine for sig_class 0x20 in this - * special case. */ - rc = check_key_signature( keyblock, node, NULL); - if( rc ) + /* check whether we already have this */ + for(onode=keyblock->next; onode; onode=onode->next ) { + if (onode->pkt->pkttype == PKT_USER_ID ) + break; + else if (onode->pkt->pkttype == PKT_SIGNATURE + && !cmp_signatures(node->pkt->pkt.signature, + onode->pkt->pkt.signature)) { - log_error( _("key %s: invalid revocation certificate" - ": %s - rejected\n"), keystr(keyid), g10_errstr(rc)); - goto leave; + rc = 0; + goto leave; /* yes, we already know about it */ } + } - /* check whether we already have this */ - for(onode=keyblock->next; onode; onode=onode->next ) { - if( onode->pkt->pkttype == PKT_USER_ID ) - break; - else if( onode->pkt->pkttype == PKT_SIGNATURE - && !cmp_signatures(node->pkt->pkt.signature, - onode->pkt->pkt.signature)) - { - rc = 0; - goto leave; /* yes, we already know about it */ - } - } - + /* insert it */ + insert_kbnode( keyblock, clone_kbnode(node), 0 ); - /* insert it */ - insert_kbnode( keyblock, clone_kbnode(node), 0 ); + /* and write the keyblock back */ + rc = keydb_update_keyblock (hd, keyblock ); + if (rc) + log_error (_("error writing keyring '%s': %s\n"), + keydb_get_resource_name (hd), g10_errstr(rc) ); + keydb_release (hd); + hd = NULL; - /* and write the keyblock back */ - rc = keydb_update_keyblock (hd, keyblock ); - if (rc) - log_error (_("error writing keyring '%s': %s\n"), - keydb_get_resource_name (hd), g10_errstr(rc) ); - keydb_release (hd); hd = NULL; - /* we are ready */ - if( !opt.quiet ) - { - char *p=get_user_id_native (keyid); - log_info( _("key %s: \"%s\" revocation certificate imported\n"), - keystr(keyid),p); - xfree(p); - } - stats->n_revoc++; + /* we are ready */ + if (!opt.quiet ) + { + char *p=get_user_id_native (keyid); + log_info( _("key %s: \"%s\" revocation certificate imported\n"), + keystr(keyid),p); + xfree(p); + } + stats->n_revoc++; - /* If the key we just revoked was ultimately trusted, remove its - ultimate trust. This doesn't stop the user from putting the - ultimate trust back, but is a reasonable solution for now. */ - if(get_ownertrust(pk)==TRUST_ULTIMATE) - clear_ownertrusts(pk); + /* If the key we just revoked was ultimately trusted, remove its + ultimate trust. This doesn't stop the user from putting the + ultimate trust back, but is a reasonable solution for now. */ + if(get_ownertrust(pk)==TRUST_ULTIMATE) + clear_ownertrusts(pk); - revalidation_mark (); + revalidation_mark (); - leave: - keydb_release (hd); - release_kbnode( keyblock ); - free_public_key( pk ); - return rc; + leave: + keydb_release (hd); + release_kbnode( keyblock ); + free_public_key( pk ); + return rc; } @@ -1896,7 +1943,7 @@ chk_self_sigs (const char *fname, kbnode_t keyblock, if ( IS_UID_SIG(sig) || IS_UID_REV(sig) ) { - KBNODE unode = find_prev_kbnode( keyblock, n, PKT_USER_ID ); + kbnode_t unode = find_prev_kbnode( keyblock, n, PKT_USER_ID ); if ( !unode ) { log_error( _("key %s: no user ID for signature\n"), @@ -2055,95 +2102,104 @@ chk_self_sigs (const char *fname, kbnode_t keyblock, * returns: true if at least one valid user-id is left over. */ static int -delete_inv_parts( const char *fname, KBNODE keyblock, +delete_inv_parts( const char *fname, kbnode_t keyblock, u32 *keyid, unsigned int options) { - KBNODE node; - int nvalid=0, uid_seen=0, subkey_seen=0; - - (void)fname; - - for(node=keyblock->next; node; node = node->next ) { - if( node->pkt->pkttype == PKT_USER_ID ) { - uid_seen = 1; - if( (node->flag & 2) || !(node->flag & 1) ) { - if( opt.verbose ) - { - char *p=utf8_to_native(node->pkt->pkt.user_id->name, - node->pkt->pkt.user_id->len,0); - log_info( _("key %s: skipped user ID \"%s\"\n"), - keystr(keyid),p); - xfree(p); - } - delete_kbnode( node ); /* the user-id */ - /* and all following packets up to the next user-id */ - while( node->next - && node->next->pkt->pkttype != PKT_USER_ID - && node->next->pkt->pkttype != PKT_PUBLIC_SUBKEY - && node->next->pkt->pkttype != PKT_SECRET_SUBKEY ){ - delete_kbnode( node->next ); - node = node->next; - } + kbnode_t node; + int nvalid=0, uid_seen=0, subkey_seen=0; + + (void)fname; + + for (node=keyblock->next; node; node = node->next ) + { + if (node->pkt->pkttype == PKT_USER_ID) + { + uid_seen = 1; + if ((node->flag & 2) || !(node->flag & 1) ) + { + if (opt.verbose ) + { + char *p=utf8_to_native(node->pkt->pkt.user_id->name, + node->pkt->pkt.user_id->len,0); + log_info( _("key %s: skipped user ID \"%s\"\n"), + keystr(keyid),p); + xfree(p); + } + delete_kbnode( node ); /* the user-id */ + /* and all following packets up to the next user-id */ + while (node->next + && node->next->pkt->pkttype != PKT_USER_ID + && node->next->pkt->pkttype != PKT_PUBLIC_SUBKEY + && node->next->pkt->pkttype != PKT_SECRET_SUBKEY ){ + delete_kbnode( node->next ); + node = node->next; + } } - else - nvalid++; + else + nvalid++; } - else if( node->pkt->pkttype == PKT_PUBLIC_SUBKEY - || node->pkt->pkttype == PKT_SECRET_SUBKEY ) { - if( (node->flag & 2) || !(node->flag & 1) ) { - if( opt.verbose ) - log_info( _("key %s: skipped subkey\n"),keystr(keyid)); - - delete_kbnode( node ); /* the subkey */ - /* and all following signature packets */ - while( node->next - && node->next->pkt->pkttype == PKT_SIGNATURE ) { - delete_kbnode( node->next ); - node = node->next; - } + else if ( node->pkt->pkttype == PKT_PUBLIC_SUBKEY + || node->pkt->pkttype == PKT_SECRET_SUBKEY ) + { + if ((node->flag & 2) || !(node->flag & 1) ) + { + if (opt.verbose ) + log_info( _("key %s: skipped subkey\n"),keystr(keyid)); + + delete_kbnode( node ); /* the subkey */ + /* and all following signature packets */ + while (node->next + && node->next->pkt->pkttype == PKT_SIGNATURE ) { + delete_kbnode( node->next ); + node = node->next; + } } - else - subkey_seen = 1; + else + subkey_seen = 1; } - else if (node->pkt->pkttype == PKT_SIGNATURE - && openpgp_pk_test_algo (node->pkt->pkt.signature->pubkey_algo) - && node->pkt->pkt.signature->pubkey_algo != PUBKEY_ALGO_RSA ) - delete_kbnode( node ); /* build_packet() can't handle this */ - else if( node->pkt->pkttype == PKT_SIGNATURE && - !node->pkt->pkt.signature->flags.exportable && - !(options&IMPORT_LOCAL_SIGS) && - !have_secret_key_with_kid (node->pkt->pkt.signature->keyid)) - { - /* here we violate the rfc a bit by still allowing - * to import non-exportable signature when we have the - * the secret key used to create this signature - it - * seems that this makes sense */ - if(opt.verbose) - log_info( _("key %s: non exportable signature" - " (class 0x%02X) - skipped\n"), - keystr(keyid), node->pkt->pkt.signature->sig_class ); - delete_kbnode( node ); - } - else if( node->pkt->pkttype == PKT_SIGNATURE - && node->pkt->pkt.signature->sig_class == 0x20 ) { - if( uid_seen ) - { - if(opt.verbose) - log_info( _("key %s: revocation certificate" - " at wrong place - skipped\n"),keystr(keyid)); - delete_kbnode( node ); - } - else { + else if (node->pkt->pkttype == PKT_SIGNATURE + && openpgp_pk_test_algo (node->pkt->pkt.signature->pubkey_algo) + && node->pkt->pkt.signature->pubkey_algo != PUBKEY_ALGO_RSA ) + { + delete_kbnode( node ); /* build_packet() can't handle this */ + } + else if (node->pkt->pkttype == PKT_SIGNATURE + && !node->pkt->pkt.signature->flags.exportable + && !(options&IMPORT_LOCAL_SIGS) + && !have_secret_key_with_kid (node->pkt->pkt.signature->keyid)) + { + /* here we violate the rfc a bit by still allowing + * to import non-exportable signature when we have the + * the secret key used to create this signature - it + * seems that this makes sense */ + if(opt.verbose) + log_info( _("key %s: non exportable signature" + " (class 0x%02X) - skipped\n"), + keystr(keyid), node->pkt->pkt.signature->sig_class ); + delete_kbnode( node ); + } + else if (node->pkt->pkttype == PKT_SIGNATURE + && node->pkt->pkt.signature->sig_class == 0x20) + { + if (uid_seen ) + { + if(opt.verbose) + log_info( _("key %s: revocation certificate" + " at wrong place - skipped\n"),keystr(keyid)); + delete_kbnode( node ); + } + else + { /* If the revocation cert is from a different key than the one we're working on don't check it - it's probably from a revocation key and won't be verifiable with this key anyway. */ - if(node->pkt->pkt.signature->keyid[0]==keyid[0] && - node->pkt->pkt.signature->keyid[1]==keyid[1]) + if(node->pkt->pkt.signature->keyid[0]==keyid[0] + && node->pkt->pkt.signature->keyid[1]==keyid[1]) { int rc = check_key_signature( keyblock, node, NULL); - if( rc ) + if (rc ) { if(opt.verbose) log_info( _("key %s: invalid revocation" @@ -2154,33 +2210,33 @@ delete_inv_parts( const char *fname, KBNODE keyblock, } } } - else if( node->pkt->pkttype == PKT_SIGNATURE && - (node->pkt->pkt.signature->sig_class == 0x18 || - node->pkt->pkt.signature->sig_class == 0x28) && - !subkey_seen ) - { - if(opt.verbose) - log_info( _("key %s: subkey signature" - " in wrong place - skipped\n"), keystr(keyid)); - delete_kbnode( node ); - } - else if( node->pkt->pkttype == PKT_SIGNATURE - && !IS_CERT(node->pkt->pkt.signature)) - { - if(opt.verbose) - log_info(_("key %s: unexpected signature class (0x%02X) -" - " skipped\n"),keystr(keyid), - node->pkt->pkt.signature->sig_class); - delete_kbnode(node); + else if (node->pkt->pkttype == PKT_SIGNATURE + && (node->pkt->pkt.signature->sig_class == 0x18 + || node->pkt->pkt.signature->sig_class == 0x28) + && !subkey_seen ) + { + if(opt.verbose) + log_info( _("key %s: subkey signature" + " in wrong place - skipped\n"), keystr(keyid)); + delete_kbnode( node ); + } + else if (node->pkt->pkttype == PKT_SIGNATURE + && !IS_CERT(node->pkt->pkt.signature)) + { + if(opt.verbose) + log_info(_("key %s: unexpected signature class (0x%02X) -" + " skipped\n"),keystr(keyid), + node->pkt->pkt.signature->sig_class); + delete_kbnode(node); } - else if( (node->flag & 4) ) /* marked for deletion */ - delete_kbnode( node ); + else if ((node->flag & 4) ) /* marked for deletion */ + delete_kbnode( node ); } - /* note: because keyblock is the public key, it is never marked - * for deletion and so keyblock cannot change */ - commit_kbnode( &keyblock ); - return nvalid; + /* note: because keyblock is the public key, it is never marked + * for deletion and so keyblock cannot change */ + commit_kbnode( &keyblock ); + return nvalid; } @@ -2191,14 +2247,14 @@ delete_inv_parts( const char *fname, KBNODE keyblock, * Returns: True if the keyblock has changed. */ int -collapse_uids( KBNODE *keyblock ) +collapse_uids( kbnode_t *keyblock ) { - KBNODE uid1; + kbnode_t uid1; int any=0; for(uid1=*keyblock;uid1;uid1=uid1->next) { - KBNODE uid2; + kbnode_t uid2; if(is_deleted_kbnode(uid1)) continue; @@ -2218,7 +2274,7 @@ collapse_uids( KBNODE *keyblock ) uid2->pkt->pkt.user_id)==0) { /* We have a duplicated uid */ - KBNODE sig1,last; + kbnode_t sig1,last; any=1; @@ -2246,7 +2302,7 @@ collapse_uids( KBNODE *keyblock ) /* Now dedupe uid1 */ for(sig1=uid1->next;sig1;sig1=sig1->next) { - KBNODE sig2; + kbnode_t sig2; if(is_deleted_kbnode(sig1)) continue; @@ -2303,6 +2359,7 @@ collapse_uids( KBNODE *keyblock ) return any; } + /* Check for a 0x20 revocation from a revocation key that is not present. This may be called without the benefit of merge_xxxx so you can't rely on pk->revkey and friends. */ @@ -2387,7 +2444,8 @@ revocation_present (ctrl_t ctrl, kbnode_t keyblock) } } -/**************** + +/* * compare and merge the blocks * * o compare the signatures: If we already have this signature, check @@ -2399,320 +2457,355 @@ revocation_present (ctrl_t ctrl, kbnode_t keyblock) * Note: We indicate newly inserted packets with flag bit 0 */ static int -merge_blocks( const char *fname, KBNODE keyblock_orig, KBNODE keyblock, +merge_blocks (const char *fname, kbnode_t keyblock_orig, kbnode_t keyblock, u32 *keyid, int *n_uids, int *n_sigs, int *n_subk ) { - KBNODE onode, node; - int rc, found; + kbnode_t onode, node; + int rc, found; - /* 1st: handle revocation certificates */ - for(node=keyblock->next; node; node=node->next ) { - if( node->pkt->pkttype == PKT_USER_ID ) - break; - else if( node->pkt->pkttype == PKT_SIGNATURE - && node->pkt->pkt.signature->sig_class == 0x20 ) { - /* check whether we already have this */ - found = 0; - for(onode=keyblock_orig->next; onode; onode=onode->next ) { - if( onode->pkt->pkttype == PKT_USER_ID ) - break; - else if( onode->pkt->pkttype == PKT_SIGNATURE - && onode->pkt->pkt.signature->sig_class == 0x20 - && !cmp_signatures(onode->pkt->pkt.signature, - node->pkt->pkt.signature)) - { - found = 1; - break; - } + /* 1st: handle revocation certificates */ + for (node=keyblock->next; node; node=node->next ) + { + if (node->pkt->pkttype == PKT_USER_ID ) + break; + else if (node->pkt->pkttype == PKT_SIGNATURE + && node->pkt->pkt.signature->sig_class == 0x20) + { + /* check whether we already have this */ + found = 0; + for (onode=keyblock_orig->next; onode; onode=onode->next) + { + if (onode->pkt->pkttype == PKT_USER_ID ) + break; + else if (onode->pkt->pkttype == PKT_SIGNATURE + && onode->pkt->pkt.signature->sig_class == 0x20 + && !cmp_signatures(onode->pkt->pkt.signature, + node->pkt->pkt.signature)) + { + found = 1; + break; + } } - if( !found ) { - KBNODE n2 = clone_kbnode(node); - insert_kbnode( keyblock_orig, n2, 0 ); - n2->flag |= 1; - ++*n_sigs; - if(!opt.quiet) - { - char *p=get_user_id_native (keyid); - log_info(_("key %s: \"%s\" revocation" - " certificate added\n"), keystr(keyid),p); - xfree(p); - } + if (!found) + { + kbnode_t n2 = clone_kbnode(node); + insert_kbnode( keyblock_orig, n2, 0 ); + n2->flag |= 1; + ++*n_sigs; + if(!opt.quiet) + { + char *p=get_user_id_native (keyid); + log_info(_("key %s: \"%s\" revocation" + " certificate added\n"), keystr(keyid),p); + xfree(p); + } } } } - /* 2nd: merge in any direct key (0x1F) sigs */ - for(node=keyblock->next; node; node=node->next ) { - if( node->pkt->pkttype == PKT_USER_ID ) - break; - else if( node->pkt->pkttype == PKT_SIGNATURE - && node->pkt->pkt.signature->sig_class == 0x1F ) { - /* check whether we already have this */ - found = 0; - for(onode=keyblock_orig->next; onode; onode=onode->next ) { - if( onode->pkt->pkttype == PKT_USER_ID ) - break; - else if( onode->pkt->pkttype == PKT_SIGNATURE - && onode->pkt->pkt.signature->sig_class == 0x1F - && !cmp_signatures(onode->pkt->pkt.signature, - node->pkt->pkt.signature)) { - found = 1; - break; + /* 2nd: merge in any direct key (0x1F) sigs */ + for(node=keyblock->next; node; node=node->next) + { + if (node->pkt->pkttype == PKT_USER_ID ) + break; + else if (node->pkt->pkttype == PKT_SIGNATURE + && node->pkt->pkt.signature->sig_class == 0x1F) + { + /* check whether we already have this */ + found = 0; + for (onode=keyblock_orig->next; onode; onode=onode->next) + { + if (onode->pkt->pkttype == PKT_USER_ID) + break; + else if (onode->pkt->pkttype == PKT_SIGNATURE + && onode->pkt->pkt.signature->sig_class == 0x1F + && !cmp_signatures(onode->pkt->pkt.signature, + node->pkt->pkt.signature)) + { + found = 1; + break; } } - if( !found ) - { - KBNODE n2 = clone_kbnode(node); - insert_kbnode( keyblock_orig, n2, 0 ); - n2->flag |= 1; - ++*n_sigs; - if(!opt.quiet) - log_info( _("key %s: direct key signature added\n"), - keystr(keyid)); - } + if (!found ) + { + kbnode_t n2 = clone_kbnode(node); + insert_kbnode( keyblock_orig, n2, 0 ); + n2->flag |= 1; + ++*n_sigs; + if(!opt.quiet) + log_info( _("key %s: direct key signature added\n"), + keystr(keyid)); + } } } - /* 3rd: try to merge new certificates in */ - for(onode=keyblock_orig->next; onode; onode=onode->next ) { - if( !(onode->flag & 1) && onode->pkt->pkttype == PKT_USER_ID) { - /* find the user id in the imported keyblock */ - for(node=keyblock->next; node; node=node->next ) - if( node->pkt->pkttype == PKT_USER_ID - && !cmp_user_ids( onode->pkt->pkt.user_id, - node->pkt->pkt.user_id ) ) - break; - if( node ) { /* found: merge */ - rc = merge_sigs( onode, node, n_sigs, fname, keyid ); - if( rc ) - return rc; + /* 3rd: try to merge new certificates in */ + for (onode=keyblock_orig->next; onode; onode=onode->next) + { + if (!(onode->flag & 1) && onode->pkt->pkttype == PKT_USER_ID) + { + /* find the user id in the imported keyblock */ + for (node=keyblock->next; node; node=node->next) + if (node->pkt->pkttype == PKT_USER_ID + && !cmp_user_ids( onode->pkt->pkt.user_id, + node->pkt->pkt.user_id ) ) + break; + if (node ) /* found: merge */ + { + rc = merge_sigs( onode, node, n_sigs, fname, keyid ); + if (rc ) + return rc; } } } - /* 4th: add new user-ids */ - for(node=keyblock->next; node; node=node->next ) { - if( node->pkt->pkttype == PKT_USER_ID) { - /* do we have this in the original keyblock */ - for(onode=keyblock_orig->next; onode; onode=onode->next ) - if( onode->pkt->pkttype == PKT_USER_ID - && !cmp_user_ids( onode->pkt->pkt.user_id, - node->pkt->pkt.user_id ) ) - break; - if( !onode ) { /* this is a new user id: append */ - rc = append_uid( keyblock_orig, node, n_sigs, fname, keyid); - if( rc ) - return rc; - ++*n_uids; + /* 4th: add new user-ids */ + for (node=keyblock->next; node; node=node->next) + { + if (node->pkt->pkttype == PKT_USER_ID) + { + /* do we have this in the original keyblock */ + for (onode=keyblock_orig->next; onode; onode=onode->next ) + if (onode->pkt->pkttype == PKT_USER_ID + && !cmp_user_ids( onode->pkt->pkt.user_id, + node->pkt->pkt.user_id ) ) + break; + if (!onode ) /* this is a new user id: append */ + { + rc = append_uid( keyblock_orig, node, n_sigs, fname, keyid); + if (rc ) + return rc; + ++*n_uids; } } } - /* 5th: add new subkeys */ - for(node=keyblock->next; node; node=node->next ) { - onode = NULL; - if( node->pkt->pkttype == PKT_PUBLIC_SUBKEY ) { - /* do we have this in the original keyblock? */ - for(onode=keyblock_orig->next; onode; onode=onode->next ) - if( onode->pkt->pkttype == PKT_PUBLIC_SUBKEY - && !cmp_public_keys( onode->pkt->pkt.public_key, - node->pkt->pkt.public_key ) ) - break; - if( !onode ) { /* this is a new subkey: append */ - rc = append_key( keyblock_orig, node, n_sigs, fname, keyid); - if( rc ) - return rc; - ++*n_subk; + /* 5th: add new subkeys */ + for (node=keyblock->next; node; node=node->next) + { + onode = NULL; + if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY) + { + /* do we have this in the original keyblock? */ + for(onode=keyblock_orig->next; onode; onode=onode->next) + if (onode->pkt->pkttype == PKT_PUBLIC_SUBKEY + && !cmp_public_keys( onode->pkt->pkt.public_key, + node->pkt->pkt.public_key)) + break; + if (!onode ) /* This is a new subkey: append. */ + { + rc = append_key (keyblock_orig, node, n_sigs, fname, keyid); + if (rc) + return rc; + ++*n_subk; } } - else if( node->pkt->pkttype == PKT_SECRET_SUBKEY ) { - /* do we have this in the original keyblock? */ - for(onode=keyblock_orig->next; onode; onode=onode->next ) - if( onode->pkt->pkttype == PKT_SECRET_SUBKEY - && !cmp_public_keys (onode->pkt->pkt.public_key, - node->pkt->pkt.public_key) ) - break; - if( !onode ) { /* this is a new subkey: append */ - rc = append_key( keyblock_orig, node, n_sigs, fname, keyid); - if( rc ) - return rc; - ++*n_subk; + else if (node->pkt->pkttype == PKT_SECRET_SUBKEY) + { + /* do we have this in the original keyblock? */ + for (onode=keyblock_orig->next; onode; onode=onode->next ) + if (onode->pkt->pkttype == PKT_SECRET_SUBKEY + && !cmp_public_keys (onode->pkt->pkt.public_key, + node->pkt->pkt.public_key) ) + break; + if (!onode ) /* This is a new subkey: append. */ + { + rc = append_key (keyblock_orig, node, n_sigs, fname, keyid); + if (rc ) + return rc; + ++*n_subk; } } } - /* 6th: merge subkey certificates */ - for(onode=keyblock_orig->next; onode; onode=onode->next ) { - if( !(onode->flag & 1) - && ( onode->pkt->pkttype == PKT_PUBLIC_SUBKEY - || onode->pkt->pkttype == PKT_SECRET_SUBKEY) ) { - /* find the subkey in the imported keyblock */ - for(node=keyblock->next; node; node=node->next ) { - if ((node->pkt->pkttype == PKT_PUBLIC_SUBKEY - || node->pkt->pkttype == PKT_SECRET_SUBKEY) - && !cmp_public_keys( onode->pkt->pkt.public_key, - node->pkt->pkt.public_key ) ) - break; + /* 6th: merge subkey certificates */ + for (onode=keyblock_orig->next; onode; onode=onode->next) + { + if (!(onode->flag & 1) + && (onode->pkt->pkttype == PKT_PUBLIC_SUBKEY + || onode->pkt->pkttype == PKT_SECRET_SUBKEY)) + { + /* find the subkey in the imported keyblock */ + for(node=keyblock->next; node; node=node->next) + { + if ((node->pkt->pkttype == PKT_PUBLIC_SUBKEY + || node->pkt->pkttype == PKT_SECRET_SUBKEY) + && !cmp_public_keys( onode->pkt->pkt.public_key, + node->pkt->pkt.public_key ) ) + break; } - if( node ) { /* found: merge */ - rc = merge_keysigs( onode, node, n_sigs, fname, keyid ); - if( rc ) - return rc; + if (node) /* Found: merge. */ + { + rc = merge_keysigs( onode, node, n_sigs, fname, keyid ); + if (rc ) + return rc; } } } - - return 0; + return 0; } -/**************** - * append the userid starting with NODE and all signatures to KEYBLOCK. +/* + * Append the userid starting with NODE and all signatures to KEYBLOCK. */ static int -append_uid (KBNODE keyblock, KBNODE node, int *n_sigs, +append_uid (kbnode_t keyblock, kbnode_t node, int *n_sigs, const char *fname, u32 *keyid ) { - KBNODE n, n_where=NULL; + kbnode_t n; + kbnode_t n_where = NULL; - (void)fname; - (void)keyid; + (void)fname; + (void)keyid; - assert(node->pkt->pkttype == PKT_USER_ID ); + assert(node->pkt->pkttype == PKT_USER_ID ); - /* find the position */ - for( n = keyblock; n; n_where = n, n = n->next ) { - if( n->pkt->pkttype == PKT_PUBLIC_SUBKEY - || n->pkt->pkttype == PKT_SECRET_SUBKEY ) - break; + /* find the position */ + for (n = keyblock; n; n_where = n, n = n->next) + { + if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY + || n->pkt->pkttype == PKT_SECRET_SUBKEY ) + break; } - if( !n ) - n_where = NULL; - - /* and append/insert */ - while( node ) { - /* we add a clone to the original keyblock, because this - * one is released first */ - n = clone_kbnode(node); - if( n_where ) { - insert_kbnode( n_where, n, 0 ); - n_where = n; + if (!n) + n_where = NULL; + + /* and append/insert */ + while (node) + { + /* we add a clone to the original keyblock, because this + * one is released first */ + n = clone_kbnode(node); + if (n_where) + { + insert_kbnode( n_where, n, 0 ); + n_where = n; } - else - add_kbnode( keyblock, n ); - n->flag |= 1; - node->flag |= 1; - if( n->pkt->pkttype == PKT_SIGNATURE ) - ++*n_sigs; - - node = node->next; - if( node && node->pkt->pkttype != PKT_SIGNATURE ) - break; + else + add_kbnode( keyblock, n ); + n->flag |= 1; + node->flag |= 1; + if (n->pkt->pkttype == PKT_SIGNATURE ) + ++*n_sigs; + + node = node->next; + if (node && node->pkt->pkttype != PKT_SIGNATURE ) + break; } - return 0; + return 0; } -/**************** +/* * Merge the sigs from SRC onto DST. SRC and DST are both a PKT_USER_ID. * (how should we handle comment packets here?) */ static int -merge_sigs( KBNODE dst, KBNODE src, int *n_sigs, - const char *fname, u32 *keyid ) +merge_sigs (kbnode_t dst, kbnode_t src, int *n_sigs, + const char *fname, u32 *keyid) { - KBNODE n, n2; - int found=0; + kbnode_t n, n2; + int found = 0; - (void)fname; - (void)keyid; + (void)fname; + (void)keyid; - assert(dst->pkt->pkttype == PKT_USER_ID ); - assert(src->pkt->pkttype == PKT_USER_ID ); + assert(dst->pkt->pkttype == PKT_USER_ID ); + assert(src->pkt->pkttype == PKT_USER_ID ); - for(n=src->next; n && n->pkt->pkttype != PKT_USER_ID; n = n->next ) { - if( n->pkt->pkttype != PKT_SIGNATURE ) - continue; - if( n->pkt->pkt.signature->sig_class == 0x18 - || n->pkt->pkt.signature->sig_class == 0x28 ) - continue; /* skip signatures which are only valid on subkeys */ - found = 0; - for(n2=dst->next; n2 && n2->pkt->pkttype != PKT_USER_ID; n2 = n2->next) - if(!cmp_signatures(n->pkt->pkt.signature,n2->pkt->pkt.signature)) - { - found++; - break; - } - if( !found ) { - /* This signature is new or newer, append N to DST. - * We add a clone to the original keyblock, because this - * one is released first */ - n2 = clone_kbnode(n); - insert_kbnode( dst, n2, PKT_SIGNATURE ); - n2->flag |= 1; - n->flag |= 1; - ++*n_sigs; + for (n=src->next; n && n->pkt->pkttype != PKT_USER_ID; n = n->next) + { + if (n->pkt->pkttype != PKT_SIGNATURE ) + continue; + if (n->pkt->pkt.signature->sig_class == 0x18 + || n->pkt->pkt.signature->sig_class == 0x28 ) + continue; /* skip signatures which are only valid on subkeys */ + + found = 0; + for (n2=dst->next; n2 && n2->pkt->pkttype != PKT_USER_ID; n2 = n2->next) + if (!cmp_signatures(n->pkt->pkt.signature,n2->pkt->pkt.signature)) + { + found++; + break; + } + if (!found ) + { + /* This signature is new or newer, append N to DST. + * We add a clone to the original keyblock, because this + * one is released first */ + n2 = clone_kbnode(n); + insert_kbnode( dst, n2, PKT_SIGNATURE ); + n2->flag |= 1; + n->flag |= 1; + ++*n_sigs; } } - return 0; + return 0; } -/**************** + +/* * Merge the sigs from SRC onto DST. SRC and DST are both a PKT_xxx_SUBKEY. */ static int -merge_keysigs (KBNODE dst, KBNODE src, int *n_sigs, +merge_keysigs (kbnode_t dst, kbnode_t src, int *n_sigs, const char *fname, u32 *keyid) { - KBNODE n, n2; - int found=0; + kbnode_t n, n2; + int found = 0; - (void)fname; - (void)keyid; + (void)fname; + (void)keyid; - assert( dst->pkt->pkttype == PKT_PUBLIC_SUBKEY - || dst->pkt->pkttype == PKT_SECRET_SUBKEY ); + assert (dst->pkt->pkttype == PKT_PUBLIC_SUBKEY + || dst->pkt->pkttype == PKT_SECRET_SUBKEY); - for(n=src->next; n ; n = n->next ) { - if( n->pkt->pkttype == PKT_PUBLIC_SUBKEY - || n->pkt->pkttype == PKT_PUBLIC_KEY ) - break; - if( n->pkt->pkttype != PKT_SIGNATURE ) - continue; - found = 0; - for(n2=dst->next; n2; n2 = n2->next){ - if( n2->pkt->pkttype == PKT_PUBLIC_SUBKEY - || n2->pkt->pkttype == PKT_PUBLIC_KEY ) - break; - if( n2->pkt->pkttype == PKT_SIGNATURE - && n->pkt->pkt.signature->keyid[0] - == n2->pkt->pkt.signature->keyid[0] - && n->pkt->pkt.signature->keyid[1] - == n2->pkt->pkt.signature->keyid[1] - && n->pkt->pkt.signature->timestamp - <= n2->pkt->pkt.signature->timestamp - && n->pkt->pkt.signature->sig_class - == n2->pkt->pkt.signature->sig_class ) { - found++; - break; + for (n=src->next; n ; n = n->next) + { + if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY + || n->pkt->pkttype == PKT_PUBLIC_KEY ) + break; + if (n->pkt->pkttype != PKT_SIGNATURE ) + continue; + + found = 0; + for (n2=dst->next; n2; n2 = n2->next) + { + if (n2->pkt->pkttype == PKT_PUBLIC_SUBKEY + || n2->pkt->pkttype == PKT_PUBLIC_KEY ) + break; + if (n2->pkt->pkttype == PKT_SIGNATURE + && (n->pkt->pkt.signature->keyid[0] + == n2->pkt->pkt.signature->keyid[0]) + && (n->pkt->pkt.signature->keyid[1] + == n2->pkt->pkt.signature->keyid[1]) + && (n->pkt->pkt.signature->timestamp + <= n2->pkt->pkt.signature->timestamp) + && (n->pkt->pkt.signature->sig_class + == n2->pkt->pkt.signature->sig_class)) + { + found++; + break; } } - if( !found ) { - /* This signature is new or newer, append N to DST. - * We add a clone to the original keyblock, because this - * one is released first */ - n2 = clone_kbnode(n); - insert_kbnode( dst, n2, PKT_SIGNATURE ); - n2->flag |= 1; - n->flag |= 1; - ++*n_sigs; + if (!found ) + { + /* This signature is new or newer, append N to DST. + * We add a clone to the original keyblock, because this + * one is released first */ + n2 = clone_kbnode(n); + insert_kbnode( dst, n2, PKT_SIGNATURE ); + n2->flag |= 1; + n->flag |= 1; + ++*n_sigs; } } - return 0; + return 0; } @@ -2721,31 +2814,32 @@ merge_keysigs (KBNODE dst, KBNODE src, int *n_sigs, * Mark all new and copied packets by setting flag bit 0. */ static int -append_key (KBNODE keyblock, KBNODE node, int *n_sigs, +append_key (kbnode_t keyblock, kbnode_t node, int *n_sigs, const char *fname, u32 *keyid) { - KBNODE n; - - (void)fname; - (void)keyid; - - assert( node->pkt->pkttype == PKT_PUBLIC_SUBKEY - || node->pkt->pkttype == PKT_SECRET_SUBKEY ); - - while( node ) { - /* we add a clone to the original keyblock, because this - * one is released first */ - n = clone_kbnode(node); - add_kbnode( keyblock, n ); - n->flag |= 1; - node->flag |= 1; - if( n->pkt->pkttype == PKT_SIGNATURE ) - ++*n_sigs; - - node = node->next; - if( node && node->pkt->pkttype != PKT_SIGNATURE ) - break; + kbnode_t n; + + (void)fname; + (void)keyid; + + assert( node->pkt->pkttype == PKT_PUBLIC_SUBKEY + || node->pkt->pkttype == PKT_SECRET_SUBKEY ); + + while (node) + { + /* we add a clone to the original keyblock, because this + * one is released first */ + n = clone_kbnode(node); + add_kbnode( keyblock, n ); + n->flag |= 1; + node->flag |= 1; + if (n->pkt->pkttype == PKT_SIGNATURE ) + ++*n_sigs; + + node = node->next; + if (node && node->pkt->pkttype != PKT_SIGNATURE ) + break; } - return 0; + return 0; } commit 17b4662984b4669d8dcbbd6705ccfbe6c263319c Author: Werner Koch Date: Wed Dec 3 11:28:10 2014 +0100 gpg: Remove option aliases --[no-]throw-keyid and --notation-data. * g10/gpg.c (opts): Remove them. * g10/options.h (opt): s/throw_keyid/throw_keyids/ and change users. -- See mails starting http://lists.gnupg.org/pipermail/gnupg-devel/2014-November/029128.html diff --git a/NEWS b/NEWS index df40c2d..7643a02 100644 --- a/NEWS +++ b/NEWS @@ -23,6 +23,9 @@ Noteworthy changes in version 2.1.1 (unreleased) * More translations (but most of them are not complete). + * gpg: Removed the option aliases --throw-keyid and --notation-data; + use --throw-keyids and --set-notation instead. + Noteworthy changes in version 2.1.0 (2014-11-06) ------------------------------------------------ diff --git a/g10/encrypt.c b/g10/encrypt.c index 518b544..b692544 100644 --- a/g10/encrypt.c +++ b/g10/encrypt.c @@ -867,9 +867,9 @@ write_pubkey_enc_from_list (PK_LIST pk_list, DEK *dek, iobuf_t out) enc = xmalloc_clear ( sizeof *enc ); enc->pubkey_algo = pk->pubkey_algo; keyid_from_pk( pk, enc->keyid ); - enc->throw_keyid = (opt.throw_keyid || (pk_list->flags&1)); + enc->throw_keyid = (opt.throw_keyids || (pk_list->flags&1)); - if (opt.throw_keyid && (PGP6 || PGP7 || PGP8)) + if (opt.throw_keyids && (PGP6 || PGP7 || PGP8)) { log_info(_("you may not use %s while in %s mode\n"), "--throw-keyids",compliance_option_string()); diff --git a/g10/gpg.c b/g10/gpg.c index 6e6407a..0bedf25 100644 --- a/g10/gpg.c +++ b/g10/gpg.c @@ -587,15 +587,12 @@ static ARGPARSE_OPTS opts[] = { ARGPARSE_s_s (oCertDigestAlgo, "cert-digest-algo", "@"), ARGPARSE_s_s (oCompressAlgo,"compress-algo", "@"), ARGPARSE_s_s (oCompressAlgo, "compression-algo", "@"), /* Alias */ - ARGPARSE_s_n (oThrowKeyids, "throw-keyid", "@"), ARGPARSE_s_n (oThrowKeyids, "throw-keyids", "@"), - ARGPARSE_s_n (oNoThrowKeyids, "no-throw-keyid", "@"), ARGPARSE_s_n (oNoThrowKeyids, "no-throw-keyids", "@"), ARGPARSE_s_n (oShowPhotos, "show-photos", "@"), ARGPARSE_s_n (oNoShowPhotos, "no-show-photos", "@"), ARGPARSE_s_s (oPhotoViewer, "photo-viewer", "@"), ARGPARSE_s_s (oSetNotation, "set-notation", "@"), - ARGPARSE_s_s (oSetNotation, "notation-data", "@"), /* Alias */ ARGPARSE_s_s (oSigNotation, "sig-notation", "@"), ARGPARSE_s_s (oCertNotation, "cert-notation", "@"), @@ -2611,8 +2608,8 @@ main (int argc, char **argv) free_strlist(opt.comments); opt.comments=NULL; break; - case oThrowKeyids: opt.throw_keyid = 1; break; - case oNoThrowKeyids: opt.throw_keyid = 0; break; + case oThrowKeyids: opt.throw_keyids = 1; break; + case oNoThrowKeyids: opt.throw_keyids = 0; break; case oShowPhotos: deprecated_warning(configname,configlineno,"--show-photos", "--list-options ","show-photos"); diff --git a/g10/options.h b/g10/options.h index 7ec81af..9aadb42 100644 --- a/g10/options.h +++ b/g10/options.h @@ -130,7 +130,7 @@ struct int shm_coprocess; const char *set_filename; strlist_t comments; - int throw_keyid; + int throw_keyids; const char *photo_viewer; int s2k_mode; int s2k_digest_algo; ----------------------------------------------------------------------- Summary of changes: NEWS | 5 + g10/encrypt.c | 4 +- g10/gpg.c | 7 +- g10/import.c | 2238 ++++++++++++++++++++++++++++------------------------- g10/options.h | 2 +- kbx/keybox-file.c | 2 +- 6 files changed, 1182 insertions(+), 1076 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Thu Dec 4 11:00:20 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 04 Dec 2014 11:00:20 +0100 Subject: [git] KSBA - branch, master, updated. libksba-1.3.2-2-ge71c1df Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "KSBA is a library to access X.509 certificates and CMS data.". The branch, master has been updated via e71c1df8b5a348c7c5a0ce8ba8ba4c19edd9d88c (commit) from 4ecabc4eb0684f5decb240dc3ac7c797a07b5cb7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit e71c1df8b5a348c7c5a0ce8ba8ba4c19edd9d88c Author: Werner Koch Date: Thu Dec 4 11:01:03 2014 +0100 Add CVE id to NEWS. -- diff --git a/NEWS b/NEWS index bf0c43b..49c45fe 100644 --- a/NEWS +++ b/NEWS @@ -5,7 +5,7 @@ Noteworthy changes in version 1.3.3 (unreleased) [C19/A11/R_] Noteworthy changes in version 1.3.2 (2014-11-25) [C19/A11/R3] ------------------------------------------------ - * Fixed a buffer overflow in ksba_oid_to_str. + * Fixed a buffer overflow in ksba_oid_to_str. [CVE-2014-9087] Noteworthy changes in version 1.3.1 (2014-09-18) ----------------------------------------------------------------------- Summary of changes: NEWS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- KSBA is a library to access X.509 certificates and CMS data. http://git.gnupg.org From cvs at cvs.gnupg.org Thu Dec 4 14:41:13 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 04 Dec 2014 14:41:13 +0100 Subject: [git] gnupg-doc - branch, master, updated. a01ddf94fc5baede200ce6f2016f0e3deb018ccd Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via a01ddf94fc5baede200ce6f2016f0e3deb018ccd (commit) via dc7be5d34f2dda278490783879bc43c50ff48f6b (commit) via f617811f4c19da882b8b3c40c5626e109e514434 (commit) via f5413a72a26f96583168b1df2e8a597e25f8633a (commit) from 871820f8bdffce5c3f09d969ec54b638cb773cd2 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a01ddf94fc5baede200ce6f2016f0e3deb018ccd Author: Werner Koch Date: Thu Dec 4 14:36:19 2014 +0100 web,tools: Add a list of recent donors diff --git a/tools/mkkudos.sh b/tools/mkkudos.sh index 8e5ed96..ae1831e 100755 --- a/tools/mkkudos.sh +++ b/tools/mkkudos.sh @@ -67,7 +67,8 @@ euroyr=$(echo "$tmp" | awk -F: '{printf "%d Euro", int($10 + 0.5)}') n=$(echo "$tmp" | awk -F: '{printf "%d", $7}') nyr=$(echo "$tmp" | awk -F: '{printf "%d", $9}') -for file in "$htdocs/donate/"kudos-????.html "$htdocs/donate/"kudos.html; do +for file in "$htdocs/donate/"kudos-????.html "$htdocs/donate/"kudos.html \ + "$htdocs/donate/"index.html; do if [ $force = no ]; then [ "$file" -ot "$donors" ] || continue fi @@ -85,6 +86,8 @@ for file in "$htdocs/donate/"kudos-????.html "$htdocs/donate/"kudos.html; do <"$file" >"$file.tmp" ' // {indon=1; print; insert("") } // {indon=0} + // {indon=1; print; insertsome("") } + // {indon=0} // {indon=1; print; insert("goteo13") } // {indon=0} // { @@ -121,6 +124,24 @@ for file in "$htdocs/donate/"kudos-????.html "$htdocs/donate/"kudos.html; do } close (donors) } + + function insertsome (tag) { + i = 0 + while (getline < donors) { + if ( $0 ~ /^(#.*)?$/ ) + continue; + if ( $3 == "" ) + continue; + if ($4==tag) { + data[i++] = $3 + } + } + close (donors) + j = i > 16 ? ( i - 16 ) : 0 + while (j < i) { + printf "
  • %s
    • \n", data[j++] + } + } ' mv "$file.tmp" "$file" || echo "mkkudos.sh: error updating $file" >&2 done diff --git a/web/donate/index.org b/web/donate/index.org index 07572c1..8994e7c 100644 --- a/web/donate/index.org +++ b/web/donate/index.org @@ -15,6 +15,15 @@ to help with development and maintenance please consider to make a donation. +** Recent donors + +#+HTML:
      +#+HTML: +#+HTML: +#+HTML:
    • (all)
      • +#+HTML:

    + + ** Ways to donate Paying using a credit card is currently our preferred choice. [[https://en.wikipedia.org/wiki/Single_Euro_Payments_Area][SEPA]] @@ -32,7 +41,7 @@ information is only used for the purpose of the donation and no data will ever be send to any entity not directly involved in the donation process. Not giving a name makes the donation ?anonymous? - in that the name won?t be listed on the public thank you page. + in that the name won?t be listed on the public [[file:kudos.org][thank you]] page. #+BEGIN_HTML diff --git a/web/donate/kudos.org b/web/donate/kudos.org index df875e4..e7cdeea 100644 --- a/web/donate/kudos.org +++ b/web/donate/kudos.org @@ -9,7 +9,7 @@ #+HTML:
  • [please reload in a few minutes while the list is being updated] #+HTML: #+HTML:
  • your name
    • -#+HTML:

    +#+HTML:

    Thank you. diff --git a/web/share/site.css b/web/share/site.css index f9d8207..9fb803d 100644 --- a/web/share/site.css +++ b/web/share/site.css @@ -527,6 +527,14 @@ td.right { font-size: 0.8em; } +#tagcloudlist p.doclear { + clear: left; + padding-top: 0; + padding-bottom: 0; + margin-top: 0; + margin-bottom: 0; +} + #tagcloudlist a { font-variant: normal; font-size: 0.8em; commit dc7be5d34f2dda278490783879bc43c50ff48f6b Author: Werner Koch Date: Thu Dec 4 12:28:50 2014 +0100 web: First set of changes to the CSS. diff --git a/web/share/gpgweb.el b/web/share/gpgweb.el index e0c25fa..aed734b 100644 --- a/web/share/gpgweb.el +++ b/web/share/gpgweb.el @@ -66,7 +66,8 @@ if not available." -\n")) + +")) (defconst gpgweb-gnupg-menu-alist '(("/index.html" @@ -159,7 +160,7 @@ if not available." (insert ">" (cadr item) "\n") (when (caddr item) (dotimes (i (1+ lvl)) (insert " ")) - (insert "
      \n") + (insert "
        \n") (gpgweb--insert-menu (caddr item) (1+ lvl) selected-file) (dotimes (i (1+ lvl)) (insert " ")) (insert "
      \n")) @@ -185,7 +186,9 @@ if not available." "Insert the menu structure into the HTML file." (goto-char (point-min)) (when (re-search-forward "^\n" nil t) - (insert "
       
      + (insert "
      +
       
      \n"))) (insert "
      +
      "))) (defun gpgweb-insert-footer () (goto-char (point-max)) - (insert "
      + (insert "
      +
        @@ -229,6 +234,7 @@ if not available."
      \n")) (goto-char (point-max)) (insert "
      + ")) diff --git a/web/share/site.css b/web/share/site.css index 382ffcb..f9d8207 100644 --- a/web/share/site.css +++ b/web/share/site.css @@ -14,13 +14,30 @@ */ body { - background-color: #f0f0fc; + background: #f0f0fc; + font-family: "Proxima Nova Regular","Segoe UI",Roboto,"Droid Sans","Helvetica Neue",Arial,sans-serif; + font-weight: 400; + height: 100%; +} + +/* +div#wrapper { + background: transparent url(/share/email-envelope.png) top right no-repeat; +} +*/ + +div#wrapper, +div#footer { + max-width: 850px; + margin: auto; } + h1, h2, h3 { - color: #5c6064; + color: #000; + font-family: "Helvetica Neue",Arial,sans-serif; font-weight: bold; font-variant: small-caps; letter-spacing: 0.1em; @@ -28,29 +45,19 @@ h3 { h1, h2 { - font-size: large; -} - -h1:first-letter, -h2:first-letter, -h3:first-letter { - color: #784c6c; -} - - -h1:first-letter, -h2:first-letter { font-size: x-large; } -h3:first-letter { - font-size: large; +h3 { + font-size: 1em; } + /* Links */ + a:link { /* color: #784c6c;*/ font-weight: bold; @@ -78,15 +85,11 @@ a.img:hover { Raise attention */ -li.important { - color: red; -} - +li.important, span.important { color: red; } - div.urgent { width: 85%; text-align: center; @@ -94,7 +97,6 @@ div.urgent { font-weight: bold; } - .ii { display: none !important; } @@ -155,11 +157,24 @@ div.entry-qotd #header { - background: url(/share/logo-gnupg-light-purple-bg.png) center no-repeat; - height: 120px; + background: transparent; + height: 150px; padding: 0px; } +#header a.logo img { + height: 120px; +} +#header a.logo:hover img { + background: transparent; + opacity: 0.4; + filter: alpha(opacity=40); /* For IE8 and earlier */ +} +#header a, +#header a:hover { + background: transparent; +} + #cornerImage { width: 128px; height: 130px; @@ -175,88 +190,72 @@ div.entry-qotd */ /* Reset the link attributes for nav except for hover */ -nav * a:visited, a:link { +nav a:visited, +a:link { color: #757575; font-weight: bold; text-decoration: none; } - -/* The menu bar is centered. */ -nav { - text-align: left; - line-height: 0.4em; - margin-left: 5%; - margin-right: 5%; +nav ul, +ul ul.sub-menu { + margin: 0; + padding: 0; + z-index: 5; } -/* Main menu list. */ nav ul { - display: inline-table; - list-style: none; - position: relative; box-shadow: 0px 0px 9px rgba(0,0,0,0.15); padding: 0 20px; border-radius: 10px; background: #efefef; + list-style: none; } -nav ul:after { - display: block; - clear: both; - content: ""; -} -/* Main menu items. */ -nav ul li { - float: left; +nav ul li, +ul ul.sub-menu li { + list-style-type: none; + display: inline-block; } -nav ul li:hover { - background: #4b545f; -} -nav ul li:hover a { +/*Link Appearance*/ +nav ul li a, +ul li ul.sub-menu li a { + text-decoration: none; color: #fff; + padding: 10px; + display:inline-block; } -nav ul li a { - display: block; - color: #757575; - font-weight: bold; - text-decoration: none; - padding: 20px 30px; +/*Make the parent of sub-menu relative*/ +nav ul li { + position: relative; } -/* Sub-menu lists. - Hide unless we over hover them. */ -nav ul ul { - display: none; +/*sub menu*/ +nav ul li ul.sub-menu { + display:none; +} +nav ul li:hover ul.sub-menu { + display:block; background: #5f6975; + color: #fff; + z-index: 99; border-radius: 0px; - padding: 0; position: absolute; - z-index: 5; - top: 100%; -} - -nav ul li:hover > ul { - display: block; + top: 41px; + left: 0; } - - -/* Sub-menu items. */ nav ul ul li { - float: none; - border-top: 1px solid #6b727c; border-bottom: 1px solid #575f6a; position: relative; + width: 100%; } nav ul ul li a { - font-weight: bold; - color: #fff; - padding: 20px 30px; + display:block !important; } nav ul ul li a:hover { @@ -264,22 +263,10 @@ nav ul ul li a:hover { } - -/* Sub-sub-menu lists. - Put right to the sub-menus. */ -nav ul ul ul { - position: absolute; - z-index: 10; - left: 100%; - top: 0; -} - - - /* The second menu line for stop menu with sub-menus. This is a non-nested list. */ nav.subnav { - margin-top: -1.5em; + margin-top: 1.5em; } nav.subnav ul { @@ -296,22 +283,14 @@ nav.subnav ul li a { display: block; font-weight: normal; text-decoration: none; - padding: 10px 20px; -} - - -/* Put selection markers arount a selected items. - \2009 is a   \21d2 and \21d0 are arrows. */ -nav * li a.selected:before { - content: "\21d2\2009"; + padding: 0 30px 0 10px; } -nav * li a.selected:after { - content: "\2009\21d0"; +nav * li a.selected { + color: #0093DD; } - /* The bottom menu */ @@ -344,9 +323,6 @@ nav * li a.selected:after { */ main { - float: left; - margin-left: 5%; - margin-right: 5%; } main ul { @@ -355,21 +331,51 @@ main ul { margin-left: 1em; } +div#content { + background-color: #fff; + margin-top: 1em; + padding: 1em; + box-shadow: 0 1px 1px rgba(154,170,207,0.1); +} + +div#content a, +div#footer a { + color: #0093DD !important; +} div.outline-text-2 { - padding-top: 5px; - padding-right: 3px; - border-top: 2px solid #5c6064; - border-right: 2px solid #784c6c; + margin: 0; + padding: 0.5em 0.5em 0 0; + border-top: 2px solid #DEECF9; + border-right: 2px solid #DEECF9; } div.outline-text-3 { padding-top: 3px; padding-right: 3px; - border-top: 1px solid #5c6064; - border-right: 1px solid #784c6c; + border-top: 1px solid #E2EEFA; + border-right: 1px solid #E2EEFA; } +div.outline-text-2, +div.outline-text-3 { + margin-bottom: 2em; +} + +div.outline-text-3, +div > h3 { + margin-left: 1em; +} + +h2, +h3 { + margin-bottom: 0; + padding-bottom: 0; +} + +h3 { + font-size: 1em; +} /* Not anymore used: #rightColumn { @@ -565,7 +571,6 @@ td.right { margin-bottom: 20px; } - .donate-button-low { overflow: hidden; display: inline-block; commit f617811f4c19da882b8b3c40c5626e109e514434 Author: Werner Koch Date: Thu Dec 4 11:25:25 2014 +0100 web: Minor text additions. diff --git a/web/documentation/index.org b/web/documentation/index.org index 8487e80..32e8c6f 100644 --- a/web/documentation/index.org +++ b/web/documentation/index.org @@ -21,6 +21,8 @@ how to subscribe. Links to other GnuPG-related discussion groups are also available. - [[file:bts.org][BTS]] :: Before you report a bug, please consult the list of bugs. + - [[http://twitter.com/gnupg][@gnupg]] :: We sometimes post short messages to Twitter. + You may also notice that OpenPGP is a proposed Internet standard, described by RFC4880 (found at [[http://www.rfc-editor.org/][RFC Editor]]). diff --git a/web/download/cvs_access.org b/web/download/cvs_access.org index f3ea6e8..0887139 100644 --- a/web/download/cvs_access.org +++ b/web/download/cvs_access.org @@ -14,6 +14,9 @@ server, so please don't poll for new pushes too often. Instead, we suggest you to subscribe to the [[http://lists.gnupg.org/mailman/listinfo/gnupg-commits/][commits mailing list]] . + You may also follow [[http://twitter.com/gnuprivacyguard][@gnuprivacyguard]] on Twitter to get notified + about commits to the GnuPG master branch. + There is a Web interface at [[http://git.gnupg.org/]] which can be used to browse the GIT repository. diff --git a/web/index.org b/web/index.org index 701dc84..d692170 100644 --- a/web/index.org +++ b/web/index.org @@ -21,7 +21,7 @@ GnuPG is [[http://www.gnu.org/philosophy/free-sw.html][Free Software]] (meaning be freely used, modified and distributed under the terms of the [[http://www.gnu.org/copyleft/gpl.html][GNU General Public License]] . -GnuPG comes in two flavours: [[download][{{{gnupg1_ver}}}]] is the well known and +GnuPG comes in two flavours: [[download][{{{gnupg1_ver}}}]] is the old and very portable standalone version, whereas [[download][{{{gnupg_ver}}}]] is the enhanced and modern version and suggested for most users. @@ -52,6 +52,14 @@ all [[file:news.org][news of previous years]] is also available. # point or paste the [[news.en.rss][RSS file]] into your aggregator. +** Libksba 1.3.2 released :important: + +This is a security fix release and all users of Libksba should update +to this version. Note that *GnuPG 2.x* makes use of Libksba and thus +all user of GnuPG 2.x need to install this new version of Libksba and +restart the dirmngr process. Read the full [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000359.html][announcement]]. + + ** GnuPG 2.1.0 with ECC support released (2014-11-06) This is the first released of the new /modern/ branch of GnuPG. It diff --git a/web/swdb.mac b/web/swdb.mac index 05ab0df..c5a53f3 100644 --- a/web/swdb.mac +++ b/web/swdb.mac @@ -65,10 +65,10 @@ # # GPGME # -#+macro: gpgme_ver 1.5.1 +#+macro: gpgme_ver 1.5.2 #+macro: gpgme_branch master -#+macro: gpgme_size 943k -#+macro: gpgme_sha1 a91c258e79acf30ec86a667e07f835e5e79342d8 +#+macro: gpgme_size 946k +#+macro: gpgme_sha1 cb550ea09314a362aa895f1ca92da6ba73fb512a # @@ -82,9 +82,9 @@ # # LIBKSBA # -#+macro: libksba_ver 1.3.1 -#+macro: libksba_size 584k -#+macro: libksba_sha1 6bfe285dbc3a7b6e295f9389c20ea1cdf4947ee5 +#+macro: libksba_ver 1.3.2 +#+macro: libksba_size 587k +#+macro: libksba_sha1 37d0893a587354af2b6e49f6ae701ca84f52da67 # commit f5413a72a26f96583168b1df2e8a597e25f8633a Author: Werner Koch Date: Tue Nov 25 16:31:17 2014 +0100 web: Removed "under construction notice and extra link to copying. diff --git a/web/share/gpgweb.el b/web/share/gpgweb.el index a4cfdc4..e0c25fa 100644 --- a/web/share/gpgweb.el +++ b/web/share/gpgweb.el @@ -207,10 +207,6 @@ if not available." (goto-char (point-max)) (insert "
      -

      This site is currently undergoing a complete redesign. - We apologize for any inconveniences like broken links - or bad formatting. Please do not report such problems as we are probably - already aware of them. (2014-05-28 wk)

        ") @@ -226,8 +222,7 @@ if not available." >\"CC-BY-SA  These web pages are - Copyright 1998--2014 The GnuPG Project? - and licensed under a + Copyright 1998--2014 The GnuPG Project and licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License. See copying for details. ----------------------------------------------------------------------- Summary of changes: tools/mkkudos.sh | 23 ++++- web/documentation/index.org | 2 + web/donate/index.org | 11 ++- web/donate/kudos.org | 2 +- web/download/cvs_access.org | 3 + web/index.org | 10 +- web/share/gpgweb.el | 21 ++-- web/share/site.css | 227 +++++++++++++++++++++++-------------------- web/swdb.mac | 12 +-- 9 files changed, 184 insertions(+), 127 deletions(-) hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Thu Dec 4 17:04:44 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 04 Dec 2014 17:04:44 +0100 Subject: [git] gnupg-doc - branch, master, updated. 26c6d6481f22f72cf2896bb96c181c2974cf496c Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via 26c6d6481f22f72cf2896bb96c181c2974cf496c (commit) from a01ddf94fc5baede200ce6f2016f0e3deb018ccd (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 26c6d6481f22f72cf2896bb96c181c2974cf496c Author: Werner Koch Date: Thu Dec 4 17:01:13 2014 +0100 web: Add people/ page. diff --git a/web/people/david.png b/web/people/david.png new file mode 100644 index 0000000..f75a213 Binary files /dev/null and b/web/people/david.png differ diff --git a/web/people/gniibe.png b/web/people/gniibe.png new file mode 100644 index 0000000..15d6e74 Binary files /dev/null and b/web/people/gniibe.png differ diff --git a/web/people/index.org b/web/people/index.org new file mode 100644 index 0000000..246c21d --- /dev/null +++ b/web/people/index.org @@ -0,0 +1,88 @@ +#+TITLE: GnuPG - People +#+STARTUP: showall +#+SETUPFILE: "../share/setup.inc" + +* The People behind GnuPG + + As with all technical things in the world, people and not machines + created them are responsible to keep them running. Software and + thus GnuPG is not different. Although software is build using a lot + of other software and thus the work of many thousand people, you may + be interested to see who is working on GnuPG. Here is a list of + some of them: + + #+HTML:
        + +** Werner Koch + + #+ATTR_HTML: :class people :title Werner Koch + [[file:werner.png]] + + /Core components maintainer/ + + Werner started GnuPG in 1997 and still puts most of his working + time into the development and maintenance of GnuPG. He has 29 + years experience in commercial software development on systems + ranging from CP/M systems to mainframes, languages from assembler + to Smalltalk and applications from drivers to financial analysis + systems. Werner is a long time free software supporter and + co-founder of the [[http://fsfe.org][FSFE]]. With the support of his brother he founded + [[https://g10code.com][g10^code]] GmbH in 2001 to make GnuPG development his profession. + + #+HTML:

        + +** David Shaw + + #+ATTR_HTML: :class people :title David Shaw + [[file:david.png]] + + /Master of the classic branch/ + + David approached the GnuPG Project in 2002 after the relaxing of + the US crypto regulation allowed the participation of US based + hackers on international crypto projects. One of his first + achievements was a much improved Web-of-Trust implementation. + Today he mainly takes responsibility for the keyserver access and + the classic GnuPG 1.x branch. + + #+HTML:

        + +** Marcus Brinkmann + + #+ATTR_HTML: :class people :title Marcus Brinkmann + [[file:marcus.png]] + + /Hacker emeritus/ + + Marcus is part of the free software community since 1997, when he + joined the [[http://www.debian.org][Debian]] project. Probably best known for his past work + on GNU/Hurd, he also has a diploma degree in mathematics, and was + employed by [[https://g10code.com][g10^code]] to work on the GnuPG and related software from + 2001 to 2012. + + #+HTML:

        + +** NIIBE Yutaka + + #+ATTR_HTML: :class people :title NIIBE Yutaka + [[file:gniibe.png]] + + /Smartcards and Libgcrypt/ + + Niibe is a long time free software hacker who joined the GnuPG + project in 2011 and soon took over the development of the smartcard + related code. He is also the person behind the [[https://fsij.org/gnuk][gnuk token]]. + + #+HTML:

        + +** Jussi Kivilinna + + #+ATTR_HTML: :class people :title Jussi Kivilinna + [[file:jussi.png]] + + /Optimization/ + + Jussi joined the GnuPG project in 2012 and worked since then on + assembler optimized code for cryptographic algorithms in Libgcrypt. + + #+HTML:

        diff --git a/web/people/jussi.png b/web/people/jussi.png new file mode 100644 index 0000000..be0a3ce Binary files /dev/null and b/web/people/jussi.png differ diff --git a/web/people/marcus.png b/web/people/marcus.png new file mode 100644 index 0000000..c8e2d9a Binary files /dev/null and b/web/people/marcus.png differ diff --git a/web/people/werner.png b/web/people/werner.png new file mode 100644 index 0000000..3b0a8b8 Binary files /dev/null and b/web/people/werner.png differ diff --git a/web/share/gpgweb.el b/web/share/gpgweb.el index aed734b..915a3de 100644 --- a/web/share/gpgweb.el +++ b/web/share/gpgweb.el @@ -74,6 +74,7 @@ if not available." "Home" (("/features.html" "Features") ("/news.html" "News") + ("/people/index.html" "People") ("/service.html" "Service"))) ("/donate/index.html" "Donate" diff --git a/web/share/site.css b/web/share/site.css index 9fb803d..5810701 100644 --- a/web/share/site.css +++ b/web/share/site.css @@ -124,6 +124,14 @@ img.rfloat { margin-left: 1em; } +img.people { + float: left; + margin-right: 1em; + margin-bottom: 1em; + min-width: 120px; +} + + .correction { color: #ff0000; ----------------------------------------------------------------------- Summary of changes: web/people/david.png | Bin 0 -> 183 bytes web/people/gniibe.png | Bin 0 -> 27040 bytes web/people/index.org | 88 +++++++++++++++++++++++++++++++++++++++++++++++++ web/people/jussi.png | Bin 0 -> 12900 bytes web/people/marcus.png | Bin 0 -> 19672 bytes web/people/werner.png | Bin 0 -> 22010 bytes web/share/gpgweb.el | 1 + web/share/site.css | 8 +++++ 8 files changed, 97 insertions(+) create mode 100644 web/people/david.png create mode 100644 web/people/gniibe.png create mode 100644 web/people/index.org create mode 100644 web/people/jussi.png create mode 100644 web/people/marcus.png create mode 100644 web/people/werner.png hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Fri Dec 5 09:38:55 2014 From: cvs at cvs.gnupg.org (by NIIBE Yutaka) Date: Fri, 05 Dec 2014 09:38:55 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-61-g8720125 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 8720125f5a283ede34e52c2493b8a9b0226ae62c (commit) from 63e7891f0f9f0228d93c6cd979fbf2797da2b67d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 8720125f5a283ede34e52c2493b8a9b0226ae62c Author: NIIBE Yutaka Date: Fri Dec 5 14:20:50 2014 +0900 scd: Fix for NIST P-256. * g10/card-util.c (card_store_subkey): Error check. * scd/app-opengpg.c (ecc_writekey): Support NIST P-256. (do_writekey): Error check. diff --git a/g10/card-util.c b/g10/card-util.c index 3d5c43c..4f1c9d8 100644 --- a/g10/card-util.c +++ b/g10/card-util.c @@ -1619,7 +1619,7 @@ card_store_subkey (KBNODE node, int use) goto leave; epoch2isotime (timebuf, (time_t)pk->timestamp); - agent_keytocard (hexgrip, keyno, rc, info.serialno, timebuf); + rc = agent_keytocard (hexgrip, keyno, rc, info.serialno, timebuf); if (rc) log_error (_("KEYTOCARD failed: %s\n"), gpg_strerror (rc)); diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c index 9b4ab22..e27a2cb 100644 --- a/scd/app-openpgp.c +++ b/scd/app-openpgp.c @@ -3258,8 +3258,8 @@ ecc_writekey (app_t app, gpg_error_t (*pincb)(void*, const char *, char **), u32 created_at = 0; int curve = CURVE_UNKNOWN; - /* (private-key(ecdsa(curve%s)(q%m)(d%m))(created-at%d)): - curve = "1.2.840.10045.3.1.7" */ + /* (private-key(ecc(curve%s)(q%m)(d%m))(created-at%d)): + curve = "NIST P-256" */ /* (private-key(ecc(curve%s)(q%m)(d%m))(created-at%d)): curve = "secp256k1" */ /* (private-key(ecc(curve%s)(flags eddsa)(q%m)(d%m))(created-at%d)): @@ -3281,12 +3281,18 @@ ecc_writekey (app_t app, gpg_error_t (*pincb)(void*, const char *, char **), if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))) goto leave; - if (tok && toklen == 19 && !memcmp (tok, "1.2.840.10045.3.1.7", 19)) + if (tok && toklen == 10 && !memcmp (tok, "NIST P-256", 10)) curve = CURVE_NIST_P256; else if (tok && toklen == 9 && !memcmp (tok, "secp256k1", 9)) curve = CURVE_SEC_P256K1; else if (tok && toklen == 7 && !memcmp (tok, "Ed25519", 7)) curve = CURVE_ED25519; + else + { + log_error (_("unsupported curve\n")); + err = gpg_error (GPG_ERR_INV_VALUE); + goto leave; + } } else if (tok && toklen == 1) { @@ -3491,15 +3497,15 @@ do_writekey (app_t app, ctrl_t ctrl, if ((err = parse_sexp (&buf, &buflen, &depth, &tok, &toklen))) goto leave; if (tok && toklen == 3 && memcmp ("rsa", tok, toklen) == 0) - rsa_writekey (app, pincb, pincb_arg, keyno, buf, buflen, depth); + err = rsa_writekey (app, pincb, pincb_arg, keyno, buf, buflen, depth); else if ((tok && toklen == 3 && memcmp ("ecc", tok, toklen) == 0 && (keyno == 0 || keyno == 2)) || (tok && toklen == 5 && memcmp ("ecdsa", tok, toklen) == 0)) - ecc_writekey (app, pincb, pincb_arg, keyno, buf, buflen, depth); + err = ecc_writekey (app, pincb, pincb_arg, keyno, buf, buflen, depth); else if ((tok && toklen == 3 && memcmp ("ecc", tok, toklen) == 0 && keyno == 1) || (tok && toklen == 4 && memcmp ("ecdh", tok, toklen) == 0)) - ecdh_writekey (app, pincb, pincb_arg, keyno, buf, buflen, depth); + err = ecdh_writekey (app, pincb, pincb_arg, keyno, buf, buflen, depth); else { err = gpg_error (GPG_ERR_WRONG_PUBKEY_ALGO); ----------------------------------------------------------------------- Summary of changes: g10/card-util.c | 2 +- scd/app-openpgp.c | 18 ++++++++++++------ 2 files changed, 13 insertions(+), 7 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Dec 5 15:26:12 2014 From: cvs at cvs.gnupg.org (by Andre Heinecke) Date: Fri, 05 Dec 2014 15:26:12 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-62-gf4ed04f Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via f4ed04fca8885301b567ec004ffff0d6e24f4611 (commit) from 8720125f5a283ede34e52c2493b8a9b0226ae62c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f4ed04fca8885301b567ec004ffff0d6e24f4611 Author: Andre Heinecke Date: Fri Dec 5 11:16:14 2014 +0100 Document no-allow-mark-trusted option doc: Document no-allow-mark-trusted for gpg-agent * doc/gpg-agent.texi: Change allow-mark-trusted doc to no-allow-mark-trusted. -- Since rev. 78a56b14 allow-mark-trusted is the default option and was replaced by no-allow-mark-trusted to disable the interactive prompt. Signed-off-by: Andre Heinecke diff --git a/doc/gpg-agent.texi b/doc/gpg-agent.texi index 7523043..36bd0c2 100644 --- a/doc/gpg-agent.texi +++ b/doc/gpg-agent.texi @@ -350,12 +350,12 @@ descriptor has been set on a Windows platform, the Registry entry the logging output. - at anchor{option --allow-mark-trusted} - at item --allow-mark-trusted - at opindex allow-mark-trusted -Allow clients to mark keys as trusted, i.e. put them into the - at file{trustlist.txt} file. This is by default not allowed to make it -harder for users to inadvertently accept Root-CA keys. + at anchor{option --no-allow-mark-trusted} + at item --no-allow-mark-trusted + at opindex no-allow-mark-trusted +Do not allow clients to mark keys as trusted, i.e. put them into the + at file{trustlist.txt} file. This makes it harder for users to inadvertently +accept Root-CA keys. @anchor{option --allow-preset-passphrase} @item --allow-preset-passphrase @@ -650,11 +650,10 @@ administrator might have already entered those keys which are deemed trustworthy enough into this file. Places where to look for the fingerprint of a root certificate are letters received from the CA or the website of the CA (after making 100% sure that this is indeed the -website of that CA). You may want to consider allowing interactive -updates of this file by using the @xref{option --allow-mark-trusted}. -This is however not as secure as maintaining this file manually. It is -even advisable to change the permissions to read-only so that this file -can't be changed inadvertently. +website of that CA). You may want to consider disallowing interactive +updates of this file by using the @xref{option --no-allow-mark-trusted}. +It might even be advisable to change the permissions to read-only so +that this file can't be changed inadvertently. As a special feature a line @code{include-default} will include a global list of trusted certificates (e.g. @file{/etc/gnupg/trustlist.txt}). @@ -751,7 +750,7 @@ again. Only certain options are honored: @code{quiet}, @code{verbose}, @code{debug}, @code{debug-all}, @code{debug-level}, @code{no-grab}, @code{pinentry-program}, @code{default-cache-ttl}, @code{max-cache-ttl}, @code{ignore-cache-for-signing}, - at code{allow-mark-trusted}, @code{disable-scdaemon}, and + at code{no-allow-mark-trusted}, @code{disable-scdaemon}, and @code{disable-check-own-socket}. @code{scdaemon-program} is also supported but due to the current implementation, which calls the scdaemon only once, it is not of much use unless you manually kill the ----------------------------------------------------------------------- Summary of changes: doc/gpg-agent.texi | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 8 02:23:46 2014 From: cvs at cvs.gnupg.org (by NIIBE Yutaka) Date: Mon, 08 Dec 2014 02:23:46 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-63-gc50c11d Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via c50c11d5751f46ddb38244a5a07d8274e1e10922 (commit) from f4ed04fca8885301b567ec004ffff0d6e24f4611 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c50c11d5751f46ddb38244a5a07d8274e1e10922 Author: NIIBE Yutaka Date: Mon Dec 8 10:21:55 2014 +0900 scd: Fix for EdDSA. * scd/app-openpgp.c (get_algo_byte): It catches 22. (store_fpr): It's MPI usually, but it's opaque bytes for EdDSA. diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c index e27a2cb..663b7d3 100644 --- a/scd/app-openpgp.c +++ b/scd/app-openpgp.c @@ -752,7 +752,7 @@ get_algo_byte (key_type_t key_type) else if (key_type == KEY_TYPE_ECDH) return 18; else if (key_type == KEY_TYPE_EDDSA) - return 105; /* (experimental) */ + return 22; else return 1; /* RSA */ } @@ -790,8 +790,10 @@ store_fpr (app_t app, int keynumber, u32 timestamp, { m[i] = va_arg (ap, const unsigned char *); mlen[i] = va_arg (ap, size_t); - for (; mlen[i] && !*m[i]; mlen[i]--, m[i]++) /* strip leading zeroes */ - ; + if (key_type != KEY_TYPE_EDDSA) + /* strip off leading zeroes */ + for (; mlen[i] && !*m[i]; mlen[i]--, m[i]++) + ; if (key_type == KEY_TYPE_RSA || i == 1) n += 2; n += mlen[i]; ----------------------------------------------------------------------- Summary of changes: scd/app-openpgp.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 8 11:14:47 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 08 Dec 2014 11:14:47 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-65-gb72ece6 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via b72ece6d74d3e385e818ead748eba0cb111b95b3 (commit) via 66ab8f807c96b778f2a2c82b58d3e15ac295e1b2 (commit) from c50c11d5751f46ddb38244a5a07d8274e1e10922 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b72ece6d74d3e385e818ead748eba0cb111b95b3 Author: Werner Koch Date: Mon Dec 8 11:13:17 2014 +0100 dirmngr: Return a proper error for all dead hosts. * dirmngr/ks-engine-hkp.c (map_host): Change to return an gpg_error_t. Return an error code for all dead hosts. (make_host_part): Change to return an gpg_error_t. Change all callers. -- The functions used to return an error code via ERRNO. However, this does not allow to return extra error codes in a portable way. Thus we change the function to directly return a gpg_error_t. Signed-off-by: Werner Koch diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c index 83e878a..0a86b5d 100644 --- a/dirmngr/ks-engine-hkp.c +++ b/dirmngr/ks-engine-hkp.c @@ -316,25 +316,30 @@ is_ip_address (const char *name) to choose one of the hosts. For example we skip those hosts which failed for some time and we stick to one host for a time independent of DNS retry times. If FORCE_RESELECT is true a new - host is always selected. If R_HTTPFLAGS is not NULL if will - receive flags which are to be passed to http_open. If R_HOST is - not NULL a malloced name of the pool is stored or NULL if it is not - a pool. */ -static char * + host is always selected. The selected host is stored as a malloced + string at R_HOST; on error NULL is stored. If R_HTTPFLAGS is not + NULL it will receive flags which are to be passed to http_open. If + R_POOLNAME is not NULL a malloced name of the pool is stored or + NULL if it is not a pool. */ +static gpg_error_t map_host (ctrl_t ctrl, const char *name, int force_reselect, - unsigned int *r_httpflags, char **r_host) + char **r_host, unsigned int *r_httpflags, char **r_poolname) { hostinfo_t hi; int idx; + *r_host = NULL; if (r_httpflags) *r_httpflags = 0; - if (r_host) - *r_host = NULL; + if (r_poolname) + *r_poolname = NULL; /* No hostname means localhost. */ if (!name || !*name) - return xtrystrdup ("localhost"); + { + *r_host = xtrystrdup ("localhost"); + return *r_host? 0 : gpg_error_from_syserror (); + } /* See whether the host is in our table. */ idx = find_hostinfo (name); @@ -350,14 +355,14 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect, reftblsize = 100; reftbl = xtrymalloc (reftblsize * sizeof *reftbl); if (!reftbl) - return NULL; + return gpg_error_from_syserror (); refidx = 0; idx = create_new_hostinfo (name); if (idx == -1) { xfree (reftbl); - return NULL; + return gpg_error_from_syserror (); } hi = hosttable[idx]; @@ -527,7 +532,7 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect, if (hi->poolidx == -1) { log_error ("no alive host found in pool '%s'\n", name); - return NULL; + return gpg_error (GPG_ERR_NO_KEYSERVER); } } @@ -539,7 +544,7 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect, if (hi->dead) { log_error ("host '%s' marked as dead\n", hi->name); - return NULL; + return gpg_error (GPG_ERR_NO_KEYSERVER); } if (r_httpflags) @@ -555,10 +560,24 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect, *r_httpflags |= HTTP_FLAG_IGNORE_IPv6; } - if (r_host && hi->pool && hi->cname) - *r_host = xtrystrdup (hi->cname); + if (r_poolname && hi->pool && hi->cname) + { + *r_poolname = xtrystrdup (hi->cname); + if (!*r_poolname) + return gpg_error_from_syserror (); + } - return xtrystrdup (hi->name); + *r_host = xtrystrdup (hi->name); + if (!*r_host) + { + if (r_poolname) + { + xfree (*r_poolname); + *r_poolname = NULL; + } + return gpg_error_from_syserror (); + } + return 0; } @@ -792,18 +811,20 @@ ks_hkp_help (ctrl_t ctrl, parsed_uri_t uri) /* Build the remote part of the URL from SCHEME, HOST and an optional - PORT. Returns an allocated string or NULL on failure and sets - ERRNO. If R_HTTPHOST is not NULL it receive a mallcoed string with - the poolname. */ -static char * + PORT. Returns an allocated string at R_HOSTPORT or NULL on failure + If R_POOLNAME is not NULL it receives a malloced string with the + poolname. */ +static gpg_error_t make_host_part (ctrl_t ctrl, const char *scheme, const char *host, unsigned short port, int force_reselect, - unsigned int *r_httpflags, char **r_httphost) + char **r_hostport, unsigned int *r_httpflags, char **r_poolname) { + gpg_error_t err; char portstr[10]; char *hostname; - char *hostport; + + *r_hostport = NULL; /* Map scheme and port. */ if (!strcmp (scheme, "hkps") || !strcmp (scheme,"https")) @@ -823,13 +844,23 @@ make_host_part (ctrl_t ctrl, /*fixme_do_srv_lookup ()*/ } - hostname = map_host (ctrl, host, force_reselect, r_httpflags, r_httphost); - if (!hostname) - return NULL; + err = map_host (ctrl, host, force_reselect, + &hostname, r_httpflags, r_poolname); + if (err) + return err; - hostport = strconcat (scheme, "://", hostname, ":", portstr, NULL); + *r_hostport = strconcat (scheme, "://", hostname, ":", portstr, NULL); xfree (hostname); - return hostport; + if (!*r_hostport) + { + if (r_poolname) + { + xfree (*r_poolname); + *r_poolname = NULL; + } + return gpg_error_from_syserror (); + } + return 0; } @@ -842,11 +873,10 @@ ks_hkp_resolve (ctrl_t ctrl, parsed_uri_t uri) gpg_error_t err; char *hostport = NULL; - hostport = make_host_part (ctrl, uri->scheme, uri->host, uri->port, 1, - NULL, NULL); - if (!hostport) + err = make_host_part (ctrl, uri->scheme, uri->host, uri->port, 1, + &hostport, NULL, NULL); + if (err) { - err = gpg_error_from_syserror (); err = ks_printf_help (ctrl, "%s://%s:%hu: resolve failed: %s", uri->scheme, uri->host, uri->port, gpg_strerror (err)); @@ -1187,15 +1217,12 @@ ks_hkp_search (ctrl_t ctrl, parsed_uri_t uri, const char *pattern, { char *searchkey; - xfree (hostport); + xfree (hostport); hostport = NULL; xfree (httphost); httphost = NULL; - hostport = make_host_part (ctrl, uri->scheme, uri->host, uri->port, - reselect, &httpflags, &httphost); - if (!hostport) - { - err = gpg_error_from_syserror (); - goto leave; - } + err = make_host_part (ctrl, uri->scheme, uri->host, uri->port, reselect, + &hostport, &httpflags, &httphost); + if (err) + goto leave; searchkey = http_escape_string (pattern, EXTRA_ESCAPE_CHARS); if (!searchkey) @@ -1330,15 +1357,12 @@ ks_hkp_get (ctrl_t ctrl, parsed_uri_t uri, const char *keyspec, estream_t *r_fp) reselect = 0; again: /* Build the request string. */ - xfree (hostport); + xfree (hostport); hostport = NULL; xfree (httphost); httphost = NULL; - hostport = make_host_part (ctrl, uri->scheme, uri->host, uri->port, - reselect, &httpflags, &httphost); - if (!hostport) - { - err = gpg_error_from_syserror (); - goto leave; - } + err = make_host_part (ctrl, uri->scheme, uri->host, uri->port, reselect, + &hostport, &httpflags, &httphost); + if (err) + goto leave; xfree (request); request = strconcat (hostport, @@ -1445,15 +1469,12 @@ ks_hkp_put (ctrl_t ctrl, parsed_uri_t uri, const void *data, size_t datalen) /* Build the request string. */ reselect = 0; again: - xfree (hostport); + xfree (hostport); hostport = NULL; xfree (httphost); httphost = NULL; - hostport = make_host_part (ctrl, uri->scheme, uri->host, uri->port, - reselect, &httpflags, &httphost); - if (!hostport) - { - err = gpg_error_from_syserror (); - goto leave; - } + err = make_host_part (ctrl, uri->scheme, uri->host, uri->port, reselect, + &hostport, &httpflags, &httphost); + if (err) + goto leave; xfree (request); request = strconcat (hostport, "/pks/add", NULL); commit 66ab8f807c96b778f2a2c82b58d3e15ac295e1b2 Author: Werner Koch Date: Mon Dec 8 11:10:11 2014 +0100 gpg: Write a status line for a failed --send-keys. * g10/keyserver.c (keyserver_put): Write an status error. diff --git a/g10/keyserver.c b/g10/keyserver.c index e3ad707..6b603cd 100644 --- a/g10/keyserver.c +++ b/g10/keyserver.c @@ -1828,7 +1828,10 @@ keyserver_put (ctrl_t ctrl, strlist_t keyspecs, release_kbnode (keyblock); xfree (data); if (err) - log_error (_("keyserver send failed: %s\n"), gpg_strerror (err)); + { + write_status_error ("keyserver_send", err); + log_error (_("keyserver send failed: %s\n"), gpg_strerror (err)); + } } } ----------------------------------------------------------------------- Summary of changes: dirmngr/ks-engine-hkp.c | 131 +++++++++++++++++++++++++++-------------------- g10/keyserver.c | 5 +- 2 files changed, 80 insertions(+), 56 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 8 11:18:38 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 08 Dec 2014 11:18:38 +0100 Subject: [git] GPGME - branch, master, updated. gpgme-1.5.2-2-g05258d4 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "GnuPG Made Easy". The branch, master has been updated via 05258d427513a933f01d4df13aca834d797f91e7 (commit) from 162c87f069ebeecec4244fdfe56a19c566641356 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 05258d427513a933f01d4df13aca834d797f91e7 Author: Werner Koch Date: Mon Dec 8 11:19:16 2014 +0100 Return an error for some export key operations. * src/context.h (OPDATA_EXPORT): New. * src/export.c (op_data_t): New. (release_op_data): New. (parse_error): New. (export_status_handler): New. (export_start, export_ext_start): Prepare op_data. (gpgme_op_export_ext, gpgme_op_export_keys): Return an error from the status handler. -- To support an error return also for the async functions we need to extend the API. Until we have done that this new features helps at least in some cases; in particular for --send-keys. diff --git a/src/context.h b/src/context.h index e921436..745ffa8 100644 --- a/src/context.h +++ b/src/context.h @@ -38,7 +38,7 @@ typedef enum OPDATA_DECRYPT, OPDATA_SIGN, OPDATA_ENCRYPT, OPDATA_PASSPHRASE, OPDATA_IMPORT, OPDATA_GENKEY, OPDATA_KEYLIST, OPDATA_EDIT, OPDATA_VERIFY, OPDATA_TRUSTLIST, OPDATA_ASSUAN, OPDATA_VFS_MOUNT, - OPDATA_PASSWD + OPDATA_PASSWD, OPDATA_EXPORT } ctx_op_data_id_t; diff --git a/src/export.c b/src/export.c index 81a23b0..8930aa6 100644 --- a/src/export.c +++ b/src/export.c @@ -1,6 +1,6 @@ /* export.c - Export a key. Copyright (C) 2000 Werner Koch (dd9jn) - Copyright (C) 2001, 2002, 2003, 2004, 2010 g10 Code GmbH + Copyright (C) 2001-2004, 2010, 2014 g10 Code GmbH This file is part of GPGME. @@ -31,9 +31,82 @@ #include "ops.h" +/* Local operation data. */ +typedef struct +{ + gpg_error_t err; /* Error encountred during the export. */ +} *op_data_t; + + +static void +release_op_data (void *hook) +{ + op_data_t opd = (op_data_t) hook; + + (void)opd; /* Nothing to release here. */ +} + + +/* Parse an error status line. Return the error location and the + error code. The function may modify ARGS. */ +static char * +parse_error (char *args, gpg_error_t *r_err) +{ + char *where = strchr (args, ' '); + char *which; + + if (where) + { + *where = '\0'; + which = where + 1; + + where = strchr (which, ' '); + if (where) + *where = '\0'; + + where = args; + } + else + { + *r_err = trace_gpg_error (GPG_ERR_INV_ENGINE); + return NULL; + } + + *r_err = atoi (which); + + return where; +} + + static gpgme_error_t export_status_handler (void *priv, gpgme_status_code_t code, char *args) { + gpgme_ctx_t ctx = (gpgme_ctx_t) priv; + gpgme_error_t err; + void *hook; + op_data_t opd; + const char *loc; + + err = _gpgme_op_data_lookup (ctx, OPDATA_EXPORT, &hook, -1, NULL); + opd = hook; + if (err) + return err; + + switch (code) + { + case GPGME_STATUS_ERROR: + loc = parse_error (args, &err); + if (!loc) + return err; + else if (opd->err) + ; /* We only want to report the first error. */ + else if (!strcmp (loc, "keyserver_send")) + opd->err = err; + break; + + default: + break; + } return 0; } @@ -43,6 +116,8 @@ export_start (gpgme_ctx_t ctx, int synchronous, const char *pattern, gpgme_export_mode_t mode, gpgme_data_t keydata) { gpgme_error_t err; + void *hook; + op_data_t opd; if ((mode & ~(GPGME_EXPORT_MODE_EXTERN |GPGME_EXPORT_MODE_MINIMAL))) @@ -64,6 +139,12 @@ export_start (gpgme_ctx_t ctx, int synchronous, const char *pattern, if (err) return err; + err = _gpgme_op_data_lookup (ctx, OPDATA_EXPORT, &hook, + sizeof (*opd), release_op_data); + opd = hook; + if (err) + return err; + _gpgme_engine_set_status_handler (ctx->engine, export_status_handler, ctx); return _gpgme_engine_op_export (ctx->engine, pattern, mode, keydata, @@ -114,6 +195,8 @@ export_ext_start (gpgme_ctx_t ctx, int synchronous, const char *pattern[], gpgme_export_mode_t mode, gpgme_data_t keydata) { gpgme_error_t err; + void *hook; + op_data_t opd; if ((mode & ~(GPGME_EXPORT_MODE_EXTERN |GPGME_EXPORT_MODE_MINIMAL))) @@ -134,6 +217,12 @@ export_ext_start (gpgme_ctx_t ctx, int synchronous, const char *pattern[], if (err) return err; + err = _gpgme_op_data_lookup (ctx, OPDATA_EXPORT, &hook, + sizeof (*opd), release_op_data); + opd = hook; + if (err) + return err; + _gpgme_engine_set_status_handler (ctx->engine, export_status_handler, ctx); return _gpgme_engine_op_export_ext (ctx->engine, pattern, mode, keydata, @@ -196,7 +285,24 @@ gpgme_op_export_ext (gpgme_ctx_t ctx, const char *pattern[], err = export_ext_start (ctx, 1, pattern, mode, keydata); if (!err) - err = _gpgme_wait_one (ctx); + { + err = _gpgme_wait_one (ctx); + if (!err) + { + /* For this synchronous operation we check for operational + errors and return them. For asynchronous operations + there is currently no way to do this - we need to add a + gpgme_op_export_result function to fix that. */ + void *hook; + op_data_t opd; + + err = _gpgme_op_data_lookup (ctx, OPDATA_EXPORT, &hook, -1, NULL); + opd = hook; + if (!err) + err = opd->err; + } + } + return TRACE_ERR (err); } @@ -319,7 +425,24 @@ gpgme_op_export_keys (gpgme_ctx_t ctx, err = export_keys_start (ctx, 1, keys, mode, keydata); if (!err) - err = _gpgme_wait_one (ctx); + { + err = _gpgme_wait_one (ctx); + if (!err) + { + /* For this synchronous operation we check for operational + errors and return them. For asynchronous operations + there is currently no way to do this - we need to add a + gpgme_op_export_result function to fix that. */ + void *hook; + op_data_t opd; + + err = _gpgme_op_data_lookup (ctx, OPDATA_EXPORT, &hook, -1, NULL); + opd = hook; + if (!err) + err = opd->err; + } + } + return TRACE_ERR (err); } ----------------------------------------------------------------------- Summary of changes: src/context.h | 2 +- src/export.c | 129 +++++++++++++++++++++++++++++++++++++++++++++++++++++++-- 2 files changed, 127 insertions(+), 4 deletions(-) hooks/post-receive -- GnuPG Made Easy http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 8 11:30:12 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 08 Dec 2014 11:30:12 +0100 Subject: [git] GPA - branch, master, updated. gpa-0.9.6-4-g5c763a2 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Assistant". The branch, master has been updated via 5c763a21f2a8d3a47399bec6dc042651d1f84a28 (commit) via e37fe5c07a73c4c56892842d2cfdb1793c94275d (commit) via e4e9d6f82993404453dfb00e6059a7bb8b7ae577 (commit) from a46182fed6094502341d0192208e5567b6a2b155 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5c763a21f2a8d3a47399bec6dc042651d1f84a28 Author: Werner Koch Date: Mon Dec 8 11:30:36 2014 +0100 po: Update the German translation. -- diff --git a/po/de.po b/po/de.po index dc3d699..d6595f5 100644 --- a/po/de.po +++ b/po/de.po @@ -6,7 +6,7 @@ msgid "" msgstr "" "Project-Id-Version: gpa\n" "Report-Msgid-Bugs-To: gpa-dev at gnupg.org\n" -"PO-Revision-Date: 2014-11-21 09:40+0100\n" +"PO-Revision-Date: 2014-12-08 11:30+0100\n" "Last-Translator: Werner Koch \n" "Language-Team: German \n" "Language: de\n" @@ -146,6 +146,21 @@ msgstr "Fortgeschritten" msgid "Expert" msgstr "Experte" +msgid "A keyserver has not been configured." +msgstr "Es ist kein Schl?ssel-Server konfiguriert." + +msgid "Configure backend to use a keyserver?" +msgstr "Soll ein Schl?ssel-Server konfiguriert werden?" + +msgid "_Yes" +msgstr "_Ja" + +msgid "_No" +msgstr "_Nein" + +msgid "Configuring the backend to use a keyserver failed" +msgstr "Konfiguration eines Schl?ssel-Servers ist fehlgeschlagen" + msgid "days" msgstr "Tage" @@ -356,19 +371,17 @@ msgstr "Nur Schl?ssel eines Protokolls k?nnen zusammen exportiert werden" #, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" -"Der ausgew?hlte Schl?ssel wird an einen ?ffentlichen\n" -"Schl?ssel-Server (\"%s\") gesandt.\n" -"Sind Sie sicher, dass Sie diesen Schl?ssel ver?ffentlichen wollen?" +"Der oder die ausgew?hlte(n) Schl?ssel wird an einen ?ffentlichen\n" +"Schl?ssel-Server (\"%s\") gesandt." -msgid "_Yes" -msgstr "_Ja" +msgid "Are you sure you want to distribute this key?" +msgstr "Wollen Sie diesen Schl?ssel wirklich ver?ffentlichen?" -msgid "_No" -msgstr "_Nein" +msgid "Error sending key(s) to the server." +msgstr "Schl?ssel konnte(n) nicht zum Server gesendet werden" msgid "The keys have been sent to the server." msgstr "Die Schl?ssel wurden zum Server gesandt." @@ -1661,7 +1674,7 @@ msgid "Key incomplete" msgstr "Unvollst?ndiger Schl?ssel" msgid "Could not contact keyserver" -msgstr "Keinve Verbindung zum Schl?ssel-Server m?glich." +msgstr "Keine Verbindung zum Schl?ssel-Server m?glich." msgid "Unknown Error" msgstr "Unbekannter Fehler" @@ -2017,7 +2030,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" commit e37fe5c07a73c4c56892842d2cfdb1793c94275d Author: Werner Koch Date: Mon Dec 8 11:23:40 2014 +0100 Support sending keys with GnuPG 2.1. * src/confdialog.c (gpa_configure_keyserver): New. * src/gpa.c (main): Do no get a default keyserver for GnuPG 2.1. * src/options.c (gpa_options_read_settings): Ditto. * src/settingsdlg.c (save_settings): Do not set a default keyserver for GnuPG 2.1 * src/gpaexportserverop.c (confirm_send): Ask to configure keyserver. Support GnuPG 2.1. (send_keys): New. (gpa_export_server_operation_complete_export): Support GnuPG 2.1. diff --git a/src/confdialog.c b/src/confdialog.c index 892aee6..005d55d 100644 --- a/src/confdialog.c +++ b/src/confdialog.c @@ -32,6 +32,7 @@ #include "i18n.h" #include "gpgmetools.h" +#include "gtktools.h" #include "options.h" /* Violation of GNOME standards: Cancel does not revert previous @@ -1569,3 +1570,44 @@ gpa_store_configured_keyserver (const char *value) gpa_store_gpgconf_string ("gpg", "keyserver", value); #endif } + + +/* Ask the user whether to configure GnuPG to use a keyserver. Return + NULL if it could or shall not be configured or the name of the + keyserver which needs to be g_freed. */ +char * +gpa_configure_keyserver (GtkWidget *parent) +{ +#ifdef ENABLE_KEYSERVER_SUPPORT + GtkWidget *msgbox; + char *keyserver; + + msgbox = gtk_message_dialog_new + (GTK_WINDOW(parent), GTK_DIALOG_MODAL, + GTK_MESSAGE_WARNING, GTK_BUTTONS_NONE, + "%s\n\n%s", + _("A keyserver has not been configured."), + _("Configure backend to use a keyserver?")); + gtk_dialog_add_buttons (GTK_DIALOG (msgbox), + _("_Yes"), GTK_RESPONSE_YES, + _("_No"), GTK_RESPONSE_NO, NULL); + if (gtk_dialog_run (GTK_DIALOG (msgbox)) == GTK_RESPONSE_NO) + { + gtk_widget_destroy (msgbox); + return NULL; + } + gtk_widget_destroy (msgbox); + gpa_store_configured_keyserver ("hkp://keys.gnupg.net"); + keyserver = gpa_load_configured_keyserver (); + if (!keyserver) + { + gpa_show_warning + (parent, _("Configuring the backend to use a keyserver failed")); + return NULL; + } + return keyserver; +#else + (void)parent; + return NULL +#endif +} diff --git a/src/confdialog.h b/src/confdialog.h index 1d7857e..5a91650 100644 --- a/src/confdialog.h +++ b/src/confdialog.h @@ -25,13 +25,14 @@ GtkWidget *gpa_backend_config_dialog_new (void); char *gpa_load_gpgconf_string (const char *cname, const char *name); -void gpa_store_gpgconf_string (const char *cname, +void gpa_store_gpgconf_string (const char *cname, const char *name, const char *value); char *gpa_load_configured_keyserver (void); void gpa_store_configured_keyserver (const char *value); +char *gpa_configure_keyserver (GtkWidget *parent); #endif diff --git a/src/gpa.c b/src/gpa.c index 73335bd..d9db079 100644 --- a/src/gpa.c +++ b/src/gpa.c @@ -592,7 +592,8 @@ main (int argc, char *argv[]) gpa_options_update_default_key (gpa_options_get_instance ()); /* Now, make sure there are reasonable defaults for the default key and keyserver. */ - if (!gpa_options_get_default_keyserver (gpa_options_get_instance ())) + if (!is_gpg_version_at_least ("2.1.0") + && !gpa_options_get_default_keyserver (gpa_options_get_instance ())) { GList *keyservers = keyserver_get_as_glist (); gpa_options_set_default_keyserver (gpa_options_get_instance (), diff --git a/src/gpaexportserverop.c b/src/gpaexportserverop.c index 9500ccb..4691423 100644 --- a/src/gpaexportserverop.c +++ b/src/gpaexportserverop.c @@ -27,6 +27,7 @@ #include "gtktools.h" #include "gpgmetools.h" #include "server-access.h" +#include "confdialog.h" #include "gpaexportserverop.h" static GObjectClass *parent_class = NULL; @@ -121,15 +122,38 @@ gpa_export_server_operation_get_type (void) /* Internal */ static gboolean -confirm_send (GtkWidget * parent, const gchar *server) +confirm_send (GtkWidget *parent, const gchar *server) { - GtkWidget *msgbox = gtk_message_dialog_new - (GTK_WINDOW(parent), GTK_DIALOG_MODAL, - GTK_MESSAGE_WARNING, GTK_BUTTONS_NONE, - _("The selected key will be sent to a public key\n" - "server (\"%s\").\n" - "Are you sure you want to distribute this key?"), - server); + GtkWidget *msgbox; + char *info; + char *keyserver = NULL; + + if (is_gpg_version_at_least ("2.1.0")) + { + keyserver = gpa_load_configured_keyserver (); + server = keyserver; + } + + if (!server) + { + keyserver = gpa_configure_keyserver (parent); + if (!keyserver) + return FALSE; + server = keyserver; + } + + + info = g_strdup_printf (_("The selected key(s) will be sent to a public key\n" + "server (\"%s\")."), server); + g_free (keyserver); + msgbox = gtk_message_dialog_new + (GTK_WINDOW(parent), GTK_DIALOG_MODAL, + GTK_MESSAGE_WARNING, GTK_BUTTONS_NONE, + "%s\n\n%s", + info, + _("Are you sure you want to distribute this key?")); + g_free (info); + gtk_dialog_add_buttons (GTK_DIALOG (msgbox), _("_Yes"), GTK_RESPONSE_YES, _("_No"), GTK_RESPONSE_NO, NULL); @@ -172,21 +196,77 @@ gpa_export_server_operation_get_destination (GpaExportOperation *operation, } } + +/* GnuPG 2.1 method to send keys to the keyserver. KEYLIST has a list + of keys to be sent. Returns true on success. */ +static gboolean +send_keys (GpaExportServerOperation *op, GList *keylist) +{ + gpg_error_t err; + GList *item; + gpgme_key_t *keyarray; + gpgme_key_t key; + int i; + + keyarray = g_malloc0_n (g_list_length (keylist)+1, sizeof *keyarray); + i = 0; + for (item = keylist; item; i++, item = g_list_next (item)) + { + key = (gpgme_key_t) item->data; + if (!key || key->protocol != GPGME_PROTOCOL_OpenPGP) + continue; + gpgme_key_ref (key); + keyarray[i++] = key; + } + + gpgme_set_protocol (GPA_OPERATION (op)->context->ctx, GPGME_PROTOCOL_OpenPGP); + err = gpgme_op_export_keys (GPA_OPERATION (op)->context->ctx, + keyarray, GPGME_KEYLIST_MODE_EXTERN, NULL); + for (i=0; keyarray[i]; i++) + gpgme_key_unref (keyarray[i]); + g_free (keyarray); + + if (err) + { + gpa_show_warning (GPA_OPERATION (op)->window, + "%s\n\n(%s <%s>)", + _("Error sending key(s) to the server."), + gpg_strerror (err), gpg_strsource (err)); + return FALSE; + } + + return TRUE; +} + + + static void gpa_export_server_operation_complete_export (GpaExportOperation *operation) { GpaExportServerOperation *op = GPA_EXPORT_SERVER_OPERATION (operation); - gpgme_key_t key; - op->server = g_strdup (gpa_options_get_default_keyserver - (gpa_options_get_instance ())); + int okay = 0; - key = (gpgme_key_t) operation->keys->data; - if (server_send_keys (op->server, key->subkeys->keyid, operation->dest, - GPA_OPERATION (op)->window)) + if (is_gpg_version_at_least ("2.1.0")) + { + /* GnuPG 2.1.0 does not anymore use the keyserver helpers and + thus we need to use the real API for sending keys. */ + if (send_keys (op, operation->keys)) + okay = 1; + } + else { - gpa_window_message (_("The keys have been sent to the server."), - GPA_OPERATION (op)->window); + gpgme_key_t key = (gpgme_key_t) operation->keys->data; + + op->server = g_strdup (gpa_options_get_default_keyserver + (gpa_options_get_instance ())); + if (server_send_keys (op->server, key->subkeys->keyid, operation->dest, + GPA_OPERATION (op)->window)) + okay = 1; } + + if (okay) + gpa_window_message (_("The keys have been sent to the server."), + GPA_OPERATION (op)->window); } /* API */ diff --git a/src/options.c b/src/options.c index ccdd183..fc67c46 100644 --- a/src/options.c +++ b/src/options.c @@ -3,17 +3,17 @@ Copyright (C) 2005, 2008 g10 Code GmbH. This file is part of GPA - + GPA is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. - + GPA is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. - + You should have received a copy of the GNU General Public License along with this program; if not, see . */ @@ -61,7 +61,7 @@ GType gpa_options_get_type (void) { static GType style_type = 0; - + if (!style_type) { static const GTypeInfo style_info = @@ -76,12 +76,12 @@ gpa_options_get_type (void) 0, /* n_preallocs */ (GInstanceInitFunc) gpa_options_init, }; - + style_type = g_type_register_static (G_TYPE_OBJECT, "GpaOptions", &style_info, 0); } - + return style_type; } @@ -105,7 +105,7 @@ static void gpa_options_class_init (GpaOptionsClass *klass) { GObjectClass *object_class = G_OBJECT_CLASS (klass); - + parent_class = g_type_class_peek_parent (klass); object_class->finalize = gpa_options_finalize; @@ -121,7 +121,7 @@ gpa_options_class_init (GpaOptionsClass *klass) make_signal (CHANGED_UI_MODE, object_class, "changed_ui_mode", G_STRUCT_OFFSET (GpaOptionsClass, changed_ui_mode)); - make_signal (CHANGED_SHOW_ADVANCED_OPTIONS, object_class, + make_signal (CHANGED_SHOW_ADVANCED_OPTIONS, object_class, "changed_show_advanced_options", G_STRUCT_OFFSET (GpaOptionsClass, changed_show_advanced_options)); @@ -156,12 +156,12 @@ static void gpa_options_finalize (GObject *object) { GpaOptions *options = GPA_OPTIONS (object); - + g_free (options->options_file); gpgme_key_unref (options->default_key); g_free (options->default_key_fpr); g_free (options->default_keyserver); - + G_OBJECT_CLASS (parent_class)->finalize (object); } @@ -176,7 +176,7 @@ static GpaOptions * gpa_options_new (void) { GpaOptions *options; - + options = g_object_new (GPA_OPTIONS_TYPE, NULL); return options; @@ -300,7 +300,7 @@ determine_default_key (void) err = gpgme_op_keylist_end (ctx); if (gpg_err_code (err) != GPG_ERR_NO_ERROR) { - gpa_gpgme_warning (err); + gpa_gpgme_warning (err); } } else if (gpg_err_code (err) != GPG_ERR_EOF) @@ -323,7 +323,7 @@ gpa_options_update_default_key (GpaOptions *options) if (! options->default_key_fpr) update = TRUE; - else if (gpg_err_code (gpgme_get_key (ctx, options->default_key_fpr, + else if (gpg_err_code (gpgme_get_key (ctx, options->default_key_fpr, &key, TRUE)) == GPG_ERR_EOF) { gpa_window_error (_("The private key you selected as default is no " @@ -357,6 +357,9 @@ gpa_options_update_default_key (GpaOptions *options) void gpa_options_set_default_keyserver (GpaOptions *options, const gchar *keyserver) { + if (is_gpg_version_at_least ("2.1.0")) + return; + if (options->default_keyserver) { g_free (options->default_keyserver); @@ -404,7 +407,7 @@ static void gpa_options_save_settings (GpaOptions *options) { FILE *options_file; - + g_assert(options->options_file != NULL); options_file = g_fopen (options->options_file, "w"); if (!options_file) @@ -420,7 +423,7 @@ gpa_options_save_settings (GpaOptions *options) } if (options->default_keyserver) { - /* we do not write the keyserver anymore to gpg.conf. */ + /* we do not write the keyserver anymore to gpa.conf. */ /* fprintf (options_file, "keyserver %s\n", */ /* options->default_keyserver); */ } @@ -444,7 +447,7 @@ gpa_options_save_settings (GpaOptions *options) } /* Write the keyserver to the backend. */ - if (options->default_keyserver) + if (options->default_keyserver && !is_gpg_version_at_least ("2.1.0")) gpa_store_configured_keyserver (options->default_keyserver); } @@ -472,12 +475,12 @@ read_next_word (FILE *file, char *buffer, int size) buffer[i++] = c; } buffer[i] = '\0'; - + return TRUE; } } -typedef enum +typedef enum { PARSE_OPTIONS_STATE_START, PARSE_OPTIONS_STATE_HAVE_KEY, @@ -490,7 +493,7 @@ static void gpa_options_read_settings (GpaOptions *options) { FILE *options_file; - + g_assert(options->options_file != NULL); options_file = g_fopen (options->options_file, "r"); if (!options_file) @@ -558,5 +561,7 @@ gpa_options_read_settings (GpaOptions *options) /* Read the keyserver from the abckend. */ g_free (options->default_keyserver); - options->default_keyserver = gpa_load_configured_keyserver (); + options->default_keyserver = NULL; + if (!is_gpg_version_at_least ("2.1.0")) + options->default_keyserver = gpa_load_configured_keyserver (); } diff --git a/src/settingsdlg.c b/src/settingsdlg.c index fe9e529..ce57ee6 100644 --- a/src/settingsdlg.c +++ b/src/settingsdlg.c @@ -798,8 +798,9 @@ save_settings (SettingsDlg *dialog) #ifdef ENABLE_KEYSERVER_SUPPORT - gpa_options_set_default_keyserver (gpa_options_get_instance (), - dialog->keyserver.url); + if (!dialog->gnupg21) + gpa_options_set_default_keyserver (gpa_options_get_instance (), + dialog->keyserver.url); #endif /*ENABLE_KEYSERVER_SUPPORT*/ if (!dialog->akl.enabled) commit e4e9d6f82993404453dfb00e6059a7bb8b7ae577 Author: Werner Koch Date: Fri Dec 5 10:58:47 2014 +0100 Update card vendor list and fix one typo. -- diff --git a/src/cm-openpgp.c b/src/cm-openpgp.c index 39ea38d..b559dcd 100644 --- a/src/cm-openpgp.c +++ b/src/cm-openpgp.c @@ -132,12 +132,18 @@ get_manufacturer (unsigned int no) case 0x0001: return "PPC Card Systems"; case 0x0002: return "Prism"; case 0x0003: return "OpenFortress"; - case 0x0004: return "Wewid AB"; + case 0x0004: return "Wewid"; case 0x0005: return "ZeitControl"; + case 0x0006: return "Yubico"; + case 0x0007: return "OpenKMS"; + case 0x0008: return "LogoEmail"; case 0x002A: return "Magrathea"; - /* 0x00000 and 0xFFFF are defined as test cards per spec, - 0xFFF00 to 0xFFFE are assigned for use with randomly created + + case 0xF517: return "FSIJ"; + + /* 0x0000 and 0xFFFF are defined as test cards per spec, + 0xFF00 to 0xFFFE are assigned for use with randomly created serial numbers. */ case 0x0000: case 0xffff: return "test card"; @@ -1121,7 +1127,7 @@ change_pin (GpaCMOpenpgp *card, int pinno) "A fresh standard card has set the Admin-PIN to the value " "12345678. However, the issuer of your card might " "have initialized the card with a different Admin-PIN and " - "that Admin-PIN might only be nown to the issuer. " + "that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current " ----------------------------------------------------------------------- Summary of changes: po/de.po | 39 +++++++++++------ src/cm-openpgp.c | 14 ++++-- src/confdialog.c | 42 ++++++++++++++++++ src/confdialog.h | 3 +- src/gpa.c | 3 +- src/gpaexportserverop.c | 112 ++++++++++++++++++++++++++++++++++++++++------- src/options.c | 45 ++++++++++--------- src/settingsdlg.c | 5 ++- 8 files changed, 206 insertions(+), 57 deletions(-) hooks/post-receive -- The GNU Privacy Assistant http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 8 11:35:50 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 08 Dec 2014 11:35:50 +0100 Subject: [git] GPA - branch, master, updated. gpa-0.9.6-5-g3e643a3 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Assistant". The branch, master has been updated via 3e643a33b9f2d5cbc229e5c1efc086c6aec65243 (commit) from 5c763a21f2a8d3a47399bec6dc042651d1f84a28 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3e643a33b9f2d5cbc229e5c1efc086c6aec65243 Author: Werner Koch Date: Mon Dec 8 11:36:33 2014 +0100 Floppy drives are pretty rare these days advice to use flash. -- diff --git a/po/de.po b/po/de.po index d6595f5..2b054d3 100644 --- a/po/de.po +++ b/po/de.po @@ -6,7 +6,7 @@ msgid "" msgstr "" "Project-Id-Version: gpa\n" "Report-Msgid-Bugs-To: gpa-dev at gnupg.org\n" -"PO-Revision-Date: 2014-12-08 11:30+0100\n" +"PO-Revision-Date: 2014-12-08 11:35+0100\n" "Last-Translator: Werner Koch \n" "Language-Team: German \n" "Language: de\n" @@ -333,15 +333,14 @@ msgid "" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a flash memory kept in a safe place)." msgstr "" "Eine Kopie Ihres geheimen Schl?ssels wurde abgespeichert in der Datei:\n" "\n" "\t\"%s\"\n" "\n" -"Dies ist eine sicherheitskritische Information und muss sicher gespeichert " -"werden\n" -"(z.B. auf einer Diskette, die an einem sicheren Ort verwahrt wird)." +"Dies ist eine sicherheitskritische Information und muss sicher gespeichert werden\n" +"(z.B. auf einem USB Stick, der an einem sicheren Ort verwahrt wird)." msgid "An error ocurred during the backup operation." msgstr "Beim Erstellen der Datensicherung ist ein Fehler aufgetreten." diff --git a/src/gpabackupop.c b/src/gpabackupop.c index 46aeba3..5ff5921 100644 --- a/src/gpabackupop.c +++ b/src/gpabackupop.c @@ -223,7 +223,7 @@ gpa_backup_operation_do_backup (GpaBackupOperation *op, gchar *filename) "\t\"%s\"\n\n" "This is sensitive information, " "and should be stored carefully\n" - "(for example, in a floppy disk " + "(for example, on a flash memory " "kept in a safe place)."), filename); gpa_window_message (message, GPA_OPERATION (op)->window); ----------------------------------------------------------------------- Summary of changes: po/de.po | 9 ++++----- src/gpabackupop.c | 2 +- 2 files changed, 5 insertions(+), 6 deletions(-) hooks/post-receive -- The GNU Privacy Assistant http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 8 11:46:02 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 08 Dec 2014 11:46:02 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-66-gcdc404f Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via cdc404fe5247fb9886a7aeb9f214a04fc88b7aa0 (commit) from b72ece6d74d3e385e818ead748eba0cb111b95b3 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit cdc404fe5247fb9886a7aeb9f214a04fc88b7aa0 Author: Werner Koch Date: Mon Dec 8 11:46:48 2014 +0100 gpg: Add OpenPGP card vendor 0x1337. -- diff --git a/g10/card-util.c b/g10/card-util.c index 4f1c9d8..0535c1d 100644 --- a/g10/card-util.c +++ b/g10/card-util.c @@ -213,6 +213,8 @@ get_manufacturer (unsigned int no) case 0x002A: return "Magrathea"; + case 0x1337: return "Warsaw Hackerspace"; + case 0xF517: return "FSIJ"; /* 0x0000 and 0xFFFF are defined as test cards per spec, ----------------------------------------------------------------------- Summary of changes: g10/card-util.c | 2 ++ 1 file changed, 2 insertions(+) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 8 15:16:39 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 08 Dec 2014 15:16:39 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-67-g5bf93f4 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 5bf93f4ea7a11381dd256b5fd4e5913366828265 (commit) from cdc404fe5247fb9886a7aeb9f214a04fc88b7aa0 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5bf93f4ea7a11381dd256b5fd4e5913366828265 Author: Werner Koch Date: Mon Dec 8 15:14:35 2014 +0100 gpg: Obsolete some keyserver helper options. * g10/options.h (opt): Remove keyserver_options.other. * g10/gpg.c (main): Obsolete option --honor-http-proxt. * g10/keyserver.c (add_canonical_option): Replace by ... (warn_kshelper_option): New. (parse_keyserver_uri): Obsolete "x-broken-http". -- Some of these options are deprecated for 10 years and they do not make any sense without the keyserver helpers. For one we print a hint on how to replace it: gpg: keyserver option 'ca-cert-file' is obsolete; \ please use 'hkp-cacert' in dirmngr.conf Signed-off-by: Werner Koch diff --git a/g10/gpg.c b/g10/gpg.c index 0bedf25..12fe7b2 100644 --- a/g10/gpg.c +++ b/g10/gpg.c @@ -702,7 +702,6 @@ static ARGPARSE_OPTS opts[] = { ARGPARSE_s_n (oNoAllowFreeformUID, "no-allow-freeform-uid", "@"), ARGPARSE_s_n (oNoLiteral, "no-literal", "@"), ARGPARSE_p_u (oSetFilesize, "set-filesize", "@"), - ARGPARSE_s_n (oHonorHttpProxy, "honor-http-proxy", "@"), ARGPARSE_s_n (oFastListMode, "fast-list-mode", "@"), ARGPARSE_s_n (oFixedListMode, "fixed-list-mode", "@"), ARGPARSE_s_n (oLegacyListMode, "legacy-list-mode", "@"), @@ -794,6 +793,7 @@ static ARGPARSE_OPTS opts[] = { ARGPARSE_s_s (octapiDriver, "ctapi-driver", "@"), ARGPARSE_s_s (opcscDriver, "pcsc-driver", "@"), ARGPARSE_s_n (oDisableCCID, "disable-ccid", "@"), + ARGPARSE_s_n (oHonorHttpProxy, "honor-http-proxy", "@"), /* Dummy options. */ ARGPARSE_s_n (oNoop, "sk-comments", "@"), @@ -2375,6 +2375,9 @@ main (int argc, char **argv) case oDisableCCID: obsolete_scdaemon_option (configname, configlineno, "disable-ccid"); break; + case oHonorHttpProxy: + obsolete_option (configname, configlineno, "honor-http-proxy"); + break; case oAnswerYes: opt.answer_yes = 1; break; case oAnswerNo: opt.answer_no = 1; break; @@ -2940,12 +2943,6 @@ main (int argc, char **argv) case oNoAllowFreeformUID: opt.allow_freeform_uid = 0; break; case oNoLiteral: opt.no_literal = 1; break; case oSetFilesize: opt.set_filesize = pargs.r.ret_ulong; break; - case oHonorHttpProxy: - add_to_strlist(&opt.keyserver_options.other,"http-proxy"); - deprecated_warning(configname,configlineno, - "--honor-http-proxy", - "--keyserver-options ","http-proxy"); - break; case oFastListMode: opt.fast_list_mode = 1; break; case oFixedListMode: /* Dummy */ break; case oLegacyListMode: opt.legacy_list_mode = 1; break; diff --git a/g10/keyserver.c b/g10/keyserver.c index 6b603cd..a92544c 100644 --- a/g10/keyserver.c +++ b/g10/keyserver.c @@ -124,26 +124,23 @@ static gpg_error_t keyserver_put (ctrl_t ctrl, strlist_t keyspecs, static size_t max_cert_size=DEFAULT_MAX_CERT_SIZE; static void -add_canonical_option(char *option,strlist_t *list) +warn_kshelper_option(char *option) { - char *arg=argsplit(option); - - if(arg) - { - char *joined; - - joined=xmalloc(strlen(option)+1+strlen(arg)+1); - /* Make a canonical name=value form with no spaces */ - strcpy(joined,option); - strcat(joined,"="); - strcat(joined,arg); - append_to_strlist(list,joined); - xfree(joined); - } - else - append_to_strlist(list,option); + char *p; + + if ((p=strchr (option, '='))) + *p = 0; + + if (!strcmp (option, "ca-cert-file")) + log_info ("keyserver option '%s' is obsolete; please use " + "'%s' in dirmngr.conf\n", + "ca-cert-file", "hkp-cacert"); + else if (!strcmp (option, "check-cert") + || !strcmp (option, "broken-http-proxy")) + log_info ("keyserver option '%s' is obsolete\n", option); } + int parse_keyserver_options(char *options) { @@ -190,9 +187,9 @@ parse_keyserver_options(char *options) && !parse_export_options(tok, &opt.keyserver_options.export_options,0)) { - /* All of the standard options have failed, so the option is - destined for a keyserver plugin. */ - add_canonical_option(tok,&opt.keyserver_options.other); + /* All of the standard options have failed, so the option was + destined for a keyserver plugin as used by GnuPG < 2.1 */ + warn_kshelper_option (tok); } } @@ -285,7 +282,7 @@ parse_keyserver_uri (const char *string,int require_scheme, options++; while((tok=optsep(&options))) - add_canonical_option(tok,&keyserver->options); + warn_kshelper_option (tok); } /* Get the scheme */ @@ -344,11 +341,8 @@ parse_keyserver_uri (const char *string,int require_scheme, if(ascii_strcasecmp(keyserver->scheme,"x-broken-hkp")==0) { - deprecated_warning(configname,configlineno,"x-broken-hkp", - "--keyserver-options ","broken-http-proxy"); - xfree(keyserver->scheme); - keyserver->scheme=xstrdup("hkp"); - append_to_strlist(&opt.keyserver_options.other,"broken-http-proxy"); + log_info ("keyserver option '%s' is obsolete\n", + "x-broken-hkp"); } else if(ascii_strcasecmp(keyserver->scheme,"x-hkp")==0) { diff --git a/g10/options.h b/g10/options.h index 9aadb42..7b9f366 100644 --- a/g10/options.h +++ b/g10/options.h @@ -146,7 +146,6 @@ struct unsigned int options; unsigned int import_options; unsigned int export_options; - strlist_t other; } keyserver_options; int exec_disable; int exec_path_set; ----------------------------------------------------------------------- Summary of changes: g10/gpg.c | 11 ++++------- g10/keyserver.c | 46 ++++++++++++++++++++-------------------------- g10/options.h | 1 - 3 files changed, 24 insertions(+), 34 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 8 17:38:52 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 08 Dec 2014 17:38:52 +0100 Subject: [git] GPA - branch, master, updated. gpa-0.9.6-7-g404f5d7 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Assistant". The branch, master has been updated via 404f5d7396ac83d78fade4cfadd3df96ae44c5fa (commit) via fbbc5ce0e0fe66ff1d58420394b3be610306eafb (commit) from 3e643a33b9f2d5cbc229e5c1efc086c6aec65243 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 404f5d7396ac83d78fade4cfadd3df96ae44c5fa Author: Werner Koch Date: Mon Dec 8 17:39:28 2014 +0100 po: Use the term "USB stick" for the backup message. -- diff --git a/po/de.po b/po/de.po index 2b054d3..0a21488 100644 --- a/po/de.po +++ b/po/de.po @@ -6,7 +6,7 @@ msgid "" msgstr "" "Project-Id-Version: gpa\n" "Report-Msgid-Bugs-To: gpa-dev at gnupg.org\n" -"PO-Revision-Date: 2014-12-08 11:35+0100\n" +"PO-Revision-Date: 2014-12-08 17:36+0100\n" "Last-Translator: Werner Koch \n" "Language-Team: German \n" "Language: de\n" @@ -333,13 +333,14 @@ msgid "" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, on a flash memory kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "Eine Kopie Ihres geheimen Schl?ssels wurde abgespeichert in der Datei:\n" "\n" "\t\"%s\"\n" "\n" -"Dies ist eine sicherheitskritische Information und muss sicher gespeichert werden\n" +"Dies ist eine sicherheitskritische Information und muss sicher gespeichert " +"werden\n" "(z.B. auf einem USB Stick, der an einem sicheren Ort verwahrt wird)." msgid "An error ocurred during the backup operation." diff --git a/po/fr.po b/po/fr.po index f32cdf8..72ef2f4 100644 --- a/po/fr.po +++ b/po/fr.po @@ -10,7 +10,7 @@ msgid "" msgstr "" "Project-Id-Version: GPA 0.8.0\n" "Report-Msgid-Bugs-To: gpa-dev at gnupg.org\n" -"PO-Revision-Date: 2011-12-12 10:12+0100\n" +"PO-Revision-Date: 2014-12-08 17:37+0100\n" "Last-Translator: Eric Lassauge \n" "Language-Team: \n" "Language: fr\n" @@ -150,6 +150,23 @@ msgstr "Avanc?" msgid "Expert" msgstr "Expert" +msgid "A keyserver has not been configured." +msgstr "" + +#, fuzzy +msgid "Configure backend to use a keyserver?" +msgstr "Configurer les programmes ? backend ?" + +msgid "_Yes" +msgstr "_Oui" + +msgid "_No" +msgstr "_Non" + +#, fuzzy +msgid "Configuring the backend to use a keyserver failed" +msgstr "Configurer les programmes ? backend ?" + msgid "days" msgstr "jours" @@ -327,7 +344,7 @@ msgid "" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "Une copie de votre clef secr?te a ?t? faite dans le fichier?:\n" "\n" @@ -362,21 +379,22 @@ msgstr "Les clefs ont ?t? export?es dans %s." msgid "Only keys of the same procotol may be exported as a collection." msgstr "" -#, c-format +#, fuzzy, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" "La cl? s?lectionn?e sera envoy?e au serveur de\n" "cl? publique (? %s ?).\n" "?tes-vous certain de vouloir distribuer cette cl? ?" -msgid "_Yes" -msgstr "_Oui" +#, fuzzy +msgid "Are you sure you want to distribute this key?" +msgstr "?tes-vous certain de vouloir effacer cette clef ?" -msgid "_No" -msgstr "_Non" +#, fuzzy +msgid "Error sending key(s) to the server." +msgstr "Envoi de clefs au serveur" msgid "The keys have been sent to the server." msgstr "Les cl?s ont ?t? envoy?es au serveur." @@ -2025,7 +2043,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" diff --git a/src/gpabackupop.c b/src/gpabackupop.c index 5ff5921..316dbb0 100644 --- a/src/gpabackupop.c +++ b/src/gpabackupop.c @@ -223,7 +223,7 @@ gpa_backup_operation_do_backup (GpaBackupOperation *op, gchar *filename) "\t\"%s\"\n\n" "This is sensitive information, " "and should be stored carefully\n" - "(for example, on a flash memory " + "(for example, on a USB stick " "kept in a safe place)."), filename); gpa_window_message (message, GPA_OPERATION (op)->window); commit fbbc5ce0e0fe66ff1d58420394b3be610306eafb Author: Werner Koch Date: Mon Dec 8 11:46:01 2014 +0100 Add another OpenPGP card vendor. -- To ease these things we should provide an API to read this list from GnuPG. diff --git a/src/cm-openpgp.c b/src/cm-openpgp.c index b559dcd..cd901e0 100644 --- a/src/cm-openpgp.c +++ b/src/cm-openpgp.c @@ -140,6 +140,8 @@ get_manufacturer (unsigned int no) case 0x002A: return "Magrathea"; + case 0x1337: return "Warsaw Hackerspace"; + case 0xF517: return "FSIJ"; /* 0x0000 and 0xFFFF are defined as test cards per spec, ----------------------------------------------------------------------- Summary of changes: po/de.po | 7 ++++--- po/fr.po | 40 +++++++++++++++++++++++++++++----------- src/cm-openpgp.c | 2 ++ src/gpabackupop.c | 2 +- 4 files changed, 36 insertions(+), 15 deletions(-) hooks/post-receive -- The GNU Privacy Assistant http://git.gnupg.org From cvs at cvs.gnupg.org Tue Dec 9 21:35:47 2014 From: cvs at cvs.gnupg.org (by Vicente Olivert Riera) Date: Tue, 09 Dec 2014 21:35:47 +0100 Subject: [git] Pinentry - branch, master, updated. pinentry-0.9.0-2-g4844653 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The standard pinentry collection". The branch, master has been updated via 484465338ea6f5f12eb1341ca0ef84aa79224ed4 (commit) from 0fbc949f998fa84380b66bc0f589c7fca6232d3c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 484465338ea6f5f12eb1341ca0ef84aa79224ed4 Author: Vicente Olivert Riera Date: Mon Dec 8 16:42:42 2014 +0000 pinentry-qt4: make the accessibility part optional Check if the Qt libraries have support for QT Accessibility before using it. Otherwise it will raise error like these one: main.cpp: In function 'int qt_cmd_handler(pinentry_t)': main.cpp:220:51: error: 'class QAbstractButton' has no member named 'setAccessibleDescription' Signed-off-by: Vicente Olivert Riera diff --git a/qt4/main.cpp b/qt4/main.cpp index 106999e..b2a69f2 100644 --- a/qt4/main.cpp +++ b/qt4/main.cpp @@ -217,8 +217,9 @@ qt_cmd_handler (pinentry_t pe) for ( size_t i = 0 ; i < sizeof buttonLabels / sizeof *buttonLabels ; ++i ) if ( (buttons & buttonLabels[i].button) && !buttonLabels[i].label.isEmpty() ) { box.button( buttonLabels[i].button )->setText( buttonLabels[i].label ); +#ifndef QT_NO_ACCESSIBILITY box.button( buttonLabels[i].button )->setAccessibleDescription ( buttonLabels[i].label ); - +#endif } box.setIconPixmap( icon() ); diff --git a/qt4/pinentryconfirm.cpp b/qt4/pinentryconfirm.cpp index dfbd19f..6b3d545 100644 --- a/qt4/pinentryconfirm.cpp +++ b/qt4/pinentryconfirm.cpp @@ -30,8 +30,10 @@ PinentryConfirm::PinentryConfirm(Icon icon, int timeout, const QString &title, connect(_timer, SIGNAL(timeout()), this, SLOT(slotTimeout())); _timer->start(timeout*1000); } +#ifndef QT_NO_ACCESSIBILITY setAccessibleDescription (desc); setAccessibleName (title); +#endif raiseWindow (this); } diff --git a/qt4/pinentrydialog.cpp b/qt4/pinentrydialog.cpp index 3a6dacc..456f022 100644 --- a/qt4/pinentrydialog.cpp +++ b/qt4/pinentrydialog.cpp @@ -217,7 +217,9 @@ void PinEntryDialog::setDescription( const QString& txt ) { _desc->setVisible( !txt.isEmpty() ); _desc->setText( txt ); +#ifndef QT_NO_ACCESSIBILITY _desc->setAccessibleDescription ( txt ); +#endif _icon->setPixmap( icon() ); setError( QString::null ); } @@ -231,7 +233,9 @@ void PinEntryDialog::setError( const QString& txt ) { if( !txt.isNull() )_icon->setPixmap( icon( QStyle::SP_MessageBoxCritical ) ); _error->setText( txt ); +#ifndef QT_NO_ACCESSIBILITY _error->setAccessibleDescription ( txt ); +#endif _error->setVisible( !txt.isEmpty() ); } @@ -264,14 +268,18 @@ QString PinEntryDialog::prompt() const void PinEntryDialog::setOkText( const QString& txt ) { _ok->setText( txt ); +#ifndef QT_NO_ACCESSIBILITY _ok->setAccessibleDescription ( txt ); +#endif _ok->setVisible( !txt.isEmpty() ); } void PinEntryDialog::setCancelText( const QString& txt ) { _cancel->setText( txt ); +#ifndef QT_NO_ACCESSIBILITY _cancel->setAccessibleDescription ( txt ); +#endif _cancel->setVisible( !txt.isEmpty() ); } @@ -279,7 +287,9 @@ void PinEntryDialog::setQualityBar( const QString& txt ) { if (_have_quality_bar) { _quality_bar_label->setText( txt ); +#ifndef QT_NO_ACCESSIBILITY _quality_bar_label->setAccessibleDescription ( txt ); +#endif } } ----------------------------------------------------------------------- Summary of changes: qt4/main.cpp | 3 ++- qt4/pinentryconfirm.cpp | 2 ++ qt4/pinentrydialog.cpp | 10 ++++++++++ 3 files changed, 14 insertions(+), 1 deletion(-) hooks/post-receive -- The standard pinentry collection http://git.gnupg.org From cvs at cvs.gnupg.org Wed Dec 10 19:29:27 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 10 Dec 2014 19:29:27 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-69-ge8c0ed7 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via e8c0ed779579293b3f4592d9337bc15ee0fc3fdd (commit) via 6d5f12834124ba5ee0e54261531abf95c36c116c (commit) from 5bf93f4ea7a11381dd256b5fd4e5913366828265 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit e8c0ed779579293b3f4592d9337bc15ee0fc3fdd Author: Werner Koch Date: Mon Dec 8 17:13:11 2014 +0100 dirmngr: Improve dead host detection. * dirmngr/ks-engine-hkp.c (handle_send_request_error): Mark host dead also for 2 other error messages. diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c index 0a86b5d..bd98eed 100644 --- a/dirmngr/ks-engine-hkp.c +++ b/dirmngr/ks-engine-hkp.c @@ -1075,6 +1075,8 @@ handle_send_request_error (gpg_error_t err, const char *request, { case GPG_ERR_ECONNREFUSED: case GPG_ERR_ENETUNREACH: + case GPG_ERR_UNKNOWN_HOST: + case GPG_ERR_NETWORK: if (mark_host_dead (request) && *tries_left) retry = 1; break; commit 6d5f12834124ba5ee0e54261531abf95c36c116c Author: Werner Koch Date: Mon Dec 8 17:12:23 2014 +0100 http: Improve diagnostic messages. * common/http.c (send_request): Print TLS alert info (connect_server): Detect bogus DNS entry. -- 1. Prints the TLS alert description. 2. Detect case where the DNS returns an IP address but the server is not reachable at this address. This may happen for a server which is reachable only at IPv6 but but the local machine has no full IPv6 configuration. diff --git a/common/http.c b/common/http.c index f129010..50c0692 100644 --- a/common/http.c +++ b/common/http.c @@ -1574,7 +1574,21 @@ send_request (http_t hd, const char *httphost, const char *auth, while (rc == GNUTLS_E_INTERRUPTED || rc == GNUTLS_E_AGAIN); if (rc < 0) { - log_info ("TLS handshake failed: %s\n", gnutls_strerror (rc)); + if (rc == GNUTLS_E_WARNING_ALERT_RECEIVED + || rc == GNUTLS_E_FATAL_ALERT_RECEIVED) + { + gnutls_alert_description_t alertno; + const char *alertstr; + + alertno = gnutls_alert_get (hd->session->tls_session); + alertstr = gnutls_alert_get_name (alertno); + log_info ("TLS handshake failed: %s (alert %d)\n", + alertstr, (int)alertno); + if (alertno == GNUTLS_A_UNRECOGNIZED_NAME && server) + log_info (" (sent server name '%s')\n", server); + } + else + log_info ("TLS handshake failed: %s\n", gnutls_strerror (rc)); xfree (proxy_authstr); return gpg_err_make (default_errsource, GPG_ERR_NETWORK); } @@ -2115,6 +2129,7 @@ connect_server (const char *server, unsigned short port, int sock = -1; int srvcount = 0; int hostfound = 0; + int anyhostaddr = 0; int srv, connected; int last_errno = 0; struct srventry *serverlist = NULL; @@ -2221,6 +2236,7 @@ connect_server (const char *server, unsigned short port, return -1; } + anyhostaddr = 1; if (my_connect (sock, ai->ai_addr, ai->ai_addrlen)) last_errno = errno; else @@ -2274,6 +2290,7 @@ connect_server (const char *server, unsigned short port, /* Try all A records until one responds. */ for (i = 0; host->h_addr_list[i] && !connected; i++) { + anyhostaddr = 1; memcpy (&addr.sin_addr, host->h_addr_list[i], host->h_length); if (my_connect (sock, (struct sockaddr *) &addr, sizeof (addr))) last_errno = errno; @@ -2290,17 +2307,23 @@ connect_server (const char *server, unsigned short port, if (!connected) { + if (!hostfound) + log_error ("can't connect to '%s': %s\n", + server, "host not found"); + else if (!anyhostaddr) + log_error ("can't connect to '%s': %s\n", + server, "no IP address for host"); + else + { #ifdef HAVE_W32_SYSTEM - log_error ("can't connect to '%s': %s%sec=%d\n", - server, - hostfound? "":"host not found", - hostfound? "":" - ", (int)WSAGetLastError()); + log_error ("can't connect to '%s': ec=%d\n", + server, (int)WSAGetLastError()); #else - log_error ("can't connect to '%s': %s\n", - server, - hostfound? strerror (last_errno):"host not found"); + log_error ("can't connect to '%s': %s\n", + server, strerror (last_errno)); #endif - if (!hostfound) + } + if (!hostfound || (hostfound && !anyhostaddr)) *r_host_not_found = 1; if (sock != -1) sock_close (sock); ----------------------------------------------------------------------- Summary of changes: common/http.c | 41 ++++++++++++++++++++++++++++++++--------- dirmngr/ks-engine-hkp.c | 2 ++ 2 files changed, 34 insertions(+), 9 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Thu Dec 11 12:56:58 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 11 Dec 2014 12:56:58 +0100 Subject: [git] GPGME - branch, master, updated. gpgme-1.5.2-4-ga813c09 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "GnuPG Made Easy". The branch, master has been updated via a813c09cc792bfeed945f8573e4fd36da99a88c8 (commit) via 37d927a9706fff6d8ef8d45073984ea2f92afb31 (commit) from 05258d427513a933f01d4df13aca834d797f91e7 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit a813c09cc792bfeed945f8573e4fd36da99a88c8 Author: Werner Koch Date: Thu Dec 11 12:53:28 2014 +0100 Post release updates. -- diff --git a/Makefile.am b/Makefile.am index 28f9eca..cb22a91 100644 --- a/Makefile.am +++ b/Makefile.am @@ -20,7 +20,6 @@ ## Process this file with automake to produce Makefile.in ACLOCAL_AMFLAGS = -I m4 -AUTOMAKE_OPTIONS = dist-bzip2 DISTCHECK_CONFIGURE_FLAGS = diff --git a/NEWS b/NEWS index a429101..399c1e0 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,10 @@ +Noteworthy changes in version 1.6.0 (unreleased) [C__/A__/R0] +------------------------------------------------------------- + + * Interface changes relative to the 1.5.3 release: + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + + Noteworthy changes in version 1.5.3 (2014-12-11) [C24/A13/R2] ------------------------------------------------------------- diff --git a/configure.ac b/configure.ac index 70b846f..4660122 100644 --- a/configure.ac +++ b/configure.ac @@ -28,8 +28,8 @@ min_automake_version="1.11" # commit and push so that the git magic is able to work. See below # for the LT versions. m4_define(mym4_version_major, [1]) -m4_define(mym4_version_minor, [5]) -m4_define(mym4_version_micro, [3]) +m4_define(mym4_version_minor, [6]) +m4_define(mym4_version_micro, [0]) # Below is m4 magic to extract and compute the revision number, the # decimalized short revision number, a beta version string, and a flag @@ -79,7 +79,7 @@ AC_CONFIG_SRCDIR(src/gpgme.h.in) AC_CONFIG_HEADER(config.h) # Note: For automake 1.13 add the option # serial-tests -AM_INIT_AUTOMAKE +AM_INIT_AUTOMAKE([dist-bzip2 no-dist-gzip]) AM_MAINTAINER_MODE AC_CANONICAL_HOST AM_SILENT_RULES commit 37d927a9706fff6d8ef8d45073984ea2f92afb31 Author: Werner Koch Date: Thu Dec 11 12:07:49 2014 +0100 Release 1.5.3. * configure.ac: Set LT version to C24/A13/R2. diff --git a/NEWS b/NEWS index 65f0283..a429101 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,9 @@ -Noteworthy changes in version 1.5.3 (unreleased) [C24/A13/R_] +Noteworthy changes in version 1.5.3 (2014-12-11) [C24/A13/R2] ------------------------------------------------------------- + * The export key functions do now return an error if used with the + latest GnuPG version. + Noteworthy changes in version 1.5.2 (2014-11-21) [C24/A13/R1] ------------------------------------------------------------- diff --git a/configure.ac b/configure.ac index 7bef516..70b846f 100644 --- a/configure.ac +++ b/configure.ac @@ -59,7 +59,7 @@ LIBGPGME_LT_CURRENT=24 # Subtract 2 from this value if you want to make the LFS transition an # ABI break. [Note to self: Remove this comment with the next regular break.] LIBGPGME_LT_AGE=13 -LIBGPGME_LT_REVISION=1 +LIBGPGME_LT_REVISION=2 # If the API is changed in an incompatible way: increment the next counter. GPGME_CONFIG_API_VERSION=1 ----------------------------------------------------------------------- Summary of changes: Makefile.am | 1 - NEWS | 12 +++++++++++- configure.ac | 8 ++++---- 3 files changed, 15 insertions(+), 6 deletions(-) hooks/post-receive -- GnuPG Made Easy http://git.gnupg.org From cvs at cvs.gnupg.org Thu Dec 11 13:21:09 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 11 Dec 2014 13:21:09 +0100 Subject: [git] Assuan - branch, master, updated. libassuan-2.1.2-8-g61e24ad Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPC library used by GnuPG". The branch, master has been updated via 61e24ad79cb4477b32542399e48b56b3115ae1e7 (commit) via 261498de39a10a00d5035f2481d33319c983875f (commit) from 0fce017100c5896cf9dc1fcbd4a39053651c3910 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 61e24ad79cb4477b32542399e48b56b3115ae1e7 Author: Werner Koch Date: Thu Dec 11 13:13:53 2014 +0100 Post release updates -- diff --git a/NEWS b/NEWS index 3d74644..1f6f992 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,7 @@ +Noteworthy changes in version 2.2.1 (unreleased) [C5/A5/R_] +------------------------------------------------ + + Noteworthy changes in version 2.2.0 (2014-12-11) [C5/A5/R0] ------------------------------------------------ diff --git a/configure.ac b/configure.ac index 5cdf883..dffc18d 100644 --- a/configure.ac +++ b/configure.ac @@ -31,7 +31,7 @@ min_automake_version="1.10" m4_define([mym4_package],[libassuan]) m4_define([mym4_major], [2]) m4_define([mym4_minor], [2]) -m4_define([mym4_micro], [0]) +m4_define([mym4_micro], [1]) # To start a new development series, i.e a new major or minor number # you need to mark an arbitrary commit before the first beta release diff --git a/doc/Makefile.am b/doc/Makefile.am index 6229ddc..fc4e97d 100644 --- a/doc/Makefile.am +++ b/doc/Makefile.am @@ -28,8 +28,7 @@ assuan_TEXINFOS = lgpl.texi gpl.texi online: assuan.html assuan.pdf set -e; \ echo "Uploading current manuals to www.gnupg.org ..."; \ - user=werner ; \ + user=werner ; webhost="ftp.gnupg.org"; \ (cd assuan.html && rsync -vr --exclude='.svn' . \ - $${user}@cvs.gnupg.org:webspace/manuals/assuan/ ); \ - rsync -v assuan.pdf $${user}@cvs.gnupg.org:webspace/manuals/ - + $${user}@$${webhost}:webspace/manuals/assuan/ ); \ + rsync -v assuan.pdf $${user}@$${webhost}:webspace/manuals/ commit 261498de39a10a00d5035f2481d33319c983875f Author: Werner Koch Date: Thu Dec 11 13:10:24 2014 +0100 Release 2.2.0 * configure.ac: Set LT version to C5/A5/R0. (AM_INIT_AUTOMAKE): Add options. * Makefile.am (AUTOMAKE_OPTIONS): Remove. diff --git a/Makefile.am b/Makefile.am index 15b1533..ad8efca 100644 --- a/Makefile.am +++ b/Makefile.am @@ -19,7 +19,6 @@ ACLOCAL_AMFLAGS = -I m4 -AUTOMAKE_OPTIONS = dist-bzip2 no-dist-gzip # (A suitable gitlog-to-changelog script can be found in GnuPG master.) GITLOG_TO_CHANGELOG=gitlog-to-changelog diff --git a/NEWS b/NEWS index a2611db..3d74644 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,8 @@ -Noteworthy changes in version 2.1.4 (unreleased) [C4/A4/R_] +Noteworthy changes in version 2.2.0 (2014-12-11) [C5/A5/R0] ------------------------------------------------ + * Added support for socket redirection. + * Interface changes relative to the 2.1.3 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ assuan_sock_set_sockaddr_un NEW. diff --git a/configure.ac b/configure.ac index 2f09e98..5cdf883 100644 --- a/configure.ac +++ b/configure.ac @@ -30,8 +30,8 @@ min_automake_version="1.10" # for the LT versions. m4_define([mym4_package],[libassuan]) m4_define([mym4_major], [2]) -m4_define([mym4_minor], [1]) -m4_define([mym4_micro], [4]) +m4_define([mym4_minor], [2]) +m4_define([mym4_micro], [0]) # To start a new development series, i.e a new major or minor number # you need to mark an arbitrary commit before the first beta release @@ -58,9 +58,9 @@ AC_INIT([mym4_package],[mym4_version], [http://bugs.gnupg.org]) # (Interfaces added: AGE++) # (Interfaces removed/changed: AGE=0) # -LIBASSUAN_LT_CURRENT=4 -LIBASSUAN_LT_AGE=4 -LIBASSUAN_LT_REVISION=3 +LIBASSUAN_LT_CURRENT=5 +LIBASSUAN_LT_AGE=5 +LIBASSUAN_LT_REVISION=0 # If the API is changed in an incompatible way: increment the next counter. LIBASSUAN_CONFIG_API_VERSION=2 @@ -74,7 +74,7 @@ PACKAGE=$PACKAGE_NAME VERSION=$PACKAGE_VERSION AC_CONFIG_AUX_DIR([build-aux]) -AM_INIT_AUTOMAKE +AM_INIT_AUTOMAKE([dist-bzip2 no-dist-gzip]) AM_MAINTAINER_MODE AC_CONFIG_SRCDIR(src/assuan.h.in) AC_CONFIG_MACRO_DIR(m4) ----------------------------------------------------------------------- Summary of changes: Makefile.am | 1 - NEWS | 8 +++++++- configure.ac | 12 ++++++------ doc/Makefile.am | 7 +++---- 4 files changed, 16 insertions(+), 12 deletions(-) hooks/post-receive -- IPC library used by GnuPG http://git.gnupg.org From cvs at cvs.gnupg.org Thu Dec 11 15:15:21 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Thu, 11 Dec 2014 15:15:21 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-70-g1d8ebe4 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 1d8ebe4d54eef37da65e7bd5d7386bc04f344447 (commit) from e8c0ed779579293b3f4592d9337bc15ee0fc3fdd (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1d8ebe4d54eef37da65e7bd5d7386bc04f344447 Author: Werner Koch Date: Thu Dec 11 15:14:44 2014 +0100 build: Replace deprecated autconf macro. * m4/intl.m4: s/AM_PROG_MKDIR_P/AC_PROG_MKDIR_P/ * m4/po.m4: Ditto. -- In preparation of moving to automake 1.14. GnuPG-bug-id: 1776 diff --git a/m4/intl.m4 b/m4/intl.m4 index dcefb11..3906a17 100644 --- a/m4/intl.m4 +++ b/m4/intl.m4 @@ -25,7 +25,7 @@ dnl USE_INCLUDED_LIBINTL, BUILD_INCLUDED_LIBINTL. AC_DEFUN([AM_INTL_SUBDIR], [ AC_REQUIRE([AC_PROG_INSTALL])dnl - AC_REQUIRE([AM_PROG_MKDIR_P])dnl defined by automake + AC_REQUIRE([AC_PROG_MKDIR_P])dnl AC_REQUIRE([AC_PROG_CC])dnl AC_REQUIRE([AC_CANONICAL_HOST])dnl AC_REQUIRE([gt_GLIBC2])dnl diff --git a/m4/po.m4 b/m4/po.m4 index 0734762..f7c9c06 100644 --- a/m4/po.m4 +++ b/m4/po.m4 @@ -24,7 +24,7 @@ AC_DEFUN([AM_PO_SUBDIRS], [ AC_REQUIRE([AC_PROG_MAKE_SET])dnl AC_REQUIRE([AC_PROG_INSTALL])dnl - AC_REQUIRE([AM_PROG_MKDIR_P])dnl defined by automake + AC_REQUIRE([AC_PROG_MKDIR_P])dnl AC_REQUIRE([AM_NLS])dnl dnl Release version of the gettext macros. This is used to ensure that ----------------------------------------------------------------------- Summary of changes: m4/intl.m4 | 2 +- m4/po.m4 | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Dec 12 09:42:09 2014 From: cvs at cvs.gnupg.org (by NIIBE Yutaka) Date: Fri, 12 Dec 2014 09:42:09 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-1-4, updated. gnupg-1.4.18-20-gda66ad5 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-1-4 has been updated via da66ad5bba4215b9ddd0cb927a89aa75355632aa (commit) from c935c73f8262dcce7d5ac823ba4a6a2f563cc3eb (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit da66ad5bba4215b9ddd0cb927a89aa75355632aa Author: NIIBE Yutaka Date: Fri Dec 12 17:41:56 2014 +0900 gpg: release DEK soon after its use. * g10/keygen.c (generate_subkeypair): Release DEK soon. -- This fixes the out_of_core error in the test case of adding RSA-4096 subkey to RSA-4096 primary key with configuration: s2k-cipher-algo S10 Debian-bug-id: 772780 diff --git a/g10/keygen.c b/g10/keygen.c index 9020908..5af0043 100644 --- a/g10/keygen.c +++ b/g10/keygen.c @@ -3447,6 +3447,7 @@ generate_subkeypair( KBNODE pub_keyblock, KBNODE sec_keyblock ) rc = do_create (algo, nbits, pub_keyblock, sec_keyblock, dek, s2k, &sub_sk, timestamp, expire, 1 ); + xfree( dek ); if (!rc) rc = write_keybinding (pub_keyblock, pub_keyblock, pri_sk, sub_sk, use, timestamp); @@ -3463,7 +3464,6 @@ generate_subkeypair( KBNODE pub_keyblock, KBNODE sec_keyblock ) if( rc ) log_error(_("Key generation failed: %s\n"), g10_errstr(rc) ); xfree( passphrase ); - xfree( dek ); xfree( s2k ); /* release the copy of the (now unprotected) secret keys */ if( pri_sk ) ----------------------------------------------------------------------- Summary of changes: g10/keygen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Dec 12 09:48:10 2014 From: cvs at cvs.gnupg.org (by NIIBE Yutaka) Date: Fri, 12 Dec 2014 09:48:10 +0100 Subject: [git] GnuPG - branch, STABLE-BRANCH-2-0, updated. gnupg-2.0.26-31-g4f0d526 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, STABLE-BRANCH-2-0 has been updated via 4f0d526b7df871318508f8c3d2f57e7069c47e6f (commit) from 4e03e2757521ddc39d627712937227b84bf72275 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 4f0d526b7df871318508f8c3d2f57e7069c47e6f Author: NIIBE Yutaka Date: Fri Dec 12 17:41:56 2014 +0900 gpg: release DEK soon after its use. * g10/keygen.c (generate_subkeypair): Release DEK soon. -- This fixes the out_of_core error in the test case of adding RSA-4096 subkey to RSA-4096 primary key with configuration: s2k-cipher-algo S10 Debian-bug-id: 772780 Cherry-picked da66ad5bba4215b9ddd0cb927a89aa75355632aa from STABLE-BRANCH-1-4 branch. diff --git a/g10/keygen.c b/g10/keygen.c index 17fde7f..10cca7d 100644 --- a/g10/keygen.c +++ b/g10/keygen.c @@ -3839,6 +3839,7 @@ generate_subkeypair (KBNODE pub_keyblock, KBNODE sec_keyblock) if (!rc) rc = do_create (algo, nbits, pub_keyblock, sec_keyblock, dek, s2k, &sub_sk, cur_time, expire, 1 ); + xfree (dek); if (!rc) rc = write_keybinding (pub_keyblock, pub_keyblock, pri_sk, sub_sk, use, cur_time); @@ -3855,7 +3856,6 @@ generate_subkeypair (KBNODE pub_keyblock, KBNODE sec_keyblock) if (rc) log_error (_("Key generation failed: %s\n"), g10_errstr(rc) ); xfree (passphrase); - xfree (dek); xfree (s2k); /* Release the copy of the (now unprotected) secret keys. */ if (pri_sk) ----------------------------------------------------------------------- Summary of changes: g10/keygen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Dec 12 11:11:00 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 12 Dec 2014 11:11:00 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-71-g1938150 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 193815030d20716d9a97850013ac3cc8749022c9 (commit) from 1d8ebe4d54eef37da65e7bd5d7386bc04f344447 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 193815030d20716d9a97850013ac3cc8749022c9 Author: Werner Koch Date: Fri Dec 12 10:41:25 2014 +0100 gpg: Fix possible read of unallocated memory * g10/parse-packet.c (can_handle_critical): Check content length before calling can_handle_critical_notation. -- The problem was found by Jan Bee and gniibe proposed the used fix. Thanks. This bug can't be exploited: Only if the announced length of the notation is 21 or 32 a memcmp against fixed strings using that length would be done. The compared data is followed by the actual signature and thus it is highly likely that not even read of unallocated memory will happen. Nevertheless such a bug needs to be fixed. Signed-off-by: Werner Koch diff --git a/g10/parse-packet.c b/g10/parse-packet.c index 58cb1c4..1de7307 100644 --- a/g10/parse-packet.c +++ b/g10/parse-packet.c @@ -1387,10 +1387,12 @@ can_handle_critical (const byte * buffer, size_t n, int type) { case SIGSUBPKT_NOTATION: if (n >= 8) - return can_handle_critical_notation (buffer + 8, - (buffer[4] << 8) | buffer[5]); - else - return 0; + { + size_t notation_len = ((buffer[4] << 8) | buffer[5]); + if (n - 8 >= notation_len) + return can_handle_critical_notation (buffer + 8, notation_len); + } + return 0; case SIGSUBPKT_SIGNATURE: case SIGSUBPKT_SIG_CREATED: case SIGSUBPKT_SIG_EXPIRE: ----------------------------------------------------------------------- Summary of changes: g10/parse-packet.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Dec 12 11:12:41 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 12 Dec 2014 11:12:41 +0100 Subject: [git] GPA - branch, master, updated. gpa-0.9.7-1-g9febd01 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Assistant". The branch, master has been updated via 9febd013fa1e6ad56204304b0193001f6b5fc0be (commit) via 8ce94803460b165f1291075bf9560010d790bb18 (commit) via 566c0641018ac60102a66abc2201815c0d994a4f (commit) via 69525610df82a88becf11d3952506075815ec98d (commit) from 404f5d7396ac83d78fade4cfadd3df96ae44c5fa (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 9febd013fa1e6ad56204304b0193001f6b5fc0be Author: Werner Koch Date: Fri Dec 12 11:13:07 2014 +0100 Post release updates -- diff --git a/NEWS b/NEWS index cd99a9a..6d05352 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,6 @@ +Noteworthy changes in version 0.9.8 (unreleased) +------------------------------------------------ + Noteworthy changes in version 0.9.7 (2014-12-12) ------------------------------------------------ diff --git a/configure.ac b/configure.ac index 4c35e71..afd8f17 100644 --- a/configure.ac +++ b/configure.ac @@ -28,7 +28,7 @@ min_automake_version="1.10" # (git tag -s gpa-1.n.m) and run "./autogen.sh --force". Please # bump the version number immediately *after* the release and do # another commit and push so that the git magic is able to work. -m4_define([mym4_version], [0.9.7]) +m4_define([mym4_version], [0.9.8]) # Below is m4 magic to extract and compute the git revision number, # the decimalized short revision number, a beta version string and a commit 8ce94803460b165f1291075bf9560010d790bb18 Author: Werner Koch Date: Fri Dec 12 08:47:48 2014 +0100 Release 0.9.7 diff --git a/NEWS b/NEWS index a66d0cc..cd99a9a 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,8 @@ -Noteworthy changes in version 0.9.7 (unreleased) +Noteworthy changes in version 0.9.7 (2014-12-12) ------------------------------------------------ + * Support sending keys for GnuPG 2.1. + Noteworthy changes in version 0.9.6 (2014-11-21) ------------------------------------------------ commit 566c0641018ac60102a66abc2201815c0d994a4f Author: Werner Koch Date: Fri Dec 12 08:45:47 2014 +0100 po: Auto update. -- diff --git a/po/ar.po b/po/ar.po index f6f85c4..bd80f9c 100644 --- a/po/ar.po +++ b/po/ar.po @@ -157,6 +157,21 @@ msgstr "????????????" msgid "Expert" msgstr "????????" +msgid "A keyserver has not been configured." +msgstr "" + +msgid "Configure backend to use a keyserver?" +msgstr "" + +msgid "_Yes" +msgstr "_??????" + +msgid "_No" +msgstr "_????" + +msgid "Configuring the backend to use a keyserver failed" +msgstr "" + msgid "days" msgstr "??????????" @@ -336,14 +351,14 @@ msgstr "/??????????/?????????????? ????_??????????..." msgid "Configure the backend programs" msgstr "" -#, c-format +#, fuzzy, c-format msgid "" "A copy of your secret key has been made to the file:\n" "\n" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "?????????? ???????? ???? ???????????? ?????????? ???? ??????????:\n" "\n" @@ -378,21 +393,22 @@ msgstr "???? ?????????? ???????????????? ?????? %s." msgid "Only keys of the same procotol may be exported as a collection." msgstr "" -#, c-format +#, fuzzy, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" "?????????????? ?????????????? ???????????? ??????\n" "?????????? ???????????? ???????? (\"%s\").\n" "???????????? ?????? ???????? ?????????? ?????? ????????????????" -msgid "_Yes" -msgstr "_??????" +#, fuzzy +msgid "Are you sure you want to distribute this key?" +msgstr "???????????? ?????? ???????? ?????? ?????? ????????????????" -msgid "_No" -msgstr "_????" +#, fuzzy +msgid "Error sending key(s) to the server." +msgstr "/????_?????? ???????????????? ??????????????..." msgid "The keys have been sent to the server." msgstr "???????????? ???????????????? ?????? ??????????????." @@ -2010,7 +2026,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" diff --git a/po/cs.po b/po/cs.po index fd6cade..86eb916 100644 --- a/po/cs.po +++ b/po/cs.po @@ -146,6 +146,23 @@ msgstr "Pokro??il??" msgid "Expert" msgstr "Expert" +msgid "A keyserver has not been configured." +msgstr "" + +#, fuzzy +msgid "Configure backend to use a keyserver?" +msgstr "Nastavit programy backednu" + +msgid "_Yes" +msgstr "_Ano" + +msgid "_No" +msgstr "_Ne" + +#, fuzzy +msgid "Configuring the backend to use a keyserver failed" +msgstr "Nastavit programy backednu" + msgid "days" msgstr "dny" @@ -311,14 +328,14 @@ msgstr "Na_staven?? backendu" msgid "Configure the backend programs" msgstr "Nastavit programy backednu" -#, c-format +#, fuzzy, c-format msgid "" "A copy of your secret key has been made to the file:\n" "\n" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "Kopie va??eho soukrom??ho kl????e byla ulo??ena v souboru:\n" "\n" @@ -353,21 +370,22 @@ msgstr "Kl????e byly exportov??ny do %s." msgid "Only keys of the same procotol may be exported as a collection." msgstr "Pouze kl????e stejn??ho protokolu sm??j?? b??t exportov??ny jako kolekce." -#, c-format +#, fuzzy, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" "Vybran?? kl???? bude odesl??n na server kl??????\n" "(\"%s\").\n" "Ur??it?? chcete ??????it tento kl?????" -msgid "_Yes" -msgstr "_Ano" +#, fuzzy +msgid "Are you sure you want to distribute this key?" +msgstr "Jste si jist??, ??e chcete smazat tento kl?????" -msgid "_No" -msgstr "_Ne" +#, fuzzy +msgid "Error sending key(s) to the server." +msgstr "Odeslat kl????e na server..." msgid "The keys have been sent to the server." msgstr "Kl????e byly odesl??ny na server." @@ -2007,6 +2025,7 @@ msgstr "" "Pokud budete pokra??ovat, budete vyzv??n??, abyste vlo??ili sou??asnou hodnotu " "PIN, pot?? novou hodnotu Reset k??du a tu na dal????m ????dku zopakovali." +#, fuzzy msgid "" "Reseting the PIN or the Reset Code\n" "\n" @@ -2016,7 +2035,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" diff --git a/po/es.po b/po/es.po index 1dacda5..450643a 100644 --- a/po/es.po +++ b/po/es.po @@ -160,6 +160,21 @@ msgstr "Avanzado" msgid "Expert" msgstr "Experto" +msgid "A keyserver has not been configured." +msgstr "" + +msgid "Configure backend to use a keyserver?" +msgstr "" + +msgid "_Yes" +msgstr "_S??" + +msgid "_No" +msgstr "_No" + +msgid "Configuring the backend to use a keyserver failed" +msgstr "" + msgid "days" msgstr "d??as" @@ -339,14 +354,14 @@ msgstr "/Editar/Pr_eferencias del motor..." msgid "Configure the backend programs" msgstr "" -#, c-format +#, fuzzy, c-format msgid "" "A copy of your secret key has been made to the file:\n" "\n" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "Se ha copiado su clave secreta al archivo:\n" "\n" @@ -381,21 +396,22 @@ msgstr "Las claves se han exportado a %s." msgid "Only keys of the same procotol may be exported as a collection." msgstr "" -#, c-format +#, fuzzy, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" "La clave seleccionada se enviar?? a un servidor de\n" "claves p??blico (\"%s\").\n" "??Est?? seguro de que quiere distribuir esta clave?" -msgid "_Yes" -msgstr "_S??" +#, fuzzy +msgid "Are you sure you want to distribute this key?" +msgstr "Seguro que desea borrar esta clave?" -msgid "_No" -msgstr "_No" +#, fuzzy +msgid "Error sending key(s) to the server." +msgstr "E_nviar claves al servidor" msgid "The keys have been sent to the server." msgstr "Las claves se han enviado al servidor." @@ -2047,7 +2063,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" diff --git a/po/ja.po b/po/ja.po index c83a838..e638474 100644 --- a/po/ja.po +++ b/po/ja.po @@ -166,6 +166,22 @@ msgstr "" msgid "Expert" msgstr "????????????" +#, fuzzy +msgid "A keyserver has not been configured." +msgstr "????????????????????????????" + +msgid "Configure backend to use a keyserver?" +msgstr "" + +msgid "_Yes" +msgstr "???? (_Y)" + +msgid "_No" +msgstr "?????? (_N)" + +msgid "Configuring the backend to use a keyserver failed" +msgstr "" + msgid "days" msgstr "??" @@ -356,14 +372,14 @@ msgstr "/ msgid "Configure the backend programs" msgstr "" -#, c-format +#, fuzzy, c-format msgid "" "A copy of your secret key has been made to the file:\n" "\n" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "????????????????\n" "\n" @@ -398,21 +414,22 @@ msgstr " msgid "Only keys of the same procotol may be exported as a collection." msgstr "" -#, c-format +#, fuzzy, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" "????????????????????????????????????????????\n" "(??????: \"%s\")\n" "?????????????????????????????????????????" -msgid "_Yes" -msgstr "???? (_Y)" +#, fuzzy +msgid "Are you sure you want to distribute this key?" +msgstr "???????????????????????????" -msgid "_No" -msgstr "?????? (_N)" +#, fuzzy +msgid "Error sending key(s) to the server." +msgstr "/????????????????... (_N)" msgid "The keys have been sent to the server." msgstr "??????????????????????????" @@ -2044,7 +2061,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" @@ -3249,9 +3266,6 @@ msgstr "" #~ msgid "No valid public key specified" #~ msgstr "????????????????????????????????" -#~ msgid "Keyserver not specified" -#~ msgstr "????????????????????????????" - #~ msgid "No valid secret key specified" #~ msgstr "????????????????????????????????" diff --git a/po/nl.po b/po/nl.po index 641498d..9e4ef5b 100644 --- a/po/nl.po +++ b/po/nl.po @@ -163,6 +163,21 @@ msgstr "" msgid "Expert" msgstr "Exporteer" +msgid "A keyserver has not been configured." +msgstr "" + +msgid "Configure backend to use a keyserver?" +msgstr "" + +msgid "_Yes" +msgstr "_Ja" + +msgid "_No" +msgstr "_Nee" + +msgid "Configuring the backend to use a keyserver failed" +msgstr "" + msgid "days" msgstr "dagen" @@ -353,14 +368,14 @@ msgstr "/Bewerk/Voork_euren..." msgid "Configure the backend programs" msgstr "" -#, c-format +#, fuzzy, c-format msgid "" "A copy of your secret key has been made to the file:\n" "\n" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "Een kopie van uw geheime sleutel is gemaakt naar het bestand:\n" "\n" @@ -395,21 +410,22 @@ msgstr "De sleutels werden naar %s ge msgid "Only keys of the same procotol may be exported as a collection." msgstr "" -#, c-format +#, fuzzy, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" "De geselecteerde sleutel zal naar een publieke\n" "keyserver gestuurd worden (\"%s\").\n" "Bent u zeker dat u deze sleutel wilt verspreiden?" -msgid "_Yes" -msgstr "_Ja" +#, fuzzy +msgid "Are you sure you want to distribute this key?" +msgstr "Weet u zeker dat je deze sleutel wilt verwijderen?" -msgid "_No" -msgstr "_Nee" +#, fuzzy +msgid "Error sending key(s) to the server." +msgstr "Stel keyserver in" msgid "The keys have been sent to the server." msgstr "De sleutels werden naar de server gestuurd." @@ -2051,7 +2067,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" diff --git a/po/pl.po b/po/pl.po index 09a5859..fe3a4cf 100644 --- a/po/pl.po +++ b/po/pl.po @@ -160,6 +160,21 @@ msgstr "" msgid "Expert" msgstr "Eksport" +msgid "A keyserver has not been configured." +msgstr "" + +msgid "Configure backend to use a keyserver?" +msgstr "" + +msgid "_Yes" +msgstr "_Tak" + +msgid "_No" +msgstr "_Nie" + +msgid "Configuring the backend to use a keyserver failed" +msgstr "" + msgid "days" msgstr "dni" @@ -349,14 +364,14 @@ msgstr "/Edycja/_Ustawienia..." msgid "Configure the backend programs" msgstr "" -#, c-format +#, fuzzy, c-format msgid "" "A copy of your secret key has been made to the file:\n" "\n" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "Sporz??dzono kopi?? twojego tajnego klucza do pliku:\n" "\n" @@ -392,21 +407,22 @@ msgstr "Klucze zosta??y wyeksportowane do %s." msgid "Only keys of the same procotol may be exported as a collection." msgstr "" -#, c-format +#, fuzzy, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" "Wybrany klucz zostanie wys??any do publicznego\n" "serwera kluczy (\"%s\").\n" "Na pewno chcesz rozpowszechni?? ten klucz?" -msgid "_Yes" -msgstr "_Tak" +#, fuzzy +msgid "Are you sure you want to distribute this key?" +msgstr "Jeste?? pewna/pewien ??e chcesz usun???? ten klucz?" -msgid "_No" -msgstr "_Nie" +#, fuzzy +msgid "Error sending key(s) to the server." +msgstr "/W_y??lij klucze na serwer..." msgid "The keys have been sent to the server." msgstr "Klucze zosta??y wys??ane na serwer." @@ -2046,7 +2062,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" diff --git a/po/pt_BR.po b/po/pt_BR.po index 334fc1e..4dad738 100644 --- a/po/pt_BR.po +++ b/po/pt_BR.po @@ -162,6 +162,21 @@ msgstr "" msgid "Expert" msgstr "Exportar" +msgid "A keyserver has not been configured." +msgstr "" + +msgid "Configure backend to use a keyserver?" +msgstr "" + +msgid "_Yes" +msgstr "_Sim" + +msgid "_No" +msgstr "_N?o" + +msgid "Configuring the backend to use a keyserver failed" +msgstr "" + msgid "days" msgstr "dias" @@ -352,14 +367,14 @@ msgstr "/Editar/Pr_efer msgid "Configure the backend programs" msgstr "" -#, c-format +#, fuzzy, c-format msgid "" "A copy of your secret key has been made to the file:\n" "\n" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "Uma c?pia de sua chave secreta foi feita para o arquivo:\n" "\n" @@ -398,16 +413,17 @@ msgstr "" #, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" -msgid "_Yes" -msgstr "_Sim" +#, fuzzy +msgid "Are you sure you want to distribute this key?" +msgstr "Voc? est? certo que deseja apagar esta chave?" -msgid "_No" -msgstr "_N?o" +#, fuzzy +msgid "Error sending key(s) to the server." +msgstr "_Servidor de chave:" msgid "The keys have been sent to the server." msgstr "" @@ -2057,7 +2073,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" diff --git a/po/ru.po b/po/ru.po index d65db09..67515f4 100644 --- a/po/ru.po +++ b/po/ru.po @@ -158,6 +158,21 @@ msgstr "??????????????????????" msgid "Expert" msgstr "????????????????????" +msgid "A keyserver has not been configured." +msgstr "" + +msgid "Configure backend to use a keyserver?" +msgstr "" + +msgid "_Yes" +msgstr "????" + +msgid "_No" +msgstr "??????" + +msgid "Configuring the backend to use a keyserver failed" +msgstr "" + msgid "days" msgstr "????????" @@ -337,14 +352,14 @@ msgstr "/????????????/?????????????????? _????????. ??????????????????..." msgid "Configure the backend programs" msgstr "" -#, c-format +#, fuzzy, c-format msgid "" "A copy of your secret key has been made to the file:\n" "\n" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "?????????? ???????????? ?????????????????? ?????????? ?????????????????? ?? ????????:\n" "\n" @@ -379,21 +394,22 @@ msgstr "?????????? ???????????????????????????? ?? %s." msgid "Only keys of the same procotol may be exported as a collection." msgstr "" -#, c-format +#, fuzzy, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" "?????????????????? ???????? ?????????? ?????????????????? ???? ???????????????? ???????????? ???????????????? ????????????\n" "(\"%s\").\n" "?????????????????????????? ???????????? ???????????????????????????? ???????????? ?????????" -msgid "_Yes" -msgstr "????" +#, fuzzy +msgid "Are you sure you want to distribute this key?" +msgstr "???? ?????????????????????????? ???????????? ?????????????? ???????? ?????????" -msgid "_No" -msgstr "??????" +#, fuzzy +msgid "Error sending key(s) to the server." +msgstr "/?????????????????? ???? ????????????..." msgid "The keys have been sent to the server." msgstr "?????????? ?????????????? ???????????????????? ???? ????????????." @@ -2029,7 +2045,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" diff --git a/po/sv.po b/po/sv.po index c355482..ac6e140 100644 --- a/po/sv.po +++ b/po/sv.po @@ -148,6 +148,23 @@ msgstr "Avancerat" msgid "Expert" msgstr "Expert" +msgid "A keyserver has not been configured." +msgstr "" + +#, fuzzy +msgid "Configure backend to use a keyserver?" +msgstr "Konfigurera bak??ndesprogram" + +msgid "_Yes" +msgstr "_Ja" + +msgid "_No" +msgstr "_Nej" + +#, fuzzy +msgid "Configuring the backend to use a keyserver failed" +msgstr "Konfigurera bak??ndesprogram" + msgid "days" msgstr "dagar" @@ -317,14 +334,14 @@ msgstr "Inst??llningar f??r bak??nde" msgid "Configure the backend programs" msgstr "Konfigurera bak??ndesprogram" -#, c-format +#, fuzzy, c-format msgid "" "A copy of your secret key has been made to the file:\n" "\n" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "En kopia av din hemliga nyckel har skapats i filen:\n" "\n" @@ -359,21 +376,22 @@ msgstr "Nycklarna har exporterats till %s." msgid "Only keys of the same procotol may be exported as a collection." msgstr "" -#, c-format +#, fuzzy, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" "Den valda nyckeln kommer att skickas till en\n" "publik nyckelserver (\"%s\").\n" "??r du s??ker p?? att du vill distribuera nyckeln?" -msgid "_Yes" -msgstr "_Ja" +#, fuzzy +msgid "Are you sure you want to distribute this key?" +msgstr "??r du s??ker p?? att du vill ta bort denna nyckel?" -msgid "_No" -msgstr "_Nej" +#, fuzzy +msgid "Error sending key(s) to the server." +msgstr "Skicka nycklar till server" msgid "The keys have been sent to the server." msgstr "Nycklarna har skickats till servern." @@ -2002,7 +2020,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" diff --git a/po/tr.po b/po/tr.po index 615292c..08097c3 100644 --- a/po/tr.po +++ b/po/tr.po @@ -160,6 +160,21 @@ msgstr "" msgid "Expert" msgstr "D??ar? Yaz" +msgid "A keyserver has not been configured." +msgstr "" + +msgid "Configure backend to use a keyserver?" +msgstr "" + +msgid "_Yes" +msgstr "_Evet" + +msgid "_No" +msgstr "_Hay?r" + +msgid "Configuring the backend to use a keyserver failed" +msgstr "" + msgid "days" msgstr "g?n" @@ -349,14 +364,14 @@ msgstr "/D msgid "Configure the backend programs" msgstr "" -#, c-format +#, fuzzy, c-format msgid "" "A copy of your secret key has been made to the file:\n" "\n" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "Gizli anahtar?n?z?n bir kopyas? ?u dosyaya yaz?ld?:\n" "\n" @@ -391,21 +406,22 @@ msgstr "Anahtarlar %s isimli dosyaya aktar msgid "Only keys of the same procotol may be exported as a collection." msgstr "" -#, c-format +#, fuzzy, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" "Se?ili anahtar \"%s\" genel anahtar\n" "sunucusuna g?nderilecektir.\n" "Bu anahtar? da??tmak istedi?inizden emin misiniz?" -msgid "_Yes" -msgstr "_Evet" +#, fuzzy +msgid "Are you sure you want to distribute this key?" +msgstr "Bu anahtar? silmek istedi?inize emin misiniz?" -msgid "_No" -msgstr "_Hay?r" +#, fuzzy +msgid "Error sending key(s) to the server." +msgstr "/Anahtarlar? Sunucuya _G?nder..." msgid "The keys have been sent to the server." msgstr "Anahtarlar sunucuya yolland?." @@ -2039,7 +2055,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" diff --git a/po/zh_TW.po b/po/zh_TW.po index 4d86b05..695a955 100644 --- a/po/zh_TW.po +++ b/po/zh_TW.po @@ -159,6 +159,21 @@ msgstr "" msgid "Expert" msgstr "???X" +msgid "A keyserver has not been configured." +msgstr "" + +msgid "Configure backend to use a keyserver?" +msgstr "" + +msgid "_Yes" +msgstr "?O (&Y)" + +msgid "_No" +msgstr "?_ (&N)" + +msgid "Configuring the backend to use a keyserver failed" +msgstr "" + msgid "days" msgstr "??" @@ -348,14 +363,14 @@ msgstr "/ msgid "Configure the backend programs" msgstr "" -#, c-format +#, fuzzy, c-format msgid "" "A copy of your secret key has been made to the file:\n" "\n" "\t\"%s\"\n" "\n" "This is sensitive information, and should be stored carefully\n" -"(for example, in a floppy disk kept in a safe place)." +"(for example, on a USB stick kept in a safe place)." msgstr "" "?K?_?w?g?Q???s???s???? :\n" "\n" @@ -390,21 +405,22 @@ msgstr " msgid "Only keys of the same procotol may be exported as a collection." msgstr "" -#, c-format +#, fuzzy, c-format msgid "" -"The selected key will be sent to a public key\n" -"server (\"%s\").\n" -"Are you sure you want to distribute this key?" +"The selected key(s) will be sent to a public key\n" +"server (\"%s\")." msgstr "" "?Q?????????_?|?H?????_?F?A?? :\n" "(\"%s\")??.\n" "?n?T?w?o???o?????_?? ?" -msgid "_Yes" -msgstr "?O (&Y)" +#, fuzzy +msgid "Are you sure you want to distribute this key?" +msgstr "?z?T?w?n?R???o?K?_?" -msgid "_No" -msgstr "?_ (&N)" +#, fuzzy +msgid "Error sending key(s) to the server." +msgstr "?H?X???_?????A??... (&N)" msgid "The keys have been sent to the server." msgstr "???_?w?Q???????_?F?A??." @@ -2007,7 +2023,7 @@ msgid "" "\n" "A fresh standard card has set the Admin-PIN to the value 12345678. " "However, the issuer of your card might have initialized the card with a " -"different Admin-PIN and that Admin-PIN might only be nown to the issuer. " +"different Admin-PIN and that Admin-PIN might only be known to the issuer. " "Please check the instructions of your issuer.\n" "\n" "If you proceed you will be asked to enter the current value of the Admin-" commit 69525610df82a88becf11d3952506075815ec98d Author: Werner Koch Date: Thu Dec 11 09:59:33 2014 +0100 Replace deprecated gpgme API for card access. * src/cardman.c: Use gpgme_op_assuan_transact_ext. * src/cm-dinsig.c: Ditto. * src/cm-geldkarte.c: Ditto. * src/cm-netkey.c: Ditto. * src/cm-openpgp.c: Ditto. * src/cm-unknown.c: Ditto. diff --git a/src/cardman.c b/src/cardman.c index 844a44a..382284a 100644 --- a/src/cardman.c +++ b/src/cardman.c @@ -289,7 +289,7 @@ card_reload_finish_idle_cb (void *user_data) static void card_reload (GpaCardManager *cardman) { - gpg_error_t err; + gpg_error_t err, operr; const char *application; char *command_buf = NULL; const char *command; @@ -327,14 +327,14 @@ card_reload (GpaCardManager *cardman) } else auto_app = 1; - err = gpgme_op_assuan_transact (cardman->gpgagent, - command, - scd_data_cb, NULL, - scd_inq_cb, NULL, - scd_status_cb, cardman); + err = gpgme_op_assuan_transact_ext (cardman->gpgagent, + command, + scd_data_cb, NULL, + scd_inq_cb, NULL, + scd_status_cb, cardman, &operr); if (!err) { - err = gpgme_op_assuan_result (cardman->gpgagent)->err; + err = operr; if (!auto_app && gpg_err_source (err) == GPG_ERR_SOURCE_SCD && gpg_err_code (err) == GPG_ERR_CONFLICT) @@ -344,19 +344,20 @@ card_reload (GpaCardManager *cardman) again to display an application selection conflict error only if it is not due to our own connection to the scdaemon. */ - if (!gpgme_op_assuan_transact (cardman->gpgagent, - "SCD RESTART", - NULL, NULL, NULL, NULL, - NULL, NULL) - && !gpgme_op_assuan_result (cardman->gpgagent)->err) + if (!gpgme_op_assuan_transact_ext (cardman->gpgagent, + "SCD RESTART", + NULL, NULL, NULL, NULL, + NULL, NULL, &operr) + && !operr) { - err = gpgme_op_assuan_transact (cardman->gpgagent, - command, - scd_data_cb, NULL, - scd_inq_cb, NULL, - scd_status_cb, cardman); + err = gpgme_op_assuan_transact_ext (cardman->gpgagent, + command, + scd_data_cb, NULL, + scd_inq_cb, NULL, + scd_status_cb, cardman, + &operr); if (!err) - err = gpgme_op_assuan_result (cardman->gpgagent)->err; + err = operr; } } } @@ -388,9 +389,10 @@ card_reload (GpaCardManager *cardman) { g_debug ("assuan command `%s' failed: %s <%s>\n", command, gpg_strerror (err), gpg_strsource (err)); - if (!gpgme_op_assuan_transact (cardman->gpgagent, - "SCD SERIALNO undefined", - NULL, NULL, NULL, NULL, NULL, NULL)) + if (!gpgme_op_assuan_transact_ext (cardman->gpgagent, + "SCD SERIALNO undefined", + NULL, NULL, NULL, NULL, + NULL, NULL, &operr) && !operr) err = 0; else { @@ -405,22 +407,22 @@ card_reload (GpaCardManager *cardman) { /* Get the event counter to avoid a duplicate reload due to the ticker. */ - gpgme_op_assuan_transact (cardman->gpgagent, - "GETEVENTCOUNTER", - NULL, NULL, - NULL, NULL, - scd_status_cb, cardman); + gpgme_op_assuan_transact_ext (cardman->gpgagent, + "GETEVENTCOUNTER", + NULL, NULL, + NULL, NULL, + scd_status_cb, cardman, NULL); /* Now we need to get the APPTYPE of the card so that the correct GpaCM* object can can act on the data. */ command = "SCD GETATTR APPTYPE"; - err = gpgme_op_assuan_transact (cardman->gpgagent, - command, - scd_data_cb, NULL, - scd_inq_cb, NULL, - scd_status_cb, cardman); + err = gpgme_op_assuan_transact_ext (cardman->gpgagent, + command, + scd_data_cb, NULL, + scd_inq_cb, NULL, + scd_status_cb, cardman, &operr); if (!err) - err = gpgme_op_assuan_result (cardman->gpgagent)->err; + err = operr; if (gpg_err_code (err) == GPG_ERR_CARD_NOT_PRESENT || gpg_err_code (err) == GPG_ERR_CARD_REMOVED) @@ -522,11 +524,11 @@ ticker_cb (gpointer user_data) /* Note that we are single threaded and thus there is no need to lock the assuan context. */ - gpgme_op_assuan_transact (cardman->gpgagent, - "GETEVENTCOUNTER", - NULL, NULL, - NULL, NULL, - geteventcounter_status_cb, cardman); + gpgme_op_assuan_transact_ext (cardman->gpgagent, + "GETEVENTCOUNTER", + NULL, NULL, + NULL, NULL, + geteventcounter_status_cb, cardman, NULL); return TRUE; /* Keep on ticking. */ } @@ -564,8 +566,8 @@ card_genkey_completed (GpaCardManager *cardman, gpg_error_t err) static void card_genkey (GpaCardManager *cardman) { + gpg_error_t err, operr; GpaGenKeyCardOperation *op; - gpg_error_t err; char *keyattr; if (cardman->cardtype != GPA_CM_OPENPGP_TYPE) @@ -578,11 +580,13 @@ card_genkey (GpaCardManager *cardman) /* Note: This test works only with GnuPG > 2.0.10 but that version is anyway required for the card manager to work correctly. */ - err = gpgme_op_assuan_transact (cardman->gpgagent, - "SCD GETINFO deny_admin", - NULL, NULL, NULL, NULL, NULL, NULL); + err = gpgme_op_assuan_transact_ext (cardman->gpgagent, + "SCD GETINFO deny_admin", + NULL, NULL, NULL, NULL, NULL, NULL, + &operr); if (!err) - err = gpgme_op_assuan_result (cardman->gpgagent)->err; + err = operr; + if (!err) { gpa_window_error ("Admin commands are disabled in scdamon.\n" @@ -844,7 +848,7 @@ setup_app_selector_data_cb (void *opaque, const void *data, size_t datalen) static void setup_app_selector (GpaCardManager *cardman) { - gpg_error_t err; + gpg_error_t err, operr; membuf_t mb; char *string; char *p, *p0, *p1; @@ -854,11 +858,11 @@ setup_app_selector (GpaCardManager *cardman) init_membuf (&mb, 256); - err = gpgme_op_assuan_transact (cardman->gpgagent, - "SCD GETINFO app_list", - setup_app_selector_data_cb, &mb, - NULL, NULL, NULL, NULL); - if (err || gpgme_op_assuan_result (cardman->gpgagent)->err) + err = gpgme_op_assuan_transact_ext (cardman->gpgagent, + "SCD GETINFO app_list", + setup_app_selector_data_cb, &mb, + NULL, NULL, NULL, NULL, &operr); + if (err || operr) { g_free (get_membuf (&mb, NULL)); return; diff --git a/src/cm-dinsig.c b/src/cm-dinsig.c index 0a4a866..a8d1e14 100644 --- a/src/cm-dinsig.c +++ b/src/cm-dinsig.c @@ -14,7 +14,7 @@ * License for more details. * * You should have received a copy of the GNU General Public License - * along with this program; if not, see . + * along with this program; if not, see . */ /* DINSIG is the old and still used standard for smartcards to create @@ -32,7 +32,7 @@ #include #include -#include "gpa.h" +#include "gpa.h" #include "gtktools.h" #include "convert.h" @@ -48,12 +48,12 @@ enum ENTRY_SERIALNO, ENTRY_LAST - }; + }; /* Object's class definition. */ -struct _GpaCMDinsigClass +struct _GpaCMDinsigClass { GpaCMObjectClass parent_class; }; @@ -81,7 +81,7 @@ static void gpa_cm_dinsig_finalize (GObject *object); -/************************************************************ +/************************************************************ ******************* Implementation ********************* ************************************************************/ @@ -126,17 +126,17 @@ scd_getattr_cb (void *opaque, const char *status, const char *args) if (parm->updfnc) parm->updfnc (parm->card, entry_id, tmp); else if (GTK_IS_LABEL (parm->card->entries[entry_id])) - gtk_label_set_text + gtk_label_set_text (GTK_LABEL (parm->card->entries[entry_id]), tmp); else - gtk_entry_set_text + gtk_entry_set_text (GTK_ENTRY (parm->card->entries[entry_id]), tmp); xfree (tmp); } } return 0; -} +} /* Use the assuan machinery to load the bulk of the OpenPGP card data. */ @@ -152,7 +152,7 @@ reload_data (GpaCMDinsig *card) { NULL } }; int attridx; - gpg_error_t err; + gpg_error_t err, operr; char command[100]; struct scd_getattr_parm parm; gpgme_ctx_t gpgagent; @@ -168,13 +168,13 @@ reload_data (GpaCMDinsig *card) parm.entry_id = attrtbl[attridx].entry_id; parm.updfnc = attrtbl[attridx].updfnc; snprintf (command, sizeof command, "SCD GETATTR %s", parm.name); - err = gpgme_op_assuan_transact (gpgagent, - command, - NULL, NULL, - NULL, NULL, - scd_getattr_cb, &parm); + err = gpgme_op_assuan_transact_ext (gpgagent, + command, + NULL, NULL, + NULL, NULL, + scd_getattr_cb, &parm, &operr); if (!err) - err = gpgme_op_assuan_result (gpgagent)->err; + err = operr; if (err) { @@ -182,7 +182,7 @@ reload_data (GpaCMDinsig *card) ; /* Lost the card. */ else { - g_debug ("assuan command `%s' failed: %s <%s>\n", + g_debug ("assuan command `%s' failed: %s <%s>\n", command, gpg_strerror (err), gpg_strsource (err)); } clear_card_data (card); @@ -206,12 +206,12 @@ add_table_row (GtkWidget *table, int *rowidx, label = gtk_label_new (labelstr); gtk_label_set_width_chars (GTK_LABEL (label), 22); gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5); - gtk_table_attach (GTK_TABLE (table), label, 0, 1, - *rowidx, *rowidx + 1, GTK_FILL, GTK_SHRINK, 0, 0); + gtk_table_attach (GTK_TABLE (table), label, 0, 1, + *rowidx, *rowidx + 1, GTK_FILL, GTK_SHRINK, 0, 0); if (is_label) gtk_misc_set_alignment (GTK_MISC (widget), 0, 0.5); - + if (readonly) { if (!is_label && GTK_IS_ENTRY (widget)) @@ -225,7 +225,7 @@ add_table_row (GtkWidget *table, int *rowidx, if (is_label) gtk_label_set_selectable (GTK_LABEL (widget), TRUE); } - + gtk_table_attach (GTK_TABLE (table), widget, 1, 2, *rowidx, *rowidx + 1, GTK_FILL, GTK_SHRINK, 0, 0); if (widget2) @@ -259,18 +259,18 @@ construct_data_widget (GpaCMDinsig *card) gtk_container_set_border_width (GTK_CONTAINER (table), 10); gtk_container_add (GTK_CONTAINER (frame), table); rowidx = 0; - + card->entries[ENTRY_SERIALNO] = gtk_label_new (NULL); add_table_row (table, &rowidx, _("Serial number:"), card->entries[ENTRY_SERIALNO], NULL, 0); gtk_box_pack_start (GTK_BOX (card), frame, FALSE, TRUE, 0); - + /* Info frame. */ frame = gtk_frame_new (NULL); gtk_frame_set_shadow_type (GTK_FRAME (frame), GTK_SHADOW_NONE); vbox = gtk_vbox_new (FALSE, 5); - text = g_strdup_printf + text = g_strdup_printf (_("There is not much information to display for a %s card. " "You may want to use the application selector button to " "switch to another application available on this card."), "DINSIG"); @@ -281,12 +281,12 @@ construct_data_widget (GpaCMDinsig *card) gtk_container_add (GTK_CONTAINER (frame), vbox); gtk_box_pack_start (GTK_BOX (card), frame, FALSE, TRUE, 0); - + } -/************************************************************ +/************************************************************ ****************** Object Management ******************** ************************************************************/ @@ -296,7 +296,7 @@ gpa_cm_dinsig_class_init (void *class_ptr, void *class_data) GpaCMDinsigClass *klass = class_ptr; parent_class = g_type_class_peek_parent (klass); - + G_OBJECT_CLASS (klass)->finalize = gpa_cm_dinsig_finalize; } @@ -313,7 +313,7 @@ gpa_cm_dinsig_init (GTypeInstance *instance, void *class_ptr) static void gpa_cm_dinsig_finalize (GObject *object) -{ +{ /* GpaCMDinsig *card = GPA_CM_DINSIG (object); */ parent_class->finalize (object); @@ -325,7 +325,7 @@ GType gpa_cm_dinsig_get_type (void) { static GType this_type = 0; - + if (!this_type) { static const GTypeInfo this_info = @@ -340,23 +340,23 @@ gpa_cm_dinsig_get_type (void) 0, /* n_preallocs */ gpa_cm_dinsig_init }; - + this_type = g_type_register_static (GPA_CM_OBJECT_TYPE, "GpaCMDinsig", &this_info, 0); } - + return this_type; } -/************************************************************ +/************************************************************ ********************** Public API ************************ ************************************************************/ GtkWidget * gpa_cm_dinsig_new () { - return GTK_WIDGET (g_object_new (GPA_CM_DINSIG_TYPE, NULL)); + return GTK_WIDGET (g_object_new (GPA_CM_DINSIG_TYPE, NULL)); } diff --git a/src/cm-geldkarte.c b/src/cm-geldkarte.c index aebfb7c..577b4c8 100644 --- a/src/cm-geldkarte.c +++ b/src/cm-geldkarte.c @@ -14,7 +14,7 @@ * License for more details. * * You should have received a copy of the GNU General Public License - * along with this program; if not, see . + * along with this program; if not, see . */ #ifdef HAVE_CONFIG_H @@ -26,7 +26,7 @@ #include #include -#include "gpa.h" +#include "gpa.h" #include "convert.h" #include "cm-object.h" @@ -52,12 +52,12 @@ enum ENTRY_MAXAMOUNT1, ENTRY_LAST - }; + }; /* Object's class definition. */ -struct _GpaCMGeldkarteClass +struct _GpaCMGeldkarteClass { GpaCMObjectClass parent_class; }; @@ -84,7 +84,7 @@ static void gpa_cm_geldkarte_finalize (GObject *object); -/************************************************************ +/************************************************************ ******************* Implementation ********************* ************************************************************/ @@ -125,13 +125,13 @@ scd_getattr_cb (void *opaque, const char *status, const char *args) if (parm->updfnc) parm->updfnc (parm->card, entry_id, args); else - gtk_label_set_text + gtk_label_set_text (GTK_LABEL (parm->card->entries[entry_id]), args); } } return 0; -} +} /* Use the assuan machinery to load the bulk of the OpenPGP card data. */ @@ -158,7 +158,7 @@ reload_data (GpaCMGeldkarte *card, gpgme_ctx_t gpgagent) { NULL } }; int attridx; - gpg_error_t err; + gpg_error_t err, operr; char command[100]; struct scd_getattr_parm parm; @@ -169,13 +169,13 @@ reload_data (GpaCMGeldkarte *card, gpgme_ctx_t gpgagent) parm.entry_id = attrtbl[attridx].entry_id; parm.updfnc = attrtbl[attridx].updfnc; snprintf (command, sizeof command, "SCD GETATTR %s", parm.name); - err = gpgme_op_assuan_transact (gpgagent, - command, - NULL, NULL, - NULL, NULL, - scd_getattr_cb, &parm); + err = gpgme_op_assuan_transact_ext (gpgagent, + command, + NULL, NULL, + NULL, NULL, + scd_getattr_cb, &parm, &operr); if (!err) - err = gpgme_op_assuan_result (gpgagent)->err; + err = operr; if (err) { @@ -183,7 +183,7 @@ reload_data (GpaCMGeldkarte *card, gpgme_ctx_t gpgagent) ; /* Lost the card. */ else { - g_debug ("assuan command `%s' failed: %s <%s>\n", + g_debug ("assuan command `%s' failed: %s <%s>\n", command, gpg_strerror (err), gpg_strsource (err)); } clear_card_data (card); @@ -206,8 +206,8 @@ add_table_row (GtkWidget *table, int *rowidx, const char *labelstr) label = gtk_label_new (labelstr); gtk_label_set_width_chars (GTK_LABEL (label), 22); gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5); - gtk_table_attach (GTK_TABLE (table), label, 0, 1, - *rowidx, *rowidx + 1, GTK_FILL, GTK_SHRINK, 0, 0); + gtk_table_attach (GTK_TABLE (table), label, 0, 1, + *rowidx, *rowidx + 1, GTK_FILL, GTK_SHRINK, 0, 0); gtk_misc_set_alignment (GTK_MISC (widget), 0, 0.5); gtk_label_set_selectable (GTK_LABEL (widget), TRUE); @@ -253,35 +253,35 @@ construct_data_widget (GpaCMGeldkarte *card) amount_table = gtk_table_new (3, 3, FALSE); gtk_container_set_border_width (GTK_CONTAINER (amount_table), 10); - + /* General frame. */ rowidx = 0; - card->entries[ENTRY_CARDNO] = add_table_row + card->entries[ENTRY_CARDNO] = add_table_row (general_table, &rowidx, _("Card number: ")); - card->entries[ENTRY_KBLZ] = add_table_row + card->entries[ENTRY_KBLZ] = add_table_row (general_table, &rowidx, _("Short Bank Code number: ")); - card->entries[ENTRY_BANKTYPE] = add_table_row + card->entries[ENTRY_BANKTYPE] = add_table_row (general_table, &rowidx, _("Bank type: ")); - card->entries[ENTRY_VALIDFROM] = add_table_row + card->entries[ENTRY_VALIDFROM] = add_table_row (general_table, &rowidx, _("Card valid from: ")); - card->entries[ENTRY_EXPIRES] = add_table_row + card->entries[ENTRY_EXPIRES] = add_table_row (general_table, &rowidx, _("Card expires: ")); - card->entries[ENTRY_COUNTRY] = add_table_row + card->entries[ENTRY_COUNTRY] = add_table_row (general_table, &rowidx, _("Issuing country: ")); - card->entries[ENTRY_CURRENCY] = add_table_row + card->entries[ENTRY_CURRENCY] = add_table_row (general_table, &rowidx, _("Currency: ")); - card->entries[ENTRY_ZKACHIPID] = add_table_row + card->entries[ENTRY_ZKACHIPID] = add_table_row (general_table, &rowidx, _("ZKA chip Id: ")); - card->entries[ENTRY_OSVERSION] = add_table_row + card->entries[ENTRY_OSVERSION] = add_table_row (general_table, &rowidx, _("Chip OS version: ")); gtk_container_add (GTK_CONTAINER (general_frame), general_table); @@ -290,13 +290,13 @@ construct_data_widget (GpaCMGeldkarte *card) /* Amount frame. */ rowidx = 0; - card->entries[ENTRY_BALANCE] = add_table_row + card->entries[ENTRY_BALANCE] = add_table_row (amount_table, &rowidx, _("Balance: ")); - card->entries[ENTRY_MAXAMOUNT] = add_table_row + card->entries[ENTRY_MAXAMOUNT] = add_table_row (amount_table, &rowidx, _("General limit: ")); - card->entries[ENTRY_MAXAMOUNT1] = add_table_row + card->entries[ENTRY_MAXAMOUNT1] = add_table_row (amount_table, &rowidx, _("Transaction limit: ")); gtk_container_add (GTK_CONTAINER (amount_frame), amount_table); @@ -309,7 +309,7 @@ construct_data_widget (GpaCMGeldkarte *card) -/************************************************************ +/************************************************************ ****************** Object Management ******************** ************************************************************/ @@ -319,7 +319,7 @@ gpa_cm_geldkarte_class_init (void *class_ptr, void *class_data) GpaCMGeldkarteClass *klass = class_ptr; parent_class = g_type_class_peek_parent (klass); - + G_OBJECT_CLASS (klass)->finalize = gpa_cm_geldkarte_finalize; } @@ -336,7 +336,7 @@ gpa_cm_geldkarte_init (GTypeInstance *instance, void *class_ptr) static void gpa_cm_geldkarte_finalize (GObject *object) -{ +{ /* GpaCMGeldkarte *card = GPA_CM_GELDKARTE (object); */ parent_class->finalize (object); @@ -348,7 +348,7 @@ GType gpa_cm_geldkarte_get_type (void) { static GType this_type = 0; - + if (!this_type) { static const GTypeInfo this_info = @@ -363,23 +363,23 @@ gpa_cm_geldkarte_get_type (void) 0, /* n_preallocs */ gpa_cm_geldkarte_init }; - + this_type = g_type_register_static (GPA_CM_OBJECT_TYPE, "GpaCMGeldkarte", &this_info, 0); } - + return this_type; } -/************************************************************ +/************************************************************ ********************** Public API ************************ ************************************************************/ GtkWidget * gpa_cm_geldkarte_new () { - return GTK_WIDGET (g_object_new (GPA_CM_GELDKARTE_TYPE, NULL)); + return GTK_WIDGET (g_object_new (GPA_CM_GELDKARTE_TYPE, NULL)); } diff --git a/src/cm-netkey.c b/src/cm-netkey.c index 8ddbcb7..656010b 100644 --- a/src/cm-netkey.c +++ b/src/cm-netkey.c @@ -319,7 +319,7 @@ reload_more_data_cb (void *opaque, const char *status, const char *args) static void reload_more_data (GpaCMNetkey *card) { - gpg_error_t err; + gpg_error_t err, operr; gpgme_ctx_t gpgagent; GtkWidget *vbox; struct reload_more_data_parm parm; @@ -355,13 +355,14 @@ reload_more_data (GpaCMNetkey *card) g_debug (" parm.ctx=%p", parm.ctx); - err = gpgme_op_assuan_transact (gpgagent, - "SCD LEARN --keypairinfo", - NULL, NULL, NULL, NULL, - reload_more_data_cb, &parm); + err = gpgme_op_assuan_transact_ext (gpgagent, + "SCD LEARN --keypairinfo", + NULL, NULL, NULL, NULL, + reload_more_data_cb, &parm, &operr); g_debug (" assuan ret=%d", err); if (!err) - err = gpgme_op_assuan_result (gpgagent)->err; + err = operr; + if (err) g_debug ("SCD LEARN failed: %s", gpg_strerror (err)); @@ -479,6 +480,7 @@ reload_data (GpaCMNetkey *card) }; int attridx; gpg_error_t err = 0; + gpg_error_t operr; char command[100]; struct scd_getattr_parm parm; gpgme_ctx_t gpgagent; @@ -497,13 +499,13 @@ reload_data (GpaCMNetkey *card) parm.entry_id = attrtbl[attridx].entry_id; parm.updfnc = attrtbl[attridx].updfnc; snprintf (command, sizeof command, "SCD GETATTR %s", parm.name); - err = gpgme_op_assuan_transact (gpgagent, - command, - NULL, NULL, - NULL, NULL, - scd_getattr_cb, &parm); + err = gpgme_op_assuan_transact_ext (gpgagent, + command, + NULL, NULL, + NULL, NULL, + scd_getattr_cb, &parm, &operr); if (!err) - err = gpgme_op_assuan_result (gpgagent)->err; + err = operr; if (err && attrtbl[attridx].entry_id == ENTRY_NKS_VERSION) { @@ -616,7 +618,7 @@ learn_keys_clicked_cb (GtkButton *button, void *user_data) static void change_nullpin (GpaCMNetkey *card) { - gpg_error_t err; + gpg_error_t err, operr; GtkWidget *dialog; gpgme_ctx_t gpgagent; int is_sigg; @@ -666,15 +668,16 @@ change_nullpin (GpaCMNetkey *card) okay = (gtk_dialog_run (GTK_DIALOG (dialog)) == GTK_RESPONSE_OK); if (okay) { - err = gpgme_op_assuan_transact (gpgagent, - is_sigg - ? "SCD PASSWD --nullpin PW1.CH.SIG" - : "SCD PASSWD --nullpin PW1.CH", - NULL, NULL, - NULL, NULL, - NULL, NULL); + err = gpgme_op_assuan_transact_ext (gpgagent, + is_sigg + ? "SCD PASSWD --nullpin PW1.CH.SIG" + : "SCD PASSWD --nullpin PW1.CH", + NULL, NULL, + NULL, NULL, + NULL, NULL, &operr); if (!err) - err = gpgme_op_assuan_result (gpgagent)->err; + err = operr; + if (gpg_err_code (err) == GPG_ERR_CANCELED) okay = 0; /* No need to reload the data. */ else if (err) @@ -696,7 +699,7 @@ change_nullpin (GpaCMNetkey *card) static void change_or_reset_pin (GpaCMNetkey *card, int info_idx) { - gpg_error_t err; + gpg_error_t err, operr; GtkWidget *dialog; gpgme_ctx_t gpgagent; int reset_mode; @@ -781,10 +784,12 @@ change_or_reset_pin (GpaCMNetkey *card, int info_idx) snprintf (command, sizeof command, "SCD PASSWD%s %s", reset_mode? " --reset":"", pwidstr); - err = gpgme_op_assuan_transact (gpgagent, command, - NULL, NULL, NULL, NULL, NULL, NULL); + err = gpgme_op_assuan_transact_ext (gpgagent, command, + NULL, NULL, NULL, NULL, NULL, NULL, + &operr); if (!err) - err = gpgme_op_assuan_result (gpgagent)->err; + err = operr; + if (gpg_err_code (err) == GPG_ERR_CANCELED) okay = 0; /* No need to reload the data. */ else if (err) diff --git a/src/cm-openpgp.c b/src/cm-openpgp.c index cd901e0..55a3081 100644 --- a/src/cm-openpgp.c +++ b/src/cm-openpgp.c @@ -597,7 +597,7 @@ reload_data (GpaCMOpenpgp *card) { NULL } }; int attridx; - gpg_error_t err; + gpg_error_t err, operr; char command[100]; struct scd_getattr_parm parm; gpgme_ctx_t gpgagent; @@ -616,13 +616,13 @@ reload_data (GpaCMOpenpgp *card) parm.updfnc = attrtbl[attridx].updfnc; snprintf (command, sizeof command, "SCD GETATTR %s", parm.name); - err = gpgme_op_assuan_transact (gpgagent, - command, - NULL, NULL, - NULL, NULL, - scd_getattr_cb, &parm); + err = gpgme_op_assuan_transact_ext (gpgagent, + command, + NULL, NULL, + NULL, NULL, + scd_getattr_cb, &parm, &operr); if (!err) - err = gpgme_op_assuan_result (gpgagent)->err; + err = operr; if (err) { @@ -648,7 +648,7 @@ static gpg_error_t save_attr (GpaCMOpenpgp *card, const char *name, const char *value, int is_escaped) { - gpg_error_t err; + gpg_error_t err, operr; char *command; gpgme_ctx_t gpgagent; @@ -670,13 +670,13 @@ save_attr (GpaCMOpenpgp *card, const char *name, command = g_strdup_printf ("SCD SETATTR %s %s", name, p); xfree (p); } - err = gpgme_op_assuan_transact (gpgagent, - command, - NULL, NULL, - NULL, NULL, - NULL, NULL); + err = gpgme_op_assuan_transact_ext (gpgagent, + command, + NULL, NULL, + NULL, NULL, + NULL, NULL, &operr); if (!err) - err = gpgme_op_assuan_result (gpgagent)->err; + err = operr; if (err && !(gpg_err_code (err) == GPG_ERR_CANCELED && gpg_err_source (err) == GPG_ERR_SOURCE_PINENTRY)) @@ -1050,7 +1050,7 @@ edit_focus_cb (GtkWidget *widget, GtkDirectionType direction, void *opaque) static void change_pin (GpaCMOpenpgp *card, int pinno) { - gpg_error_t err; + gpg_error_t err, operr; GtkWidget *dialog; gpgme_ctx_t gpgagent; int reset_mode = 0; @@ -1171,10 +1171,12 @@ change_pin (GpaCMOpenpgp *card, int pinno) snprintf (command, sizeof command, "SCD PASSWD%s %d", reset_mode? " --reset":"", pinno+1); - err = gpgme_op_assuan_transact (gpgagent, command, - NULL, NULL, NULL, NULL, NULL, NULL); + err = gpgme_op_assuan_transact_ext (gpgagent, command, + NULL, NULL, NULL, NULL, NULL, NULL, + &operr); if (!err) - err = gpgme_op_assuan_result (gpgagent)->err; + err = operr; + if (gpg_err_code (err) == GPG_ERR_CANCELED) okay = 0; /* No need to reload the data. */ else if (err) diff --git a/src/cm-unknown.c b/src/cm-unknown.c index 70ac99e..db27058 100644 --- a/src/cm-unknown.c +++ b/src/cm-unknown.c @@ -86,7 +86,7 @@ scd_atr_data_cb (void *opaque, const void *data, size_t datalen) static void reload_data (GpaCMUnknown *card) { - gpg_error_t err; + gpg_error_t err, operr; char command[100]; gpgme_ctx_t gpgagent; membuf_t mb; @@ -99,12 +99,12 @@ reload_data (GpaCMUnknown *card) init_membuf (&mb, 512); - err = gpgme_op_assuan_transact (gpgagent, - "SCD APDU --dump-atr", - scd_atr_data_cb, &mb, - NULL, NULL, NULL, NULL); + err = gpgme_op_assuan_transact_ext (gpgagent, + "SCD APDU --dump-atr", + scd_atr_data_cb, &mb, + NULL, NULL, NULL, NULL, &operr); if (!err) - err = gpgme_op_assuan_result (gpgagent)->err; + err = operr; if (!err) { ----------------------------------------------------------------------- Summary of changes: NEWS | 7 +++- configure.ac | 2 +- po/ar.po | 38 ++++++++++++++------ po/cs.po | 41 +++++++++++++++------ po/es.po | 38 ++++++++++++++------ po/ja.po | 42 ++++++++++++++-------- po/nl.po | 38 ++++++++++++++------ po/pl.po | 38 ++++++++++++++------ po/pt_BR.po | 36 +++++++++++++------ po/ru.po | 38 ++++++++++++++------ po/sv.po | 40 +++++++++++++++------ po/tr.po | 38 ++++++++++++++------ po/zh_TW.po | 38 ++++++++++++++------ src/cardman.c | 100 +++++++++++++++++++++++++++------------------------- src/cm-dinsig.c | 64 ++++++++++++++++----------------- src/cm-geldkarte.c | 76 +++++++++++++++++++-------------------- src/cm-netkey.c | 55 ++++++++++++++++------------- src/cm-openpgp.c | 38 ++++++++++---------- src/cm-unknown.c | 12 +++---- 19 files changed, 487 insertions(+), 292 deletions(-) hooks/post-receive -- The GNU Privacy Assistant http://git.gnupg.org From cvs at cvs.gnupg.org Fri Dec 12 11:16:25 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 12 Dec 2014 11:16:25 +0100 Subject: [git] gnupg-doc - branch, master, updated. 3154925789c7576d4f654acbfc694217f384d222 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via 3154925789c7576d4f654acbfc694217f384d222 (commit) via 9d9fd2fcb4b256c695b2a949b956a37ddf8a66e9 (commit) via feead5e78b63a83e05bcebf59f3b30d63e0d8f91 (commit) from 200d0652c05de971544e6270594c6037d76d4592 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 3154925789c7576d4f654acbfc694217f384d222 Author: Werner Koch Date: Fri Dec 12 11:17:20 2014 +0100 swdb: Update gpa, libassuan, gpgme, and adns. diff --git a/web/swdb.mac b/web/swdb.mac index c5a53f3..41d48df 100644 --- a/web/swdb.mac +++ b/web/swdb.mac @@ -49,9 +49,9 @@ # # GPA # -#+macro: gpa_ver 0.9.6 +#+macro: gpa_ver 0.9.7 #+macro: gpa_size 718k -#+macro: gpa_sha1 c664409c7d423eccc1120fbd0d232108269c9797 +#+macro: gpa_sha1 9eb07bcceeb986c7b6dbce8a18b82a2c344b50ce # @@ -65,10 +65,10 @@ # # GPGME # -#+macro: gpgme_ver 1.5.2 +#+macro: gpgme_ver 1.5.3 #+macro: gpgme_branch master #+macro: gpgme_size 946k -#+macro: gpgme_sha1 cb550ea09314a362aa895f1ca92da6ba73fb512a +#+macro: gpgme_sha1 8dd7711a4de117994fe2d45879ef8a9900d50f6a # @@ -106,9 +106,9 @@ # # LIBASSUAN # -#+macro: libassuan_ver 2.1.3 -#+macro: libassuan_size 504k -#+macro: libassuan_sha1 56ac91973c2818a91d4f16ed48265a2b5daf45d3 +#+macro: libassuan_ver 2.2.0 +#+macro: libassuan_size 505k +#+macro: libassuan_sha1 7cf0545955ce414044bb99b871d324753dd7b2e5 # @@ -128,8 +128,8 @@ # # ADNS # -#+macro: adns_ver 1.4-g10-4 -#+macro: adns_sha1 040aed033694aeb3a97b8e5d74b990d4cad6bc99 +#+macro: adns_ver 1.4-g10-5 +#+macro: adns_sha1 aecd6213118f01aa38f535dc3bafc31b1e7c1c21 # commit 9d9fd2fcb4b256c695b2a949b956a37ddf8a66e9 Author: Werner Koch Date: Wed Dec 10 16:06:56 2014 +0100 web: Add "blog" to the main menu diff --git a/.gitignore b/.gitignore index a2ea2ee..b05caed 100644 --- a/.gitignore +++ b/.gitignore @@ -1,5 +1,6 @@ oldsite/ stage/ +scratch/ /web/sitemap.org .*.orgx /web/theindex.inc diff --git a/web/donate/index.org b/web/donate/index.org index 8994e7c..d92e5dc 100644 --- a/web/donate/index.org +++ b/web/donate/index.org @@ -1,6 +1,11 @@ #+TITLE: GnuPG - Donate #+STARTUP: showall #+SETUPFILE: "../share/setup.inc" +# +# Note: Do not use relative links because this page is also used as a +# template from cgi-bin/. Using https://www.gnupg.org/... is +# fine as it is stripped before publishing. + * Donate @@ -20,7 +25,7 @@ #+HTML:

          #+HTML: #+HTML: -#+HTML:
        • (all)
          • +#+HTML:
        • (all)
          • #+HTML:

        @@ -41,7 +46,7 @@ information is only used for the purpose of the donation and no data will ever be send to any entity not directly involved in the donation process. Not giving a name makes the donation ?anonymous? - in that the name won?t be listed on the public [[file:kudos.org][thank you]] page. + in that the name won?t be listed on the public [[https://www.gnupg.org/donate/kudos.html][thank you]] page. #+BEGIN_HTML @@ -102,7 +107,7 @@ If you want to be listed on the - list of donors, + list of donors, please enter your name as it shall appear there. diff --git a/web/share/gpgweb.el b/web/share/gpgweb.el index 1e11a6a..06c43a0 100644 --- a/web/share/gpgweb.el +++ b/web/share/gpgweb.el @@ -100,7 +100,9 @@ if not available." (("/related_software/frontends.html" "Frontends") ("/related_software/tools.html" "Tools") ("/related_software/libraries.html" "Libraries") - ("/related_software/swlist.html" "All")))) + ("/related_software/swlist.html" "All"))) + ("/blog/index.html" + "Blog")) "The definition of the gnupg.org menu structure.") (defconst gpgweb-gnupg-bottom-menu-alist commit feead5e78b63a83e05bcebf59f3b30d63e0d8f91 Author: Werner Koch Date: Wed Dec 10 15:05:50 2014 +0100 blog: Wrote upload and indexing script. See the README file for details. diff --git a/.gitignore b/.gitignore index 7cd9006..a2ea2ee 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,5 @@ stage/ /web/faq/gnupg-faq.txt /web/swdb.lst /web/swdb.lst.sig +/misc/blog.gnupg.org/index.html +/misc/blog.gnupg.org/20*.html diff --git a/README b/README index a3224d5..0d6069c 100644 --- a/README +++ b/README @@ -68,3 +68,35 @@ for d in $(find . -type d); \\ A cronjob needs to run mkkudos.sh to update the list of donors. This can be done every few minutes becuase mkkudos won't do anything if the list of donors has not been updated. + +** Writing a blog entry + + The misc/blog.gnupg.org directory is used for the blogging system. + On the web server it is symlinked to /blog/. To build and upload all + blogs you cd to misc/blog.gnupg.org and run the command ./upload. + This renders the org files into html, builds an index, and uploads + the html files to the web server. Emacs and a decent org-mode are + required (tested with org-mode 8.2.7). + + To add a new blog entry, decide on the publication date and create + a file + + YYYYMMDD-short-headline.org + + for example "20141030-what-happened-this-month.org". Unless you + translate an existing entry do not use a file name which ends in + ".??.org". The file itself is a standard org file using these + conventions: + + ===== 8< ========= + # Comment + #+AUTHOR: Werner + #+DATE: 30th October 2014 + + ** What happened in October 2014 + + Blurb + ===== >8 ========= + + AUTHOR and DATE are used to construct the "Posted at" info. The + headline needs to start at level 2. diff --git a/misc/blog.gnupg.org/index.html b/misc/blog.gnupg.org/index.html deleted file mode 100644 index 4e4849f..0000000 --- a/misc/blog.gnupg.org/index.html +++ /dev/null @@ -1,886 +0,0 @@ - - - - - - Blog - GNU Privacy Guard - - - - -- - - - - - - - - - - - - - -
        - - - - - - - - - - - - - - - - - -
          - [GnuPG Logo]  
        · English ·     
        -
        - - - - - - - - - - - - - - - -
        Links - -  
          
         
        -         		- - - - - - - - - - - - - - - -
        - - - -

        GnuPG Blog

        - -
        - -

        Goteo Campaign: Preliminary Results

        -         -
        Posted May 12, 2014 by Werner
        - -

        - Here is a quick campaign status update: After the t-shirts arrived as - expected the week after Eastern, Mechthilde, Michael, Penny, Rainer, - and me met the other day at the FSFE office in D?sseldorf. Due to - Rainer?s excellent preparation we quickly folded, enveloped, and - stamped about 300 t-shirts and snailed them. Kudos to them for - helping with this task. There are still a few t-shirts we have not - been able to sent because some of our contributors did not reply to - several mails asking for missing address details, or the postmaster - returned them due to faulty addresses. If you expected a t-shirt and - did not receive one, please contact me at accounts at GnuPG dot net. - Most of the stickers have also been snailed but a few are still - pending due to uncertain addresses. -

        - -

        - The main GnuPG site is now - accessible via TLS and plain http access is redirected to the https - address. Strict Transport Security (HSTS) has also been enabled. - In the case of problems with TLS the site may still be accessed - non-encrypted via - http://www.tla-friendly.gnupg.org. -

        - -

        - To accomplish another promise of the campaign, the website may now be - accessed as TOR hidden service at - http://ic6au7wa3f6naxjq.onion. Being - a well known and intentionally public site, it does not make much - sense to have it as a hidden service. However, if the site is to be - accessed anyway via Tor we can avoid the extra TLS layer and and - allow direct access. Note that lists.gnupg.org and some other - services are not available via an onion address. -

        - -

        - Finally here are preliminary financial results of the campaign: -

        - -

        - Our contributors donated a total of 37270 Euro. Due to card and - Paypal processing problems we actually received 36732 Euro. The - preliminary costs for running the campaign are 18590 Euros, so - that 18142 Euro are available for the goals. Here is an overview - of the costs: -

        - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Goteo fee2939
        Paypal fees1152
        VAT5212
        Campaign manager5390
        300 t-shirts1852
        Envelopes + postage t-shirts996
        Rewards for helper102
        360 Stickers342
        Envelopes + postage sticker210
        Campaign server for 5 months395
         18590
        -

        - Due to missing or incomplete addresses or no response to our mails - we could not ship about 80 stickers and 15 t-shirts. I spend a - substantial amount of time (at least 4 weeks) with direct campaign - related tasks, which were not included in the original plan. That - plan explained how to spend the money: -

        - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        New website4054
        New content910
        New website design1435
        Releasing 2.16000
         12399
        - -

        - The extra 5743 Euro we received will be used for general - maintenance, to cover the unexpected time I had to spend on the - campaign, and for some giveaways to long time GnuPG hackers. -

        - -

        - Thank you very much for all your help and please keep on - supporting GnuPG. -

        -

        -
        - -
        - - -

        Mission complete: campaign ends, closing stats

        -         -
        Posted 6th February 2014 by Sam Tuke
        - -
        - -

        Today's donation totals

        -
        - -

        After 50 days of crowdfunding, the GnuPG campaign for new website and infrastructure will close tomorrow. That means rewards for backers can now be ordered and preparations for dispatch can begin. Here are the results so far:

        - -
          -
        • 36.741 EUR raised out of 24.000 target
          • -
        • 1.081 people donated in support
          • -
        • 350 EUR Largest single donation
          • -
        • 33 EUR average donation
          • -
        • 365 Stickers claimed
          • -
        • 300 T-shirts claimed
          • -
        • 191 GnuPG email addresses claimed
          • -
        • 793 Additional Twitter followers (from 60)
          • -
        - -

        Goteo, the Free Software platform hosting the campaign, usually required two 40 day rounds of funding, but in our case we're ending early, after just 50 days. This will enable us to deliver the new site and GnuPG 2.1 faster, and is possible thanks to reaching our goal so quickly (in just 26 hours).

        - -

        We're currently preparing a system for collecting donor preferences for their rewards (sizes, addresses, etc.), so expect to be contacted in the next week or two if that includes you.

        - -

        Thanks again to all our backers for the overwhelming support that GnuPG has received!

        - -

        - -
        - -
        - -
        - -

        Keysigning at FOSDEM

        -
        - - -

        Find us at FOSDEM

        -         -
        Posted 27th January 2014 by Sam Tuke
        - -

        On Friday Werner and Sam are heading to FOSDEM, the largest Free Software conference in Europe, along with many GnuPG hackers, users, and supporters. Get in touch if you'd like to talk about the existing or future campaigns while we're there.

        - -

        There won't be a GnuPG booth this year, but we shall be busy with meetings and mingling. Notes and contacts for us can be left at the FSFE booth.

        - -

        And don't forget that you're invited to the continent's biggest keysigning party, organised by FOSDEM volunteers. Today is the last opportunity to submit your key, which is necessary for participation. Get to it!

        - -

        Bring your ideas. See you there.

        - -

        - -
        - -
        - -

        How good is Goteo? An appraisal

        -         -
        Posted 30th December 2013 by Sam Tuke
        - -
        - -

        A wall of donor faces on Goteo

        -
        - -

        "One question: why did you choose the quite unknown Spanish crowdfunding site Goteo?" So shot back the reply to the press release I had just sent to a few dozen selected journalists announcing the launch of the GnuPG crowdfunding campaign. "You won't get any exposure on there, we got a few hundred thousand hits just from being on indiegogo" I was told by one experienced crowdfunder at my favourite Berlin hackerspace last month. "What's Goteo?" has been one of the most frequently asked questions of this campaign from friends and supporters.

        - -

        I ummed and ahhed over which crowfunding platform to choose. It's a decision that has a huge impact on the campaign - market exposure, transaction costs, and design and layout are just a few of the many factors that have to be taken into account. This is a crowded market - new crowdfunding sites are popping up each week as more companies try to cash in on what is recognised a key tech trend of 2013. An estimated $5bn was raised by crowdfunders this year. That equates to around $35m in commission fees for the platforms hosting these campaigns, who typically charge between 5-10%. It's no surprise that everyone wants a slice.

        - -
        - -

        "Non-economic donations"

        -
        - -

        Goteo however, is unique. Right now it's the only crowdfunding software that is itself Free Software, allowing everyone to inspect how it works and run their own copy. Even though I don't plan to run my own Kickstarter competitor any time soon, the fact we can check its code, make improvements, and follow the development process is really important. I want Goteo to prosper profitably because, aside from all its other good points, I know some of that profit will be invested in the platform itself, which shall remain free and accessible to everyone under the terms of the AGPL3 license.

        - -

        Goteo is also the only such site to my knowledge that's built with public money. Funded by Spain's Department for Education, Culture and Sport, Barcelona's City Council, and The University of Andalucia, Goteo exists to host projects which "contribute to the common good, free knowledge, and open code". Everything about the platform and the projects it hosts point to common goods, shared resources, and collaborative effort.

        - -

        Besides that, these other features make it stand out:

        - -
          -
        • Signup and donation workflow is smooth and simple
          • -
        • Great focus on social media and sharing links (we had hundreds of tweets from these)
          • -
        • Users can login with many social networks, including OpenID and LinkedIn
          • -
        • Clean and professional design with easy access to key information
          • -
        • Built in license chooser for all "goods" projects produce (categories for software, artwork, etc.)
          • -
        • Mandatory delivery timeframe / deadline setter with public calendar
          • -
        • Nice "image wall widget" of donors faces has potential, provides public recognition of donations
          • -
        • Web forms for project creation are comprehensive and well designed
          • -
        • Crowdsourcing of extra skills ("non-economic donations") works well
          • -
        • Donations are guaranteed by PayPal and Goteo, not pledged or retractable
          • -
        • Goteo staff are friendly and knowledgable, providing personal guidance and assistance
          • -
        • Many funding successes, including a few related to hardware, software, and Hackerspaces
          • -
        - - Many of those benefits are obvious before launching a campaign. However, on the list of problems I experienced with the platform, most weren't discovered until the point of execution (orange = fix in progress): - -
          -
        • User-set passwords are automatically emailed in plain text after registration (insecure)
          • -
        • Rewards can't be customised, e.g. select t-shirt size
          • -
        • Once a campaign is launched, no aspect can be edited directly (though news can be added)
          • -
        • The order of images for the campaign page is random - the first image visitors see can't be specified
          • -
        • The launch date of the campaign is chosen by Goteo administrators, it can't be specified
          • -
        • No markup is available for text formatting
          • -
        • Pictures are limited and can't be placed between text to break up the page
          • -
        • There's a bug that causes double posting of news items
          • -
        • Shipping for rewards is not configurable - international shipping can't be billed
          • -
        • The website is not mobile friendly (minimum page width is 940px)
          • -
        • HTTPS is not available to donors for transferring personal details
          • -
        - - Besides that, I spotted a few opportunities for improvement: - -
          -
        • Send emails to people who didn't complete their donation ("abandoned carts" - indiegogo does this)
          • -
        • Allow managers to specify the content of social media messages
          • -
        - -
        - -

        Goteo's license on GitHub

        -
        - -

        Some of the problems listed are a real pain. Because I couldn't choose the launch date, and hadn't planned for an in-depth human review by Goteo, our project went public days later than I expected, at a time when I was travelling and without connectivity. Goteo's campaigns team is helpful and responsive however, and even in the last few weeks several translation problems have been fixed which I had previously reported. I'm confident that the other most serious issues will be addressed in a timely manner.

        - -

        In all, we took a gamble by using Goteo, but one that paid off. It's focus on communal work and rewards is unique amongst its competitors, and when it comes to copyleft licensing they stand alone in practicing what they preach. Nearly all the convenient features that you'd expect from more established platforms are included, together with a pleasant functional interface. Donations are worry-free for both donors and recipients (though I can't comment on the final transfer process until later next month).

        - -

        Best of all perhaps, staff at Goteo are knowledgable and supportive and have time to invest in making projects a success. And when launch day comes and you're expecting the unexpected, that's very reassuring.

        - -

        - -
        - -
        -

        16 Years of protecting privacy

         -
        Posted 20th December 2013 by Sam Tuke
        - -

        - Today marks 16 years since the first release of GNU Privacy Guard - (GnuPG). In that time the project has grown from being a hacker?s - hobby into one of the world?s most critical anti-surveillance - tools. Today GnuPG stands at the front line of the battle between - invasive surveillance and civil liberties. -

        - -

        - ?Time has proven Free Software to be the most trustworthy defender - against companies and governments seeking to undermine citizen - privacy? said Werner Koch, GnuPG Founder and Lead Developer. ?Although - funding our work has not always been easy, the need for universally - accessible privacy tools has never been more apparent?. -

        - -

        - Some of the world?s top security specialists are now counted among - GnuPG users, including Bruce Schneier, Jacob Appelbaum, and Phil - Zimmerman, inventor of PGP. This summer the world learned of the - extent of Government spying thanks to whistleblowers and journalists - communicating using GnuPG encrypted emails. Market leading servers - from Red Hat and Debian have built their reputation for security on - the foundation of GnuPG-verified software. -

        - -

        - ?The success of GnuPG?s - first crowdfunding campaign, which received 90% of it?s target in 24 - hours, shows a fresh willingness among users to support GnuPG in it?s - 16th year, and points to new opportunities for the project in future? - said Sam Tuke, GnuPG Campaign Manager. ?The release of GnuPG 2.1 and - the launch of a newly designed website later this year will bring - GnuPG and its clients for Windows, Mac, Gnu/Linux, and Android to new - audiences?. -

        - -

        - Over the years GnuPG has kept up to date with new algorithms, such as - Elliptic Curve Cryptography, and reactive to new threats, such as key - extraction via acoustic monitoring, which was announced two days ago - by researchers as GnuPG updates were released, in coordination with - developers. Members remain confident of the future of GnuPG and look - forward to facing the privacy threats of tomorrow with community - support. -

        - - -

        - -
        - - -
        -

        Press release: GnuPG encryption project launches crowdfunding - campaign

         -
        Posted 19th December 2013 by Sam Tuke
        - - -

        Today GNU Privacy Guard (GnuPG) has launched its first - crowdfunding campaign with the aim of building a new - website and long term infrastructure. The 24.000 EUR target will - fund:

        - -
          -
        • Fresh web interfaces for gnupg.org including mobile
          • -
        • Completion and release of GnuPG 2.1
          • -
        • Anonymous Tor network access to the website
          • -
        • A new user friendly download page suitable for all devices
          • -
        • A new server for web services
          • -
        • New pages convening external guides, videos, and handbooks
          • -
        • Facilities for processing recurring donations for long - term project support
          • -
        - -

        Project founder and Lead Developer Werner Koch said ?GnuPG has - seen a huge upsurge in popularity following recent state - spying revelations. After 16 years of continuous development, - we are now asking for community support to capitalise on - consumer demand for privacy, and make GnuPG easy to access for - mainstream audiences?.

        - -

        GnuPG is one of the few tools remaining above suspicion in the - wake of leaked NSA documents. Edward Snowden and his contacts - including Bruce Schneier switched to GnuPG when they began handling - the secret - documents earlier - this year. The Wall Street Journal, The Committee to Protect - Journalists, - and ProPublica - have all embraced GnuPG for protection of staff and sources. Phil - Zimmermann, original inventor of Pretty Good Privacy (PGP), has also - moved to GnuPG in wake of the news.

        - -

        ?GnuPG is a key part of modern privacy infrastructure? said - Sam Tuke, Campaign Manager, GnuPG. ?Millions of users rely on - GnuPG to work securely on servers, laptops and smartphones, - but 2013 donations totaling 3.000 EUR to date have not even - covered fixed costs. Supporting new algorithms like elliptical - curve and fixing newfound exploits fast takes a lot of work - which is done voluntarily. Now is the time for people to - contribute to making GnuPG slick and more sustainable in - future?.

        - -

        Jacob Appelbaum, Tor Project developer, added ?GnuPG is - important - it allows us the assurances we need to do our - work. Community funding is a critical part of a confident - outlook for GnuPG in future.?

        - - -

        For further information, please contact Sam Tuke.
        - Email: samtuke [at] gnupg.org
        - Phone: +49 176 81923811 -

        - -

        About GNU Privacy Guard

        - -

        GnuPG is a leading cryptography app that protects emails and - data from interception. It is developed by a community of Free - Software engineers led by Werner Koch. GnuPG is used and - recommended by the world?s top security experts, including - Bruce Schneier and Phil Zimmermann. It offers best in class - privacy free of charge and restriction. Hundreds of companies - have integrated GnuPG into their products to perform mission - critical security, including Red Hat, Deutsche Bahn, and many - others.

        - -

        http://gnupg.org

        - -

        -
        - - - -
        -

        Getting Goteo approval

         -
        Posted 18th December 2013 by Sam Tuke
        - -
        - -

        Pending project on Goteo

        -
        - -

        The targets are set, the rewards are prepared, the press release - has been edited and translated, and now we?re waiting for - approval from the crowdfunding - platform Goteo.

        - -

        Goteo is like indiegogo, but more forward thinking. It has a - special focus on communal benefits and rewards - projects that - benefit society as a whole, not just project donors (though they - can get special rewards too).

        - - -

        Every ?good? produced by a campaign on Goteo, be it artwork, - software, event, or manufactured product, has a license assigned - to it, like GPL or Creative Commons, and as well as asking for - money, projects ask for other forms of help called ?non-economic - needs?, like translations or product - testing. Goteo?s own - source code is Free Software too, meaning anyone can run - their own Goteo crowdfunding server. That?s the feature that - swung our decision to use it for GnuPG.

        - - -

        Because the type of project on Goteo is quite specific - however, the acceptance phase of launching crowdfunding is - taking us longer than expected. Right now we?re working with - Goteo?s small team to answer questions which aren?t on the - webforms you fill out when you design your project with their - system.

        - -

        I?m hoping to provide what?s necesasry and get acceptance - quickly. As soon as we have it the crowdfunding will launch - and newsletter subscribers - and Twitter followers - will be the first to know.

        - -

        - - -
        - - - - -
        -

        Speedups in Libgcrypt 1.6

         -
        Posted 15 December 2013 by Werner Koch
        -

        - [...] To check how the forthcoming version 1.6.0 of Libgcrypt - compares to the older 1.5 version of Libgcrypt, I did some benchmarks - using a Thinkpad X220 which features an i5-2410M processor at 2.3GHz - running a 64 bit Debian Wheezy. - {more} -

        -

        -
        - -
        -

        Preparing for launch

         - -
        Posted 13th December 2013 by Sam Tuke
        - -

        Mid December, giving season, and nearly time for the GnuPG - Crowdfunding to commence. We've been working hard on - preparations. Drafts of the new mobile website design have been published and met positive feedback, and a community-contibuted - promo video was posted on YouTube. GnuPG coverage on Twitter - continues to grow with many articles - (The - Guardian, Kaspersky - Labs, The - EFF, Lifehacker, - ...) and 252 new followers in 6 weeks.

        - -

        - Click here - to view the video on YouTube. [embedded video - removed on 2014-04-28 due to privacy issues]

        - -
        - - - -

        New mobile site draft

        -
        - -

        Last Friday I announced the crowdfunding to a crowded audience at - Berlin event - "Whatever - happened to privacy", and Markus Beckedahl - (Netzpolitik) - and Jacob - Appelbaum (Tor Project and Wikileaks) amplified the importance - of supporting the project. Hugo Roy (FSFE) gave a talk on Wednesday - about the campaign at the Paris - 'Hackadon' - a new conference for - Free Software giving, organised by three - crowdfunding - organisations. His slides are online in the - GPG presentations - repository.

        - -

        Hopefully the crowdfunding page on Goteo (a Free Software - Kickstarter) will be ready for launch next week. Email me if you can - help with translating the press release - we're aiming for at least - three languages. And don't forget you can still sign up for email - updates (form below). Thanks for all your support so far!

        - -

        [Subscribe code with references to external sites removed - on 2014-04-28 due to privacy issues.]

        - - -

        -
        - - -
        -

        Friends tell friends they love GnuPG

         - -
        Posted 13th November 2013 by Sam Tuke
        - -
        - -

        GnuPG can run almost anywhere

        -
        - -

        Email encryption is one of those pleasures that can't be enjoyed - alone. Sending yourself messages secured with 4096-bit RSA is great - for proof of concept, but meaningful communication requires two - parties. GnuPG requires both those parties to have their own - keys.

        - -

        Less than 1% of all email - traffic is PGP encrypted, meaning that those of us who do make our - messages private routinely find ourselves in the frustrating - predicament of having to share our thoughts insecurely, even though - we know they're being intercepted, even though this is easily - avoidable, and even though we've already taken steps to do so. All - because our friends and colleagues don't know the - benefits of GnuPG.

        - -

        Windows, Gnu/Linux, Mac, and Android all have point and click - GnuPG interfaces - at this point, all bases except iPhone are more - or less covered. That means the reason your contacts aren't OpenPGP - ready is not technical. And because GnuPG is Free - Software (and free of charge), it can't be about price.

        - -

        A recommendation from you is the most effective way you can - increase the number of GnuPG users, and consequently increase the - percentage of the messages you send that are meaningfully - encrypted. That's why we're asking people in our community to think - of pithy explanations of why GnuPG is important and how it enables - them.

        - -

        We've already got quotes from some big names like Bruce Schneier, - Jacob Appelbaum, and Richard Stallman. But the chances are - that your name carries more weight among your - peers. Please use it to share your appreciation for GnuPG!

        - -

        If you use social networks, you can - use #iloveGPG to connect your messages to other - people's, and make is easier for us to find and repeat them.

        - -

        Look out for weekly quotes posted from the - GnuPG Twitter - and Diaspora - accounts if you need inspiration. Let's fill up - the keyservers - with fresh keys from new users!

        - -

        -
        - -
        -

        Securing the future of GPG

         -
        Posted 5th November 2013 by Sam Tuke
        - -

        If you've noticed some changes around here, there's a good reason - why. We have a plan for securing the long term stability of GnuPG - development by giving more to our users, and asking more from them - in return.

        - -

        You already know that GnuPG is important, and as months of fresh - government spying revelations go by, it's becoming obvious that - GnuPG is one of the very few tools that can still be trusted to keep - our data safe from the overwhelming efforts of international law - enforcement. But developing GnuPG takes work - regular monitoring - for newfound threats and exploits, and new features to keep it sharp - with the latest encryption algorithms. We also need to reach out to - the millions of potential GnuPG users who are asking themselves how - they can make their email secure. Public-private key cryptography - hasn't yet gained mainstream acceptance, but it could if it were - just a little more appealing and accessible.

        - -

        To maintain progress within the project we need to make it easier - for GnuPG users to support the work that we do. Ours is an app that - is often hidden from view, relied upon daily by hundreds of - thousands of people, often in life-threatening circumstances, yet - low profile and rarely supported by publicity or donations.

        - -

        To change that we're going to launch a new - website with a fresh design, more friendly and accessible - information, and new resources to grow and strengthen our user - group. The new site will also allow the project to accept and manage - new forms of financial support, including automatic subscriptions to - sustain development long term.

        - -

        Designing, building and populating the new site will take a few - months, and in order to cover the costs there will be - a crowd-funding campaign with a modest target, in - early December. We have some rewards up our sleeves for those who - donate.

        - -

        When that time comes, we'll need your help - - telling your contacts, forwarding the announcement to your - communities, and contributing financially if you can.

        - -

        You can subscribe to updates about the campaign using this - form. This is separate to other GnuPG mailing lists - update will be - sent here, and only here.

        - -

        [Subscribe code with references to external sites removed - on 2014-04-28 due to privacy issues.]

        - -

        -
        - -
        -

        New blog, first post

         -
        Posted 30th October 2013 by Sam Tuke
        - -

        Welcome to Gnu Privacy Guard's new blog! We're planning some - major changes to gnupg.org and how the project communicates in - general. I'm Sam, and I'll be writing updates here as our work - progresses. In future this blog will be replaced with a more - beautiful and featureful alternative, but bear with us as we get - from here to there.

        - -

        For more timely updates you can follow our Twitter - accounts: @GnuPrivacyGuard - and @GnuPG. - That's right, we have two! But I'm going to combine them shortly so - it's easier to keep track [UPDATE: accounts now merged! - Stick with @GnuPG].

        - -

        For more information, see - our press - contact page hosted on Totem. That's all for now.

        - -

        -
        - - - -        		 
          
         
        -
          -
        - - - - - - - - - - - - -
         Technical resources for this
        - service are sponsered by        		 
          - OpenIT -  
        -
        - -

        - - Valid XHTML 1.0! -     - - Digital Respect for the Masses -     - - Peace! -     - - Valid CSS! -

        - - - -
        -
        - - - diff --git a/misc/blog.gnupg.org/index.org b/misc/blog.gnupg.org/index.org new file mode 100644 index 0000000..08f3e53 --- /dev/null +++ b/misc/blog.gnupg.org/index.org @@ -0,0 +1,22 @@ +# Index of all blog entries +#+STARTUP: showall + +#+HTML:

        The GnuPG blog

        + +#+HTML: +#+HTML: + +* List of all blog entries + :PROPERTIES: + :CUSTOM_ID: blogindex + :END: + +#+HTML: +#+HTML: + +* Comments + + We do not provide a feature to comment on a blog. Instead please + send remarks to the gnupg-users mailing list using the blog title + for the subject line. This helps to keep the discussion at one + place and not to spread it over different media. diff --git a/misc/blog.gnupg.org/upload b/misc/blog.gnupg.org/upload index b8396aa..795ebf2 100755 --- a/misc/blog.gnupg.org/upload +++ b/misc/blog.gnupg.org/upload @@ -7,7 +7,78 @@ if [ "$(pwd | awk -F/ '{print $NF}')" != "blog.gnupg.org" ]; then exit 1 fi -rsync -vr --links --exclude '*~' --exclude upload \ +echo "upload: Rendering entries" >&2 +# We need to initialize that org cache to use our own publish function +# despite that we do not use any org-publish feature +emacs --batch \ + --eval "(require 'assoc)" \ + --eval "(require 'org)" \ + --eval "(setq gpgweb-root-dir \"$(cd ../../web && pwd)/\")" \ + --eval "(require 'gpgweb (concat gpgweb-root-dir \"share/gpgweb.el\"))" \ + --eval "(setq org-publish-use-timestamps-flag nil)" \ + --eval "(setq org-export-html-toplevel-hlevel 1)" \ + --eval "(setq org-export-html-coding-system 'utf-8)" \ + --eval "(gpgweb-setup-project)" \ + --eval "(org-publish-initialize-cache \"gpgweb\")" \ + --eval "(gpgweb-publish-blogs)" + +if [ ! -f index.html ]; then + echo "upload: index.html has not yet been build" >&2; + exit 1 +fi + +# Find all rendered HTML files but skip possible translated versions. +find . -maxdepth 1 -type f -name "20*.html" -print \ + | grep -v '\.[a-z][a-z].html$' | sort -r >index.tmp +newest=$(head -1 index.tmp) + +# Extract the head lines +: >index.headlines.tmp +cat index.tmp | while read fname; do + echo -n "${fname#./}|" >>index.headlines.tmp + sed -n '/^

        ]*>\(.*\)

        ,\1,p' $fname >>index.headlines.tmp +done + +# Update the index file +echo "upload: Updating index.html" >&2 +awk -F: index.tmp \ + -v newest=${newest#./} ' + // {indon=1; print; insertnewest() } + // {indon=0} + // {indon=1; print; insertindex() } + // {indon=0} + !indon { print } + + function insertnewest () { + inblog = 0 + while (getline < newest) { + if (match ($0, /^
        /)) { inblog = 1; continue; } + if (match ($0, /^<\/main>/)) { inblog = 0; break; } + if (! inblog) { continue } + if (match ($0, /^
        /)) { continue; } + if (match ($0, /^<\/div>/)) { continue; } + print $0 + } + close(newest) + } + + function insertindex (tag) { + file = "index.headlines.tmp"; + print "
          " + while (getline < file) { + split($0, a, "|") + printf "
        • %s\n", a[1], a[2]; + } + print "
        " + close (file) + } + ' +mv index.tmp index.html || echo "upload: error updating index.html" >&2 +rm index.headlines.tmp + +echo "upload: Uploading files" >&2 +rsync -vr --links --exclude '*~' --exclude upload --exclude '*tmp' \ + --exclude '*.org' \ . werner at trithemius.gnupg.org:/var/www/www/www.gnupg.org/misc/blog/ #eof diff --git a/web/share/gpgweb.el b/web/share/gpgweb.el index 2091701..1e11a6a 100644 --- a/web/share/gpgweb.el +++ b/web/share/gpgweb.el @@ -208,15 +208,63 @@ if not available." "))) -(defun gpgweb-fixup-blog (info) - "Fix up a a blog entry." - (goto-char (point-min)) - (if (re-search-forward "^

        Posted " - (car (plist-get info :date)) - " by " - (car (plist-get info :author)) - "

        \n"))) +(defun gpgweb-blog-index (orgfile filelist) + "Return the index of ORGFILE in FILELIST or nil if not found." + (let (found + (i 0)) + (while (and filelist (not found)) + (if (string= orgfile (car filelist)) + (setq found i)) + (setq i (1+ i)) + (setq filelist (cdr filelist))) + found)) + +(defun gpgweb-blog-prev (fileidx filelist) + "Return the chronological previous file at FILEIDX from FILELIST +with the suffixed replaced by \"html\"." + (if (> fileidx 1) + (concat (file-name-sans-extension (nth (1- fileidx) filelist)) ".html"))) + +(defun gpgweb-blog-next (orgfile filelist) + "Return the chronological next file at FILEIDX from FILELIST +with the suffixed replaced by \"html\"." + (if (< fileidx (1- (length filelist))) + (concat (file-name-sans-extension (nth (1+ fileidx) filelist)) ".html"))) + +(defun gpgweb-fixup-blog (info orgfile filelist) + "Insert the blog specific content. INFO is the usual +plist. ORGFILE is the name of the current source file without the +directory part. If FILELIST is a list it has an ordered list of +org filenames." + (let ((authorstr (car (plist-get info :author))) + (datestr (car (plist-get info :date)))) + (goto-char (point-min)) + (if (re-search-forward "^
        " nil t) + (let* ((indexp (string= orgfile "index.org")) + (fileidx (if (listp filelist) + (if indexp + (1- (length filelist)) + (gpgweb-blog-index orgfile filelist)))) + (prevfile (if fileidx + (gpgweb-blog-prev fileidx filelist))) + (nextfile (if (and fileidx (not indexp)) + (gpgweb-blog-next fileidx filelist)))) + (move-beginning-of-line nil) + (insert "\n"))) + (if (and datestr authorstr) + (if (re-search-forward "^

        Posted " + datestr + " by " + authorstr + "

        \n"))))) (defun gpgweb-insert-footer () @@ -256,6 +304,11 @@ if not available." ;;; - Insert header and footer ;;; - Insert "class=selected" into the active menu entry ;;; - Fixup sitemap. +;;; +;;; If blogmode is not nil the output is rendered as a blog. BLOGMODE +;;; may then contain an ordered list of org file names which are used +;;; to create the previous and Next links for an entry. +;;; (defun gpgweb-postprocess-html (plist orgfile htmlfile blogmode) (let* ((visitingp (find-buffer-visiting htmlfile)) (work-buffer (or visitingp (find-file-noselect htmlfile))) @@ -270,7 +323,9 @@ if not available." (gpgweb-insert-header title committed-at) (gpgweb-insert-menu fname-2) (if blogmode - (gpgweb-fixup-blog plist)) + (gpgweb-fixup-blog plist + (file-name-nondirectory orgfile) + blogmode)) (gpgweb-insert-footer) ; Fixup the sitemap @@ -305,9 +360,10 @@ if not available." ;;; -;;; The specialized publisher for the blog entries. +;;; Turn the current buffer which has an org-mode blog entry into its +;;; rendered form and save it with the suffix .html. ;;; -(defun gpgweb-render-blob () +(defun gpgweb-render-blog (&optional filelist) (interactive) (let* ((extplist '(:language "en" :section-numbers nil @@ -316,7 +372,23 @@ if not available." (orgfile (buffer-file-name)) (plist (org-export-get-environment 'gpgweb nil extplist)) (htmlfile (org-gpgweb-export-to-html nil nil nil t extplist))) - (gpgweb-postprocess-html plist orgfile htmlfile t))) + (gpgweb-postprocess-html plist orgfile htmlfile (if filelist filelist t)))) + + +;;; +;;; Publish all blog entries in the current directory +;;; +(defun gpgweb-publish-blogs () + (interactive) + (let ((orgfiles (directory-files "." nil "^2[0-9]+-.*\.org$"))) + (dolist (file (cons "index.org" orgfiles)) + (let* ((visitingp (find-buffer-visiting file)) + (work-buffer (or visitingp (find-file-noselect file)))) + (with-current-buffer work-buffer + (gpgweb-render-blog orgfiles) + (basic-save-buffer)) + (unless visitingp + (kill-buffer work-buffer)))))) ----------------------------------------------------------------------- Summary of changes: .gitignore | 3 + README | 32 ++ misc/blog.gnupg.org/index.html | 886 ---------------------------------------- misc/blog.gnupg.org/index.org | 22 + misc/blog.gnupg.org/upload | 73 +++- web/donate/index.org | 11 +- web/share/gpgweb.el | 102 ++++- web/swdb.mac | 18 +- 8 files changed, 234 insertions(+), 913 deletions(-) delete mode 100644 misc/blog.gnupg.org/index.html create mode 100644 misc/blog.gnupg.org/index.org hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Fri Dec 12 12:50:59 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 12 Dec 2014 12:50:59 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-72-gf3f9f9b Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via f3f9f9b2844c35f7942ee904d5222523615cdad4 (commit) from 193815030d20716d9a97850013ac3cc8749022c9 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit f3f9f9b2844c35f7942ee904d5222523615cdad4 Author: Werner Koch Date: Fri Dec 12 12:35:45 2014 +0100 gpg: Let --card--status create a shadow key (card key stub). * agent/command.c (cmd_learn): Add option --sendinfo. * agent/learncard.c (agent_handle_learn): Add arg "send" andsend certifciate only if that is set. * g10/call-agent.c (agent_scd_learn): Use --sendinfo. Make INFO optional. (agent_learn): Remove. * g10/keygen.c (gen_card_key): Replace agent_learn by agent_scd_learn. -- The requirement of using --card-status on the first use of card on a new box is a bit annoying but the alternative of always checking whether a card is available before a decryption starts does not sound promising either. Signed-off-by: Werner Koch diff --git a/agent/agent.h b/agent/agent.h index 0c83b27..a1663cd 100644 --- a/agent/agent.h +++ b/agent/agent.h @@ -492,7 +492,7 @@ int agent_card_scd (ctrl_t ctrl, const char *cmdline, /*-- learncard.c --*/ -int agent_handle_learn (ctrl_t ctrl, void *assuan_context); +int agent_handle_learn (ctrl_t ctrl, int send, void *assuan_context); #endif /*AGENT_H*/ diff --git a/agent/command.c b/agent/command.c index 3e80663..c875f55 100644 --- a/agent/command.c +++ b/agent/command.c @@ -1619,21 +1619,26 @@ cmd_get_confirmation (assuan_context_t ctx, char *line) static const char hlp_learn[] = - "LEARN [--send]\n" + "LEARN [--send][--sendinfo]\n" "\n" "Learn something about the currently inserted smartcard. With\n" - "--send the new certificates are send back."; + "--sendinfo information about the card is returned; with --send\n" + "the available certificates are returned as D lines."; static gpg_error_t cmd_learn (assuan_context_t ctx, char *line) { ctrl_t ctrl = assuan_get_pointer (ctx); - int rc; + gpg_error_t err; + int send, sendinfo; + + send = has_option (line, "--send"); + sendinfo = send? 1 : has_option (line, "--sendinfo"); if (ctrl->restricted) return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN)); - rc = agent_handle_learn (ctrl, has_option (line, "--send")? ctx : NULL); - return leave_cmd (ctx, rc); + err = agent_handle_learn (ctrl, send, sendinfo? ctx : NULL); + return leave_cmd (ctx, err); } diff --git a/agent/learncard.c b/agent/learncard.c index c60b3f4..62569ce 100644 --- a/agent/learncard.c +++ b/agent/learncard.c @@ -296,10 +296,10 @@ send_cert_back (ctrl_t ctrl, const char *id, void *assuan_context) return 0; } -/* Perform the learn operation. If ASSUAN_CONTEXT is not NULL all new - certificates are send back via Assuan. */ +/* Perform the learn operation. If ASSUAN_CONTEXT is not NULL and + SEND is true all new certificates are send back via Assuan. */ int -agent_handle_learn (ctrl_t ctrl, void *assuan_context) +agent_handle_learn (ctrl_t ctrl, int send, void *assuan_context) { int rc; @@ -369,7 +369,7 @@ agent_handle_learn (ctrl_t ctrl, void *assuan_context) log_info (" id: %s (type=%d)\n", citem->id, citem->type); - if (assuan_context) + if (assuan_context && send) { rc = send_cert_back (ctrl, citem->id, assuan_context); if (rc) @@ -439,9 +439,9 @@ agent_handle_learn (ctrl_t ctrl, void *assuan_context) } if (opt.verbose) - log_info ("stored\n"); + log_info (" id: %s - shadow key created\n", item->id); - if (assuan_context) + if (assuan_context && send) { CERTINFO citem; diff --git a/g10/call-agent.c b/g10/call-agent.c index f5c943d..43a5c4e 100644 --- a/g10/call-agent.c +++ b/g10/call-agent.c @@ -655,6 +655,7 @@ agent_scd_learn (struct agent_card_info_s *info) { int rc; struct default_inq_parm_s parm; + struct agent_card_info_s dummyinfo; memset (&parm, 0, sizeof parm); @@ -674,39 +675,22 @@ agent_scd_learn (struct agent_card_info_s *info) if (rc) return rc; + if (!info) + info = &dummyinfo; + parm.ctx = agent_ctx; memset (info, 0, sizeof *info); - rc = assuan_transact (agent_ctx, "SCD LEARN --force", + rc = assuan_transact (agent_ctx, "LEARN --sendinfo", dummy_data_cb, NULL, default_inq_cb, &parm, learn_status_cb, info); /* Also try to get the key attributes. */ if (!rc) agent_scd_getattr ("KEY-ATTR", info); - return rc; -} - - -/* Call the agent to learn about the current smartcard. This is - currently only used to have the agent create the shadow key. */ -gpg_error_t -agent_learn (void) -{ - gpg_error_t err; - struct default_inq_parm_s parm; - - memset (&parm, 0, sizeof parm); - - err = start_agent (NULL, 1); - if (err) - return err; - - parm.ctx = agent_ctx; - err = assuan_transact (agent_ctx, "LEARN", - dummy_data_cb, NULL, default_inq_cb, &parm, - NULL, NULL); + if (info == &dummyinfo) + agent_release_card_info (info); - return err; + return rc; } diff --git a/g10/call-agent.h b/g10/call-agent.h index a99cac9..a24941e 100644 --- a/g10/call-agent.h +++ b/g10/call-agent.h @@ -78,9 +78,6 @@ void agent_release_card_info (struct agent_card_info_s *info); /* Return card info. */ int agent_scd_learn (struct agent_card_info_s *info); -/* Let the agent learn about the current card. */ -gpg_error_t agent_learn (void); - /* Update INFO with the attribute NAME. */ int agent_scd_getattr (const char *name, struct agent_card_info_s *info); diff --git a/g10/keygen.c b/g10/keygen.c index 89cc255..c25caad 100644 --- a/g10/keygen.c +++ b/g10/keygen.c @@ -4447,7 +4447,7 @@ gen_card_key (int algo, int keyno, int is_primary, kbnode_t pub_root, /* Send the learn command so that the agent creates a shadow key for card key. We need to do that now so that we are able to create the self-signatures. */ - err = agent_learn (); + err = agent_scd_learn (NULL); if (err) { /* Oops: Card removed during generation. */ ----------------------------------------------------------------------- Summary of changes: agent/agent.h | 2 +- agent/command.c | 15 ++++++++++----- agent/learncard.c | 12 ++++++------ g10/call-agent.c | 32 ++++++++------------------------ g10/call-agent.h | 3 --- g10/keygen.c | 2 +- 6 files changed, 26 insertions(+), 40 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Dec 12 23:50:34 2014 From: cvs at cvs.gnupg.org (by Jussi Kivilinna) Date: Fri, 12 Dec 2014 23:50:34 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-134-g4f46374 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via 4f46374502eb988d701b904f83819e2cf7b1755c (commit) via 4a0795af021305f9240f23626a3796157db46bd7 (commit) from cbf4c8cb6bbda15eea61885279f2a6f1d4bcedfd (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 4f46374502eb988d701b904f83819e2cf7b1755c Author: Jussi Kivilinna Date: Sat Dec 6 15:09:13 2014 +0200 rijndael: further optimizations for AES-NI accelerated CBC and CFB bulk modes * cipher/rijndael-aesni.c (do_aesni_enc, do_aesni_dec): Pass input/output through SSE register XMM0. (do_aesni_cfb): Remove. (_gcry_aes_aesni_encrypt, _gcry_aes_aesni_decrypt): Add loading/storing input/output to/from XMM0. (_gcry_aes_aesni_cfb_enc, _gcry_aes_aesni_cbc_enc) (_gcry_aes_aesni_cfb_dec): Update to use renewed 'do_aesni_enc' and move IV loading/storing outside loop. (_gcry_aes_aesni_cbc_dec): Update to use renewed 'do_aesni_dec'. -- CBC encryption speed is improved ~16% on Intel Haswell and CFB encryption ~8%. Signed-off-by: Jussi Kivilinna diff --git a/cipher/rijndael-aesni.c b/cipher/rijndael-aesni.c index e6c1051..3c367ce 100644 --- a/cipher/rijndael-aesni.c +++ b/cipher/rijndael-aesni.c @@ -340,33 +340,14 @@ _gcry_aes_aesni_prepare_decryption (RIJNDAEL_context *ctx) } -/* Encrypt one block using the Intel AES-NI instructions. A and B may - be the same. - - Our problem here is that gcc does not allow the "x" constraint for - SSE registers in asm unless you compile with -msse. The common - wisdom is to use a separate file for SSE instructions and build it - separately. This would require a lot of extra build system stuff, - similar to what we do in mpi/ for the asm stuff. What we do - instead is to use standard registers and a bit more of plain asm - which copies the data and key stuff to the SSE registers and later - back. If we decide to implement some block modes with parallelized - AES instructions, it might indeed be better to use plain asm ala - mpi/. */ +/* Encrypt one block using the Intel AES-NI instructions. Block is input + * and output through SSE register xmm0. */ static inline void -do_aesni_enc (const RIJNDAEL_context *ctx, unsigned char *b, - const unsigned char *a) +do_aesni_enc (const RIJNDAEL_context *ctx) { #define aesenc_xmm1_xmm0 ".byte 0x66, 0x0f, 0x38, 0xdc, 0xc1\n\t" #define aesenclast_xmm1_xmm0 ".byte 0x66, 0x0f, 0x38, 0xdd, 0xc1\n\t" - /* Note: For now we relax the alignment requirement for A and B: It - does not make much difference because in many case we would need - to memcpy them to an extra buffer; using the movdqu is much faster - that memcpy and movdqa. For CFB we know that the IV is properly - aligned but that is a special case. We should better implement - CFB direct in asm. */ - asm volatile ("movdqu %[src], %%xmm0\n\t" /* xmm0 := *a */ - "movdqa (%[key]), %%xmm1\n\t" /* xmm1 := key[0] */ + asm volatile ("movdqa (%[key]), %%xmm1\n\t" /* xmm1 := key[0] */ "pxor %%xmm1, %%xmm0\n\t" /* xmm0 ^= key[0] */ "movdqa 0x10(%[key]), %%xmm1\n\t" aesenc_xmm1_xmm0 @@ -402,10 +383,9 @@ do_aesni_enc (const RIJNDAEL_context *ctx, unsigned char *b, ".Lenclast%=:\n\t" aesenclast_xmm1_xmm0 - "movdqu %%xmm0, %[dst]\n" - : [dst] "=m" (*b) - : [src] "m" (*a), - [key] "r" (ctx->keyschenc), + "\n" + : + : [key] "r" (ctx->keyschenc), [rounds] "r" (ctx->rounds) : "cc", "memory"); #undef aesenc_xmm1_xmm0 @@ -413,14 +393,14 @@ do_aesni_enc (const RIJNDAEL_context *ctx, unsigned char *b, } +/* Decrypt one block using the Intel AES-NI instructions. Block is input + * and output through SSE register xmm0. */ static inline void -do_aesni_dec (const RIJNDAEL_context *ctx, unsigned char *b, - const unsigned char *a) +do_aesni_dec (const RIJNDAEL_context *ctx) { #define aesdec_xmm1_xmm0 ".byte 0x66, 0x0f, 0x38, 0xde, 0xc1\n\t" #define aesdeclast_xmm1_xmm0 ".byte 0x66, 0x0f, 0x38, 0xdf, 0xc1\n\t" - asm volatile ("movdqu %[src], %%xmm0\n\t" /* xmm0 := *a */ - "movdqa (%[key]), %%xmm1\n\t" + asm volatile ("movdqa (%[key]), %%xmm1\n\t" "pxor %%xmm1, %%xmm0\n\t" /* xmm0 ^= key[0] */ "movdqa 0x10(%[key]), %%xmm1\n\t" aesdec_xmm1_xmm0 @@ -456,10 +436,9 @@ do_aesni_dec (const RIJNDAEL_context *ctx, unsigned char *b, ".Ldeclast%=:\n\t" aesdeclast_xmm1_xmm0 - "movdqu %%xmm0, %[dst]\n" - : [dst] "=m" (*b) - : [src] "m" (*a), - [key] "r" (ctx->keyschdec), + "\n" + : + : [key] "r" (ctx->keyschdec), [rounds] "r" (ctx->rounds) : "cc", "memory"); #undef aesdec_xmm1_xmm0 @@ -685,74 +664,6 @@ do_aesni_dec_vec4 (const RIJNDAEL_context *ctx) } -/* Perform a CFB encryption or decryption round using the - initialization vector IV and the input block A. Write the result - to the output block B and update IV. IV needs to be 16 byte - aligned. */ -static inline void -do_aesni_cfb (const RIJNDAEL_context *ctx, int decrypt_flag, - unsigned char *iv, unsigned char *b, const unsigned char *a) -{ -#define aesenc_xmm1_xmm0 ".byte 0x66, 0x0f, 0x38, 0xdc, 0xc1\n\t" -#define aesenclast_xmm1_xmm0 ".byte 0x66, 0x0f, 0x38, 0xdd, 0xc1\n\t" - asm volatile ("movdqa %[iv], %%xmm0\n\t" /* xmm0 := IV */ - "movdqa (%[key]), %%xmm1\n\t" /* xmm1 := key[0] */ - "pxor %%xmm1, %%xmm0\n\t" /* xmm0 ^= key[0] */ - "movdqa 0x10(%[key]), %%xmm1\n\t" - aesenc_xmm1_xmm0 - "movdqa 0x20(%[key]), %%xmm1\n\t" - aesenc_xmm1_xmm0 - "movdqa 0x30(%[key]), %%xmm1\n\t" - aesenc_xmm1_xmm0 - "movdqa 0x40(%[key]), %%xmm1\n\t" - aesenc_xmm1_xmm0 - "movdqa 0x50(%[key]), %%xmm1\n\t" - aesenc_xmm1_xmm0 - "movdqa 0x60(%[key]), %%xmm1\n\t" - aesenc_xmm1_xmm0 - "movdqa 0x70(%[key]), %%xmm1\n\t" - aesenc_xmm1_xmm0 - "movdqa 0x80(%[key]), %%xmm1\n\t" - aesenc_xmm1_xmm0 - "movdqa 0x90(%[key]), %%xmm1\n\t" - aesenc_xmm1_xmm0 - "movdqa 0xa0(%[key]), %%xmm1\n\t" - "cmpl $10, %[rounds]\n\t" - "jz .Lenclast%=\n\t" - aesenc_xmm1_xmm0 - "movdqa 0xb0(%[key]), %%xmm1\n\t" - aesenc_xmm1_xmm0 - "movdqa 0xc0(%[key]), %%xmm1\n\t" - "cmpl $12, %[rounds]\n\t" - "jz .Lenclast%=\n\t" - aesenc_xmm1_xmm0 - "movdqa 0xd0(%[key]), %%xmm1\n\t" - aesenc_xmm1_xmm0 - "movdqa 0xe0(%[key]), %%xmm1\n" - - ".Lenclast%=:\n\t" - aesenclast_xmm1_xmm0 - "movdqu %[src], %%xmm1\n\t" /* Save input. */ - "pxor %%xmm1, %%xmm0\n\t" /* xmm0 = input ^ IV */ - - "cmpl $1, %[decrypt]\n\t" - "jz .Ldecrypt_%=\n\t" - "movdqa %%xmm0, %[iv]\n\t" /* [encrypt] Store IV. */ - "jmp .Lleave_%=\n" - ".Ldecrypt_%=:\n\t" - "movdqa %%xmm1, %[iv]\n" /* [decrypt] Store IV. */ - ".Lleave_%=:\n\t" - "movdqu %%xmm0, %[dst]\n" /* Store output. */ - : [iv] "+m" (*iv), [dst] "=m" (*b) - : [src] "m" (*a), - [key] "r" (ctx->keyschenc), - [rounds] "g" (ctx->rounds), - [decrypt] "m" (decrypt_flag) - : "cc", "memory"); -#undef aesenc_xmm1_xmm0 -#undef aesenclast_xmm1_xmm0 -} - /* Perform a CTR encryption round using the counter CTR and the input block A. Write the result to the output block B and update CTR. CTR needs to be a 16 byte aligned little-endian value. */ @@ -1026,7 +937,15 @@ _gcry_aes_aesni_encrypt (const RIJNDAEL_context *ctx, unsigned char *dst, const unsigned char *src) { aesni_prepare (); - do_aesni_enc (ctx, dst, src); + asm volatile ("movdqu %[src], %%xmm0\n\t" + : + : [src] "m" (*src) + : "memory" ); + do_aesni_enc (ctx); + asm volatile ("movdqu %%xmm0, %[dst]\n\t" + : [dst] "=m" (*dst) + : + : "memory" ); aesni_cleanup (); return 0; } @@ -1038,12 +957,32 @@ _gcry_aes_aesni_cfb_enc (RIJNDAEL_context *ctx, unsigned char *outbuf, size_t nblocks) { aesni_prepare (); + + asm volatile ("movdqu %[iv], %%xmm0\n\t" + : /* No output */ + : [iv] "m" (*iv) + : "memory" ); + for ( ;nblocks; nblocks-- ) { - do_aesni_cfb (ctx, 0, iv, outbuf, inbuf); + do_aesni_enc (ctx); + + asm volatile ("movdqu %[inbuf], %%xmm1\n\t" + "pxor %%xmm1, %%xmm0\n\t" + "movdqu %%xmm0, %[outbuf]\n\t" + : [outbuf] "=m" (*outbuf) + : [inbuf] "m" (*inbuf) + : "memory" ); + outbuf += BLOCKSIZE; inbuf += BLOCKSIZE; } + + asm volatile ("movdqu %%xmm0, %[iv]\n\t" + : [iv] "=m" (*iv) + : + : "memory" ); + aesni_cleanup (); } @@ -1053,45 +992,41 @@ _gcry_aes_aesni_cbc_enc (RIJNDAEL_context *ctx, unsigned char *outbuf, const unsigned char *inbuf, unsigned char *iv, size_t nblocks, int cbc_mac) { - unsigned char *last_iv; - aesni_prepare (); - last_iv = iv; + asm volatile ("movdqu %[iv], %%xmm5\n\t" + : /* No output */ + : [iv] "m" (*iv) + : "memory" ); for ( ;nblocks; nblocks-- ) { - /* ~35% speed up on Sandy-Bridge when doing xoring and copying with - SSE registers. */ - asm volatile ("movdqu %[iv], %%xmm0\n\t" - "movdqu %[inbuf], %%xmm1\n\t" - "pxor %%xmm0, %%xmm1\n\t" - "movdqu %%xmm1, %[outbuf]\n\t" + asm volatile ("movdqu %[inbuf], %%xmm0\n\t" + "pxor %%xmm5, %%xmm0\n\t" : /* No output */ - : [iv] "m" (*last_iv), - [inbuf] "m" (*inbuf), - [outbuf] "m" (*outbuf) + : [inbuf] "m" (*inbuf) : "memory" ); - do_aesni_enc (ctx, outbuf, outbuf); + do_aesni_enc (ctx); + + asm volatile ("movdqa %%xmm0, %%xmm5\n\t" + "movdqu %%xmm0, %[outbuf]\n\t" + : [outbuf] "=m" (*outbuf) + : + : "memory" ); - last_iv = outbuf; inbuf += BLOCKSIZE; if (!cbc_mac) outbuf += BLOCKSIZE; } - if (last_iv != iv) - { - asm volatile ("movdqu %[last], %%xmm0\n\t" - "movdqu %%xmm0, %[iv]\n\t" - : /* No output */ - : [last] "m" (*last_iv), - [iv] "m" (*iv) - : "memory" ); - } + asm volatile ("movdqu %%xmm5, %[iv]\n\t" + : [iv] "=m" (*iv) + : + : "memory" ); aesni_cleanup (); + aesni_cleanup_2_6 (); } @@ -1134,7 +1069,15 @@ _gcry_aes_aesni_decrypt (const RIJNDAEL_context *ctx, unsigned char *dst, const unsigned char *src) { aesni_prepare (); - do_aesni_dec (ctx, dst, src); + asm volatile ("movdqu %[src], %%xmm0\n\t" + : + : [src] "m" (*src) + : "memory" ); + do_aesni_dec (ctx); + asm volatile ("movdqu %%xmm0, %[dst]\n\t" + : [dst] "=m" (*dst) + : + : "memory" ); aesni_cleanup (); return 0; } @@ -1147,19 +1090,23 @@ _gcry_aes_aesni_cfb_dec (RIJNDAEL_context *ctx, unsigned char *outbuf, { aesni_prepare (); + asm volatile ("movdqu %[iv], %%xmm6\n\t" + : /* No output */ + : [iv] "m" (*iv) + : "memory" ); + /* CFB decryption can be parallelized */ for ( ;nblocks >= 4; nblocks -= 4) { asm volatile - ("movdqu (%[iv]), %%xmm1\n\t" /* load input blocks */ + ("movdqu %%xmm6, %%xmm1\n\t" /* load input blocks */ "movdqu 0*16(%[inbuf]), %%xmm2\n\t" "movdqu 1*16(%[inbuf]), %%xmm3\n\t" "movdqu 2*16(%[inbuf]), %%xmm4\n\t" - "movdqu 3*16(%[inbuf]), %%xmm0\n\t" /* update IV */ - "movdqu %%xmm0, (%[iv])\n\t" + "movdqu 3*16(%[inbuf]), %%xmm6\n\t" /* update IV */ : /* No output */ - : [inbuf] "r" (inbuf), [iv] "r" (iv) + : [inbuf] "r" (inbuf) : "memory"); do_aesni_enc_vec4 (ctx); @@ -1190,12 +1137,29 @@ _gcry_aes_aesni_cfb_dec (RIJNDAEL_context *ctx, unsigned char *outbuf, inbuf += 4*BLOCKSIZE; } + asm volatile ("movdqu %%xmm6, %%xmm0\n\t" ::: "cc"); + for ( ;nblocks; nblocks-- ) { - do_aesni_cfb (ctx, 1, iv, outbuf, inbuf); + do_aesni_enc (ctx); + + asm volatile ("movdqa %%xmm0, %%xmm6\n\t" + "movdqu %[inbuf], %%xmm0\n\t" + "pxor %%xmm0, %%xmm6\n\t" + "movdqu %%xmm6, %[outbuf]\n\t" + : [outbuf] "=m" (*outbuf) + : [inbuf] "m" (*inbuf) + : "memory" ); + outbuf += BLOCKSIZE; inbuf += BLOCKSIZE; } + + asm volatile ("movdqu %%xmm0, %[iv]\n\t" + : [iv] "=m" (*iv) + : + : "memory" ); + aesni_cleanup (); aesni_cleanup_2_6 (); } @@ -1256,21 +1220,21 @@ _gcry_aes_aesni_cbc_dec (RIJNDAEL_context *ctx, unsigned char *outbuf, for ( ;nblocks; nblocks-- ) { asm volatile - ("movdqu %[inbuf], %%xmm2\n\t" /* use xmm2 as savebuf */ + ("movdqu %[inbuf], %%xmm0\n\t" + "movdqa %%xmm0, %%xmm2\n\t" /* use xmm2 as savebuf */ : /* No output */ : [inbuf] "m" (*inbuf) : "memory"); /* uses only xmm0 and xmm1 */ - do_aesni_dec (ctx, outbuf, inbuf); + do_aesni_dec (ctx); asm volatile - ("movdqu %[outbuf], %%xmm0\n\t" - "pxor %%xmm5, %%xmm0\n\t" /* xor IV with output */ + ("pxor %%xmm5, %%xmm0\n\t" /* xor IV with output */ "movdqu %%xmm0, %[outbuf]\n\t" "movdqu %%xmm2, %%xmm5\n\t" /* store savebuf as new IV */ - : /* No output */ - : [outbuf] "m" (*outbuf) + : [outbuf] "=m" (*outbuf) + : : "memory"); outbuf += BLOCKSIZE; commit 4a0795af021305f9240f23626a3796157db46bd7 Author: Jussi Kivilinna Date: Sat Dec 6 10:38:36 2014 +0200 GCM: move Intel PCLMUL accelerated implementation to separate file * cipher/Makefile.am: Add 'cipher-gcm-intel-pclmul.c'. * cipher/cipher-gcm-intel-pclmul.c: New. * cipher/cipher-gcm.c [GCM_USE_INTEL_PCLMUL] (_gcry_ghash_setup_intel_pclmul, _gcry_ghash_intel_pclmul): New prototypes. [GCM_USE_INTEL_PCLMUL] (gfmul_pclmul, gfmul_pclmul_aggr4): Move to 'cipher-gcm-intel-pclmul.c'. (ghash): Rename to... (ghash_internal): ...this and move GCM_USE_INTEL_PCLMUL part to new function in 'cipher-gcm-intel-pclmul.c'. (setupM): Move GCM_USE_INTEL_PCLMUL part to new function in 'cipher-gcm-intel-pclmul.c'; Add selection of ghash function based on available HW acceleration. (do_ghash_buf): Change use of 'ghash' to 'c->u_mode.gcm.ghash_fn'. * cipher/internal.h (ghash_fn_t): New. (gcry_cipher_handle): Remove 'use_intel_pclmul'; Add 'ghash_fn'. -- Signed-off-by: Jussi Kivilinna diff --git a/cipher/Makefile.am b/cipher/Makefile.am index d7e7773..98142ed 100644 --- a/cipher/Makefile.am +++ b/cipher/Makefile.am @@ -40,8 +40,8 @@ libcipher_la_LIBADD = $(GCRYPT_MODULES) libcipher_la_SOURCES = \ cipher.c cipher-internal.h \ cipher-cbc.c cipher-cfb.c cipher-ofb.c cipher-ctr.c cipher-aeswrap.c \ -cipher-ccm.c cipher-cmac.c cipher-gcm.c cipher-poly1305.c \ -cipher-selftest.c cipher-selftest.h \ +cipher-ccm.c cipher-cmac.c cipher-gcm.c cipher-gcm-intel-pclmul.c \ +cipher-poly1305.c cipher-selftest.c cipher-selftest.h \ pubkey.c pubkey-internal.h pubkey-util.c \ md.c \ mac.c mac-internal.h \ diff --git a/cipher/cipher-gcm-intel-pclmul.c b/cipher/cipher-gcm-intel-pclmul.c new file mode 100644 index 0000000..02e7701 --- /dev/null +++ b/cipher/cipher-gcm-intel-pclmul.c @@ -0,0 +1,395 @@ +/* cipher-gcm-intel-pclmul.c - Intel PCLMUL accelerated Galois Counter Mode + * implementation + * Copyright (C) 2013-2014 Jussi Kivilinna + * + * This file is part of Libgcrypt. + * + * Libgcrypt is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser general Public License as + * published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * Libgcrypt is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this program; if not, see . + */ + +#include +#include +#include +#include +#include + +#include "g10lib.h" +#include "cipher.h" +#include "bufhelp.h" +#include "./cipher-internal.h" + + +#ifdef GCM_USE_INTEL_PCLMUL + +/* + Intel PCLMUL ghash based on white paper: + "Intel? Carry-Less Multiplication Instruction and its Usage for Computing the + GCM Mode - Rev 2.01"; Shay Gueron, Michael E. Kounavis. + */ +static inline void gfmul_pclmul(void) +{ + /* Input: XMM0 and XMM1, Output: XMM1. Input XMM0 stays unmodified. + Input must be converted to little-endian. + */ + asm volatile (/* gfmul, xmm0 has operator a and xmm1 has operator b. */ + "pshufd $78, %%xmm0, %%xmm2\n\t" + "pshufd $78, %%xmm1, %%xmm4\n\t" + "pxor %%xmm0, %%xmm2\n\t" /* xmm2 holds a0+a1 */ + "pxor %%xmm1, %%xmm4\n\t" /* xmm4 holds b0+b1 */ + + "movdqa %%xmm0, %%xmm3\n\t" + "pclmulqdq $0, %%xmm1, %%xmm3\n\t" /* xmm3 holds a0*b0 */ + "movdqa %%xmm0, %%xmm6\n\t" + "pclmulqdq $17, %%xmm1, %%xmm6\n\t" /* xmm6 holds a1*b1 */ + "movdqa %%xmm3, %%xmm5\n\t" + "pclmulqdq $0, %%xmm2, %%xmm4\n\t" /* xmm4 holds (a0+a1)*(b0+b1) */ + + "pxor %%xmm6, %%xmm5\n\t" /* xmm5 holds a0*b0+a1*b1 */ + "pxor %%xmm5, %%xmm4\n\t" /* xmm4 holds a0*b0+a1*b1+(a0+a1)*(b0+b1) */ + "movdqa %%xmm4, %%xmm5\n\t" + "psrldq $8, %%xmm4\n\t" + "pslldq $8, %%xmm5\n\t" + "pxor %%xmm5, %%xmm3\n\t" + "pxor %%xmm4, %%xmm6\n\t" /* holds the result of the + carry-less multiplication of xmm0 + by xmm1 */ + + /* shift the result by one bit position to the left cope for + the fact that bits are reversed */ + "movdqa %%xmm3, %%xmm4\n\t" + "movdqa %%xmm6, %%xmm5\n\t" + "pslld $1, %%xmm3\n\t" + "pslld $1, %%xmm6\n\t" + "psrld $31, %%xmm4\n\t" + "psrld $31, %%xmm5\n\t" + "movdqa %%xmm4, %%xmm1\n\t" + "pslldq $4, %%xmm5\n\t" + "pslldq $4, %%xmm4\n\t" + "psrldq $12, %%xmm1\n\t" + "por %%xmm4, %%xmm3\n\t" + "por %%xmm5, %%xmm6\n\t" + "por %%xmm6, %%xmm1\n\t" + + /* first phase of the reduction */ + "movdqa %%xmm3, %%xmm6\n\t" + "movdqa %%xmm3, %%xmm7\n\t" + "pslld $31, %%xmm6\n\t" /* packed right shifting << 31 */ + "movdqa %%xmm3, %%xmm5\n\t" + "pslld $30, %%xmm7\n\t" /* packed right shifting shift << 30 */ + "pslld $25, %%xmm5\n\t" /* packed right shifting shift << 25 */ + "pxor %%xmm7, %%xmm6\n\t" /* xor the shifted versions */ + "pxor %%xmm5, %%xmm6\n\t" + "movdqa %%xmm6, %%xmm7\n\t" + "pslldq $12, %%xmm6\n\t" + "psrldq $4, %%xmm7\n\t" + "pxor %%xmm6, %%xmm3\n\t" /* first phase of the reduction + complete */ + + /* second phase of the reduction */ + "movdqa %%xmm3, %%xmm2\n\t" + "movdqa %%xmm3, %%xmm4\n\t" + "psrld $1, %%xmm2\n\t" /* packed left shifting >> 1 */ + "movdqa %%xmm3, %%xmm5\n\t" + "psrld $2, %%xmm4\n\t" /* packed left shifting >> 2 */ + "psrld $7, %%xmm5\n\t" /* packed left shifting >> 7 */ + "pxor %%xmm4, %%xmm2\n\t" /* xor the shifted versions */ + "pxor %%xmm5, %%xmm2\n\t" + "pxor %%xmm7, %%xmm2\n\t" + "pxor %%xmm2, %%xmm3\n\t" + "pxor %%xmm3, %%xmm1\n\t" /* the result is in xmm1 */ + ::: "cc" ); +} + + +#ifdef __x86_64__ +static inline void gfmul_pclmul_aggr4(void) +{ + /* Input: + H?: XMM0 X_i : XMM6 + H?: XMM8 X_(i-1) : XMM3 + H?: XMM9 X_(i-2) : XMM2 + H?: XMM10 X_(i-3)?Y_(i-4): XMM1 + Output: + Y_i: XMM1 + Inputs XMM0 stays unmodified. + Input must be converted to little-endian. + */ + asm volatile (/* perform clmul and merge results... */ + "pshufd $78, %%xmm10, %%xmm11\n\t" + "pshufd $78, %%xmm1, %%xmm12\n\t" + "pxor %%xmm10, %%xmm11\n\t" /* xmm11 holds 4:a0+a1 */ + "pxor %%xmm1, %%xmm12\n\t" /* xmm12 holds 4:b0+b1 */ + + "pshufd $78, %%xmm9, %%xmm13\n\t" + "pshufd $78, %%xmm2, %%xmm14\n\t" + "pxor %%xmm9, %%xmm13\n\t" /* xmm13 holds 3:a0+a1 */ + "pxor %%xmm2, %%xmm14\n\t" /* xmm14 holds 3:b0+b1 */ + + "pshufd $78, %%xmm8, %%xmm5\n\t" + "pshufd $78, %%xmm3, %%xmm15\n\t" + "pxor %%xmm8, %%xmm5\n\t" /* xmm1 holds 2:a0+a1 */ + "pxor %%xmm3, %%xmm15\n\t" /* xmm2 holds 2:b0+b1 */ + + "movdqa %%xmm10, %%xmm4\n\t" + "movdqa %%xmm9, %%xmm7\n\t" + "pclmulqdq $0, %%xmm1, %%xmm4\n\t" /* xmm4 holds 4:a0*b0 */ + "pclmulqdq $0, %%xmm2, %%xmm7\n\t" /* xmm7 holds 3:a0*b0 */ + "pclmulqdq $17, %%xmm10, %%xmm1\n\t" /* xmm1 holds 4:a1*b1 */ + "pclmulqdq $17, %%xmm9, %%xmm2\n\t" /* xmm9 holds 3:a1*b1 */ + "pclmulqdq $0, %%xmm11, %%xmm12\n\t" /* xmm12 holds 4:(a0+a1)*(b0+b1) */ + "pclmulqdq $0, %%xmm13, %%xmm14\n\t" /* xmm14 holds 3:(a0+a1)*(b0+b1) */ + + "pshufd $78, %%xmm0, %%xmm10\n\t" + "pshufd $78, %%xmm6, %%xmm11\n\t" + "pxor %%xmm0, %%xmm10\n\t" /* xmm10 holds 1:a0+a1 */ + "pxor %%xmm6, %%xmm11\n\t" /* xmm11 holds 1:b0+b1 */ + + "pxor %%xmm4, %%xmm7\n\t" /* xmm7 holds 3+4:a0*b0 */ + "pxor %%xmm2, %%xmm1\n\t" /* xmm1 holds 3+4:a1*b1 */ + "pxor %%xmm14, %%xmm12\n\t" /* xmm12 holds 3+4:(a0+a1)*(b0+b1) */ + + "movdqa %%xmm8, %%xmm13\n\t" + "pclmulqdq $0, %%xmm3, %%xmm13\n\t" /* xmm13 holds 2:a0*b0 */ + "pclmulqdq $17, %%xmm8, %%xmm3\n\t" /* xmm3 holds 2:a1*b1 */ + "pclmulqdq $0, %%xmm5, %%xmm15\n\t" /* xmm15 holds 2:(a0+a1)*(b0+b1) */ + + "pxor %%xmm13, %%xmm7\n\t" /* xmm7 holds 2+3+4:a0*b0 */ + "pxor %%xmm3, %%xmm1\n\t" /* xmm1 holds 2+3+4:a1*b1 */ + "pxor %%xmm15, %%xmm12\n\t" /* xmm12 holds 2+3+4:(a0+a1)*(b0+b1) */ + + "movdqa %%xmm0, %%xmm3\n\t" + "pclmulqdq $0, %%xmm6, %%xmm3\n\t" /* xmm3 holds 1:a0*b0 */ + "pclmulqdq $17, %%xmm0, %%xmm6\n\t" /* xmm6 holds 1:a1*b1 */ + "movdqa %%xmm11, %%xmm4\n\t" + "pclmulqdq $0, %%xmm10, %%xmm4\n\t" /* xmm4 holds 1:(a0+a1)*(b0+b1) */ + + "pxor %%xmm7, %%xmm3\n\t" /* xmm3 holds 1+2+3+4:a0*b0 */ + "pxor %%xmm1, %%xmm6\n\t" /* xmm6 holds 1+2+3+4:a1*b1 */ + "pxor %%xmm12, %%xmm4\n\t" /* xmm4 holds 1+2+3+4:(a0+a1)*(b0+b1) */ + + /* aggregated reduction... */ + "movdqa %%xmm3, %%xmm5\n\t" + "pxor %%xmm6, %%xmm5\n\t" /* xmm5 holds a0*b0+a1*b1 */ + "pxor %%xmm5, %%xmm4\n\t" /* xmm4 holds a0*b0+a1*b1+(a0+a1)*(b0+b1) */ + "movdqa %%xmm4, %%xmm5\n\t" + "psrldq $8, %%xmm4\n\t" + "pslldq $8, %%xmm5\n\t" + "pxor %%xmm5, %%xmm3\n\t" + "pxor %%xmm4, %%xmm6\n\t" /* holds the result of the + carry-less multiplication of xmm0 + by xmm1 */ + + /* shift the result by one bit position to the left cope for + the fact that bits are reversed */ + "movdqa %%xmm3, %%xmm4\n\t" + "movdqa %%xmm6, %%xmm5\n\t" + "pslld $1, %%xmm3\n\t" + "pslld $1, %%xmm6\n\t" + "psrld $31, %%xmm4\n\t" + "psrld $31, %%xmm5\n\t" + "movdqa %%xmm4, %%xmm1\n\t" + "pslldq $4, %%xmm5\n\t" + "pslldq $4, %%xmm4\n\t" + "psrldq $12, %%xmm1\n\t" + "por %%xmm4, %%xmm3\n\t" + "por %%xmm5, %%xmm6\n\t" + "por %%xmm6, %%xmm1\n\t" + + /* first phase of the reduction */ + "movdqa %%xmm3, %%xmm6\n\t" + "movdqa %%xmm3, %%xmm7\n\t" + "pslld $31, %%xmm6\n\t" /* packed right shifting << 31 */ + "movdqa %%xmm3, %%xmm5\n\t" + "pslld $30, %%xmm7\n\t" /* packed right shifting shift << 30 */ + "pslld $25, %%xmm5\n\t" /* packed right shifting shift << 25 */ + "pxor %%xmm7, %%xmm6\n\t" /* xor the shifted versions */ + "pxor %%xmm5, %%xmm6\n\t" + "movdqa %%xmm6, %%xmm7\n\t" + "pslldq $12, %%xmm6\n\t" + "psrldq $4, %%xmm7\n\t" + "pxor %%xmm6, %%xmm3\n\t" /* first phase of the reduction + complete */ + + /* second phase of the reduction */ + "movdqa %%xmm3, %%xmm2\n\t" + "movdqa %%xmm3, %%xmm4\n\t" + "psrld $1, %%xmm2\n\t" /* packed left shifting >> 1 */ + "movdqa %%xmm3, %%xmm5\n\t" + "psrld $2, %%xmm4\n\t" /* packed left shifting >> 2 */ + "psrld $7, %%xmm5\n\t" /* packed left shifting >> 7 */ + "pxor %%xmm4, %%xmm2\n\t" /* xor the shifted versions */ + "pxor %%xmm5, %%xmm2\n\t" + "pxor %%xmm7, %%xmm2\n\t" + "pxor %%xmm2, %%xmm3\n\t" + "pxor %%xmm3, %%xmm1\n\t" /* the result is in xmm1 */ + :::"cc"); +} +#endif + + +void +_gcry_ghash_setup_intel_pclmul (gcry_cipher_hd_t c, byte *h) +{ + u64 tmp[2]; + + /* Swap endianness of hsub. */ + tmp[0] = buf_get_be64(c->u_mode.gcm.u_ghash_key.key + 8); + tmp[1] = buf_get_be64(c->u_mode.gcm.u_ghash_key.key + 0); + buf_cpy (c->u_mode.gcm.u_ghash_key.key, tmp, GCRY_GCM_BLOCK_LEN); + +#ifdef __x86_64__ + asm volatile ("movdqu %[h_1], %%xmm0\n\t" + "movdqa %%xmm0, %%xmm1\n\t" + : + : [h_1] "m" (*tmp)); + + gfmul_pclmul (); /* H?H => H? */ + + asm volatile ("movdqu %%xmm1, 0*16(%[h_234])\n\t" + "movdqa %%xmm1, %%xmm8\n\t" + : + : [h_234] "r" (c->u_mode.gcm.gcm_table) + : "memory"); + + gfmul_pclmul (); /* H?H? => H? */ + + asm volatile ("movdqa %%xmm8, %%xmm0\n\t" + "movdqu %%xmm1, 1*16(%[h_234])\n\t" + "movdqa %%xmm8, %%xmm1\n\t" + : + : [h_234] "r" (c->u_mode.gcm.gcm_table) + : "memory"); + + gfmul_pclmul (); /* H??H? => H? */ + + asm volatile ("movdqu %%xmm1, 2*16(%[h_234])\n\t" + : + : [h_234] "r" (c->u_mode.gcm.gcm_table) + : "memory"); + + /* Clear used registers. */ + asm volatile( "pxor %%xmm0, %%xmm0\n\t" + "pxor %%xmm1, %%xmm1\n\t" + "pxor %%xmm2, %%xmm2\n\t" + "pxor %%xmm3, %%xmm3\n\t" + "pxor %%xmm4, %%xmm4\n\t" + "pxor %%xmm5, %%xmm5\n\t" + "pxor %%xmm6, %%xmm6\n\t" + "pxor %%xmm7, %%xmm7\n\t" + "pxor %%xmm8, %%xmm8\n\t" + ::: "cc" ); +#endif + + wipememory (tmp, sizeof(tmp)); +} + + +unsigned int +_gcry_ghash_intel_pclmul (gcry_cipher_hd_t c, byte *result, const byte *buf, + size_t nblocks) +{ + static const unsigned char be_mask[16] __attribute__ ((aligned (16))) = + { 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 }; + const unsigned int blocksize = GCRY_GCM_BLOCK_LEN; + + if (nblocks == 0) + return 0; + + /* Preload hash and H1. */ + asm volatile ("movdqu %[hash], %%xmm1\n\t" + "movdqa %[hsub], %%xmm0\n\t" + "pshufb %[be_mask], %%xmm1\n\t" /* be => le */ + : + : [hash] "m" (*result), [be_mask] "m" (*be_mask), + [hsub] "m" (*c->u_mode.gcm.u_ghash_key.key)); + +#ifdef __x86_64__ + if (nblocks >= 4) + { + do + { + asm volatile ("movdqa %[be_mask], %%xmm4\n\t" + "movdqu 0*16(%[buf]), %%xmm5\n\t" + "movdqu 1*16(%[buf]), %%xmm2\n\t" + "movdqu 2*16(%[buf]), %%xmm3\n\t" + "movdqu 3*16(%[buf]), %%xmm6\n\t" + "pshufb %%xmm4, %%xmm5\n\t" /* be => le */ + + /* Load H2, H3, H4. */ + "movdqu 2*16(%[h_234]), %%xmm10\n\t" + "movdqu 1*16(%[h_234]), %%xmm9\n\t" + "movdqu 0*16(%[h_234]), %%xmm8\n\t" + + "pxor %%xmm5, %%xmm1\n\t" + "pshufb %%xmm4, %%xmm2\n\t" /* be => le */ + "pshufb %%xmm4, %%xmm3\n\t" /* be => le */ + "pshufb %%xmm4, %%xmm6\n\t" /* be => le */ + : + : [buf] "r" (buf), [be_mask] "m" (*be_mask), + [h_234] "r" (c->u_mode.gcm.gcm_table)); + + gfmul_pclmul_aggr4 (); + + buf += 4 * blocksize; + nblocks -= 4; + } + while (nblocks >= 4); + + /* Clear used x86-64/XMM registers. */ + asm volatile( "pxor %%xmm8, %%xmm8\n\t" + "pxor %%xmm9, %%xmm9\n\t" + "pxor %%xmm10, %%xmm10\n\t" + "pxor %%xmm11, %%xmm11\n\t" + "pxor %%xmm12, %%xmm12\n\t" + "pxor %%xmm13, %%xmm13\n\t" + "pxor %%xmm14, %%xmm14\n\t" + "pxor %%xmm15, %%xmm15\n\t" + ::: "cc" ); + } +#endif + + while (nblocks--) + { + asm volatile ("movdqu %[buf], %%xmm2\n\t" + "pshufb %[be_mask], %%xmm2\n\t" /* be => le */ + "pxor %%xmm2, %%xmm1\n\t" + : + : [buf] "m" (*buf), [be_mask] "m" (*be_mask)); + + gfmul_pclmul (); + + buf += blocksize; + } + + /* Store hash. */ + asm volatile ("pshufb %[be_mask], %%xmm1\n\t" /* be => le */ + "movdqu %%xmm1, %[hash]\n\t" + : [hash] "=m" (*result) + : [be_mask] "m" (*be_mask)); + + /* Clear used registers. */ + asm volatile( "pxor %%xmm0, %%xmm0\n\t" + "pxor %%xmm1, %%xmm1\n\t" + "pxor %%xmm2, %%xmm2\n\t" + "pxor %%xmm3, %%xmm3\n\t" + "pxor %%xmm4, %%xmm4\n\t" + "pxor %%xmm5, %%xmm5\n\t" + "pxor %%xmm6, %%xmm6\n\t" + "pxor %%xmm7, %%xmm7\n\t" + ::: "cc" ); + + return 0; +} + +#endif /* GCM_USE_INTEL_PCLMUL */ diff --git a/cipher/cipher-gcm.c b/cipher/cipher-gcm.c index 0534761..f89b81e 100644 --- a/cipher/cipher-gcm.c +++ b/cipher/cipher-gcm.c @@ -29,6 +29,15 @@ #include "bufhelp.h" #include "./cipher-internal.h" + +#ifdef GCM_USE_INTEL_PCLMUL +extern void _gcry_ghash_setup_intel_pclmul (gcry_cipher_hd_t c, byte *h); + +extern unsigned int _gcry_ghash_intel_pclmul (gcry_cipher_hd_t c, byte *result, + const byte *buf, size_t nblocks); +#endif + + #ifdef GCM_USE_TABLES static const u16 gcmR[256] = { 0x0000, 0x01c2, 0x0384, 0x0246, 0x0708, 0x06ca, 0x048c, 0x054e, @@ -348,325 +357,18 @@ do_ghash (unsigned char *hsub, unsigned char *result, const unsigned char *buf) #endif /* !GCM_USE_TABLES */ -#ifdef GCM_USE_INTEL_PCLMUL -/* - Intel PCLMUL ghash based on white paper: - "Intel? Carry-Less Multiplication Instruction and its Usage for Computing the - GCM Mode - Rev 2.01"; Shay Gueron, Michael E. Kounavis. - */ -static inline void gfmul_pclmul(void) -{ - /* Input: XMM0 and XMM1, Output: XMM1. Input XMM0 stays unmodified. - Input must be converted to little-endian. - */ - asm volatile (/* gfmul, xmm0 has operator a and xmm1 has operator b. */ - "pshufd $78, %%xmm0, %%xmm2\n\t" - "pshufd $78, %%xmm1, %%xmm4\n\t" - "pxor %%xmm0, %%xmm2\n\t" /* xmm2 holds a0+a1 */ - "pxor %%xmm1, %%xmm4\n\t" /* xmm4 holds b0+b1 */ - - "movdqa %%xmm0, %%xmm3\n\t" - "pclmulqdq $0, %%xmm1, %%xmm3\n\t" /* xmm3 holds a0*b0 */ - "movdqa %%xmm0, %%xmm6\n\t" - "pclmulqdq $17, %%xmm1, %%xmm6\n\t" /* xmm6 holds a1*b1 */ - "movdqa %%xmm3, %%xmm5\n\t" - "pclmulqdq $0, %%xmm2, %%xmm4\n\t" /* xmm4 holds (a0+a1)*(b0+b1) */ - - "pxor %%xmm6, %%xmm5\n\t" /* xmm5 holds a0*b0+a1*b1 */ - "pxor %%xmm5, %%xmm4\n\t" /* xmm4 holds a0*b0+a1*b1+(a0+a1)*(b0+b1) */ - "movdqa %%xmm4, %%xmm5\n\t" - "psrldq $8, %%xmm4\n\t" - "pslldq $8, %%xmm5\n\t" - "pxor %%xmm5, %%xmm3\n\t" - "pxor %%xmm4, %%xmm6\n\t" /* holds the result of the - carry-less multiplication of xmm0 - by xmm1 */ - - /* shift the result by one bit position to the left cope for - the fact that bits are reversed */ - "movdqa %%xmm3, %%xmm4\n\t" - "movdqa %%xmm6, %%xmm5\n\t" - "pslld $1, %%xmm3\n\t" - "pslld $1, %%xmm6\n\t" - "psrld $31, %%xmm4\n\t" - "psrld $31, %%xmm5\n\t" - "movdqa %%xmm4, %%xmm1\n\t" - "pslldq $4, %%xmm5\n\t" - "pslldq $4, %%xmm4\n\t" - "psrldq $12, %%xmm1\n\t" - "por %%xmm4, %%xmm3\n\t" - "por %%xmm5, %%xmm6\n\t" - "por %%xmm6, %%xmm1\n\t" - - /* first phase of the reduction */ - "movdqa %%xmm3, %%xmm6\n\t" - "movdqa %%xmm3, %%xmm7\n\t" - "pslld $31, %%xmm6\n\t" /* packed right shifting << 31 */ - "movdqa %%xmm3, %%xmm5\n\t" - "pslld $30, %%xmm7\n\t" /* packed right shifting shift << 30 */ - "pslld $25, %%xmm5\n\t" /* packed right shifting shift << 25 */ - "pxor %%xmm7, %%xmm6\n\t" /* xor the shifted versions */ - "pxor %%xmm5, %%xmm6\n\t" - "movdqa %%xmm6, %%xmm7\n\t" - "pslldq $12, %%xmm6\n\t" - "psrldq $4, %%xmm7\n\t" - "pxor %%xmm6, %%xmm3\n\t" /* first phase of the reduction - complete */ - - /* second phase of the reduction */ - "movdqa %%xmm3, %%xmm2\n\t" - "movdqa %%xmm3, %%xmm4\n\t" - "psrld $1, %%xmm2\n\t" /* packed left shifting >> 1 */ - "movdqa %%xmm3, %%xmm5\n\t" - "psrld $2, %%xmm4\n\t" /* packed left shifting >> 2 */ - "psrld $7, %%xmm5\n\t" /* packed left shifting >> 7 */ - "pxor %%xmm4, %%xmm2\n\t" /* xor the shifted versions */ - "pxor %%xmm5, %%xmm2\n\t" - "pxor %%xmm7, %%xmm2\n\t" - "pxor %%xmm2, %%xmm3\n\t" - "pxor %%xmm3, %%xmm1\n\t" /* the result is in xmm1 */ - ::: "cc" ); -} - -#ifdef __x86_64__ -static inline void gfmul_pclmul_aggr4(void) -{ - /* Input: - H?: XMM0 X_i : XMM6 - H?: XMM8 X_(i-1) : XMM3 - H?: XMM9 X_(i-2) : XMM2 - H?: XMM10 X_(i-3)?Y_(i-4): XMM1 - Output: - Y_i: XMM1 - Inputs XMM0 stays unmodified. - Input must be converted to little-endian. - */ - asm volatile (/* perform clmul and merge results... */ - "pshufd $78, %%xmm10, %%xmm11\n\t" - "pshufd $78, %%xmm1, %%xmm12\n\t" - "pxor %%xmm10, %%xmm11\n\t" /* xmm11 holds 4:a0+a1 */ - "pxor %%xmm1, %%xmm12\n\t" /* xmm12 holds 4:b0+b1 */ - - "pshufd $78, %%xmm9, %%xmm13\n\t" - "pshufd $78, %%xmm2, %%xmm14\n\t" - "pxor %%xmm9, %%xmm13\n\t" /* xmm13 holds 3:a0+a1 */ - "pxor %%xmm2, %%xmm14\n\t" /* xmm14 holds 3:b0+b1 */ - - "pshufd $78, %%xmm8, %%xmm5\n\t" - "pshufd $78, %%xmm3, %%xmm15\n\t" - "pxor %%xmm8, %%xmm5\n\t" /* xmm1 holds 2:a0+a1 */ - "pxor %%xmm3, %%xmm15\n\t" /* xmm2 holds 2:b0+b1 */ - - "movdqa %%xmm10, %%xmm4\n\t" - "movdqa %%xmm9, %%xmm7\n\t" - "pclmulqdq $0, %%xmm1, %%xmm4\n\t" /* xmm4 holds 4:a0*b0 */ - "pclmulqdq $0, %%xmm2, %%xmm7\n\t" /* xmm7 holds 3:a0*b0 */ - "pclmulqdq $17, %%xmm10, %%xmm1\n\t" /* xmm1 holds 4:a1*b1 */ - "pclmulqdq $17, %%xmm9, %%xmm2\n\t" /* xmm9 holds 3:a1*b1 */ - "pclmulqdq $0, %%xmm11, %%xmm12\n\t" /* xmm12 holds 4:(a0+a1)*(b0+b1) */ - "pclmulqdq $0, %%xmm13, %%xmm14\n\t" /* xmm14 holds 3:(a0+a1)*(b0+b1) */ - - "pshufd $78, %%xmm0, %%xmm10\n\t" - "pshufd $78, %%xmm6, %%xmm11\n\t" - "pxor %%xmm0, %%xmm10\n\t" /* xmm10 holds 1:a0+a1 */ - "pxor %%xmm6, %%xmm11\n\t" /* xmm11 holds 1:b0+b1 */ - - "pxor %%xmm4, %%xmm7\n\t" /* xmm7 holds 3+4:a0*b0 */ - "pxor %%xmm2, %%xmm1\n\t" /* xmm1 holds 3+4:a1*b1 */ - "pxor %%xmm14, %%xmm12\n\t" /* xmm12 holds 3+4:(a0+a1)*(b0+b1) */ - - "movdqa %%xmm8, %%xmm13\n\t" - "pclmulqdq $0, %%xmm3, %%xmm13\n\t" /* xmm13 holds 2:a0*b0 */ - "pclmulqdq $17, %%xmm8, %%xmm3\n\t" /* xmm3 holds 2:a1*b1 */ - "pclmulqdq $0, %%xmm5, %%xmm15\n\t" /* xmm15 holds 2:(a0+a1)*(b0+b1) */ - - "pxor %%xmm13, %%xmm7\n\t" /* xmm7 holds 2+3+4:a0*b0 */ - "pxor %%xmm3, %%xmm1\n\t" /* xmm1 holds 2+3+4:a1*b1 */ - "pxor %%xmm15, %%xmm12\n\t" /* xmm12 holds 2+3+4:(a0+a1)*(b0+b1) */ - - "movdqa %%xmm0, %%xmm3\n\t" - "pclmulqdq $0, %%xmm6, %%xmm3\n\t" /* xmm3 holds 1:a0*b0 */ - "pclmulqdq $17, %%xmm0, %%xmm6\n\t" /* xmm6 holds 1:a1*b1 */ - "movdqa %%xmm11, %%xmm4\n\t" - "pclmulqdq $0, %%xmm10, %%xmm4\n\t" /* xmm4 holds 1:(a0+a1)*(b0+b1) */ - - "pxor %%xmm7, %%xmm3\n\t" /* xmm3 holds 1+2+3+4:a0*b0 */ - "pxor %%xmm1, %%xmm6\n\t" /* xmm6 holds 1+2+3+4:a1*b1 */ - "pxor %%xmm12, %%xmm4\n\t" /* xmm4 holds 1+2+3+4:(a0+a1)*(b0+b1) */ - - /* aggregated reduction... */ - "movdqa %%xmm3, %%xmm5\n\t" - "pxor %%xmm6, %%xmm5\n\t" /* xmm5 holds a0*b0+a1*b1 */ - "pxor %%xmm5, %%xmm4\n\t" /* xmm4 holds a0*b0+a1*b1+(a0+a1)*(b0+b1) */ - "movdqa %%xmm4, %%xmm5\n\t" - "psrldq $8, %%xmm4\n\t" - "pslldq $8, %%xmm5\n\t" - "pxor %%xmm5, %%xmm3\n\t" - "pxor %%xmm4, %%xmm6\n\t" /* holds the result of the - carry-less multiplication of xmm0 - by xmm1 */ - - /* shift the result by one bit position to the left cope for - the fact that bits are reversed */ - "movdqa %%xmm3, %%xmm4\n\t" - "movdqa %%xmm6, %%xmm5\n\t" - "pslld $1, %%xmm3\n\t" - "pslld $1, %%xmm6\n\t" - "psrld $31, %%xmm4\n\t" - "psrld $31, %%xmm5\n\t" - "movdqa %%xmm4, %%xmm1\n\t" - "pslldq $4, %%xmm5\n\t" - "pslldq $4, %%xmm4\n\t" - "psrldq $12, %%xmm1\n\t" - "por %%xmm4, %%xmm3\n\t" - "por %%xmm5, %%xmm6\n\t" - "por %%xmm6, %%xmm1\n\t" - - /* first phase of the reduction */ - "movdqa %%xmm3, %%xmm6\n\t" - "movdqa %%xmm3, %%xmm7\n\t" - "pslld $31, %%xmm6\n\t" /* packed right shifting << 31 */ - "movdqa %%xmm3, %%xmm5\n\t" - "pslld $30, %%xmm7\n\t" /* packed right shifting shift << 30 */ - "pslld $25, %%xmm5\n\t" /* packed right shifting shift << 25 */ - "pxor %%xmm7, %%xmm6\n\t" /* xor the shifted versions */ - "pxor %%xmm5, %%xmm6\n\t" - "movdqa %%xmm6, %%xmm7\n\t" - "pslldq $12, %%xmm6\n\t" - "psrldq $4, %%xmm7\n\t" - "pxor %%xmm6, %%xmm3\n\t" /* first phase of the reduction - complete */ - - /* second phase of the reduction */ - "movdqa %%xmm3, %%xmm2\n\t" - "movdqa %%xmm3, %%xmm4\n\t" - "psrld $1, %%xmm2\n\t" /* packed left shifting >> 1 */ - "movdqa %%xmm3, %%xmm5\n\t" - "psrld $2, %%xmm4\n\t" /* packed left shifting >> 2 */ - "psrld $7, %%xmm5\n\t" /* packed left shifting >> 7 */ - "pxor %%xmm4, %%xmm2\n\t" /* xor the shifted versions */ - "pxor %%xmm5, %%xmm2\n\t" - "pxor %%xmm7, %%xmm2\n\t" - "pxor %%xmm2, %%xmm3\n\t" - "pxor %%xmm3, %%xmm1\n\t" /* the result is in xmm1 */ - :::"cc"); -} -#endif - -#endif /*GCM_USE_INTEL_PCLMUL*/ - - static unsigned int -ghash (gcry_cipher_hd_t c, byte *result, const byte *buf, - size_t nblocks) +ghash_internal (gcry_cipher_hd_t c, byte *result, const byte *buf, + size_t nblocks) { const unsigned int blocksize = GCRY_GCM_BLOCK_LEN; - unsigned int burn; - - if (nblocks == 0) - return 0; - - if (0) - ; -#ifdef GCM_USE_INTEL_PCLMUL - else if (c->u_mode.gcm.use_intel_pclmul) - { - static const unsigned char be_mask[16] __attribute__ ((aligned (16))) = - { 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 }; - - /* Preload hash and H1. */ - asm volatile ("movdqu %[hash], %%xmm1\n\t" - "movdqa %[hsub], %%xmm0\n\t" - "pshufb %[be_mask], %%xmm1\n\t" /* be => le */ - : - : [hash] "m" (*result), [be_mask] "m" (*be_mask), - [hsub] "m" (*c->u_mode.gcm.u_ghash_key.key)); - -#ifdef __x86_64__ - if (nblocks >= 4) - { - do - { - asm volatile ("movdqa %[be_mask], %%xmm4\n\t" - "movdqu 0*16(%[buf]), %%xmm5\n\t" - "movdqu 1*16(%[buf]), %%xmm2\n\t" - "movdqu 2*16(%[buf]), %%xmm3\n\t" - "movdqu 3*16(%[buf]), %%xmm6\n\t" - "pshufb %%xmm4, %%xmm5\n\t" /* be => le */ - - /* Load H2, H3, H4. */ - "movdqu 2*16(%[h_234]), %%xmm10\n\t" - "movdqu 1*16(%[h_234]), %%xmm9\n\t" - "movdqu 0*16(%[h_234]), %%xmm8\n\t" - - "pxor %%xmm5, %%xmm1\n\t" - "pshufb %%xmm4, %%xmm2\n\t" /* be => le */ - "pshufb %%xmm4, %%xmm3\n\t" /* be => le */ - "pshufb %%xmm4, %%xmm6\n\t" /* be => le */ - : - : [buf] "r" (buf), [be_mask] "m" (*be_mask), - [h_234] "r" (c->u_mode.gcm.gcm_table)); - - gfmul_pclmul_aggr4 (); - - buf += 4 * blocksize; - nblocks -= 4; - } - while (nblocks >= 4); - - /* Clear used x86-64/XMM registers. */ - asm volatile( "pxor %%xmm8, %%xmm8\n\t" - "pxor %%xmm9, %%xmm9\n\t" - "pxor %%xmm10, %%xmm10\n\t" - "pxor %%xmm11, %%xmm11\n\t" - "pxor %%xmm12, %%xmm12\n\t" - "pxor %%xmm13, %%xmm13\n\t" - "pxor %%xmm14, %%xmm14\n\t" - "pxor %%xmm15, %%xmm15\n\t" - ::: "cc" ); - } -#endif - - while (nblocks--) - { - asm volatile ("movdqu %[buf], %%xmm2\n\t" - "pshufb %[be_mask], %%xmm2\n\t" /* be => le */ - "pxor %%xmm2, %%xmm1\n\t" - : - : [buf] "m" (*buf), [be_mask] "m" (*be_mask)); - - gfmul_pclmul (); - - buf += blocksize; - } + unsigned int burn = 0; - /* Store hash. */ - asm volatile ("pshufb %[be_mask], %%xmm1\n\t" /* be => le */ - "movdqu %%xmm1, %[hash]\n\t" - : [hash] "=m" (*result) - : [be_mask] "m" (*be_mask)); - - /* Clear used registers. */ - asm volatile( "pxor %%xmm0, %%xmm0\n\t" - "pxor %%xmm1, %%xmm1\n\t" - "pxor %%xmm2, %%xmm2\n\t" - "pxor %%xmm3, %%xmm3\n\t" - "pxor %%xmm4, %%xmm4\n\t" - "pxor %%xmm5, %%xmm5\n\t" - "pxor %%xmm6, %%xmm6\n\t" - "pxor %%xmm7, %%xmm7\n\t" - ::: "cc" ); - burn = 0; - } -#endif - else + while (nblocks) { - while (nblocks) - { - burn = GHASH (c, result, buf); - buf += blocksize; - nblocks--; - } + burn = GHASH (c, result, buf); + buf += blocksize; + nblocks--; } return burn + (burn ? 5*sizeof(void*) : 0); @@ -681,63 +383,15 @@ setupM (gcry_cipher_hd_t c, byte *h) #ifdef GCM_USE_INTEL_PCLMUL else if (_gcry_get_hw_features () & HWF_INTEL_PCLMUL) { - u64 tmp[2]; - - c->u_mode.gcm.use_intel_pclmul = 1; - - /* Swap endianness of hsub. */ - tmp[0] = buf_get_be64(c->u_mode.gcm.u_ghash_key.key + 8); - tmp[1] = buf_get_be64(c->u_mode.gcm.u_ghash_key.key + 0); - buf_cpy (c->u_mode.gcm.u_ghash_key.key, tmp, GCRY_GCM_BLOCK_LEN); - -#ifdef __x86_64__ - asm volatile ("movdqu %[h_1], %%xmm0\n\t" - "movdqa %%xmm0, %%xmm1\n\t" - : - : [h_1] "m" (*tmp)); - - gfmul_pclmul (); /* H?H => H? */ - - asm volatile ("movdqu %%xmm1, 0*16(%[h_234])\n\t" - "movdqa %%xmm1, %%xmm8\n\t" - : - : [h_234] "r" (c->u_mode.gcm.gcm_table) - : "memory"); - - gfmul_pclmul (); /* H?H? => H? */ - - asm volatile ("movdqa %%xmm8, %%xmm0\n\t" - "movdqu %%xmm1, 1*16(%[h_234])\n\t" - "movdqa %%xmm8, %%xmm1\n\t" - : - : [h_234] "r" (c->u_mode.gcm.gcm_table) - : "memory"); - - gfmul_pclmul (); /* H??H? => H? */ - - asm volatile ("movdqu %%xmm1, 2*16(%[h_234])\n\t" - : - : [h_234] "r" (c->u_mode.gcm.gcm_table) - : "memory"); - - /* Clear used registers. */ - asm volatile( "pxor %%xmm0, %%xmm0\n\t" - "pxor %%xmm1, %%xmm1\n\t" - "pxor %%xmm2, %%xmm2\n\t" - "pxor %%xmm3, %%xmm3\n\t" - "pxor %%xmm4, %%xmm4\n\t" - "pxor %%xmm5, %%xmm5\n\t" - "pxor %%xmm6, %%xmm6\n\t" - "pxor %%xmm7, %%xmm7\n\t" - "pxor %%xmm8, %%xmm8\n\t" - ::: "cc" ); -#endif - - wipememory (tmp, sizeof(tmp)); + c->u_mode.gcm.ghash_fn = _gcry_ghash_intel_pclmul; + _gcry_ghash_setup_intel_pclmul(c, h); } #endif else - fillM (c, h); + { + c->u_mode.gcm.ghash_fn = ghash_internal; + fillM (c, h); + } } @@ -810,6 +464,7 @@ do_ghash_buf(gcry_cipher_hd_t c, byte *hash, const byte *buf, { unsigned int blocksize = GCRY_GCM_BLOCK_LEN; unsigned int unused = c->u_mode.gcm.mac_unused; + ghash_fn_t ghash_fn = c->u_mode.gcm.ghash_fn; size_t nblocks, n; unsigned int burn = 0; @@ -843,7 +498,7 @@ do_ghash_buf(gcry_cipher_hd_t c, byte *hash, const byte *buf, gcry_assert (unused == blocksize); /* Process one block from macbuf. */ - burn = ghash (c, hash, c->u_mode.gcm.macbuf, 1); + burn = ghash_fn (c, hash, c->u_mode.gcm.macbuf, 1); unused = 0; } @@ -851,7 +506,7 @@ do_ghash_buf(gcry_cipher_hd_t c, byte *hash, const byte *buf, if (nblocks) { - burn = ghash (c, hash, buf, nblocks); + burn = ghash_fn (c, hash, buf, nblocks); buf += blocksize * nblocks; buflen -= blocksize * nblocks; } diff --git a/cipher/cipher-internal.h b/cipher/cipher-internal.h index f6bda66..fef0ecb 100644 --- a/cipher/cipher-internal.h +++ b/cipher/cipher-internal.h @@ -42,7 +42,7 @@ #define GCM_USE_TABLES 1 -/* GCM_USE_INTEL_PCLMUL inidicates whether to compile GCM with Intel PCLMUL +/* GCM_USE_INTEL_PCLMUL indicates whether to compile GCM with Intel PCLMUL code. */ #undef GCM_USE_INTEL_PCLMUL #if defined(ENABLE_PCLMUL_SUPPORT) && defined(GCM_USE_TABLES) @@ -54,6 +54,10 @@ #endif /* GCM_USE_INTEL_PCLMUL */ +typedef unsigned int (*ghash_fn_t) (gcry_cipher_hd_t c, byte *result, + const byte *buf, size_t nblocks); + + /* A VIA processor with the Padlock engine as well as the Intel AES_NI instructions require an alignment of most data on a 16 byte boundary. Because we trick out the compiler while allocating the @@ -188,6 +192,7 @@ struct gcry_cipher_handle unsigned char macbuf[GCRY_CCM_BLOCK_LEN]; int mac_unused; /* Number of unprocessed bytes in MACBUF. */ + /* byte counters for GCM */ u32 aadlen[2]; u32 datalen[2]; @@ -209,10 +214,8 @@ struct gcry_cipher_handle unsigned char key[MAX_BLOCKSIZE]; } u_ghash_key; -#ifdef GCM_USE_INTEL_PCLMUL - /* Use Intel PCLMUL instructions for accelerated GHASH. */ - unsigned int use_intel_pclmul:1; -#endif + /* GHASH implementation in use. */ + ghash_fn_t ghash_fn; /* Pre-calculated table for GCM. */ #ifdef GCM_USE_TABLES ----------------------------------------------------------------------- Summary of changes: cipher/Makefile.am | 4 +- cipher/cipher-gcm-intel-pclmul.c | 395 ++++++++++++++++++++++++++++++++++++++ cipher/cipher-gcm.c | 395 +++----------------------------------- cipher/cipher-internal.h | 13 +- cipher/rijndael-aesni.c | 244 ++++++++++------------- 5 files changed, 534 insertions(+), 517 deletions(-) create mode 100644 cipher/cipher-gcm-intel-pclmul.c hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Sun Dec 14 22:37:30 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Sun, 14 Dec 2014 22:37:30 +0100 Subject: [git] gnupg-doc - branch, master, updated. 4b80ae2446dac4b4eacf5e9b29170b9fdc763f8c Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via 4b80ae2446dac4b4eacf5e9b29170b9fdc763f8c (commit) from 3154925789c7576d4f654acbfc694217f384d222 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 4b80ae2446dac4b4eacf5e9b29170b9fdc763f8c Author: Werner Koch Date: Sun Dec 14 22:23:07 2014 +0100 blog: Add new article. Also adjusted the CSS for tables a bit. diff --git a/misc/blog.gnupg.org/20141214-gnupg-and-g10.org b/misc/blog.gnupg.org/20141214-gnupg-and-g10.org new file mode 100644 index 0000000..6d2d838 --- /dev/null +++ b/misc/blog.gnupg.org/20141214-gnupg-and-g10.org @@ -0,0 +1,76 @@ +# About GnupG and g10 code +#+AUTHOR: Werner +#+DATE: 14th December 2014 + +** GnuPG and g10^code + +After the release of GnuPG 1.0 in 1999 it turned out that this was not +a write once and forget project. The unrestricted availability of the +software and public concerns about the acquirement of /PGP Inc./ by +/NAI Inc./ (coincidentally at the time of the initial GnuPG release in +December 1997) raised a lot of interest by those who always cared +about privacy issues. + +Fortunately the funding of the Windows port by the German Ministry of +Economics helped to finance the maintenance and further developments +in 1999 and 2000. After that I decided to keep on working on GnuPG +full time and founded [[https://g10code.com][g10^code GmbH]] in 2001 as a legal framework for +it. The company is owned entirely by my brother [[http://www.u32.de][Walter]] and myself and +I like to thank him for his long time support and waive of profit +distribution. If you ever wondered about the name: /g10/ is a +reference on the German constitution article on freedom of +communication (Grundgesetz [[http://de.wikipedia.org/wiki/Artikel_10_des_Grundgesetzes_f%C3%BCr_die_Bundesrepublik_Deutschland][Artikel 10]]) and a pun on the [[http://en.wikipedia.org/wiki/Gesetz_zur_Beschr%C3%A4nkung_des_Brief-,_Post-_und_Fernmeldegeheimnisses][G-10]] law which +allows the secret services to bypass these constitutional guaranteed +freedoms. + +The best known project of g10^code is probably version 2 of GnuPG, +which started under the name /NewPG/ as part of the broader /Aegypten/ +project. The main goal of Aegypten was to provide support for S/MIME +under GNU/Linux and integrate that cleanly with other mail clients, +most notably KMail. This project was due to a public tender of the +[[http://www.bsi.de/EN/][BSI]] (German federal office for information security) and awarded to a +consortium of g10^code, [[https://intevation.de/index.en.html][Intevation]], and [[https://kdab.com][KDAB]]. Another large project +is [[http://www.gpg4win.org][Gpg4win]] which has its roots in a port of GnuPG-2 to Windows done by +g10^code as part of a health research project. Another tender awarded +to the same consortium extended this port to the now mostly used GnuPG +distribution for Windows. + +Now, how viable is it to run a company for the development of free +security software? Not very good I had to realize: the original plan +of selling support contracts did not worked out too well due to the +lack of resources for marketing. Larger development projects raised +most of the revenues but they are not easy to acquire. In the last +years we had problems to get new GnuPG related development contracts +which turned the company into a one-person show by fall 2012. I +actually planned to shut it down in 2013 and to take a straight coder +job somewhere. However, as a side effect of Edward Snowden?s brave +actions, there was more public demand for privacy tools and thus I +concluded that it is worth to keep on working on GnuPG. + +#+ATTR_HTML: :cellpadding 2 + | year | profit | wages | n | balance | + |------+--------+-------+---+---------| + | 2001 | -12000 | 11000 | 2 | 31000 | + | 2002 | 3000 | 40000 | 3 | 32000 | + | 2003 | -16000 | 26000 | 3 | 35000 | + | 2004 | 3000 | 45000 | 4 | 52000 | + | 2005 | 0 | 44000 | 4 | 56000 | + | 2006 | 2000 | 48000 | 3 | 49000 | + | 2007 | 50000 | 57000 | 2 | 99000 | + | 2008 | 11000 | 75000 | 3 | 94000 | + | 2009 | -23000 | 72000 | 3 | 68000 | + | 2010 | 28000 | 74000 | 2 | 78000 | + | 2011 | -41000 | 63000 | 2 | 81000 | + | 2012 | -16000 | 54000 | 2 | 45000 | + | 2013 | -10000 | 32000 | 1 | 44000 | + | 2014 | 12000 | 32000 | 1 | 47000 | + +The table above is a summary of g10^{code}?s balance sheets (in Euro, +2014 are estimations). /profit/ gives the annual net profit or loss, +/wages/ are the gross salary costs for the /n/ employed developers, +and /balance/ is the balance sheet total. Despite of our low wages we +accumulated an estimated loss of 9000 Euro over the last 3 years. The +crowdfunding campaign last year proved that there are many people who +like to see GnuPG alive and maintained. Despite the huge [[file:20140512-rewards-sent.org][costs]] of the +campaign it allowed me to keep working on GnuPG and I am confident +that there will be ways to continue work in 2015. diff --git a/web/share/site.css b/web/share/site.css index 768844f..f91beef 100644 --- a/web/share/site.css +++ b/web/share/site.css @@ -519,6 +519,11 @@ span.sansserif { /* Table related rules as used by org-mode. */ +table { + margin-left: 5%; +} + + .left { margin-left: 0px; margin-right: auto; @@ -551,6 +556,7 @@ th.right { td.left { text-align:left; + padding-left: 10px; } td.center { @@ -559,6 +565,7 @@ td.center { td.right { text-align:right; + padding-right: 10px; } ----------------------------------------------------------------------- Summary of changes: misc/blog.gnupg.org/20141214-gnupg-and-g10.org | 76 ++++++++++++++++++++++++ web/share/site.css | 7 +++ 2 files changed, 83 insertions(+) create mode 100644 misc/blog.gnupg.org/20141214-gnupg-and-g10.org hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 15 09:50:36 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 15 Dec 2014 09:50:36 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-76-gfc9a35d Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via fc9a35d2dec2f838abac831fd88dca494773e082 (commit) via b4e402cb5c6d7fc507e8d5131969145b49640e50 (commit) via 38b583ab3cead59cd1d924cfe05b6bd15695ac36 (commit) via 68b4e7c9e4de0dc3580ca5af3cfd0f20a2691b5e (commit) from f3f9f9b2844c35f7942ee904d5222523615cdad4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit fc9a35d2dec2f838abac831fd88dca494773e082 Author: Werner Koch Date: Mon Dec 15 09:50:19 2014 +0100 gpg: Fix regression in notation data regression. * g10/misc.c (pct_expando): Reorder conditions for clarity. * g10/sign.c (write_signature_packets): Fix notation data creation. -- Also re-added the check for signature version > 3. Reported-by: MFPA Signed-off-by: Werner Koch diff --git a/g10/misc.c b/g10/misc.c index c47d6dc..6a45c69 100644 --- a/g10/misc.c +++ b/g10/misc.c @@ -867,23 +867,25 @@ pct_expando(const char *string,struct expando_args *args) } break; - case 'p': /* primary pk fingerprint of a sk */ - case 'f': /* pk fingerprint */ - case 'g': /* sk fingerprint */ + case 'f': /* Fingerprint of key being signed */ + case 'p': /* Fingerprint of the primary key making the signature. */ + case 'g': /* Fingerprint of thge key making the signature. */ { byte array[MAX_FINGERPRINT_LEN]; size_t len; int i; - if((*(ch+1))=='p' && args->pksk) + if ((*(ch+1))=='f' && args->pk) + fingerprint_from_pk (args->pk, array, &len); + else if ((*(ch+1))=='p' && args->pksk) { if(args->pksk->flags.primary) fingerprint_from_pk (args->pksk, array, &len); else if (args->pksk->main_keyid[0] || args->pksk->main_keyid[1]) { - /* FIXME: Document teh code and check whether - it is still needed. */ + /* Not the primary key: Find the fingerprint + of the primary key. */ PKT_public_key *pk= xmalloc_clear(sizeof(PKT_public_key)); @@ -893,11 +895,9 @@ pct_expando(const char *string,struct expando_args *args) memset (array, 0, (len=MAX_FINGERPRINT_LEN)); free_public_key (pk); } - else + else /* Oops: info about the primary key missing. */ memset(array,0,(len=MAX_FINGERPRINT_LEN)); } - else if((*(ch+1))=='f' && args->pk) - fingerprint_from_pk (args->pk, array, &len); else if((*(ch+1))=='g' && args->pksk) fingerprint_from_pk (args->pksk, array, &len); else diff --git a/g10/sign.c b/g10/sign.c index 2e62f04..2724513 100644 --- a/g10/sign.c +++ b/g10/sign.c @@ -700,8 +700,11 @@ write_signature_packets (SK_LIST sk_list, IOBUF out, gcry_md_hd_t hash, if (gcry_md_copy (&md, hash)) BUG (); - build_sig_subpkt_from_sig (sig); - mk_notation_policy_etc (sig, pk, NULL); + if (sig->version >= 4) + { + build_sig_subpkt_from_sig (sig); + mk_notation_policy_etc (sig, NULL, pk); + } hash_sigversion_to_magic (md, sig); gcry_md_final (md); commit b4e402cb5c6d7fc507e8d5131969145b49640e50 Author: Werner Koch Date: Mon Dec 15 09:47:21 2014 +0100 gpg: Avoid extra LF in notaion data listing. * g10/keylist.c (show_notation): Use log_printf. diff --git a/g10/keylist.c b/g10/keylist.c index 75def77..0255f00 100644 --- a/g10/keylist.c +++ b/g10/keylist.c @@ -393,7 +393,12 @@ show_notation (PKT_signature * sig, int indent, int mode, int which) print_utf8_buffer (fp, nd->name, strlen (nd->name)); es_fprintf (fp, "="); print_utf8_buffer (fp, nd->value, strlen (nd->value)); - es_fprintf (fp, "\n"); + /* (We need to use log_printf so that the next call to a + log function does not insert an extra LF.) */ + if (mode) + log_printf ("\n"); + else + es_putc ('\n', fp); } } commit 38b583ab3cead59cd1d924cfe05b6bd15695ac36 Author: Werner Koch Date: Sun Dec 14 12:15:21 2014 +0100 doc: Typo fixes. -- diff --git a/doc/a-decade-of-gnupg.txt b/doc/a-decade-of-gnupg.txt index 17209ba..f632a2c 100644 --- a/doc/a-decade-of-gnupg.txt +++ b/doc/a-decade-of-gnupg.txt @@ -26,17 +26,17 @@ history: To help political activists Phil Zimmermann published a software called Pretty Good Privacy (PGP) in 1991. PGP was designed as an easy to use encryption tool with no backdoors and disclosed source code. PGP was indeed intended to be cryptographically strong -and not just pretty good; however it had a couple of inital bugs, most +and not just pretty good; however it had a couple of initial bugs, most of all a home designed cipher algorithm. With the availability of the source code a community of hackers (Branko Lankester, Colin Plumb, Derek Atkins, Hal Finney, Peter Gutmann and others) helped him to fix these flaws and a get a solid version 2 out. -Soon after that the trouble started. As in many counties the use or +Soon after that the trouble started. As in many countries the use or export of cryptographic devices and software was also strongly restricted in the USA. Only weak cryptography was generally allowed. PGP was much stronger and due to the Usenet and the availability of -FTP servers and BBSs, PGP accidently leaked out of the country and +FTP servers and BBSs, PGP accidentally leaked out of the country and soon Phil was sued for unlicensed munitions export. Those export control laws were not quite up to the age of software with the funny effect that exporting the software in printed form seemed not to be @@ -58,7 +58,7 @@ the PGP product was later continued by the new PGP Corporation). Also often claimed to be Free Software, PGP has never fulfilled the requirements for it: PGP-5 is straight proprietary software; the -availability of the source code alonedoes not make it free. PGP-2 has +availability of the source code alone does not make it free. PGP-2 has certain restrictions on commercial use [2] and thus puts restrictions on the software which makes it also non-free. Another problem with PGP-2 is that it requires the use of the patented RSA and IDEA @@ -80,8 +80,8 @@ such software in their country or even by US citizens working abroad. Thus he told the European hackers that they are in the unique position to help the GNU with crypto software. -Being tired of writing SMGL conversion software and without a current -fun project, I soon found my self hacking on PGP-2 parsing code based +Being tired of writing SGML conversion software and without a current +fun project, I soon found myself hacking on PGP-2 parsing code based on the description in RFC-1991 and the pgformat.txt file. As this turned out to be easy I continued and finally came up with code to decrypt and create PGP-2 data. After I told the GNU towers that I @@ -101,7 +101,7 @@ and wrote an announcement [5]. Right the next day Peter Gutmann offered to allow the use of his random number code for systems without a /dev/random. This eventually helped a lot to make GnuPG portable to many platforms. The next two -months were filled with code updates and a lengthly discussion on the +months were filled with code updates and a lengthily discussion on the name; we finally settled for Anand Kumria's suggestion of GnuPG and made the first release under this name (gnupg-0.2.8) on Feb 24 [6]. Just a few days later an experimental version with support for Windows @@ -117,7 +117,7 @@ copyright concerns with the reference code). Michael Roth contributed a Triple-DES implementation later the year and thus completed the required set of OpenPGP algorithms. Over the next year the usual problems were solved, features discussed, complaints noticed and -support for gpg in various other software was introduced by their +support for GPG in various other software was introduced by their respective authors. Finally, on September 7, 1999 the current code was released as version @@ -206,7 +206,7 @@ In a reply to this mail Alan Olsen remarked on the ML: determined that the only difference was that RSAREF2 had fixed a number of buffer overflows and other security flaws. There were no added features.) - + If I remember correctly, 2.5 had RSAREF2 and 2.6 had RSAREF1. One of the main reasons for the creation of the "International version" was the use of RSAREF. (Besides the security issues, it was pretty commit 68b4e7c9e4de0dc3580ca5af3cfd0f20a2691b5e Author: Werner Koch Date: Fri Dec 12 20:08:45 2014 +0100 scd: Fix possibly inhibited checkpin of the admin pin. * scd/app-openpgp.c (do_check_pin): Do not check a byte of a released buffer. Signed-off-by: Werner Koch diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c index 663b7d3..ac290c9 100644 --- a/scd/app-openpgp.c +++ b/scd/app-openpgp.c @@ -4286,7 +4286,7 @@ do_check_pin (app_t app, const char *keyidstr, log_info (_("card is permanently locked!\n")); return gpg_error (GPG_ERR_BAD_PIN); } - else if (value[6] < 3) + else if (count < 3) { log_info (_("verification of Admin PIN is currently prohibited " "through this command\n")); ----------------------------------------------------------------------- Summary of changes: doc/a-decade-of-gnupg.txt | 18 +++++++++--------- g10/keylist.c | 7 ++++++- g10/misc.c | 18 +++++++++--------- g10/sign.c | 7 +++++-- scd/app-openpgp.c | 2 +- 5 files changed, 30 insertions(+), 22 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 15 11:46:37 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 15 Dec 2014 11:46:37 +0100 Subject: [git] GPG-ERROR - branch, master, updated. libgpg-error-1.17-11-g754a987 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Error codes used by GnuPG et al.". The branch, master has been updated via 754a987f6df59e2ba0e69aada65ae4aaf593c148 (commit) via 923c4b174520c401a827d8198ebd2dc83666000f (commit) from 149fe98e1279b065edb06958d9a73a0c013c2db9 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 754a987f6df59e2ba0e69aada65ae4aaf593c148 Author: Werner Koch Date: Mon Dec 15 11:44:20 2014 +0100 Add configure option --disable-doc * Makefile.am (doc) [!BUILD_DOC]: Do not recurse into doc/. * configure.ac (BUILD_DOC): New am_conditional and new option. -- We have this option already for GnuPG and should use it for all projects. Embedded platforms usually do not require documentation and being able to disable the building avoids a lot of build dependencies. Suggested-by: Hans-Christoph Steiner diff --git a/Makefile.am b/Makefile.am index c6edd12..42cd0c4 100644 --- a/Makefile.am +++ b/Makefile.am @@ -33,7 +33,13 @@ else lang_subdirs = endif -SUBDIRS = m4 src doc tests po $(lang_subdirs) +if BUILD_DOC +doc = doc +else +doc = +endif + +SUBDIRS = m4 src $(doc) tests po $(lang_subdirs) dist-hook: gen-ChangeLog diff --git a/configure.ac b/configure.ac index 9683c81..27fda63 100644 --- a/configure.ac +++ b/configure.ac @@ -508,10 +508,17 @@ AC_DEFINE_UNQUOTED(BUILD_TIMESTAMP, "$BUILD_TIMESTAMP", -AC_ARG_ENABLE(languages, -[ --disable-languages do not build support for other languages than C]) +AC_ARG_ENABLE(languages, AC_HELP_STRING([--disable-languages], + [do not build support for other languages than C])) AM_CONDITIONAL([LANGUAGES_SOME], [test "x$enable_languages" != xno]) +build_doc=yes +AC_ARG_ENABLE([doc], AC_HELP_STRING([--disable-doc], + [do not build the documentation]), + build_doc=$enableval, build_doc=yes) +AM_CONDITIONAL([BUILD_DOC], [test "x$enable_languages" != xno]) + + # # Substitution # commit 923c4b174520c401a827d8198ebd2dc83666000f Author: Werner Koch Date: Mon Dec 15 11:40:27 2014 +0100 Add GPG_ERR_OBJ_TERM_STATE. diff --git a/NEWS b/NEWS index d6a3eb4..01eb0fb 100644 --- a/NEWS +++ b/NEWS @@ -4,6 +4,7 @@ Noteworthy changes in version 1.18 (unreleased) [C13/A13/R_] * Interface changes relative to the 1.17 release: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ GPG_ERR_FORBIDDEN NEW. + GPG_ERR_OBJ_TERM_STATE NEW. Noteworthy changes in version 1.17 (2014-10-15) [C13/A13/R0] diff --git a/doc/errorref.txt b/doc/errorref.txt index 886a304..15a2013 100644 --- a/doc/errorref.txt +++ b/doc/errorref.txt @@ -509,11 +509,6 @@ GPG_ERR_TOO_MANY Too many objects maximum Assuan line length would overflow. GPGME: - To many patterns in gpgme-tools's KEYLIST command. -GPG_ERR_NO_KEYSERVER No keyserver available - - No keyserver configured or no keyserver available due to - missing support for the requested protocol. Found in Dirmngr. - GPG_ERR_LIMIT_REACHED Limit reached A programmed limit has been reached. @@ -529,7 +524,11 @@ GPG_ERR_NOT_INITIALIZED Not initialized fulfilled. 185 GPG_ERR_MISSING_ISSUER_CERT Missing issuer certificate -186 GPG_ERR_NO_KEYSERVER No keyserver available + +GPG_ERR_NO_KEYSERVER No keyserver available + + No keyserver configured or no keyserver available due to + missing support for the requested protocol. Found in Dirmngr. GPG_ERR_INV_CURVE Invalid elliptic curve @@ -612,6 +611,11 @@ GPG_ERR_MAC_ALGO 213 GPG_ERR_SEXP_BAD_OCT_CHAR Bad octal character in S-expression +GPG_ERR_OBJ_TERM_STATE Object is in termination state + + For cards this is the ISO status word 0x6285 (file is in + termnation state). + GPG_ERR_NO_CERT_CHAIN No certificate chain diff --git a/src/err-codes.h.in b/src/err-codes.h.in index 5990bd0..11699cf 100644 --- a/src/err-codes.h.in +++ b/src/err-codes.h.in @@ -247,8 +247,9 @@ 212 GPG_ERR_SEXP_ODD_HEX_NUMBERS Odd hexadecimal numbers in S-expression 213 GPG_ERR_SEXP_BAD_OCT_CHAR Bad octal character in S-expression -# 214 to 225 are free to be used. +# 214 to 224 are free to be used. +225 GPG_ERR_OBJ_TERM_STATE Object is in termination state 226 GPG_ERR_NO_CERT_CHAIN No certificate chain 227 GPG_ERR_CERT_TOO_LARGE Certificate is too large 228 GPG_ERR_INV_RECORD Invalid record ----------------------------------------------------------------------- Summary of changes: Makefile.am | 8 +++++++- NEWS | 1 + configure.ac | 11 +++++++++-- doc/errorref.txt | 16 ++++++++++------ src/err-codes.h.in | 3 ++- 5 files changed, 29 insertions(+), 10 deletions(-) hooks/post-receive -- Error codes used by GnuPG et al. http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 15 11:55:44 2014 From: cvs at cvs.gnupg.org (by Daniel Kahn Gillmor) Date: Mon, 15 Dec 2014 11:55:44 +0100 Subject: [git] GPGME - branch, master, updated. gpgme-1.5.3-2-gc32fab4 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "GnuPG Made Easy". The branch, master has been updated via c32fab44f86921ef3f6d42e128e8ba6d287a7718 (commit) from a813c09cc792bfeed945f8573e4fd36da99a88c8 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c32fab44f86921ef3f6d42e128e8ba6d287a7718 Author: Daniel Kahn Gillmor Date: Sat Sep 6 01:04:07 2014 -0400 doc: Update gpl.texi to match version from gnupg -- Somehow the doc/gpl.texi from gpgme and gnupg drifted out of sync. This patch to gpgme's file brings it in line with gnupg's master branch, and avoids the following errors during make: ./gpl.texi:667: @section seen before @end enumerate ./gpl.texi:724: unmatched `@end enumerate' ./gpl.texi:1: warning: node next `Copying' in menu `Concept Index' and in sectioning `Function and Data Index' differ diff --git a/doc/gpl.texi b/doc/gpl.texi index 1b29a81..d13e9e4 100644 --- a/doc/gpl.texi +++ b/doc/gpl.texi @@ -1,4 +1,5 @@ @node Copying + @unnumbered GNU General Public License @center Version 3, 29 June 2007 @@ -11,7 +12,7 @@ Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. @end display - at section Preamble + at unnumberedsec Preamble The GNU General Public License is a free, copyleft license for software and other kinds of works. @@ -77,7 +78,7 @@ The precise terms and conditions for copying, distribution and modification follow. @iftex - at section TERMS AND CONDITIONS + at unnumberedsec TERMS AND CONDITIONS @end iftex @ifinfo @center TERMS AND CONDITIONS @@ -227,7 +228,7 @@ terms of section 4, provided that you also meet all of these conditions: @enumerate a - at item + at item The work must carry prominent notices stating that you modified it, and giving a relevant date. @@ -658,13 +659,16 @@ an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee. + at end enumerate + @iftex @heading END OF TERMS AND CONDITIONS @end iftex @ifinfo @center END OF TERMS AND CONDITIONS @end ifinfo - at section How to Apply These Terms to Your New Programs + + at unnumberedsec How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it @@ -674,9 +678,11 @@ terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least -the ``copyright'' line and a pointer to where the full notice is found. - at smallexample - at var{one line to give the program's name and a brief idea of what it does.} +the ``copyright'' line and a pointer to where the full notice is +found. + + at example + at var{one line to give the program's name and a brief idea of what it does.} Copyright (C) @var{year} @var{name of author} This program is free software: you can redistribute it and/or modify @@ -691,17 +697,21 @@ General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see @url{http://www.gnu.org/licenses/}. - at end smallexample + at end example + at noindent Also add information on how to contact you by electronic and paper mail. + at noindent If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode: @smallexample - at var{program} Copyright (C) @var{year} @var{name of author} -This program comes with ABSOLUTELY NO WARRANTY; for details type @samp{show w}. -This is free software, and you are welcome to redistribute it under certain conditions; type @samp{show c} for details. + at var{program} Copyright (C) @var{year} @var{name of author} +This program comes with ABSOLUTELY NO WARRANTY; for details +type @samp{show w}. This is free software, and you are +welcome to redistribute it under certain conditions; +type @samp{show c} for details. @end smallexample The hypothetical commands @samp{show w} and @samp{show c} should show @@ -720,5 +730,3 @@ library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read @url{http://www.gnu.org/philosophy/why-not-lgpl.html}. - - at end enumerate ----------------------------------------------------------------------- Summary of changes: doc/gpl.texi | 34 +++++++++++++++++++++------------- 1 file changed, 21 insertions(+), 13 deletions(-) hooks/post-receive -- GnuPG Made Easy http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 15 12:15:04 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 15 Dec 2014 12:15:04 +0100 Subject: [git] GPG-ERROR - branch, master, updated. libgpg-error-1.17-12-gbcd9295 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Error codes used by GnuPG et al.". The branch, master has been updated via bcd9295d5b9c9f46478bff0680f57bd71b4061f8 (commit) from 754a987f6df59e2ba0e69aada65ae4aaf593c148 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit bcd9295d5b9c9f46478bff0680f57bd71b4061f8 Author: Werner Koch Date: Mon Dec 15 12:15:44 2014 +0100 Fix commit 754a987. * Makefile.am (DISTCHECK_CONFIGURE_FLAGS): New. (AUTOMAKE_OPTIONS): Move options to ... * configure.ac (AM_INIT_AUTOMAKE): .. here. (BUILD_DOC): Fix commit 754a987. diff --git a/Makefile.am b/Makefile.am index 42cd0c4..e5f3f56 100644 --- a/Makefile.am +++ b/Makefile.am @@ -17,7 +17,7 @@ # License along with this program; if not, see . ACLOCAL_AMFLAGS = -I m4 -AUTOMAKE_OPTIONS = dist-bzip2 +DISTCHECK_CONFIGURE_FLAGS = --enable-doc # (A suitable gitlog-to-changelog script can be found in GnuPG master.) GITLOG_TO_CHANGELOG=gitlog-to-changelog diff --git a/configure.ac b/configure.ac index 27fda63..c1ea013 100644 --- a/configure.ac +++ b/configure.ac @@ -65,7 +65,7 @@ VERSION_NUMBER=m4_esyscmd(printf "0x%02x%02x00" mym4_version_major \ AC_SUBST(VERSION_NUMBER) AC_CONFIG_AUX_DIR([build-aux]) -AM_INIT_AUTOMAKE +AM_INIT_AUTOMAKE([dist-bzip2]) AM_MAINTAINER_MODE AC_CONFIG_SRCDIR([src/err-sources.h.in]) AC_CONFIG_HEADER([config.h]) @@ -516,7 +516,7 @@ build_doc=yes AC_ARG_ENABLE([doc], AC_HELP_STRING([--disable-doc], [do not build the documentation]), build_doc=$enableval, build_doc=yes) -AM_CONDITIONAL([BUILD_DOC], [test "x$enable_languages" != xno]) +AM_CONDITIONAL([BUILD_DOC], [test "x$build_doc" != xno]) # ----------------------------------------------------------------------- Summary of changes: Makefile.am | 2 +- configure.ac | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) hooks/post-receive -- Error codes used by GnuPG et al. http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 15 12:15:43 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 15 Dec 2014 12:15:43 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-135-gad50e36 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via ad50e360ef4851e66e51a03fc420175636336b58 (commit) from 4f46374502eb988d701b904f83819e2cf7b1755c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ad50e360ef4851e66e51a03fc420175636336b58 Author: Werner Koch Date: Mon Dec 15 12:05:32 2014 +0100 build: Add configure option --disable-doc. * Makefile.am (AUTOMAKE_OPTIONS): Remove. (doc) [!BUILD_DOC]: Do not recurse into the dir. * configure.ac (AM_INIT_AUTOMAKE): Add option formerly in Makefile.am. (BUILD_DOC): Add new am_conditional. diff --git a/Makefile.am b/Makefile.am index 937bdaf..2d7ca43 100644 --- a/Makefile.am +++ b/Makefile.am @@ -18,15 +18,21 @@ # Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA ACLOCAL_AMFLAGS = -I m4 -AUTOMAKE_OPTIONS = dist-bzip2 -DISTCHECK_CONFIGURE_FLAGS = --disable-random-daemon \ +DISTCHECK_CONFIGURE_FLAGS = --disable-random-daemon --enable-doc \ --enable-ciphers=arcfour:blowfish:cast5:des:aes:twofish:serpent:rfc2268:seed:camellia # (A suitable gitlog-to-changelog script can be found in GnuPG master.) GITLOG_TO_CHANGELOG=gitlog-to-changelog +if BUILD_DOC +doc = doc +else +doc = +endif + + DIST_SUBDIRS = m4 compat mpi cipher random src doc tests -SUBDIRS = compat mpi cipher random src doc tests +SUBDIRS = compat mpi cipher random src $(doc) tests EXTRA_DIST = autogen.sh autogen.rc README.GIT LICENSES \ ChangeLog-2011 build-aux/ChangeLog-2011 doc/ChangeLog-2011 \ diff --git a/configure.ac b/configure.ac index c979d57..a4ea990 100644 --- a/configure.ac +++ b/configure.ac @@ -75,7 +75,7 @@ VERSION=$PACKAGE_VERSION AC_CONFIG_AUX_DIR([build-aux]) AC_CONFIG_SRCDIR([src/libgcrypt.vers]) -AM_INIT_AUTOMAKE +AM_INIT_AUTOMAKE([dist-bzip2]) AC_CONFIG_HEADER(config.h) AC_CONFIG_MACRO_DIR([m4]) AC_CONFIG_LIBOBJ_DIR([compat]) @@ -2090,6 +2090,16 @@ AC_SUBST([GCRYPT_HWF_MODULES]) # +# Option to disable building of doc file +# +build_doc=yes +AC_ARG_ENABLE([doc], AC_HELP_STRING([--disable-doc], + [do not build the documentation]), + build_doc=$enableval, build_doc=yes) +AM_CONDITIONAL([BUILD_DOC], [test "x$build_doc" != xno]) + + +# # Provide information about the build. # BUILD_REVISION="mym4_revision" ----------------------------------------------------------------------- Summary of changes: Makefile.am | 12 +++++++++--- configure.ac | 12 +++++++++++- 2 files changed, 20 insertions(+), 4 deletions(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 15 17:39:28 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 15 Dec 2014 17:39:28 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.0-77-gdd65e21 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via dd65e21cb4934b40e6f2f7a8095f39fd6d9971bc (commit) from fc9a35d2dec2f838abac831fd88dca494773e082 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit dd65e21cb4934b40e6f2f7a8095f39fd6d9971bc Author: Werner Koch Date: Mon Dec 15 17:38:40 2014 +0100 gpg: Add sub-command "factory-reset" to --card-edit. * common/util.h (GPG_ERR_OBJ_TERM_STATE): New. * scd/iso7816.c (map_sw): Add this error code. * scd/app-openpgp.c (do_getattr): Return the life cycle indicator. * scd/app.c (select_application): Allow a return value of GPG_ERR_OBJ_TERM_STATE. * scd/scdaemon.c (set_debug): Print the DBG_READER value. * g10/call-agent.c (start_agent): Print a status line for the termination state. (agent_scd_learn): Make arg "info" optional. (agent_scd_apdu): New. * g10/card-util.c (send_apdu): New. (factory_reset): New. (card_edit): Add command factory-reset. Signed-off-by: Werner Koch diff --git a/common/util.h b/common/util.h index a6f8606..94878bc 100644 --- a/common/util.h +++ b/common/util.h @@ -38,7 +38,8 @@ /* These error codes are used but not defined in the required libgpg-error version. Define them here. */ #if GPG_ERROR_VERSION_NUMBER < 0x011200 /* 1.18 */ -# define GPG_ERR_FORBIDDEN 251 +# define GPG_ERR_OBJ_TERM_STATE 225 +# define GPG_ERR_FORBIDDEN 251 #endif diff --git a/doc/DETAILS b/doc/DETAILS index 9ad616c..ba2725f 100644 --- a/doc/DETAILS +++ b/doc/DETAILS @@ -765,6 +765,7 @@ pkd:0:1024:B665B1435F4C2 .... FF26ABB: - 4 :: No card available - 5 :: No card reader available - 6 :: No card support available + - 7 :: Card is in termination state *** SC_OP_FAILURE [] An operation on a smartcard definitely failed. Currently there is diff --git a/g10/call-agent.c b/g10/call-agent.c index 43a5c4e..0450b81 100644 --- a/g10/call-agent.c +++ b/g10/call-agent.c @@ -343,6 +343,9 @@ start_agent (ctrl_t ctrl, int for_card) case GPG_ERR_NO_SCDAEMON: write_status_text (STATUS_CARDCTRL, "6"); break; + case GPG_ERR_OBJ_TERM_STATE: + write_status_text (STATUS_CARDCTRL, "7"); + break; default: write_status_text (STATUS_CARDCTRL, "4"); log_info ("selecting openpgp failed: %s\n", gpg_strerror (rc)); @@ -586,6 +589,8 @@ learn_status_cb (void *opaque, const char *line) parm->extcap.ki = abool; else if (!strcmp (p, "aac")) parm->extcap.aac = abool; + else if (!strcmp (p, "si")) + parm->status_indicator = strtoul (p2, NULL, 10); } } xfree (buf); @@ -657,6 +662,9 @@ agent_scd_learn (struct agent_card_info_s *info) struct default_inq_parm_s parm; struct agent_card_info_s dummyinfo; + if (!info) + info = &dummyinfo; + memset (info, 0, sizeof *info); memset (&parm, 0, sizeof parm); rc = start_agent (NULL, 1); @@ -675,11 +683,7 @@ agent_scd_learn (struct agent_card_info_s *info) if (rc) return rc; - if (!info) - info = &dummyinfo; - parm.ctx = agent_ctx; - memset (info, 0, sizeof *info); rc = assuan_transact (agent_ctx, "LEARN --sendinfo", dummy_data_cb, NULL, default_inq_cb, &parm, learn_status_cb, info); @@ -694,6 +698,63 @@ agent_scd_learn (struct agent_card_info_s *info) } +/* Send an APDU to the current card. On success the status word is + stored at R_SW. With HEXAPDU being NULL only a RESET command is + send to scd. With HEXAPDU being the string "undefined" the command + "SERIALNO undefined" is send to scd. */ +gpg_error_t +agent_scd_apdu (const char *hexapdu, unsigned int *r_sw) +{ + gpg_error_t err; + + /* Start the agent but not with the card flag so that we do not + autoselect the openpgp application. */ + err = start_agent (NULL, 0); + if (err) + return err; + + if (!hexapdu) + { + err = assuan_transact (agent_ctx, "SCD RESET", + NULL, NULL, NULL, NULL, NULL, NULL); + + } + else if (!strcmp (hexapdu, "undefined")) + { + err = assuan_transact (agent_ctx, "SCD SERIALNO undefined", + NULL, NULL, NULL, NULL, NULL, NULL); + } + else + { + char line[ASSUAN_LINELENGTH]; + membuf_t mb; + unsigned char *data; + size_t datalen; + + init_membuf (&mb, 256); + + snprintf (line, DIM(line)-1, "SCD APDU %s", hexapdu); + err = assuan_transact (agent_ctx, line, + membuf_data_cb, &mb, NULL, NULL, NULL, NULL); + if (!err) + { + data = get_membuf (&mb, &datalen); + if (!data) + err = gpg_error_from_syserror (); + else if (datalen < 2) /* Ooops */ + err = gpg_error (GPG_ERR_CARD); + else + { + *r_sw = (data[datalen-2] << 8) | data[datalen-1]; + } + xfree (data); + } + } + + return err; +} + + int agent_keytocard (const char *hexgrip, int keyno, int force, const char *serialno, const char *timestamp) diff --git a/g10/call-agent.h b/g10/call-agent.h index a24941e..bcb5ae9 100644 --- a/g10/call-agent.h +++ b/g10/call-agent.h @@ -61,6 +61,7 @@ struct agent_card_info_s unsigned int ki:1; /* Key import available. */ unsigned int aac:1; /* Algorithm attributes are changeable. */ } extcap; + unsigned int status_indicator; }; struct agent_card_genkey_s { @@ -78,6 +79,9 @@ void agent_release_card_info (struct agent_card_info_s *info); /* Return card info. */ int agent_scd_learn (struct agent_card_info_s *info); +/* Send an APDU to the card. */ +gpg_error_t agent_scd_apdu (const char *hexapdu, unsigned int *r_sw); + /* Update INFO with the attribute NAME. */ int agent_scd_getattr (const char *name, struct agent_card_info_s *info); diff --git a/g10/card-util.c b/g10/card-util.c index 0535c1d..b030fad 100644 --- a/g10/card-util.c +++ b/g10/card-util.c @@ -1635,6 +1635,169 @@ card_store_subkey (KBNODE node, int use) } + +/* Direct sending of an hex encoded APDU with error printing. */ +static gpg_error_t +send_apdu (const char *hexapdu, const char *desc, unsigned int ignore) +{ + gpg_error_t err; + unsigned int sw; + + err = agent_scd_apdu (hexapdu, &sw); + if (err) + tty_printf ("sending card command %s failed: %s\n", desc, + gpg_strerror (err)); + else if (!hexapdu || !strcmp (hexapdu, "undefined")) + ; + else if (ignore == 0xffff) + ; /* Ignore all status words. */ + else if (sw != 0x9000) + { + switch (sw) + { + case 0x6285: err = gpg_error (GPG_ERR_OBJ_TERM_STATE); break; + case 0x6982: err = gpg_error (GPG_ERR_BAD_PIN); break; + case 0x6985: err = gpg_error (GPG_ERR_USE_CONDITIONS); break; + default: err = gpg_error (GPG_ERR_CARD); + } + if (!(ignore && ignore == sw)) + tty_printf ("card command %s failed: %s (0x%04x)\n", desc, + gpg_strerror (err), sw); + } + return err; +} + + +/* Do a factory reset after confirmation. */ +static void +factory_reset (void) +{ + struct agent_card_info_s info; + gpg_error_t err; + char *answer = NULL; + int termstate = 0; + int i; + + /* The code below basically does the same what this + gpg-connect-agent script does: + + scd reset + scd serialno undefined + scd apdu 00 A4 04 00 06 D2 76 00 01 24 01 + scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40 + scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40 + scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40 + scd apdu 00 20 00 81 08 40 40 40 40 40 40 40 40 + scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40 + scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40 + scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40 + scd apdu 00 20 00 83 08 40 40 40 40 40 40 40 40 + scd apdu 00 e6 00 00 + scd reset + scd serialno undefined + scd apdu 00 A4 04 00 06 D2 76 00 01 24 01 + scd apdu 00 44 00 00 + /echo Card has been reset to factory defaults + + but tries to find out something about the card first. + */ + + err = agent_scd_learn (&info); + if (gpg_err_code (err) == GPG_ERR_OBJ_TERM_STATE + && gpg_err_source (err) == GPG_ERR_SOURCE_SCD) + termstate = 1; + else if (err) + { + log_error (_("OpenPGP card not available: %s\n"), gpg_strerror (err)); + return; + } + + if (!termstate) + { + log_info (_("OpenPGP card no. %s detected\n"), + info.serialno? info.serialno : "[none]"); + if (!(info.status_indicator == 3 || info.status_indicator == 5)) + { + /* Note: We won't see status-indicator 3 here because it is not + possible to select a card application in termination state. */ + log_error (_("This command is not supported by this card\n")); + goto leave; + } + + tty_printf ("\n"); + log_info (_("Note: This command destroys all keys stored on the card!\n")); + tty_printf ("\n"); + if (!cpr_get_answer_is_yes ("cardedit.factory-reset.proceed", + _("Continue? (y/N) "))) + goto leave; + + + answer = cpr_get ("cardedit.factory-reset.really", + _("Really do a factory reset? (enter \"yes\") ")); + cpr_kill_prompt (); + trim_spaces (answer); + if (strcmp (answer, "yes")) + goto leave; + + /* We need to select a card application before we can send APDUs + to the card without scdaemon doing anything on its own. */ + err = send_apdu (NULL, "RESET", 0); + if (err) + goto leave; + err = send_apdu ("undefined", "dummy select ", 0); + if (err) + goto leave; + + /* Select the OpenPGP application. */ + err = send_apdu ("00A4040006D27600012401", "SELECT AID", 0); + if (err) + goto leave; + + /* Do some dummy verifies with wrong PINs to set the retry + counter to zero. We can't easily use the card version 2.1 + feature of presenting the admin PIN to allow the terminate + command because there is no machinery in scdaemon to catch + the verify command and ask for the PIN when the "APDU" + command is used. */ + for (i=0; i < 4; i++) + send_apdu ("00200081084040404040404040", "VERIFY", 0xffff); + for (i=0; i < 4; i++) + send_apdu ("00200083084040404040404040", "VERIFY", 0xffff); + + /* Send terminate datafile command. */ + err = send_apdu ("00e60000", "TERMINATE DF", 0x6985); + if (err) + goto leave; + } + + /* The card is in termination state - reset and select again. */ + err = send_apdu (NULL, "RESET", 0); + if (err) + goto leave; + err = send_apdu ("undefined", "dummy select", 0); + if (err) + goto leave; + + /* Select the OpenPGP application. (no error checking here). */ + send_apdu ("00A4040006D27600012401", "SELECT AID", 0xffff); + + /* Send activate datafile command. This is used without + confirmation if the card is already in termination state. */ + err = send_apdu ("00440000", "ACTIVATE DF", 0); + if (err) + goto leave; + + /* Finally we reset the card reader once more. */ + err = send_apdu (NULL, "RESET", 0); + if (err) + goto leave; + + leave: + xfree (answer); + agent_release_card_info (&info); +} + + /* Data used by the command parser. This needs to be outside of the function scope to allow readline based command completion. */ @@ -1644,7 +1807,7 @@ enum cmdids cmdQUIT, cmdADMIN, cmdHELP, cmdLIST, cmdDEBUG, cmdVERIFY, cmdNAME, cmdURL, cmdFETCH, cmdLOGIN, cmdLANG, cmdSEX, cmdCAFPR, cmdFORCESIG, cmdGENERATE, cmdPASSWD, cmdPRIVATEDO, cmdWRITECERT, - cmdREADCERT, cmdUNBLOCK, + cmdREADCERT, cmdUNBLOCK, cmdFACTORYRESET, cmdINVCMD }; @@ -1676,6 +1839,7 @@ static struct { "passwd" , cmdPASSWD, 0, N_("menu to change or unblock the PIN")}, { "verify" , cmdVERIFY, 0, N_("verify the PIN and list all data")}, { "unblock" , cmdUNBLOCK,0, N_("unblock the PIN using a Reset Code") }, + { "factory-reset", cmdFACTORYRESET, 1, N_("destroy all keys and data")}, /* Note, that we do not announce these command yet. */ { "privatedo", cmdPRIVATEDO, 0, NULL }, { "readcert", cmdREADCERT, 0, NULL }, @@ -1848,7 +2012,7 @@ card_edit (ctrl_t ctrl, strlist_t commands) for (i=0; cmds[i].name; i++ ) if(cmds[i].desc && (!cmds[i].admin_only || (cmds[i].admin_only && allow_admin))) - tty_printf("%-10s %s\n", cmds[i].name, _(cmds[i].desc) ); + tty_printf("%-14s %s\n", cmds[i].name, _(cmds[i].desc) ); break; case cmdADMIN: @@ -1953,6 +2117,10 @@ card_edit (ctrl_t ctrl, strlist_t commands) change_pin (1, allow_admin); break; + case cmdFACTORYRESET: + factory_reset (); + break; + case cmdQUIT: goto leave; diff --git a/scd/apdu.h b/scd/apdu.h index 2e518b1..7e30f76 100644 --- a/scd/apdu.h +++ b/scd/apdu.h @@ -53,7 +53,7 @@ enum { SW_CLA_NOT_SUP = 0x6e00, SW_SUCCESS = 0x9000, - /* The follwoing statuswords are no real ones but used to map host + /* The following statuswords are no real ones but used to map host OS errors into status words. A status word is 16 bit so that those values can't be issued by a card. */ SW_HOST_OUT_OF_CORE = 0x10001, /* No way yet to differentiate diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c index ac290c9..daf0310 100644 --- a/scd/app-openpgp.c +++ b/scd/app-openpgp.c @@ -1073,10 +1073,10 @@ do_getattr (app_t app, ctrl_t ctrl, const char *name) } if (table[idx].special == -2) { - char tmp[100]; + char tmp[110]; snprintf (tmp, sizeof tmp, - "gc=%d ki=%d fc=%d pd=%d mcl3=%u aac=%d sm=%d", + "gc=%d ki=%d fc=%d pd=%d mcl3=%u aac=%d sm=%d si=%u", app->app_local->extcap.get_challenge, app->app_local->extcap.key_import, app->app_local->extcap.change_force_chv, @@ -1085,7 +1085,8 @@ do_getattr (app_t app, ctrl_t ctrl, const char *name) app->app_local->extcap.algo_attr_change, (app->app_local->extcap.sm_supported ? (app->app_local->extcap.sm_aes128? 7 : 2) - : 0)); + : 0), + app->app_local->status_indicator); send_status_info (ctrl, table[idx].name, tmp, strlen (tmp), NULL, 0); return 0; } diff --git a/scd/app.c b/scd/app.c index 1694ea1..5fa06b0 100644 --- a/scd/app.c +++ b/scd/app.c @@ -389,7 +389,7 @@ select_application (ctrl_t ctrl, int slot, const char *name, app_t *r_app) err = app_select_dinsig (app); if (err && is_app_allowed ("sc-hsm") && (!name || !strcmp (name, "sc-hsm"))) err = app_select_sc_hsm (app); - if (err && name) + if (err && name && gpg_err_code (err) != GPG_ERR_OBJ_TERM_STATE) err = gpg_error (GPG_ERR_NOT_SUPPORTED); leave: diff --git a/scd/iso7816.c b/scd/iso7816.c index f1dbcff..3c43a4c 100644 --- a/scd/iso7816.c +++ b/scd/iso7816.c @@ -64,7 +64,7 @@ map_sw (int sw) switch (sw) { case SW_EEPROM_FAILURE: ec = GPG_ERR_HARDWARE; break; - case SW_TERM_STATE: ec = GPG_ERR_CARD; break; + case SW_TERM_STATE: ec = GPG_ERR_OBJ_TERM_STATE; break; case SW_WRONG_LENGTH: ec = GPG_ERR_INV_VALUE; break; case SW_SM_NOT_SUP: ec = GPG_ERR_NOT_SUPPORTED; break; case SW_CC_NOT_SUP: ec = GPG_ERR_NOT_SUPPORTED; break; diff --git a/scd/scdaemon.c b/scd/scdaemon.c index 763ce2d..7c786c2 100644 --- a/scd/scdaemon.c +++ b/scd/scdaemon.c @@ -344,7 +344,7 @@ set_debug (const char *level) gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose); if (opt.debug) - log_info ("enabled debug flags:%s%s%s%s%s%s%s%s%s\n", + log_info ("enabled debug flags:%s%s%s%s%s%s%s%s%s%s\n", (opt.debug & DBG_COMMAND_VALUE)? " command":"", (opt.debug & DBG_MPI_VALUE )? " mpi":"", (opt.debug & DBG_CRYPTO_VALUE )? " crypto":"", @@ -353,7 +353,8 @@ set_debug (const char *level) (opt.debug & DBG_MEMSTAT_VALUE)? " memstat":"", (opt.debug & DBG_HASHING_VALUE)? " hashing":"", (opt.debug & DBG_ASSUAN_VALUE )? " assuan":"", - (opt.debug & DBG_CARD_IO_VALUE)? " cardio":""); + (opt.debug & DBG_CARD_IO_VALUE)? " cardio":"", + (opt.debug & DBG_READER_VALUE )? " reader":""); } ----------------------------------------------------------------------- Summary of changes: common/util.h | 3 +- doc/DETAILS | 1 + g10/call-agent.c | 69 +++++++++++++++++++-- g10/call-agent.h | 4 ++ g10/card-util.c | 172 ++++++++++++++++++++++++++++++++++++++++++++++++++++- scd/apdu.h | 2 +- scd/app-openpgp.c | 7 ++- scd/app.c | 2 +- scd/iso7816.c | 2 +- scd/scdaemon.c | 5 +- 10 files changed, 252 insertions(+), 15 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 15 18:12:17 2014 From: cvs at cvs.gnupg.org (by Andre Heinecke) Date: Mon, 15 Dec 2014 18:12:17 +0100 Subject: [git] Pinentry - branch, master, updated. pinentry-0.9.0-4-gbb42362 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The standard pinentry collection". The branch, master has been updated via bb423620fca82159e60ab25de3c608a0243088b0 (commit) via c911657710893643558f91ec497fac2831d91040 (commit) from 484465338ea6f5f12eb1341ca0ef84aa79224ed4 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit bb423620fca82159e60ab25de3c608a0243088b0 Author: Andre Heinecke Date: Mon Dec 15 18:07:32 2014 +0100 qt4: Improve moc handling * configure.ac: Disable pinentry-qt4 or exit if moc not found. * m4/qt.m4: Look for and prefer moc-qt4. * qt4/Makefile.am: Add moc files to nodist and clean them. -- Files generated by MOC vary over the used Qt versions (even inside a Major release). Distributing them leads to errors if a different qt version is installed. GnuPG-bug-id: 1784 diff --git a/configure.ac b/configure.ac index c2644c9..1cbd8b2 100644 --- a/configure.ac +++ b/configure.ac @@ -335,7 +335,19 @@ fi) fi if test "$pinentry_qt4" != "no"; then + QT_PATH_MOC +if test "$have_moc" != "yes"; then + if test "$pinentry_qt4" = "yes"; then + AC_MSG_ERROR([[ + *** + *** Qt moc is required. + ***]]) + else + pinentry_qt4=no + fi +fi + PKG_CHECK_MODULES(QT4_GUI, QtGui,, if test "$pinentry_qt4" = "yes"; then AC_MSG_ERROR([[ diff --git a/m4/qt.m4 b/m4/qt.m4 index 42f33e1..a6b849b 100644 --- a/m4/qt.m4 +++ b/m4/qt.m4 @@ -59,7 +59,7 @@ AC_DEFUN([QT_PATH_MOC], qt_bindirs="$ac_qt_bindir:$qt_bindirs" fi - AC_PATH_PROG(MOC, moc, no, [$qt_bindirs]) + AC_PATH_PROGS(MOC, [moc-qt4 moc], no, [$qt_bindirs]) if test "$MOC" = no; then #AC_MSG_ERROR([No Qt meta object compiler (moc) found! #Please check whether you installed Qt correctly. diff --git a/qt4/Makefile.am b/qt4/Makefile.am index 6dd5f25..e52169c 100644 --- a/qt4/Makefile.am +++ b/qt4/Makefile.am @@ -44,16 +44,15 @@ pinentry_qt4_LDADD = $(QT4_CORE_LIBS) $(QT4_GUI_LIBS) $(libcurses) \ BUILT_SOURCES = \ pinentryconfirm.moc qsecurelineedit.moc pinentrydialog.moc -MAINTAINERCLEANFILES = \ +CLEANFILES = \ pinentryconfirm.moc qsecurelineedit.moc pinentrydialog.moc -EXTRA_DIST += \ - pinentryconfirm.moc qsecurelineedit.moc pinentrydialog.moc - pinentry_qt4_SOURCES = pinentrydialog.h pinentrydialog.cpp \ main.cpp secstring.h secstring.cpp qsecurelineedit.h \ qsecurelineedit.cpp qrc_pinentry.cpp \ - qsecurelineedit_p.h pinentryconfirm.cpp pinentryconfirm.h \ + qsecurelineedit_p.h pinentryconfirm.cpp pinentryconfirm.h + +nodist_pinentry_qt4_SOURCES = \ pinentryconfirm.moc qsecurelineedit.moc pinentrydialog.moc .h.moc: commit c911657710893643558f91ec497fac2831d91040 Author: Andre Heinecke Date: Mon Dec 15 17:38:05 2014 +0100 doc: Update gpl.texi to match version from gcrypt * doc/gpl.texi: Use version from gcrypt. -- This fixes build errors with texinfo 5.2 diff --git a/doc/gpl.texi b/doc/gpl.texi index ca0508f..6eb301e 100644 --- a/doc/gpl.texi +++ b/doc/gpl.texi @@ -1,5 +1,5 @@ @node Copying - at appendix GNU GENERAL PUBLIC LICENSE + at unnumbered GNU General Public License @cindex GPL, GNU General Public License @center Version 2, June 1991 @@ -12,7 +12,7 @@ Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. @end display - at appendixsubsec Preamble + at heading Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public @@ -63,7 +63,7 @@ patent must be licensed for everyone's free use or not licensed at all. modification follow. @iftex - at appendixsubsec TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + at heading TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION @end iftex @ifinfo @center TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION @@ -287,12 +287,7 @@ make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. - at iftex - at heading NO WARRANTY - at end iftex - at ifinfo @center NO WARRANTY - at end ifinfo @item BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY @@ -325,7 +320,7 @@ POSSIBILITY OF SUCH DAMAGES. @end ifinfo @page - at unnumberedsec How to Apply These Terms to Your New Programs + at heading How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it @@ -364,7 +359,7 @@ when it starts in an interactive mode: Gnomovision version 69, Copyright (C) 19 at var{yy} @var{name of author} Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome -to redistribute it under certain conditions; type `show c' +to redistribute it under certain conditions; type `show c' for details. @end smallexample @@ -382,7 +377,7 @@ necessary. Here is a sample; alter the names: @group Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' -(which makes passes at compilers) written +(which makes passes at compilers) written by James Hacker. @var{signature of Ty Coon}, 1 April 1989 ----------------------------------------------------------------------- Summary of changes: configure.ac | 12 ++++++++++++ doc/gpl.texi | 17 ++++++----------- m4/qt.m4 | 2 +- qt4/Makefile.am | 9 ++++----- 4 files changed, 23 insertions(+), 17 deletions(-) hooks/post-receive -- The standard pinentry collection http://git.gnupg.org From cvs at cvs.gnupg.org Tue Dec 16 10:37:28 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Tue, 16 Dec 2014 10:37:28 +0100 Subject: [git] gnupg-doc - branch, master, updated. c4e8dde54e3ba7f91c484612c4ed0d2978bcdb13 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via c4e8dde54e3ba7f91c484612c4ed0d2978bcdb13 (commit) via 25ce7c92239477fdcc83e59c7159f13548fd7105 (commit) via 2b1e6cc2d57fb5aed1e01935f23e1a3218581ae8 (commit) from 4b80ae2446dac4b4eacf5e9b29170b9fdc763f8c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit c4e8dde54e3ba7f91c484612c4ed0d2978bcdb13 Author: Werner Koch Date: Tue Dec 16 10:38:26 2014 +0100 web: Fixed the layout of people/. This fixes a regression due to the change of the "figure" class for the blogs. diff --git a/web/people/index.org b/web/people/index.org index 246c21d..af24b66 100644 --- a/web/people/index.org +++ b/web/people/index.org @@ -15,8 +15,9 @@ ** Werner Koch - #+ATTR_HTML: :class people :title Werner Koch - [[file:werner.png]] + #+HTML:
        + #+HTML:

        + #+HTML:
        /Core components maintainer/ @@ -33,8 +34,9 @@ ** David Shaw - #+ATTR_HTML: :class people :title David Shaw - [[file:david.png]] + #+HTML:
        + #+HTML:

        + #+HTML:
        /Master of the classic branch/ @@ -49,8 +51,9 @@ ** Marcus Brinkmann - #+ATTR_HTML: :class people :title Marcus Brinkmann - [[file:marcus.png]] + #+HTML:
        + #+HTML:

        + #+HTML:
        /Hacker emeritus/ @@ -64,8 +67,9 @@ ** NIIBE Yutaka - #+ATTR_HTML: :class people :title NIIBE Yutaka - [[file:gniibe.png]] + #+HTML:
        + #+HTML:

        + #+HTML:
        /Smartcards and Libgcrypt/ @@ -77,8 +81,9 @@ ** Jussi Kivilinna - #+ATTR_HTML: :class people :title Jussi Kivilinna - [[file:jussi.png]] + #+HTML:
        + #+HTML:

        + #+HTML:
        /Optimization/ diff --git a/web/share/site.css b/web/share/site.css index 8678c06..c2b816a 100644 --- a/web/share/site.css +++ b/web/share/site.css @@ -124,13 +124,6 @@ img.rfloat { margin-left: 1em; } -img.people { - float: left; - margin-right: 1em; - margin-bottom: 1em; - min-width: 120px; -} - /* The figure class is used by the blog entries. We use display to suppress the figure number inserted by org-mode. */ @@ -622,6 +615,16 @@ td.right { } +/* Used by the list of people. */ +.people { + float: left; + margin-top: 1em; + margin-right: 1em; + margin-bottom: 1em; + min-width: 120px; +} + + /* Forms */ .inputpanel { background-color: #FAEBD7; commit 25ce7c92239477fdcc83e59c7159f13548fd7105 Author: Werner Koch Date: Tue Dec 16 10:13:19 2014 +0100 web: Add fundraising message diff --git a/web/donate/index.org b/web/donate/index.org index d92e5dc..793af3b 100644 --- a/web/donate/index.org +++ b/web/donate/index.org @@ -31,14 +31,19 @@ ** Ways to donate - Paying using a credit card is currently our preferred choice. [[https://en.wikipedia.org/wiki/Single_Euro_Payments_Area][SEPA]] - payments will soon be acceptable but we have not yet automated this - process. If you have a Paypal account you may use that too. + Paying using a credit card is currently our preferred choice. If + you have a Paypal account you may use that too. Because the GnuPG project is not tax exempted, we are not able to - send you a respective donation receipt. However, if you represent a - company, you may want to enter into a support contract with [[https://g10code.com][g10^code]] - or ask for other service options. + send you a respective donation receipt. If you can benefit from a + donation receipt by a Germany charity you may donate to the GnuPG + account at the [[https://www.wauland.de/en/donation.html#61][Wau Holland Stiftung]]; they will use the money raised + to pay for development work on GnuPG and Enigmail. If you want to + be listed on our [[https://www.gnupg.org/donate/kudos.html][thank you]] page you should indicate this by adding a + comment of the form =List me as: NAME= to your donation. + + If you represent a company, you may also enter into a support + contract with [[https://g10code.com][g10^code]] or ask for other service options. ** Donation form @@ -51,15 +56,16 @@ #+BEGIN_HTML -
        +

        Keep this field clear:

        - + @@ -88,6 +94,7 @@ + +
        How much do you want to donate? - (choosing ?other? allows to donate in other currencies)How much do you want to donate?
        + (choosing ?other? allows + to donate in other currencies)
        Amount:
         
        Pay using: @@ -103,6 +110,7 @@ value="pp" />PayPal
         
        diff --git a/web/index.org b/web/index.org index d692170..0e1b493 100644 --- a/web/index.org +++ b/web/index.org @@ -2,6 +2,40 @@ #+STARTUP: showall #+SETUPFILE: "share/setup.inc" + +* Securing the future of GnuPG + +Work on GnuPG is mostly financed from donations. To continue +maintaining GnuPG so to keep it strong and secure against the ever +increasing mass surveillance we need your support. Until the end of +November we received a total of 6584\thinsp\euro (~5500 net) donations +for this year. Along with the 18000\thinsp\euro net from the [[https://www.gnupg.org/blog/20140512-rewards-sent.html][Goteo +campaign]] this paid for less less than 50% of the costs for one +developer. + +#+BEGIN_HTML +
        +
        +

         

        +

        + + + + + +

        +

        +#+END_HTML + +For a critical project of this size two experienced developers are +required for proper operation. This requires gross revenues of 120000 +Euro per year. Unfortunately there is currently only one underpaid +full time developer who is barely able to keep up with the work. +Please help to secure the future of GnuPG and consider to [[file:donate/index.org][donate]] to +this project [[file:donate/index.org][now]]. + + * The GNU Privacy Guard #+index: GnuPG #+index: GPG @@ -21,13 +55,18 @@ GnuPG is [[http://www.gnu.org/philosophy/free-sw.html][Free Software]] (meaning be freely used, modified and distributed under the terms of the [[http://www.gnu.org/copyleft/gpl.html][GNU General Public License]] . -GnuPG comes in two flavours: [[download][{{{gnupg1_ver}}}]] is the old and very -portable standalone version, whereas [[download][{{{gnupg_ver}}}]] is the enhanced -and modern version and suggested for most users. +GnuPG comes in three flavours: + + - {{{gnupg_ver}}} is the /stable/ version suggested for most users, -Project [[http://www.gpg4win.org][Gpg4win]] provides a Windows version of GnuPG. It is nicely -integrated into an installer and features several frontends as well as -English and German manuals. + - {{{gnupg21_ver}}} is the brand-new /modern/ version with support + for [[https://en.wikipedia.org/wiki/Elliptic_curve_cryptography][ECC]] and many other new features, + + - and {{{gnupg1_ver}}} is the /classic/ portable version. + +Project [[http://www.gpg4win.org][Gpg4win]] provides a Windows version of GnuPG /stable/. It is +nicely integrated into an installer and features several frontends as +well as English and German manuals. * Reconquer your privacy @@ -40,7 +79,6 @@ used to uncover his secrets about the NSA. Please visit the [[https://emailselfdefense.fsf.org][Email Self-Defense]] site to learn how and why you should use GnuPG for your electronic communication. - * Latest news #+index: News diff --git a/web/share/site.css b/web/share/site.css index f91beef..8678c06 100644 --- a/web/share/site.css +++ b/web/share/site.css @@ -454,6 +454,10 @@ h3 { font-size: 0.8em; } +.smallnote { + font-size: 0.8em; +} + #footer { border-top: 2px solid #5c6064; margin-top: 5em; @@ -618,6 +622,11 @@ td.right { } +/* Forms */ +.inputpanel { + background-color: #FAEBD7; +} + /* Donation stuff. */ .buttonbox { commit 2b1e6cc2d57fb5aed1e01935f23e1a3218581ae8 Author: Werner Koch Date: Mon Dec 15 20:48:41 2014 +0100 tools: Add --test option to mkkudos and include the main page. diff --git a/tools/mkkudos.sh b/tools/mkkudos.sh index ae1831e..d477d69 100755 --- a/tools/mkkudos.sh +++ b/tools/mkkudos.sh @@ -2,25 +2,20 @@ set -e -htdocs="/var/www/www/www.gnupg.org/htdocs" -#htdocs="/home/wk/s/gnupg-doc/web" - -donors="$htdocs/donate/donors.dat" -donations="$htdocs/donate/donations.dat" - - usage() { cat <&2; @@ -62,13 +70,17 @@ monyear=$(echo "$tmp" | awk -F: 'BEGIN { m[1] = "January"; m[6] = "June"; m[7] = "July"; m[8] = "August"; m[9] = "September"; m[10] = "October"; m[11] = "November"; m[12] = "December"; } {printf "%s %d", m[$2] , $1}') -euro=$(echo "$tmp" | awk -F: '{printf "%d Euro", int($8 + 0.5)}') -euroyr=$(echo "$tmp" | awk -F: '{printf "%d Euro", int($10 + 0.5)}') +euro=$(echo "$tmp" | awk -F: '{printf "%d €", int($8 + 0.5)}') +euroyr=$(echo "$tmp" | awk -F: '{printf "%d €", int($10 + 0.5)}') n=$(echo "$tmp" | awk -F: '{printf "%d", $7}') nyr=$(echo "$tmp" | awk -F: '{printf "%d", $9}') +goal="120000" +percent=$(echo "$euro:$goal" | awk -F: '{printf "%d",(int($1)*100)/int($2)}') for file in "$htdocs/donate/"kudos-????.html "$htdocs/donate/"kudos.html \ - "$htdocs/donate/"index.html; do + "$htdocs/donate/"index.html \ + "$htdocs/"index.html + do if [ $force = no ]; then [ "$file" -ot "$donors" ] || continue fi @@ -82,7 +94,7 @@ for file in "$htdocs/donate/"kudos-????.html "$htdocs/donate/"kudos.html \ [ -f "$file.tmp" ] && rm "$file.tmp" awk -F: -v year=$year -v donors="$donors" \ -v monyear="$monyear" -v euro="$euro" -v euroyr="$euroyr" \ - -v n="$n" -v nyr="$nyr" \ + -v n="$n" -v nyr="$nyr" -v goal="$goal" -v percent="$percent" \ <"$file" >"$file.tmp" ' // {indon=1; print; insert("") } // {indon=0} @@ -110,6 +122,20 @@ for file in "$htdocs/donate/"kudos-????.html "$htdocs/donate/"kudos.html \ printf " %s\n", nyr; next } + // { + printf "%s\n", + euro; + next + } + // { + printf "goal: %s €\n", goal; + next + } + // { + printf "style=\"width: %d%%\"\n", + percent; + next + } !indon { print } function insert (tag) { ----------------------------------------------------------------------- Summary of changes: tools/mkkudos.sh | 48 +++++++++++++++++++++++++++++++++++----------- web/donate/index.org | 26 ++++++++++++++++--------- web/index.org | 52 +++++++++++++++++++++++++++++++++++++++++++------- web/people/index.org | 25 ++++++++++++++---------- web/share/site.css | 26 ++++++++++++++++++------- 5 files changed, 133 insertions(+), 44 deletions(-) hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Tue Dec 16 17:47:48 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Tue, 16 Dec 2014 17:47:48 +0100 Subject: [git] gnupg-doc - branch, master, updated. 47aa329b0ba798717e09a413f197ca6a0fc7e403 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via 47aa329b0ba798717e09a413f197ca6a0fc7e403 (commit) from c4e8dde54e3ba7f91c484612c4ed0d2978bcdb13 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 47aa329b0ba798717e09a413f197ca6a0fc7e403 Author: Werner Koch Date: Tue Dec 16 17:41:00 2014 +0100 web: Update for the release of 2.1.1 diff --git a/web/download/index.org b/web/download/index.org index a0ec6aa..ede8133 100644 --- a/web/download/index.org +++ b/web/download/index.org @@ -101,7 +101,7 @@ |---------+--------------------+---------------------------------------------| | | <18> | | | Windows | [[http://gpg4win.org/download.html][Gpg4win]] | Installers for /GnuPG stable/ | - | | --- | Simple installer for /GnuPG modern/ | + | | {{{ftpopen}}}{{{ftp_base}}}/binary/gnupg-w32-{{{gnupg21_w32_ver}}}.exe{{{ftpclose}}} {{{ftpopen}}}{{{ftp_base}}}/binary/gnupg-w32-{{{gnupg21_w32_ver}}}.exe.sig{{{ftpcloseS}}} | Simple installer for /GnuPG modern/ | | | {{{ftpopen}}}{{{ftp_base}}}/binary/gnupg-w32cli-{{{gnupg1_w32cli_ver}}}.exe{{{ftpclose}}} {{{ftpopen}}}{{{ftp_base}}}/binary/gnupg-w32cli-{{{gnupg1_w32cli_ver}}}.exe.sig{{{ftpcloseS}}} | Simple installer for /GnuPG classic/ | | OS X | [[http://gpgtools.org][Mac GPG]] | Installer from the gpgtools project | | Debian | [[https://www.debian.org][Debian site]] | GnuPG stable and classic are part of Debian | @@ -111,6 +111,5 @@ | RISC OS | [[http://www.sbellon.de/gnupg.html][home page]] | Sources and binaries for RISC OS | |---------+--------------------+---------------------------------------------| -# | | {{{ftpopen}}}{{{ftp_base}}}/binary/gnupg-w32-{{{gnupg21_w32_ver}}}.exe{{{ftpclose}}} {{{ftpopen}}}{{{ftp_base}}}/binary/gnupg-w32-{{{gnupg21_w32_ver}}}.exe.sig{{{ftpcloseS}}} | Simple installer for /GnuPG modern/ | # eof # diff --git a/web/index.org b/web/index.org index 0e1b493..7eaae07 100644 --- a/web/index.org +++ b/web/index.org @@ -89,6 +89,12 @@ all [[file:news.org][news of previous years]] is also available. # GnuPG's latest news are available as [[http://feedvalidator.org/check.cgi?url%3Dhttps://www.gnupg.org/news.en.rss][RSS 2.0 compliant]] feed. Just # point or paste the [[news.en.rss][RSS file]] into your aggregator. +** GnuPG 2.1.1 released (2014-12-16) + +This is the second release of the /modern/ branch of GnuPG. It fixes +a lot of bugs and brings some new features. Read more about 2.1 at +the [[file:faq/whats-new-in-2.1.org][feature overview]] page and in the [[http://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000360.html][announcement]] mail. + ** Libksba 1.3.2 released :important: diff --git a/web/swdb.mac b/web/swdb.mac index 41d48df..9dbf061 100644 --- a/web/swdb.mac +++ b/web/swdb.mac @@ -17,14 +17,14 @@ # # GnuPG-2.1 # -#+macro: gnupg21_ver 2.1.0 +#+macro: gnupg21_ver 2.1.1 #+macro: gnupg21_branch master -#+macro: gnupg21_size 3039k -#+macro: gnupg21_sha1 2fcd0ca6889ef6cb59e3275e8411f8b7778c2f33 +#+macro: gnupg21_size 4689k +#+macro: gnupg21_sha1 3d11fd150cf86f842d077437edb119a775c7325d # -#+macro: gnupg21_w32_ver 2.1.0_20141105 -#+macro: gnupg21_w32_size 6225k -#+macro: gnupg21_w32_sha1 9907cb6509a0e63331b27a92e25c1ef956caaf3b +#+macro: gnupg21_w32_ver 2.1.1_20141216 +#+macro: gnupg21_w32_size 6364k +#+macro: gnupg21_w32_sha1 fb541b8685b78541c9b2fadb026787f535863b4a # ----------------------------------------------------------------------- Summary of changes: web/download/index.org | 3 +-- web/index.org | 6 ++++++ web/swdb.mac | 12 ++++++------ 3 files changed, 13 insertions(+), 8 deletions(-) hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Wed Dec 17 01:56:35 2014 From: cvs at cvs.gnupg.org (by NIIBE Yutaka) Date: Wed, 17 Dec 2014 01:56:35 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-2-gb1b1923 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via b1b1923b06acbe9d0b653445548530e949ea5b9a (commit) from 22168c83599f2411755e669d767f569dccc6cc87 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b1b1923b06acbe9d0b653445548530e949ea5b9a Author: NIIBE Yutaka Date: Wed Dec 17 09:54:19 2014 +0900 po: Update Japanese Translation. -- Investigated who is P.KATOH, and fixed the header, accordingly. diff --git a/po/ja.po b/po/ja.po index b0b3386..e603c3f 100644 --- a/po/ja.po +++ b/po/ja.po @@ -1,15 +1,16 @@ # Japanese messages for GnuPG # Copyright (C) 1999, 2000, 2002, 2003, 2004, 2013 Free Software Foundation, Inc. +# This file is distributed under the same license as the GnuPG package. # IIDA Yosiaki , 1999, 2000, 2002, 2003, 2004. # Yoshihiro Kajiki , 1999. -# This file is distributed under the same license as the GnuPG package. -# Special thanks to "Takashi P.KATOH". +# Takashi P.KATOH, 2002. +# NIIBE Yutaka , 2013, 2014. # msgid "" msgstr "" -"Project-Id-Version: gnupg 2.1\n" +"Project-Id-Version: gnupg 2.1.1\n" "Report-Msgid-Bugs-To: translations at gnupg.org\n" -"PO-Revision-Date: 2014-11-18 13:01+0900\n" +"PO-Revision-Date: 2014-12-17 09:43+0900\n" "Last-Translator: NIIBE Yutaka \n" "Language-Team: none\n" "Language: ja\n" @@ -762,10 +763,8 @@ msgstr "agent???????%d?????\n" msgid "connection to agent established\n" msgstr "??????????????????\n" -#, fuzzy -#| msgid "connection to agent established\n" msgid "connection to agent is in restricted mode\n" -msgstr "??????????????????\n" +msgstr "???????????????????\n" #, c-format msgid "no running Dirmngr - starting '%s'\n" @@ -1314,23 +1313,17 @@ msgstr "?????????????????:\n" msgid "KEYTOCARD failed: %s\n" msgstr "KEYTOCARD???????: %s\n" -#, fuzzy -#| msgid "This command is not allowed while in %s mode.\n" msgid "This command is not supported by this card\n" -msgstr "%s????????????????\n" +msgstr "???????????????????????????\n" -#, fuzzy -#| msgid "Note: keys are already stored on the card!\n" msgid "Note: This command destroys all keys stored on the card!\n" -msgstr "*??*: ??????????????????!\n" +msgstr "*??*: ????????????????????????????!\n" -#, fuzzy -#| msgid "Continue? (Y/n) " msgid "Continue? (y/N) " -msgstr "?????? (Y/n) " +msgstr "?????? (y/N) " msgid "Really do a factory reset? (enter \"yes\") " -msgstr "" +msgstr "??????????????? (???? \"yes\" ???) " msgid "quit this menu" msgstr "?????????" @@ -1381,7 +1374,7 @@ msgid "unblock the PIN using a Reset Code" msgstr "PIN?Reset Code??????" msgid "destroy all keys and data" -msgstr "" +msgstr "???????????????" msgid "gpg/card> " msgstr "gpg/card> " @@ -2270,10 +2263,8 @@ msgstr "%lu?????\n" msgid "Total number processed: %lu\n" msgstr " ??????: %lu\n" -#, fuzzy, c-format -#| msgid " skipped new keys: %lu\n" msgid " skipped PGP-2 keys: %lu\n" -msgstr "??????????: %lu\n" +msgstr "??????PGP-2?: %lu\n" #, c-format msgid " skipped new keys: %lu\n" @@ -5375,10 +5366,8 @@ msgstr "RSA?? %s ??????????%d????????? msgid "failed to store the key: %s\n" msgstr "???????????: %s\n" -#, fuzzy -#| msgid "unsupported inquiry '%s'\n" msgid "unsupported curve\n" -msgstr "???????????????: '%s'\n" +msgstr "????????????\n" msgid "please wait while key is being generated ...\n" msgstr "????????????? ...\n" @@ -5481,10 +5470,8 @@ msgstr "fd %d????????????\n" msgid "invalid radix64 character %02x skipped\n" msgstr "???64???%02X?????????\n" -#, fuzzy -#| msgid "no gpg-agent running in this session\n" msgid "no dirmngr running in this session\n" -msgstr "????????gpg-agent??????????\n" +msgstr "????????dirmngr??????????\n" #, c-format msgid "validation model requested by certificate: %s" ----------------------------------------------------------------------- Summary of changes: po/ja.po | 41 ++++++++++++++--------------------------- 1 file changed, 14 insertions(+), 27 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Wed Dec 17 10:38:40 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Wed, 17 Dec 2014 10:38:40 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-3-g5cb6df8 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 5cb6df8996623c00eaa2a39e3037101585442f7e (commit) from b1b1923b06acbe9d0b653445548530e949ea5b9a (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5cb6df8996623c00eaa2a39e3037101585442f7e Author: Werner Koch Date: Wed Dec 17 10:36:24 2014 +0100 gpgconf: Exit with failure if --launch fails. * tools/gpgconf-comp.c (gc_component_launch): Return an error code. * tools/gpgconf.c (main): Exit if launch failed. -- GnuPG-bug-id: 1791 diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c index 77139bb..8c47b2e 100644 --- a/tools/gpgconf-comp.c +++ b/tools/gpgconf-comp.c @@ -1142,7 +1142,7 @@ dirmngr_runtime_change (int killflag) /* Launch the gpg-agent or the dirmngr if not already running. */ -void +gpg_error_t gc_component_launch (int component) { gpg_error_t err; @@ -1176,6 +1176,7 @@ gc_component_launch (int component) " NOP", gpg_strerror (err)); gnupg_release_process (pid); + return err; } diff --git a/tools/gpgconf.c b/tools/gpgconf.c index 31804f5..423a66c 100644 --- a/tools/gpgconf.c +++ b/tools/gpgconf.c @@ -281,9 +281,17 @@ main (int argc, char **argv) exit (1); } else if (cmd == aLaunch) - gc_component_launch (idx); + { + if (gc_component_launch (idx)) + exit (1); + } else - gc_component_kill (idx); + { + /* We don't error out if the kill failed because this + command should do nothing if the component is not + running. */ + gc_component_kill (idx); + } } break; diff --git a/tools/gpgconf.h b/tools/gpgconf.h index 0286c27..d63833d 100644 --- a/tools/gpgconf.h +++ b/tools/gpgconf.h @@ -45,7 +45,7 @@ char *gc_percent_escape (const char *src); void gc_error (int status, int errnum, const char *fmt, ...); /* Launch given component. */ -void gc_component_launch (int component); +gpg_error_t gc_component_launch (int component); /* Kill given component. */ void gc_component_kill (int component); ----------------------------------------------------------------------- Summary of changes: tools/gpgconf-comp.c | 3 ++- tools/gpgconf.c | 12 ++++++++++-- tools/gpgconf.h | 2 +- 3 files changed, 13 insertions(+), 4 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Dec 19 13:08:19 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 19 Dec 2014 13:08:19 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-6-g14601ea Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 14601eacb51f6c8a60d3d57aee1be11debd94c68 (commit) via aad8963f7b9d13b319abd413db8f42ec467db913 (commit) via abec64f3cb04e49ca48cc476a5830a920e2ebf8f (commit) from 5cb6df8996623c00eaa2a39e3037101585442f7e (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 14601eacb51f6c8a60d3d57aee1be11debd94c68 Author: Werner Koch Date: Fri Dec 19 13:07:09 2014 +0100 agent: Keep the session environment for restricted connections. * agent/command-ssh.c (setup_ssh_env): Move code to ... * agent/gpg-agent.c (agent_copy_startup_env): .. new function. Change calllers. * agent/command.c (start_command_handler): Call that fucntion for restricted connections. -- A remote connection is and should not be able to setup the local session environment. However, unless --keep-display is used we would be left without an environment and thus pinentry can't be used. The fix is the same as used for ssh-agent connection: We use the default environment as used at the startup of the agent. Signed-off-by: Werner Koch diff --git a/agent/agent.h b/agent/agent.h index a1663cd..c7c65af 100644 --- a/agent/agent.h +++ b/agent/agent.h @@ -278,6 +278,7 @@ typedef int (*lookup_ttl_t)(const char *hexgrip); /*-- gpg-agent.c --*/ void agent_exit (int rc) JNLIB_GCC_A_NR; /* Also implemented in other tools */ +gpg_error_t agent_copy_startup_env (ctrl_t ctrl); const char *get_agent_socket_name (void); const char *get_agent_ssh_socket_name (void); #ifdef HAVE_W32_SYSTEM diff --git a/agent/command-ssh.c b/agent/command-ssh.c index 2d00512..51d2c54 100644 --- a/agent/command-ssh.c +++ b/agent/command-ssh.c @@ -3578,38 +3578,6 @@ ssh_request_process (ctrl_t ctrl, estream_t stream_sock) } -/* Because the ssh protocol does not send us information about the - current TTY setting, we use this function to use those from startup - or those explictly set. */ -static gpg_error_t -setup_ssh_env (ctrl_t ctrl) -{ - static const char *names[] = - {"GPG_TTY", "DISPLAY", "TERM", "XAUTHORITY", "PINENTRY_USER_DATA", NULL}; - gpg_error_t err = 0; - int idx; - const char *value; - - for (idx=0; !err && names[idx]; idx++) - if ((value = session_env_getenv (opt.startup_env, names[idx]))) - err = session_env_setenv (ctrl->session_env, names[idx], value); - - if (!err && !ctrl->lc_ctype && opt.startup_lc_ctype) - if (!(ctrl->lc_ctype = xtrystrdup (opt.startup_lc_ctype))) - err = gpg_error_from_syserror (); - - if (!err && !ctrl->lc_messages && opt.startup_lc_messages) - if (!(ctrl->lc_messages = xtrystrdup (opt.startup_lc_messages))) - err = gpg_error_from_syserror (); - - if (err) - log_error ("error setting default session environment: %s\n", - gpg_strerror (err)); - - return err; -} - - /* Start serving client on SOCK_CLIENT. */ void start_command_handler_ssh (ctrl_t ctrl, gnupg_fd_t sock_client) @@ -3618,7 +3586,7 @@ start_command_handler_ssh (ctrl_t ctrl, gnupg_fd_t sock_client) gpg_error_t err; int ret; - err = setup_ssh_env (ctrl); + err = agent_copy_startup_env (ctrl); if (err) goto out; @@ -3681,7 +3649,7 @@ serve_mmapped_ssh_request (ctrl_t ctrl, u32 msglen; estream_t request_stream, response_stream; - if (setup_ssh_env (ctrl)) + if (agent_copy_startup_env (ctrl)) goto leave; /* Error setting up the environment. */ if (maxreqlen < 5) diff --git a/agent/command.c b/agent/command.c index eba766b..da7e508 100644 --- a/agent/command.c +++ b/agent/command.c @@ -3113,6 +3113,12 @@ start_command_handler (ctrl_t ctrl, gnupg_fd_t listen_fd, gnupg_fd_t fd) int rc; assuan_context_t ctx = NULL; + if (ctrl->restricted) + { + if (agent_copy_startup_env (ctrl)) + return; + } + rc = assuan_new (&ctx); if (rc) { diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c index de40e3b..b053fc5 100644 --- a/agent/gpg-agent.c +++ b/agent/gpg-agent.c @@ -1386,6 +1386,39 @@ agent_deinit_default_ctrl (ctrl_t ctrl) } +/* Because the ssh protocol does not send us information about the + current TTY setting, we use this function to use those from startup + or those explictly set. This is also used for the restricted mode + where we ignore requests to change the environment. */ +gpg_error_t +agent_copy_startup_env (ctrl_t ctrl) +{ + static const char *names[] = + {"GPG_TTY", "DISPLAY", "TERM", "XAUTHORITY", "PINENTRY_USER_DATA", NULL}; + gpg_error_t err = 0; + int idx; + const char *value; + + for (idx=0; !err && names[idx]; idx++) + if ((value = session_env_getenv (opt.startup_env, names[idx]))) + err = session_env_setenv (ctrl->session_env, names[idx], value); + + if (!err && !ctrl->lc_ctype && opt.startup_lc_ctype) + if (!(ctrl->lc_ctype = xtrystrdup (opt.startup_lc_ctype))) + err = gpg_error_from_syserror (); + + if (!err && !ctrl->lc_messages && opt.startup_lc_messages) + if (!(ctrl->lc_messages = xtrystrdup (opt.startup_lc_messages))) + err = gpg_error_from_syserror (); + + if (err) + log_error ("error setting default session environment: %s\n", + gpg_strerror (err)); + + return err; +} + + /* Reread parts of the configuration. Note, that this function is obviously not thread-safe and should only be called from the PTH signal handler. diff --git a/common/session-env.c b/common/session-env.c index 478d5e3..8f78c10 100644 --- a/common/session-env.c +++ b/common/session-env.c @@ -56,7 +56,7 @@ struct session_environment_s }; -/* A list of environment vribales we pass from the acual user +/* A list of environment vribales we pass from the actual user (e.g. gpgme) down to the pinentry. We do not handle the locale settings because they do not only depend on envvars. */ static struct commit aad8963f7b9d13b319abd413db8f42ec467db913 Author: Werner Koch Date: Fri Dec 19 12:03:38 2014 +0100 agent: Fix string prepended to remotely initiated prompts. * agent/command.c (cmd_setkeydesc): Use %0A and not \n. Make translatable. Signed-off-by: Werner Koch diff --git a/agent/command.c b/agent/command.c index c875f55..eba766b 100644 --- a/agent/command.c +++ b/agent/command.c @@ -731,7 +731,7 @@ cmd_setkeydesc (assuan_context_t ctx, char *line) if (ctrl->restricted) ctrl->server_local->keydesc = strconcat - ("Note: Request from a remote site.\n\n", desc, NULL); + (_("Note: Request from a remote site."), "%0A%0A", desc, NULL); else ctrl->server_local->keydesc = xtrystrdup (desc); if (!ctrl->server_local->keydesc) commit abec64f3cb04e49ca48cc476a5830a920e2ebf8f Author: Werner Koch Date: Thu Dec 18 09:38:41 2014 +0100 build: Remove option to build without agent. * configure.ac (build-agent): Set to yes. diff --git a/configure.ac b/configure.ac index 09e683d..16843f4 100644 --- a/configure.ac +++ b/configure.ac @@ -110,7 +110,8 @@ large_secmem=no GNUPG_BUILD_PROGRAM(gpg, yes) GNUPG_BUILD_PROGRAM(gpgsm, yes) -GNUPG_BUILD_PROGRAM(agent, yes) +# The agent is a required part and can't be disabled anymore. +build_agent=yes GNUPG_BUILD_PROGRAM(scdaemon, yes) GNUPG_BUILD_PROGRAM(g13, yes) GNUPG_BUILD_PROGRAM(dirmngr, yes) ----------------------------------------------------------------------- Summary of changes: agent/agent.h | 1 + agent/command-ssh.c | 36 ++---------------------------------- agent/command.c | 8 +++++++- agent/gpg-agent.c | 33 +++++++++++++++++++++++++++++++++ common/session-env.c | 2 +- configure.ac | 3 ++- 6 files changed, 46 insertions(+), 37 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Fri Dec 19 13:27:44 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Fri, 19 Dec 2014 13:27:44 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-7-g7614014 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 76140141699b545f7a988bf5fc101063917e8ce3 (commit) from 14601eacb51f6c8a60d3d57aee1be11debd94c68 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 76140141699b545f7a988bf5fc101063917e8ce3 Author: Werner Koch Date: Fri Dec 19 13:28:14 2014 +0100 agent: Make sure --max-cache-ttl is >= --default-cache-ttl. * agent/gpg-agent.c (finalize_rereadable_options): New. (main, reread_configuration): Call it. -- This change should help to avoid surprising behaviour. Signed-off-by: Werner Koch diff --git a/NEWS b/NEWS index 4bf2a44..f4a6918 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,10 @@ Noteworthy changes in version 2.1.2 (unreleased) ------------------------------------------------ + * agent: When setting --default-cache-ttl the value for + --max-cache-ttl is adjusted to be not lower than the former. + + Noteworthy changes in version 2.1.1 (2014-12-16) ------------------------------------------------ diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c index b053fc5..918c72b 100644 --- a/agent/gpg-agent.c +++ b/agent/gpg-agent.c @@ -628,6 +628,20 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread) } +/* Fixup some options after all have been processed. */ +static void +finalize_rereadable_options (void) +{ + /* It would be too surprising if the max-cache-ttl is lower than the + default-cache-ttl - thus we silently correct that. */ + if (opt.def_cache_ttl > opt.max_cache_ttl) + opt.max_cache_ttl = opt.def_cache_ttl; + if (opt.def_cache_ttl_ssh > opt.max_cache_ttl_ssh) + opt.max_cache_ttl_ssh = opt.def_cache_ttl_ssh; +} + + + /* The main entry point. */ int main (int argc, char **argv ) @@ -916,6 +930,8 @@ main (int argc, char **argv ) if (log_get_errorcount(0)) exit(2); + finalize_rereadable_options (); + /* Turn the homedir into an absolute one. */ opt.homedir = make_absfilename (opt.homedir, NULL); @@ -1461,6 +1477,7 @@ reread_configuration (void) parse_rereadable_options (&pargs, 1); } fclose (fp); + finalize_rereadable_options (); set_debug (); } ----------------------------------------------------------------------- Summary of changes: NEWS | 4 ++++ agent/gpg-agent.c | 17 +++++++++++++++++ 2 files changed, 21 insertions(+) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 22 01:29:45 2014 From: cvs at cvs.gnupg.org (by NIIBE Yutaka) Date: Mon, 22 Dec 2014 01:29:45 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-8-gbdc8efb Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via bdc8efbdd124d836c36cf482216e375421f72891 (commit) from 76140141699b545f7a988bf5fc101063917e8ce3 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit bdc8efbdd124d836c36cf482216e375421f72891 Author: NIIBE Yutaka Date: Mon Dec 22 09:27:00 2014 +0900 scd: ECDH Support. * agent/divert-scd.c (divert_pkdecrypt): Support ECDH. * scd/app-openpgp.c (get_algo_byte, store_fpr): Support ECDH. (send_key_attr): Support ECDH. Fix EdDSA algorithm value. (retrieve_key_material): Initialize fields. (get_public_key, ecc_writekey, do_writekey): Support ECDH. (ecdh_writekey): Remove. (do_decipher): Support ECDH. (parse_algorithm_attribute): Support ECDH. Fix EdDSA. -- Following the gpg-agent protocol, SCDaemon's counter part is now implemented. diff --git a/agent/divert-scd.c b/agent/divert-scd.c index ceef588..1408d65 100644 --- a/agent/divert-scd.c +++ b/agent/divert-scd.c @@ -417,17 +417,45 @@ divert_pkdecrypt (ctrl_t ctrl, n = snext (&s); if (!n) return gpg_error (GPG_ERR_INV_SEXP); - if (!smatch (&s, n, "rsa")) + if (smatch (&s, n, "rsa")) + { + if (*s != '(') + return gpg_error (GPG_ERR_UNKNOWN_SEXP); + s++; + n = snext (&s); + if (!n) + return gpg_error (GPG_ERR_INV_SEXP); + if (!smatch (&s, n, "a")) + return gpg_error (GPG_ERR_UNKNOWN_SEXP); + n = snext (&s); + } + else if (smatch (&s, n, "ecdh")) + { + if (*s != '(') + return gpg_error (GPG_ERR_UNKNOWN_SEXP); + s++; + n = snext (&s); + if (!n) + return gpg_error (GPG_ERR_INV_SEXP); + if (smatch (&s, n, "s")) + { + n = snext (&s); + s += n; + if (*s++ != ')') + return gpg_error (GPG_ERR_INV_SEXP); + if (*s++ != '(') + return gpg_error (GPG_ERR_UNKNOWN_SEXP); + n = snext (&s); + if (!n) + return gpg_error (GPG_ERR_INV_SEXP); + } + if (!smatch (&s, n, "e")) + return gpg_error (GPG_ERR_UNKNOWN_SEXP); + n = snext (&s); + } + else return gpg_error (GPG_ERR_UNSUPPORTED_ALGORITHM); - if (*s != '(') - return gpg_error (GPG_ERR_UNKNOWN_SEXP); - s++; - n = snext (&s); - if (!n) - return gpg_error (GPG_ERR_INV_SEXP); - if (!smatch (&s, n, "a")) - return gpg_error (GPG_ERR_UNKNOWN_SEXP); - n = snext (&s); + if (!n) return gpg_error (GPG_ERR_UNKNOWN_SEXP); ciphertext = s; diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c index daf0310..475d844 100644 --- a/scd/app-openpgp.c +++ b/scd/app-openpgp.c @@ -120,8 +120,7 @@ static struct { /* Type of keys. */ typedef enum { - KEY_TYPE_ECDH, - KEY_TYPE_ECDSA, + KEY_TYPE_ECC, KEY_TYPE_EDDSA, KEY_TYPE_RSA, } @@ -236,15 +235,10 @@ struct app_local_s { } rsa; struct { int curve; - } ecdsa; + } ecc; struct { int curve; } eddsa; - struct { - int curve; - int hashalgo; - int cipheralgo; - } ecdh; }; } keyattr[3]; }; @@ -745,11 +739,11 @@ parse_login_data (app_t app) static unsigned char -get_algo_byte (key_type_t key_type) +get_algo_byte (int keynumber, key_type_t key_type) { - if (key_type == KEY_TYPE_ECDSA) + if (key_type == KEY_TYPE_ECC && keynumber != 1) return 19; - else if (key_type == KEY_TYPE_ECDH) + else if (key_type == KEY_TYPE_ECC && keynumber == 1) return 18; else if (key_type == KEY_TYPE_EDDSA) return 22; @@ -777,13 +771,10 @@ store_fpr (app_t app, int keynumber, u32 timestamp, int i; n = 6; /* key packet version, 4-byte timestamps, and algorithm */ - if (key_type == KEY_TYPE_RSA || key_type == KEY_TYPE_ECDSA - || key_type == KEY_TYPE_EDDSA) - argc = 2; - else if (key_type == KEY_TYPE_ECDH) + if (keynumber == 1 && key_type == KEY_TYPE_ECC) argc = 3; else - return gpg_error (GPG_ERR_NOT_IMPLEMENTED); + argc = 2; va_start (ap, key_type); for (i = 0; i < argc; i++) @@ -812,7 +803,7 @@ store_fpr (app_t app, int keynumber, u32 timestamp, *p++ = timestamp >> 16; *p++ = timestamp >> 8; *p++ = timestamp; - *p++ = get_algo_byte (key_type); + *p++ = get_algo_byte (keynumber, key_type); for (i = 0; i < argc; i++) { @@ -977,27 +968,18 @@ send_key_attr (ctrl_t ctrl, app_t app, const char *keyword, int number) app->app_local->keyattr[number].rsa.n_bits, app->app_local->keyattr[number].rsa.e_bits, app->app_local->keyattr[number].rsa.format); - else if (app->app_local->keyattr[number].key_type == KEY_TYPE_ECDSA) + else if (app->app_local->keyattr[number].key_type == KEY_TYPE_ECC) { - get_ecc_key_parameters (app->app_local->keyattr[number].ecdsa.curve, + get_ecc_key_parameters (app->app_local->keyattr[number].ecc.curve, &n_bits, &curve_oid); - snprintf (buffer, sizeof buffer, "%d 19 %u %s", - number+1, n_bits, curve_oid); - } - else if (app->app_local->keyattr[number].key_type == KEY_TYPE_ECDH) - { - get_ecc_key_parameters (app->app_local->keyattr[number].ecdh.curve, - &n_bits, &curve_oid); - snprintf (buffer, sizeof buffer, "%d 18 %u %s %d %d", - number+1, n_bits, curve_oid, - app->app_local->keyattr[number].ecdh.hashalgo, - app->app_local->keyattr[number].ecdh.cipheralgo); + snprintf (buffer, sizeof buffer, "%d %d %u %s", + number+1, number==1? 18: 19, n_bits, curve_oid); } else if (app->app_local->keyattr[number].key_type == KEY_TYPE_EDDSA) { get_ecc_key_parameters (app->app_local->keyattr[number].eddsa.curve, &n_bits, &curve_oid); - snprintf (buffer, sizeof buffer, "%d 105 %u %s", + snprintf (buffer, sizeof buffer, "%d 22 %u %s", number+1, n_bits, curve_oid); } else @@ -1215,7 +1197,7 @@ retrieve_key_material (FILE *fp, const char *hexkeyid, for (;;) { char *p; - char *fields[6]; + char *fields[6] = { NULL, NULL, NULL, NULL, NULL, NULL }; int nfields; size_t max_length; gcry_mpi_t mpi; @@ -1530,10 +1512,10 @@ get_public_key (app_t app, int keyno) gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, keybuf, len); gcry_sexp_release (s_pkey); } - else if (app->app_local->keyattr[keyno].key_type == KEY_TYPE_ECDSA) + else if (app->app_local->keyattr[keyno].key_type == KEY_TYPE_ECC) { const char *curve_name - = get_curve_name (app->app_local->keyattr[keyno].ecdsa.curve); + = get_curve_name (app->app_local->keyattr[keyno].ecc.curve); err = gcry_sexp_build (&s_pkey, NULL, "(public-key(ecc(curve%s)(q%b)))", @@ -3227,23 +3209,6 @@ rsa_writekey (app_t app, gpg_error_t (*pincb)(void*, const char *, char **), static gpg_error_t -ecdh_writekey (app_t app, gpg_error_t (*pincb)(void*, const char *, char **), - void *pincb_arg, int keyno, - const unsigned char *buf, size_t buflen, int depth) -{ - (void)app; - (void)pincb; - (void)pincb_arg; - (void)keyno; - (void)buf; - (void)buflen; - (void)depth; - - return GPG_ERR_NOT_IMPLEMENTED; -} - - -static gpg_error_t ecc_writekey (app_t app, gpg_error_t (*pincb)(void*, const char *, char **), void *pincb_arg, int keyno, const unsigned char *buf, size_t buflen, int depth) @@ -3419,15 +3384,15 @@ ecc_writekey (app_t app, gpg_error_t (*pincb)(void*, const char *, char **), } err = store_fpr (app, keyno, created_at, fprbuf, app->card_version, - curve == CURVE_ED25519 ? KEY_TYPE_EDDSA : KEY_TYPE_ECDSA, + curve == CURVE_ED25519 ? KEY_TYPE_EDDSA : KEY_TYPE_ECC, curve == CURVE_ED25519 ? "\x09\x2b\x06\x01\x04\x01\xda\x47\x0f\x01" : curve == CURVE_NIST_P256 ? "\x08\x2a\x86\x48\xce\x3d\x03\x01\x07" - : "\05\x2b\x81\x04\x00\x0a", + : "\x05\x2b\x81\x04\x00\x0a", curve == CURVE_ED25519 ? 10 : curve == CURVE_NIST_P256? 9 : 6, - ecc_q, ecc_q_len); + ecc_q, ecc_q_len, "\x03\x01\x08\x07", 4); if (err) goto leave; @@ -3501,14 +3466,11 @@ do_writekey (app_t app, ctrl_t ctrl, goto leave; if (tok && toklen == 3 && memcmp ("rsa", tok, toklen) == 0) err = rsa_writekey (app, pincb, pincb_arg, keyno, buf, buflen, depth); - else if ((tok && toklen == 3 && memcmp ("ecc", tok, toklen) == 0 - && (keyno == 0 || keyno == 2)) - || (tok && toklen == 5 && memcmp ("ecdsa", tok, toklen) == 0)) + else if (tok + && ((toklen == 3 && memcmp ("ecc", tok, toklen) == 0) + || (toklen == 4 && memcmp ("ecdh", tok, toklen) == 0) + || (toklen == 5 && memcmp ("ecdsa", tok, toklen) == 0))) err = ecc_writekey (app, pincb, pincb_arg, keyno, buf, buflen, depth); - else if ((tok && toklen == 3 && memcmp ("ecc", tok, toklen) == 0 - && keyno == 1) - || (tok && toklen == 4 && memcmp ("ecdh", tok, toklen) == 0)) - err = ecdh_writekey (app, pincb, pincb_arg, keyno, buf, buflen, depth); else { err = gpg_error (GPG_ERR_WRONG_PUBKEY_ALGO); @@ -3995,7 +3957,7 @@ do_auth (app_t app, const char *keyidstr, && indatalen > 101) /* For a 2048 bit key. */ return gpg_error (GPG_ERR_INV_VALUE); - if (app->app_local->keyattr[2].key_type == KEY_TYPE_ECDSA + if (app->app_local->keyattr[2].key_type == KEY_TYPE_ECC && (indatalen == 51 || indatalen == 67 || indatalen == 83)) { const char *p = (const char *)indata + 19; @@ -4083,6 +4045,8 @@ do_decipher (app_t app, const char *keyidstr, int n; const char *fpr = NULL; int exmode, le_value; + unsigned char *fixbuf = NULL; + int padind = 0; if (!keyidstr || !*keyidstr || !indatalen) return gpg_error (GPG_ERR_INV_VALUE); @@ -4124,11 +4088,12 @@ do_decipher (app_t app, const char *keyidstr, return rc; rc = verify_chv2 (app, pincb, pincb_arg); - if (!rc) + if (rc) + return rc; + + if (app->app_local->keyattr[1].key_type == KEY_TYPE_RSA) { int fixuplen; - unsigned char *fixbuf = NULL; - int padind = 0; /* We might encounter a couple of leading zeroes in the cryptogram. Due to internal use of MPIs these leading zeroes @@ -4180,33 +4145,37 @@ do_decipher (app_t app, const char *keyidstr, /* We use the extra leading zero as the padding byte. */ padind = -1; } + } + else if (app->app_local->keyattr[1].key_type == KEY_TYPE_ECC) + padind = -1; + else + return gpg_error (GPG_ERR_INV_VALUE); - if (app->app_local->cardcap.ext_lc_le && indatalen > 254 ) - { - exmode = 1; /* Extended length w/o a limit. */ - le_value = app->app_local->extcap.max_rsp_data; - } - else if (app->app_local->cardcap.cmd_chaining && indatalen > 254) - { - exmode = -254; /* Command chaining with max. 254 bytes. */ - le_value = 0; - } - else - exmode = le_value = 0; + if (app->app_local->cardcap.ext_lc_le && indatalen > 254 ) + { + exmode = 1; /* Extended length w/o a limit. */ + le_value = app->app_local->extcap.max_rsp_data; + } + else if (app->app_local->cardcap.cmd_chaining && indatalen > 254) + { + exmode = -254; /* Command chaining with max. 254 bytes. */ + le_value = 0; + } + else + exmode = le_value = 0; - rc = iso7816_decipher (app->slot, exmode, - indata, indatalen, le_value, padind, - outdata, outdatalen); - xfree (fixbuf); + rc = iso7816_decipher (app->slot, exmode, + indata, indatalen, le_value, padind, + outdata, outdatalen); + xfree (fixbuf); - if (gpg_err_code (rc) == GPG_ERR_CARD /* actual SW is 0x640a */ - && app->app_local->manufacturer == 5 - && app->card_version == 0x0200) - log_info ("NOTE: Cards with manufacturer id 5 and s/n <= 346 (0x15a)" - " do not work with encryption keys > 2048 bits\n"); + if (gpg_err_code (rc) == GPG_ERR_CARD /* actual SW is 0x640a */ + && app->app_local->manufacturer == 5 + && app->card_version == 0x0200) + log_info ("NOTE: Cards with manufacturer id 5 and s/n <= 346 (0x15a)" + " do not work with encryption keys > 2048 bits\n"); - *r_info |= APP_DECIPHER_INFO_NOPAD; - } + *r_info |= APP_DECIPHER_INFO_NOPAD; return rc; } @@ -4455,25 +4424,25 @@ parse_algorithm_attribute (app_t app, int keyno) app->app_local->keyattr[keyno].rsa.format == RSA_CRT? "crt" : app->app_local->keyattr[keyno].rsa.format == RSA_CRT_N?"crt+n":"?"); } - else if (*buffer == 19) /* ECDSA */ + else if (*buffer == 18 || *buffer == 19) /* ECDH or ECDSA */ { - app->app_local->keyattr[keyno].key_type = KEY_TYPE_ECDSA; - app->app_local->keyattr[keyno].ecdsa.curve + app->app_local->keyattr[keyno].key_type = KEY_TYPE_ECC; + app->app_local->keyattr[keyno].ecc.curve = parse_ecc_curve (buffer + 1, buflen - 1); + if (opt.verbose) + log_printf + ("ECC, curve=%s\n", + get_curve_name (app->app_local->keyattr[keyno].ecc.curve)); } - else if (*buffer == 18 && buflen == 11) /* ECDH */ - { - app->app_local->keyattr[keyno].key_type = KEY_TYPE_ECDH; - app->app_local->keyattr[keyno].ecdh.hashalgo = buffer[1]; - app->app_local->keyattr[keyno].ecdh.cipheralgo = buffer[2]; - app->app_local->keyattr[keyno].ecdh.curve - = parse_ecc_curve (buffer + 3, buflen - 3); - } - else if (*buffer == 105) /* EdDSA (experimental) */ + else if (*buffer == 22) /* EdDSA */ { app->app_local->keyattr[keyno].key_type = KEY_TYPE_EDDSA; app->app_local->keyattr[keyno].eddsa.curve = parse_ecc_curve (buffer + 1, buflen - 1); + if (opt.verbose) + log_printf + ("EdDSA, curve=%s\n", + get_curve_name (app->app_local->keyattr[keyno].eddsa.curve)); } else if (opt.verbose) log_printhex ("", buffer, buflen); ----------------------------------------------------------------------- Summary of changes: agent/divert-scd.c | 48 +++++++++++---- scd/app-openpgp.c | 169 +++++++++++++++++++++------------------------------- 2 files changed, 107 insertions(+), 110 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 22 12:38:21 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 22 Dec 2014 12:38:21 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-11-g5a556e4 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 5a556e4e88bcbc926c0922070acaf5f7b25d18fb (commit) via 0d5cb55402c44fb5f731ecf85705f845f3091aa7 (commit) via abd5f6752d693b7f313c19604f0723ecec4d39a6 (commit) from bdc8efbdd124d836c36cf482216e375421f72891 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 5a556e4e88bcbc926c0922070acaf5f7b25d18fb Author: Werner Koch Date: Mon Dec 22 12:34:57 2014 +0100 dirmngr: Fix memory leak. * dirmngr/server.c (cmd_ks_search, cmd_ks_get): Fix memory leak. * dirmngr/ks-engine-hkp.c (ks_hkp_mark_host): Remove double check. -- Reported-by: Joshua Rogers Signed-off-by: Werner Koch diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c index bd98eed..3c6a003 100644 --- a/dirmngr/ks-engine-hkp.c +++ b/dirmngr/ks-engine-hkp.c @@ -674,7 +674,7 @@ ks_hkp_mark_host (ctrl_t ctrl, const char *name, int alive) member in another pool. */ for (idx3=0; idx3 < hosttable_size; idx3++) { - if (hosttable[idx3] && hosttable[idx3] + if (hosttable[idx3] && hosttable[idx3]->pool && idx3 != idx && host_in_pool_p (hosttable[idx3]->pool, n)) diff --git a/dirmngr/server.c b/dirmngr/server.c index 9b4cdb2..6094bc9 100644 --- a/dirmngr/server.c +++ b/dirmngr/server.c @@ -1586,7 +1586,6 @@ cmd_ks_search (assuan_context_t ctx, char *line) if (!sl) { err = gpg_error_from_syserror (); - free_strlist (list); goto leave; } sl->flags = 0; @@ -1607,6 +1606,7 @@ cmd_ks_search (assuan_context_t ctx, char *line) } leave: + free_strlist (list); return leave_cmd (ctx, err); } @@ -1647,7 +1647,6 @@ cmd_ks_get (assuan_context_t ctx, char *line) if (!sl) { err = gpg_error_from_syserror (); - free_strlist (list); goto leave; } sl->flags = 0; @@ -1668,6 +1667,7 @@ cmd_ks_get (assuan_context_t ctx, char *line) } leave: + free_strlist (list); return leave_cmd (ctx, err); } commit 0d5cb55402c44fb5f731ecf85705f845f3091aa7 Author: Werner Koch Date: Mon Dec 22 12:29:32 2014 +0100 dirmngr: Remove un-needed check. * dirmngr/crlfetch.c (crl_fetch): Check that URL is not NULL. -- Reported-by: Joshua Rogers "Remove un-needed check. If 'url' were not to be true, http_parse_uri(parse_uri(do_parse_uri))) would fail, leaving 'err' false." In addition I added an explicit check for the URL arg not beeing NULL. Signed-off-by: Werner Koch diff --git a/dirmngr/crlfetch.c b/dirmngr/crlfetch.c index 2471ca2..2c4a247 100644 --- a/dirmngr/crlfetch.c +++ b/dirmngr/crlfetch.c @@ -163,10 +163,13 @@ crl_fetch (ctrl_t ctrl, const char *url, ksba_reader_t *reader) *reader = NULL; + if (!url) + return gpg_error (GPG_ERR_INV_ARG); + once_more: err = http_parse_uri (&uri, url, 0); http_release_parsed_uri (uri); - if (err && url && !strncmp (url, "https:", 6)) + if (err && !strncmp (url, "https:", 6)) { /* Our HTTP code does not support TLS, thus we can't use this scheme and it is frankly not useful for CRL retrieval anyway. commit abd5f6752d693b7f313c19604f0723ecec4d39a6 Author: Werner Koch Date: Mon Dec 22 12:16:46 2014 +0100 dirmngr,gpgsm: Return NULL on fail * dirmngr/ldapserver.c (ldapserver_parse_one): Set SERVER to NULL. * sm/gpgsm.c (parse_keyserver_line): Ditto. -- Reported-by: Joshua Rogers "If something inside the ldapserver_parse_one function failed, 'server' would be freed, then returned, leading to a use-after-free. This code is likely copied from sm/gpgsm.c, which was also susceptible to this bug." Signed-off-by: Werner Koch diff --git a/dirmngr/ldapserver.c b/dirmngr/ldapserver.c index 20a574c..5808c5b 100644 --- a/dirmngr/ldapserver.c +++ b/dirmngr/ldapserver.c @@ -125,6 +125,7 @@ ldapserver_parse_one (char *line, { log_info (_("%s:%u: skipping this line\n"), filename, lineno); ldapserver_list_free (server); + server = NULL; } return server; diff --git a/sm/gpgsm.c b/sm/gpgsm.c index 3398d17..72bceb4 100644 --- a/sm/gpgsm.c +++ b/sm/gpgsm.c @@ -862,6 +862,7 @@ parse_keyserver_line (char *line, { log_info (_("%s:%u: skipping this line\n"), filename, lineno); keyserver_list_free (server); + server = NULL; } return server; ----------------------------------------------------------------------- Summary of changes: dirmngr/crlfetch.c | 5 ++++- dirmngr/ks-engine-hkp.c | 2 +- dirmngr/ldapserver.c | 1 + dirmngr/server.c | 4 ++-- sm/gpgsm.c | 1 + 5 files changed, 9 insertions(+), 4 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 22 12:43:53 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 22 Dec 2014 12:43:53 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-12-g6056d24 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 6056d2467310260ddc0db2fe65b737ace6febcaa (commit) from 5a556e4e88bcbc926c0922070acaf5f7b25d18fb (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 6056d2467310260ddc0db2fe65b737ace6febcaa Author: Werner Koch Date: Mon Dec 22 12:44:13 2014 +0100 doc: Fix memory leak in yat2m. * doc/yat2m.c (write_th): Free NAME. -- Reported-by: Joshua Rogers diff --git a/doc/yat2m.c b/doc/yat2m.c index f780952..86c3c70 100644 --- a/doc/yat2m.c +++ b/doc/yat2m.c @@ -656,6 +656,7 @@ write_th (FILE *fp) *p++ = 0; fprintf (fp, ".TH %s %s %s \"%s\" \"%s\"\n", name, p, isodatestring (), opt_release, opt_source); + free (name); return 0; } ----------------------------------------------------------------------- Summary of changes: doc/yat2m.c | 1 + 1 file changed, 1 insertion(+) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 22 12:56:46 2014 From: cvs at cvs.gnupg.org (by Daniel Kahn Gillmor) Date: Mon, 22 Dec 2014 12:56:46 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-14-g628b111 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via 628b111fa679612e23c0d46505b1ecbbf091897d (commit) via 351bca9047d748c3c4f7e9a3cdc476af127b1da3 (commit) from 6056d2467310260ddc0db2fe65b737ace6febcaa (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 628b111fa679612e23c0d46505b1ecbbf091897d Author: Daniel Kahn Gillmor Date: Fri Dec 19 17:12:37 2014 -0500 avoid double-close in unusual dotlock situations * common/dotlock.c: (dotlock_create_unix) avoid double-close() in unusual situations. -- close(2) says: close() should not be retried after an EINTR since this may cause a reused descriptor from another thread to be closed. Before this patch was applied, if close(fd) failed with EINTR, it would be closed again in the write_failed: block. It could also have been closed a second time in the case that (use_hardlinks_p (h->tname)) evaluated to something other than 0 or 1. This patch avoids both of those scenarios. Note that close() could still be called twice on the same file descriptor if the first close(fd) fails but errno is not EINTR. I'm not sure the right thing to do in that scenario. An alternate resolution could be to unequivocally set fd to -1 after the first failed close(fd), avoiding the errno == EINTR test. Debian-Bug-Id: 773423 diff --git a/common/dotlock.c b/common/dotlock.c index c5520db..a9963d1 100644 --- a/common/dotlock.c +++ b/common/dotlock.c @@ -680,7 +680,12 @@ dotlock_create_unix (dotlock_t h, const char *file_to_lock) if ( write (fd, "\n", 1 ) != 1 ) goto write_failed; if ( close (fd) ) - goto write_failed; + { + if ( errno == EINTR ) + fd = -1; + goto write_failed; + } + fd = -1; /* Check whether we support hard links. */ switch (use_hardlinks_p (h->tname)) @@ -718,7 +723,8 @@ dotlock_create_unix (dotlock_t h, const char *file_to_lock) all_lockfiles = h->next; UNLOCK_all_lockfiles (); my_error_2 (_("error writing to '%s': %s\n"), h->tname, strerror (errno)); - close (fd); + if ( fd != -1 ) + close (fd); unlink (h->tname); jnlib_free (h->tname); jnlib_free (h); commit 351bca9047d748c3c4f7e9a3cdc476af127b1da3 Author: Daniel Kahn Gillmor Date: Fri Dec 19 17:12:05 2014 -0500 gpgkey2ssh: clean up varargs * tools/gpgkey2ssh.c (key_to_blob) : ensure that va_end is called. -- stdarg(3) says: Each invocation of va_start() must be matched by a corresponding invocation of va_end() in the same function. Observed by Joshua Rogers Debian-Bug-Id: 773415 diff --git a/tools/gpgkey2ssh.c b/tools/gpgkey2ssh.c index 903fb5b..d22c5ac 100644 --- a/tools/gpgkey2ssh.c +++ b/tools/gpgkey2ssh.c @@ -224,6 +224,8 @@ key_to_blob (unsigned char **blob, size_t *blob_n, const char *identifier, ...) assert (ret == 1); } + va_end (ap); + blob_new_n = ftell (stream); rewind (stream); ----------------------------------------------------------------------- Summary of changes: common/dotlock.c | 10 ++++++++-- tools/gpgkey2ssh.c | 2 ++ 2 files changed, 10 insertions(+), 2 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 22 13:17:36 2014 From: cvs at cvs.gnupg.org (by Daniel Kahn Gillmor) Date: Mon, 22 Dec 2014 13:17:36 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-16-gb0b3803 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via b0b3803e8c2959dd67ca96debc54b5c6464f0d41 (commit) via 367b073ab5f439ccf0750461d10c69f36998bd62 (commit) from 628b111fa679612e23c0d46505b1ecbbf091897d (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit b0b3803e8c2959dd67ca96debc54b5c6464f0d41 Author: Daniel Kahn Gillmor Date: Fri Dec 19 18:07:55 2014 -0500 scd: Avoid double-free on error condition in scd * scd/command.c (cmd_readkey): avoid double-free of cert -- When ksba_cert_new() fails, cert will be double-freed. Debian-Bug-Id: 773471 Original patch changed by wk to do the free only at leave. diff --git a/scd/command.c b/scd/command.c index dd4191f..1cc580a 100644 --- a/scd/command.c +++ b/scd/command.c @@ -804,10 +804,8 @@ cmd_readkey (assuan_context_t ctx, char *line) rc = ksba_cert_new (&kc); if (rc) - { - xfree (cert); - goto leave; - } + goto leave; + rc = ksba_cert_init_from_mem (kc, cert, ncert); if (rc) { commit 367b073ab5f439ccf0750461d10c69f36998bd62 Author: Daniel Kahn Gillmor Date: Fri Dec 19 17:53:36 2014 -0500 avoid future chance of using uninitialized memory * common/iobuf.c: (iobuf_open): initialize len -- In iobuf_open, IOBUFCTRL_DESC and IOBUFCTRL_INIT commands are invoked (via file_filter()) on fcx, passing in a pointer to an uninitialized len. With these two commands, file_filter doesn't actually do anything with the value of len, so there's no actual risk of use of uninitialized memory in the code as it stands. However, some static analysis tools might flag this situation with a warning, and initializing the value doesn't hurt anything, so i think this trivial cleanup is warranted. Debian-Bug-Id: 773469 diff --git a/common/iobuf.c b/common/iobuf.c index 3c68ce5..badbf78 100644 --- a/common/iobuf.c +++ b/common/iobuf.c @@ -1301,7 +1301,7 @@ iobuf_open (const char *fname) iobuf_t a; gnupg_fd_t fp; file_filter_ctx_t *fcx; - size_t len; + size_t len = 0; int print_only = 0; int fd; ----------------------------------------------------------------------- Summary of changes: common/iobuf.c | 2 +- scd/command.c | 6 ++---- 2 files changed, 3 insertions(+), 5 deletions(-) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 22 14:17:48 2014 From: cvs at cvs.gnupg.org (by Daniel Kahn Gillmor) Date: Mon, 22 Dec 2014 14:17:48 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-17-ged8383c Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via ed8383c618e124cfa708c9ee87563fcdf2f4649c (commit) from b0b3803e8c2959dd67ca96debc54b5c6464f0d41 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ed8383c618e124cfa708c9ee87563fcdf2f4649c Author: Daniel Kahn Gillmor Date: Fri Dec 19 18:53:34 2014 -0500 sm: Avoid double-free on iconv failure * sm/minip12.c: (p12_build) if jnlib_iconv_open fails, avoid double-free of pwbuf. -- Observed by Joshua Rogers , who proposed a slightly different fix. Debian-Bug-Id: 773472 Added fix at a second place - wk. diff --git a/sm/minip12.c b/sm/minip12.c index 01b91b7..ca4d248 100644 --- a/sm/minip12.c +++ b/sm/minip12.c @@ -2422,6 +2422,7 @@ p12_build (gcry_mpi_t *kparms, const void *cert, size_t certlen, " requested charset '%s': %s\n", charset, strerror (errno)); gcry_free (pwbuf); + pwbuf = NULL; goto failure; } @@ -2436,6 +2437,7 @@ p12_build (gcry_mpi_t *kparms, const void *cert, size_t certlen, " requested charset '%s': %s\n", charset, strerror (errno)); gcry_free (pwbuf); + pwbuf = NULL; jnlib_iconv_close (cd); goto failure; } ----------------------------------------------------------------------- Summary of changes: sm/minip12.c | 2 ++ 1 file changed, 2 insertions(+) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 22 14:26:35 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 22 Dec 2014 14:26:35 +0100 Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.1-18-gd2d8481 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU Privacy Guard". The branch, master has been updated via d2d8481e3866124c143cac165dea8453001e2905 (commit) from ed8383c618e124cfa708c9ee87563fcdf2f4649c (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit d2d8481e3866124c143cac165dea8453001e2905 Author: Werner Koch Date: Mon Dec 22 14:27:33 2014 +0100 Register DCO for Joshua Rogers. -- diff --git a/AUTHORS b/AUTHORS index eb42043..554c10a 100644 --- a/AUTHORS +++ b/AUTHORS @@ -179,6 +179,9 @@ Hans of Guardian Jonas Borgstr?m 2013-08-29:521F1E7A.5080602 at borgstrom.se: +Joshua Rogers +2014-12-22:5497FE75.7010503 at internot.info: + Kyle Butt 2013-05-29:CAAODAYLbCtqOG6msLLL0UTdASKWT6u2ptxsgUQ1JpusBESBoNQ at mail.gmail.com: ----------------------------------------------------------------------- Summary of changes: AUTHORS | 3 +++ 1 file changed, 3 insertions(+) hooks/post-receive -- The GNU Privacy Guard http://git.gnupg.org From cvs at cvs.gnupg.org Mon Dec 22 18:32:46 2014 From: cvs at cvs.gnupg.org (by Werner Koch) Date: Mon, 22 Dec 2014 18:32:46 +0100 Subject: [git] gnupg-doc - branch, master, updated. 450481c63872bf79f03399128070bff768fae5b0 Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GnuPG website and other docs". The branch, master has been updated via 450481c63872bf79f03399128070bff768fae5b0 (commit) via f89a36b71126c4912c904129d7cfe0910043d1ad (commit) from 47aa329b0ba798717e09a413f197ca6a0fc7e403 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 450481c63872bf79f03399128070bff768fae5b0 Author: Werner Koch Date: Mon Dec 22 18:32:15 2014 +0100 web: Minor content changes. diff --git a/tools/mkkudos.sh b/tools/mkkudos.sh index d477d69..9ab6e26 100755 --- a/tools/mkkudos.sh +++ b/tools/mkkudos.sh @@ -8,6 +8,7 @@ usage() Usage: $0 [OPTIONS] Options: --force Force re-creation of files. + --verbose Run in verbose mode --test Run in test environment EOF exit $1 @@ -15,6 +16,7 @@ EOF force=no +verbose=no testmode=no while [ $# -gt 0 ]; do case "$1" in @@ -31,6 +33,9 @@ while [ $# -gt 0 ]; do --force) force=yes ;; + --verbose) + verbose=yes + ;; --test) testmode=yes ;; @@ -90,7 +95,7 @@ for file in "$htdocs/donate/"kudos-????.html "$htdocs/donate/"kudos.html \ year=${file#$htdocs/donate/kudos-} year=${year%.html} fi - echo "processing $file" >&2 + [ $verbose = yes ] && echo "processing $file" >&2 [ -f "$file.tmp" ] && rm "$file.tmp" awk -F: -v year=$year -v donors="$donors" \ -v monyear="$monyear" -v euro="$euro" -v euroyr="$euroyr" \ diff --git a/web/donate/index.org b/web/donate/index.org index 793af3b..f4cc20b 100644 --- a/web/donate/index.org +++ b/web/donate/index.org @@ -42,6 +42,9 @@ be listed on our [[https://www.gnupg.org/donate/kudos.html][thank you]] page you should indicate this by adding a comment of the form =List me as: NAME= to your donation. + If you like to donate Bitcoins you may use the [[https://www.wauland.de/en/donation.html#61][Wau Holland Stiftung]] + account too. + If you represent a company, you may also enter into a support contract with [[https://g10code.com][g10^code]] or ask for other service options. diff --git a/web/index.org b/web/index.org index 7eaae07..b21c029 100644 --- a/web/index.org +++ b/web/index.org @@ -10,7 +10,7 @@ maintaining GnuPG so to keep it strong and secure against the ever increasing mass surveillance we need your support. Until the end of November we received a total of 6584\thinsp\euro (~5500 net) donations for this year. Along with the 18000\thinsp\euro net from the [[https://www.gnupg.org/blog/20140512-rewards-sent.html][Goteo -campaign]] this paid for less less than 50% of the costs for one +campaign]] this paid for less than 50% of the costs for one developer. #+BEGIN_HTML @@ -31,9 +31,9 @@ style="width: 0%"> For a critical project of this size two experienced developers are required for proper operation. This requires gross revenues of 120000 Euro per year. Unfortunately there is currently only one underpaid -full time developer who is barely able to keep up with the work. -Please help to secure the future of GnuPG and consider to [[file:donate/index.org][donate]] to -this project [[file:donate/index.org][now]]. +full time developer who is barely able to keep up with the work; see +this [[file:blog/20141214-gnupg-and-g10.org][blog entry]] for some backgound. Please help to secure the +future of GnuPG and consider to [[file:donate/index.org][donate]] to this project [[file:donate/index.org][now]]. * The GNU Privacy Guard commit f89a36b71126c4912c904129d7cfe0910043d1ad Author: Andre Heinecke Date: Fri Dec 19 16:52:19 2014 +0100 web: Move hover menu slightly up -- This prevents the hover menu from closing when moving the mouse down over the border. diff --git a/web/share/site.css b/web/share/site.css index c2b816a..48815f3 100644 --- a/web/share/site.css +++ b/web/share/site.css @@ -279,7 +279,7 @@ nav ul li:hover ul.sub-menu { z-index: 99; border-radius: 0px; position: absolute; - top: 41px; + top: 39px; left: 0; } nav ul ul li { ----------------------------------------------------------------------- Summary of changes: tools/mkkudos.sh | 7 ++++++- web/donate/index.org | 3 +++ web/index.org | 8 ++++---- web/share/site.css | 2 +- 4 files changed, 14 insertions(+), 6 deletions(-) hooks/post-receive -- The GnuPG website and other docs http://git.gnupg.org From cvs at cvs.gnupg.org Sun Dec 28 14:57:43 2014 From: cvs at cvs.gnupg.org (by Jussi Kivilinna) Date: Sun, 28 Dec 2014 14:57:43 +0100 Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.6.0-139-g520070e Message-ID: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The GNU crypto library". The branch, master has been updated via 520070e02e2e6ee7228945015573a6e1f4895ec3 (commit) via 11b8d2d449a7bc664b4371ae14c57caa6704d272 (commit) from c964321c8a1328e89d636d899a45d68802f5ac9f (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 520070e02e2e6ee7228945015573a6e1f4895ec3 Author: Jussi Kivilinna Date: Sun Dec 21 17:36:59 2014 +0200 Poly1305-AEAD: updated implementation to match draft-irtf-cfrg-chacha20-poly1305-03 * cipher/cipher-internal.h (gcry_cipher_handle): Use separate byte counters for AAD and data in Poly1305. * cipher/cipher-poly1305.c (poly1305_fill_bytecount): Remove. (poly1305_fill_bytecounts, poly1305_do_padding): New. (poly1305_aad_finish): Fill padding to Poly1305 and do not fill AAD length. (_gcry_cipher_poly1305_authenticate, _gcry_cipher_poly1305_encrypt) (_gcry_cipher_poly1305_decrypt): Update AAD and data length separately. (_gcry_cipher_poly1305_tag): Fill padding and bytecounts to Poly1305. (_gcry_cipher_poly1305_setkey, _gcry_cipher_poly1305_setiv): Reset AAD and data byte counts; only allow 96-bit IV. * cipher/cipher.c (_gcry_cipher_open_internal): Limit Poly1305-AEAD to ChaCha20 cipher. * tests/basic.c (_check_poly1305_cipher): Update test-vectors. (check_ciphers): Limit Poly1305-AEAD checks to ChaCha20. * tests/bench-slope.c (cipher_bench_one): Ditto. -- Latest Internet-Draft version for "ChaCha20 and Poly1305 for IETF protocols" has added additional padding to Poly1305-AEAD and limited support IV size to 96-bits: https://www.ietf.org/rfcdiff?url1=draft-nir-cfrg-chacha20-poly1305-03&difftype=--html&submit=Go!&url2=draft-irtf-cfrg-chacha20-poly1305-03 Patch makes Poly1305-AEAD implementation to match the changes and limits Poly1305-AEAD to ChaCha20 only. Signed-off-by: Jussi Kivilinna diff --git a/cipher/cipher-internal.h b/cipher/cipher-internal.h index fef0ecb..650d813 100644 --- a/cipher/cipher-internal.h +++ b/cipher/cipher-internal.h @@ -163,8 +163,11 @@ struct gcry_cipher_handle /* Mode specific storage for Poly1305 mode. */ struct { - /* byte counter for AAD and data. */ - u32 bytecount[2]; + /* byte counter for AAD. */ + u32 aadcount[2]; + + /* byte counter for data. */ + u32 datacount[2]; unsigned int aad_finalized:1; unsigned int bytecount_over_limits:1; diff --git a/cipher/cipher-poly1305.c b/cipher/cipher-poly1305.c index a22ffa3..f283333 100644 --- a/cipher/cipher-poly1305.c +++ b/cipher/cipher-poly1305.c @@ -53,12 +53,14 @@ poly1305_bytecounter_add (u32 ctr[2], size_t add) static void -poly1305_fill_bytecount (gcry_cipher_hd_t c) +poly1305_fill_bytecounts (gcry_cipher_hd_t c) { - u32 lenbuf[2]; + u32 lenbuf[4]; - lenbuf[0] = le_bswap32(c->u_mode.poly1305.bytecount[0]); - lenbuf[1] = le_bswap32(c->u_mode.poly1305.bytecount[1]); + lenbuf[0] = le_bswap32(c->u_mode.poly1305.aadcount[0]); + lenbuf[1] = le_bswap32(c->u_mode.poly1305.aadcount[1]); + lenbuf[2] = le_bswap32(c->u_mode.poly1305.datacount[0]); + lenbuf[3] = le_bswap32(c->u_mode.poly1305.datacount[1]); _gcry_poly1305_update (&c->u_mode.poly1305.ctx, (byte*)lenbuf, sizeof(lenbuf)); @@ -67,15 +69,33 @@ poly1305_fill_bytecount (gcry_cipher_hd_t c) static void +poly1305_do_padding (gcry_cipher_hd_t c, u32 ctr[2]) +{ + static const byte zero_padding_buf[15] = {}; + u32 padding_count; + + /* Padding to 16 byte boundary. */ + if (ctr[0] % 16 > 0) + { + padding_count = 16 - ctr[0] % 16; + + _gcry_poly1305_update (&c->u_mode.poly1305.ctx, zero_padding_buf, + padding_count); + } +} + + +static void poly1305_aad_finish (gcry_cipher_hd_t c) { - /* Start of encryption marks end of AAD stream. */ - poly1305_fill_bytecount(c); + /* After AAD, feed padding bytes so we get 16 byte alignment. */ + poly1305_do_padding (c, c->u_mode.poly1305.aadcount); + /* Start of encryption marks end of AAD stream. */ c->u_mode.poly1305.aad_finalized = 1; - c->u_mode.poly1305.bytecount[0] = 0; - c->u_mode.poly1305.bytecount[1] = 0; + c->u_mode.poly1305.datacount[0] = 0; + c->u_mode.poly1305.datacount[1] = 0; } @@ -102,7 +122,7 @@ _gcry_cipher_poly1305_authenticate (gcry_cipher_hd_t c, if (!c->marks.iv) poly1305_set_zeroiv(c); - if (poly1305_bytecounter_add(c->u_mode.poly1305.bytecount, aadbuflen)) + if (poly1305_bytecounter_add(c->u_mode.poly1305.aadcount, aadbuflen)) { c->u_mode.poly1305.bytecount_over_limits = 1; return GPG_ERR_INV_LENGTH; @@ -138,7 +158,7 @@ _gcry_cipher_poly1305_encrypt (gcry_cipher_hd_t c, if (!c->u_mode.poly1305.aad_finalized) poly1305_aad_finish(c); - if (poly1305_bytecounter_add(c->u_mode.poly1305.bytecount, inbuflen)) + if (poly1305_bytecounter_add(c->u_mode.poly1305.datacount, inbuflen)) { c->u_mode.poly1305.bytecount_over_limits = 1; return GPG_ERR_INV_LENGTH; @@ -176,7 +196,7 @@ _gcry_cipher_poly1305_decrypt (gcry_cipher_hd_t c, if (!c->u_mode.poly1305.aad_finalized) poly1305_aad_finish(c); - if (poly1305_bytecounter_add(c->u_mode.poly1305.bytecount, inbuflen)) + if (poly1305_bytecounter_add(c->u_mode.poly1305.datacount, inbuflen)) { c->u_mode.poly1305.bytecount_over_limits = 1; return GPG_ERR_INV_LENGTH; @@ -212,8 +232,11 @@ _gcry_cipher_poly1305_tag (gcry_cipher_hd_t c, if (!c->marks.tag) { - /* Write data-length to poly1305. */ - poly1305_fill_bytecount(c); + /* After data, feed padding bytes so we get 16 byte alignment. */ + poly1305_do_padding (c, c->u_mode.poly1305.datacount); + + /* Write byte counts to poly1305. */ + poly1305_fill_bytecounts(c); _gcry_poly1305_finish(&c->u_mode.poly1305.ctx, c->u_iv.iv); @@ -247,8 +270,11 @@ _gcry_cipher_poly1305_check_tag (gcry_cipher_hd_t c, const unsigned char *intag, void _gcry_cipher_poly1305_setkey (gcry_cipher_hd_t c) { - c->u_mode.poly1305.bytecount[0] = 0; - c->u_mode.poly1305.bytecount[1] = 0; + c->u_mode.poly1305.aadcount[0] = 0; + c->u_mode.poly1305.aadcount[1] = 0; + + c->u_mode.poly1305.datacount[0] = 0; + c->u_mode.poly1305.datacount[1] = 0; c->u_mode.poly1305.bytecount_over_limits = 0; c->u_mode.poly1305.aad_finalized = 0; @@ -260,16 +286,20 @@ _gcry_cipher_poly1305_setkey (gcry_cipher_hd_t c) gcry_err_code_t _gcry_cipher_poly1305_setiv (gcry_cipher_hd_t c, const byte *iv, size_t ivlen) { - byte tmpbuf[64]; /* size of ChaCha20/Salsa20 block */ + byte tmpbuf[64]; /* size of ChaCha20 block */ gcry_err_code_t err; - if (!iv && ivlen > 0) + /* IV must be 96-bits */ + if (!iv && ivlen != (96 / 8)) return GPG_ERR_INV_ARG; memset(&c->u_mode.poly1305.ctx, 0, sizeof(c->u_mode.poly1305.ctx)); - c->u_mode.poly1305.bytecount[0] = 0; - c->u_mode.poly1305.bytecount[1] = 0; + c->u_mode.poly1305.aadcount[0] = 0; + c->u_mode.poly1305.aadcount[1] = 0; + + c->u_mode.poly1305.datacount[0] = 0; + c->u_mode.poly1305.datacount[1] = 0; c->u_mode.poly1305.bytecount_over_limits = 0; c->u_mode.poly1305.aad_finalized = 0; @@ -279,7 +309,7 @@ _gcry_cipher_poly1305_setiv (gcry_cipher_hd_t c, const byte *iv, size_t ivlen) /* Set up IV for stream cipher. */ c->spec->setiv (&c->context.c, iv, ivlen); - /* Get the first block from ChaCha20/Salsa20. */ + /* Get the first block from ChaCha20. */ memset(tmpbuf, 0, sizeof(tmpbuf)); c->spec->stencrypt(&c->context.c, tmpbuf, tmpbuf, sizeof(tmpbuf)); diff --git a/cipher/cipher.c b/cipher/cipher.c index 5c44c0d..78cad21 100644 --- a/cipher/cipher.c +++ b/cipher/cipher.c @@ -421,9 +421,7 @@ _gcry_cipher_open_internal (gcry_cipher_hd_t *handle, case GCRY_CIPHER_MODE_POLY1305: if (!spec->stencrypt || !spec->stdecrypt || !spec->setiv) err = GPG_ERR_INV_CIPHER_MODE; - else if (spec->algo != GCRY_CIPHER_SALSA20 && - spec->algo != GCRY_CIPHER_SALSA20R12 && - spec->algo != GCRY_CIPHER_CHACHA20) + else if (spec->algo != GCRY_CIPHER_CHACHA20) err = GPG_ERR_INV_CIPHER_MODE; break; diff --git a/tests/basic.c b/tests/basic.c index e406db4..ef8260f 100644 --- a/tests/basic.c +++ b/tests/basic.c @@ -1625,27 +1625,59 @@ _check_poly1305_cipher (unsigned int step) struct tv { int algo; - char key[MAX_DATA_LEN]; - char iv[MAX_DATA_LEN]; + const char *key; + const char *iv; int ivlen; - unsigned char aad[MAX_DATA_LEN]; + const char *aad; int aadlen; - unsigned char plaintext[MAX_DATA_LEN]; + const char *plaintext; int inlen; - char out[MAX_DATA_LEN]; - char tag[MAX_DATA_LEN]; + const char *out; + const char *tag; } tv[] = { - /* draft-agl-tls-chacha20poly1305-04 */ + /* draft-irtf-cfrg-chacha20-poly1305-03 */ { GCRY_CIPHER_CHACHA20, - "\x42\x90\xbc\xb1\x54\x17\x35\x31\xf3\x14\xaf\x57\xf3\xbe\x3b\x50" - "\x06\xda\x37\x1e\xce\x27\x2a\xfa\x1b\x5d\xbd\xd1\x10\x0a\x10\x07", - "\xcd\x7c\xf6\x7b\xe3\x9c\x79\x4a", 8, - "\x87\xe2\x29\xd4\x50\x08\x45\xa0\x79\xc0", 10, - "\x86\xd0\x99\x74\x84\x0b\xde\xd2\xa5\xca", 10, - "\xe3\xe4\x46\xf7\xed\xe9\xa1\x9b\x62\xa4", - "\x67\x7d\xab\xf4\xe3\xd2\x4b\x87\x6b\xb2\x84\x75\x38\x96\xe1\xd6" }, - /* draft-nir-cfrg-chacha20-poly1305-03 */ + "\x1c\x92\x40\xa5\xeb\x55\xd3\x8a\xf3\x33\x88\x86\x04\xf6\xb5\xf0" + "\x47\x39\x17\xc1\x40\x2b\x80\x09\x9d\xca\x5c\xbc\x20\x70\x75\xc0", + "\x00\x00\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08", 12, + "\xf3\x33\x88\x86\x00\x00\x00\x00\x00\x00\x4e\x91", 12, + "\x49\x6e\x74\x65\x72\x6e\x65\x74\x2d\x44\x72\x61\x66\x74\x73\x20" + "\x61\x72\x65\x20\x64\x72\x61\x66\x74\x20\x64\x6f\x63\x75\x6d\x65" + "\x6e\x74\x73\x20\x76\x61\x6c\x69\x64\x20\x66\x6f\x72\x20\x61\x20" + "\x6d\x61\x78\x69\x6d\x75\x6d\x20\x6f\x66\x20\x73\x69\x78\x20\x6d" + "\x6f\x6e\x74\x68\x73\x20\x61\x6e\x64\x20\x6d\x61\x79\x20\x62\x65" + "\x20\x75\x70\x64\x61\x74\x65\x64\x2c\x20\x72\x65\x70\x6c\x61\x63" + "\x65\x64\x2c\x20\x6f\x72\x20\x6f\x62\x73\x6f\x6c\x65\x74\x65\x64" + "\x20\x62\x79\x20\x6f\x74\x68\x65\x72\x20\x64\x6f\x63\x75\x6d\x65" + "\x6e\x74\x73\x20\x61\x74\x20\x61\x6e\x79\x20\x74\x69\x6d\x65\x2e" + "\x20\x49\x74\x20\x69\x73\x20\x69\x6e\x61\x70\x70\x72\x6f\x70\x72" + "\x69\x61\x74\x65\x20\x74\x6f\x20\x75\x73\x65\x20\x49\x6e\x74\x65" + "\x72\x6e\x65\x74\x2d\x44\x72\x61\x66\x74\x73\x20\x61\x73\x20\x72" + "\x65\x66\x65\x72\x65\x6e\x63\x65\x20\x6d\x61\x74\x65\x72\x69\x61" + "\x6c\x20\x6f\x72\x20\x74\x6f\x20\x63\x69\x74\x65\x20\x74\x68\x65" + "\x6d\x20\x6f\x74\x68\x65\x72\x20\x74\x68\x61\x6e\x20\x61\x73\x20" + "\x2f\xe2\x80\x9c\x77\x6f\x72\x6b\x20\x69\x6e\x20\x70\x72\x6f\x67" + "\x72\x65\x73\x73\x2e\x2f\xe2\x80\x9d", 265, + "\x64\xa0\x86\x15\x75\x86\x1a\xf4\x60\xf0\x62\xc7\x9b\xe6\x43\xbd" + "\x5e\x80\x5c\xfd\x34\x5c\xf3\x89\xf1\x08\x67\x0a\xc7\x6c\x8c\xb2" + "\x4c\x6c\xfc\x18\x75\x5d\x43\xee\xa0\x9e\xe9\x4e\x38\x2d\x26\xb0" + "\xbd\xb7\xb7\x3c\x32\x1b\x01\x00\xd4\xf0\x3b\x7f\x35\x58\x94\xcf" + "\x33\x2f\x83\x0e\x71\x0b\x97\xce\x98\xc8\xa8\x4a\xbd\x0b\x94\x81" + "\x14\xad\x17\x6e\x00\x8d\x33\xbd\x60\xf9\x82\xb1\xff\x37\xc8\x55" + "\x97\x97\xa0\x6e\xf4\xf0\xef\x61\xc1\x86\x32\x4e\x2b\x35\x06\x38" + "\x36\x06\x90\x7b\x6a\x7c\x02\xb0\xf9\xf6\x15\x7b\x53\xc8\x67\xe4" + "\xb9\x16\x6c\x76\x7b\x80\x4d\x46\xa5\x9b\x52\x16\xcd\xe7\xa4\xe9" + "\x90\x40\xc5\xa4\x04\x33\x22\x5e\xe2\x82\xa1\xb0\xa0\x6c\x52\x3e" + "\xaf\x45\x34\xd7\xf8\x3f\xa1\x15\x5b\x00\x47\x71\x8c\xbc\x54\x6a" + "\x0d\x07\x2b\x04\xb3\x56\x4e\xea\x1b\x42\x22\x73\xf5\x48\x27\x1a" + "\x0b\xb2\x31\x60\x53\xfa\x76\x99\x19\x55\xeb\xd6\x31\x59\x43\x4e" + "\xce\xbb\x4e\x46\x6d\xae\x5a\x10\x73\xa6\x72\x76\x27\x09\x7a\x10" + "\x49\xe6\x17\xd9\x1d\x36\x10\x94\xfa\x68\xf0\xff\x77\x98\x71\x30" + "\x30\x5b\xea\xba\x2e\xda\x04\xdf\x99\x7b\x71\x4d\x6c\x6f\x2c\x29" + "\xa6\xad\x5c\xb4\x02\x2b\x02\x70\x9b", + "\xee\xad\x9d\x67\x89\x0c\xbb\x22\x39\x23\x36\xfe\xa1\x85\x1f\x38" }, + /* draft-irtf-cfrg-chacha20-poly1305-03 */ { GCRY_CIPHER_CHACHA20, "\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f" "\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f", @@ -1661,11 +1693,11 @@ _check_poly1305_cipher (unsigned int step) "\xfa\xb3\x24\xe4\xfa\xd6\x75\x94\x55\x85\x80\x8b\x48\x31\xd7\xbc" "\x3f\xf4\xde\xf0\x8e\x4b\x7a\x9d\xe5\x76\xd2\x65\x86\xce\xc6\x4b" "\x61\x16", - "\x18\xfb\x11\xa5\x03\x1a\xd1\x3a\x7e\x3b\x03\xd4\x6e\xe3\xa6\xa7" } + "\x1a\xe1\x0b\x59\x4f\x09\xe2\x6a\x7e\x90\x2e\xcb\xd0\x60\x06\x91" }, }; gcry_cipher_hd_t hde, hdd; - unsigned char out[MAX_DATA_LEN]; + unsigned char out[1024]; unsigned char tag[16]; int i, keylen; gcry_error_t err = 0; @@ -4333,9 +4365,7 @@ check_ciphers (void) gcry_cipher_algo_name (algos2[i])); check_one_cipher (algos2[i], GCRY_CIPHER_MODE_STREAM, 0); - if (algos2[i] == GCRY_CIPHER_CHACHA20 || - algos2[i] == GCRY_CIPHER_SALSA20 || - algos2[i] == GCRY_CIPHER_SALSA20R12) + if (algos2[i] == GCRY_CIPHER_CHACHA20) check_one_cipher (algos2[i], GCRY_CIPHER_MODE_POLY1305, 0); } /* we have now run all cipher's selftests */ diff --git a/tests/bench-slope.c b/tests/bench-slope.c index 7bf587f..ebf672e 100644 --- a/tests/bench-slope.c +++ b/tests/bench-slope.c @@ -1147,10 +1147,8 @@ cipher_bench_one (int algo, struct bench_cipher_mode *pmode) mode.name = mode.ops == &encrypt_ops ? "STREAM enc" : "STREAM dec"; } - /* Poly1305 has restrictions for cipher algorithm */ - if (mode.mode == GCRY_CIPHER_MODE_POLY1305 && - (algo != GCRY_CIPHER_SALSA20 && algo != GCRY_CIPHER_SALSA20R12 && - algo != GCRY_CIPHER_CHACHA20)) + /* Poly1305 has restriction for cipher algorithm */ + if (mode.mode == GCRY_CIPHER_MODE_POLY1305 && algo != GCRY_CIPHER_CHACHA20) return; /* CCM has restrictions for block-size */ commit 11b8d2d449a7bc664b4371ae14c57caa6704d272 Author: Jussi Kivilinna Date: Sun Dec 21 17:36:59 2014 +0200 chacha20: allow setting counter for stream random access * cipher/chacha20.c (CHACHA20_CTR_SIZE): New. (chacha20_ivsetup): Add setup for full counter. (chacha20_setiv): Allow ivlen == CHACHA20_CTR_SIZE. -- Signed-off-by: Jussi Kivilinna diff --git a/cipher/chacha20.c b/cipher/chacha20.c index c1847aa..2eaeffd 100644 --- a/cipher/chacha20.c +++ b/cipher/chacha20.c @@ -45,6 +45,7 @@ #define CHACHA20_BLOCK_SIZE 64 /* Bytes. */ #define CHACHA20_MIN_IV_SIZE 8 /* Bytes. */ #define CHACHA20_MAX_IV_SIZE 12 /* Bytes. */ +#define CHACHA20_CTR_SIZE 16 /* Bytes. */ #define CHACHA20_INPUT_LENGTH (CHACHA20_BLOCK_SIZE / 4) /* USE_SSE2 indicates whether to compile with Intel SSE2 code. */ @@ -312,22 +313,30 @@ chacha20_keysetup (CHACHA20_context_t * ctx, const byte * key, static void chacha20_ivsetup (CHACHA20_context_t * ctx, const byte * iv, size_t ivlen) { - ctx->input[12] = 0; - - if (ivlen == CHACHA20_MAX_IV_SIZE) + if (ivlen == CHACHA20_CTR_SIZE) + { + ctx->input[12] = buf_get_le32 (iv + 0); + ctx->input[13] = buf_get_le32 (iv + 4); + ctx->input[14] = buf_get_le32 (iv + 8); + ctx->input[15] = buf_get_le32 (iv + 12); + } + else if (ivlen == CHACHA20_MAX_IV_SIZE) { + ctx->input[12] = 0; ctx->input[13] = buf_get_le32 (iv + 0); ctx->input[14] = buf_get_le32 (iv + 4); ctx->input[15] = buf_get_le32 (iv + 8); } else if (ivlen == CHACHA20_MIN_IV_SIZE) { + ctx->input[12] = 0; ctx->input[13] = 0; ctx->input[14] = buf_get_le32 (iv + 0); ctx->input[15] = buf_get_le32 (iv + 4); } else { + ctx->input[12] = 0; ctx->input[13] = 0; ctx->input[14] = 0; ctx->input[15] = 0; @@ -402,10 +411,12 @@ chacha20_setiv (void *context, const byte * iv, size_t ivlen) CHACHA20_context_t *ctx = (CHACHA20_context_t *) context; /* draft-nir-cfrg-chacha20-poly1305-02 defines 96-bit and 64-bit nonce. */ - if (iv && ivlen != CHACHA20_MAX_IV_SIZE && ivlen != CHACHA20_MIN_IV_SIZE) + if (iv && ivlen != CHACHA20_MAX_IV_SIZE && ivlen != CHACHA20_MIN_IV_SIZE + && ivlen != CHACHA20_CTR_SIZE) log_info ("WARNING: chacha20_setiv: bad ivlen=%u\n", (u32) ivlen); - if (iv && (ivlen == CHACHA20_MAX_IV_SIZE || ivlen == CHACHA20_MIN_IV_SIZE)) + if (iv && (ivlen == CHACHA20_MAX_IV_SIZE || ivlen == CHACHA20_MIN_IV_SIZE + || ivlen == CHACHA20_CTR_SIZE)) chacha20_ivsetup (ctx, iv, ivlen); else chacha20_ivsetup (ctx, NULL, 0); ----------------------------------------------------------------------- Summary of changes: cipher/chacha20.c | 21 ++++++++++---- cipher/cipher-internal.h | 7 +++-- cipher/cipher-poly1305.c | 70 +++++++++++++++++++++++++++++++++------------- cipher/cipher.c | 4 +-- tests/basic.c | 70 +++++++++++++++++++++++++++++++++------------- tests/bench-slope.c | 6 ++-- 6 files changed, 124 insertions(+), 54 deletions(-) hooks/post-receive -- The GNU crypto library http://git.gnupg.org