From cvs at cvs.gnupg.org  Sun Jan  1 00:10:55 2017
From: cvs at cvs.gnupg.org (by Ben Kibbey)
Date: Sun, 01 Jan 2017 00:10:55 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-17-ga4b9f1a
Message-ID: <E1cNSnh-00065c-V7@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  a4b9f1a2b404fd8627d5ac567617510abd55d980 (commit)
      from  d83b8f0dc84d6cf7fe2e091bd1b103ceedfa3d6c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a4b9f1a2b404fd8627d5ac567617510abd55d980
Author: Ben Kibbey <bjk at luxsci.net>
Date:   Sat Dec 31 18:09:49 2016 -0500

    Fix gpg_addkey() to work with GPGME_CREATE_NOPASSWD as well.
    
    * src/engine-gpg.c (gpg_addkey): Pass --batch to gpg when
    GPGME_CREATE_NOPASSWD is set to fix pinentry without loopback mode.
    
    --
    Signed-off-by: Ben Kibbey <bjk at luxsci.net>

diff --git a/src/engine-gpg.c b/src/engine-gpg.c
index 1b0e4c9..75ba4bd 100644
--- a/src/engine-gpg.c
+++ b/src/engine-gpg.c
@@ -2176,6 +2176,8 @@ gpg_addkey (engine_gpg_t gpg,
       err = add_arg (gpg, "--passphrase");
       if (!err)
         err = add_arg (gpg, "");
+      if (!err)
+        err = add_arg (gpg, "--batch");
     }
   if (!err)
     err = add_arg (gpg, "--");

-----------------------------------------------------------------------

Summary of changes:
 src/engine-gpg.c | 2 ++
 1 file changed, 2 insertions(+)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  2 10:05:49 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 02 Jan 2017 10:05:49 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-19-gb200e63
Message-ID: <E1cNyYz-0004pq-6z@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  b200e636ab20d2aa93d9f71f3789db5a04af0a56 (commit)
      from  337690441fcb19343fe56b139f5649bed7d25c83 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b200e636ab20d2aa93d9f71f3789db5a04af0a56
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 2 10:00:33 2017 +0100

    dirmngr: Strip root zone suffix from libdns cname results.
    
    * dirmngr/dns-stuff.c (resolve_name_libdns): Strip trailing dot.
    (get_dns_cname_libdns): Ditto.
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index a31b073..f2e1df9 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -732,6 +732,10 @@ resolve_name_libdns (const char *name, unsigned short port,
               err = gpg_error_from_syserror ();
               goto leave;
             }
+          /* Libdns appends the root zone part which is problematic
+           * for most other functions - strip it.  */
+          if (**r_canonname && (*r_canonname)[strlen (*r_canonname)-1] == '.')
+            (*r_canonname)[strlen (*r_canonname)-1] = 0;
         }
 
       dai = xtrymalloc (sizeof *dai + ent->ai_addrlen -1);
@@ -1899,6 +1903,13 @@ get_dns_cname_libdns (const char *name, char **r_cname)
   *r_cname = xtrystrdup (cname.host);
   if (!*r_cname)
     err = gpg_error_from_syserror ();
+  else
+    {
+      /* Libdns appends the root zone part which is problematic
+       * for most other functions - strip it.  */
+      if (**r_cname && (*r_cname)[strlen (*r_cname)-1] == '.')
+        (*r_cname)[strlen (*r_cname)-1] = 0;
+    }
 
  leave:
   dns_free (ans);

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dns-stuff.c | 11 +++++++++++
 1 file changed, 11 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  2 10:43:20 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 02 Jan 2017 10:43:20 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-20-g5a4a109
Message-ID: <E1cNz9G-0006NO-R7@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  5a4a109354d53cf3673d0636731c67021d3f367a (commit)
      from  b200e636ab20d2aa93d9f71f3789db5a04af0a56 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5a4a109354d53cf3673d0636731c67021d3f367a
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 2 10:39:59 2017 +0100

    doc: Remove warning that DNS is not routed via Tor
    
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
index 5b4e68b..e136dff 100644
--- a/doc/dirmngr.texi
+++ b/doc/dirmngr.texi
@@ -239,10 +239,8 @@ useful for debugging.
 @item --use-tor
 @opindex use-tor
 This option switches Dirmngr and thus GnuPG into ``Tor mode'' to route
-all network access via Tor (an anonymity network).  WARNING: As of now
-this still leaks the DNS queries; e.g. to lookup the hosts in a
-keyserver pool.  Certain other features are disabled if this mode is
-active.
+all network access via Tor (an anonymity network).  Certain other
+features are disabled if this mode is active.
 
 @item --standard-resolver
 @opindex standard-resolver

-----------------------------------------------------------------------

Summary of changes:
 doc/dirmngr.texi | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  2 12:53:37 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 02 Jan 2017 12:53:37 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-23-gb0e14bd
Message-ID: <E1cO1BM-0003dN-UN@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  b0e14bd6ff8401b12b2b39f75aef94d3ad28017f (commit)
       via  b79274a3b7e58f88e9a8c1dc1fb24dd3e983543c (commit)
       via  e8b843508dac96e9d0a3140954dd5a3618669cec (commit)
      from  5a4a109354d53cf3673d0636731c67021d3f367a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b0e14bd6ff8401b12b2b39f75aef94d3ad28017f
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 22 15:48:07 2016 +0100

    gpgscm: Fail if too many arguments are given.
    
    * tests/gpgscm/scheme.c (opexe_0): Enable check.
    * tests/gpgscm/tests.scm (test::report): Remove superfluous argument.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index 7cd5217..c4725db 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -3364,11 +3364,9 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
                     }
                }
                if (x == sc->NIL) {
-                    /*--
-                     * if (y != sc->NIL) {
-                     *   Error_0(sc,"too many arguments");
-                     * }
-                     */
+                    if (y != sc->NIL) {
+                      Error_0(sc, "too many arguments");
+                    }
                } else if (is_symbol(x))
                     new_slot_in_env(sc, x, y);
                else {
diff --git a/tests/gpgscm/tests.scm b/tests/gpgscm/tests.scm
index 5954704..e5858d9 100644
--- a/tests/gpgscm/tests.scm
+++ b/tests/gpgscm/tests.scm
@@ -610,7 +610,7 @@
 		(seek logfd 0 SEEK_SET)
 		(splice logfd STDERR_FILENO)
 		(close logfd))
-	(echo (string-append (status retcode) ":") name))))))
+	(echo (string-append (status) ":") name))))))
 
 ;; Run the setup target to create an environment, then run all given
 ;; tests in parallel.

commit b79274a3b7e58f88e9a8c1dc1fb24dd3e983543c
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 22 14:42:50 2016 +0100

    gpgscm: Add 'finally', rework all macros.
    
    * tests/gpgscm/init.scm (finally): New macro.
    * tests/gpgscm/tests.scm (letfd): Rewrite.
    (with-working-directory): Likewise.
    (with-temporary-working-directory): Likewise.
    (lettmp): Likewise.
    --
    
    Rewrite all our macros using 'define-macro'. Use the new control flow
    mechanism 'finally', or 'dynamic-wind' where appropriate.  Make sure
    the macros are hygienic.  Reduce code duplication.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/init.scm b/tests/gpgscm/init.scm
index 106afd5..83261b0 100644
--- a/tests/gpgscm/init.scm
+++ b/tests/gpgscm/init.scm
@@ -569,6 +569,16 @@
 ;    the thrown exception is bound to *error*.  Errors can be rethrown
 ;    using (rethrow *error*).
 ;
+;    Finalization can be expressed using "finally":
+;
+;         (finally (finalize-something called-purely-for side-effects)
+;              (whether-or-not something goes-wrong)
+;              (with-these calls))
+;
+;    The final expression is executed purely for its side-effects,
+;    both when the function exits successfully, and when an exception
+;    is thrown.
+;
 ;    Exceptions are thrown with:
 ;
 ;         (throw "message")
@@ -622,6 +632,13 @@
                     (pop-handler)
                     ,label)))))
 
+(define-macro (finally final-expression . expressions)
+  (let ((result (gensym)))
+    `(let ((,result (catch (begin ,final-expression (rethrow *error*))
+			   , at expressions)))
+       ,final-expression
+       ,result)))
+
 ;; Make the vm use throw'.
 (define *error-hook* throw')
 
diff --git a/tests/gpgscm/tests.scm b/tests/gpgscm/tests.scm
index f127a93..5954704 100644
--- a/tests/gpgscm/tests.scm
+++ b/tests/gpgscm/tests.scm
@@ -244,27 +244,26 @@
 ;;
 ;; Bind all variables given in <bindings> and initialize each of them
 ;; to the given initial value, and close them after evaluting <body>.
-(macro (letfd form)
-  (let ((result-sym (gensym)))
-    `((lambda (,(caaadr form))
-	(let ((,result-sym
-	       ,(if (= 1 (length (cadr form)))
-		    `(catch (begin (close ,(caaadr form))
-				   (rethrow *error*))
-			    ,@(cddr form))
-		    `(letfd ,(cdadr form) ,@(cddr form)))))
-	  (close ,(caaadr form))
-	  ,result-sym)) ,@(cdaadr form))))
-
-(macro (with-working-directory form)
-  (let ((result-sym (gensym)) (cwd-sym (gensym)))
-    `(let* ((,cwd-sym (getcwd))
-	    (_ (if ,(cadr form) (chdir ,(cadr form))))
-	    (,result-sym (catch (begin (chdir ,cwd-sym)
-				       (rethrow *error*))
-				,@(cddr form))))
-       (chdir ,cwd-sym)
-       ,result-sym)))
+(define-macro (letfd bindings . body)
+  (let bind ((bindings' bindings))
+    (if (null? bindings')
+	`(begin , at body)
+	(let* ((binding (car bindings'))
+	       (name (car binding))
+	       (initializer (cadr binding)))
+	  `(let ((,name ,initializer))
+	     (finally (close ,name)
+		      ,(bind (cdr bindings'))))))))
+
+(define-macro (with-working-directory new-directory . expressions)
+  (let ((new-dir (gensym))
+	(old-dir (gensym)))
+    `(let* ((,new-dir ,new-directory)
+	    (,old-dir (getcwd)))
+       (dynamic-wind
+	   (lambda () (if ,new-dir (chdir ,new-dir)))
+	   (lambda () , at expressions)
+	   (lambda () (chdir ,old-dir))))))
 
 ;; Make a temporary directory.  If arguments are given, they are
 ;; joined using path-join, and must end in a component ending in
@@ -278,18 +277,12 @@
 					  "-XXXXXX"))
 		(apply path-join components))))
 
-(macro (with-temporary-working-directory form)
-  (let ((result-sym (gensym)) (cwd-sym (gensym)) (tmp-sym (gensym)))
-    `(let* ((,cwd-sym (getcwd))
-	    (,tmp-sym (mkdtemp))
-	    (_ (chdir ,tmp-sym))
-	    (,result-sym (catch (begin (chdir ,cwd-sym)
-				       (unlink-recursively ,tmp-sym)
-				       (rethrow *error*))
-				,@(cdr form))))
-       (chdir ,cwd-sym)
-       (unlink-recursively ,tmp-sym)
-       ,result-sym)))
+(define-macro (with-temporary-working-directory . expressions)
+  (let ((tmp-sym (gensym)))
+    `(let* ((,tmp-sym (mkdtemp)))
+       (finally (unlink-recursively ,tmp-sym)
+		(with-working-directory ,tmp-sym
+					, at expressions)))))
 
 (define (make-temporary-file . args)
   (canonical-path (path-join
@@ -310,17 +303,15 @@
 ;; Bind all variables given in <bindings>, initialize each of them to
 ;; a string representing an unique path in the filesystem, and delete
 ;; them after evaluting <body>.
-(macro (lettmp form)
-  (let ((result-sym (gensym)))
-    `((lambda (,(caadr form))
-	(let ((,result-sym
-	       ,(if (= 1 (length (cadr form)))
-		    `(catch (begin (remove-temporary-file ,(caadr form))
-				   (rethrow *error*))
-			    ,@(cddr form))
-		    `(lettmp ,(cdadr form) ,@(cddr form)))))
-	  (remove-temporary-file ,(caadr form))
-	  ,result-sym)) (make-temporary-file ,(symbol->string (caadr form))))))
+(define-macro (lettmp bindings . body)
+  (let bind ((bindings' bindings))
+    (if (null? bindings')
+	`(begin , at body)
+	(let ((name (car bindings'))
+	      (rest (cdr bindings')))
+	  `(let ((,name (make-temporary-file ,(symbol->string name))))
+	     (finally (remove-temporary-file ,name)
+		      ,(bind rest)))))))
 
 (define (check-execution source transformer)
   (lettmp (sink)

commit e8b843508dac96e9d0a3140954dd5a3618669cec
Author: Justus Winter <justus at g10code.com>
Date:   Thu Dec 22 10:36:56 2016 +0100

    gpgscm: Use boxed values for source locations.
    
    * tests/gpgscm/scheme-private.h (struct port): Use boxed values for
    filename and current line.  This allows us to use the same Scheme
    object for labeling all expressions in a file.
    * tests/gpgscm/scheme.c (file_push): Use boxed type for filename.
    (mark): Mark location objects of port objects.
    (gc): Mark location objects in the load stack.
    (port_clear_location): New function.
    (port_reset_current_line): Likewise.
    (port_increment_current_line): Likewise.
    (file_pop): Adapt accordingly.
    (port_rep_from_filename): Likewise.
    (port_rep_from_file): Likewise.
    (port_close): Likewise.
    (skipspace): Likewise.
    (token): Likewise.
    (_Error_1): Likewise.
    (opexe_0): Likewise.
    (opexe_5): Likewise.
    (scheme_deinit): Likewise.
    (scheme_load_file): Likewise.
    (scheme_load_named_file): Likewise.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme-private.h b/tests/gpgscm/scheme-private.h
index 7f19a6e..aba2319 100644
--- a/tests/gpgscm/scheme-private.h
+++ b/tests/gpgscm/scheme-private.h
@@ -28,8 +28,8 @@ typedef struct port {
       FILE *file;
       int closeit;
 #if SHOW_ERROR_LINE
-      int curr_line;
-      char *filename;
+      pointer curr_line;
+      pointer filename;
 #endif
     } stdio;
     struct {
diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index 2844545..7cd5217 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -377,7 +377,7 @@ static int is_ascii_name(const char *name, int *pc) {
 
 #endif
 
-static int file_push(scheme *sc, const char *fname);
+static int file_push(scheme *sc, pointer fname);
 static void file_pop(scheme *sc);
 static int file_interactive(scheme *sc);
 static INLINE int is_one_of(char *s, int c);
@@ -1552,6 +1552,15 @@ E2:  setmark(p);
                mark(p+1+i);
           }
      }
+#if SHOW_ERROR_LINE
+     else if (is_port(p)) {
+	  port *pt = p->_object._port;
+	  if (pt->kind & port_file) {
+	       mark(pt->rep.stdio.curr_line);
+	       mark(pt->rep.stdio.filename);
+	  }
+     }
+#endif
      /* Mark tag if p has one.  */
      if (has_tag(p))
        mark(p + 1);
@@ -1617,6 +1626,13 @@ static void gc(scheme *sc, pointer a, pointer b) {
   mark(sc->save_inport);
   mark(sc->outport);
   mark(sc->loadport);
+  for (i = 0; i <= sc->file_i; i++) {
+    if (! (sc->load_stack[i].kind & port_file))
+      continue;
+
+    mark(sc->load_stack[i].rep.stdio.filename);
+    mark(sc->load_stack[i].rep.stdio.curr_line);
+  }
 
   /* Mark recent objects the interpreter doesn't know about yet. */
   mark(car(sc->sink));
@@ -1678,14 +1694,39 @@ static void finalize_cell(scheme *sc, pointer a) {
   }
 }
 
+#if SHOW_ERROR_LINE
+static void
+port_clear_location (scheme *sc, port *p)
+{
+  assert(p->kind & port_file);
+  p->rep.stdio.curr_line = sc->NIL;
+  p->rep.stdio.filename = sc->NIL;
+}
+
+static void
+port_reset_current_line (scheme *sc, port *p)
+{
+  assert(p->kind & port_file);
+  p->rep.stdio.curr_line = mk_integer(sc, 0);
+}
+
+static void
+port_increment_current_line (scheme *sc, port *p, long delta)
+{
+  assert(p->kind & port_file);
+  p->rep.stdio.curr_line =
+    mk_integer(sc, ivalue_unchecked(p->rep.stdio.curr_line) + delta);
+}
+#endif
+
 /* ========== Routines for Reading ========== */
 
-static int file_push(scheme *sc, const char *fname) {
+static int file_push(scheme *sc, pointer fname) {
   FILE *fin = NULL;
 
   if (sc->file_i == MAXFIL-1)
      return 0;
-  fin=fopen(fname,"r");
+  fin = fopen(string_value(fname), "r");
   if(fin!=0) {
     sc->file_i++;
     sc->load_stack[sc->file_i].kind=port_file|port_input;
@@ -1695,9 +1736,8 @@ static int file_push(scheme *sc, const char *fname) {
     sc->loadport->_object._port=sc->load_stack+sc->file_i;
 
 #if SHOW_ERROR_LINE
-    sc->load_stack[sc->file_i].rep.stdio.curr_line = 0;
-    if(fname)
-      sc->load_stack[sc->file_i].rep.stdio.filename = store_string(sc, strlen(fname), fname, 0);
+    port_reset_current_line(sc, &sc->load_stack[sc->file_i]);
+    sc->load_stack[sc->file_i].rep.stdio.filename = fname;
 #endif
   }
   return fin!=0;
@@ -1707,6 +1747,10 @@ static void file_pop(scheme *sc) {
  if(sc->file_i != 0) {
    sc->nesting=sc->nesting_stack[sc->file_i];
    port_close(sc,sc->loadport,port_input);
+#if SHOW_ERROR_LINE
+   if (sc->load_stack[sc->file_i].kind & port_file)
+     port_clear_location(sc, &sc->load_stack[sc->file_i]);
+#endif
    sc->file_i--;
    sc->loadport->_object._port=sc->load_stack+sc->file_i;
  }
@@ -1736,10 +1780,12 @@ static port *port_rep_from_filename(scheme *sc, const char *fn, int prop) {
   pt->rep.stdio.closeit=1;
 
 #if SHOW_ERROR_LINE
-  if(fn)
-    pt->rep.stdio.filename = store_string(sc, strlen(fn), fn, 0);
+  if (fn)
+    pt->rep.stdio.filename = mk_string(sc, fn);
+  else
+    pt->rep.stdio.filename = mk_string(sc, "<unknown>");
 
-  pt->rep.stdio.curr_line = 0;
+  port_reset_current_line(sc, pt);
 #endif
   return pt;
 }
@@ -1764,6 +1810,10 @@ static port *port_rep_from_file(scheme *sc, FILE *f, int prop)
     pt->kind = port_file | prop;
     pt->rep.stdio.file = f;
     pt->rep.stdio.closeit = 0;
+#if SHOW_ERROR_LINE
+    pt->rep.stdio.filename = mk_string(sc, "<unknown>");
+    port_reset_current_line(sc, pt);
+#endif
     return pt;
 }
 
@@ -1837,10 +1887,7 @@ static void port_close(scheme *sc, pointer p, int flag) {
 
 #if SHOW_ERROR_LINE
       /* Cleanup is here so (close-*-port) functions could work too */
-      pt->rep.stdio.curr_line = 0;
-
-      if(pt->rep.stdio.filename)
-        sc->free(pt->rep.stdio.filename);
+      port_clear_location(sc, pt);
 #endif
 
       fclose(pt->rep.stdio.file);
@@ -2119,8 +2166,11 @@ static INLINE int skipspace(scheme *sc) {
 
 /* record it */
 #if SHOW_ERROR_LINE
-     if (sc->load_stack[sc->file_i].kind & port_file)
-       sc->load_stack[sc->file_i].rep.stdio.curr_line += curr_line;
+     {
+       port *p = &sc->load_stack[sc->file_i];
+       if (p->kind & port_file)
+	 port_increment_current_line(sc, p, curr_line);
+     }
 #endif
 
      if(c!=EOF) {
@@ -2160,7 +2210,7 @@ static int token(scheme *sc) {
 
 #if SHOW_ERROR_LINE
            if(c == '\n' && sc->load_stack[sc->file_i].kind & port_file)
-             sc->load_stack[sc->file_i].rep.stdio.curr_line++;
+             port_increment_current_line(sc, &sc->load_stack[sc->file_i], 1);
 #endif
 
        if(c == EOF)
@@ -2188,7 +2238,7 @@ static int token(scheme *sc) {
 
 #if SHOW_ERROR_LINE
            if(c == '\n' && sc->load_stack[sc->file_i].kind & port_file)
-             sc->load_stack[sc->file_i].rep.stdio.curr_line++;
+             port_increment_current_line(sc, &sc->load_stack[sc->file_i], 1);
 #endif
 
            if(c == EOF)
@@ -2691,8 +2741,8 @@ static pointer _Error_1(scheme *sc, const char *s, pointer a) {
 	 fname = string_value(car(tag));
 	 ln = ivalue_unchecked(cdr(tag));
        } else {
-	 fname = sc->load_stack[sc->file_i].rep.stdio.filename;
-	 ln = sc->load_stack[sc->file_i].rep.stdio.curr_line;
+	 fname = string_value(sc->load_stack[sc->file_i].rep.stdio.filename);
+	 ln = ivalue_unchecked(sc->load_stack[sc->file_i].rep.stdio.curr_line);
        }
 
        /* should never happen */
@@ -3105,7 +3155,7 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
                fprintf(sc->outport->_object._port->rep.stdio.file,
                "Loading %s\n", strvalue(car(sc->args)));
           }
-          if (!file_push(sc,strvalue(car(sc->args)))) {
+          if (!file_push(sc, car(sc->args))) {
                Error_1(sc,"unable to open", car(sc->args));
           }
       else
@@ -4839,14 +4889,13 @@ static pointer opexe_5(scheme *sc, enum scheme_opcodes op) {
                     sc->nesting_stack[sc->file_i]++;
 #if USE_TAGS && SHOW_ERROR_LINE
 		    if (sc->load_stack[sc->file_i].kind & port_file) {
-		      const char *filename =
+		      pointer filename =
 			sc->load_stack[sc->file_i].rep.stdio.filename;
-		      int lineno =
+		      pointer lineno =
 			sc->load_stack[sc->file_i].rep.stdio.curr_line;
 
 		      s_save(sc, OP_TAG_VALUE,
-			     cons(sc, mk_string(sc, filename),
-				  cons(sc, mk_integer(sc, lineno), sc->NIL)),
+			     cons(sc, filename, cons(sc, lineno, sc->NIL)),
 			     sc->NIL);
 		    }
 #endif
@@ -4917,7 +4966,8 @@ static pointer opexe_5(scheme *sc, enum scheme_opcodes op) {
                  backchar(sc,c);
 #if SHOW_ERROR_LINE
                else if (sc->load_stack[sc->file_i].kind & port_file)
-                  sc->load_stack[sc->file_i].rep.stdio.curr_line++;
+                  port_increment_current_line(sc,
+					      &sc->load_stack[sc->file_i], 1);
 #endif
                sc->nesting_stack[sc->file_i]--;
                s_return(sc,reverse_in_place(sc, sc->NIL, sc->args));
@@ -5583,10 +5633,6 @@ void scheme_set_external_data(scheme *sc, void *p) {
 void scheme_deinit(scheme *sc) {
   int i;
 
-#if SHOW_ERROR_LINE
-  char *fname;
-#endif
-
   sc->oblist=sc->NIL;
   sc->global_env=sc->NIL;
   dump_stack_free(sc);
@@ -5608,6 +5654,14 @@ void scheme_deinit(scheme *sc) {
     typeflag(sc->loadport) = T_ATOM;
   }
   sc->loadport=sc->NIL;
+
+#if SHOW_ERROR_LINE
+  for(i=0; i<=sc->file_i; i++) {
+    if (sc->load_stack[i].kind & port_file)
+      port_clear_location(sc, &sc->load_stack[i]);
+  }
+#endif
+
   sc->gc_verbose=0;
   gc(sc,sc->NIL,sc->NIL);
 
@@ -5619,16 +5673,6 @@ void scheme_deinit(scheme *sc) {
     sc->free(sc->alloc_seg[i]);
   }
   sc->free(sc->strbuff);
-
-#if SHOW_ERROR_LINE
-  for(i=0; i<=sc->file_i; i++) {
-    if (sc->load_stack[i].kind & port_file) {
-      fname = sc->load_stack[i].rep.stdio.filename;
-      if(fname)
-        sc->free(fname);
-    }
-  }
-#endif
 }
 
 void scheme_load_file(scheme *sc, FILE *fin)
@@ -5647,11 +5691,11 @@ void scheme_load_named_file(scheme *sc, FILE *fin, const char *filename) {
   }
 
 #if SHOW_ERROR_LINE
-  sc->load_stack[0].rep.stdio.curr_line = 0;
+  port_reset_current_line(sc, &sc->load_stack[0]);
   if(fin!=stdin && filename)
-    sc->load_stack[0].rep.stdio.filename = store_string(sc, strlen(filename), filename, 0);
+    sc->load_stack[0].rep.stdio.filename = mk_string(sc, filename);
   else
-    sc->load_stack[0].rep.stdio.filename = NULL;
+    sc->load_stack[0].rep.stdio.filename = mk_string(sc, "<unknown>");
 #endif
 
   sc->inport=sc->loadport;
@@ -5663,8 +5707,7 @@ void scheme_load_named_file(scheme *sc, FILE *fin, const char *filename) {
   }
 
 #if SHOW_ERROR_LINE
-  sc->free(sc->load_stack[0].rep.stdio.filename);
-  sc->load_stack[0].rep.stdio.filename = NULL;
+  port_clear_location(sc, &sc->load_stack[0]);
 #endif
 }
 

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgscm/init.scm         |  17 ++++++
 tests/gpgscm/scheme-private.h |   4 +-
 tests/gpgscm/scheme.c         | 139 +++++++++++++++++++++++++++---------------
 tests/gpgscm/tests.scm        |  81 +++++++++++-------------
 4 files changed, 145 insertions(+), 96 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  2 13:34:06 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 02 Jan 2017 13:34:06 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-26-g5b6ebfb
Message-ID: <E1cO1oX-0005gC-Vc@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  5b6ebfb9244602d9de31d61c7eceb0c45ac8aa49 (commit)
       via  6b84ecbf312d98ac8cce9fe5facdc815bc742fa1 (commit)
       via  c52930d11fcc52515fcc09a1085bf118411566a8 (commit)
      from  b0e14bd6ff8401b12b2b39f75aef94d3ad28017f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5b6ebfb9244602d9de31d61c7eceb0c45ac8aa49
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 2 13:30:37 2017 +0100

    g13: Improve printing of debug infos.
    
    * g13/g13tuple.c (all_printable): Make it work.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g13/g13tuple.c b/g13/g13tuple.c
index f79c82d..b10ebbc 100644
--- a/g13/g13tuple.c
+++ b/g13/g13tuple.c
@@ -282,7 +282,7 @@ all_printable (const void *buf, size_t buflen)
   const unsigned char *s;
 
   for (s=buf ; buflen; s++, buflen--)
-    if (*s < 32 && *s > 126)
+    if (*s < 32 || *s > 126)
       return 0;
   return 1;
 }

commit 6b84ecbf312d98ac8cce9fe5facdc815bc742fa1
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 2 13:29:18 2017 +0100

    Replace use of variable-length-arrays.
    
    * common/t-iobuf.c (main): Replace variable-length-array.
    * g10/gpgcompose.c (mksubpkt_callback): Ditto.
    (encrypted): Ditto.
    * g10/t-stutter.c (log_hexdump): Ditto.
    (oracle_test): Ditto.
    * g10/tofu.c (get_policy): Ditto.  Use "%zu" for size_t.
    * scd/app-openpgp.c (ecc_writekey): Replace variable-length-array.
    Check for zero length OID_LEN.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/t-iobuf.c b/common/t-iobuf.c
index 0e6f508..bdeab99 100644
--- a/common/t-iobuf.c
+++ b/common/t-iobuf.c
@@ -362,10 +362,12 @@ main (int argc, char *argv[])
   {
     iobuf_t iobuf;
     int rc;
-    char *content = "0123456789";
+    char content[] = "0123456789";
     int n;
     int c;
-    char buffer[strlen (content)];
+    char buffer[10];
+
+    assert (sizeof buffer == sizeof content - 1);
 
     iobuf = iobuf_temp_with_content (content, strlen (content));
     assert (iobuf);
diff --git a/g10/gpgcompose.c b/g10/gpgcompose.c
index 512cb45..fafbfd2 100644
--- a/g10/gpgcompose.c
+++ b/g10/gpgcompose.c
@@ -1654,13 +1654,17 @@ mksubpkt_callback (PKT_signature *sig, void *cookie)
 
   if (si->reason_for_revocation)
     {
-      int l = 1 + strlen (si->reason_for_revocation);
-      char buf[l];
+      int len = 1 + strlen (si->reason_for_revocation);
+      char *buf;
+
+      buf = xmalloc (len);
 
       buf[0] = si->reason_for_revocation_code;
-      memcpy (&buf[1], si->reason_for_revocation, l - 1);
+      memcpy (&buf[1], si->reason_for_revocation, len - 1);
+
+      build_sig_subpkt (sig, SIGSUBPKT_REVOC_REASON, buf, len);
 
-      build_sig_subpkt (sig, SIGSUBPKT_REVOC_REASON, buf, l);
+      xfree (buf);
     }
 
   if (si->features)
@@ -2540,10 +2544,13 @@ encrypted (const char *option, int argc, char *argv[], void *cookie)
 
   if (do_debug)
     {
-      char buf[2 * session_key.keylen + 1];
+      char *buf;
+
+      buf = xmalloc (2 * session_key.keylen + 1);
       debug ("session key: algo: %d; keylen: %d; key: %s\n",
              session_key.algo, session_key.keylen,
              bin2hex (session_key.key, session_key.keylen, buf));
+      xfree (buf);
     }
 
   if (strcmp (option, "--encrypted-mdc") == 0)
diff --git a/g10/t-stutter.c b/g10/t-stutter.c
index a2e9666..359cdf6 100644
--- a/g10/t-stutter.c
+++ b/g10/t-stutter.c
@@ -68,8 +68,8 @@ log_hexdump (byte *buffer, int length)
     {
       int have = length > 16 ? 16 : length;
       int i;
-      char formatted[2 * have + 1];
-      char text[have + 1];
+      char formatted[2 * 16 + 1];
+      char text[16 + 1];
 
       fprintf (stderr, "%-8d ", written);
       bin2hex (buffer, have, formatted);
@@ -87,10 +87,12 @@ log_hexdump (byte *buffer, int length)
         }
 
       for (i = 0; i < have; i ++)
-        if (isprint (buffer[i]))
-          text[i] = buffer[i];
-        else
-          text[i] = '.';
+        {
+          if (isprint (buffer[i]))
+            text[i] = buffer[i];
+          else
+            text[i] = '.';
+        }
       text[i] = 0;
 
       fprintf (stderr, "    ");
@@ -347,8 +349,9 @@ oracle (int debug, byte *ciphertext, int len, byte **plaintextp, byte **cfbp)
 static int
 oracle_test (unsigned int d, int b, int debug)
 {
-  byte probe[blocksize + 2];
+  byte probe[32 + 2];
 
+  log_assert (blocksize + 2 <= sizeof probe);
   log_assert (d < 256 * 256);
 
   if (b == 1)
diff --git a/g10/tofu.c b/g10/tofu.c
index 2bded9e..8d535fa 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -2457,16 +2457,16 @@ get_policy (tofu_dbs_t dbs, PKT_public_key *pk,
   /* See if the key is signed by an ultimately trusted key.  */
   {
     int fingerprint_raw_len = strlen (fingerprint) / 2;
-    char fingerprint_raw[fingerprint_raw_len];
+    char fingerprint_raw[20];
     int len = 0;
 
-    if (fingerprint_raw_len != 20
+    if (fingerprint_raw_len != sizeof fingerprint_raw
         || ((len = hex2bin (fingerprint,
                             fingerprint_raw, fingerprint_raw_len))
             != strlen (fingerprint)))
       {
         if (DBG_TRUST)
-          log_debug ("TOFU: Bad fingerprint: %s (len: %zd, parsed: %d)\n",
+          log_debug ("TOFU: Bad fingerprint: %s (len: %zu, parsed: %d)\n",
                      fingerprint, strlen (fingerprint), len);
       }
     else
diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index 5fa4fd2..4d8b1bc 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -3580,11 +3580,23 @@ ecc_writekey (app_t app, gpg_error_t (*pincb)(void*, const char *, char **),
     {
       if (app->app_local->extcap.algo_attr_change)
         {
-          unsigned char keyattr[oid_len];
+          unsigned char *keyattr;
 
+          if (!oid_len)
+            {
+              err = gpg_error (GPG_ERR_INTERNAL);
+              goto leave;
+            }
+          keyattr = xtrymalloc (oid_len);
+          if (!keyattr)
+            {
+              err = gpg_error_from_syserror ();
+              goto leave;
+            }
           keyattr[0] = algo;
           memcpy (keyattr+1, oidbuf+1, oid_len-1);
           err = change_keyattr (app, keyno, keyattr, oid_len, pincb, pincb_arg);
+          xfree (keyattr);
           if (err)
             goto leave;
         }

commit c52930d11fcc52515fcc09a1085bf118411566a8
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 2 12:59:10 2017 +0100

    build: Enable gcc warnings to detect non-portable code.
    
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/configure.ac b/configure.ac
index 80d977c..fa206c9 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1574,6 +1574,15 @@ if test "$GCC" = yes; then
         if test x"$_gcc_wopt" = xyes ; then
           mycflags="$mycflags -Wdeclaration-after-statement"
         fi
+
+        AC_MSG_CHECKING([if gcc supports -Wlogical-op and -Wvla])
+        CFLAGS="-Wlogical-op -Wvla"
+        AC_COMPILE_IFELSE([AC_LANG_PROGRAM([],[])],_gcc_wopt=yes,_gcc_wopt=no)
+        AC_MSG_RESULT($_gcc_wopt)
+        if test x"$_gcc_wopt" = xyes ; then
+          mycflags="$mycflags -Wlogical-op -Wvla"
+        fi
+
     else
         mycflags="$mycflags -Wall"
     fi

-----------------------------------------------------------------------

Summary of changes:
 common/t-iobuf.c  |  6 ++++--
 configure.ac      |  9 +++++++++
 g10/gpgcompose.c  | 17 ++++++++++++-----
 g10/t-stutter.c   | 17 ++++++++++-------
 g10/tofu.c        |  6 +++---
 g13/g13tuple.c    |  2 +-
 scd/app-openpgp.c | 14 +++++++++++++-
 7 files changed, 52 insertions(+), 19 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  2 14:06:33 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 02 Jan 2017 14:06:33 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-19-gececfd5
Message-ID: <E1cO2Jv-00070t-8G@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  ececfd5de81f1851943be7b284b672d5b02aceb4 (commit)
       via  7103315829847163f1c6f52cad25d1ddb33358f0 (commit)
      from  a4b9f1a2b404fd8627d5ac567617510abd55d980 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ececfd5de81f1851943be7b284b672d5b02aceb4
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 2 14:03:08 2017 +0100

    qt: Update config sync doc / comment
    
    * lang/qt/src/cryptoconfig.h (CryptoConfig::sync): Document
    that runtime option is always set.
    * lang/qt/Src/qgpgmenewcryptoconfig.cpp
    (QGpgMENewCryptoConfigComponent::sync): Remove outdated comment
    and warn on error.

diff --git a/lang/qt/src/cryptoconfig.h b/lang/qt/src/cryptoconfig.h
index c3f0c7e..452bfbb 100644
--- a/lang/qt/src/cryptoconfig.h
+++ b/lang/qt/src/cryptoconfig.h
@@ -379,9 +379,8 @@ public:
     /**
      * Write back changes
      *
-     * @param runtime If this option is set, the changes will take effect at run-time, as
-     * far as this is possible.  Otherwise, they will take effect at the next
-     * start of the respective backend programs.
+     * @param runtime this parameter is ignored. Changes will always
+     * be made with --runtime set.
      */
     virtual void sync(bool runtime) = 0;
 
diff --git a/lang/qt/src/qgpgmenewcryptoconfig.cpp b/lang/qt/src/qgpgmenewcryptoconfig.cpp
index eb3af56..49b27ca 100644
--- a/lang/qt/src/qgpgmenewcryptoconfig.cpp
+++ b/lang/qt/src/qgpgmenewcryptoconfig.cpp
@@ -216,17 +216,12 @@ QGpgMENewCryptoConfigGroup *QGpgMENewCryptoConfigComponent::group(const QString
 
 void QGpgMENewCryptoConfigComponent::sync(bool runtime)
 {
-    Q_UNUSED(runtime)
-    // ### how to pass --runtime to gpgconf? -> marcus: not yet supported (2010-11-20)
+    Q_UNUSED(runtime) // runtime is always set by engine_gpgconf
     if (const Error err = m_component.save()) {
-#if 0
-        TODO port
-        const QString wmsg = i18n("Error from gpgconf while saving configuration: %1", QString::fromLocal8Bit(err.asString()));
-        qCWarning(GPGPME_BACKEND_LOG) << ":" << wmsg;
-        KMessageBox::error(0, wmsg);
-#endif
+        qCWarning(GPGPME_BACKEND_LOG) << ":"
+            << "Error from gpgconf while saving configuration: %1"
+            << QString::fromLocal8Bit(err.asString());
     }
-    // ### unset dirty state again
 }
 
 ////

commit 7103315829847163f1c6f52cad25d1ddb33358f0
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 2 13:11:10 2017 +0100

    core: Always use runtime for gpgconf changes
    
    * src/engine-gpgconf.c (gpgconf_write): Add --runtime.
    * src/gpgme.h.in (gpgme_conf_opt_change): Document this
    behavior.
    
    --
    If a tool uses GPGME for changing configuration values it
    needs a way to ensure that these changes take effect. Otherwise
    users may change and see config values and do not understand
    why they are not working.

diff --git a/src/engine-gpgconf.c b/src/engine-gpgconf.c
index 2ea8673..01a60eb 100644
--- a/src/engine-gpgconf.c
+++ b/src/engine-gpgconf.c
@@ -708,7 +708,7 @@ gpgconf_write (void *engine, const char *arg1, char *arg2, gpgme_data_t conf)
 #define BUFLEN 1024
   char buf[BUFLEN];
   int buflen = 0;
-  char *argv[6];
+  char *argv[7];
   int argc = 0;
   int rp[2];
   struct spawn_fd_item_s cfd[] = { {-1, 0 /* STDIN_FILENO */}, {-1, -1} };
@@ -724,6 +724,7 @@ gpgconf_write (void *engine, const char *arg1, char *arg2, gpgme_data_t conf)
       argv[argc++] = gpgconf->home_dir;
     }
 
+  argv[argc++] = (char*)"--runtime";
   argv[argc++] = (char*)arg1;
   argv[argc++] = arg2;
   argv[argc] = NULL;
diff --git a/src/gpgme.h.in b/src/gpgme.h.in
index 7cfe8f6..4fc119f 100644
--- a/src/gpgme.h.in
+++ b/src/gpgme.h.in
@@ -2410,7 +2410,8 @@ void gpgme_conf_arg_release (gpgme_conf_arg_t arg, gpgme_conf_type_t type);
 /* Register a change for the value of OPT to ARG.  If RESET is 1 (do
    not use any values but 0 or 1), ARG is ignored and the option is
    not changed (reverting a previous change).  Otherwise, if ARG is
-   NULL, the option is cleared or reset to its default.  */
+   NULL, the option is cleared or reset to its default. The change
+   is done with gpgconf's --runtime option to immediately take effect. */
 gpgme_error_t gpgme_conf_opt_change (gpgme_conf_opt_t opt, int reset,
 				     gpgme_conf_arg_t arg);
 

-----------------------------------------------------------------------

Summary of changes:
 lang/qt/src/cryptoconfig.h            |  5 ++---
 lang/qt/src/qgpgmenewcryptoconfig.cpp | 13 ++++---------
 src/engine-gpgconf.c                  |  3 ++-
 src/gpgme.h.in                        |  3 ++-
 4 files changed, 10 insertions(+), 14 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  2 18:24:40 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 02 Jan 2017 18:24:40 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-28-ga1e0d4a
Message-ID: <E1cO6Lj-0002dg-9T@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  a1e0d4a1e75fc6e6c3392a4e1d1d27005b38d6cc (commit)
       via  6d065198337b5242889723481bfa9ce81aa108bb (commit)
      from  5b6ebfb9244602d9de31d61c7eceb0c45ac8aa49 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a1e0d4a1e75fc6e6c3392a4e1d1d27005b38d6cc
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 2 16:30:45 2017 +0100

    common: Turn assertions into expressions.
    
    * common/logging.h (log_assert): Turn this into an expression so it
    can be used in expressions.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/common/logging.h b/common/logging.h
index 64b999d..fc9e846 100644
--- a/common/logging.h
+++ b/common/logging.h
@@ -56,18 +56,18 @@ estream_t log_get_stream (void);
   void _log_assert (const char *expr, const char *file, int line,
                     const char *func) GPGRT_ATTR_NORETURN;
 # define BUG() bug_at( __FILE__ , __LINE__, __FUNCTION__)
-# define log_assert(expr)    do {                               \
-    if (!(expr))                                                \
-      _log_assert (#expr, __FILE__, __LINE__, __FUNCTION__);    \
-  } while (0)
+# define log_assert(expr)                                       \
+  ((expr)                                                       \
+   ? (void) 0                                                   \
+   : _log_assert (#expr, __FILE__, __LINE__, __FUNCTION__))
 #else /*!GPGRT_HAVE_MACRO_FUNCTION*/
   void bug_at (const char *file, int line);
   void _log_assert (const char *expr, const char *file, int line;
 # define BUG() bug_at( __FILE__ , __LINE__ )
-# define log_assert(expr)    do {                               \
-    if (!(expr))                                                \
-      _log_assert (#expr, __FILE__, __LINE__);                  \
-  } while (0)
+# define log_assert(expr)                                       \
+  ((expr)                                                       \
+   ? (void) 0                                                   \
+   : _log_assert (#expr, __FILE__, __LINE__))
 #endif /*!GPGRT_HAVE_MACRO_FUNCTION*/
 
 /* Flag values for log_set_prefix. */

commit 6d065198337b5242889723481bfa9ce81aa108bb
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 2 16:37:02 2017 +0100

    tests: Fix faked time in the TOFU test.
    
    * tests/openpgp/tofu.scm (GPG): Fix time delta.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/tofu.scm b/tests/openpgp/tofu.scm
index 20c130a..cfcd5c8 100755
--- a/tests/openpgp/tofu.scm
+++ b/tests/openpgp/tofu.scm
@@ -29,7 +29,7 @@
 (define (days->seconds days) (* days 24 60 60))
 
 ;; Redefine GPG without --always-trust and a fixed time.
-(define GPG `(,(tool 'gpg) --no-permission-warning ,(faketime GPGTIME)))
+(define GPG `(,(tool 'gpg) --no-permission-warning ,(faketime 0)))
 (define GNUPGHOME (getenv "GNUPGHOME"))
 (if (string=? "" GNUPGHOME)
     (fail "GNUPGHOME not set"))

-----------------------------------------------------------------------

Summary of changes:
 common/logging.h       | 16 ++++++++--------
 tests/openpgp/tofu.scm |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  2 18:25:40 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 02 Jan 2017 18:25:40 +0100
Subject: [git] GnuPG - branch, justus/issue2826-0,
 created. gnupg-2.1.17-31-g0140684
Message-ID: <E1cO6Mg-0002fF-GG@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, justus/issue2826-0 has been created
        at  01406840c199e0e13774fdea6dd82ed15fbb1a41 (commit)

- Log -----------------------------------------------------------------
commit 01406840c199e0e13774fdea6dd82ed15fbb1a41
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 2 18:16:47 2017 +0100

    g10: Avoid accessing invalid expiration dates.
    
    * g10/sig-check.c (check_signature_metadata_validity): Avoid accessing
    invalid expiration dates.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/g10/sig-check.c b/g10/sig-check.c
index a735500..3a378e1 100644
--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -324,7 +324,14 @@ check_signature_metadata_validity (PKT_public_key *pk, PKT_signature *sig,
        flag which is set after a full evaluation of the key (getkey.c)
        as well as a simple compare to the current time in case the
        merge has for whatever reasons not been done.  */
-    if( pk->has_expired || (kb_pk_expiredate (pk) && kb_pk_expiredate (pk) < cur_time)) {
+    if( pk->has_expired || (/* Computing EXPIREDATE requires calling
+			       this function.  To break this circular
+			       dependency, we only check the
+			       expiration if this information is
+			       already known (i.e. valid):  */
+			    kb_pk_valid_expiredate (pk)
+			    && kb_pk_expiredate (pk)
+			    && kb_pk_expiredate (pk) < cur_time)) {
         char buf[11];
         if (opt.verbose)
 	  log_info(_("Note: signature key %s expired %s\n"),

commit 65c8002b705b30b5eefdaf2586559d8112b2a063
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 2 16:55:41 2017 +0100

    g10: Use accessors for expiration dates of public keys.
    
    * g10/Makefile.am (common_source): Add new file.
    * g10/packet-functions.h: New file.
    * g10/packet.h (PKT_public_key): New flag 'valid_expiredate'.
    * g10/call-dirmngr.c: Apply the following semantic patch.
    * g10/free-packet.c: Likewise.
    * g10/getkey.c: Likewise.
    * g10/keyedit.c: Likewise.
    * g10/keygen.c: Likewise.  Here with small manual fixups.
    * g10/keyid.c: Likewise.
    * g10/keylist.c: Likewise.
    * g10/mainproc.c: Likewise.
    * g10/parse-packet.c: Likewise.
    * g10/pubkey-enc.c: Likewise.
    * g10/sig-check.c: Likewise.
    * g10/trustdb.c: Likewise.
    --
    
        @@
        PKT_public_key *E;
        expression X;
        @@
        -E->expiredate = X
        +kb_pk_set_expiredate (E, X)
    
        @@
        PKT_public_key *E;
        @@
        -E->expiredate
        +kb_pk_expiredate (E)
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/g10/Makefile.am b/g10/Makefile.am
index 604be93..7a14173 100644
--- a/g10/Makefile.am
+++ b/g10/Makefile.am
@@ -112,6 +112,7 @@ common_source =  \
 	      openfile.c	\
 	      keyid.c		\
 	      packet.h		\
+	      packet-functions.h \
 	      parse-packet.c	\
 	      cpr.c		\
 	      plaintext.c	\
diff --git a/g10/call-dirmngr.c b/g10/call-dirmngr.c
index 12838b5..94018be 100644
--- a/g10/call-dirmngr.c
+++ b/g10/call-dirmngr.c
@@ -948,7 +948,7 @@ ks_put_inq_cb (void *opaque, const char *line)
 
 		record_output (fp, node->pkt->pkttype, validity,
 			       nbits_from_pk (pk), pk->pubkey_algo,
-			       pk->keyid, pk->timestamp, pk->expiredate,
+			       pk->keyid, pk->timestamp, kb_pk_expiredate (pk),
 			       NULL);
               }
               break;
diff --git a/g10/free-packet.c b/g10/free-packet.c
index 6038d26..63349c6 100644
--- a/g10/free-packet.c
+++ b/g10/free-packet.c
@@ -455,7 +455,7 @@ cmp_public_keys( PKT_public_key *a, PKT_public_key *b )
 
     if( a->timestamp != b->timestamp )
 	return -1;
-    if( a->version < 4 && a->expiredate != b->expiredate )
+    if( a->version < 4 && kb_pk_expiredate (a) != kb_pk_expiredate (b))
 	return -1;
     if( a->pubkey_algo != b->pubkey_algo )
 	return -1;
diff --git a/g10/getkey.c b/g10/getkey.c
index ed0bf0e..e133b97 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -2899,7 +2899,7 @@ merge_selfsigs_main (KBNODE keyblock, int *r_revoked,
     key_expire = pk->max_expiredate;
 
   pk->has_expired = key_expire >= curtime ? 0 : key_expire;
-  pk->expiredate = key_expire;
+  kb_pk_set_expiredate (pk, key_expire);
 
   /* Fixme: we should see how to get rid of the expiretime fields  but
    * this needs changes at other places too. */
@@ -3037,7 +3037,7 @@ buf_to_sig (const byte * buf, size_t len)
      flags.backsig
      pubkey_usage
      has_expired
-     expired_date
+     expiredate
 
    On this subkey's most revent valid self-signed packet, the
    following field is set:
@@ -3146,7 +3146,7 @@ merge_selfsigs_subkey (KBNODE keyblock, KBNODE subnode)
   else
     key_expire = 0;
   subpk->has_expired = key_expire >= curtime ? 0 : key_expire;
-  subpk->expiredate = key_expire;
+  kb_pk_set_expiredate (subpk, key_expire);
 
   /* Algo doesn't exist.  */
   if (openpgp_pk_test_algo (subpk->pubkey_algo))
diff --git a/g10/keyedit.c b/g10/keyedit.c
index 88e2f4f..c565ee0 100644
--- a/g10/keyedit.c
+++ b/g10/keyedit.c
@@ -1394,7 +1394,7 @@ sign_uids (ctrl_t ctrl, estream_t fp,
       show_key_with_all_names (ctrl, fp, keyblock, 1, 0, 1, 0, 0, 0);
       tty_fprintf (fp, "\n");
 
-      if (primary_pk->expiredate && !selfsig)
+      if (kb_pk_expiredate (primary_pk) && !selfsig)
 	{
           /* Static analyzer note: A claim that PRIMARY_PK might be
              NULL is not correct because it set from the public key
@@ -1406,7 +1406,7 @@ sign_uids (ctrl_t ctrl, estream_t fp,
 
 	  u32 now = make_timestamp ();
 
-	  if (primary_pk->expiredate <= now)
+	  if (kb_pk_expiredate (primary_pk) <= now)
 	    {
 	      tty_fprintf (fp, _("This key has expired!"));
 
@@ -1443,7 +1443,7 @@ sign_uids (ctrl_t ctrl, estream_t fp,
 		         to answer the questions, enter the
 		         passphrase, etc). */
 		      timestamp = now;
-		      duration = primary_pk->expiredate - now;
+		      duration = kb_pk_expiredate (primary_pk) - now;
 		    }
 
 		  cpr_kill_prompt ();
@@ -3676,7 +3676,7 @@ show_key_with_all_names_colon (ctrl_t ctrl, estream_t fp, kbnode_t keyblock)
                       nbits_from_pk (pk),
                       pk->pubkey_algo,
                       (ulong) keyid[0], (ulong) keyid[1],
-                      (ulong) pk->timestamp, (ulong) pk->expiredate);
+                      (ulong) pk->timestamp, (ulong) kb_pk_expiredate (pk));
 	  if (node->pkt->pkttype == PKT_PUBLIC_KEY
 	      && !(opt.fast_list_mode || opt.no_expensive_trust_checks))
 	    es_putc (get_ownertrust_info (pk), fp);
@@ -4309,7 +4309,7 @@ subkey_expire_warning (kbnode_t keyblock)
       if (pk->timestamp > latest_date || (!pk->timestamp && !latest_date))
         {
           latest_date = pk->timestamp;
-          subexpire = pk->expiredate;
+          subexpire = kb_pk_expiredate (pk);
         }
     }
 
@@ -4872,14 +4872,14 @@ menu_expire (kbnode_t pub_keyblock, int force_mainkey, u32 newexpiration)
 	{
 	  main_pk = node->pkt->pkt.public_key;
 	  keyid_from_pk (main_pk, keyid);
-	  main_pk->expiredate = expiredate;
+	  kb_pk_set_expiredate (main_pk, expiredate);
 	}
       else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
 	{
           if ((node->flag & NODFLG_SELKEY) && !force_mainkey)
             {
               sub_pk = node->pkt->pkt.public_key;
-              sub_pk->expiredate = expiredate;
+              kb_pk_set_expiredate (sub_pk, expiredate);
             }
           else
             sub_pk = NULL;
diff --git a/g10/keygen.c b/g10/keygen.c
index b4fddba..f54bfa8 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -259,10 +259,10 @@ keygen_add_key_expire (PKT_signature *sig, void *opaque)
   byte buf[8];
   u32  u;
 
-  if (pk->expiredate)
+  if (kb_pk_expiredate (pk))
     {
-      if (pk->expiredate > pk->timestamp)
-        u = pk->expiredate - pk->timestamp;
+      if (kb_pk_expiredate (pk) > pk->timestamp)
+        u = kb_pk_expiredate (pk) - pk->timestamp;
       else
         u = 1;
 
@@ -1290,8 +1290,7 @@ do_create_from_keygrip (ctrl_t ctrl, int algo, const char *hexkeygrip,
 
   pk->timestamp = timestamp;
   pk->version = 4;
-  if (expireval)
-    pk->expiredate = pk->timestamp + expireval;
+  kb_pk_set_expiredate (pk, expireval ? pk->timestamp + expireval : 0);
   pk->pubkey_algo = algo;
 
   if (algo == PUBKEY_ALGO_ECDSA
@@ -1357,8 +1356,7 @@ common_gen (const char *keyparms, int algo, const char *algoelem,
 
   pk->timestamp = timestamp;
   pk->version = 4;
-  if (expireval)
-    pk->expiredate = pk->timestamp + expireval;
+  kb_pk_set_expiredate (pk, expireval ? pk->timestamp + expireval : 0);
   pk->pubkey_algo = algo;
 
   if (algo == PUBKEY_ALGO_ECDSA
@@ -5276,8 +5274,7 @@ gen_card_key (int keyno, int algo, int is_primary, kbnode_t pub_root,
 
   pk->timestamp = *timestamp;
   pk->version = 4;
-  if (expireval)
-    pk->expiredate = pk->timestamp + expireval;
+  kb_pk_set_expiredate (pk, expireval ? pk->timestamp + expireval : 0);
   pk->pubkey_algo = algo;
 
   pkt->pkttype = is_primary ? PKT_PUBLIC_KEY : PKT_PUBLIC_SUBKEY;
diff --git a/g10/keyid.c b/g10/keyid.c
index dd098fd..a2e5412 100644
--- a/g10/keyid.c
+++ b/g10/keyid.c
@@ -660,9 +660,9 @@ expirestr_from_pk (PKT_public_key *pk)
   static char buffer[11+5];
   time_t atime;
 
-  if (!pk->expiredate)
+  if (!kb_pk_expiredate (pk))
     return _("never     ");
-  atime = pk->expiredate;
+  atime = kb_pk_expiredate (pk);
   return mk_datestr (buffer, atime);
 }
 
diff --git a/g10/keylist.c b/g10/keylist.c
index fe4ce22..0394020 100644
--- a/g10/keylist.c
+++ b/g10/keylist.c
@@ -1245,7 +1245,7 @@ list_keyblock_colon (ctrl_t ctrl, kbnode_t keyblock,
           nbits_from_pk (pk),
           pk->pubkey_algo,
           (ulong) keyid[0], (ulong) keyid[1],
-          colon_datestr_from_pk (pk), colon_strtime (pk->expiredate));
+          colon_datestr_from_pk (pk), colon_strtime (kb_pk_expiredate (pk)));
 
   if (ownertrust_print)
     es_putc (ownertrust_print, es_stdout);
@@ -1383,7 +1383,7 @@ list_keyblock_colon (ctrl_t ctrl, kbnode_t keyblock,
 		  nbits_from_pk (pk2),
 		  pk2->pubkey_algo,
 		  (ulong) keyid2[0], (ulong) keyid2[1],
-		  colon_datestr_from_pk (pk2), colon_strtime (pk2->expiredate)
+		  colon_datestr_from_pk (pk2), colon_strtime (kb_pk_expiredate (pk2))
 		  /* fixme: add LID and ownertrust here */
 	    );
 	  print_capabilities (pk2, NULL);
@@ -1857,7 +1857,7 @@ print_key_line (estream_t fp, PKT_public_key *pk, int secret)
       tty_fprintf (fp, _("expired: %s"), expirestr_from_pk (pk));
       tty_fprintf (fp, "]");
     }
-  else if (pk->expiredate)
+  else if (kb_pk_expiredate (pk))
     {
       tty_fprintf (fp, " [");
       tty_fprintf (fp, _("expires: %s"), expirestr_from_pk (pk));
diff --git a/g10/mainproc.c b/g10/mainproc.c
index 8e3974d..2245879 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -1030,7 +1030,7 @@ list_node (CTX c, kbnode_t node)
                      pk->pubkey_algo,
                      (ulong)keyid[0],(ulong)keyid[1],
                      colon_datestr_from_pk( pk ),
-                     colon_strtime (pk->expiredate) );
+                     colon_strtime (kb_pk_expiredate (pk)) );
           if (pk->flags.primary && !opt.fast_list_mode)
             es_putc (get_ownertrust_info (pk), es_stdout);
           es_putc (':', es_stdout);
diff --git a/g10/packet-functions.h b/g10/packet-functions.h
new file mode 100644
index 0000000..0372f4e
--- /dev/null
+++ b/g10/packet-functions.h
@@ -0,0 +1,49 @@
+/* packet-functions.h - Accessor functions for in-core representations.
+ * Copyright (C) 2017 g10 Code GmbH
+ *
+ * This file is part of GnuPG.
+ *
+ * GnuPG is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuPG is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, see <https://www.gnu.org/licenses/>.
+ */
+
+#ifndef G10_PACKET_FUNCTIONS_H
+#define G10_PACKET_FUNCTIONS_H
+
+#include "../common/logging.h"
+
+static inline u32
+kb_pk_set_expiredate (PKT_public_key *pk, u32 value)
+{
+  pk->expiredate = value;
+  pk->flags.valid_expiredate = 1;
+  return value;
+}
+
+static inline void
+kb_pk_invalidate_expiredate (PKT_public_key *pk)
+{
+  pk->expiredate = 0;
+  pk->flags.valid_expiredate = 0;
+}
+
+static inline int
+kb_pk_valid_expiredate (PKT_public_key *pk)
+{
+  return pk->flags.valid_expiredate;
+}
+
+#define kb_pk_expiredate(PK)					\
+  (log_assert ((PK)->flags.valid_expiredate), (PK)->expiredate)
+
+#endif /*G10_PACKET_FUNCTIONS_H*/
diff --git a/g10/packet.h b/g10/packet.h
index 71079c3..aa1a221 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -396,6 +396,10 @@ typedef struct
     unsigned int backsig:2;       /* 0=none, 1=bad, 2=good.  */
     unsigned int serialno_valid:1;/* SERIALNO below is valid.  */
     unsigned int exact:1;         /* Found via exact (!) search.  */
+
+    /* The following flags track the validity of fields.  Should not
+       be accessed directly.  */
+    unsigned int valid_expiredate:1;
   } flags;
   PKT_user_id *user_id;   /* If != NULL: found by that uid. */
   struct revocation_key *revkey;
@@ -852,4 +856,6 @@ gpg_error_t update_keysig_packet (PKT_signature **ret_sig,
 /*-- keygen.c --*/
 PKT_user_id *generate_user_id (kbnode_t keyblock, const char *uidstr);
 
+#include "packet-functions.h"
+
 #endif /*G10_PACKET_H*/
diff --git a/g10/parse-packet.c b/g10/parse-packet.c
index 7f44ce5..f4427f0 100644
--- a/g10/parse-packet.c
+++ b/g10/parse-packet.c
@@ -2205,7 +2205,7 @@ parse_key (IOBUF inp, int pkttype, unsigned long pktlen,
                 version, algorithm, timestamp, expiredate);
 
   pk->timestamp = timestamp;
-  pk->expiredate = expiredate;
+  kb_pk_invalidate_expiredate (pk);
   pk->max_expiredate = max_expiredate;
   pk->hdrbytes = hdrlen;
   pk->version = version;
diff --git a/g10/pubkey-enc.c b/g10/pubkey-enc.c
index bd257dc..1adea5f 100644
--- a/g10/pubkey-enc.c
+++ b/g10/pubkey-enc.c
@@ -372,10 +372,10 @@ get_it (PKT_pubkey_enc *enc, DEK *dek, PKT_public_key *sk, u32 *keyid)
           }
         if (!pk)
           BUG ();
-        if (pk->expiredate && pk->expiredate <= make_timestamp ())
+        if (kb_pk_expiredate (pk) && kb_pk_expiredate (pk) <= make_timestamp ())
           {
             log_info (_("Note: secret key %s expired at %s\n"),
-                      keystr (keyid), asctimestamp (pk->expiredate));
+                      keystr (keyid), asctimestamp (kb_pk_expiredate (pk)));
           }
       }
 
diff --git a/g10/sig-check.c b/g10/sig-check.c
index 4df29af..a735500 100644
--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -132,7 +132,7 @@ check_signature2 (PKT_signature *sig, gcry_md_hd_t digest, u32 *r_expiredate,
     else
       {
         if(r_expiredate)
-	  *r_expiredate = pk->expiredate;
+	  *r_expiredate = kb_pk_expiredate (pk);
 
 	rc = check_signature_end (pk, sig, digest, r_expired, r_revoked, NULL);
 
@@ -324,12 +324,12 @@ check_signature_metadata_validity (PKT_public_key *pk, PKT_signature *sig,
        flag which is set after a full evaluation of the key (getkey.c)
        as well as a simple compare to the current time in case the
        merge has for whatever reasons not been done.  */
-    if( pk->has_expired || (pk->expiredate && pk->expiredate < cur_time)) {
+    if( pk->has_expired || (kb_pk_expiredate (pk) && kb_pk_expiredate (pk) < cur_time)) {
         char buf[11];
         if (opt.verbose)
 	  log_info(_("Note: signature key %s expired %s\n"),
-		   keystr_from_pk(pk), asctimestamp( pk->expiredate ) );
-	sprintf(buf,"%lu",(ulong)pk->expiredate);
+		   keystr_from_pk(pk), asctimestamp(kb_pk_expiredate (pk)) );
+	sprintf(buf,"%lu",(ulong)kb_pk_expiredate (pk));
 	write_status_text(STATUS_KEYEXPIRED,buf);
 	if(r_expired)
 	  *r_expired = 1;
diff --git a/g10/trustdb.c b/g10/trustdb.c
index 3dfff9e..304d280 100644
--- a/g10/trustdb.c
+++ b/g10/trustdb.c
@@ -1829,9 +1829,9 @@ validate_key_list (KEYDB_HANDLE hd, KeyHashTable full_trust,
         {
 	  KBNODE node;
 
-          if (pk->expiredate && pk->expiredate >= curtime
-              && pk->expiredate < *next_expire)
-            *next_expire = pk->expiredate;
+          if (kb_pk_expiredate (pk) && kb_pk_expiredate (pk) >= curtime
+              && kb_pk_expiredate (pk) < *next_expire)
+            *next_expire = kb_pk_expiredate (pk);
 
           if (nkeys == maxkeys) {
             maxkeys += 1000;
@@ -2007,9 +2007,9 @@ validate_keys (ctrl_t ctrl, int interactive)
           if (node->pkt->pkttype == PKT_USER_ID)
 	    update_validity (pk, node->pkt->pkt.user_id, 0, TRUST_ULTIMATE);
         }
-      if ( pk->expiredate && pk->expiredate >= start_time
-           && pk->expiredate < next_expire)
-        next_expire = pk->expiredate;
+      if (kb_pk_expiredate (pk) && kb_pk_expiredate (pk) >= start_time
+           && kb_pk_expiredate (pk) < next_expire)
+        next_expire = kb_pk_expiredate (pk);
 
       release_kbnode (keyblock);
       do_sync ();

commit a1a64820c30a978a415021281dff4f8b9eb0afd2
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 2 13:11:42 2017 +0100

    g10: Use bitfield for flags of user ids.
    
    * g10/packet.h (is_{primary,revoked,expired}): Move to the flags
    bitfield.
    * g10/call-dirmngr.c: Update all uses using the following semantic
    patch.
    * g10/export.c: Likewise.
    * g10/getkey.c: Likewise.
    * g10/import.c: Likewise.
    * g10/kbnode.c: Likewise.
    * g10/keyedit.c: Likewise.
    * g10/keylist.c: Likewise.
    * g10/keyserver.c: Likewise.
    * g10/mainproc.c: Likewise.
    * g10/pkclist.c: Likewise.
    * g10/pubkey-enc.c: Likewise.
    * g10/tofu.c: Likewise.
    * g10/trust.c: Likewise.
    * g10/trustdb.c: Likewise.
    --
    
    I used Coccinelle and the following semantic patch to update the code:
    
        @@
        expression E;
        @@
        -E->is_expired
        +E->flags.expired
    
        @@
        expression E;
        @@
        -E->is_primary
        +E->flags.primary
    
        @@
        expression E;
        @@
        -E->is_revoked
        +E->flags.revoked
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/g10/call-dirmngr.c b/g10/call-dirmngr.c
index 4be9da1..12838b5 100644
--- a/g10/call-dirmngr.c
+++ b/g10/call-dirmngr.c
@@ -963,9 +963,9 @@ ks_put_inq_cb (void *opaque, const char *line)
 		    int i;
 
 		    i = 0;
-		    if (uid->is_revoked)
+		    if (uid->flags.revoked)
 		      validity[i ++] = 'r';
-		    if (uid->is_expired)
+		    if (uid->flags.expired)
 		      validity[i ++] = 'e';
 		    validity[i] = '\0';
 
diff --git a/g10/export.c b/g10/export.c
index ad42b41..cae4b1f 100644
--- a/g10/export.c
+++ b/g10/export.c
@@ -1417,7 +1417,7 @@ print_pka_or_dane_records (iobuf_t out, kbnode_t keyblock, PKT_public_key *pk,
         continue;
       uid = node->pkt->pkt.user_id;
 
-      if (uid->is_expired || uid->is_revoked)
+      if (uid->flags.expired || uid->flags.revoked)
         continue;
 
       xfree (mbox);
diff --git a/g10/getkey.c b/g10/getkey.c
index e39de28..ed0bf0e 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -274,7 +274,7 @@ get_primary_uid (KBNODE keyblock, size_t * uidlen)
     {
       if (k->pkt->pkttype == PKT_USER_ID
 	  && !k->pkt->pkt.user_id->attrib_data
-	  && k->pkt->pkt.user_id->is_primary)
+	  && k->pkt->pkt.user_id->flags.primary)
 	{
 	  *uidlen = k->pkt->pkt.user_id->len;
 	  return k->pkt->pkt.user_id->name;
@@ -970,7 +970,7 @@ skip_unusable (void *dummy, u32 * keyid, int uid_no)
 	      if (uids_seen != uid_no)
 		continue;
 
-	      if (user_id->is_revoked || user_id->is_expired)
+	      if (user_id->flags.revoked || user_id->flags.expired)
 		unusable = 1;
 
 	      break;
@@ -1494,7 +1494,7 @@ key_is_ok (const PKT_public_key *key)
 static int
 uid_is_ok (const PKT_public_key *key, const PKT_user_id *uid)
 {
-  return key_is_ok (key) && ! uid->is_revoked;
+  return key_is_ok (key) && ! uid->flags.revoked;
 }
 
 
@@ -2342,26 +2342,26 @@ fixup_uidnode (KBNODE uidnode, KBNODE signode, u32 keycreated)
   uid->created = 0;		/* Not created == invalid. */
   if (IS_UID_REV (sig))
     {
-      uid->is_revoked = 1;
+      uid->flags.revoked = 1;
       return; /* Has been revoked.  */
     }
   else
-    uid->is_revoked = 0;
+    uid->flags.revoked = 0;
 
   uid->expiredate = sig->expiredate;
 
   if (sig->flags.expired)
     {
-      uid->is_expired = 1;
+      uid->flags.expired = 1;
       return; /* Has expired.  */
     }
   else
-    uid->is_expired = 0;
+    uid->flags.expired = 0;
 
   uid->created = sig->timestamp; /* This one is okay. */
   uid->selfsigversion = sig->version;
   /* If we got this far, it's not expired :) */
-  uid->is_expired = 0;
+  uid->flags.expired = 0;
 
   /* Store the key flags in the helper variable for later processing.  */
   uid->help_key_usage = parse_key_usage (sig);
@@ -2375,10 +2375,10 @@ fixup_uidnode (KBNODE uidnode, KBNODE signode, u32 keycreated)
 
   /* Set the primary user ID flag - we will later wipe out some
    * of them to only have one in our keyblock.  */
-  uid->is_primary = 0;
+  uid->flags.primary = 0;
   p = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PRIMARY_UID, NULL);
   if (p && *p)
-    uid->is_primary = 2;
+    uid->flags.primary = 2;
 
   /* We could also query this from the unhashed area if it is not in
    * the hased area and then later try to decide which is the better
@@ -2912,7 +2912,7 @@ merge_selfsigs_main (KBNODE keyblock, int *r_revoked,
       if (k->pkt->pkttype == PKT_USER_ID && !k->pkt->pkt.user_id->attrib_data)
 	{
 	  PKT_user_id *uid = k->pkt->pkt.user_id;
-	  if (uid->is_primary)
+	  if (uid->flags.primary)
 	    {
 	      if (uid->created > uiddate)
 		{
@@ -2956,7 +2956,7 @@ merge_selfsigs_main (KBNODE keyblock, int *r_revoked,
 	    {
 	      PKT_user_id *uid = k->pkt->pkt.user_id;
 	      if (k != uidnode)
-		uid->is_primary = 0;
+		uid->flags.primary = 0;
 	    }
 	}
     }
@@ -2964,7 +2964,7 @@ merge_selfsigs_main (KBNODE keyblock, int *r_revoked,
     {
       /* None is flagged primary - use the latest user ID we have,
          and disambiguate with the arbitrary packet comparison. */
-      uidnode2->pkt->pkt.user_id->is_primary = 1;
+      uidnode2->pkt->pkt.user_id->flags.primary = 1;
     }
   else
     {
@@ -2983,7 +2983,7 @@ merge_selfsigs_main (KBNODE keyblock, int *r_revoked,
 	      if (!uidnode)
 		{
 		  uidnode = k;
-		  uidnode->pkt->pkt.user_id->is_primary = 1;
+		  uidnode->pkt->pkt.user_id->flags.primary = 1;
 		  continue;
 		}
 	      else
@@ -2991,12 +2991,12 @@ merge_selfsigs_main (KBNODE keyblock, int *r_revoked,
 		  if (cmp_user_ids (k->pkt->pkt.user_id,
 				    uidnode->pkt->pkt.user_id) > 0)
 		    {
-		      uidnode->pkt->pkt.user_id->is_primary = 0;
+		      uidnode->pkt->pkt.user_id->flags.primary = 0;
 		      uidnode = k;
-		      uidnode->pkt->pkt.user_id->is_primary = 1;
+		      uidnode->pkt->pkt.user_id->flags.primary = 1;
 		    }
 		  else
-		    k->pkt->pkt.user_id->is_primary = 0;	/* just to be
+		    k->pkt->pkt.user_id->flags.primary = 0;	/* just to be
 								   safe */
 		}
 	    }
@@ -3310,7 +3310,7 @@ merge_selfsigs (KBNODE keyblock)
     {
       if (k->pkt->pkttype == PKT_USER_ID
 	  && !k->pkt->pkt.user_id->attrib_data
-	  && k->pkt->pkt.user_id->is_primary)
+	  && k->pkt->pkt.user_id->flags.primary)
 	{
 	  prefs = k->pkt->pkt.user_id->prefs;
 	  mdc_feature = k->pkt->pkt.user_id->flags.mdc;
diff --git a/g10/import.c b/g10/import.c
index 1ed11bf..09d0867 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -1170,7 +1170,7 @@ impex_filter_getval (void *cookie, const char *propname)
           result = node->pkt->pkt.user_id->mbox;
         }
       else if (!strcmp (propname, "primary"))
-        result = node->pkt->pkt.user_id->is_primary? "1":"0";
+        result = node->pkt->pkt.user_id->flags.primary? "1":"0";
       else
         result = NULL;
     }
diff --git a/g10/kbnode.c b/g10/kbnode.c
index 6700dc0..ab038ba 100644
--- a/g10/kbnode.c
+++ b/g10/kbnode.c
@@ -392,10 +392,10 @@ dump_kbnode (KBNODE node)
           es_write_sanitized (log_get_stream (), uid->name, uid->len,
                               NULL, NULL);
           log_printf ("\" %c%c%c%c\n",
-                      uid->is_expired? 'e':'.',
-                      uid->is_revoked? 'r':'.',
+                      uid->flags.expired? 'e':'.',
+                      uid->flags.revoked? 'r':'.',
                       uid->created?    'v':'.',
-                      uid->is_primary? 'p':'.' );
+                      uid->flags.primary? 'p':'.' );
         }
       else if (node->pkt->pkttype == PKT_SIGNATURE)
         {
diff --git a/g10/keyedit.c b/g10/keyedit.c
index dadf586..88e2f4f 100644
--- a/g10/keyedit.c
+++ b/g10/keyedit.c
@@ -1164,7 +1164,7 @@ sign_uids (ctrl_t ctrl, estream_t fp,
                       uidnode->flag &= ~NODFLG_MARK_A;
                       uidnode = NULL;
                     }
-		  else if (uidnode->pkt->pkt.user_id->is_revoked)
+		  else if (uidnode->pkt->pkt.user_id->flags.revoked)
 		    {
 		      tty_fprintf (fp, _("User ID \"%s\" is revoked."), user);
 
@@ -1192,7 +1192,7 @@ sign_uids (ctrl_t ctrl, estream_t fp,
 			  tty_fprintf (fp, _("  Unable to sign.\n"));
 			}
 		    }
-		  else if (uidnode->pkt->pkt.user_id->is_expired)
+		  else if (uidnode->pkt->pkt.user_id->flags.expired)
 		    {
 		      tty_fprintf (fp, _("User ID \"%s\" is expired."), user);
 
@@ -3714,9 +3714,9 @@ show_key_with_all_names_colon (ctrl_t ctrl, estream_t fp, kbnode_t keyblock)
 	  else
 	    es_fputs ("uid:", fp);
 
-	  if (uid->is_revoked)
+	  if (uid->flags.revoked)
 	    es_fputs ("r::::::::", fp);
-	  else if (uid->is_expired)
+	  else if (uid->flags.expired)
 	    es_fputs ("e::::::::", fp);
 	  else if (opt.fast_list_mode || opt.no_expensive_trust_checks)
 	    es_fputs ("::::::::", fp);
@@ -3764,11 +3764,11 @@ show_key_with_all_names_colon (ctrl_t ctrl, estream_t fp, kbnode_t keyblock)
 	  es_putc (':', fp);
 	  /* flags */
 	  es_fprintf (fp, "%d,", i);
-	  if (uid->is_primary)
+	  if (uid->flags.primary)
 	    es_putc ('p', fp);
-	  if (uid->is_revoked)
+	  if (uid->flags.revoked)
 	    es_putc ('r', fp);
-	  if (uid->is_expired)
+	  if (uid->flags.expired)
 	    es_putc ('e', fp);
 	  if ((node->flag & NODFLG_SELUID))
 	    es_putc ('s', fp);
@@ -3814,7 +3814,7 @@ show_names (ctrl_t ctrl, estream_t fp,
 		tty_fprintf (fp, "     ");
 	      else if (node->flag & NODFLG_SELUID)
 		tty_fprintf (fp, "(%d)* ", i);
-	      else if (uid->is_primary)
+	      else if (uid->flags.primary)
 		tty_fprintf (fp, "(%d). ", i);
 	      else
 		tty_fprintf (fp, "(%d)  ", i);
@@ -4146,9 +4146,9 @@ show_basic_key_info (KBNODE keyblock)
 	  ++i;
 
 	  tty_printf ("     ");
-	  if (uid->is_revoked)
+	  if (uid->flags.revoked)
 	    tty_printf ("[%s] ", _("revoked"));
-	  else if (uid->is_expired)
+	  else if (uid->flags.expired)
 	    tty_printf ("[%s] ", _("expired"));
 	  tty_print_utf8_string (uid->name, uid->len);
 	  tty_printf ("\n");
@@ -4256,7 +4256,7 @@ no_primary_warning (KBNODE keyblock)
 	{
 	  uid_count++;
 
-	  if (node->pkt->pkt.user_id->is_primary == 2)
+	  if (node->pkt->pkt.user_id->flags.primary == 2)
 	    {
 	      have_primary = 1;
 	      break;
@@ -4457,7 +4457,7 @@ menu_deluid (KBNODE pub_keyblock)
 	    {
 	      /* Only cause a trust update if we delete a
 	         non-revoked user id */
-	      if (!node->pkt->pkt.user_id->is_revoked)
+	      if (!node->pkt->pkt.user_id->flags.revoked)
 		update_trust = 1;
 	      delete_kbnode (node);
 	    }
@@ -4577,9 +4577,9 @@ menu_clean (KBNODE keyblock, int self_only)
 	    {
 	      const char *reason;
 
-	      if (uidnode->pkt->pkt.user_id->is_revoked)
+	      if (uidnode->pkt->pkt.user_id->flags.revoked)
 		reason = _("revoked");
-	      else if (uidnode->pkt->pkt.user_id->is_expired)
+	      else if (uidnode->pkt->pkt.user_id->flags.expired)
 		reason = _("expired");
 	      else
 		reason = _("invalid");
@@ -6314,7 +6314,7 @@ reloop:			/* (must use this, because we are modifing the list) */
       /* Are we revoking our own uid? */
       if (primary_pk->keyid[0] == sig->keyid[0] &&
 	  primary_pk->keyid[1] == sig->keyid[1])
-	unode->pkt->pkt.user_id->is_revoked = 1;
+	unode->pkt->pkt.user_id->flags.revoked = 1;
       pkt = xmalloc_clear (sizeof *pkt);
       pkt->pkttype = PKT_SIGNATURE;
       pkt->pkt.signature = sig;
@@ -6348,7 +6348,7 @@ core_revuid (ctrl_t ctrl, kbnode_t keyblock, KBNODE node,
     {
       PKT_user_id *uid = node->pkt->pkt.user_id;
 
-      if (uid->is_revoked)
+      if (uid->flags.revoked)
         {
           char *user = utf8_to_native (uid->name, uid->len, 0);
           log_info (_("user ID \"%s\" is already revoked\n"), user);
@@ -6408,7 +6408,7 @@ core_revuid (ctrl_t ctrl, kbnode_t keyblock, KBNODE node,
                 update_trust = 1;
 #endif /*!NO_TRUST_MODELS*/
 
-              node->pkt->pkt.user_id->is_revoked = 1;
+              node->pkt->pkt.user_id->flags.revoked = 1;
               if (modified)
                 *modified = 1;
             }
diff --git a/g10/keylist.c b/g10/keylist.c
index a5fdc06..fe4ce22 100644
--- a/g10/keylist.c
+++ b/g10/keylist.c
@@ -852,9 +852,8 @@ dump_attribs (const PKT_user_id *uid, PKT_public_key *pk)
 		   (ulong) uid->attribs[i].len, uid->attribs[i].type, i + 1,
 		   uid->numattribs, (ulong) uid->created,
 		   (ulong) uid->expiredate,
-		   ((uid->is_primary ? 0x01 : 0) | (uid->
-						    is_revoked ? 0x02 : 0) |
-		    (uid->is_expired ? 0x04 : 0)));
+		   ((uid->flags.primary ? 0x01 : 0) | (uid->flags.revoked ? 0x02 : 0) |
+		    (uid->flags.expired ? 0x04 : 0)));
 	  write_status_text (STATUS_ATTRIBUTE, buf);
 	}
 
@@ -929,7 +928,7 @@ list_keyblock_print (ctrl_t ctrl, kbnode_t keyblock, int secret, int fpr,
           int indent;
           int kl = opt.keyid_format == KF_NONE? 10 : keystrlen ();
 
-	  if ((uid->is_expired || uid->is_revoked)
+	  if ((uid->flags.expired || uid->flags.revoked)
 	      && !(opt.list_options & LIST_SHOW_UNUSABLE_UIDS))
 	    {
 	      skip_sigs = 1;
@@ -941,7 +940,7 @@ list_keyblock_print (ctrl_t ctrl, kbnode_t keyblock, int secret, int fpr,
 	  if (attrib_fp && uid->attrib_data != NULL)
 	    dump_attribs (uid, pk);
 
-	  if ((uid->is_revoked || uid->is_expired)
+	  if ((uid->flags.revoked || uid->flags.expired)
 	      || ((opt.list_options & LIST_SHOW_UID_VALIDITY)
                   && !listctx->no_validity))
 	    {
@@ -1300,9 +1299,9 @@ list_keyblock_colon (ctrl_t ctrl, kbnode_t keyblock,
 	  if (attrib_fp && uid->attrib_data != NULL)
 	    dump_attribs (uid, pk);
 
-	  if (uid->is_revoked)
+	  if (uid->flags.revoked)
 	    uid_validity = 'r';
-	  else if (uid->is_expired)
+	  else if (uid->flags.expired)
 	    uid_validity = 'e';
 	  else if (opt.no_expensive_trust_checks)
 	    uid_validity = 0;
@@ -1559,7 +1558,7 @@ do_reorder_keyblock (KBNODE keyblock, int attr)
       if (node->pkt->pkttype == PKT_USER_ID &&
 	  ((attr && node->pkt->pkt.user_id->attrib_data) ||
 	   (!attr && !node->pkt->pkt.user_id->attrib_data)) &&
-	  node->pkt->pkt.user_id->is_primary)
+	  node->pkt->pkt.user_id->flags.primary)
 	{
 	  primary = primary2 = node;
 	  for (node = node->next; node; primary2 = node, node = node->next)
diff --git a/g10/keyserver.c b/g10/keyserver.c
index c7363c9..6c12643 100644
--- a/g10/keyserver.c
+++ b/g10/keyserver.c
@@ -1323,7 +1323,7 @@ keyidlist(strlist_t users,KEYDB_SEARCH_DESC **klist,int *count,int fakev3)
 	      for(node=node->next;node;node=node->next)
 		{
 		  if(node->pkt->pkttype==PKT_USER_ID
-		     && node->pkt->pkt.user_id->is_primary)
+		     && node->pkt->pkt.user_id->flags.primary)
 		    uid=node->pkt->pkt.user_id;
 		  else if(node->pkt->pkttype==PKT_SIGNATURE
 			  && node->pkt->pkt.signature->
diff --git a/g10/mainproc.c b/g10/mainproc.c
index ac2ab03..8e3974d 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -1960,11 +1960,11 @@ check_sig_and_print (CTX c, kbnode_t node)
             continue;
           if (!un->pkt->pkt.user_id->created)
             continue;
-          if (un->pkt->pkt.user_id->is_revoked)
+          if (un->pkt->pkt.user_id->flags.revoked)
             continue;
-          if (un->pkt->pkt.user_id->is_expired)
+          if (un->pkt->pkt.user_id->flags.expired)
             continue;
-          if (!un->pkt->pkt.user_id->is_primary)
+          if (!un->pkt->pkt.user_id->flags.primary)
             continue;
           /* We want the textual primary user ID here */
           if (un->pkt->pkt.user_id->attrib_data)
@@ -2041,12 +2041,12 @@ check_sig_and_print (CTX c, kbnode_t node)
             {
               if (un->pkt->pkttype != PKT_USER_ID)
                 continue;
-              if ((un->pkt->pkt.user_id->is_revoked
-                   || un->pkt->pkt.user_id->is_expired)
+              if ((un->pkt->pkt.user_id->flags.revoked
+                   || un->pkt->pkt.user_id->flags.expired)
                   && !(opt.verify_options & VERIFY_SHOW_UNUSABLE_UIDS))
                 continue;
               /* Skip textual primary user ids which we printed above. */
-              if (un->pkt->pkt.user_id->is_primary
+              if (un->pkt->pkt.user_id->flags.primary
                   && !un->pkt->pkt.user_id->attrib_data )
                 continue;
 
@@ -2071,9 +2071,9 @@ check_sig_and_print (CTX c, kbnode_t node)
                 {
                   const char *valid;
 
-                  if (un->pkt->pkt.user_id->is_revoked)
+                  if (un->pkt->pkt.user_id->flags.revoked)
                     valid = _("revoked");
-                  else if (un->pkt->pkt.user_id->is_expired)
+                  else if (un->pkt->pkt.user_id->flags.expired)
                     valid = _("expired");
                   else
 		    /* Since this is just informational, don't
diff --git a/g10/packet.h b/g10/packet.h
index 9780d93..71079c3 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -280,19 +280,19 @@ typedef struct
   u32 help_key_expire;
   int help_full_count;
   int help_marginal_count;
-  int is_primary;       /* 2 if set via the primary flag, 1 if calculated */
-  int is_revoked;
-  int is_expired;
   u32 expiredate;       /* expires at this date or 0 if not at all */
   prefitem_t *prefs;    /* list of preferences (may be NULL)*/
   u32 created;          /* according to the self-signature */
   byte selfsigversion;
   struct
   {
-    /* TODO: Move more flags here */
     unsigned int mdc:1;
     unsigned int ks_modify:1;
     unsigned int compacted:1;
+    unsigned int primary:2;	/* 2 if set via the primary flag, 1 if
+                                 * calculated */
+    unsigned int revoked:1;
+    unsigned int expired:1;
   } flags;
   char *mbox;   /* NULL or the result of mailbox_from_userid.  */
   /* The text contained in the user id packet, which is normally the
diff --git a/g10/pkclist.c b/g10/pkclist.c
index 288affc..4eb3628 100644
--- a/g10/pkclist.c
+++ b/g10/pkclist.c
@@ -235,12 +235,12 @@ do_edit_ownertrust (ctrl_t ctrl, PKT_public_key *pk, int mode,
 	      {
                 if (un->pkt->pkttype != PKT_USER_ID )
 		  continue;
-                if (un->pkt->pkt.user_id->is_revoked )
+                if (un->pkt->pkt.user_id->flags.revoked)
 		  continue;
-                if (un->pkt->pkt.user_id->is_expired )
+                if (un->pkt->pkt.user_id->flags.expired)
 		  continue;
 		/* Only skip textual primaries */
-                if (un->pkt->pkt.user_id->is_primary
+                if (un->pkt->pkt.user_id->flags.primary
 		    && !un->pkt->pkt.user_id->attrib_data )
 		  continue;
 
diff --git a/g10/pubkey-enc.c b/g10/pubkey-enc.c
index 117744f..bd257dc 100644
--- a/g10/pubkey-enc.c
+++ b/g10/pubkey-enc.c
@@ -54,7 +54,7 @@ is_algo_in_prefs (kbnode_t keyblock, preftype_t type, int algo)
           PKT_user_id *uid = k->pkt->pkt.user_id;
           prefitem_t *prefs = uid->prefs;
 
-          if (uid->created && prefs && !uid->is_revoked && !uid->is_expired)
+          if (uid->created && prefs && !uid->flags.revoked && !uid->flags.expired)
             {
               for (; prefs->type; prefs++)
                 if (prefs->type == type && prefs->value == algo)
diff --git a/g10/tofu.c b/g10/tofu.c
index 8d535fa..7934b9e 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -2209,9 +2209,9 @@ build_conflict_set (tofu_dbs_t dbs,
             {
               found_user_id = 1;
 
-              if (user_id2->is_revoked)
+              if (user_id2->flags.revoked)
                 iter->flags |= BINDING_REVOKED;
-              if (user_id2->is_expired)
+              if (user_id2->flags.expired)
                 iter->flags |= BINDING_EXPIRED;
             }
 
@@ -3470,7 +3470,7 @@ tofu_register_encryption (ctrl_t ctrl,
         {
 	  PKT_user_id *uid = n->pkt->pkt.user_id;
 
-          if (uid->is_revoked)
+          if (uid->flags.revoked)
             continue;
 
           add_to_strlist (&user_id_list, uid->name);
@@ -3805,7 +3805,7 @@ tofu_set_policy (ctrl_t ctrl, kbnode_t kb, enum tofu_policy policy)
 	continue;
 
       user_id = kb->pkt->pkt.user_id;
-      if (user_id->is_revoked)
+      if (user_id->flags.revoked)
 	/* Skip revoked user ids.  (Don't skip expired user ids, the
 	   expiry can be changed.)  */
 	continue;
diff --git a/g10/trust.c b/g10/trust.c
index 080926a..a6092a9 100644
--- a/g10/trust.c
+++ b/g10/trust.c
@@ -145,9 +145,9 @@ uid_trust_string_fixed (ctrl_t ctrl, PKT_public_key *key, PKT_user_id *uid)
          uid are both NULL, or neither are NULL. */
       return _("10 translator see trust.c:uid_trust_string_fixed");
     }
-  else if(uid->is_revoked || (key && key->flags.revoked))
+  else if(uid->flags.revoked || (key && key->flags.revoked))
     return                         _("[ revoked]");
-  else if(uid->is_expired)
+  else if(uid->flags.expired)
     return                         _("[ expired]");
   else if(key)
     {
@@ -688,7 +688,7 @@ clean_uid_from_key (kbnode_t keyblock, kbnode_t uidnode, int noisy)
      IDs if --allow-non-selfsigned-uid is set. */
   if (uid->created
       || uid->flags.compacted
-      || (!uid->is_expired && !uid->is_revoked && opt.allow_non_selfsigned_uid))
+      || (!uid->flags.expired && !uid->flags.revoked && opt.allow_non_selfsigned_uid))
     return 0;
 
   for (node=uidnode->next;
@@ -708,9 +708,9 @@ clean_uid_from_key (kbnode_t keyblock, kbnode_t uidnode, int noisy)
       const char *reason;
       char *user = utf8_to_native (uid->name, uid->len, 0);
 
-      if (uid->is_revoked)
+      if (uid->flags.revoked)
 	reason = _("revoked");
-      else if (uid->is_expired)
+      else if (uid->flags.expired)
 	reason = _("expired");
       else
 	reason = _("invalid");
diff --git a/g10/trustdb.c b/g10/trustdb.c
index d402cb2..3dfff9e 100644
--- a/g10/trustdb.c
+++ b/g10/trustdb.c
@@ -1099,14 +1099,14 @@ tdb_get_validity_core (ctrl_t ctrl,
             }
 
           /* If the user id is revoked or expired, then skip it.  */
-          if (user_id->is_revoked || user_id->is_expired)
+          if (user_id->flags.revoked || user_id->flags.expired)
             {
               if (DBG_TRUST)
                 {
                   char *s;
-                  if (user_id->is_revoked && user_id->is_expired)
+                  if (user_id->flags.revoked && user_id->flags.expired)
                     s = "revoked and expired";
-                  else if (user_id->is_revoked)
+                  else if (user_id->flags.revoked)
                     s = "revoked";
                   else
                     s = "expire";
@@ -1115,7 +1115,7 @@ tdb_get_validity_core (ctrl_t ctrl,
                              s, user_id->name);
                 }
 
-              if (user_id->is_revoked)
+              if (user_id->flags.revoked)
                 continue;
 
               expired = 1;
@@ -1604,8 +1604,8 @@ validate_one_keyblock (KBNODE kb, struct key_item *klist,
 	 resigned.  -dshaw */
 
       if (node->pkt->pkttype == PKT_USER_ID
-	  && !node->pkt->pkt.user_id->is_revoked
-	  && !node->pkt->pkt.user_id->is_expired)
+	  && !node->pkt->pkt.user_id->flags.revoked
+	  && !node->pkt->pkt.user_id->flags.expired)
         {
           if (uidnode && issigned)
             {

-----------------------------------------------------------------------


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan  3 12:48:41 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 03 Jan 2017 12:48:41 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-30-g9695124
Message-ID: <E1cONa9-0007sZ-67@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  969512401603639e4467ede7d892f1b02582c2c9 (commit)
       via  0004d52ba2f1245c84f95a151342ad99fd72ca3d (commit)
      from  a1e0d4a1e75fc6e6c3392a4e1d1d27005b38d6cc (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 969512401603639e4467ede7d892f1b02582c2c9
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 3 12:03:28 2017 +0100

    dirmngr: Make sure Tor mode is also set for DNS on SIGHUP.
    
    * dirmngr/dns-stuff.c (enable_dns_tormode): Always succeed.
    (reload_dns_stuff): Reset tor port.
    * dirmngr/dirmngr.c (set_tor_mode): Also enable Tor mode for DNS.
    (main): Remove warning that Tor mode may not fully work.
    * dirmngr/server.c (cmd_dns_cert): Remove explicit Tor for DNS
    initialization.
    * dirmngr/t-dns-stuff.c (main): Remove option --new-circuit and error
    checking for enable_dns_tormode.
    --
    
    This patch also resets the port on SIGHUP so that after starting Tor
    SIGHUP is sufficient to use Tor.  Without the SIGHUP and when not
    using the Tor browser Dirmngr would keep on trying the Tor browser
    port.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 5ee589e..f50e935 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -481,6 +481,9 @@ set_tor_mode (void)
 {
   if (opt.use_tor)
     {
+      /* Enable Tor mode and when called again force a new curcuit
+       * (e.g. on SIGHUP).  */
+      enable_dns_tormode (1);
       if (assuan_sock_set_flag (ASSUAN_INVALID_FD, "tor-mode", 1))
         {
           log_error ("error enabling Tor mode: %s\n", strerror (errno));
@@ -919,13 +922,6 @@ main (int argc, char **argv)
   log_info ("NOTE: this is a development version!\n");
 #endif
 
-  if (opt.use_tor)
-    {
-      log_info ("WARNING: ***************************************\n");
-      log_info ("WARNING: Tor mode (--use-tor) MAY NOT FULLY WORK!\n");
-      log_info ("WARNING: ***************************************\n");
-    }
-
   /* Print a warning if an argument looks like an option.  */
   if (!opt.quiet && !(pargs.flags & ARGPARSE_FLAG_STOP_SEEN))
     {
diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index cf8cefb..e32e1e3 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -199,9 +199,9 @@ recursive_resolver_p (void)
 }
 
 
-/* Sets the module in Tor mode.  Returns 0 is this is possible or an
-   error code.  */
-gpg_error_t
+/* Puts this module eternally into Tor mode.  When called agained with
+ * NEW_CIRCUIT request a new TOR circuit for the next DNS query.  */
+void
 enable_dns_tormode (int new_circuit)
 {
   if (!*tor_socks_user || new_circuit)
@@ -215,7 +215,6 @@ enable_dns_tormode (int new_circuit)
       counter++;
     }
   tor_mode = 1;
-  return 0;
 }
 
 
@@ -548,7 +547,10 @@ reload_dns_stuff (int force)
       libdns_reinit_pending = 0;
     }
   else
-    libdns_reinit_pending = 1;
+    {
+      libdns_reinit_pending = 1;
+      libdns_tor_port = 0;  /* Start again with the default port.  */
+    }
 #else
   (void)force;
 #endif
diff --git a/dirmngr/dns-stuff.h b/dirmngr/dns-stuff.h
index 0a4a4de..eb7fe72 100644
--- a/dirmngr/dns-stuff.h
+++ b/dirmngr/dns-stuff.h
@@ -113,9 +113,9 @@ void enable_recursive_resolver (int yes);
 /* Return true iff the recursive resolver is used.  */
 int recursive_resolver_p (void);
 
-/* Calling this function switches the DNS code into Tor mode if
-   possibe.  Return 0 on success.  */
-gpg_error_t enable_dns_tormode (int new_circuit);
+/* Put this module eternally into Tor mode.  When called agained with
+ * NEW_CIRCUIT request a new TOR circuit for the next DNS query.  */
+void enable_dns_tormode (int new_circuit);
 
 /* Change the default IP address of the nameserver to IPADDR.  The
    address needs to be a numerical IP address and will be used for the
diff --git a/dirmngr/server.c b/dirmngr/server.c
index a785238..28c2cd4 100644
--- a/dirmngr/server.c
+++ b/dirmngr/server.c
@@ -709,13 +709,6 @@ cmd_dns_cert (assuan_context_t ctx, char *line)
         }
     }
 
-  if (opt.use_tor && (err = enable_dns_tormode (0)))
-    {
-      /* Tor mode is requested but the DNS code can't enable it.  */
-      assuan_set_error (ctx, err, "error enabling Tor mode");
-      goto leave;
-    }
-
   if (pka_mode || dane_mode)
     {
       char *domain;     /* Points to mbox.  */
diff --git a/dirmngr/t-dns-stuff.c b/dirmngr/t-dns-stuff.c
index b087b5e..bc4ca9a 100644
--- a/dirmngr/t-dns-stuff.c
+++ b/dirmngr/t-dns-stuff.c
@@ -51,7 +51,6 @@ main (int argc, char **argv)
   gpg_error_t err;
   int any_options = 0;
   int opt_tor = 0;
-  int opt_new_circuit = 0;
   int opt_cert = 0;
   int opt_srv = 0;
   int opt_bracket = 0;
@@ -103,11 +102,6 @@ main (int argc, char **argv)
           opt_tor = 1;
           argc--; argv++;
         }
-      else if (!strcmp (*argv, "--new-circuit"))
-        {
-          opt_new_circuit = 1;
-          argc--; argv++;
-        }
       else if (!strcmp (*argv, "--standard-resolver"))
         {
           enable_standard_resolver (1);
@@ -171,15 +165,7 @@ main (int argc, char **argv)
   init_sockets ();
 
   if (opt_tor)
-    {
-      err = enable_dns_tormode (opt_new_circuit);
-      if (err)
-        {
-          fprintf (stderr, "error switching into Tor mode: %s\n",
-                   gpg_strerror (err));
-          exit (1);
-        }
-    }
+    enable_dns_tormode (0);
 
   if (opt_cert)
     {

commit 0004d52ba2f1245c84f95a151342ad99fd72ca3d
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 2 15:47:24 2017 +0100

    dirmngr: New debug message on correctly initialized libdns.
    
    * dirmngr/dns-stuff.c (libdns_init): Add debug level diagnostic on
    success.
    --
    
    This output may help to avoid questions when evaluating an Assuan log.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index f2e1df9..cf8cefb 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -507,6 +507,9 @@ libdns_init (void)
   /* All fine.  Make the data global.  */
   libdns = ld;
 
+  if (opt_debug)
+    log_debug ("dns: libdns initialized%s\n", tor_mode?" (tor mode)":"");
+
  leave:
   xfree (cfgstr);
   return err;
@@ -595,7 +598,7 @@ libdns_res_open (struct dns_resolver **r_res)
 
 
 #ifdef USE_LIBDNS
-/* Helper to test whether we need totry again after having swicthed
+/* Helper to test whether we need to try again after having switched
  * the Tor port.  */
 static int
 libdns_switch_port_p (gpg_error_t err)

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dirmngr.c     | 10 +++-------
 dirmngr/dns-stuff.c   | 17 +++++++++++------
 dirmngr/dns-stuff.h   |  6 +++---
 dirmngr/server.c      |  7 -------
 dirmngr/t-dns-stuff.c | 16 +---------------
 5 files changed, 18 insertions(+), 38 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan  3 13:14:40 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 03 Jan 2017 13:14:40 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-31-g293a55b
Message-ID: <E1cONzH-0000ST-08@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  293a55bacdacec4501af3a396b14fd32e404e39e (commit)
      from  969512401603639e4467ede7d892f1b02582c2c9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 293a55bacdacec4501af3a396b14fd32e404e39e
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 3 13:12:25 2017 +0100

    doc: Extend dirmngr's --allow-version-check description
    
    --

diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
index e136dff..fc617d8 100644
--- a/doc/dirmngr.texi
+++ b/doc/dirmngr.texi
@@ -264,7 +264,13 @@ the list of current software versions.  If this option is enabled, or
 if @option{use-tor} is active, the list is retrieved when the local
 copy does not exist or is older than 5 to 7 days.  See the option
 @option{--query-swdb} of the command @command{gpgconf} for more
-details.
+details.  Note, that regardless of this option a version check can
+always be triggered using this command:
+
+ at example
+       gpg-connect-agent --dirmngr 'loadswdb --force' /bye
+ at end example
+
 
 @item --keyserver @var{name}
 @opindex keyserver

-----------------------------------------------------------------------

Summary of changes:
 doc/dirmngr.texi | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan  3 15:34:54 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 03 Jan 2017 15:34:54 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-21-gb14419f
Message-ID: <E1cOQAy-0008Hd-DR@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  b14419f68b3aaa90025e0e97151de7c3da7806fb (commit)
       via  d0e91d28f63b74e53673902e675be8a54b6b90d3 (commit)
      from  ececfd5de81f1851943be7b284b672d5b02aceb4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b14419f68b3aaa90025e0e97151de7c3da7806fb
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 3 15:27:49 2017 +0100

    python: Improve compatibility with Scheme tests.
    
    * lang/python/tests/run-tests.py: Add stub --parallel option.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/lang/python/tests/run-tests.py b/lang/python/tests/run-tests.py
index 3f9ece3..46c6d8c 100644
--- a/lang/python/tests/run-tests.py
+++ b/lang/python/tests/run-tests.py
@@ -51,6 +51,8 @@ parser.add_argument('--srcdir', type=str,
 parser.add_argument('--builddir', type=str,
                     default=os.environ.get("abs_builddir", ""),
                     help='Location of the tests.')
+parser.add_argument('--parallel', action="store_true", default=False,
+                    help='Ignored.  For compatibility with run-tests.scm.')
 
 args = parser.parse_args()
 if not args.interpreters:

commit d0e91d28f63b74e53673902e675be8a54b6b90d3
Author: Justus Winter <justus at g10code.com>
Date:   Wed Nov 30 10:39:25 2016 +0100

    python: Add a switch '--quiet' to the test runner.
    
    * lang/python/tests/run-tests.py: Add and honor a switch '--quiet'.
    This way we can use this script to run Python tests one by one without
    the noise, and the script will setup the necessary environment for us.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/lang/python/tests/run-tests.py b/lang/python/tests/run-tests.py
index 55d3f11..3f9ece3 100644
--- a/lang/python/tests/run-tests.py
+++ b/lang/python/tests/run-tests.py
@@ -39,6 +39,8 @@ parser.add_argument('tests', metavar='TEST', type=str, nargs='+',
                     help='A test to run')
 parser.add_argument('-v', '--verbose', action="store_true", default=False,
                     help='Be verbose.')
+parser.add_argument('-q', '--quiet', action="store_true", default=False,
+                    help='Be quiet.')
 parser.add_argument('--interpreters', metavar='PYTHON', type=str,
                     default=[], action=SplitAndAccumulate,
                     help='Use these interpreters to run the tests, ' +
@@ -72,12 +74,15 @@ for interpreter in args.interpreters:
     env = dict(os.environ)
     env["PYTHONPATH"] = builddirs[0]
 
-    print("Running tests using {0} ({1})...".format(interpreter, version))
+    if not args.quiet:
+        print("Running tests using {0} ({1})...".format(interpreter, version))
+
     for test in args.tests:
         status = subprocess.call(
             [interpreter, os.path.join(args.srcdir, test)],
             env=env, stdout=out, stderr=err)
-        print("{0}: {1}".format(status_to_str(status), test))
+        if not args.quiet:
+            print("{0}: {1}".format(status_to_str(status), test))
         results.append(status)
 
 def count(status):
@@ -85,6 +90,8 @@ def count(status):
 def failed():
     return len(list(filter(lambda x: x not in (0, 77, 99), results)))
 
-print("{0} tests run, {1} succeeded, {2} failed, {3} skipped.".format(
-    len(results), count(0), failed(), count(77)))
-sys.exit(len(results) - count(0))
+if not args.quiet:
+    print("{0} tests run, {1} succeeded, {2} failed, {3} skipped.".format(
+        len(results), count(0), failed(), count(77)))
+    sys.exit(len(results) - count(0))
+sys.exit(results[0])

-----------------------------------------------------------------------

Summary of changes:
 lang/python/tests/run-tests.py | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan  3 15:59:46 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Tue, 03 Jan 2017 15:59:46 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-233-g0dc7cc2
Message-ID: <E1cOQZ2-0000rt-Kx@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  0dc7cc2ebf78a61a739b2aca76e9fd7b6e0a5a3a (commit)
      from  3029cf63dcb05d57b8c77c759cbb7f4469bef567 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0dc7cc2ebf78a61a739b2aca76e9fd7b6e0a5a3a
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Tue Jan 3 15:59:21 2017 +0100

    Fix encrypt icon name in EXTRA_DIST
    
    * src/icons/Makefile.am (EXTRA_DIST): Fix encrypt name.

diff --git a/src/icons/Makefile.am b/src/icons/Makefile.am
index 914742a..a727d0e 100644
--- a/src/icons/Makefile.am
+++ b/src/icons/Makefile.am
@@ -23,7 +23,7 @@ EXTRA_DIST= \
     encrypt-sign-file-48.png \
     sign-48.png verify-48.png \
     README.icons\
-    sign.svg sign-enc.svg enc.svg \
+    sign.svg sign-enc.svg encrypt.svg \
     sign-enc-40.png sign-20.png encrypt-20.png \
     level-0.svg level-0-enc.svg level-0.png level-0-enc.png \
     level-1.svg level-1-enc.svg level-1.png level-1-enc.png \

-----------------------------------------------------------------------

Summary of changes:
 src/icons/Makefile.am | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan  3 16:38:11 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 03 Jan 2017 16:38:11 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.26-5-g704c319
Message-ID: <E1cORAD-0002hw-V6@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  704c31992e8716bbe61e6d5751e125a64badeef0 (commit)
       via  80ec003f328ee8180a63585d196a8d40e6045b39 (commit)
      from  8d844f6c23f6ca2192248f8d7eb7bf52b645b25b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 704c31992e8716bbe61e6d5751e125a64badeef0
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 3 16:12:16 2017 +0100

    Fix macro GPGRT_GCC_VERSION
    
    * src/gpg-error.h.in (GPGRT_GCC_VERSION): Fix.
    --
    
    Fixes-commit: 4e790613f66efcfc62d73722d5f1730a37cb8324
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index b19fd11..572385f 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 Noteworthy changes in version 1.27 (unreleased) [C2_/A2_/R_]
 -----------------------------------------------
 
+ * Fixed macro GPGRT_GCC_VERSION.
+
 
 Noteworthy changes in version 1.26 (2016-12-21) [C21/A21/R0]
 -----------------------------------------------
diff --git a/src/gpg-error.h.in b/src/gpg-error.h.in
index 06c2f9c..c603314 100644
--- a/src/gpg-error.h.in
+++ b/src/gpg-error.h.in
@@ -155,7 +155,7 @@ typedef unsigned int gpg_error_t;
 # define _GPG_ERR_CONSTRUCTOR
 #endif
 
-#define GPGRT_GCC_VERSION  _GCC_ERR_GCC_VERSION
+#define GPGRT_GCC_VERSION  _GPG_ERR_GCC_VERSION
 
 #if _GPG_ERR_GCC_VERSION >= 29200
 # define _GPGRT__RESTRICT __restrict__

commit 80ec003f328ee8180a63585d196a8d40e6045b39
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 3 16:32:12 2017 +0100

    Fix last merge.
    
    --

diff --git a/NEWS b/NEWS
index 21637bc..b19fd11 100644
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,8 @@
-Noteworthy changes in version 1.26 (unreleased) [C20/A20/R_]
+Noteworthy changes in version 1.27 (unreleased) [C2_/A2_/R_]
+-----------------------------------------------
+
+
+Noteworthy changes in version 1.26 (2016-12-21) [C21/A21/R0]
 -----------------------------------------------
 
  * New option --desc for gpg-error.
diff --git a/configure.ac b/configure.ac
index e3ca56e..6d4f173 100644
--- a/configure.ac
+++ b/configure.ac
@@ -27,7 +27,7 @@ min_automake_version="1.14"
 # another commit, and a push so that the git magic is able to work.
 # See below for the LT versions.
 m4_define([mym4_version_major], [1])
-m4_define([mym4_version_minor], [26])
+m4_define([mym4_version_minor], [27])
 
 # Below is m4 magic to extract and compute the revision number, the
 # decimalized short revision number, a beta version string, and a flag

-----------------------------------------------------------------------

Summary of changes:
 NEWS               | 8 +++++++-
 configure.ac       | 2 +-
 src/gpg-error.h.in | 2 +-
 3 files changed, 9 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan  3 16:39:05 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 03 Jan 2017 16:39:05 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-49-g98b4969
Message-ID: <E1cORB5-0002iy-Po@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  98b49695b1ffe3c406ae39a45051b8594f903b9d (commit)
       via  3582641469f1c74078f0d758c4d5458cc0ee5649 (commit)
      from  0996d5f1c34a3d3012facd098a139d8abbde085f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 98b49695b1ffe3c406ae39a45051b8594f903b9d
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 3 16:30:54 2017 +0100

    Extend GCRYCTL_PRINT_CONFIG to print compiler version.
    
    * src/global.c (print_config): Print version of libgpg-error and used
    compiler.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index ef882b7..179b18d 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,11 @@ Noteworthy changes in version 1.8.0 (unreleased)  [C21/A1/R_]
 
    - GCRYCTL_REINIT_SYSCALL_CLAMP allows to init nPth after Libgcrypt.
 
+ * Extended interfaces:
+
+   - GCRYCTL_PRINT_CONFIG does now also print build information for
+     libgpg-error and the used compiler version.
+
  * Internal changes:
 
    - Libgpg-error 1.25 is now required.  This avoids stalling of nPth
diff --git a/src/global.c b/src/global.c
index cfb7618..25815dd 100644
--- a/src/global.c
+++ b/src/global.c
@@ -279,7 +279,25 @@ print_config ( int (*fnc)(FILE *fp, const char *format, ...), FILE *fp)
   int i;
   const char *s;
 
-  fnc (fp, "version:%s:\n", VERSION);
+  fnc (fp, "version:%s:%x:%s:%x:\n",
+       VERSION, GCRYPT_VERSION_NUMBER,
+       GPGRT_VERSION, GPGRT_VERSION_NUMBER);
+  fnc (fp, "cc:%d:%s:\n",
+#if GPGRT_VERSION_NUMBER >= 0x011b00 /* 1.27 */
+       GPGRT_GCC_VERSION
+#else
+       _GPG_ERR_GCC_VERSION /* Due to a bug in gpg-error.h.  */
+#endif
+       ,
+#ifdef __clang__
+       "clang:" __VERSION__
+#elif __GNUC__
+       "gcc:" __VERSION__
+#else
+       ":"
+#endif
+       );
+
   fnc (fp, "ciphers:%s:\n", LIBGCRYPT_CIPHERS);
   fnc (fp, "pubkeys:%s:\n", LIBGCRYPT_PUBKEY_CIPHERS);
   fnc (fp, "digests:%s:\n", LIBGCRYPT_DIGESTS);

commit 3582641469f1c74078f0d758c4d5458cc0ee5649
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 3 15:34:33 2017 +0100

    tests: Add option --disable-hwf to the version utility.
    
    * src/hwfeatures.c (_gcry_disable_hw_feature): Rewrite to allow
    passing a colon delimited feature set.
    (parse_hwf_deny_file): Remove unused var I.
    * tests/version.c (main): Add options --verbose and --disable-hwf.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/gcrypt.texi b/doc/gcrypt.texi
index cb539da..47ac19e 100644
--- a/doc/gcrypt.texi
+++ b/doc/gcrypt.texi
@@ -906,10 +906,14 @@ success or an error code on failure.
 Libgcrypt detects certain features of the CPU at startup time.  For
 performance tests it is sometimes required not to use such a feature.
 This option may be used to disable a certain feature; i.e. Libgcrypt
-behaves as if this feature has not been detected.  Note that the
-detection code might be run if the feature has been disabled.  This
-command must be used at initialization time; i.e. before calling
- at code{gcry_check_version}.
+behaves as if this feature has not been detected.  This call can be
+used several times to disable a set of features, or features may be
+given as a colon or comma delimited string.  The special feature
+"all" can be used to disable all available features.
+
+Note that the detection code might be run if the feature has been
+disabled.  This command must be used at initialization time;
+i.e. before calling @code{gcry_check_version}.
 
 @item GCRYCTL_REINIT_SYSCALL_CLAMP; Arguments: none
 
diff --git a/src/hwfeatures.c b/src/hwfeatures.c
index 99aba34..82f8bf2 100644
--- a/src/hwfeatures.c
+++ b/src/hwfeatures.c
@@ -82,20 +82,34 @@ gpg_err_code_t
 _gcry_disable_hw_feature (const char *name)
 {
   int i;
+  size_t n1, n2;
 
-  if (!strcmp(name, "all"))
+  while (name && *name)
     {
-      disabled_hw_features = ~0;
-      return 0;
+      n1 = strcspn (name, ":,");
+      if (!n1)
+        ;
+      else if (n1 == 3 && !strncmp (name, "all", 3))
+        disabled_hw_features = ~0;
+      else
+        {
+          for (i=0; i < DIM (hwflist); i++)
+            {
+              n2 = strlen (hwflist[i].desc);
+              if (n1 == n2 && !strncmp (hwflist[i].desc, name, n2))
+                {
+                  disabled_hw_features |= hwflist[i].flag;
+                  break;
+                }
+            }
+          if (!(i < DIM (hwflist)))
+            return GPG_ERR_INV_NAME;
+        }
+      name += n1;
+      if (*name)
+        name++; /* Skip delimiter ':' or ','.  */
     }
-
-  for (i=0; i < DIM (hwflist); i++)
-    if (!strcmp (hwflist[i].desc, name))
-      {
-        disabled_hw_features |= hwflist[i].flag;
-        return 0;
-      }
-  return GPG_ERR_INV_NAME;
+  return 0;
 }
 
 
@@ -131,7 +145,7 @@ parse_hwf_deny_file (void)
   FILE *fp;
   char buffer[256];
   char *p, *pend;
-  int i, lnr = 0;
+  int lnr = 0;
 
   fp = fopen (fname, "r");
   if (!fp)
diff --git a/tests/version.c b/tests/version.c
index f22c305..baf984e 100644
--- a/tests/version.c
+++ b/tests/version.c
@@ -42,8 +42,47 @@
 int
 main (int argc, char **argv)
 {
-  (void)argc;
-  (void)argv;
+  int last_argc = -1;
+
+  if (argc)
+    { argc--; argv++; }
+
+  while (argc && last_argc != argc )
+    {
+      last_argc = argc;
+      if (!strcmp (*argv, "--"))
+        {
+          argc--; argv++;
+          break;
+        }
+      else if (!strcmp (*argv, "--verbose"))
+        {
+          verbose++;
+          argc--; argv++;
+        }
+      else if (!strcmp (*argv, "--debug"))
+        {
+          /* Dummy option */
+          argc--; argv++;
+        }
+      else if (!strcmp (*argv, "--disable-hwf"))
+        {
+          argc--;
+          argv++;
+          if (argc)
+            {
+              if (gcry_control (GCRYCTL_DISABLE_HWF, *argv, NULL))
+                fprintf (stderr,
+                        PGM
+                        ": unknown hardware feature '%s' - option ignored\n",
+                        *argv);
+              argc--;
+              argv++;
+            }
+        }
+    }
+
+  xgcry_control (GCRYCTL_SET_VERBOSITY, (int)verbose);
 
   xgcry_control (GCRYCTL_DISABLE_SECMEM, 0);
   if (strcmp (GCRYPT_VERSION, gcry_check_version (NULL)))

-----------------------------------------------------------------------

Summary of changes:
 NEWS             |  5 +++++
 doc/gcrypt.texi  | 12 ++++++++----
 src/global.c     | 20 +++++++++++++++++++-
 src/hwfeatures.c | 38 ++++++++++++++++++++++++++------------
 tests/version.c  | 43 +++++++++++++++++++++++++++++++++++++++++--
 5 files changed, 99 insertions(+), 19 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan  4 11:20:22 2017
From: cvs at cvs.gnupg.org (by Jussi Kivilinna)
Date: Wed, 04 Jan 2017 11:20:22 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-50-gaada604
Message-ID: <E1cOigD-0006kA-2T@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  aada604594fd42224d366d3cb98f67fd3b989cd6 (commit)
      from  98b49695b1ffe3c406ae39a45051b8594f903b9d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit aada604594fd42224d366d3cb98f67fd3b989cd6
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Wed Jan 4 12:02:36 2017 +0200

    rijndael-ssse3: fix counter operand from read-only to read/write
    
    * cipher/rijndael-ssse3-amd64.c (_gcry_aes_ssse3_ctr_enc): Change
    'ctrlow' operand from read-only to read-write.
    --
    
    With read-only operand, compiler is allowed to pass temporary
    register to assembly block and throw away any calculation that
    have been done on that register. On the other hand, compiler is
    also allowed to keep operand value permanently in one register
    as value is treated as read-only, and effectly operates as
    expected. Selection between these two depends on compiler
    version and used flags.
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/rijndael-ssse3-amd64.c b/cipher/rijndael-ssse3-amd64.c
index a8e89d4..2adb73f 100644
--- a/cipher/rijndael-ssse3-amd64.c
+++ b/cipher/rijndael-ssse3-amd64.c
@@ -387,8 +387,8 @@ _gcry_aes_ssse3_ctr_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
                     ".Lno_carry%=:\n\t"
 
                     "pshufb %%xmm6, %%xmm7\n\t"
-                    :
-                    : [ctr] "r" (ctr), [ctrlow] "r" (ctrlow)
+                    : [ctrlow] "+r" (ctrlow)
+                    : [ctr] "r" (ctr)
                     : "cc", "memory");
 
       do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);

-----------------------------------------------------------------------

Summary of changes:
 cipher/rijndael-ssse3-amd64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan  4 17:20:03 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 04 Jan 2017 17:20:03 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-32-g28e1496
Message-ID: <E1cOoII-0006A5-78@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  28e149609da44fab600f6a11b385d1c8ca8e7eb9 (commit)
      from  293a55bacdacec4501af3a396b14fd32e404e39e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 28e149609da44fab600f6a11b385d1c8ca8e7eb9
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 4 16:54:41 2017 +0100

    tests,w32: Fix locating the components.
    
    * tests/openpgp/defs.scm (percent-decode): New function.
    (bin-prefix): New variable.
    (installed?): Likewise.
    (tool-hardcoded): Use the new variables.
    (gpg-conf): Use the new function to decode the values.
    (gpg-components): Do not use '--build-prefix' when 'installed?'.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/defs.scm b/tests/openpgp/defs.scm
index 3280d7c..863d128 100644
--- a/tests/openpgp/defs.scm
+++ b/tests/openpgp/defs.scm
@@ -81,6 +81,21 @@
 	default
 	value)))
 
+(define (percent-decode s)
+  (define (decode c)
+    (if (and (> (length c) 2) (char=? #\% (car c)))
+	(integer->char (string->number (string #\# #\x (cadr c) (caddr c))))
+	#f))
+  (let loop ((i 0) (c (string->list s)) (r (make-string (string-length s))))
+    (if (null? c)
+	(substring r 0 i)
+	(let ((decoded (decode c)))
+	  (string-set! r i (if decoded decoded (car c)))
+	  (loop (+ 1 i) (if decoded (cdddr c) (cdr c)) r)))))
+(assert (equal? (percent-decode "") ""))
+(assert (equal? (percent-decode "%61") "a"))
+(assert (equal? (percent-decode "foob%61r") "foobar"))
+
 (define tools
   '((gpgv "GPGV" "g10/gpgv")
     (gpg-connect-agent "GPG_CONNECT_AGENT" "tools/gpg-connect-agent")
@@ -91,25 +106,30 @@
     (gpg-zip "GPGZIP" "tools/gpg-zip")
     (pinentry "PINENTRY" "tests/openpgp/fake-pinentry")))
 
+(define bin-prefix (getenv "BIN_PREFIX"))
+(define installed? (not (string=? "" bin-prefix)))
+
 (define (tool-hardcoded which)
-  (let ((t (assoc which tools))
-	(prefix (getenv "BIN_PREFIX")))
+  (let ((t (assoc which tools)))
     (getenv' (cadr t)
-	     (qualify (if (string=? prefix "")
-			  (string-append (getenv "objdir") "/" (caddr t))
-			  (string-append prefix "/" (basename (caddr t))))))))
+	     (qualify (if installed?
+			  (string-append bin-prefix "/" (basename (caddr t)))
+			  (string-append (getenv "objdir") "/" (caddr t)))))))
 
 (define (gpg-conf . args)
   (let ((s (call-popen `(,(tool-hardcoded 'gpgconf) , at args) "")))
-    (map (lambda (line) (string-split line #\:))
+    (map (lambda (line) (map percent-decode (string-split line #\:)))
 	 (string-split-newlines s))))
 (define :gc:c:name car)
 (define :gc:c:description cadr)
 (define :gc:c:pgmname caddr)
 
-(setenv "GNUPG_BUILDDIR" (getenv "objdir") #t)
-(define gpg-components (gpg-conf '--build-prefix (getenv "objdir")
-				 '--list-components))
+(unless installed?
+	(setenv "GNUPG_BUILDDIR" (getenv "objdir") #t))
+(define gpg-components (apply gpg-conf
+			`(,@(if installed? '()
+				(list '--build-prefix (getenv "objdir")))
+			  --list-components)))
 
 (define (tool which)
   (case which

-----------------------------------------------------------------------

Summary of changes:
 tests/openpgp/defs.scm | 38 +++++++++++++++++++++++++++++---------
 1 file changed, 29 insertions(+), 9 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan  4 18:40:34 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 04 Jan 2017 18:40:34 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-33-g588121c
Message-ID: <E1cOpYC-0000rw-TB@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  588121c158384b05099388097053d8d1e8bdf143 (commit)
      from  28e149609da44fab600f6a11b385d1c8ca8e7eb9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 588121c158384b05099388097053d8d1e8bdf143
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 4 18:37:36 2017 +0100

    doc: Add release announcement pointers to NEWS entries.
    
    --
    
    These are used by the website buider to link to the announcement
    mails.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index 79bbbbc..da0f0f7 100644
--- a/NEWS
+++ b/NEWS
@@ -37,6 +37,8 @@ Noteworthy changes in version 2.1.17 (2016-12-20)
  * Major improvements to the test suite.  For example it is possible
    to run the external test suite of GPGME.
 
+ See-also: gnupg-announce/2016q4/000400.html
+
 
 Noteworthy changes in version 2.1.16 (2016-11-18)
 -------------------------------------------------
@@ -109,6 +111,8 @@ Noteworthy changes in version 2.1.16 (2016-11-18)
 
  * Many changes and improvements for the test suite.
 
+ See-also: gnupg-announce/2016q4/000398.html
+
 
 Noteworthy changes in version 2.1.15 (2016-08-18)
 -------------------------------------------------
@@ -160,6 +164,8 @@ Noteworthy changes in version 2.1.15 (2016-08-18)
 
  * Spelling and grammar fixes.
 
+ See-also: gnupg-announce/2016q3/000396.html
+
 
 Noteworthy changes in version 2.1.14 (2016-07-14)
 -------------------------------------------------
@@ -218,6 +224,8 @@ Noteworthy changes in version 2.1.14 (2016-07-14)
 
  * The rendering of the man pages has been improved.
 
+ See-also: gnupg-announce/2016q3/000393.html
+
 
 Noteworthy changes in version 2.1.13 (2016-06-16)
 -------------------------------------------------
@@ -268,6 +276,8 @@ Noteworthy changes in version 2.1.13 (2016-06-16)
 
  * Speedup fd closing after a fork.
 
+ See-also: gnupg-announce/2016q2/000390.html
+
 
 Noteworthy changes in version 2.1.12 (2016-05-04)
 -------------------------------------------------
@@ -321,6 +331,8 @@ Noteworthy changes in version 2.1.12 (2016-05-04)
 
  * Lots of internal cleanups and bug fixes.
 
+ See-also: gnupg-announce/2016q2/000387.html
+
 
 Noteworthy changes in version 2.1.11 (2016-01-26)
 -------------------------------------------------
@@ -372,6 +384,8 @@ Noteworthy changes in version 2.1.11 (2016-01-26)
  * Print a warning if a GnuPG component is using an older version of
    gpg-agent, dirmngr, or scdaemon.
 
+ See-also: gnupg-announce/2016q1/000383.html
+
 
 Noteworthy changes in version 2.1.10 (2015-12-04)
 -------------------------------------------------
@@ -430,6 +444,8 @@ Noteworthy changes in version 2.1.10 (2015-12-04)
 
  * Many other cleanups and bug fixes.
 
+ See-also: gnupg-announce/2015q4/000381.html
+
 
 Noteworthy changes in version 2.1.9 (2015-10-09)
 ------------------------------------------------
@@ -460,6 +476,8 @@ Noteworthy changes in version 2.1.9 (2015-10-09)
  * dirmngr: Add option --keyserver.  Deprecate that option for gpg.
    Install a dirmngr.conf file from a skeleton for new installations.
 
+ See-also: gnupg-announce/2015q4/000380.html
+
 
 Noteworthy changes in version 2.1.8 (2015-09-10)
 ------------------------------------------------
@@ -487,6 +505,8 @@ Noteworthy changes in version 2.1.8 (2015-09-10)
 
  * Various minor bug fixes.
 
+ See-also: gnupg-announce/2015q3/000379.html
+
 
 Noteworthy changes in version 2.1.7 (2015-08-11)
 ------------------------------------------------
@@ -512,6 +532,8 @@ Noteworthy changes in version 2.1.7 (2015-08-11)
 
  * Various other bug fixes.
 
+ See-also: gnupg-announce/2015q3/000371.html
+
 
 Noteworthy changes in version 2.1.6 (2015-07-01)
 ------------------------------------------------
@@ -542,6 +564,8 @@ Noteworthy changes in version 2.1.6 (2015-07-01)
 
  * Various other bug fixes.
 
+ See-also: gnupg-announce/2015q3/000370.html
+
 
 Noteworthy changes in version 2.1.5 (2015-06-11)
 ------------------------------------------------
@@ -556,6 +580,8 @@ Noteworthy changes in version 2.1.5 (2015-06-11)
 
  * Code cleanups and minor bug fixes.
 
+ See-also: gnupg-announce/2015q2/000369.html
+
 
 Noteworthy changes in version 2.1.4 (2015-05-12)
 ------------------------------------------------
@@ -581,6 +607,8 @@ Noteworthy changes in version 2.1.4 (2015-05-12)
 
  * Fixed lots of smaller bugs.
 
+ See-also: gnupg-announce/2015q2/000366.html
+
 
 Noteworthy changes in version 2.1.3 (2015-04-11)
 ------------------------------------------------
@@ -618,6 +646,8 @@ Noteworthy changes in version 2.1.3 (2015-04-11)
  * Fixed possible problems due to compiler optimization, two minor
    regressions, and other bugs.
 
+ See-also: gnupg-announce/2015q2/000365.html
+
 
 Noteworthy changes in version 2.1.2 (2015-02-11)
 ------------------------------------------------
@@ -652,6 +682,8 @@ Noteworthy changes in version 2.1.2 (2015-02-11)
  * Fixed several bugs related to bogus keyrings and improved some
    other code.
 
+ See-also: gnupg-announce/2015q1/000361.html
+
 
 Noteworthy changes in version 2.1.1 (2014-12-16)
 ------------------------------------------------
@@ -704,6 +736,8 @@ Noteworthy changes in version 2.1.1 (2014-12-16)
 
  * Improved portability and the usual bunch of bug fixes.
 
+ See-also: gnupg-announce/2014q4/000360.html
+
 
 Noteworthy changes in version 2.1.0 (2014-11-06)
 ------------------------------------------------
@@ -1021,6 +1055,8 @@ Noteworthy changes in version 2.1.0 (2014-11-06)
  * Numerical values may now be used as an alternative to the
    debug-level keywords.
 
+ See-also: gnupg-announce/2014q4/000358.html
+
 
 Version 2.0.28 (2015-06-02)
 Version 2.0.27 (2015-02-18)
@@ -1064,6 +1100,8 @@ Noteworthy changes in version 2.0.13 (2009-09-04)
 
  * Minor bug fixes.
 
+ See-also: gnupg-announce/2009q3/000294.html
+
 
 Noteworthy changes in version 2.0.12 (2009-06-17)
 -------------------------------------------------
@@ -1091,6 +1129,8 @@ Noteworthy changes in version 2.0.12 (2009-06-17)
 
  * Changed code to avoid a possible Mac OS X system freeze.
 
+ See-also: gnupg-announce/2009q2/000288.html
+
 
 Noteworthy changes in version 2.0.11 (2009-03-03)
 -------------------------------------------------
@@ -1107,6 +1147,8 @@ Noteworthy changes in version 2.0.11 (2009-03-03)
    due to interoperability problems with Outlook 2003 which still
    can't cope with AES.
 
+ See-also: gnupg-announce/2009q1/000287.html
+
 
 Noteworthy changes in version 2.0.10 (2009-01-12)
 -------------------------------------------------
@@ -1162,6 +1204,8 @@ Noteworthy changes in version 2.0.10 (2009-01-12)
 
  * Libgcrypt 1.4 is now required.
 
+ See-also: gnupg-announce/2009q1/000284.html
+
 
 Noteworthy changes in version 2.0.9 (2008-03-26)
 ------------------------------------------------
@@ -1185,6 +1229,7 @@ Noteworthy changes in version 2.0.9 (2008-03-26)
  * Minor bug fixes.
 
 
+
 Noteworthy changes in version 2.0.8 (2007-12-20)
 ------------------------------------------------
 
@@ -1218,6 +1263,8 @@ Noteworthy changes in version 2.0.8 (2007-12-20)
    taken into account.  This required a change of our socket emulation
    code and changed the IPC protocol under Windows.
 
+ See-also: gnupg-announce/2007q4/000267.html
+
 
 Noteworthy changes in version 2.0.7 (2007-09-10)
 ------------------------------------------------
@@ -1236,6 +1283,8 @@ Noteworthy changes in version 2.0.7 (2007-09-10)
    installed versions of the programs and does not anymore search via
    PATH for them.
 
+ See-also: gnupg-announce/2007q3/000259.html
+
 
 Noteworthy changes in version 2.0.6 (2007-08-16)
 ------------------------------------------------
@@ -1251,6 +1300,8 @@ Noteworthy changes in version 2.0.6 (2007-08-16)
 
  * Improved Windows support.
 
+ See-also: gnupg-announce/2007q3/000258.html
+
 
 Noteworthy changes in version 2.0.5 (2007-07-05)
 ------------------------------------------------
@@ -1268,6 +1319,8 @@ Noteworthy changes in version 2.0.5 (2007-07-05)
  * Changed key generation to reveal less information about the
    machine.  Bug fixes for gpg2's card key generation.
 
+ See-also: gnupg-announce/2007q3/000255.html
+
 
 Noteworthy changes in version 2.0.4 (2007-05-09)
 ------------------------------------------------
@@ -1280,6 +1333,8 @@ Noteworthy changes in version 2.0.4 (2007-05-09)
 
  * Improved the libgcrypt logging support in all modules.
 
+ See-also: gnupg-announce/2007q2/000254.html
+
 
 Noteworthy changes in version 2.0.3 (2007-03-08)
 ------------------------------------------------
@@ -1300,6 +1355,8 @@ Noteworthy changes in version 2.0.3 (2007-03-08)
  * The PIN pad of the Cherry XX44 keyboard is now supported.  The
    DINSIG and the NKS applications are now also aware of PIN pads.
 
+ See-also: gnupg-announce/2007q1/000252.html
+
 
 Noteworthy changes in version 2.0.2 (2007-01-31)
 ------------------------------------------------
@@ -1318,6 +1375,8 @@ Noteworthy changes in version 2.0.2 (2007-01-31)
 
  * The status code BEGIN_SIGNING now shows the used hash algorithms.
 
+ See-also: gnupg-announce/2007q1/000249.html
+
 
 Noteworthy changes in version 2.0.1 (2006-11-28)
 ------------------------------------------------
@@ -1331,12 +1390,16 @@ Noteworthy changes in version 2.0.1 (2006-11-28)
 
  * Fixed a buffer overflow in gpg2. [bug#728,CVE-2006-6169]
 
+ See-also: gnupg-announce/2006q4/000242.html
+
 
 Noteworthy changes in version 2.0.0 (2006-11-11)
 ------------------------------------------------
 
  * First stable version of a GnuPG integrating OpenPGP and S/MIME.
 
+ See-also: gnupg-announce/2006q4/000239.html
+
 
 Noteworthy changes in version 1.9.95 (2006-11-06)
 -------------------------------------------------
@@ -1377,6 +1440,8 @@ Noteworthy changes in version 1.9.92 (2006-10-11)
 
  * Bug fixes.
 
+ See-also: gnupg-announce/2006q4/000236.html
+
 
 Noteworthy changes in version 1.9.91 (2006-10-04)
 -------------------------------------------------
@@ -1878,6 +1943,8 @@ Noteworthy changes in version 1.3.2 (2003-05-27)
       of GnuPG and other OpenPGP programs, please do not use this
       algorithm.
 
+    See-also: gnupg-announce/2003q2/000153.html
+
 
 Noteworthy changes in version 1.3.1 (2002-11-12)
 ------------------------------------------------
@@ -2204,6 +2271,8 @@ Noteworthy changes in version 1.0.7 (2002-04-29)
 
     * Read only keyrings are now handled as expected.
 
+    See-also: gnupg-announce/2002q2/000135.html
+
 
 Noteworthy changes in version 1.0.6 (2001-05-29)
 ------------------------------------------------
@@ -2222,6 +2291,8 @@ Noteworthy changes in version 1.0.6 (2001-05-29)
 
     * non-writable keyrings are now correctly handled.
 
+    See-also: gnupg-announce/2001q2/000123.html
+
 
 Noteworthy changes in version 1.0.5 (2001-04-29)
 ------------------------------------------------
@@ -2280,6 +2351,8 @@ Noteworthy changes in version 1.0.5 (2001-04-29)
 
     * New translations: Estonian, Turkish.
 
+    See-also: gnupg-announce/2001q2/000122.html
+
 
 Noteworthy changes in version 1.0.4 (2000-10-17)
 ------------------------------------------------
@@ -2295,6 +2368,9 @@ Noteworthy changes in version 1.0.4 (2000-10-17)
 
     * --with-colons now works with --print-md[s].
 
+    See-also: gnupg-announce/2000q4/000082.html
+
+
 Noteworthy changes in version 1.0.3 (2000-09-18)
 ------------------------------------------------
 
@@ -2326,6 +2402,8 @@ Noteworthy changes in version 1.0.3 (2000-09-18)
       this.  Older versions of GnuPG don't support it, so they should be
       upgraded to at least 1.0.2
 
+    See-also: gnupg-announce/2000q3/000075.html
+
 
 Noteworthy changes in version 1.0.2 (2000-07-12)
 ----------------------------------------------
@@ -2384,6 +2462,9 @@ Noteworthy changes in version 1.0.2 (2000-07-12)
 
     * Danish translation
 
+    See-also: gnupg-announce/2000q3/000069.html
+
+
 Noteworthy changes in version 1.0.1 (1999-12-16)
 -----------------------------------
 
@@ -2415,6 +2496,8 @@ Noteworthy changes in version 1.0.1 (1999-12-16)
     * Removed the GNU Privacy Handbook from the distribution as it will go
       into a separate one.
 
+    See-also: gnupg-announce/1999q4/000050.html
+
 
 Noteworthy changes in version 1.0.0 (1999-09-07)
 -----------------------------------
@@ -2424,6 +2507,8 @@ Noteworthy changes in version 1.0.0 (1999-09-07)
 
     * Changed the version number to GnuPG 2001 ;-)
 
+    See-also: gnupg-announce/1999q3/000037.html
+
 
 Noteworthy changes in version 0.9.11 (1999-09-03)
 ------------------------------------
@@ -2435,6 +2520,8 @@ Noteworthy changes in version 0.9.11 (1999-09-03)
 
     * Fixed a problem when importing new subkeys (duplicated signatures).
 
+    See-also: gnupg-announce/1999q3/000036.html
+
 
 Noteworthy changes in version 0.9.10 (1999-07-23)
 ------------------------------------
@@ -2443,6 +2530,8 @@ Noteworthy changes in version 0.9.10 (1999-07-23)
 
     * Cleaned up the dox a bit.
 
+    See-also: gnupg-announce/1999q3/000034.html
+
 
 Noteworthy changes in version 0.9.9
 -----------------------------------
@@ -2470,6 +2559,8 @@ Noteworthy changes in version 0.9.9
     * New option --allow-non-selfsigned-uid to work around a problem with
       the German IN way of separating signing and encryption keys.
 
+    See-also: gnupg-announce/1999q3/000028.html
+
 
 Noteworthy changes in version 0.9.8 (1999-06-26)
 -----------------------------------
@@ -2491,6 +2582,8 @@ Noteworthy changes in version 0.9.8 (1999-06-26)
 
     * Better support for HPUX.
 
+    See-also: gnupg-announce/1999q2/000016.html
+
 
 Noteworthy changes in version 0.9.7 (1999-05-23)
 -----------------------------------
@@ -2500,6 +2593,8 @@ Noteworthy changes in version 0.9.7 (1999-05-23)
 
     * Enhanced some status outputs.
 
+    See-also: gnupg-announce/1999q2/000000.html
+
 
 Noteworthy changes in version 0.9.6 (1999-05-06)
 -----------------------------------
@@ -2816,7 +2911,7 @@ Noteworthy changes in version 0.3.3 (1998-08-08)
 	   a copy of the old program.
 	2. Disable the network, make sure that you are the only
 	   user, be sure that there are no Trojan horses etc ....
-	3. Use your old gpg (version 0.3.[12]) and set the
+	3. Use your old gpg (version 0.3.1 or 0.3.2) and set the
 	   passphrases of ALL your secret keys to empty!
 	   (gpg --change-passphrase your-user-id).
 	4. Save your ownertrusts (see the next point)
@@ -2829,7 +2924,7 @@ Noteworthy changes in version 0.3.3 (1998-08-08)
 
     * The format of the trust database has changed; you must delete
       the old one, so gnupg can create a new one.
-      IMPORTANT: Use version 0.3.[12] to save your assigned ownertrusts
+      IMPORTANT: Use version 0.3.1 or .2 to save your assigned ownertrusts
       ("gpgm --list-ownertrust >saved-trust"); then build this new version
       and restore the ownertrust with this new version
       ("gpgm --import-ownertrust saved-trust").  Please note that

-----------------------------------------------------------------------

Summary of changes:
 NEWS | 99 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 97 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan  4 19:18:51 2017
From: cvs at cvs.gnupg.org (by Daniel Kahn Gillmor)
Date: Wed, 04 Jan 2017 19:18:51 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-34-g38671cf
Message-ID: <E1cOq9G-00038G-Ai@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  38671cfe5a2a40bb991619f4cb992c42b5f1e8cd (commit)
      from  588121c158384b05099388097053d8d1e8bdf143 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 38671cfe5a2a40bb991619f4cb992c42b5f1e8cd
Author: Daniel Kahn Gillmor <dkg at fifthhorseman.net>
Date:   Wed Jan 4 08:31:06 2017 -0500

    g10: avoid warning when --disable-tofu
    
    If configured with --disable-tofu, we see compiler warnings about an
    unused variable.  This should remove those warnings.

diff --git a/g10/trustdb.c b/g10/trustdb.c
index d402cb2..c113b7e 100644
--- a/g10/trustdb.c
+++ b/g10/trustdb.c
@@ -1002,9 +1002,9 @@ tdb_get_validity_core (ctrl_t ctrl,
   ulong recno;
 #ifdef USE_TOFU
   unsigned int tofu_validity = TRUST_UNKNOWN;
+  int free_kb = 0;
 #endif
   unsigned int validity = TRUST_UNKNOWN;
-  int free_kb = 0;
 
   if (kb && pk)
     log_assert (keyid_cmp (pk_main_keyid (pk),

-----------------------------------------------------------------------

Summary of changes:
 g10/trustdb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan  5 09:31:33 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 05 Jan 2017 09:31:33 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. f505be91d601062afeb7f7f6ebdb68562931f8d2
Message-ID: <E1cP3SR-0006XQ-Eq@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  f505be91d601062afeb7f7f6ebdb68562931f8d2 (commit)
      from  81d5fd92c46fb1e42a4cf5718985f55b9ec3644e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f505be91d601062afeb7f7f6ebdb68562931f8d2
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 5 09:29:23 2017 +0100

    web: Use level-2 headers for the release notes

diff --git a/tools/news-file-to-org.awk b/tools/news-file-to-org.awk
index 062b6fa..4384ce5 100644
--- a/tools/news-file-to-org.awk
+++ b/tools/news-file-to-org.awk
@@ -36,10 +36,10 @@ BEGIN {
     ml_base_url = "https://lists.gnupg.org/pipermail/"
 
     header_text["en"] = ""                      \
-        "** GnuPG\n" ;
+        "* GnuPG\n" ;
 
     header_text["de"] = ""                      \
-        "** GnuPG\n" ;
+        "* GnuPG\n" ;
 
     release_text["en"] = "released ";
     release_text["de"] = "ver?ffentlicht ";
@@ -55,16 +55,16 @@ BEGIN {
 
 function flush() {
     if (in_section) {
-        printf "*** GnuPG "
+        printf "** GnuPG "
         if (seealso)
             printf "[[%s%s][%s]]", ml_base_url, seealso, hdr_version
         else
             printf "%s", hdr_version
         printf " %s (%s)\n", release_text[lang], hdr_reldate;
         printf ""                                             \
-            "    :PROPERTIES:\n"                              \
-        "    :CUSTOM_ID: gnupg-%s\n"                      \
-        "    :END:\n\n",
+            "   :PROPERTIES:\n"                              \
+        "   :CUSTOM_ID: gnupg-%s\n"                      \
+        "   :END:\n\n",
             hdr_version;
         print lines;
     }
@@ -95,9 +95,9 @@ in_section && $0 ~ /^(Noteworthy|Version| Copyright)/ {
         sub (/^.*\(/, "");
         sub (/\).*$/, "");
         reldate = $0;
-        print "*** GnuPG " version " " release_text[lang] " (" reldate ")";
-        printf "    :PROPERTIES:\n    :CUSTOM_ID: gnupg-%s\n", version;
-        print "    :END:\n"
+        print "** GnuPG " version " " release_text[lang] " (" reldate ")";
+        printf "   :PROPERTIES:\n   :CUSTOM_ID: gnupg-%s\n", version;
+        print "   :END:\n"
 }
     next;
 }
diff --git a/web/download/release_notes.org b/web/download/release_notes.org
index 258f0b9..3a9efb4 100644
--- a/web/download/release_notes.org
+++ b/web/download/release_notes.org
@@ -5,16 +5,17 @@
 #+GPGWEB-NEED-SWDB
 #+macro: announce  [[https://lists.gnupg.org/pipermail/gnupg-announce/$1.html][Announcement]]
 
-* Release Notes
+* Release Notes for GnuPG
 
-  Please read the NEWS file for a more complete list. {{{gnupg_ver}}}
+  Please read the NEWS file for a more complete list. {{{gnupg21_ver}}}
   is the stable and modern version of GnuPG. (Version {{{gnupg1_ver}}}
   is from the old GnuPG-1 series, which is useful to decrypt PGP-2
   encrypted data.)
 
-** GnuPG-2
+  Note that this page will soon be restructed.  The URLs pointing to
+  specific releases will thus also change.
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000400.html][2.1.17]] released  (2016-12-20)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000400.html][2.1.17]] released  (2016-12-20)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.17
     :END:
@@ -54,7 +55,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000398.html][2.1.16]] released  (2016-11-18)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000398.html][2.1.16]] released  (2016-11-18)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.16
     :END:
@@ -130,7 +131,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000396.html][2.1.15]] released  (2016-08-18)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000396.html][2.1.15]] released  (2016-08-18)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.15
     :END:
@@ -185,7 +186,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000393.html][2.1.14]] released  (2016-07-14)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000393.html][2.1.14]] released  (2016-07-14)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.14
     :END:
@@ -247,7 +248,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q2/000390.html][2.1.13]] released  (2016-06-16)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q2/000390.html][2.1.13]] released  (2016-06-16)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.13
     :END:
@@ -301,7 +302,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q2/000387.html][2.1.12]] released  (2016-05-04)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q2/000387.html][2.1.12]] released  (2016-05-04)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.12
     :END:
@@ -358,7 +359,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000383.html][2.1.11]] released  (2016-01-26)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q1/000383.html][2.1.11]] released  (2016-01-26)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.11
     :END:
@@ -413,7 +414,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q4/000381.html][2.1.10]] released  (2015-12-04)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q4/000381.html][2.1.10]] released  (2015-12-04)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.10
     :END:
@@ -475,7 +476,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q4/000380.html][2.1.9]] released  (2015-10-09)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q4/000380.html][2.1.9]] released  (2015-10-09)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.9
     :END:
@@ -509,7 +510,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q3/000379.html][2.1.8]] released  (2015-09-10)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q3/000379.html][2.1.8]] released  (2015-09-10)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.8
     :END:
@@ -540,7 +541,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q3/000371.html][2.1.7]] released  (2015-08-11)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q3/000371.html][2.1.7]] released  (2015-08-11)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.7
     :END:
@@ -569,7 +570,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q3/000370.html][2.1.6]] released  (2015-07-01)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q3/000370.html][2.1.6]] released  (2015-07-01)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.6
     :END:
@@ -603,7 +604,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q2/000369.html][2.1.5]] released  (2015-06-11)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q2/000369.html][2.1.5]] released  (2015-06-11)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.5
     :END:
@@ -621,7 +622,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q2/000366.html][2.1.4]] released  (2015-05-12)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q2/000366.html][2.1.4]] released  (2015-05-12)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.4
     :END:
@@ -650,7 +651,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q2/000365.html][2.1.3]] released  (2015-04-11)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q2/000365.html][2.1.3]] released  (2015-04-11)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.3
     :END:
@@ -691,7 +692,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000361.html][2.1.2]] released  (2015-02-11)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2015q1/000361.html][2.1.2]] released  (2015-02-11)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.2
     :END:
@@ -729,7 +730,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000360.html][2.1.1]] released  (2014-12-16)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000360.html][2.1.1]] released  (2014-12-16)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.1
     :END:
@@ -785,7 +786,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000358.html][2.1.0]] released  (2014-11-06)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2014q4/000358.html][2.1.0]] released  (2014-11-06)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.1.0
     :END:
@@ -1098,82 +1099,82 @@
 
 
 
-*** GnuPG 2.0.28 released  (2015-06-02)
+** GnuPG 2.0.28 released  (2015-06-02)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.28
     :END:
 
-*** GnuPG 2.0.27 released  (2015-02-18)
+** GnuPG 2.0.27 released  (2015-02-18)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.27
     :END:
 
-*** GnuPG 2.0.26 released  (2014-08-12)
+** GnuPG 2.0.26 released  (2014-08-12)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.26
     :END:
 
-*** GnuPG 2.0.25 released  (2014-06-30)
+** GnuPG 2.0.25 released  (2014-06-30)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.25
     :END:
 
-*** GnuPG 2.0.24 released  (2014-06-24)
+** GnuPG 2.0.24 released  (2014-06-24)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.24
     :END:
 
-*** GnuPG 2.0.23 released  (2014-06-03)
+** GnuPG 2.0.23 released  (2014-06-03)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.23
     :END:
 
-*** GnuPG 2.0.22 released  (2013-10-04)
+** GnuPG 2.0.22 released  (2013-10-04)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.22
     :END:
 
-*** GnuPG 2.0.21 released  (2013-08-19)
+** GnuPG 2.0.21 released  (2013-08-19)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.21
     :END:
 
-*** GnuPG 2.0.20 released  (2013-05-10)
+** GnuPG 2.0.20 released  (2013-05-10)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.20
     :END:
 
-*** GnuPG 2.0.19 released  (2012-03-27)
+** GnuPG 2.0.19 released  (2012-03-27)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.19
     :END:
 
-*** GnuPG 2.0.18 released  (2011-08-04)
+** GnuPG 2.0.18 released  (2011-08-04)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.18
     :END:
 
-*** GnuPG 2.0.17 released  (2011-01-13)
+** GnuPG 2.0.17 released  (2011-01-13)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.17
     :END:
 
-*** GnuPG 2.0.16 released  (2010-07-19)
+** GnuPG 2.0.16 released  (2010-07-19)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.16
     :END:
 
-*** GnuPG 2.0.15 released  (2010-03-09)
+** GnuPG 2.0.15 released  (2010-03-09)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.15
     :END:
 
-*** GnuPG 2.0.14 released  (2009-12-21)
+** GnuPG 2.0.14 released  (2009-12-21)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.14
     :END:
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2009q3/000294.html][2.0.13]] released  (2009-09-04)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2009q3/000294.html][2.0.13]] released  (2009-09-04)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.13
     :END:
@@ -1203,7 +1204,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2009q2/000288.html][2.0.12]] released  (2009-06-17)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2009q2/000288.html][2.0.12]] released  (2009-06-17)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.12
     :END:
@@ -1234,7 +1235,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2009q1/000287.html][2.0.11]] released  (2009-03-03)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2009q1/000287.html][2.0.11]] released  (2009-03-03)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.11
     :END:
@@ -1254,7 +1255,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2009q1/000284.html][2.0.10]] released  (2009-01-12)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2009q1/000284.html][2.0.10]] released  (2009-01-12)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.10
     :END:
@@ -1313,7 +1314,7 @@
 
 
 
-*** GnuPG 2.0.9 released  (2008-03-26)
+** GnuPG 2.0.9 released  (2008-03-26)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.9
     :END:
@@ -1339,7 +1340,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q4/000267.html][2.0.8]] released  (2007-12-20)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q4/000267.html][2.0.8]] released  (2007-12-20)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.8
     :END:
@@ -1377,7 +1378,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q3/000259.html][2.0.7]] released  (2007-09-10)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q3/000259.html][2.0.7]] released  (2007-09-10)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.7
     :END:
@@ -1399,7 +1400,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q3/000258.html][2.0.6]] released  (2007-08-16)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q3/000258.html][2.0.6]] released  (2007-08-16)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.6
     :END:
@@ -1418,7 +1419,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q3/000255.html][2.0.5]] released  (2007-07-05)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q3/000255.html][2.0.5]] released  (2007-07-05)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.5
     :END:
@@ -1439,7 +1440,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q2/000254.html][2.0.4]] released  (2007-05-09)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q2/000254.html][2.0.4]] released  (2007-05-09)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.4
     :END:
@@ -1455,7 +1456,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q1/000252.html][2.0.3]] released  (2007-03-08)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q1/000252.html][2.0.3]] released  (2007-03-08)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.3
     :END:
@@ -1479,7 +1480,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q1/000249.html][2.0.2]] released  (2007-01-31)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2007q1/000249.html][2.0.2]] released  (2007-01-31)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.2
     :END:
@@ -1501,7 +1502,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000242.html][2.0.1]] released  (2006-11-28)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000242.html][2.0.1]] released  (2006-11-28)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.1
     :END:
@@ -1518,7 +1519,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000239.html][2.0.0]] released  (2006-11-11)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000239.html][2.0.0]] released  (2006-11-11)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-2.0.0
     :END:
@@ -1528,7 +1529,7 @@
 
 
 
-*** GnuPG 1.9.95 released  (2006-11-06)
+** GnuPG 1.9.95 released  (2006-11-06)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.95
     :END:
@@ -1537,7 +1538,7 @@
 
 
 
-*** GnuPG 1.9.94 released  (2006-10-24)
+** GnuPG 1.9.94 released  (2006-10-24)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.94
     :END:
@@ -1552,7 +1553,7 @@
 
 
 
-*** GnuPG 1.9.93 released  (2006-10-18)
+** GnuPG 1.9.93 released  (2006-10-18)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.93
     :END:
@@ -1571,7 +1572,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000236.html][1.9.92]] released  (2006-10-11)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000236.html][1.9.92]] released  (2006-10-11)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.92
     :END:
@@ -1581,7 +1582,7 @@
 
 
 
-*** GnuPG 1.9.91 released  (2006-10-04)
+** GnuPG 1.9.91 released  (2006-10-04)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.91
     :END:
@@ -1596,7 +1597,7 @@
 
 
 
-*** GnuPG 1.9.90 released  (2006-09-25)
+** GnuPG 1.9.90 released  (2006-09-25)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.90
     :END:
@@ -1609,7 +1610,7 @@
 
 
 
-*** GnuPG 1.9.23 released  (2006-09-18)
+** GnuPG 1.9.23 released  (2006-09-18)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.23
     :END:
@@ -1647,7 +1648,7 @@
 
 
 
-*** GnuPG 1.9.22 released  (2006-07-27)
+** GnuPG 1.9.22 released  (2006-07-27)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.22
     :END:
@@ -1661,7 +1662,7 @@
 
 
 
-*** GnuPG 1.9.21 released  (2006-06-20)
+** GnuPG 1.9.21 released  (2006-06-20)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.21
     :END:
@@ -1685,7 +1686,7 @@
 
 
 
-*** GnuPG 1.9.20 released  (2005-12-20)
+** GnuPG 1.9.20 released  (2005-12-20)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.20
     :END:
@@ -1699,7 +1700,7 @@
 
 
 
-*** GnuPG 1.9.19 released  (2005-09-12)
+** GnuPG 1.9.19 released  (2005-09-12)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.19
     :END:
@@ -1712,7 +1713,7 @@
 
 
 
-*** GnuPG 1.9.18 released  (2005-08-01)
+** GnuPG 1.9.18 released  (2005-08-01)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.18
     :END:
@@ -1725,7 +1726,7 @@
 
 
 
-*** GnuPG 1.9.17 released  (2005-06-20)
+** GnuPG 1.9.17 released  (2005-06-20)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.17
     :END:
@@ -1750,7 +1751,7 @@
 
 
 
-*** GnuPG 1.9.16 released  (2005-04-21)
+** GnuPG 1.9.16 released  (2005-04-21)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.16
     :END:
@@ -1767,7 +1768,7 @@
 
 
 
-*** GnuPG 1.9.15 released  (2005-01-13)
+** GnuPG 1.9.15 released  (2005-01-13)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.15
     :END:
@@ -1779,7 +1780,7 @@
 
 
 
-*** GnuPG 1.9.14 released  (2004-12-22)
+** GnuPG 1.9.14 released  (2004-12-22)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.14
     :END:
@@ -1794,7 +1795,7 @@
 
 
 
-*** GnuPG 1.9.13 released  (2004-12-03)
+** GnuPG 1.9.13 released  (2004-12-03)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.13
     :END:
@@ -1805,7 +1806,7 @@
 
 
 
-*** GnuPG 1.9.12 released  (2004-10-22)
+** GnuPG 1.9.12 released  (2004-10-22)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.12
     :END:
@@ -1819,7 +1820,7 @@
 
 
 
-*** GnuPG 1.9.11 released  (2004-10-01)
+** GnuPG 1.9.11 released  (2004-10-01)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.11
     :END:
@@ -1837,7 +1838,7 @@
 
 
 
-*** GnuPG 1.9.10 released  (2004-07-22)
+** GnuPG 1.9.10 released  (2004-07-22)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.10
     :END:
@@ -1851,7 +1852,7 @@
 
 
 
-*** GnuPG 1.9.9 released  (2004-06-08)
+** GnuPG 1.9.9 released  (2004-06-08)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.9
     :END:
@@ -1864,7 +1865,7 @@
 
 
 
-*** GnuPG 1.9.8 released  (2004-04-29)
+** GnuPG 1.9.8 released  (2004-04-29)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.8
     :END:
@@ -1885,7 +1886,7 @@
 
 
 
-*** GnuPG 1.9.7 released  (2004-04-06)
+** GnuPG 1.9.7 released  (2004-04-06)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.7
     :END:
@@ -1901,7 +1902,7 @@
 
 
 
-*** GnuPG 1.9.6 released  (2004-03-06)
+** GnuPG 1.9.6 released  (2004-03-06)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.6
     :END:
@@ -1910,7 +1911,7 @@
 
 
 
-*** GnuPG 1.9.5 released  (2004-02-21)
+** GnuPG 1.9.5 released  (2004-02-21)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.5
     :END:
@@ -1935,7 +1936,7 @@
 
 
 
-*** GnuPG 1.9.4 released  (2004-01-30)
+** GnuPG 1.9.4 released  (2004-01-30)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.4
     :END:
@@ -1950,7 +1951,7 @@
 
 
 
-*** GnuPG 1.9.3 released  (2003-12-23)
+** GnuPG 1.9.3 released  (2003-12-23)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.3
     :END:
@@ -1971,7 +1972,7 @@
 
 
 
-*** GnuPG 1.9.2 released  (2003-11-17)
+** GnuPG 1.9.2 released  (2003-11-17)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.2
     :END:
@@ -1986,7 +1987,7 @@
 
 
 
-*** GnuPG 1.9.1 released  (2003-09-06)
+** GnuPG 1.9.1 released  (2003-09-06)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.1
     :END:
@@ -2002,7 +2003,7 @@
 
 
 
-*** GnuPG 1.9.0 released  (2003-08-05)
+** GnuPG 1.9.0 released  (2003-08-05)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.9.0
     :END:
@@ -2037,107 +2038,107 @@
 
 
 
-*** GnuPG 1.4.19 released  (2015-02-27)
+** GnuPG 1.4.19 released  (2015-02-27)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.19
     :END:
 
-*** GnuPG 1.4.18 released  (2014-06-30)
+** GnuPG 1.4.18 released  (2014-06-30)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.18
     :END:
 
-*** GnuPG 1.4.17 released  (2014-06-23)
+** GnuPG 1.4.17 released  (2014-06-23)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.17
     :END:
 
-*** GnuPG 1.4.16 released  (2013-12-18)
+** GnuPG 1.4.16 released  (2013-12-18)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.16
     :END:
 
-*** GnuPG 1.4.15 released  (2013-10-04)
+** GnuPG 1.4.15 released  (2013-10-04)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.15
     :END:
 
-*** GnuPG 1.4.14 released  (2013-07-25)
+** GnuPG 1.4.14 released  (2013-07-25)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.14
     :END:
 
-*** GnuPG 1.4.13 released  (2012-12-20)
+** GnuPG 1.4.13 released  (2012-12-20)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.13
     :END:
 
-*** GnuPG 1.4.12 released  (2012-01-30)
+** GnuPG 1.4.12 released  (2012-01-30)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.12
     :END:
 
-*** GnuPG 1.4.11 released  (2010-10-18)
+** GnuPG 1.4.11 released  (2010-10-18)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.11
     :END:
 
-*** GnuPG 1.4.10 released  (2009-09-02)
+** GnuPG 1.4.10 released  (2009-09-02)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.10
     :END:
 
-*** GnuPG 1.4.9 released  (2008-03-26)
+** GnuPG 1.4.9 released  (2008-03-26)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.9
     :END:
 
-*** GnuPG 1.4.8 released  (2007-12-20)
+** GnuPG 1.4.8 released  (2007-12-20)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.8
     :END:
 
-*** GnuPG 1.4.7 released  (2007-03-05)
+** GnuPG 1.4.7 released  (2007-03-05)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.7
     :END:
 
-*** GnuPG 1.4.6 released  (2006-12-06)
+** GnuPG 1.4.6 released  (2006-12-06)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.6
     :END:
 
-*** GnuPG 1.4.5 released  (2006-08-01)
+** GnuPG 1.4.5 released  (2006-08-01)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.5
     :END:
 
-*** GnuPG 1.4.4 released  (2006-06-25)
+** GnuPG 1.4.4 released  (2006-06-25)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.4
     :END:
 
-*** GnuPG 1.4.3 released  (2006-04-03)
+** GnuPG 1.4.3 released  (2006-04-03)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.3
     :END:
 
-*** GnuPG 1.4.2 released  (2005-07-26)
+** GnuPG 1.4.2 released  (2005-07-26)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.2
     :END:
 
-*** GnuPG 1.4.1 released  (2005-03-15)
+** GnuPG 1.4.1 released  (2005-03-15)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.1
     :END:
 
-*** GnuPG 1.4.0 released  (2004-12-16)
+** GnuPG 1.4.0 released  (2004-12-16)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.4.0
     :END:
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2003q2/000153.html][1.3.2]] released  (2003-05-27)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2003q2/000153.html][1.3.2]] released  (2003-05-27)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.3.2
     :END:
@@ -2240,7 +2241,7 @@
 
 
 
-*** GnuPG 1.3.1 released  (2002-11-12)
+** GnuPG 1.3.1 released  (2002-11-12)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.3.1
     :END:
@@ -2268,7 +2269,7 @@
 
 
 
-*** GnuPG 1.3.0 released  (2002-10-18)
+** GnuPG 1.3.0 released  (2002-10-18)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.3.0
     :END:
@@ -2310,52 +2311,52 @@
 
 
 
-*** GnuPG 1.2.8 released  (2006-12-07)
+** GnuPG 1.2.8 released  (2006-12-07)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.2.8
     :END:
 
-*** GnuPG 1.2.7 released  (2004-12-27)
+** GnuPG 1.2.7 released  (2004-12-27)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.2.7
     :END:
 
-*** GnuPG 1.2.6 released  (2004-08-25)
+** GnuPG 1.2.6 released  (2004-08-25)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.2.6
     :END:
 
-*** GnuPG 1.2.5 released  (2004-07-26)
+** GnuPG 1.2.5 released  (2004-07-26)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.2.5
     :END:
 
-*** GnuPG 1.2.4 released  (2003-12-23)
+** GnuPG 1.2.4 released  (2003-12-23)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.2.4
     :END:
 
-*** GnuPG 1.2.3 released  (2003-08-21)
+** GnuPG 1.2.3 released  (2003-08-21)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.2.3
     :END:
 
-*** GnuPG 1.2.2 released  (2003-05-01)
+** GnuPG 1.2.2 released  (2003-05-01)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.2.2
     :END:
 
-*** GnuPG 1.2.1 released  (2002-10-25)
+** GnuPG 1.2.1 released  (2002-10-25)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.2.1
     :END:
 
-*** GnuPG 1.2.0 released  (2002-09-21)
+** GnuPG 1.2.0 released  (2002-09-21)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.2.0
     :END:
 
-*** GnuPG 1.1.92 released  (2002-09-11)
+** GnuPG 1.1.92 released  (2002-09-11)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.1.92
     :END:
@@ -2405,7 +2406,7 @@
 
 
 
-*** GnuPG 1.1.91 released  (2002-08-04)
+** GnuPG 1.1.91 released  (2002-08-04)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.1.91
     :END:
@@ -2449,7 +2450,7 @@
 
 
 
-*** GnuPG 1.1.90 released  (2002-07-01)
+** GnuPG 1.1.90 released  (2002-07-01)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.1.90
     :END:
@@ -2504,7 +2505,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2002q2/000135.html][1.0.7]] released  (2002-04-29)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2002q2/000135.html][1.0.7]] released  (2002-04-29)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.0.7
     :END:
@@ -2619,7 +2620,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2001q2/000123.html][1.0.6]] released  (2001-05-29)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2001q2/000123.html][1.0.6]] released  (2001-05-29)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.0.6
     :END:
@@ -2641,7 +2642,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2001q2/000122.html][1.0.5]] released  (2001-04-29)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2001q2/000122.html][1.0.5]] released  (2001-04-29)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.0.5
     :END:
@@ -2703,7 +2704,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2000q4/000082.html][1.0.4]] released  (2000-10-17)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2000q4/000082.html][1.0.4]] released  (2000-10-17)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.0.4
     :END:
@@ -2722,7 +2723,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2000q3/000075.html][1.0.3]] released  (2000-09-18)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2000q3/000075.html][1.0.3]] released  (2000-09-18)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.0.3
     :END:
@@ -2758,7 +2759,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2000q3/000069.html][1.0.2]] released  (2000-07-12)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/2000q3/000069.html][1.0.2]] released  (2000-07-12)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.0.2
     :END:
@@ -2820,7 +2821,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/1999q4/000050.html][1.0.1]] released  (1999-12-16)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/1999q4/000050.html][1.0.1]] released  (1999-12-16)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.0.1
     :END:
@@ -2856,7 +2857,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/1999q3/000037.html][1.0.0]] released  (1999-09-07)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/1999q3/000037.html][1.0.0]] released  (1999-09-07)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-1.0.0
     :END:
@@ -2869,7 +2870,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/1999q3/000036.html][0.9.11]] released  (1999-09-03)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/1999q3/000036.html][0.9.11]] released  (1999-09-03)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.9.11
     :END:
@@ -2884,7 +2885,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/1999q3/000034.html][0.9.10]] released  (1999-07-23)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/1999q3/000034.html][0.9.10]] released  (1999-07-23)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.9.10
     :END:
@@ -2896,7 +2897,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/1999q2/000016.html][0.9.8]] released  (1999-06-26)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/1999q2/000016.html][0.9.8]] released  (1999-06-26)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.9.8
     :END:
@@ -2921,7 +2922,7 @@
 
 
 
-*** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/1999q2/000000.html][0.9.7]] released  (1999-05-23)
+** GnuPG [[https://lists.gnupg.org/pipermail/gnupg-announce/1999q2/000000.html][0.9.7]] released  (1999-05-23)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.9.7
     :END:
@@ -2934,7 +2935,7 @@
 
 
 
-*** GnuPG 0.9.6 released  (1999-05-06)
+** GnuPG 0.9.6 released  (1999-05-06)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.9.6
     :END:
@@ -2952,7 +2953,7 @@
 
 
 
-*** GnuPG 0.9.5 released  (1999-03-20)
+** GnuPG 0.9.5 released  (1999-03-20)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.9.5
     :END:
@@ -2968,7 +2969,7 @@
 
 
 
-*** GnuPG 0.9.4 released  (1999-03-08)
+** GnuPG 0.9.4 released  (1999-03-08)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.9.4
     :END:
@@ -2982,7 +2983,7 @@
 
 
 
-*** GnuPG 0.9.3 released  (1999-02-19)
+** GnuPG 0.9.3 released  (1999-02-19)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.9.3
     :END:
@@ -3005,7 +3006,7 @@
 
 
 
-*** GnuPG 0.9.2 released  (1999-01-01)
+** GnuPG 0.9.2 released  (1999-01-01)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.9.2
     :END:
@@ -3020,7 +3021,7 @@
 
 
 
-*** GnuPG 0.9.1 released  (1999-01-01)
+** GnuPG 0.9.1 released  (1999-01-01)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.9.1
     :END:
@@ -3045,7 +3046,7 @@
 
 
 
-*** GnuPG 0.9.0 released  (1998-12-23)
+** GnuPG 0.9.0 released  (1998-12-23)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.9.0
     :END:
@@ -3069,7 +3070,7 @@
 
 
 
-*** GnuPG 0.4.5 released  (1998-12-08)
+** GnuPG 0.4.5 released  (1998-12-08)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.4.5
     :END:
@@ -3090,7 +3091,7 @@
 
 
 
-*** GnuPG 0.4.4 released  (1998-11-20)
+** GnuPG 0.4.4 released  (1998-11-20)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.4.4
     :END:
@@ -3125,7 +3126,7 @@
 
 
 
-*** GnuPG 0.4.3 released  (1998-11-08)
+** GnuPG 0.4.3 released  (1998-11-08)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.4.3
     :END:
@@ -3154,7 +3155,7 @@
 
 
 
-*** GnuPG 0.4.2 released  (1998-10-18)
+** GnuPG 0.4.2 released  (1998-10-18)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.4.2
     :END:
@@ -3198,7 +3199,7 @@
 
 
 
-*** GnuPG 0.4.1 released  (1998-10-07)
+** GnuPG 0.4.1 released  (1998-10-07)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.4.1
     :END:
@@ -3225,7 +3226,7 @@
 
 
 
-*** GnuPG 0.4.0 released  (1998-09-18)
+** GnuPG 0.4.0 released  (1998-09-18)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.4.0
     :END:
@@ -3244,7 +3245,7 @@
 
 
 
-*** GnuPG 0.3.5 released  (1998-09-14)
+** GnuPG 0.3.5 released  (1998-09-14)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.3.5
     :END:
@@ -3270,7 +3271,7 @@
 
 
 
-*** GnuPG 0.3.4 released  (1998-08-11)
+** GnuPG 0.3.4 released  (1998-08-11)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.3.4
     :END:
@@ -3283,7 +3284,7 @@
 
 
 
-*** GnuPG 0.3.3 released  (1998-08-08)
+** GnuPG 0.3.3 released  (1998-08-08)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.3.3
     :END:
@@ -3360,7 +3361,7 @@
 
 
 
-*** GnuPG 0.3.2 released  (1998-07-09)
+** GnuPG 0.3.2 released  (1998-07-09)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.3.2
     :END:
@@ -3377,7 +3378,7 @@
 
 
 
-*** GnuPG 0.3.1 released  (1998-07-06)
+** GnuPG 0.3.1 released  (1998-07-06)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.3.1
     :END:
@@ -3397,7 +3398,7 @@
 
 
 
-*** GnuPG 0.3.0 released  (1998-06-25)
+** GnuPG 0.3.0 released  (1998-06-25)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.3.0
     :END:
@@ -3427,7 +3428,7 @@
 
 
 
-*** GnuPG 0.2.19 released  (1998-05-29)
+** GnuPG 0.2.19 released  (1998-05-29)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.19
     :END:
@@ -3452,7 +3453,7 @@
 
 
 
-*** GnuPG 0.2.18 released  (1998-05-15)
+** GnuPG 0.2.18 released  (1998-05-15)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.18
     :END:
@@ -3481,7 +3482,7 @@
 
 
 
-*** GnuPG 0.2.17 released  (1998-05-04)
+** GnuPG 0.2.17 released  (1998-05-04)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.17
     :END:
@@ -3500,7 +3501,7 @@
 
 
 
-*** GnuPG 0.2.16 released  (1998-04-28)
+** GnuPG 0.2.16 released  (1998-04-28)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.16
     :END:
@@ -3517,7 +3518,7 @@
 
 
 
-*** GnuPG 0.2.15 released  (1998-04-09)
+** GnuPG 0.2.15 released  (1998-04-09)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.15
     :END:
@@ -3535,7 +3536,7 @@
     - Some new test cases
 
 
-*** GnuPG 0.2.14 released  (1998-04-02)
+** GnuPG 0.2.14 released  (1998-04-02)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.14
     :END:
@@ -3554,7 +3555,7 @@
 
 
 
-*** GnuPG 0.2.13 released  (1998-03-10)
+** GnuPG 0.2.13 released  (1998-03-10)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.13
     :END:
@@ -3565,7 +3566,7 @@
 
 
 
-*** GnuPG 0.2.12 released  (1998-03-07)
+** GnuPG 0.2.12 released  (1998-03-07)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.12
     :END:
@@ -3582,7 +3583,7 @@
     - New option "--with-colons" to make parsing of key lists easier.
 
 
-*** GnuPG 0.2.11 released  (1998-03-02)
+** GnuPG 0.2.11 released  (1998-03-02)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.11
     :END:
@@ -3597,7 +3598,7 @@
       and auto-regenerate the public key, next time the secret key is used?
 
 
-*** GnuPG 0.2.10 released  (1998-02-27)
+** GnuPG 0.2.10 released  (1998-02-27)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.10
     :END:
@@ -3622,7 +3623,7 @@
 
 
 
-*** GnuPG 0.2.9 released  (1998-02-26)
+** GnuPG 0.2.9 released  (1998-02-26)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.9
     :END:
@@ -3634,7 +3635,7 @@
     - Switched to automake1.2f and a newer gettext.
 
 
-*** GnuPG 0.2.8 released  (1998-02-24)
+** GnuPG 0.2.8 released  (1998-02-24)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.8
     :END:
@@ -3648,7 +3649,7 @@
 
 
 
-*** GnuPG 0.2.7 released  (1998-02-18)
+** GnuPG 0.2.7 released  (1998-02-18)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.7
     :END:
@@ -3672,7 +3673,7 @@
     - "make check" works.
 
 
-*** GnuPG 0.2.6 released  (1998-02-13)
+** GnuPG 0.2.6 released  (1998-02-13)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.6
     :END:
@@ -3681,7 +3682,7 @@
 
 
 
-*** GnuPG 0.2.5 released  (1998-02-12)
+** GnuPG 0.2.5 released  (1998-02-12)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.5
     :END:
@@ -3696,7 +3697,7 @@
 
 
 
-*** GnuPG 0.2.4 released  (1998-02-11)
+** GnuPG 0.2.4 released  (1998-02-11)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.4
     :END:
@@ -3711,7 +3712,7 @@
 
 
 
-*** GnuPG 0.2.3 released  (1998-02-09)
+** GnuPG 0.2.3 released  (1998-02-09)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.3
     :END:
@@ -3766,228 +3767,228 @@
 
 
 
-*** GnuPG 0.2.2 released  (1998-02-09)
+** GnuPG 0.2.2 released  (1998-02-09)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.2
     :END:
 
-*** GnuPG 0.2.1 released  (1998-01-28)
+** GnuPG 0.2.1 released  (1998-01-28)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.1
     :END:
 
-*** GnuPG 0.2.0 released  (1998-01-25)
+** GnuPG 0.2.0 released  (1998-01-25)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.2.0
     :END:
 
-*** GnuPG 0.1.3 released  (1998-01-12)
+** GnuPG 0.1.3 released  (1998-01-12)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.1.3
     :END:
 
-*** GnuPG 0.1.2 released  (1998-01-07)
+** GnuPG 0.1.2 released  (1998-01-07)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.1.2
     :END:
 
-*** GnuPG 0.1.1 released  (1998-01-07)
+** GnuPG 0.1.1 released  (1998-01-07)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.1.1
     :END:
 
-*** GnuPG 0.1.0 released  (1998-01-05)
+** GnuPG 0.1.0 released  (1998-01-05)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.1.0
     :END:
 
-*** GnuPG 0.0.0 released  (1997-12-20)
+** GnuPG 0.0.0 released  (1997-12-20)
     :PROPERTIES:
     :CUSTOM_ID: gnupg-0.0.0
     :END:
 
 
-** GnuPG-1
+* Release notes for the old 1.x versions
 
-*** GnuPG 1.4.14 (2013-07-25)                                     :important:
+** GnuPG 1.4.14 (2013-07-25)                                     :important:
 
     {{{announce(2013q3/000329)}}}
 
 
-*** GnuPG 1.4.13 (2012-12-20)
+** GnuPG 1.4.13 (2012-12-20)
 
     {{{announce(2012q4/000319)}}}
 
-*** GnuPG 1.4.12 (2012-01-30)
+** GnuPG 1.4.12 (2012-01-30)
 
     {{{announce(2012q1/000313)}}}
 
 
-*** GnuPG 1.4.11 (2010-10-18)
+** GnuPG 1.4.11 (2010-10-18)
 
     {{{announce(2010q4/000303)}}}
 
 
-*** GnuPG 1.4.10 (2009-09-02)
+** GnuPG 1.4.10 (2009-09-02)
 
     {{{announce(2009q3/000291)}}}
 
 
-*** GnuPG 1.4.8 (2007-12-20)
+** GnuPG 1.4.8 (2007-12-20)
 
     {{{announce(2007q4/000266)}}}
 
 
-*** GnuPG 1.4.5 (2006-08-01)
+** GnuPG 1.4.5 (2006-08-01)
 
     {{{announce(2006q3/000229)}}}
 
-*** GnuPG 1.4.4 (2006-06-25)
+** GnuPG 1.4.4 (2006-06-25)
 
     {{{announce(2006q2/000226)}}}
 
-*** GnuPG 1.4.3 (2006-04-03)
+** GnuPG 1.4.3 (2006-04-03)
 
     {{{announce(2006q2/000222)}}}
 
-*** GnuPG 1.4.2 (2005-07-27)
+** GnuPG 1.4.2 (2005-07-27)
 
     {{{announce(2005q3/000200)}}}
 
 
-*** GnuPG 1.2.7 (2004-12-28)
+** GnuPG 1.2.7 (2004-12-28)
 
     This is an update of the old stable branch..
 
     {{{announce(2004q4/000188)}}}
 
-*** GnuPG stable 1.4.0 (2004-12-16)
+** GnuPG stable 1.4.0 (2004-12-16)
 
     This is the first relese of the new stable branch of GnuPG.
 
     {{{announce(2004q4/000186)}}}
 
 
-*** GnuPG 1.3.93 (2004-12-14)
+** GnuPG 1.3.93 (2004-12-14)
 
    The latest and hopefully last release candidate for GnuPG 1.4 is
    ready for public consumption.
 
     {{{announce(2004q4/000185)}}}
 
-*** GnuPG 1.3.92 (2004-10-28)
+** GnuPG 1.3.92 (2004-10-28)
 
     This is from the development branch.
 
     {{{announce(2004q4/000183)}}}
 
 
-*** GnuPG 1.3.91 (2004-10-16)
+** GnuPG 1.3.91 (2004-10-16)
 
     This is from the development branch.
 
     {{{announce(2004q4/000180)}}}
 
 
-*** GnuPG 1.3.90  (2004-10-02)
+** GnuPG 1.3.90  (2004-10-02)
 
     This is from the development branch.
 
 
-*** GnuPG 1.2.6 (2004-08-26)
+** GnuPG 1.2.6 (2004-08-26)
 
     {{{announce(2004q3/000176)}}}
 
-*** GnuPG 1.2.5 (2004-07-27)
+** GnuPG 1.2.5 (2004-07-27)
 
     {{{announce(2004q3/000171)}}}
 
-*** GnuPG 1.3.6 (2004-05-22)
+** GnuPG 1.3.6 (2004-05-22)
 
     This is from the development branch.
 
     {{{announce(2004q2/000168)}}}
 
 
-*** GnuPG 1.3.5 (2004-02-26)
+** GnuPG 1.3.5 (2004-02-26)
 
     This is from the development branch.
 
     {{{announce(2004q1/000165)}}}
 
-*** GnuPG 1.2.4 (2003-12-24)
+** GnuPG 1.2.4 (2003-12-24)
 
     {{{announce(2003q4)}}}
 
 
-*** GnuPG 1.3.4 (2003-11-27)
+** GnuPG 1.3.4 (2003-11-27)
 
     This is from the development branch.
 
     {{{announce(2003q4)}}}
 
 
-*** GnuPG 1.3.3 (2003-10-10)
+** GnuPG 1.3.3 (2003-10-10)
 
     This is from the development branch.
 
     {{{announce(2003q4/)}}}
 
-*** GnuPG 1.2.3 (2003-08-22)
+** GnuPG 1.2.3 (2003-08-22)
 
     {{{announce(2003q3/][[more]]]
 
-*** GnuPG 1.3.2 (2003-05-27)
+** GnuPG 1.3.2 (2003-05-27)
 
     This is from the development branch.
 
     {{{announce(2003q2/)}}}
 
-*** GnuPG 1.2.2 (2003-05-03)
+** GnuPG 1.2.2 (2003-05-03)
 
     {{{announce(2003q2/)}}}
 
 
-*** GnuPG 1.3.1 (2002-11-12)
+** GnuPG 1.3.1 (2002-11-12)
 
     This is from the development branch.
 
 
-*** GnuPG 1.2.1 for Windows  (2002-10-26)
+** GnuPG 1.2.1 for Windows  (2002-10-26)
 
     This is an update of Windows binary release
 
     {{{announce(2002q4/)}}}
 
-*** GnuPG 1.2.1  (2002-10-25)
+** GnuPG 1.2.1  (2002-10-25)
 
 
-*** GnuPG 1.3.0 (2002-10-18)
+** GnuPG 1.3.0 (2002-10-18)
 
     This is the first release of a new development branch.
 
     {{{announce(2002q4/)}}}
 
-*** GnuPG 1.2.0 (2002-09-21)
+** GnuPG 1.2.0 (2002-09-21)
 
     This is a new stable branch.
 
     {{{announce(2002q3/000252)}}}
 
 
-*** GnuPG 1.0.7 (2002-04-29)
+** GnuPG 1.0.7 (2002-04-29)
 
     {{{announce(2002q2/000251)}}}
 
 
-*** GnuPG 1.0.6 (2001-05-29)
+** GnuPG 1.0.6 (2001-05-29)
 
 
-*** GnuPG 1.0.5 for Windows (2001-05-02)
+** GnuPG 1.0.5 for Windows (2001-05-02)
 
     This is a binary release for Windows.
 
-*** GnuPG 1.0.5 (2001-04-29)
+** GnuPG 1.0.5 (2001-04-29)
 
     - The semantics of --verify have changed.
     - Corrected hash calculation for input data larger than 512M.
@@ -3998,140 +3999,140 @@
     - Estonian and Turkish translation.
     - The usual fixes and other enhancements.
 
-*** Patch for GnuPG 1.0.4 (2000-11-30)
+** Patch for GnuPG 1.0.4 (2000-11-30)
 
     Fixed a serious bug which could lead to false positives when checking
     detached signatures.
 
 
-*** GnuPG 1.0.4 for Windows (2000-10-23)
+** GnuPG 1.0.4 for Windows (2000-10-23)
 
 
-*** GnuPG 1.0.3 (2000-09-20)
+** GnuPG 1.0.3 (2000-09-20)
 
    -  RSA support.
    -  Supports the new MDC encryption packet.
    -  Default options changed for better compatibility with PGP 7.
    -  The usual fixes and other enhancements.
 
-*** GnuPG 1.0.2 (2000-07-12)
+** GnuPG 1.0.2 (2000-07-12)
 
     A lot of fixes and enhancements.
 
-*** GnuPG 1.0.1 (1999-12-16)
+** GnuPG 1.0.1 (1999-12-16)
 
     Bug fixes and small enhancements.
 
-*** GnuPG 1.0.0 (1999-09-07)
+** GnuPG 1.0.0 (1999-09-07)
 
     Released the first production version.
 
-*** GnuPG 0.9.11 (1999-09-03)
+** GnuPG 0.9.11 (1999-09-03)
 
     Some more fixes and cleanups.
 
-*** GnuPG 0.9.10 (1999-08-04)
+** GnuPG 0.9.10 (1999-08-04)
 
     Minor bug fixes.
 
-*** GnuPG 0.9.9 (1999-07-23)
+** GnuPG 0.9.9 (1999-07-23)
 
     -  Yet another chunk of options.
     -  More bug fixes.
 
-*** GnuPG 0.9.8 (1999-06-26)
+** GnuPG 0.9.8 (1999-06-26)
 
     -  A couple of new options.
     -  Yet another workaround for PGP2.
     -  Other bug fixes.
 
-*** GnuPG 0.9.7 (1999-05-23)
+** GnuPG 0.9.7 (1999-05-23)
 
     -  Workarounds for a couple of PGP2 bugs.
     -  Other bug fixes.
 
 
-*** GnuPG 0.9.6 (1999-05-06)
+** GnuPG 0.9.6 (1999-05-06)
 
     -  Bug fixes.
     -  Subkey and signature revocations.
 
-*** GnuPG 0.9.5 (1999-03-20)
+** GnuPG 0.9.5 (1999-03-20)
 
     -  Bug fixes.
     -  --recv-keys command
 
-*** GnuPG 0.9.4 (1999-03-08)
+** GnuPG 0.9.4 (1999-03-08)
 
     Bug fixes.
 
-*** GnuPG 0.9.3 (1999-02-19)
+** GnuPG 0.9.3 (1999-02-19)
 
    -  Bug fixes.
    -  Some new options.
 
-*** GnuPG 0.9.2 (1999-01-20)
+** GnuPG 0.9.2 (1999-01-20)
 
     -  Bug fixes.
     -  HKP keyserver support.
 
-*** GnuPG 0.9.1 (1999-01-01)
+** GnuPG 0.9.1 (1999-01-01)
 
     - Fixed some serious bugs.
     - Some internal redesign.
     - Polish language support.
     - Setup a anonymous rsync server.
 
-*** GnuPG 0.9.0 (1998-12-23)
+** GnuPG 0.9.0 (1998-12-23)
 
     - Option to dash-escape "From" in clear text messages.
     - Better support for unices without /dev/random.
     - Fixed some bugs.
 
-*** GnuPG 0.4.5 (1998-12-08)
+** GnuPG 0.4.5 (1998-12-08)
 
     -  Brazilian translation.
     -  Improved key import.
     -  Loadable random gathering stuff.
     -  Files are now locked during updates.
 
-*** GnuPG 0.4.4 (1998-11-20)
+** GnuPG 0.4.4 (1998-11-20)
 
     -  Spanish translation.
     -  Fixed the way expiration dates are stored.
     -  Key validation is now much faster and some more bugs fixed.
     -  New feature to support signed patch files.
 
-*** GnuPG 0.4.3 (1998-11-08)
+** GnuPG 0.4.3 (1998-11-08)
 
     -  Russian translation.
     -  Now lists all matching names.
     -  Experimental support for keyrings store in GDBM files.
     -  Many bug fixes.
 
-*** GnuPG 0.4.1 (1998-10-07)
+** GnuPG 0.4.1 (1998-10-07)
 
     -  Fixed a couple of bugs and add some more features.
     -  Checked OpenPGP compliance.
     -  PGP 5 passphrase are now working.
 
-*** GnuPG 0.4.0 (1998-09-18)
+** GnuPG 0.4.0 (1998-09-18)
 
     -  Fixed a serious Bug in 0.3.5.
     -  Added 3DES.
 
-*** GnuPG 0.3.5 (1998-09-14)
+** GnuPG 0.3.5 (1998-09-14)
 
     -  Do not use this version!
     -  Anonymous enciphered messages.
     -  Building in another directory now work better.
     -  Blowfish weak key detection mechanism.
 
-*** GnuPG 0.3.4 (1998-08-11)
+** GnuPG 0.3.4 (1998-08-11)
 
     Relased revision 0.3.4.
 
-*** GnuPG 0.3.3 (1998-08-08)
+** GnuPG 0.3.3 (1998-08-08)
 
     -  Alternate user IDs.
     -  A menu to sign, add, remove user ids and other tasks.
@@ -4139,16 +4140,16 @@
        experimental cipher algorithm.
     -  Ability to run as a coprocess; this is nice for frontends.
 
-*** GnuPG 0.3.2 (1998-07-09)
+** GnuPG 0.3.2 (1998-07-09)
 
     Bug fixes.
 
-*** GnuPG 0.3.1 (1998-07-06)
+** GnuPG 0.3.1 (1998-07-06)
 
     -  Bug fixes.
     -  More in compliance with OpenPGP.
 
-*** GnuPG 0.3.0 (1998-06-25)
+** GnuPG 0.3.0 (1998-06-25)
 
     -  Major enhancements.
     -  More complete v4 key support: Preferences and expiration time is set
@@ -4157,7 +4158,7 @@
        interoperable with pgp5.
     -  Support for dynamic loading of new algorithms.
 
-*** GnuPG 0.2.19 (1998-05-29)
+** GnuPG 0.2.19 (1998-05-29)
 
     -  Tiger has now the OpenPGP assigned number 6. Because the OID has
        changed, old signatures using this algorithm can't be verified.
@@ -4168,14 +4169,14 @@
        valid OpenPGP keys.
     -  Some new features for better integration into MUAs.
 
-*** GnuPG 0.2.18 (1998-05-15)
+** GnuPG 0.2.18 (1998-05-15)
 
     -  Add key generation for DSA and v4 signatures.
     -  Fixed a small bug in the key generation.
     -  New option =--compress-algo 1= to allow the creation of compressed
        messages which are readable by PGP.
 
-*** GnuPG 0.2.17 (1998-05-04)
+** GnuPG 0.2.17 (1998-05-04)
 
     -  More stuff for OpenPGP: Blowfish is now type 20, comment packets
        moved to a private type, packet type 3 now prepends conventional
@@ -4183,28 +4184,28 @@
     -  Fixed a passphrase bug and some others.
 
 
-*** GnuPG 0.2.16 (1998-04-28)
+** GnuPG 0.2.16 (1998-04-28)
 
     -  Experimental support for TIGER/192.
     -  Standard cipher is now Blowfish with 128 bit key in OpenPGP's
        CFB mode.
 
-*** GnuPG 0.2.15 (1998-04-09)
+** GnuPG 0.2.15 (1998-04-09)
 
     -  Fixed a bug with the old checksum calculation for secret keys.
     -  CAST5 works (using PGP's strange CFB mode).
 
-*** GnuPG 0.0.0 (1997-12-20)
+** GnuPG 0.0.0 (1997-12-20)
 
     First release.
 
 
-** Related Software
+* Related Software
 
-*** GnuPG Explorer Extension (GPGee) 1.2.1  (2005-09-08)
+** GnuPG Explorer Extension (GPGee) 1.2.1  (2005-09-08)
 
     {{{announce(2005q3/000203)}}}
 
-*** GnuPG Explorer Extension (GPGee) 1.2.0  (2005-09-06)
+** GnuPG Explorer Extension (GPGee) 1.2.0  (2005-09-06)
 
     {{{announce(2005q3/000202)}}}

-----------------------------------------------------------------------

Summary of changes:
 tools/news-file-to-org.awk     |  18 +-
 web/download/release_notes.org | 491 +++++++++++++++++++++--------------------
 2 files changed, 255 insertions(+), 254 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan  5 14:18:02 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 05 Jan 2017 14:18:02 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-234-g5e4374f
Message-ID: <E1cP7vg-0001Vc-5r@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  5e4374f2f617bc322c2e13b54a588ac2d2092d2a (commit)
      from  0dc7cc2ebf78a61a739b2aca76e9fd7b6e0a5a3a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5e4374f2f617bc322c2e13b54a588ac2d2092d2a
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Jan 5 14:17:17 2017 +0100

    Fix crash when sending plain text mails
    
    * src/mimemaker.cpp (add_body): Fix boundary handling.

diff --git a/src/mimemaker.cpp b/src/mimemaker.cpp
index dbed524..58bb0d4 100644
--- a/src/mimemaker.cpp
+++ b/src/mimemaker.cpp
@@ -1300,7 +1300,7 @@ add_body (Mail *mail, const char *boundary, sink_t sink,
       if (plain_body)
         {
           rc = write_part (sink, plain_body, strlen (plain_body),
-                           *boundary? boundary : NULL, NULL, 1);
+                           boundary, NULL, 1);
         }
       /* Just the plain body or no body. We are done. */
       return rc;

-----------------------------------------------------------------------

Summary of changes:
 src/mimemaker.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan  5 17:10:58 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 05 Jan 2017 17:10:58 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-36-g168c8c9
Message-ID: <E1cPAd3-0000YU-RF@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  168c8c9d79a817c1f08a9ef976dab377f8c4c69e (commit)
       via  4ded213698123a425393b89a800fda2a4ec5229d (commit)
      from  38671cfe5a2a40bb991619f4cb992c42b5f1e8cd (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 168c8c9d79a817c1f08a9ef976dab377f8c4c69e
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jan 5 17:05:59 2017 +0100

    tests: New test for --{show,override}-session-key.
    
    * tests/openpgp/Makefile.am (XTESTS): Add new test.
    * tests/openpgp/decrypt-session-key.scm: New file.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index c7ef5e6..c93857f 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -50,6 +50,7 @@ XTESTS = \
 	decrypt.scm \
 	decrypt-multifile.scm \
 	decrypt-dsa.scm \
+	decrypt-session-key.scm \
 	sigs.scm \
 	sigs-dsa.scm \
 	encrypt.scm \
diff --git a/tests/openpgp/decrypt-session-key.scm b/tests/openpgp/decrypt-session-key.scm
new file mode 100755
index 0000000..771b53d
--- /dev/null
+++ b/tests/openpgp/decrypt-session-key.scm
@@ -0,0 +1,45 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2017 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(load (with-path "defs.scm"))
+(setup-legacy-environment)
+
+(define (get-session-key filename)
+  (lettmp (sink)
+    (let* ((status' (call-popen `(, at gpg --status-fd=1 --decrypt
+					--show-session-key
+					--output ,sink ,filename) ""))
+	   (status (map (lambda (l)
+			  (assert (string-prefix? l "[GNUPG:] "))
+			  (string-splitp (substring l 9 (string-length l))
+					 char-whitespace? -1))
+			(string-split-newlines status'))))
+      (cadr (assoc "SESSION_KEY" status)))))
+
+(for-each-p
+ "Checking decryption of supplied files using the session key."
+ (lambda (name)
+   (let* ((source (in-srcdir (string-append name ".asc")))
+	  (key (get-session-key source)))
+     (with-ephemeral-home-directory
+      (tr:do
+       (tr:open source)
+       (tr:gpg "" `(--yes --decrypt --override-session-key ,key))
+       (tr:assert-identity name)))))
+ plain-files)

commit 4ded213698123a425393b89a800fda2a4ec5229d
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jan 5 17:00:36 2017 +0100

    tests: Fix macro.
    
    * tests/openpgp/defs.scm (with-ephemeral-home-directory): Make
    hygienic, use define-macro, do not change to the ephemeral home
    directory.
    * tests/gpgsm/setup.scm: Change to the ephemeral home directory.
    * tests/openpgp/setup.scm: Likewise.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgsm/setup.scm b/tests/gpgsm/setup.scm
index fdf277d..91821a0 100644
--- a/tests/gpgsm/setup.scm
+++ b/tests/gpgsm/setup.scm
@@ -24,6 +24,7 @@
 	(error "Usage: setup.scm --create-tarball <file> ..."))
 
 (with-ephemeral-home-directory
+ (chdir (getenv "GNUPGHOME"))
  (create-gpgsmhome)
  (stop-agent)
  (call-check `(,(tool 'gpgtar) --create --output ,(car tarball) ".")))
diff --git a/tests/openpgp/defs.scm b/tests/openpgp/defs.scm
index 863d128..837e096 100644
--- a/tests/openpgp/defs.scm
+++ b/tests/openpgp/defs.scm
@@ -222,14 +222,16 @@
 
 ;; Evaluate a sequence of expressions with an ephemeral home
 ;; directory.
-(macro (with-ephemeral-home-directory form)
-  `(let ((original-home-directory (getenv "GNUPGHOME")))
-     (with-temporary-working-directory
-      (define ephemeral-home-directory (getcwd))
-      (dynamic-wind
-	  (lambda () (setenv "GNUPGHOME" ephemeral-home-directory #t))
-	  (lambda () ,@(cdr form))
-	  (lambda () (setenv "GNUPGHOME" original-home-directory #t))))))
+(define-macro (with-ephemeral-home-directory . expressions)
+  (let ((original-home-directory (gensym))
+	(ephemeral-home-directory (gensym)))
+    `(let ((,original-home-directory (getenv "GNUPGHOME"))
+	   (,ephemeral-home-directory (mkdtemp)))
+       (finally (unlink-recursively ,ephemeral-home-directory)
+	 (dynamic-wind
+	     (lambda () (setenv "GNUPGHOME" ,ephemeral-home-directory #t))
+	     (lambda () , at expressions)
+	     (lambda () (setenv "GNUPGHOME" ,original-home-directory #t)))))))
 
 ;; Call GPG to obtain the hash sums.  Either specify an input file in
 ;; ARGS, or an string in INPUT.  Returns a list of (<algo>
diff --git a/tests/openpgp/setup.scm b/tests/openpgp/setup.scm
index abe1157..d13799d 100755
--- a/tests/openpgp/setup.scm
+++ b/tests/openpgp/setup.scm
@@ -23,6 +23,7 @@
 	(fail "Usage: setup.scm --create-tarball <file>"))
 
 (with-ephemeral-home-directory
+ (chdir (getenv "GNUPGHOME"))
  (create-gpghome)
  (create-legacy-gpghome)
  (stop-agent)

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgsm/setup.scm                              |  1 +
 tests/openpgp/Makefile.am                          |  1 +
 ...onventional-mdc.scm => decrypt-session-key.scm} | 45 ++++++++++------------
 tests/openpgp/defs.scm                             | 18 +++++----
 tests/openpgp/setup.scm                            |  1 +
 5 files changed, 33 insertions(+), 33 deletions(-)
 copy tests/openpgp/{conventional-mdc.scm => decrypt-session-key.scm} (50%)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan  5 17:29:22 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 05 Jan 2017 17:29:22 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-235-g1e42345
Message-ID: <E1cPAuq-0001CD-D7@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  1e42345f8fed6c9d9ec10c87b4b23d79dc7fb9de (commit)
      from  5e4374f2f617bc322c2e13b54a588ac2d2092d2a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1e42345f8fed6c9d9ec10c87b4b23d79dc7fb9de
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Jan 5 17:25:44 2017 +0100

    Allow different UUIDs for the same mail
    
    * src/oomhelp.cpp (get_unique_id): Always create one if
    called with create parameter.
    
    --
    Outlook can have multiple Event Handler for the Same Mail.
    E.g. If you attach a mail to another mail it becomes so decoupled
    that it has it's own event handler.
    
    We must handle that case to avoid messing up or event handling /
    internal state. It is now:
    One UUID for One mailitem-events handler.

diff --git a/src/oomhelp.cpp b/src/oomhelp.cpp
index 9570eaf..87665d2 100644
--- a/src/oomhelp.cpp
+++ b/src/oomhelp.cpp
@@ -1621,22 +1621,21 @@ get_unique_id (LPDISPATCH mail, int create, const char *uuid)
     }
 
   /* Get the User Properties. */
-  char *uid = get_pa_string (mail, GPGOL_UID_DASL);
-  if (!uid)
+  if (!create)
     {
-      log_debug ("%s:%s: No uuid found in oom for '%p'",
-                 SRCNAME, __func__, mail);
-
-      if (!create)
+      char *uid = get_pa_string (mail, GPGOL_UID_DASL);
+      if (!uid)
         {
+          log_debug ("%s:%s: No uuid found in oom for '%p'",
+                     SRCNAME, __func__, mail);
           return NULL;
         }
-    }
-  else
-    {
-      log_debug ("%s:%s: Found uid '%s' for '%p'",
-                 SRCNAME, __func__, uid, mail);
-      return uid;
+      else
+        {
+          log_debug ("%s:%s: Found uid '%s' for '%p'",
+                     SRCNAME, __func__, uid, mail);
+          return uid;
+        }
     }
   char *newuid;
   if (!uuid)

-----------------------------------------------------------------------

Summary of changes:
 src/oomhelp.cpp | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan  5 17:54:06 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 05 Jan 2017 17:54:06 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-236-g474f02a
Message-ID: <E1cPBIm-0002OC-DA@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  474f02a9278b8755bd99ba79fa018212be08baf1 (commit)
      from  1e42345f8fed6c9d9ec10c87b4b23d79dc7fb9de (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 474f02a9278b8755bd99ba79fa018212be08baf1
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Jan 5 17:42:50 2017 +0100

    Hide WKD Option for now
    
    --
    Does not work yet because of missing HTTPS support and
    we would also need to change the gpg.conf setting.
    Let's hope we can revert this soon.

diff --git a/src/addin-options.cpp b/src/addin-options.cpp
index d08b71a..083d89e 100644
--- a/src/addin-options.cpp
+++ b/src/addin-options.cpp
@@ -44,7 +44,7 @@ set_labels (HWND dlg)
     { IDC_SIGN_DEFAULT,     N_("&Sign new messages by default")},
     { IDC_INLINE_PGP,       N_("&Send OpenPGP mails without "
                                "attachments as inline-pgp")},
-    { IDC_AUTORRESOLVE,     N_("&Search for OpenPGP keys automatically when encrypting")},
+//    { IDC_AUTORRESOLVE,     N_("&Search for OpenPGP keys automatically when encrypting")},
 
 
     { IDC_GPG_OPTIONS,      N_("Debug...")},
@@ -94,8 +94,8 @@ options_window_proc (HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
 #endif
           SendDlgItemMessage (hDlg, IDC_INLINE_PGP, BM_SETCHECK,
                               !!opt.inline_pgp, 0L);
-          SendDlgItemMessage (hDlg, IDC_AUTORRESOLVE, BM_SETCHECK,
-                              !!opt.autoresolve, 0L);
+//          SendDlgItemMessage (hDlg, IDC_AUTORRESOLVE, BM_SETCHECK,
+//                              !!opt.autoresolve, 0L);
           enable_disable_opts (hDlg);
           set_labels (hDlg);
           ShowWindow (GetDlgItem (hDlg, IDC_GPG_OPTIONS),
@@ -133,8 +133,8 @@ options_window_proc (HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
                 opt.inline_pgp = !!SendDlgItemMessage
                   (hDlg, IDC_INLINE_PGP, BM_GETCHECK, 0, 0L);
 
-                opt.autoresolve = !!SendDlgItemMessage
-                  (hDlg, IDC_AUTORRESOLVE, BM_GETCHECK, 0, 0L);
+//                opt.autoresolve = !!SendDlgItemMessage
+////                  (hDlg, IDC_AUTORRESOLVE, BM_GETCHECK, 0, 0L);
 
                 write_options ();
                 EndDialog (hDlg, TRUE);
diff --git a/src/dialogs.rc b/src/dialogs.rc
index a3ee628..ba8cb8c 100644
--- a/src/dialogs.rc
+++ b/src/dialogs.rc
@@ -329,7 +329,7 @@ BEGIN
 
     /* Send options box.  */
     GROUPBOX        "send-options", IDC_G_SEND,
-                    9, 50, 250, 60
+                    9, 50, 250, 50
 
     CONTROL         "encrypt-by-default", IDC_ENCRYPT_DEFAULT,
                     "Button", BS_AUTOCHECKBOX | WS_TABSTOP,
@@ -343,9 +343,9 @@ BEGIN
                     "Button", BS_AUTOCHECKBOX | WS_TABSTOP,
                     24, 82, 215, 10
 
-    CONTROL         "autoresolve", IDC_AUTORRESOLVE,
-                    "Button", BS_AUTOCHECKBOX | WS_TABSTOP,
-                    24, 93, 215, 10
+//    CONTROL         "autoresolve", IDC_AUTORRESOLVE,
+//                    "Button", BS_AUTOCHECKBOX | WS_TABSTOP,
+//                    24, 93, 215, 10
 
     /* Stuff at the lower left corner.  */
     LTEXT           "GpgOL by Gpg4win", IDC_GPG4WIN_STRING,

-----------------------------------------------------------------------

Summary of changes:
 src/addin-options.cpp | 10 +++++-----
 src/dialogs.rc        |  8 ++++----
 2 files changed, 9 insertions(+), 9 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan  5 20:45:54 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 05 Jan 2017 20:45:54 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-38-g6170eb8
Message-ID: <E1cPDz2-0001P1-Qe@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  6170eb809033c9d144abf3b1f31f8b936878cdd4 (commit)
       via  353f6ff37646ad4c24d309a495e6c6f41e5235e3 (commit)
      from  168c8c9d79a817c1f08a9ef976dab377f8c4c69e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6170eb809033c9d144abf3b1f31f8b936878cdd4
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 5 20:42:55 2017 +0100

    Silence two -Wlogical-op warnings.
    
    * common/tlv.c (parse_ber_header): Avoid compiler warning about a
    duplicate condition.
    * tools/gpgtar-create.c (pattern_valid_p): Likewise.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/tlv.c b/common/tlv.c
index 6813c58..0058b67 100644
--- a/common/tlv.c
+++ b/common/tlv.c
@@ -214,9 +214,9 @@ parse_ber_header (unsigned char const **buffer, size_t *size,
   else
     {
       unsigned long len = 0;
-      int count = c & 0x7f;
+      int count = (c & 0x7f);
 
-      if (count > sizeof (len) || count > sizeof (size_t))
+      if (count > (sizeof(len)<sizeof(size_t)?sizeof(len):sizeof(size_t)))
         return gpg_err_make (default_errsource, GPG_ERR_BAD_BER);
 
       for (; count; count--)
diff --git a/tools/gpgtar-create.c b/tools/gpgtar-create.c
index ef906a5..ffd239f 100644
--- a/tools/gpgtar-create.c
+++ b/tools/gpgtar-create.c
@@ -429,7 +429,11 @@ pattern_valid_p (const char *pattern)
     return 0;
   if (*pattern == '.' && pattern[1] == '.')
     return 0;
-  if (*pattern == '/' || *pattern == DIRSEP_C)
+  if (*pattern == '/'
+#ifdef HAVE_DOSISH_SYSTEM
+      || *pattern == '\\'
+#endif
+      )
     return 0; /* Absolute filenames are not supported.  */
 #ifdef HAVE_DRIVE_LETTERS
   if (((*pattern >= 'a' && *pattern <= 'z')

commit 353f6ff37646ad4c24d309a495e6c6f41e5235e3
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 5 20:25:16 2017 +0100

    doc: Mention gpgv in the description of gpg --verify.
    
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 469e548..4ea2cd2 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -255,6 +255,13 @@ out the actual signed data, but there are other pitfalls with this
 format as well.  It is suggested to avoid cleartext signatures in
 favor of detached signatures.
 
+Note: Sometimes the use of the @command{gpgv} tool is easier than
+using the full-fledged @command{gpg} with this option.  @command{gpgv}
+is designed to compare signed data against a list of trusted keys and
+returns with success only for a good signature.  It has its own manual
+page.
+
+
 @item --multifile
 @opindex multifile
 This modifies certain other commands to accept multiple files for

-----------------------------------------------------------------------

Summary of changes:
 common/tlv.c          | 4 ++--
 doc/gpg.texi          | 7 +++++++
 tools/gpgtar-create.c | 6 +++++-
 3 files changed, 14 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan  6 01:49:37 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 06 Jan 2017 01:49:37 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-39-g8a41e73
Message-ID: <E1cPIix-0007JA-Se@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  8a41e73c31adb86d4a7dca4da695e5ad1347811f (commit)
      from  6170eb809033c9d144abf3b1f31f8b936878cdd4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8a41e73c31adb86d4a7dca4da695e5ad1347811f
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 6 09:14:13 2017 +0900

    scd: Support multiple readers by CCID driver.
    
    * scd/apdu.c (new_reader_slot): Lock is now in apdu_dev_list_start.
    (close_pcsc_reader_direct, close_ccid_reader): RDRNAME is handled...
    (apdu_close_reader): ... by this function now.
    (apdu_prepare_exit): Likewise.
    (open_ccid_reader): Open with dev_list.
    (apdu_dev_list_start, apdu_dev_list_finish): New.
    (apdu_open_one_reader): New.
    (apdu_open_reader): Support multiple readers.
    * scd/app.c (select_application): With SCAN, opening all readers
    available, and register as new APP.
    (app_write_learn_status): app->ref_count == 0 is valid for APP which is
    not yet used.
    (app_list_start, app_list_finish): New.
    * scd/ccid-driver.c (struct ccid_driver_s): Remove RID and BCD_DEVICE.
    Add BAI.
    (parse_ccid_descriptor): BCD_DEVICE is now on the arguments.
    (ccid_dev_scan, ccid_dev_scan_finish): New.
    (ccid_get_BAI, ccid_compare_BAI, ccid_open_usb_reader): New.
    (ccid_open_reader): Support multiple readers.
    (ccid_set_progress_cb, ccid_close_reader): No RID any more.
    --
    
    With this change, multiple readers/tokens are supported by the internal
    CCID driver of GnuPG.  Until the changes of upper layers (scdaemon,
    gpg-agent, and gpg front end), only a single reader is used, though.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/apdu.c b/scd/apdu.c
index d0b75c8..50363ce 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -66,6 +66,13 @@
 #define CCID_DRIVER_INCLUDE_USB_IDS 1
 #include "ccid-driver.h"
 
+struct dev_list {
+  struct ccid_dev_table *ccid_table;
+  const char *portstr;
+  int idx;
+  int idx_max;
+};
+
 /* Due to conflicting use of threading libraries we usually can't link
    against libpcsclite if we are using Pth.  Instead we use a wrapper
    program.  Note that with nPth there is no need for a wrapper. */
@@ -428,7 +435,6 @@ new_reader_slot (void)
 {
   int i, reader = -1;
 
-  npth_mutex_lock (&reader_table_lock);
   for (i=0; i < MAX_READER; i++)
     if (!reader_table[i].used)
       {
@@ -436,7 +442,6 @@ new_reader_slot (void)
         reader_table[reader].used = 1;
         break;
       }
-  npth_mutex_unlock (&reader_table_lock);
 
   if (reader == -1)
     {
@@ -1428,8 +1433,6 @@ static int
 close_pcsc_reader_direct (int slot)
 {
   pcsc_release_context (reader_table[slot].pcsc.context);
-  xfree (reader_table[slot].rdrname);
-  reader_table[slot].rdrname = NULL;
   return 0;
 }
 #endif /*!NEED_PCSC_WRAPPER*/
@@ -2432,7 +2435,6 @@ static int
 close_ccid_reader (int slot)
 {
   ccid_close_reader (reader_table[slot].ccid.handle);
-  reader_table[slot].rdrname = NULL;
   return 0;
 }
 
@@ -2566,7 +2568,7 @@ ccid_pinpad_operation (int slot, int class, int ins, int p0, int p1,
 
 /* Open the reader and try to read an ATR.  */
 static int
-open_ccid_reader (const char *portstr)
+open_ccid_reader (struct dev_list *dl)
 {
   int err;
   int slot;
@@ -2577,8 +2579,8 @@ open_ccid_reader (const char *portstr)
     return -1;
   slotp = reader_table + slot;
 
-  err = ccid_open_reader (&slotp->ccid.handle, portstr,
-                          (const char **)&slotp->rdrname);
+  err = ccid_open_reader (dl->portstr, dl->idx, dl->ccid_table,
+                          &slotp->ccid.handle, &slotp->rdrname);
   if (err)
     {
       slotp->used = 0;
@@ -2611,12 +2613,7 @@ open_ccid_reader (const char *portstr)
   unlock_slot (slot);
   return slot;
 }
-
-
-
 #endif /* HAVE_LIBUSB */
-
-
 

 #ifdef USE_G10CODE_RAPDU
 /*
@@ -2919,63 +2916,80 @@ open_rapdu_reader (int portno,
 /*
        Driver Access
  */
+gpg_error_t
+apdu_dev_list_start (const char *portstr, struct dev_list **l_p)
+{
+  gpg_error_t err;
+  struct dev_list *dl = xtrymalloc (sizeof (struct dev_list));
 
+  *l_p = NULL;
+  if (!dl)
+    return gpg_error_from_syserror ();
 
-/* Open the reader and return an internal slot number or -1 on
-   error. If PORTSTR is NULL we default to a suitable port (for ctAPI:
-   the first USB reader.  For PC/SC the first listed reader). */
-int
-apdu_open_reader (const char *portstr)
-{
-  static int pcsc_api_loaded, ct_api_loaded;
-  int slot;
+  dl->portstr = portstr;
+  dl->idx = 0;
 
-  if (DBG_READER)
-    log_debug ("enter: apdu_open_reader: portstr=%s\n", portstr);
+  npth_mutex_lock (&reader_table_lock);
 
 #ifdef HAVE_LIBUSB
-  if (!opt.disable_ccid)
+  if (opt.disable_ccid)
     {
-      static int once_available;
-      int i;
-      const char *s;
-
-      slot = open_ccid_reader (portstr);
-      if (slot != -1)
-        {
-          once_available = 1;
-          if (DBG_READER)
-            log_debug ("leave: apdu_open_reader => slot=%d [ccid]\n", slot);
-          return slot; /* got one */
-        }
+      dl->ccid_table = NULL;
+      dl->idx_max = 1;
+    }
+  else
+    {
+      err = ccid_dev_scan (&dl->idx_max, &dl->ccid_table);
+      if (err)
+        return err;
 
-      /* If we ever loaded successfully loaded a CCID reader we never
-         want to fallback to another driver.  This solves a problem
-         where ccid was used, the card unplugged and then scdaemon
-         tries to find a new reader and will eventually try PC/SC over
-         and over again.  To reset this flag "gpgconf --kill scdaemon"
-         can be used.  */
-      if (once_available)
+      if (dl->idx_max == 0)
         {
-          if (DBG_READER)
-            log_debug ("leave: apdu_open_reader => slot=-1 (once_avail)\n");
-          return -1;
-        }
-
-      /* If a CCID reader specification has been given, the user does
-         not want a fallback to other drivers. */
-      if (portstr)
-        for (s=portstr, i=0; *s; s++)
-          if (*s == ':' && (++i == 3))
+          /* If a CCID reader specification has been given, the user does
+             not want a fallback to other drivers. */
+          if (portstr && strlen (portstr) > 5 && portstr[4] == ':')
             {
               if (DBG_READER)
                 log_debug ("leave: apdu_open_reader => slot=-1 (no ccid)\n");
-              return -1;
+
+              xfree (dl);
+              npth_mutex_unlock (&reader_table_lock);
+              return gpg_error (GPG_ERR_ENODEV);
             }
+          else
+            dl->idx_max = 1;
+        }
     }
-
+#else
+  dl->ccid_table = NULL;
+  dl->idx_max = 1;
 #endif /* HAVE_LIBUSB */
 
+  *l_p = dl;
+  return 0;
+}
+
+void
+apdu_dev_list_finish (struct dev_list *dl)
+{
+  ccid_dev_scan_finish (dl->ccid_table, dl->idx_max);
+  xfree (dl);
+  npth_mutex_unlock (&reader_table_lock);
+}
+
+
+/* Open the reader and return an internal slot number or -1 on
+   error. If PORTSTR is NULL we default to a suitable port (for ctAPI:
+   the first USB reader.  For PC/SC the first listed reader). */
+static int
+apdu_open_one_reader (const char *portstr)
+{
+  static int pcsc_api_loaded, ct_api_loaded;
+  int slot;
+
+  if (DBG_READER)
+    log_debug ("enter: apdu_open_reader: portstr=%s\n", portstr);
+
   if (opt.ctapi_driver && *opt.ctapi_driver)
     {
       int port = portstr? atoi (portstr) : 32768;
@@ -3005,7 +3019,6 @@ apdu_open_reader (const char *portstr)
       return open_ct_reader (port);
     }
 
-
   /* No ctAPI configured, so lets try the PC/SC API */
   if (!pcsc_api_loaded)
     {
@@ -3099,6 +3112,96 @@ apdu_open_reader (const char *portstr)
   return slot;
 }
 
+int
+apdu_open_reader (struct dev_list *dl)
+{
+  int slot;
+
+  if (dl->ccid_table)
+    { /* CCID readers.  */
+      int readerno;
+
+      /* See whether we want to use the reader ID string or a reader
+         number. A readerno of -1 indicates that the reader ID string is
+         to be used. */
+      if (dl->portstr && strchr (dl->portstr, ':'))
+        readerno = -1; /* We want to use the readerid.  */
+      else if (dl->portstr)
+        {
+          readerno = atoi (dl->portstr);
+          if (readerno < 0)
+            {
+              return -1;
+            }
+        }
+      else
+        readerno = 0;  /* Default. */
+
+      if (readerno > 0)
+        { /* Use single, the specific reader.  */
+          if (readerno >= dl->idx_max)
+            return -1;
+
+          dl->idx = readerno;
+          dl->portstr = NULL;
+          slot = open_ccid_reader (dl);
+          dl->idx = dl->idx_max;
+          if (slot >= 0)
+            return slot;
+          else
+            return -1;
+        }
+
+      while (dl->idx < dl->idx_max)
+        {
+          unsigned int bai = ccid_get_BAI (dl->idx, dl->ccid_table);
+
+          if (DBG_READER)
+            log_debug ("apdu_open_reader: BAI=%x\n", bai);
+
+          /* Check identity by BAI against already opened HANDLEs.  */
+          for (slot = 0; slot < MAX_READER; slot++)
+            if (reader_table[slot].used
+                && ccid_compare_BAI (reader_table[slot].ccid.handle, bai))
+              break;
+
+          if (slot == MAX_READER)
+            { /* Found a new device.  */
+              if (DBG_READER)
+                log_debug ("apdu_open_reader: new device=%x\n", bai);
+
+              slot = open_ccid_reader (dl);
+
+              dl->idx++;
+              if (slot >= 0)
+                return slot;
+              else
+                {
+                  /* Skip this reader.  */
+                  log_error ("ccid open error: skip\n");
+                  continue;
+                }
+            }
+          else
+            dl->idx++;
+        }
+
+      slot = -1;
+    }
+  else
+    { /* PC/SC readers.  */
+      if (dl->idx++ == 0)
+        slot = apdu_open_one_reader (dl->portstr);
+      else
+        slot = -1;
+    }
+
+  if (DBG_READER)
+    log_debug ("leave: apdu_open_reader => slot=%d [ccid]\n", slot);
+
+  return slot;
+}
+
 
 /* Open an remote reader and return an internal slot number or -1 on
    error. This function is an alternative to apdu_open_reader and used
@@ -3177,6 +3280,8 @@ apdu_close_reader (int slot)
         log_debug ("leave: apdu_close_reader => 0x%x (close_reader)\n", sw);
       return sw;
     }
+  xfree (reader_table[slot].rdrname);
+  reader_table[slot].rdrname = NULL;
   reader_table[slot].used = 0;
   if (DBG_READER)
     log_debug ("leave: apdu_close_reader => SW_HOST_NOT_SUPPORTED\n");
@@ -3204,6 +3309,8 @@ apdu_prepare_exit (void)
             apdu_disconnect (slot);
             if (reader_table[slot].close_reader)
               reader_table[slot].close_reader (slot);
+            xfree (reader_table[slot].rdrname);
+            reader_table[slot].rdrname = NULL;
             reader_table[slot].used = 0;
           }
       npth_mutex_unlock (&reader_table_lock);
diff --git a/scd/apdu.h b/scd/apdu.h
index 3021cf7..473def5 100644
--- a/scd/apdu.h
+++ b/scd/apdu.h
@@ -74,6 +74,7 @@ enum {
   SW_HOST_ALREADY_CONNECTED = 0x1000f
 };
 
+struct dev_list;
 
 #define SW_EXACT_LENGTH_P(a) (((a)&~0xff) == SW_EXACT_LENGTH)
 
@@ -86,8 +87,11 @@ enum {
 
 gpg_error_t apdu_init (void);
 
+gpg_error_t apdu_dev_list_start (const char *portstr, struct dev_list **l_p);
+void apdu_dev_list_finish (struct dev_list *l);
+
 /* Note, that apdu_open_reader returns no status word but -1 on error. */
-int apdu_open_reader (const char *portstr);
+int apdu_open_reader (struct dev_list *l);
 int apdu_open_remote_reader (const char *portstr,
                              const unsigned char *cookie, size_t length,
                              int (*readfnc) (void *opaque,
@@ -117,9 +121,9 @@ int apdu_reset (int slot);
 int apdu_get_status (int slot, int hang, unsigned int *status);
 int apdu_check_pinpad (int slot, int command, pininfo_t *pininfo);
 int apdu_pinpad_verify (int slot, int class, int ins, int p0, int p1,
-			pininfo_t *pininfo);
+                        pininfo_t *pininfo);
 int apdu_pinpad_modify (int slot, int class, int ins, int p0, int p1,
-			pininfo_t *pininfo);
+                        pininfo_t *pininfo);
 int apdu_send_simple (int slot, int extended_mode,
                       int class, int ins, int p0, int p1,
                       int lc, const char *data);
diff --git a/scd/app-common.h b/scd/app-common.h
index 781bf46..2371818 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -121,6 +121,9 @@ size_t app_help_read_length_of_cert (int slot, int fid, size_t *r_certoff);
 
 
 /*-- app.c --*/
+app_t app_list_start (void);
+void app_list_finish (void);
+
 void app_dump_state (void);
 void application_notify_card_reset (int slot);
 gpg_error_t check_application_conflict (const char *name, app_t app);
diff --git a/scd/app.c b/scd/app.c
index a499724..6db9e27 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -319,22 +319,30 @@ app_new_register (int slot, ctrl_t ctrl, const char *name)
 gpg_error_t
 select_application (ctrl_t ctrl, const char *name, app_t *r_app, int scan)
 {
-  gpg_error_t err;
+  gpg_error_t err = 0;
   app_t app;
-  int slot;
 
   *r_app = NULL;
 
-  if ((scan && !app_top)
-      /* FIXME: Here, we can change code to support multiple readers.
-         For now, we only open a single reader.
-      */
-      || !app_top)
+  if (scan || !app_top)
     {
-      slot = apdu_open_reader (opt.reader_port);
-      if (slot >= 0)
+      struct dev_list *l;
+
+      err = apdu_dev_list_start (opt.reader_port, &l);
+      if (err)
+        return err;
+
+      while (1)
         {
-          int sw = apdu_connect (slot);
+          int slot;
+          int sw;
+
+          slot = apdu_open_reader (l);
+          if (slot < 0)
+            break;
+
+          err = 0;
+          sw = apdu_connect (slot);
 
           if (sw == SW_HOST_CARD_INACTIVE)
             {
@@ -346,23 +354,17 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app, int scan)
             err = 0;
           else
             err = gpg_error (GPG_ERR_ENODEV);
+
+          if (!err)
+            err = app_new_register (slot, ctrl, name);
+          else
+            apdu_close_reader (slot);
         }
-      else
-        err = gpg_error (GPG_ERR_ENODEV);
 
-      if (!err)
-        err = app_new_register (slot, ctrl, name);
-      else
-        apdu_close_reader (slot);
+      apdu_dev_list_finish (l);
     }
-  else
-    err = 0;
-
-  if (!err)
-    app = app_top;
-  else
-    app = NULL;
 
+  app = app_top;
   if (app)
     {
       lock_app (app, ctrl);
@@ -552,8 +554,6 @@ app_write_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
 
   if (!app)
     return gpg_error (GPG_ERR_INV_VALUE);
-  if (!app->ref_count)
-    return gpg_error (GPG_ERR_CARD_NOT_INITIALIZED);
   if (!app->fnc.learn_status)
     return gpg_error (GPG_ERR_UNSUPPORTED_OPERATION);
 
@@ -1071,3 +1071,16 @@ initialize_module_command (void)
 
   return apdu_init ();
 }
+
+app_t
+app_list_start (void)
+{
+  npth_mutex_lock (&app_list_lock);
+  return app_top;
+}
+
+void
+app_list_finish (void)
+{
+  npth_mutex_unlock (&app_list_lock);
+}
diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index 6d81122..5e02628 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -239,12 +239,11 @@ static struct
 struct ccid_driver_s
 {
   libusb_device_handle *idev;
-  char *rid;
   int dev_fd;  /* -1 for USB transport or file descriptor of the
                    transport device. */
+  unsigned int bai;
   unsigned short id_vendor;
   unsigned short id_product;
-  unsigned short bcd_device;
   int ifc_no;
   int ep_bulk_out;
   int ep_bulk_in;
@@ -744,14 +743,13 @@ prepare_special_transport (ccid_driver_t handle)
    Note, that this code is based on the one in lsusb.c of the
    usb-utils package, I wrote on 2003-09-01. -wk. */
 static int
-parse_ccid_descriptor (ccid_driver_t handle,
+parse_ccid_descriptor (ccid_driver_t handle, unsigned short bcd_device,
                        const unsigned char *buf, size_t buflen)
 {
   unsigned int i;
   unsigned int us;
   int have_t1 = 0, have_tpdu=0;
 
-
   handle->nonnull_nad = 0;
   handle->auto_ifsd = 0;
   handle->max_ifsd = 32;
@@ -761,7 +759,7 @@ parse_ccid_descriptor (ccid_driver_t handle,
   handle->auto_param = 0;
   handle->auto_pps = 0;
   DEBUGOUT_3 ("idVendor: %04X  idProduct: %04X  bcdDevice: %04X\n",
-              handle->id_vendor, handle->id_product, handle->bcd_device);
+              handle->id_vendor, handle->id_product, bcd_device);
   if (buflen < 54 || buf[0] < 54)
     {
       DEBUGOUT ("CCID device descriptor is too short\n");
@@ -964,11 +962,11 @@ parse_ccid_descriptor (ccid_driver_t handle,
   */
   if (handle->id_vendor == VENDOR_SCM
       && handle->max_ifsd > 48
-      && (  (handle->id_product == SCM_SCR331   && handle->bcd_device < 0x0516)
-          ||(handle->id_product == SCM_SCR331DI && handle->bcd_device < 0x0620)
-          ||(handle->id_product == SCM_SCR335   && handle->bcd_device < 0x0514)
-          ||(handle->id_product == SCM_SPR532   && handle->bcd_device < 0x0504)
-          ||(handle->id_product == SCM_SCR3320  && handle->bcd_device < 0x0522)
+      && (  (handle->id_product == SCM_SCR331   && bcd_device < 0x0516)
+          ||(handle->id_product == SCM_SCR331DI && bcd_device < 0x0620)
+          ||(handle->id_product == SCM_SCR335   && bcd_device < 0x0514)
+          ||(handle->id_product == SCM_SPR532   && bcd_device < 0x0504)
+          ||(handle->id_product == SCM_SCR3320  && bcd_device < 0x0522)
           ))
     {
       DEBUGOUT ("enabling workaround for buggy SCM readers\n");
@@ -1534,23 +1532,33 @@ ccid_vendor_specific_init (ccid_driver_t handle)
 }
 
 
-/* Open the reader with the internal number READERNO and return a
-   pointer to be used as handle in HANDLE.  Returns 0 on success. */
-int
-ccid_open_reader (ccid_driver_t *handle, const char *readerid,
-                  const char **rdrname_p)
-{
-  int rc = 0;
-  libusb_device_handle *idev = NULL;
-  int dev_fd = -1;
-  char *rid = NULL;
-  unsigned char *ifcdesc_extra = NULL;
+#define MAX_DEVICE 4 /* See MAX_READER in apdu.c.  */
+
+struct ccid_dev_table {
+  int n;                        /* Index to ccid_usb_dev_list */
+  int transport;
+  int interface_number;
+  int setting_number;
+  unsigned char *ifcdesc_extra;
+  int ep_bulk_out;
+  int ep_bulk_in;
+  int ep_intr;
   size_t ifcdesc_extra_len;
-  int readerno;
-  int ifc_no, set_no, ep_bulk_out, ep_bulk_in, ep_intr;
-  struct libusb_device_descriptor desc;
+};
 
-  *handle = NULL;
+static libusb_device **ccid_usb_dev_list;
+static struct ccid_dev_table ccid_dev_table[MAX_DEVICE];
+
+gpg_error_t
+ccid_dev_scan (int *idx_max_p, struct ccid_dev_table **t_p)
+{
+  ssize_t n;
+  libusb_device *dev;
+  int i;
+  int ifc_no;
+  int set_no;
+  int idx = 0;
+  int err = 0;
 
   if (!initialized_usb)
     {
@@ -1558,122 +1566,379 @@ ccid_open_reader (ccid_driver_t *handle, const char *readerid,
       initialized_usb = 1;
     }
 
-  /* See whether we want to use the reader ID string or a reader
-     number. A readerno of -1 indicates that the reader ID string is
-     to be used. */
-  if (readerid && strchr (readerid, ':'))
-    readerno = -1; /* We want to use the readerid.  */
-  else if (readerid)
+  n = libusb_get_device_list (NULL, &ccid_usb_dev_list);
+  for (i = 0; i < n; i++)
+    {
+      struct libusb_config_descriptor *config;
+      struct libusb_device_descriptor desc;
+
+      dev = ccid_usb_dev_list[i];
+
+      if (libusb_get_device_descriptor (dev, &desc))
+        continue;
+
+      if (libusb_get_active_config_descriptor (dev, &config))
+        continue;
+
+      for (ifc_no=0; ifc_no < config->bNumInterfaces; ifc_no++)
+        for (set_no=0; set_no < config->interface[ifc_no].num_altsetting;
+             set_no++)
+          {
+            const struct libusb_interface_descriptor *ifcdesc;
+
+            ifcdesc = &config->interface[ifc_no].altsetting[set_no];
+            /* The second condition is for older SCM SPR 532 who did
+               not know about the assigned CCID class.  The third
+               condition does the same for a Cherry SmartTerminal
+               ST-2000.  Instead of trying to interpret the strings
+               we simply check the product ID. */
+            if (ifcdesc && ifcdesc->extra
+                && ((ifcdesc->bInterfaceClass == 11
+                     && ifcdesc->bInterfaceSubClass == 0
+                     && ifcdesc->bInterfaceProtocol == 0)
+                    || (ifcdesc->bInterfaceClass == 255
+                        && desc.idVendor == VENDOR_SCM
+                        && desc.idProduct == SCM_SPR532)
+                    || (ifcdesc->bInterfaceClass == 255
+                        && desc.idVendor == VENDOR_CHERRY
+                        && desc.idProduct == CHERRY_ST2000)))
+              {
+                /* Found a reader.  */
+                unsigned char *ifcdesc_extra;
+
+                ifcdesc_extra = malloc (ifcdesc->extra_length);
+                if (!ifcdesc_extra)
+                  {
+                    err = gpg_error_from_syserror ();
+                    libusb_free_config_descriptor (config);
+                    goto scan_finish;
+                  }
+                memcpy (ifcdesc_extra, ifcdesc->extra, ifcdesc->extra_length);
+
+                ccid_dev_table[idx].transport = TRANSPORT_USB;
+                ccid_dev_table[idx].n = i;
+                ccid_dev_table[idx].interface_number = ifc_no;
+                ccid_dev_table[idx].setting_number = set_no;
+                ccid_dev_table[idx].ifcdesc_extra = ifcdesc_extra;
+                ccid_dev_table[idx].ifcdesc_extra_len = ifcdesc->extra_length;
+                ccid_dev_table[idx].ep_bulk_out = find_endpoint (ifcdesc, 0);
+                ccid_dev_table[idx].ep_bulk_in = find_endpoint (ifcdesc, 1);
+                ccid_dev_table[idx].ep_intr = find_endpoint (ifcdesc, 2);
+
+                idx++;
+                if (idx >= MAX_DEVICE)
+                  {
+                    libusb_free_config_descriptor (config);
+                    err = 0;
+                    goto scan_finish;
+                  }
+              }
+          }
+
+      libusb_free_config_descriptor (config);
+    }
+
+  /* Now check whether there are any devices with special transport types. */
+  for (i=0; transports[i].name; i++)
     {
-      readerno = atoi (readerid);
-      if (readerno < 0)
+      if (access (transports[i].name, (R_OK|W_OK)) == 0)
         {
-          DEBUGOUT ("no CCID readers found\n");
-          rc = CCID_DRIVER_ERR_NO_READER;
-          goto leave;
+          /* Found a device. */
+          DEBUGOUT_1 ("Found CCID reader %d\n", idx);
+
+          ccid_dev_table[idx].transport = TRANSPORT_CM4040;
+          ccid_dev_table[idx].n = i;
+          ccid_dev_table[idx].interface_number = 0;
+          ccid_dev_table[idx].setting_number = 0;
+          ccid_dev_table[idx].ifcdesc_extra = NULL;
+          ccid_dev_table[idx].ifcdesc_extra_len = 0;
+          ccid_dev_table[idx].ep_bulk_out = 0;
+          ccid_dev_table[idx].ep_bulk_in = 0;
+          ccid_dev_table[idx].ep_intr = 0;
+
+          idx++;
+          if (idx >= MAX_DEVICE)
+            goto scan_finish;
         }
     }
-  else
-    readerno = 0;  /* Default. */
 
-  if (scan_or_find_devices (readerno, readerid, &rid, &desc, &ifcdesc_extra,
-                            &ifcdesc_extra_len, &ifc_no, &set_no, &ep_bulk_out,
-                            &ep_bulk_in, &ep_intr, &idev, &dev_fd))
+ scan_finish:
+
+  if (err)
+    {
+      *idx_max_p = 0;
+      *t_p = NULL;
+      for (i = 0; i < idx; i++)
+        {
+          free (ccid_dev_table[idx].ifcdesc_extra);
+          ccid_dev_table[idx].transport = 0;
+          ccid_dev_table[idx].n = 0;
+          ccid_dev_table[idx].interface_number = 0;
+          ccid_dev_table[idx].setting_number = 0;
+          ccid_dev_table[idx].ifcdesc_extra = NULL;
+          ccid_dev_table[idx].ifcdesc_extra_len = 0;
+          ccid_dev_table[idx].ep_bulk_out = 0;
+          ccid_dev_table[idx].ep_bulk_in = 0;
+          ccid_dev_table[idx].ep_intr = 0;
+        }
+      libusb_free_device_list (ccid_usb_dev_list, 1);
+      ccid_usb_dev_list = NULL;
+    }
+  else
     {
-      if (readerno == -1)
-        DEBUGOUT_1 ("no CCID reader with ID %s\n", readerid );
+      *idx_max_p = idx;
+      if (idx)
+        *t_p = ccid_dev_table;
       else
-        DEBUGOUT_1 ("no CCID reader with number %d\n", readerno );
-      rc = CCID_DRIVER_ERR_NO_READER;
-      goto leave;
+        *t_p = NULL;
     }
 
-  /* Okay, this is a CCID reader. */
-  *handle = calloc (1, sizeof **handle);
-  if (!*handle)
+  return err;
+}
+
+void
+ccid_dev_scan_finish (struct ccid_dev_table *tbl, int max)
+{
+  int i;
+
+  for (i = 0; i < max; i++)
     {
-      DEBUGOUT ("out of memory\n");
-      rc = CCID_DRIVER_ERR_OUT_OF_CORE;
-      goto leave;
+      free (tbl[i].ifcdesc_extra);
+      tbl[i].transport = 0;
+      tbl[i].n = 0;
+      tbl[i].interface_number = 0;
+      tbl[i].setting_number = 0;
+      tbl[i].ifcdesc_extra = NULL;
+      tbl[i].ifcdesc_extra_len = 0;
+      tbl[i].ep_bulk_out = 0;
+      tbl[i].ep_bulk_in = 0;
+      tbl[i].ep_intr = 0;
     }
-  (*handle)->rid = rid;
-  if (idev) /* Regular USB transport. */
+  libusb_free_device_list (ccid_usb_dev_list, 1);
+  ccid_usb_dev_list = NULL;
+}
+
+unsigned int
+ccid_get_BAI (int idx, struct ccid_dev_table *tbl)
+{
+  int n;
+  int bus, addr, intf;
+  unsigned int bai;
+
+  if (tbl[idx].transport == TRANSPORT_USB)
     {
-      (*handle)->idev = idev;
-      (*handle)->dev_fd = -1;
-      (*handle)->id_vendor = desc.idVendor;
-      (*handle)->id_product = desc.idProduct;
-      (*handle)->bcd_device = desc.bcdDevice;
-      (*handle)->ifc_no = ifc_no;
-      (*handle)->ep_bulk_out = ep_bulk_out;
-      (*handle)->ep_bulk_in = ep_bulk_in;
-      (*handle)->ep_intr = ep_intr;
+      libusb_device *dev;
+
+      n = tbl[idx].n;
+      dev = ccid_usb_dev_list[n];
+
+      bus = libusb_get_bus_number (dev);
+      addr = libusb_get_device_address (dev);
+      intf = tbl[idx].interface_number;
+      bai = (bus << 16) | (addr << 8) | intf;
     }
-  else if (dev_fd != -1) /* Device transport. */
+  else
     {
-      (*handle)->idev = NULL;
-      (*handle)->dev_fd = dev_fd;
-      (*handle)->id_vendor = 0;  /* Magic vendor for special transport. */
-      (*handle)->id_product = ifc_no; /* Transport type */
-      prepare_special_transport (*handle);
+      n = tbl[idx].n;
+      bai = 0xFFFF0000 | n;
     }
-  else
+
+  return bai;
+}
+
+int
+ccid_compare_BAI (ccid_driver_t handle, unsigned int bai)
+{
+  return handle->bai == bai;
+}
+
+static int
+ccid_open_usb_reader (const char *spec_reader_name,
+                      int idx, struct ccid_dev_table *ccid_table,
+                      ccid_driver_t *handle, char **rdrname_p)
+{
+  libusb_device *dev;
+  libusb_device_handle *idev = NULL;
+  char *rid;
+  int rc = 0;
+  int ifc_no, set_no;
+  struct libusb_device_descriptor desc;
+  int n;
+  int bus, addr;
+  unsigned int bai;
+
+  n = ccid_table[idx].n;
+  ifc_no = ccid_table[idx].interface_number;
+  set_no = ccid_table[idx].setting_number;
+
+  dev = ccid_usb_dev_list[n];
+  bus = libusb_get_bus_number (dev);
+  addr = libusb_get_device_address (dev);
+  bai = (bus << 16) | (addr << 8) | ifc_no;
+
+  rc = libusb_open (dev, &idev);
+  if (rc)
     {
-      assert (!"no transport"); /* Bug. */
+      DEBUGOUT_1 ("usb_open failed: %s\n", libusb_error_name (rc));
+      free (*handle);
+      *handle = NULL;
+      return rc;
     }
 
-  DEBUGOUT_2 ("using CCID reader %d (ID=%s)\n",  readerno, rid );
+  rc = libusb_get_device_descriptor (dev, &desc);
+  if (rc)
+    {
+      libusb_close (idev);
+      free (*handle);
+      *handle = NULL;
+      return rc;
+    }
 
-  if (idev)
+  rid = make_reader_id (idev, desc.idVendor, desc.idProduct,
+                        desc.iSerialNumber);
+
+  /* Check to see if reader name matches the spec.  */
+  if (spec_reader_name
+      && strncmp (rid, spec_reader_name, strlen (spec_reader_name)))
     {
-      if (parse_ccid_descriptor (*handle, ifcdesc_extra, ifcdesc_extra_len))
-        {
-          DEBUGOUT ("device not supported\n");
-          rc = CCID_DRIVER_ERR_NO_READER;
-          goto leave;
-        }
+      DEBUGOUT ("device not matched\n");
+      rc = CCID_DRIVER_ERR_NO_READER;
+      goto leave;
+    }
 
-      rc = libusb_claim_interface (idev, ifc_no);
+  (*handle)->id_vendor = desc.idVendor;
+  (*handle)->id_product = desc.idProduct;
+  (*handle)->idev = idev;
+  (*handle)->dev_fd = -1;
+  (*handle)->bai = bai;
+  (*handle)->ifc_no = ifc_no;
+  (*handle)->ep_bulk_out = ccid_table[idx].ep_bulk_out;
+  (*handle)->ep_bulk_in = ccid_table[idx].ep_bulk_in;
+  (*handle)->ep_intr = ccid_table[idx].ep_intr;
+
+  DEBUGOUT_2 ("using CCID reader %d (ID=%s)\n", idx, rid);
+
+  if (parse_ccid_descriptor (*handle, desc.bcdDevice,
+                             ccid_table[idx].ifcdesc_extra,
+                             ccid_table[idx].ifcdesc_extra_len))
+    {
+      DEBUGOUT ("device not supported\n");
+      rc = CCID_DRIVER_ERR_NO_READER;
+      goto leave;
+    }
+
+  rc = libusb_claim_interface (idev, ifc_no);
+  if (rc)
+    {
+      DEBUGOUT_1 ("usb_claim_interface failed: %d\n", rc);
+      rc = CCID_DRIVER_ERR_CARD_IO_ERROR;
+      goto leave;
+    }
+
+  if (set_no != 0)
+    {
+      rc = libusb_set_interface_alt_setting (idev, ifc_no, set_no);
       if (rc)
         {
-          DEBUGOUT_1 ("usb_claim_interface failed: %d\n", rc);
+          DEBUGOUT_1 ("usb_set_interface_alt_setting failed: %d\n", rc);
           rc = CCID_DRIVER_ERR_CARD_IO_ERROR;
           goto leave;
         }
-
-      if (set_no != 0)
-        {
-          rc = libusb_set_interface_alt_setting (idev, ifc_no, set_no);
-          if (rc)
-            {
-              DEBUGOUT_1 ("usb_set_interface_alt_setting failed: %d\n", rc);
-              rc = CCID_DRIVER_ERR_CARD_IO_ERROR;
-              goto leave;
-            }
-        }
     }
 
   rc = ccid_vendor_specific_init (*handle);
 
  leave:
-  free (ifcdesc_extra);
   if (rc)
     {
       free (rid);
-      if (idev)
-        libusb_close (idev);
-      if (dev_fd != -1)
-        close (dev_fd);
+      libusb_close (idev);
       free (*handle);
       *handle = NULL;
     }
   else
-    if (rdrname_p)
-      *rdrname_p = (*handle)->rid;
+    {
+      if (rdrname_p)
+        *rdrname_p = rid;
+      else
+        free (rid);
+    }
 
   return rc;
 }
 
+/* Open the reader with the internal number READERNO and return a
+   pointer to be used as handle in HANDLE.  Returns 0 on success. */
+int
+ccid_open_reader (const char *spec_reader_name,
+                  int idx, struct ccid_dev_table *ccid_table,
+                  ccid_driver_t *handle, char **rdrname_p)
+{
+  int n;
+  int fd;
+  char *rid;
+
+  *handle = calloc (1, sizeof **handle);
+  if (!*handle)
+    {
+      DEBUGOUT ("out of memory\n");
+      return CCID_DRIVER_ERR_OUT_OF_CORE;
+    }
+
+  if (ccid_table[idx].transport == TRANSPORT_USB)
+    return ccid_open_usb_reader (spec_reader_name, idx, ccid_table,
+                                 handle, rdrname_p);
+
+  /* Special transport support.  */
+
+  n = ccid_table[idx].n;
+  fd = open (transports[n].name, O_RDWR);
+  if (fd < 0)
+    {
+      DEBUGOUT_2 ("failed to open '%s': %s\n",
+                  transports[n].name, strerror (errno));
+      free (*handle);
+      *handle = NULL;
+      return -1;
+    }
+
+  rid = malloc (strlen (transports[n].name) + 30 + 10);
+  if (!rid)
+    {
+      close (fd);
+      free (*handle);
+      *handle = NULL;
+      return -1; /* Error. */
+    }
+
+  sprintf (rid, "0000:%04X:%s:0", transports[n].type, transports[n].name);
+
+  /* Check to see if reader name matches the spec.  */
+  if (spec_reader_name
+      && strncmp (rid, spec_reader_name, strlen (spec_reader_name)))
+    {
+      DEBUGOUT ("device not matched\n");
+      free (rid);
+      close (fd);
+      free (*handle);
+      *handle = NULL;
+      return -1;
+    }
+
+  (*handle)->id_vendor = 0;
+  (*handle)->id_product = transports[n].type;
+  (*handle)->idev = NULL;
+  (*handle)->dev_fd = fd;
+  (*handle)->bai = 0xFFFF0000 | n;
+  prepare_special_transport (*handle);
+  if (rdrname_p)
+    *rdrname_p = rid;
+  else
+    free (rid);
+
+  return 0;
+}
+
 
 static void
 do_close_reader (ccid_driver_t handle)
@@ -1719,7 +1984,7 @@ ccid_set_progress_cb (ccid_driver_t handle,
                       void (*cb)(void *, const char *, int, int, int),
                       void *cb_arg)
 {
-  if (!handle || !handle->rid)
+  if (!handle)
     return CCID_DRIVER_ERR_INV_VALUE;
 
   handle->progress_cb = cb;
@@ -1736,7 +2001,6 @@ ccid_close_reader (ccid_driver_t handle)
     return 0;
 
   do_close_reader (handle);
-  free (handle->rid);
   free (handle);
   return 0;
 }
diff --git a/scd/ccid-driver.h b/scd/ccid-driver.h
index e3aed9f..9e71f5e 100644
--- a/scd/ccid-driver.h
+++ b/scd/ccid-driver.h
@@ -1,5 +1,5 @@
-/* ccid-driver.c - USB ChipCardInterfaceDevices driver
- *	Copyright (C) 2003 Free Software Foundation, Inc.
+/* ccid-driver.h - USB ChipCardInterfaceDevices driver
+ * Copyright (C) 2003 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
@@ -109,10 +109,18 @@ enum {
 struct ccid_driver_s;
 typedef struct ccid_driver_s *ccid_driver_t;
 
+struct ccid_dev_table;
+
 int ccid_set_debug_level (int level);
 char *ccid_get_reader_list (void);
-int ccid_open_reader (ccid_driver_t *handle, const char *readerid,
-                      const char **rdrname_p);
+
+gpg_error_t ccid_dev_scan (int *idx_max, struct ccid_dev_table **t_p);
+void ccid_dev_scan_finish (struct ccid_dev_table *tbl, int max);
+unsigned int ccid_get_BAI (int, struct ccid_dev_table *tbl);
+int ccid_compare_BAI (ccid_driver_t handle, unsigned int);
+int ccid_open_reader (const char *spec_reader_name,
+                      int idx, struct ccid_dev_table *ccid_table,
+                      ccid_driver_t *handle, char **rdrname_p);
 int ccid_set_progress_cb (ccid_driver_t handle,
                           void (*cb)(void *, const char *, int, int, int),
                           void *cb_arg);
@@ -126,7 +134,7 @@ int ccid_transceive (ccid_driver_t handle,
                      unsigned char *resp, size_t maxresplen, size_t *nresp);
 int ccid_transceive_secure (ccid_driver_t handle,
                      const unsigned char *apdu, size_t apdulen,
-		     pininfo_t *pininfo,
+                     pininfo_t *pininfo,
                      unsigned char *resp, size_t maxresplen, size_t *nresp);
 int ccid_transceive_escape (ccid_driver_t handle,
                             const unsigned char *data, size_t datalen,

-----------------------------------------------------------------------

Summary of changes:
 scd/apdu.c        | 219 ++++++++++++++++++-------
 scd/apdu.h        |  10 +-
 scd/app-common.h  |   3 +
 scd/app.c         |  63 +++++---
 scd/ccid-driver.c | 466 ++++++++++++++++++++++++++++++++++++++++++------------
 scd/ccid-driver.h |  18 ++-
 6 files changed, 589 insertions(+), 190 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan  6 02:11:10 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 06 Jan 2017 02:11:10 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-40-g62268a2
Message-ID: <E1cPJ3p-0007z3-0e@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  62268a2732dddca7a05ca4cf45d0e4338c7dc3c4 (commit)
      from  8a41e73c31adb86d4a7dca4da695e5ad1347811f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 62268a2732dddca7a05ca4cf45d0e4338c7dc3c4
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 6 10:07:40 2017 +0900

    scd: Fix for --disable-ccid-driver.
    
    * scd/apdu.c [HAVE_LIBUSB] (apdu_dev_list_start): Conditionalize.
    [HAVE_LIBUSB] (apdu_dev_list_finish, apdu_open_reader): Likewise.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/apdu.c b/scd/apdu.c
index 50363ce..db46c4d 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -2919,7 +2919,6 @@ open_rapdu_reader (int portno,
 gpg_error_t
 apdu_dev_list_start (const char *portstr, struct dev_list **l_p)
 {
-  gpg_error_t err;
   struct dev_list *dl = xtrymalloc (sizeof (struct dev_list));
 
   *l_p = NULL;
@@ -2939,6 +2938,8 @@ apdu_dev_list_start (const char *portstr, struct dev_list **l_p)
     }
   else
     {
+      gpg_error_t err;
+
       err = ccid_dev_scan (&dl->idx_max, &dl->ccid_table);
       if (err)
         return err;
@@ -2972,7 +2973,9 @@ apdu_dev_list_start (const char *portstr, struct dev_list **l_p)
 void
 apdu_dev_list_finish (struct dev_list *dl)
 {
+#ifdef HAVE_LIBUSB
   ccid_dev_scan_finish (dl->ccid_table, dl->idx_max);
+#endif
   xfree (dl);
   npth_mutex_unlock (&reader_table_lock);
 }
@@ -3117,6 +3120,7 @@ apdu_open_reader (struct dev_list *dl)
 {
   int slot;
 
+#ifdef HAVE_LIBUSB
   if (dl->ccid_table)
     { /* CCID readers.  */
       int readerno;
@@ -3189,6 +3193,7 @@ apdu_open_reader (struct dev_list *dl)
       slot = -1;
     }
   else
+#endif
     { /* PC/SC readers.  */
       if (dl->idx++ == 0)
         slot = apdu_open_one_reader (dl->portstr);

-----------------------------------------------------------------------

Summary of changes:
 scd/apdu.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan  6 02:38:31 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 06 Jan 2017 02:38:31 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-41-g858e14c
Message-ID: <E1cPJUH-0000jb-HY@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  858e14cd794e2a6125d51e652a754bbe26def997 (commit)
      from  62268a2732dddca7a05ca4cf45d0e4338c7dc3c4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 858e14cd794e2a6125d51e652a754bbe26def997
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 6 10:35:46 2017 +0900

    scd: Fix for --disable-ccid for scdaemon.
    
    * scd/apdu.c (apdu_dev_list_finish): Don't call ccid_dev_scan_finish
    with no table.
    (apdu_open_reader): Only increment when it's zero.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/apdu.c b/scd/apdu.c
index db46c4d..38ebd2b 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -2974,7 +2974,8 @@ void
 apdu_dev_list_finish (struct dev_list *dl)
 {
 #ifdef HAVE_LIBUSB
-  ccid_dev_scan_finish (dl->ccid_table, dl->idx_max);
+  if (dl->ccid_table)
+    ccid_dev_scan_finish (dl->ccid_table, dl->idx_max);
 #endif
   xfree (dl);
   npth_mutex_unlock (&reader_table_lock);
@@ -3195,15 +3196,15 @@ apdu_open_reader (struct dev_list *dl)
   else
 #endif
     { /* PC/SC readers.  */
-      if (dl->idx++ == 0)
-        slot = apdu_open_one_reader (dl->portstr);
+      if (dl->idx == 0)
+        {
+          dl->idx++;
+          slot = apdu_open_one_reader (dl->portstr);
+        }
       else
         slot = -1;
     }
 
-  if (DBG_READER)
-    log_debug ("leave: apdu_open_reader => slot=%d [ccid]\n", slot);
-
   return slot;
 }
 

-----------------------------------------------------------------------

Summary of changes:
 scd/apdu.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan  6 12:46:09 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Fri, 06 Jan 2017 12:46:09 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-42-ge1f6833
Message-ID: <E1cPSyK-00024D-3M@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e1f68337b979fe4b7c3bd095a83ea832e14efb74 (commit)
      from  858e14cd794e2a6125d51e652a754bbe26def997 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e1f68337b979fe4b7c3bd095a83ea832e14efb74
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Jan 6 12:26:01 2017 +0100

    doc: Document summary values of TOFU_STATS
    
    --
    
    Signed-off-by: Andre Heinecke <aheinecke at intevation.de>

diff --git a/doc/DETAILS b/doc/DETAILS
index 568500e..ac599fc 100644
--- a/doc/DETAILS
+++ b/doc/DETAILS
@@ -761,6 +761,19 @@ pkd:0:1024:B665B1435F4C2 .... FF26ABB:
     takes on value 0.  Instead, if there is a conflict, VALIDITY still
     reflects the key's validity (values: 1-4).
 
+    SUMMARY values use the euclidean distance (m = sqrt(a? + b?)) rather
+    then the sum of the magnitudes (m = a + b) to ensure a balance between
+    verified signatures and encrypted messages.
+
+    Values are calculated based on the number of days where a key was used
+    for verifying a signature or to encrypt to it.
+    The ranges for the values are:
+
+    - 1 :: signature_days + encryption_days == 0
+    - 2 :: 1 <= sqrt(signature_days? + encryption_days?) < 8
+    - 3 :: 8 <= sqrt(signature_days? + encryption_days?) < 42
+    - 4 :: sqrt(signature_days? + encryption_days?) >= 42
+
     SIGN-COUNT and ENCRYPTION-COUNT are the number of messages that we
     have seen that have been signed by this key / encryption to this
     key.

-----------------------------------------------------------------------

Summary of changes:
 doc/DETAILS | 13 +++++++++++++
 1 file changed, 13 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan  6 13:35:50 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Fri, 06 Jan 2017 13:35:50 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-237-g3cfdd11
Message-ID: <E1cPTkO-0004gf-7s@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  3cfdd110a195ed02059d533d43fdb66da56d1852 (commit)
      from  474f02a9278b8755bd99ba79fa018212be08baf1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3cfdd110a195ed02059d533d43fdb66da56d1852
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Jan 6 13:32:21 2017 +0100

    Update crypto summary and lvl2 icon
    
    * src/dialogs.rc: Use the same icon for lvl2 and 3
    * src/mail.cpp (Mail::get_crypto_summary): Change wording.
    (Mail::get_crypto_summary): Fix comment.
    (Mail::get_crypto_one_line): New. Move one liner also into
    mail class.
    (Mail::get_crypto_details): Minor wording change.
    * src/mail.h: Update accordingly.
    * src/ribbon-callbacks.cpp (get_sig_ttip): Use one liner funct.
    
    --
    The difference between trusted / certified highly trusted
    is more confusing then just using "Level" imo. Different
    security levels are a real world concept and are hopefully
    understandable.

diff --git a/src/dialogs.rc b/src/dialogs.rc
index ba8cb8c..a99eee3 100644
--- a/src/dialogs.rc
+++ b/src/dialogs.rc
@@ -54,12 +54,14 @@ IDI_ENCSIGN_FILE_48_PNG   RCDATA               "icons/encrypt-sign-file-48.png"
 
 IDI_LEVEL_0_ENC             RCDATA             "icons/level-0-enc.png"
 IDI_LEVEL_1_ENC             RCDATA             "icons/level-1-enc.png"
-IDI_LEVEL_2_ENC             RCDATA             "icons/level-2-enc.png"
+
+/* We use the same icon for level 2 and 3 */
+IDI_LEVEL_2_ENC             RCDATA             "icons/level-3-enc.png"
 IDI_LEVEL_3_ENC             RCDATA             "icons/level-3-enc.png"
 IDI_LEVEL_4_ENC             RCDATA             "icons/level-4-enc.png"
 IDI_LEVEL_0                 RCDATA             "icons/level-0.png"
 IDI_LEVEL_1                 RCDATA             "icons/level-1.png"
-IDI_LEVEL_2                 RCDATA             "icons/level-2.png"
+IDI_LEVEL_2                 RCDATA             "icons/level-3.png"
 IDI_LEVEL_3                 RCDATA             "icons/level-3.png"
 IDI_LEVEL_4                 RCDATA             "icons/level-4.png"
 
diff --git a/src/mail.cpp b/src/mail.cpp
index 71eec62..95df6fd 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1474,21 +1474,29 @@ Mail::get_crypto_summary ()
   const int level = get_signature_level ();
 
   bool enc = is_encrypted ();
-  if (level > 3 && enc)
+  if (level == 4 && enc)
     {
-      return _("Highly Secure");
+      return _("Security Level 4");
     }
-  if (level > 3)
+  if (level == 4)
+    {
+      return _("Trust Level 4");
+    }
+  if (level == 3 && enc)
+    {
+      return _("Security Level 3");
+    }
+  if (level == 3)
     {
-      return _("Highly Trusted");
+      return _("Trust Level 3");
     }
-  if (level >= 2 && enc)
+  if (level == 2 && enc)
     {
-      return _("Secure");
+      return _("Security Level 2");
     }
-  if (level >= 2)
+  if (level == 2)
     {
-      return _("Trusted");
+      return _("Trust Level 2");
     }
   if (enc)
     {
@@ -1499,13 +1507,37 @@ Mail::get_crypto_summary ()
       /* Even if it is signed, if it is not validly
          signed it's still completly insecure as anyone
          could have signed this. So we avoid the label
-         "signed" here as this already leaves */
+         "signed" here as this word already implies some
+         security. */
       return _("Insecure");
     }
   return _("Insecure");
 }
 
 std::string
+Mail::get_crypto_one_line()
+{
+  bool sig = is_signed ();
+  bool enc = is_encrypted ();
+  if (sig || enc)
+    {
+      if (sig && enc)
+        {
+          return _("Signed and encrypted message");
+        }
+      else if (sig)
+        {
+          return _("Signed message");
+        }
+      else if (enc)
+        {
+          return _("Encrypted message");
+        }
+    }
+  return _("Insecure message");
+}
+
+std::string
 Mail::get_crypto_details()
 {
   /* Handle encrypt only */
@@ -1586,7 +1618,7 @@ Mail::get_crypto_details()
       char *time = format_date_from_gpgme (first_contact);
       /* i18n note signcount is always pulral because with signcount 1 we
        * would not be in this branch. */
-      gpgrt_asprintf (&buf, _("The senders address is trustworthy, because "
+      gpgrt_asprintf (&buf, _("The senders address is trusted, because "
                               "you have established a communication history "
                               "with this address starting on %s.\n"
                               "You encrypted %i and verified %i messages since."),
diff --git a/src/mail.h b/src/mail.h
index 0767df4..bba161a 100644
--- a/src/mail.h
+++ b/src/mail.h
@@ -260,6 +260,10 @@ public:
     crypto state of this mail. */
   std::string get_crypto_details ();
 
+  /** Returns a localized string describing a one line
+    summary of the crypto state. */
+  std::string get_crypto_one_line ();
+
   /** Get the icon id of the appropiate icon for this mail */
   int get_crypto_icon_id () const;
 
diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index 3817184..503c773 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1552,20 +1552,9 @@ HRESULT get_sig_ttip (LPDISPATCH ctrl, VARIANT *result)
 
   result->vt = VT_BSTR;
   wchar_t *w_result;
-  if (mail && (mail->is_signed () || mail->is_encrypted ()))
+  if (mail)
     {
-      if (mail->is_signed () && mail->is_encrypted ())
-        {
-          w_result = utf8_to_wchar (_("Signed and encrypted message"));
-        }
-      else if (mail->is_signed ())
-        {
-          w_result = utf8_to_wchar (_("Signed message"));
-        }
-      else if (mail->is_encrypted ())
-        {
-          w_result = utf8_to_wchar (_("Encrypted message"));
-        }
+      w_result = utf8_to_wchar (mail->get_crypto_one_line().c_str());
     }
   else
     {

-----------------------------------------------------------------------

Summary of changes:
 src/dialogs.rc           |  6 ++++--
 src/mail.cpp             | 52 ++++++++++++++++++++++++++++++++++++++----------
 src/mail.h               |  4 ++++
 src/ribbon-callbacks.cpp | 15 ++------------
 4 files changed, 52 insertions(+), 25 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan  6 15:12:00 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Fri, 06 Jan 2017 15:12:00 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-238-gabaca16
Message-ID: <E1cPVFS-0000Vb-4P@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  abaca16b9019781359c105944ea22adf3f6fa4c8 (commit)
      from  3cfdd110a195ed02059d533d43fdb66da56d1852 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit abaca16b9019781359c105944ea22adf3f6fa4c8
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Jan 6 15:09:07 2017 +0100

    Warn if partial crypto with attachments is found
    
    * src/mail.cpp (Mail::check_attachments): Check if
    all attachments are hidden and warn otherwise.
    (Mail::parsing_done): Call check_attachments.
    * src/mail.h: Update accordingly.
    * src/oomhelp.p: Add new DASL.
    
    --
    This is important for inline Crypto mails where Attachments
    may not have been signed or encrypted.
    
    For MIME Mails we don't have the problem as we only handle
    Crypto MIME Mails if the top level mime part is a crypto part
    and so everything is crypto or not.

diff --git a/src/mail.cpp b/src/mail.cpp
index 95df6fd..5fed0f6 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -258,6 +258,89 @@ get_attachment (LPDISPATCH mailitem, int pos)
   return attachment;
 }
 
+/** Helper to check that all attachments are hidden, to be
+  called before crypto. */
+int
+Mail::check_attachments () const
+{
+  LPDISPATCH attachments = get_oom_object (m_mailitem, "Attachments");
+  if (!attachments)
+    {
+      log_debug ("%s:%s: Failed to get attachments.",
+                 SRCNAME, __func__);
+      return 1;
+    }
+  int count = get_oom_int (attachments, "Count");
+  if (!count)
+    {
+      gpgol_release (attachments);
+      return 0;
+    }
+
+  std::string message;
+
+  if (is_encrypted () && is_signed ())
+    {
+      message += _("Not all attachments were encrypted or signed.\n"
+                   "The unsigned / unencrypted attachments are:\n\n");
+    }
+  else if (is_signed ())
+    {
+      message += _("Not all attachments were signed.\n"
+                   "The unsigned attachments are:\n\n");
+    }
+  else if (is_encrypted ())
+    {
+      message += _("Not all attachments were encrypted.\n"
+                   "The unencrypted attachments are:\n\n");
+    }
+  else
+    {
+      gpgol_release (attachments);
+      return 0;
+    }
+
+  bool foundOne = false;
+
+  for (int i = 1; i <= count; i++)
+    {
+      std::string item_str;
+      item_str = std::string("Item(") + std::to_string (i) + ")";
+      LPDISPATCH oom_attach = get_oom_object (attachments, item_str.c_str ());
+      if (!oom_attach)
+        {
+          log_error ("%s:%s: Failed to get attachment.",
+                     SRCNAME, __func__);
+          continue;
+        }
+      VARIANT var;
+      VariantInit (&var);
+      if (get_pa_variant (oom_attach, PR_ATTACHMENT_HIDDEN_DASL, &var) ||
+          (var.vt == VT_BOOL && var.boolVal == VARIANT_FALSE))
+        {
+          foundOne = true;
+          message += get_oom_string (oom_attach, "DisplayName");
+          message += "\n";
+        }
+      VariantClear (&var);
+      gpgol_release (oom_attach);
+    }
+  if (foundOne)
+    {
+      message += "\n";
+      message += _("Note: The attachments may be encrypted or signed "
+                    "on a file level but the GpgOL status does not apply to them.");
+      wchar_t *wmsg = utf8_to_wchar (message.c_str ());
+      wchar_t *wtitle = utf8_to_wchar (_("GpgOL Warning"));
+      MessageBoxW (get_active_hwnd (), wmsg, wtitle,
+                   MB_ICONWARNING|MB_OK);
+      xfree (wmsg);
+      xfree (wtitle);
+    }
+  gpgol_release (attachments);
+  return 0;
+}
+
 /** Get the cipherstream of the mailitem. */
 static LPSTREAM
 get_attachment_stream (LPDISPATCH mailitem, int pos)
@@ -730,6 +813,9 @@ Mail::parsing_done()
   update_body();
   TRACEPOINT;
 
+  /* Check that there are no unsigned / unencrypted messages. */
+  check_attachments ();
+
   /* Update attachments */
   if (add_attachments (m_mailitem, m_parser->get_attachments()))
     {
diff --git a/src/mail.h b/src/mail.h
index bba161a..b61569c 100644
--- a/src/mail.h
+++ b/src/mail.h
@@ -320,6 +320,10 @@ public:
     https://wiki.gnupg.org/EasyGpg2016/AutomatedEncryption for
     a definition of the levels. */
   int get_signature_level () const;
+
+  /** Check if all attachments are hidden and show a warning
+    message appropiate to the crypto state if necessary. */
+  int check_attachments () const;
 private:
   void update_categories ();
   void update_body ();
diff --git a/src/oomhelp.h b/src/oomhelp.h
index 3914f5e..3c94c3b 100644
--- a/src/oomhelp.h
+++ b/src/oomhelp.h
@@ -84,6 +84,11 @@ DEFINE_OLEGUID(IID_IOleWindow,                0x00000114, 0, 0);
   "http://schemas.microsoft.com/mapi/proptag/0x39FE001E"
 #endif
 
+#ifndef PR_ATTACHMENT_HIDDEN_DASL
+#define PR_ATTACHMENT_HIDDEN_DASL \
+  "http://schemas.microsoft.com/mapi/proptag/0x7FFE000B"
+#endif
+
 #define PR_MESSAGE_CLASS_W_DASL \
   "http://schemas.microsoft.com/mapi/proptag/0x001A001F"
 #define GPGOL_ATTACHTYPE_DASL \

-----------------------------------------------------------------------

Summary of changes:
 src/mail.cpp  | 86 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 src/mail.h    |  4 +++
 src/oomhelp.h |  5 ++++
 3 files changed, 95 insertions(+)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan  6 18:50:50 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 06 Jan 2017 18:50:50 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-43-g8d77490
Message-ID: <E1cPYfF-0002GS-Bv@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  8d774904c8066d8c0f19cfffe2d568979bb8c470 (commit)
      from  e1f68337b979fe4b7c3bd095a83ea832e14efb74 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8d774904c8066d8c0f19cfffe2d568979bb8c470
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jan 6 18:45:14 2017 +0100

    agent,w32: Fix annoying output to DebugView.
    
    * agent/gpg-agent.c (startup_fd_list): Do not define for W32.
    (main) [W32]: Do not call get_all_open_fds.
    --
    
    GnuPG-bug-id: 2267
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
index f4ed6c5..724b55a 100644
--- a/agent/gpg-agent.c
+++ b/agent/gpg-agent.c
@@ -303,8 +303,10 @@ static int putty_support;
 #endif /*HAVE_W32_SYSTEM*/
 
 /* The list of open file descriptors at startup.  Note that this list
-   has been allocated using the standard malloc.  */
+ * has been allocated using the standard malloc.  */
+#ifndef HAVE_W32_SYSTEM
 static int *startup_fd_list;
+#endif
 
 /* The signal mask at startup and a flag telling whether it is valid.  */
 #ifdef HAVE_SIGPROCMASK
@@ -949,8 +951,10 @@ main (int argc, char **argv )
 
   /* Before we do anything else we save the list of currently open
      file descriptors and the signal mask.  This info is required to
-     do the exec call properly. */
+     do the exec call properly.  We don't need it on Windows.  */
+#ifndef HAVE_W32_SYSTEM
   startup_fd_list = get_all_open_fds ();
+#endif /*!HAVE_W32_SYSTEM*/
 #ifdef HAVE_SIGPROCMASK
   if (!sigprocmask (SIG_UNBLOCK, NULL, &startup_signal_mask))
     startup_signal_mask_valid = 1;
diff --git a/common/exechelp-w32.c b/common/exechelp-w32.c
index a7a6db3..e79ee5b 100644
--- a/common/exechelp-w32.c
+++ b/common/exechelp-w32.c
@@ -128,11 +128,14 @@ close_all_fds (int first, int *except)
 
 
 /* Returns an array with all currently open file descriptors.  The end
-   of the array is marked by -1.  The caller needs to release this
-   array using the *standard free* and not with xfree.  This allow the
-   use of this function right at startup even before libgcrypt has
-   been initialized.  Returns NULL on error and sets ERRNO
-   accordingly.  */
+ * of the array is marked by -1.  The caller needs to release this
+ * array using the *standard free* and not with xfree.  This allow the
+ * use of this function right at startup even before libgcrypt has
+ * been initialized.  Returns NULL on error and sets ERRNO
+ * accordingly.  Note that fstat prints a warning to DebugView for all
+ * invalid fds which is a bit annoying.  We actually do not need this
+ * function in real code (close_all_fds is a dummy anyway) but we keep
+ * it for use by t-exechelp.c.  */
 int *
 get_all_open_fds (void)
 {

-----------------------------------------------------------------------

Summary of changes:
 agent/gpg-agent.c     |  8 ++++++--
 common/exechelp-w32.c | 13 ++++++++-----
 2 files changed, 14 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan  6 19:33:24 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 06 Jan 2017 19:33:24 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 537908a28758e0816ed956182a6a84981764401e
Message-ID: <E1cPZKP-00041f-VU@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  537908a28758e0816ed956182a6a84981764401e (commit)
      from  f505be91d601062afeb7f7f6ebdb68562931f8d2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 537908a28758e0816ed956182a6a84981764401e
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jan 6 19:31:13 2017 +0100

    bugs.gnupg.org: Updated topics list

diff --git a/misc/bugs.gnupg.org/index.html b/misc/bugs.gnupg.org/index.html
index 47cf93f..d68d9ad 100644
--- a/misc/bugs.gnupg.org/index.html
+++ b/misc/bugs.gnupg.org/index.html
@@ -149,7 +149,7 @@ You should follow these steps to enter a new bug (issue):
 
 <hr>
 <div><font size="-1"> Contact information available at the <a
-href="http://www.g10code.com">g10 Code main pages</a>.
+href="https://www.g10code.com">g10 Code main pages</a>.
 <p>
 Copyright (C) 2006 g10 Code GmbH, Erkrath-Hochdahl.<br>
 Verbatim copying and distribution of this entire article is
diff --git a/misc/bugs.gnupg.org/roundup-topics.html b/misc/bugs.gnupg.org/roundup-topics.html
index 208707d..d78cf28 100644
--- a/misc/bugs.gnupg.org/roundup-topics.html
+++ b/misc/bugs.gnupg.org/roundup-topics.html
@@ -60,7 +60,7 @@ clear.  This list shall help to make sensible use of the keywords.
     <tr><td>asm</td>       <td>Problem with low-level assembler code
                            </td></tr>
     <tr><td>cross</td>     <td>Bug pertaining to cross-compiling</td></tr>
-    <tr><td>osx</td>       <td>Mac OS/X specific problem</td></tr>
+    <tr><td>macos</td>     <td>MacOS specific problem</td></tr>
     <tr><td>w32</td>       <td>MS Windows specific problem</td></tr>
     <tr><td>w64</td>       <td>MS Windows 64 bit specific problem</td></tr>
   </tbody>
@@ -74,6 +74,8 @@ clear.  This list shall help to make sensible use of the keywords.
     <tr><td>faq</td>       <td>This should be made an entry into the
                                FAQ or is already answered there.
                            </td></tr>
+    <tr><td>gpg22</td>     <td>To be fixed for GnuPG 2.2.</td></tr>
+    <tr><td>gpg23</td>     <td>Will be addressed in GnuPG 2.2.</td></tr>
     <tr><td>patch</td>     <td>Patch included</td></tr>
     <tr><td>noinfo</td>    <td>Not enough information given</td></tr>
     <tr><td>notdup</td>    <td>Problem duplicating the bug</td></tr>
@@ -84,6 +86,8 @@ clear.  This list shall help to make sensible use of the keywords.
                                Note that there is also a category of
                                the same name.
                            </td></tr>
+    <tr><td>rc</td>       <td>Release critical report</td></tr>
+
     <tr><td>sillyUB</td> <td>Silly interpretation of undefined
                                behaviour by a compiler.  Needs fix so
                                that gcc et al do not break the
@@ -101,7 +105,7 @@ clear.  This list shall help to make sensible use of the keywords.
 
 <hr>
 <div><font size="-1"> Contact information available at the <a
-href="http://www.g10code.com">g10 Code main pages</a>.
+href="https://www.g10code.com">g10 Code main pages</a>.
 <p>
 Copyright (C) 2006 g10 Code GmbH, Erkrath-Hochdahl.<br>
 Verbatim copying and distribution of this entire article is

-----------------------------------------------------------------------

Summary of changes:
 misc/bugs.gnupg.org/index.html          | 2 +-
 misc/bugs.gnupg.org/roundup-topics.html | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sun Jan  8 18:45:54 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Sun, 08 Jan 2017 18:45:54 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-47-g88dc3af
Message-ID: <E1cQHXa-0001b3-RW@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  88dc3af3d4ae1afe1d5e136bc4c38bc4e7d4cd10 (commit)
       via  714faea4fa7f30d42e9986358214a99aa8fa57b3 (commit)
       via  16078f3deea5b82ea26e2f01dbd3ef3a5ce25410 (commit)
       via  9fa94aa10778bbd680315e93b23175423e338c40 (commit)
      from  8d774904c8066d8c0f19cfffe2d568979bb8c470 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 88dc3af3d4ae1afe1d5e136bc4c38bc4e7d4cd10
Author: Werner Koch <wk at gnupg.org>
Date:   Sun Jan 8 18:42:50 2017 +0100

    dirmngr: Implement experimental SRV record lookup for WKD.
    
    * dirmngr/server.c (cmd_wkd_get): Support SRV records.
    --
    
    This patch changes the way a WKD query is done.  Now we first look for
    a SRV record for service "openpgpkey" and port "tcp" under the
    to-be-queried domain.  If such a record was found and the target host
    matches the to-be-queried domain or is a suffix to that domain, that
    target host is used instead of the domain name.  The SRV record also
    allows to change the port and obviously can be used for
    load-balancing.
    
    For example a query for the submission address of example.org with the
    SRV record specification
    
    _openpgpkey._tcp        IN     SRV   0 0  0    wkd.foo.org.
                            IN     SRV   0 0  0    wkd.example.net.
                            IN     SRV   0 0  4711 wkd.example.org.
    
    (queried using the name "_openpgpkey._tcp.example.org") would fetch
    from this URL:
    
     https://wkd.example.org:4711/.well-known/openpgpkey/submission-address
    
    Note that the first two SRV records won't be used because foo.org and
    example.net do not match example.org.  We require that the target host
    is identical to the domain or be a subdomain of it.  This is so that
    an attacker modifying the SRV records needs to setup a server in a
    sub-domain of the actual domain and can't use an arbitrary domain.
    Whether this is a sufficient requirement is not clear and needs
    further discussion.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/server.c b/dirmngr/server.c
index 28c2cd4..c9c4ad4 100644
--- a/dirmngr/server.c
+++ b/dirmngr/server.c
@@ -826,13 +826,15 @@ cmd_wkd_get (assuan_context_t ctx, char *line)
   ctrl_t ctrl = assuan_get_pointer (ctx);
   gpg_error_t err = 0;
   char *mbox = NULL;
-  char *domain;     /* Points to mbox.  */
+  char *domainbuf = NULL;
+  char *domain;     /* Points to mbox or domainbuf.  */
   char sha1buf[20];
   char *uri = NULL;
   char *encodedhash = NULL;
   int opt_submission_addr;
   int opt_policy_flags;
   int no_log = 0;
+  char portstr[20] = { 0 };
 
   opt_submission_addr = has_option (line, "--submission-address");
   opt_policy_flags = has_option (line, "--policy-flags");
@@ -846,6 +848,50 @@ cmd_wkd_get (assuan_context_t ctx, char *line)
     }
   *domain++ = 0;
 
+  /* Check for SRV records.  */
+  if (1)
+    {
+      struct srventry *srvs;
+      unsigned int srvscount;
+      size_t domainlen, targetlen;
+      int i;
+
+      err = get_dns_srv (domain, "openpgpkey", NULL, &srvs, &srvscount);
+      if (err)
+        goto leave;
+
+      /* Find the first target which also ends in DOMAIN or is equal
+       * to DOMAIN.  */
+      domainlen = strlen (domain);
+      for (i = 0; i < srvscount; i++)
+        {
+          log_debug ("srv: trying '%s:%hu'\n", srvs[i].target, srvs[i].port);
+          targetlen = strlen (srvs[i].target);
+          if ((targetlen > domainlen + 1
+               && srvs[i].target[targetlen - domainlen - 1] == '.'
+               && !ascii_strcasecmp (srvs[i].target + targetlen - domainlen,
+                                     domain))
+              || (targetlen == domainlen
+                  && !ascii_strcasecmp (srvs[i].target, domain)))
+            {
+              /* found.  */
+              domainbuf = xtrystrdup (srvs[i].target);
+              if (!domainbuf)
+                {
+                  err = gpg_error_from_syserror ();
+                  xfree (srvs);
+                  goto leave;
+                }
+              domain = domainbuf;
+              if (srvs[i].port)
+                snprintf (portstr, sizeof portstr, ":%hu", srvs[i].port);
+              break;
+            }
+        }
+      xfree (srvs);
+      log_debug ("srv: got '%s%s'\n", domain, portstr);
+    }
+
   gcry_md_hash_buffer (GCRY_MD_SHA1, sha1buf, mbox, strlen (mbox));
   encodedhash = zb32_encode (sha1buf, 8*20);
   if (!encodedhash)
@@ -858,6 +904,7 @@ cmd_wkd_get (assuan_context_t ctx, char *line)
     {
       uri = strconcat ("https://",
                        domain,
+                       portstr,
                        "/.well-known/openpgpkey/submission-address",
                        NULL);
     }
@@ -865,6 +912,7 @@ cmd_wkd_get (assuan_context_t ctx, char *line)
     {
       uri = strconcat ("https://",
                        domain,
+                       portstr,
                        "/.well-known/openpgpkey/policy",
                        NULL);
     }
@@ -872,6 +920,7 @@ cmd_wkd_get (assuan_context_t ctx, char *line)
     {
       uri = strconcat ("https://",
                        domain,
+                       portstr,
                        "/.well-known/openpgpkey/hu/",
                        encodedhash,
                        NULL);
@@ -907,6 +956,7 @@ cmd_wkd_get (assuan_context_t ctx, char *line)
   xfree (uri);
   xfree (encodedhash);
   xfree (mbox);
+  xfree (domainbuf);
   return leave_cmd (ctx, err);
 }
 

commit 714faea4fa7f30d42e9986358214a99aa8fa57b3
Author: Werner Koch <wk at gnupg.org>
Date:   Sun Jan 8 18:07:18 2017 +0100

    dirmngr: Improve debug output for TLS.
    
    * dirmngr/misc.c (dump_cert): Also print SubjectAltNames.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/misc.c b/dirmngr/misc.c
index ac3856e..2ee6d82 100644
--- a/dirmngr/misc.c
+++ b/dirmngr/misc.c
@@ -296,6 +296,7 @@ dump_cert (const char *text, ksba_cert_t cert)
   ksba_sexp_t sexp;
   char *p;
   ksba_isotime_t t;
+  int idx;
 
   log_debug ("BEGIN Certificate '%s':\n", text? text:"");
   if (cert)
@@ -326,6 +327,13 @@ dump_cert (const char *text, ksba_cert_t cert)
       dump_string (p);
       ksba_free (p);
       log_printf ("\n");
+      for (idx=1; (p = ksba_cert_get_subject (cert, idx)); idx++)
+        {
+          log_debug ("        aka: ");
+          dump_string (p);
+          ksba_free (p);
+          log_printf ("\n");
+        }
 
       log_debug ("  hash algo: %s\n", ksba_cert_get_digest_algo (cert));
 

commit 16078f3deea5b82ea26e2f01dbd3ef3a5ce25410
Author: Werner Koch <wk at gnupg.org>
Date:   Sun Jan 8 18:04:59 2017 +0100

    dirmngr: Change internal SRV lookup API.
    
    * dirmngr/dns-stuff.c (get_dns_srv): Add args SERVICE and PROTO.
    * dirmngr/http.c (connect_server): Simplify SRV lookup.
    * dirmngr/ks-engine-hkp.c (map_host): Ditto.
    * dirmngr/t-dns-stuff.c (main): Adjust for changed get_dns_srv.
    --
    
    This new API is more convenient because it includes commonly used
    code.  Note that right now http.c's SRV record code is not used.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 028b065..a8713eb 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -1740,17 +1740,37 @@ getsrv_standard (const char *name,
 }
 
 
-/* Note that we do not return NONAME but simply store 0 at R_COUNT.  */
+/* Query a SRV record for SERVICE and PROTO for NAME.  If SERVICE is
+ * NULL, NAME is expected to contain the full query name.  Note that
+ * we do not return NONAME but simply store 0 at R_COUNT.  On error an
+ * error code is returned and 0 stored at R_COUNT.  */
 gpg_error_t
-get_dns_srv (const char *name, struct srventry **list, unsigned int *r_count)
+get_dns_srv (const char *name, const char *service, const char *proto,
+             struct srventry **list, unsigned int *r_count)
 {
   gpg_error_t err;
+  char *namebuffer = NULL;
   unsigned int srvcount;
   int i;
 
   *list = NULL;
   *r_count = 0;
   srvcount = 0;
+
+  /* If SERVICE is given construct the query from it and PROTO.  */
+  if (service)
+    {
+      namebuffer = xtryasprintf ("_%s._%s.%s",
+                                 service, proto? proto:"tcp", name);
+      if (!namebuffer)
+        {
+          err = gpg_error_from_syserror ();
+          goto leave;
+        }
+      name = namebuffer;
+    }
+
+
 #ifdef USE_LIBDNS
   if (!standard_resolver)
     {
@@ -1852,6 +1872,7 @@ get_dns_srv (const char *name, struct srventry **list, unsigned int *r_count)
     }
   if (!err)
     *r_count = srvcount;
+  xfree (namebuffer);
   return err;
 }
 
diff --git a/dirmngr/dns-stuff.h b/dirmngr/dns-stuff.h
index eb7fe72..d68dd17 100644
--- a/dirmngr/dns-stuff.h
+++ b/dirmngr/dns-stuff.h
@@ -153,6 +153,7 @@ gpg_error_t get_dns_cert (const char *name, int want_certtype,
 
 /* Return an array of SRV records.  */
 gpg_error_t get_dns_srv (const char *name,
+                         const char *service, const char *proto,
                          struct srventry **list, unsigned int *r_count);
 
 
diff --git a/dirmngr/http.c b/dirmngr/http.c
index 14d60df..7a02804 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -2362,29 +2362,11 @@ connect_server (const char *server, unsigned short port,
   /* Do the SRV thing */
   if (srvtag)
     {
-      /* We're using SRV, so append the tags. */
-      if (1 + strlen (srvtag) + 6 + strlen (server) + 1
-          <= DIMof (struct srventry, target))
-	{
-	  char *srvname = xtrymalloc (DIMof (struct srventry, target));
-
-          if (!srvname) /* Out of core */
-            {
-              serverlist = NULL;
-              srvcount = 0;
-            }
-          else
-            {
-              stpcpy (stpcpy (stpcpy (stpcpy (srvname,"_"), srvtag),
-                              "._tcp."), server);
-              err = get_dns_srv (srvname, &serverlist, &srvcount);
-              if (err)
-                log_info ("getting SRV '%s' failed: %s\n",
-                          srvname, gpg_strerror (err));
-              xfree (srvname);
-              /* Note that on error SRVCOUNT is zero.  */
-            }
-	}
+      err = get_dns_srv (server, srvtag, NULL, &serverlist, &srvcount);
+      if (err)
+        log_info ("getting '%s' SRV for '%s' failed: %s\n",
+                  srvtag, server, gpg_strerror (err));
+      /* Note that on error SRVCOUNT is zero.  */
     }
 
   if (!serverlist)
diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index a6c22f8..283e805 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -426,7 +426,6 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
       int refidx;
       int is_pool = 0;
       char *cname;
-      char *srvrecord;
       struct srventry *srvs;
       unsigned int srvscount;
 
@@ -448,16 +447,7 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
       if (!is_ip_address (name))
         {
           /* Check for SRV records.  */
-          srvrecord = xtryasprintf ("_hkp._tcp.%s", name);
-          if (srvrecord == NULL)
-            {
-              err = gpg_error_from_syserror ();
-              xfree (reftbl);
-              return err;
-            }
-
-          err = get_dns_srv (srvrecord, &srvs, &srvscount);
-          xfree (srvrecord);
+          err = get_dns_srv (name, "hkp", NULL, &srvs, &srvscount);
           if (err)
             {
               xfree (reftbl);
diff --git a/dirmngr/t-dns-stuff.c b/dirmngr/t-dns-stuff.c
index bc4ca9a..23c0c6a 100644
--- a/dirmngr/t-dns-stuff.c
+++ b/dirmngr/t-dns-stuff.c
@@ -235,7 +235,7 @@ main (int argc, char **argv)
       int i;
 
       err = get_dns_srv (name? name : "_hkp._tcp.wwwkeys.pgp.net",
-                         &srv, &count);
+                         NULL, NULL, &srv, &count);
       if (err)
         printf ("get_dns_srv failed: %s <%s>\n",
                 gpg_strerror (err), gpg_strsource (err));

commit 9fa94aa10778bbd680315e93b23175423e338c40
Author: Werner Koch <wk at gnupg.org>
Date:   Sun Jan 8 18:00:38 2017 +0100

    dirmngr: Strip root zone suffix from libdns SRV results.
    
    * dirmngr/dns-stuff.c (getsrv_libdns): Strip trailing dot from the
    target.
    --
    
    See-also: b200e636ab20d2aa93d9f71f3789db5a04af0a56
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index e32e1e3..028b065 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -1591,6 +1591,10 @@ getsrv_libdns (const char *name, struct srventry **list, unsigned int *r_count)
       srv->weight   = dsrv.weight;
       srv->port     = dsrv.port;
       mem2str (srv->target, dsrv.target, sizeof srv->target);
+      /* Libdns appends the root zone part which is problematic for
+       * most other functions - strip it.  */
+      if (*srv->target && (srv->target)[strlen (srv->target)-1] == '.')
+        (srv->target)[strlen (srv->target)-1] = 0;
     }
 
   *r_count = srvcount;

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dns-stuff.c     | 29 +++++++++++++++++++++++++--
 dirmngr/dns-stuff.h     |  1 +
 dirmngr/http.c          | 28 +++++---------------------
 dirmngr/ks-engine-hkp.c | 12 +-----------
 dirmngr/misc.c          |  8 ++++++++
 dirmngr/server.c        | 52 ++++++++++++++++++++++++++++++++++++++++++++++++-
 dirmngr/t-dns-stuff.c   |  2 +-
 7 files changed, 94 insertions(+), 38 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  9 08:57:05 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 09 Jan 2017 08:57:05 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-48-g2baba11
Message-ID: <E1cQUpH-0004ic-P3@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  2baba11fad6dd680a992260d161dffa1eeae0e42 (commit)
      from  88dc3af3d4ae1afe1d5e136bc4c38bc4e7d4cd10 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2baba11fad6dd680a992260d161dffa1eeae0e42
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 9 08:54:45 2017 +0100

    doc: Update man page for watchgnupg
    
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/tools.texi b/doc/tools.texi
index d321b69..f0e6fe7 100644
--- a/doc/tools.texi
+++ b/doc/tools.texi
@@ -54,13 +54,14 @@ other utilities.  This tool is not available for Windows.
 @command{watchgnupg} is commonly invoked as
 
 @example
-watchgnupg --force ~/.gnupg/S.log
+watchgnupg --force $(gpgconf --list-dirs socketdir)/S.log
 @end example
 @manpause
 
 @noindent
-This starts it on the current terminal for listening on the socket
- at file{~/.gnupg/S.log}.
+This starts it on the current terminal for listening on the standard
+logging socket (which is either @file{~/.gnupg/S.log} or
+ at file{/var/run/user/UID/gnupg/S.log}).
 
 @mansect options
 @noindent
@@ -77,6 +78,10 @@ Delete an already existing socket file.
 Instead of reading from a local socket, listen for connects on TCP port
 @var{n}.
 
+ at item --time-only
+ at opindex time-only
+Do not print the date part of the timestamp.
+
 @item --verbose
 @opindex verbose
 Enable extra informational output.
@@ -96,21 +101,22 @@ Display a brief help page and exit.
 @chapheading Examples
 
 @example
-$ watchgnupg --force /home/foo/.gnupg/S.log
+$ watchgnupg --force --time-only $(gpgconf --list-dirs socketdir)/S.log
 @end example
 
 This waits for connections on the local socket
- at file{/home/foo/.gnupg/S.log} and shows all log entries.  To make this
-work the option @option{log-file} needs to be used with all modules
-which logs are to be shown.  The value for that option must be given
-with a special prefix (e.g. in the conf files):
+(e.g. @file{/home/foo/.gnupg/S.log}) and shows all log entries.  To
+make this work the option @option{log-file} needs to be used with all
+modules which logs are to be shown.  The suggested entry for the
+configuration files is:
 
 @example
-log-file socket:///home/foo/.gnupg/S.log
+log-file socket://
 @end example
 
-If only @code{socket://} is used a default socket file named
- at file{S.log} in the standard socket directory is used.
+If the default socket as given above and returned by "echo $(gpgconf
+--list-dirs socketdir)/S.log" is not desired an arbitrary socket name
+can be specified, for example @file{socket:///home/foo/bar/mysocket}.
 For debugging purposes it is also possible to do remote logging.  Take
 care if you use this feature because the information is send in the
 clear over the network.  Use this syntax in the conf files:
@@ -119,13 +125,14 @@ clear over the network.  Use this syntax in the conf files:
 log-file tcp://192.168.1.1:4711
 @end example
 
-You may use any port and not just 4711 as shown above; only IP addresses
-are supported (v4 and v6) and no host names.  You need to start
- at command{watchgnupg} with the @option{tcp} option.  Note that under
-Windows the registry entry @var{HKCU\Software\GNU\GnuPG:DefaultLogFile}
-can be used to change the default log output from @code{stderr} to
-whatever is given by that entry.  However the only useful entry is a TCP
-name for remote debugging.
+You may use any port and not just 4711 as shown above; only IP
+addresses are supported (v4 and v6) and no host names.  You need to
+start @command{watchgnupg} with the @option{tcp} option.  Note that
+under Windows the registry entry
+ at var{HKCU\Software\GNU\GnuPG:DefaultLogFile} can be used to change the
+default log output from @code{stderr} to whatever is given by that
+entry.  However the only useful entry is a TCP name for remote
+debugging.
 
 
 @mansect see also

-----------------------------------------------------------------------

Summary of changes:
 doc/tools.texi | 43 +++++++++++++++++++++++++------------------
 1 file changed, 25 insertions(+), 18 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  9 10:54:46 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 09 Jan 2017 10:54:46 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-50-g0cc975d
Message-ID: <E1cQWfB-00037O-Qq@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  0cc975d8a1cd54115938202432e43263b8893ea4 (commit)
       via  c2cbe2f87c480c62239dc4c2cbb352acd98cd267 (commit)
      from  2baba11fad6dd680a992260d161dffa1eeae0e42 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0cc975d8a1cd54115938202432e43263b8893ea4
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 9 10:42:30 2017 +0100

    dirmngr: Use "pgpkey-hkps" and "pgpkey-hkp" for SRV record lookups.
    
    * dirmngr/ks-engine-hkp.c (map_host): Chnage arg NO_SRV to SRVTAG.
    (make_host_part): Rewrite.
    --
    
    This fixes a regression from 2.0 and 1.4 where these tags have been in
    used since 2009.  For whatever reason this was not ported to 2.1 and
    "hkp" was always used.
    
    GnuPG-bug-id: 2451
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 9b757a3..5f6e5f4 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -378,16 +378,17 @@ add_host (const char *name, int is_pool,
  * to choose one of the hosts.  For example we skip those hosts which
  * failed for some time and we stick to one host for a time
  * independent of DNS retry times.  If FORCE_RESELECT is true a new
- * host is always selected.  If NO_SRV is set no service record lookup
- * will be done.  The selected host is stored as a malloced string at
- * R_HOST; on error NULL is stored.  If we know the port used by the
- * selected host from a service record, a string representation is
- * written to R_PORTSTR, otherwise it is left untouched.  If
- * R_HTTPFLAGS is not NULL it will receive flags which are to be
- * passed to http_open.  If R_POOLNAME is not NULL a malloced name of
- * the pool is stored or NULL if it is not a pool. */
+ * host is always selected.  If SRVTAG is NULL no service record
+ * lookup will be done, if it is set that service name is used.  The
+ * selected host is stored as a malloced string at R_HOST; on error
+ * NULL is stored.  If we know the port used by the selected host from
+ * a service record, a string representation is written to R_PORTSTR,
+ * otherwise it is left untouched.  If R_HTTPFLAGS is not NULL it will
+ * receive flags which are to be passed to http_open.  If R_POOLNAME
+ * is not NULL a malloced name of the pool is stored or NULL if it is
+ * not a pool. */
 static gpg_error_t
-map_host (ctrl_t ctrl, const char *name, int force_reselect, int no_srv,
+map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
           char **r_host, char *r_portstr,
           unsigned int *r_httpflags, char **r_poolname)
 {
@@ -445,10 +446,10 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect, int no_srv,
         }
       hi = hosttable[idx];
 
-      if (!no_srv && !is_ip_address (name))
+      if (srvtag && !is_ip_address (name))
         {
           /* Check for SRV records.  */
-          err = get_dns_srv (name, "hkp", NULL, &srvs, &srvscount);
+          err = get_dns_srv (name, srvtag, NULL, &srvs, &srvscount);
           if (err)
             {
               xfree (reftbl);
@@ -859,38 +860,42 @@ make_host_part (ctrl_t ctrl,
                 char **r_hostport, unsigned int *r_httpflags, char **r_poolname)
 {
   gpg_error_t err;
+  const char *srvtag;
   char portstr[10];
   char *hostname;
 
   *r_hostport = NULL;
 
-  portstr[0] = 0;
-  err = map_host (ctrl, host, force_reselect, no_srv,
-                  &hostname, portstr, r_httpflags, r_poolname);
-  if (err)
-    return err;
-
-  /* If map_host did not return a port (from a SRV record) but a port
-   * has been specified (implicitly or explicitly) then use that port.
-   * Only in the case that a port was not specified (which might be a
-   * bug in https.c) we will later make sure that it has been set.  */
-  if (!*portstr && port)
-    snprintf (portstr, sizeof portstr, "%hu", port);
-
-  /* Map scheme and port.  */
   if (!strcmp (scheme, "hkps") || !strcmp (scheme,"https"))
     {
       scheme = "https";
-      if (! *portstr)
-        strcpy (portstr, "443");
+      srvtag = no_srv? NULL : "pgpkey-https";
     }
   else /* HKP or HTTP.  */
     {
       scheme = "http";
-      if (! *portstr)
-        strcpy (portstr, "11371");
+      srvtag = no_srv? NULL : "pgpkey-http";
     }
 
+  portstr[0] = 0;
+  err = map_host (ctrl, host, srvtag, force_reselect,
+                  &hostname, portstr, r_httpflags, r_poolname);
+  if (err)
+    return err;
+
+  /* If map_host did not return a port (from a SRV record) but a port
+   * has been specified (implicitly or explicitly) then use that port.
+   * In the case that a port was not specified (which is probably a
+   * bug in https.c) we will set up defaults.  */
+  if (*portstr)
+    ;
+  else if (!*portstr && port)
+    snprintf (portstr, sizeof portstr, "%hu", port);
+  else if (!strcmp (scheme,"https"))
+    strcpy (portstr, "443");
+  else
+    strcpy (portstr, "11371");
+
   *r_hostport = strconcat (scheme, "://", hostname, ":", portstr, NULL);
   xfree (hostname);
   if (!*r_hostport)

commit c2cbe2f87c480c62239dc4c2cbb352acd98cd267
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 9 10:11:20 2017 +0100

    dirmngr: Do not use a SRV record for HKP if a port was specified.
    
    * dirmngr/http.h (parsed_uri_s): Add field EXPLICIT_PORT.
    * dirmngr/http.c (do_parse_uri): That it.
    * dirmngr/ks-engine-hkp.c (map_host): Add arg NO_SRV.
    (make_host_part): Ditto.
    (ks_hkp_resolve): Set NO_SRV from EXPLICIT_PORT.
    (ks_hkp_search): Ditto.
    (ks_hkp_get): Ditto.
    (ks_hkp_put): Ditto.
    --
    
    This implements the behaviour of the keyserver helpers from 1.4 and
    2.0.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 7a02804..0a47d9f 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -1169,6 +1169,7 @@ do_parse_uri (parsed_uri_t uri, int only_local_part,
   uri->opaque = 0;
   uri->v6lit = 0;
   uri->onion = 0;
+  uri->explicit_port = 0;
 
   /* A quick validity check. */
   if (strspn (p, VALID_URI_CHARS) != n)
@@ -1241,6 +1242,7 @@ do_parse_uri (parsed_uri_t uri, int only_local_part,
 	    {
 	      *p3++ = '\0';
 	      uri->port = atoi (p3);
+              uri->explicit_port = 1;
 	    }
 
 	  if ((n = remove_escapes (uri->host)) < 0)
diff --git a/dirmngr/http.h b/dirmngr/http.h
index 2a36fda..32556a4 100644
--- a/dirmngr/http.h
+++ b/dirmngr/http.h
@@ -53,6 +53,7 @@ struct parsed_uri_s
   unsigned int opaque:1;/* Unknown scheme; PATH has the rest.  */
   unsigned int v6lit:1; /* Host was given as a literal v6 address.  */
   unsigned int onion:1; /* .onion address given.  */
+  unsigned int explicit_port :1; /* The port was explicitly specified.  */
   char *auth;           /* username/password for basic auth.  */
   char *host; 	        /* Host (converted to lowercase). */
   unsigned short port;  /* Port (always set if the host is set). */
diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 283e805..9b757a3 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -374,19 +374,20 @@ add_host (const char *name, int is_pool,
 
 
 /* Map the host name NAME to the actual to be used host name.  This
-   allows us to manage round robin DNS names.  We use our own strategy
-   to choose one of the hosts.  For example we skip those hosts which
-   failed for some time and we stick to one host for a time
-   independent of DNS retry times.  If FORCE_RESELECT is true a new
-   host is always selected.  The selected host is stored as a malloced
-   string at R_HOST; on error NULL is stored.  If we know the port
-   used by the selected host, a string representation is written to
-   R_PORTSTR, otherwise it is left untouched.  If R_HTTPFLAGS is not
-   NULL it will receive flags which are to be passed to http_open.  If
-   R_POOLNAME is not NULL a malloced name of the pool is stored or
-   NULL if it is not a pool. */
+ * allows us to manage round robin DNS names.  We use our own strategy
+ * to choose one of the hosts.  For example we skip those hosts which
+ * failed for some time and we stick to one host for a time
+ * independent of DNS retry times.  If FORCE_RESELECT is true a new
+ * host is always selected.  If NO_SRV is set no service record lookup
+ * will be done.  The selected host is stored as a malloced string at
+ * R_HOST; on error NULL is stored.  If we know the port used by the
+ * selected host from a service record, a string representation is
+ * written to R_PORTSTR, otherwise it is left untouched.  If
+ * R_HTTPFLAGS is not NULL it will receive flags which are to be
+ * passed to http_open.  If R_POOLNAME is not NULL a malloced name of
+ * the pool is stored or NULL if it is not a pool. */
 static gpg_error_t
-map_host (ctrl_t ctrl, const char *name, int force_reselect,
+map_host (ctrl_t ctrl, const char *name, int force_reselect, int no_srv,
           char **r_host, char *r_portstr,
           unsigned int *r_httpflags, char **r_poolname)
 {
@@ -444,7 +445,7 @@ map_host (ctrl_t ctrl, const char *name, int force_reselect,
         }
       hi = hosttable[idx];
 
-      if (!is_ip_address (name))
+      if (!no_srv && !is_ip_address (name))
         {
           /* Check for SRV records.  */
           err = get_dns_srv (name, "hkp", NULL, &srvs, &srvscount);
@@ -848,13 +849,13 @@ ks_hkp_help (ctrl_t ctrl, parsed_uri_t uri)
 
 
 /* Build the remote part of the URL from SCHEME, HOST and an optional
-   PORT.  Returns an allocated string at R_HOSTPORT or NULL on failure
-   If R_POOLNAME is not NULL it receives a malloced string with the
-   poolname.  */
+ * PORT.  If NO_SRV is set no SRV record lookup will be done.  Returns
+ * an allocated string at R_HOSTPORT or NULL on failure If R_POOLNAME
+ * is not NULL it receives a malloced string with the poolname.  */
 static gpg_error_t
 make_host_part (ctrl_t ctrl,
                 const char *scheme, const char *host, unsigned short port,
-                int force_reselect,
+                int force_reselect, int no_srv,
                 char **r_hostport, unsigned int *r_httpflags, char **r_poolname)
 {
   gpg_error_t err;
@@ -864,11 +865,18 @@ make_host_part (ctrl_t ctrl,
   *r_hostport = NULL;
 
   portstr[0] = 0;
-  err = map_host (ctrl, host, force_reselect,
+  err = map_host (ctrl, host, force_reselect, no_srv,
                   &hostname, portstr, r_httpflags, r_poolname);
   if (err)
     return err;
 
+  /* If map_host did not return a port (from a SRV record) but a port
+   * has been specified (implicitly or explicitly) then use that port.
+   * Only in the case that a port was not specified (which might be a
+   * bug in https.c) we will later make sure that it has been set.  */
+  if (!*portstr && port)
+    snprintf (portstr, sizeof portstr, "%hu", port);
+
   /* Map scheme and port.  */
   if (!strcmp (scheme, "hkps") || !strcmp (scheme,"https"))
     {
@@ -882,12 +890,6 @@ make_host_part (ctrl_t ctrl,
       if (! *portstr)
         strcpy (portstr, "11371");
     }
-  if (port)
-    snprintf (portstr, sizeof portstr, "%hu", port);
-  else
-    {
-      /*fixme_do_srv_lookup ()*/
-    }
 
   *r_hostport = strconcat (scheme, "://", hostname, ":", portstr, NULL);
   xfree (hostname);
@@ -913,7 +915,11 @@ ks_hkp_resolve (ctrl_t ctrl, parsed_uri_t uri)
   gpg_error_t err;
   char *hostport = NULL;
 
-  err = make_host_part (ctrl, uri->scheme, uri->host, uri->port, 1,
+  /* NB: With an explicitly given port we do not want to consult a
+   * service record because that might be in conflict with the port
+   * from such a service record.  */
+  err = make_host_part (ctrl, uri->scheme, uri->host, uri->port,
+                        1, uri->explicit_port,
                         &hostport, NULL, NULL);
   if (err)
     {
@@ -1219,7 +1225,8 @@ ks_hkp_search (ctrl_t ctrl, parsed_uri_t uri, const char *pattern,
 
     xfree (hostport); hostport = NULL;
     xfree (httphost); httphost = NULL;
-    err = make_host_part (ctrl, uri->scheme, uri->host, uri->port, reselect,
+    err = make_host_part (ctrl, uri->scheme, uri->host, uri->port,
+                          reselect, uri->explicit_port,
                           &hostport, &httpflags, &httphost);
     if (err)
       goto leave;
@@ -1360,7 +1367,8 @@ ks_hkp_get (ctrl_t ctrl, parsed_uri_t uri, const char *keyspec, estream_t *r_fp)
   /* Build the request string.  */
   xfree (hostport); hostport = NULL;
   xfree (httphost); httphost = NULL;
-  err = make_host_part (ctrl, uri->scheme, uri->host, uri->port, reselect,
+  err = make_host_part (ctrl, uri->scheme, uri->host, uri->port,
+                        reselect, uri->explicit_port,
                         &hostport, &httpflags, &httphost);
   if (err)
     goto leave;
@@ -1472,7 +1480,8 @@ ks_hkp_put (ctrl_t ctrl, parsed_uri_t uri, const void *data, size_t datalen)
  again:
   xfree (hostport); hostport = NULL;
   xfree (httphost); httphost = NULL;
-  err = make_host_part (ctrl, uri->scheme, uri->host, uri->port, reselect,
+  err = make_host_part (ctrl, uri->scheme, uri->host, uri->port,
+                        reselect, uri->explicit_port,
                         &hostport, &httpflags, &httphost);
   if (err)
     goto leave;

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/http.c          |  2 ++
 dirmngr/http.h          |  1 +
 dirmngr/ks-engine-hkp.c | 88 ++++++++++++++++++++++++++++---------------------
 3 files changed, 54 insertions(+), 37 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan  9 13:15:08 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 09 Jan 2017 13:15:08 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-244-g54c973f
Message-ID: <E1cQYr0-0000ux-AU@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  54c973fd2e45ee71664a89c500b00d5088107081 (commit)
       via  24832b5f163822e471e468234972bc2f2a2e68b6 (commit)
       via  03ae7589f175b6f4d4ecf1b7f4605e78a1932814 (commit)
       via  352c06b528804aa4754a91a653a8546607592512 (commit)
       via  b9ef5502c572eae0db0dc4ed10013d888edaf9a8 (commit)
       via  cce2a22442aefb9e65b5cc10fed0db4e5d9e11b8 (commit)
      from  abaca16b9019781359c105944ea22adf3f6fa4c8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 54c973fd2e45ee71664a89c500b00d5088107081
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 9 13:13:43 2017 +0100

    Treat marginal in WoT as lvel 2
    
    * src/mail.cpp (Mail::update_sigstate): Set marginal trust
    as level 2.
    
    --
    This is what we did before and also what kleopatra did.
    Marginal trust is shown as trusted certificate and "green".
    
    Only with tofu trust model we do marginal later because
    it can be automatically reached and any seen key is marginal
    in tofu.

diff --git a/src/mail.cpp b/src/mail.cpp
index 2604a86..dd6562c 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1334,12 +1334,12 @@ Mail::update_sigstate ()
       if (sig.validity() == Signature::Validity::Marginal)
         {
           const auto tofu = m_uid.tofuInfo();
-          if (tofu.isNull() ||
+          if (!tofu.isNull() &&
               (tofu.validity() != TofuInfo::Validity::BasicHistory &&
                tofu.validity() != TofuInfo::Validity::LargeHistory))
             {
-              /* Marginal is not good enough without tofu.
-                 We also wait for basic trust. */
+              /* Marginal is only good enough without tofu.
+                 Otherwise we wait for basic trust. */
               log_debug ("%s:%s: Discarding marginal signature."
                          "With too little history.",
                          SRCNAME, __func__);
@@ -1692,16 +1692,14 @@ Mail::get_crypto_details()
       message = buf;
       xfree (buf);
     }
+  else if (level == 2 && m_uid.tofuInfo ().isNull ())
+    {
+      /* Marginal trust through pgp only */
+      message = _("Some trusted people "
+                  "have certified the senders identity.");
+    }
   else if (level == 2)
     {
-      /* Only reachable through TOFU Trust. */
-      if (m_uid.tofuInfo ().isNull ())
-        {
-          log_error ("%s:%s:%i BUG: Invalid sigstate.",
-                     SRCNAME, __func__, __LINE__);
-          return message;
-        }
-
       unsigned long first_contact = std::max (m_uid.tofuInfo().signFirst(),
                                               m_uid.tofuInfo().encrFirst());
       char *time = format_date_from_gpgme (first_contact);
@@ -1739,12 +1737,6 @@ Mail::get_crypto_details()
           message = buf;
           xfree (buf);
         }
-      else
-        {
-          /* Marginal trust through pgp */
-          message = _("Not enough trusted people or yourself "
-                      "have certified the senders identity.");
-        }
     }
   else
     {

commit 24832b5f163822e471e468234972bc2f2a2e68b6
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 9 13:12:42 2017 +0100

    Release attachments object earlier
    
    * src/mail.cpp (Mail::check_attachments): Release
    attachments object earlier.

diff --git a/src/mail.cpp b/src/mail.cpp
index 6b6a5ca..2604a86 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -325,6 +325,7 @@ Mail::check_attachments () const
       VariantClear (&var);
       gpgol_release (oom_attach);
     }
+  gpgol_release (attachments);
   if (foundOne)
     {
       message += "\n";
@@ -337,7 +338,6 @@ Mail::check_attachments () const
       xfree (wmsg);
       xfree (wtitle);
     }
-  gpgol_release (attachments);
   return 0;
 }
 

commit 03ae7589f175b6f4d4ecf1b7f4605e78a1932814
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 9 13:11:45 2017 +0100

    Deactive Outlook Window during encryption
    
    * src/mail.cpp (encrypt_sign): Deactivate Outlook Window.
    
    --
    Not optimal but this at least allows to move the outlook
    window during encryption. Kleopatra must do some work to
    really become modal.

diff --git a/src/mail.cpp b/src/mail.cpp
index 5fed0f6..6b6a5ca 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -848,6 +848,8 @@ Mail::encrypt_sign ()
       return err;
     }
   flags = get_gpgol_draft_info_flags (message);
+
+  EnableWindow (get_active_hwnd(), FALSE);
   if (flags == 3)
     {
       log_debug ("%s:%s: Sign / Encrypting message",
@@ -872,6 +874,7 @@ Mail::encrypt_sign ()
     }
   log_debug ("%s:%s: Status: %i",
              SRCNAME, __func__, err);
+  EnableWindow (get_active_hwnd(), TRUE);
   gpgol_release (message);
   m_crypt_successful = !err;
   return err;

commit 352c06b528804aa4754a91a653a8546607592512
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 9 13:09:27 2017 +0100

    Disable button and fix msgs if no mail selected
    
    * src/gpgoladdin.cpp (GpgolRibbonExtender::GetIDsOfNames)
    (GpgolRibbonExtender::Invoke, GetCustomUI_MIME): Update
    for get_is_details_enabled.
    * src/ribbon-callbacks.cpp (get_is_details_enabled): New.
    (get_mail_from_control): Extend with selection state.

diff --git a/src/gpgoladdin.cpp b/src/gpgoladdin.cpp
index 15ba34d..9eda8c2 100644
--- a/src/gpgoladdin.cpp
+++ b/src/gpgoladdin.cpp
@@ -646,7 +646,7 @@ GpgolRibbonExtender::GetIDsOfNames (REFIID riid, LPOLESTR *rgszNames,
       ID_MAPPER (L"getSigSTip", ID_GET_SIG_STIP)
       ID_MAPPER (L"getSigTip", ID_GET_SIG_TTIP)
       ID_MAPPER (L"launchDetails", ID_LAUNCH_CERT_DETAILS)
-      ID_MAPPER (L"getIsCrypto", ID_GET_IS_CRYPTO)
+      ID_MAPPER (L"getIsDetailsEnabled", ID_GET_IS_DETAILS_ENABLED)
     }
 
   if (cNames > 1)
@@ -741,8 +741,8 @@ GpgolRibbonExtender::Invoke (DISPID dispid, REFIID riid, LCID lcid,
         return get_sig_label (parms->rgvarg[0].pdispVal, result);
       case ID_LAUNCH_CERT_DETAILS:
         return launch_cert_details (parms->rgvarg[0].pdispVal);
-      case ID_GET_IS_CRYPTO:
-        return get_is_crypto (parms->rgvarg[0].pdispVal, result);
+      case ID_GET_IS_DETAILS_ENABLED:
+        return get_is_details_enabled (parms->rgvarg[0].pdispVal, result);
 
       case ID_ON_LOAD:
           {
@@ -925,8 +925,8 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
         "               getLabel=\"getSigLabel\""
         "               getScreentip=\"getSigTip\""
         "               getSupertip=\"getSigSTip\""
-        "               onAction=\"launchDetails\"/>"
-       /* "               getEnabled=\"getIsCrypto\"/>" */
+        "               onAction=\"launchDetails\""
+        "               getEnabled=\"getIsDetailsEnabled\"/>"
         "       <dialogBoxLauncher>"
         "         <button id=\"optsBtn_read\""
         "                 onAction=\"openOptions\""
diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index 503c773..34a964d 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1421,11 +1421,12 @@ done:
 }
 
 static Mail *
-get_mail_from_control (LPDISPATCH ctrl)
+get_mail_from_control (LPDISPATCH ctrl, bool *none_selected)
 {
   HRESULT hr;
   LPDISPATCH context = NULL,
              mailitem = NULL;
+  *none_selected = false;
   if (!ctrl)
     {
       log_error ("%s:%s:%i", SRCNAME, __func__, __LINE__);
@@ -1457,6 +1458,10 @@ get_mail_from_control (LPDISPATCH ctrl)
   else if (!strcmp (ctx_name, "_Explorer"))
     {
       mailitem = get_oom_object (context, "Selection.Item(1)");
+      if (!mailitem)
+        {
+          *none_selected = true;
+        }
     }
 
   gpgol_release (context);
@@ -1504,23 +1509,22 @@ get_mail_from_control (LPDISPATCH ctrl)
       log_error ("%s:%s:%i", SRCNAME, __func__, __LINE__); \
       return E_FAIL; \
     } \
-  const auto mail = get_mail_from_control (ctrl); \
+  bool none_selected; \
+  const auto mail = get_mail_from_control (ctrl, &none_selected); \
+  (void)none_selected; \
   if (!mail) \
     { \
       log_oom ("%s:%s:%i Failed to get mail", \
                SRCNAME, __func__, __LINE__); \
     }
 
-HRESULT get_is_crypto (LPDISPATCH ctrl, VARIANT *result)
+HRESULT get_is_details_enabled (LPDISPATCH ctrl, VARIANT *result)
 {
   MY_MAIL_GETTER
 
   result->vt = VT_BOOL | VT_BYREF;
   result->pboolVal = (VARIANT_BOOL*) xmalloc (sizeof (VARIANT_BOOL));
-  *(result->pboolVal) = !mail ?
-                        VARIANT_FALSE :
-                        (mail->is_signed () || mail->is_encrypted ()) ?
-                        VARIANT_TRUE : VARIANT_FALSE;
+  *(result->pboolVal) = none_selected ? VARIANT_FALSE : VARIANT_TRUE;
 
   return S_OK;
 }
@@ -1556,10 +1560,14 @@ HRESULT get_sig_ttip (LPDISPATCH ctrl, VARIANT *result)
     {
       w_result = utf8_to_wchar (mail->get_crypto_one_line().c_str());
     }
-  else
+  else if (!none_selected)
     {
       w_result = utf8_to_wchar (_("Insecure message"));
     }
+  else
+    {
+      w_result = utf8_to_wchar (_("No message selected"));
+    }
   result->bstrVal = SysAllocString (w_result);
   xfree (w_result);
   return S_OK;
@@ -1570,6 +1578,11 @@ HRESULT get_sig_stip (LPDISPATCH ctrl, VARIANT *result)
   MY_MAIL_GETTER
 
   result->vt = VT_BSTR;
+  if (none_selected)
+    {
+      result->bstrVal = SysAllocString (L"");
+      return S_OK;
+    }
   if (!mail || (!mail->is_signed () && !mail->is_encrypted ()))
     {
       wchar_t *w_result;
diff --git a/src/ribbon-callbacks.h b/src/ribbon-callbacks.h
index 7b4bd37..b131481 100644
--- a/src/ribbon-callbacks.h
+++ b/src/ribbon-callbacks.h
@@ -42,7 +42,7 @@
 #define ID_GET_ENCRYPT_PRESSED  16
 #define ID_ON_LOAD              17
 #define ID_CMD_OPEN_OPTIONS     18
-#define ID_GET_IS_CRYPTO        19
+#define ID_GET_IS_DETAILS_ENABLED 19
 #define ID_CMD_MIME_SIGN_EX     21
 #define ID_CMD_MIME_ENCRYPT_EX  22
 #define ID_GET_SIGN_PRESSED_EX  23
@@ -85,8 +85,8 @@ HRESULT verifyBody (LPDISPATCH ctrl);
 HRESULT get_crypt_pressed (LPDISPATCH ctrl, int flags, VARIANT *result, bool is_explorer);
 /* Mark the mail to be mime encrypted on send. Flags as above */
 HRESULT mark_mime_action (LPDISPATCH ctrl, int flags, bool is_explorer);
-/* Check the if the mail was signed. Returns BOOL */
-HRESULT get_is_crypto (LPDISPATCH ctrl, VARIANT *result);
+/* Check the if the gpgol button should be enabled */
+HRESULT get_is_details_enabled (LPDISPATCH ctrl, VARIANT *result);
 /* Get the label for the signature. Returns BSTR */
 HRESULT get_sig_label (LPDISPATCH ctrl, VARIANT *result);
 /* Get the tooltip for the signature. Returns BSTR */

commit b9ef5502c572eae0db0dc4ed10013d888edaf9a8
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 9 13:08:18 2017 +0100

    Add logo to options dialog
    
    --

diff --git a/src/dialogs.h b/src/dialogs.h
index 0574444..e6f925d 100644
--- a/src/dialogs.h
+++ b/src/dialogs.h
@@ -28,6 +28,8 @@
 #define IDB_DECRYPT_VERIFY_16           0x1050
 #define IDB_DECRYPT_VERIFY_16M          0x1051
 
+#define IDB_LOGO                        0x1060
+
 
 /* Ids for the extended options dialog.  */
 #define IDD_EXT_OPTIONS                 0x4110
diff --git a/src/dialogs.rc b/src/dialogs.rc
index a99eee3..0454f19 100644
--- a/src/dialogs.rc
+++ b/src/dialogs.rc
@@ -69,6 +69,8 @@ IDI_SIGN_ENCRYPT_40_PNG    RCDATA              "icons/sign-enc-40.png"
 IDI_ENCRYPT_20_PNG         RCDATA              "icons/encrypt-20.png"
 IDI_SIGN_20_PNG            RCDATA              "icons/sign-20.png"
 
+IDB_LOGO                   BITMAP  DISCARDABLE "icons/logo.bmp"
+
 IDD_GPG_OPTIONS  DIALOG DISCARDABLE  0, 0, 266, 274
 STYLE DS_MODALFRAME | WS_POPUP | WS_VISIBLE | WS_CAPTION | WS_SYSMENU
 CAPTION "GpgOL"
@@ -350,10 +352,12 @@ BEGIN
 //                    24, 93, 215, 10
 
     /* Stuff at the lower left corner.  */
-    LTEXT           "GpgOL by Gpg4win", IDC_GPG4WIN_STRING,
-                      8, 144, 100, 8
+    CONTROL         IDB_LOGO, IDC_BITMAP,
+                    "Static", SS_BITMAP | SS_REALSIZEIMAGE,
+                      10, 105, 128, 80
+
     LTEXT           "Version x ", IDC_VERSION_INFO,
-                      8, 155, 100, 9
+                      10, 155, 100, 9
 
     PUSHBUTTON      "advanced", IDC_GPG_OPTIONS,
                     180, 120, 70, 14
diff --git a/src/icons/Makefile.am b/src/icons/Makefile.am
index a727d0e..8b7908f 100644
--- a/src/icons/Makefile.am
+++ b/src/icons/Makefile.am
@@ -29,4 +29,5 @@ EXTRA_DIST= \
     level-1.svg level-1-enc.svg level-1.png level-1-enc.png \
     level-2.svg level-2-enc.svg level-2.png level-2-enc.png \
     level-3.svg level-3-enc.svg level-3.png level-3-enc.png \
-    level-4.svg level-4-enc.svg level-4.png level-4-enc.png
+    level-4.svg level-4-enc.svg level-4.png level-4-enc.png \
+    logo.svg logo.bmp
diff --git a/src/icons/logo.bmp b/src/icons/logo.bmp
new file mode 100644
index 0000000..1ce1cc0
Binary files /dev/null and b/src/icons/logo.bmp differ
diff --git a/src/icons/logo.svg b/src/icons/logo.svg
new file mode 100644
index 0000000..2666e87
--- /dev/null
+++ b/src/icons/logo.svg
@@ -0,0 +1,174 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   id="Ebene_1"
+   data-name="Ebene 1"
+   viewBox="0 0 242.47081 151.87432"
+   version="1.1"
+   inkscape:version="0.48.3.1 r9886"
+   width="100%"
+   height="100%"
+   sodipodi:docname="GpgOL finnished Logo.svg">
+  <metadata
+     id="metadata35">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title>GpgOL finnished Logo</dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <sodipodi:namedview
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1"
+     objecttolerance="10"
+     gridtolerance="10"
+     guidetolerance="10"
+     inkscape:pageopacity="0"
+     inkscape:pageshadow="2"
+     inkscape:window-width="1680"
+     inkscape:window-height="993"
+     id="namedview33"
+     showgrid="false"
+     inkscape:zoom="1.736707"
+     inkscape:cx="128.09685"
+     inkscape:cy="-37.753291"
+     inkscape:window-x="-3"
+     inkscape:window-y="-3"
+     inkscape:window-maximized="1"
+     inkscape:current-layer="Ebene_1"
+     fit-margin-top="8"
+     fit-margin-left="10"
+     fit-margin-right="10"
+     fit-margin-bottom="5">
+    <inkscape:grid
+       type="xygrid"
+       id="grid3168"
+       empspacing="5"
+       visible="true"
+       enabled="true"
+       snapvisiblegridlinesonly="true"
+       originx="9.9114058px"
+       originy="4.6946475px" />
+  </sodipodi:namedview>
+  <defs
+     id="defs3">
+    <style
+       id="style5">.cls-1{fill:#1f8fcf;}.cls-2{fill:#3d3d3b;}.cls-3{fill:#1b72b8;}.cls-4{fill:#3d3c3b;}.cls-5{fill:#1f8ece;}</style>
+  </defs>
+  <title
+     id="title7">GpgOL finnished Logo</title>
+  <polygon
+     id="polygon4191"
+     points="40.6,281.41 40.6,281.41 0,247.55 0,316.6 81.19,316.6 81.19,247.55 "
+     class="cls-4"
+     style="fill:#1f8ece"
+     transform="translate(9.9999924,-175.14)" />
+  <polygon
+     id="polygon4193"
+     points="40.6,276.5 81.19,242.65 0,242.65 0,242.65 "
+     class="cls-4"
+     style="fill:#1f8ece"
+     transform="translate(9.9999924,-175.14)" />
+  <path
+     id="path4195"
+     d="m 17.419993,43.000001 v 20.56 h 14.14 v -20.56 c 0,-11.26 8.54,-20.43 19,-20.43 10.46,0 19,9.16 19,20.43 v 20.56 h 14.14 v -20.56 c 0,-19.32 -14.87,-35.0000006 -33.17,-35.0000006 h 0 c -18.29,0 -33.17,15.7200006 -33.17,35.0000006"
+     class="cls-3"
+     inkscape:connector-curvature="0"
+     style="fill:#3d3d3b" />
+  <g
+     transform="matrix(0.98456381,0,0,1.0156782,9.9114061,7.9796704)"
+     style="font-size:26.2523365px;font-style:normal;font-variant:normal;font-weight:300;font-stretch:normal;text-align:center;line-height:125%;letter-spacing:0.19689253px;word-spacing:0px;writing-mode:lr-tb;text-anchor:middle;fill:#3d3d3b;fill-opacity:1;stroke:none;font-family:Roboto Condensed;-inkscape-font-specification:'Roboto Condensed, Light'"
+     id="text4209">
+    <path
+       d="m 107.33714,125.32935 c -0.13674,2.09369 -0.70075,3.63191 -1.69204,4.61467 -0.99131,0.9742 -2.36289,1.46131 -4.11475,1.46131 -0.8973,0 -1.709139,-0.17519 -2.435516,-0.52556 -0.717842,-0.35038 -1.328857,-0.85457 -1.833049,-1.51259 -0.504198,-0.65801 -0.893026,-1.45703 -1.166486,-2.39706 -0.273463,-0.94857 -0.410194,-2.01678 -0.410192,-3.20463 l 0,-4.0122 c -2e-6,-1.17075 0.136729,-2.22187 0.410192,-3.15336 0.27346,-0.93146 0.666561,-1.71766 1.179305,-2.35861 0.512737,-0.64945 1.136571,-1.1451 1.871504,-1.48695 0.734923,-0.35035 1.568122,-0.52554 2.499612,-0.52555 0.84601,1e-5 1.60231,0.11965 2.26888,0.35891 0.6751,0.2393 1.2562,0.60677 1.74332,1.1024 0.48709,0.49566 0.87165,1.12804 1.15367,1.89714 0.28199,0.76912 0.45718,1.68351 0.52555,2.74316 l -1.48694,0 c -0.0684,-0.85455 -0.20084,-1.58093 -0.39738,-2.17915 -0.19656,-0.59818 -0.47002,-1.08528 -0.82038,-1.46131 -0.34184,-0.37599 -0.76058,-0.64945 -1.25622,-0.82038 -0.49566,-0.1709 -1.07249,-0.25636 -1.7305,-0.25637 -0.72639,1e-5 -1.36732,0.14102 -1.922778,0.42301 -0.555475,0.27348 -1.025487,0.67085 -1.410038,1.19212 -0.376014,0.5213 -0.662294,1.16223 -0.858841,1.92278 -0.188008,0.76058 -0.282011,1.61942 -0.282008,2.57652 l 0,4.03784 c -3e-6,0.94857 0.08973,1.81169 0.269189,2.58934 0.188002,0.76911 0.461463,1.42713 0.820386,1.97405 0.36746,0.54693 0.82038,0.96994 1.358764,1.26903 0.546916,0.29911 1.183566,0.44865 1.909956,0.44865 0.68365,0 1.28185,-0.0769 1.7946,-0.23073 0.51273,-0.16237 0.94428,-0.42728 1.29467,-0.79475 0.35036,-0.36746 0.62382,-0.85029 0.82038,-1.44849 0.20509,-0.60674 0.34182,-1.35449 0.4102,-2.24324 l 1.48694,0"
+       id="path3014"
+       inkscape:connector-curvature="0" />
+    <path
+       d="m 116.34036,118.61244 c -0.14528,-0.0256 -0.29056,-0.047 -0.43583,-0.0641 -0.13673,-0.0171 -0.29056,-0.0256 -0.46146,-0.0256 -0.41875,1e-5 -0.79903,0.0769 -1.14085,0.23073 -0.33329,0.14529 -0.62811,0.35466 -0.88448,0.62811 -0.25637,0.26493 -0.47856,0.58539 -0.66656,0.96139 -0.17947,0.37602 -0.32047,0.78621 -0.42301,1.23058 l 0,9.57544 -1.42286,0 0,-13.86965 1.39722,0 0.0256,2.0766 c 0.31618,-0.72637 0.73492,-1.29465 1.25621,-1.70486 0.52128,-0.41872 1.16221,-0.62809 1.92278,-0.62811 0.15382,2e-5 0.31618,0.0171 0.4871,0.0513 0.17091,0.0342 0.29482,0.0727 0.37174,0.11536 l -0.0256,1.42286"
+       id="path3016"
+       inkscape:connector-curvature="0" />
+    <path
+       d="m 122.99779,128.80317 3.30718,-11.52386 1.52541,0 -4.88386,16.08725 c -0.10256,0.31619 -0.23074,0.67083 -0.38456,1.06394 -0.15382,0.3931 -0.35892,0.76056 -0.61529,1.10239 -0.25637,0.34182 -0.57256,0.6281 -0.94857,0.85884 -0.36746,0.23928 -0.81611,0.35892 -1.34594,0.35892 -0.0769,0 -0.16237,-0.009 -0.25637,-0.0256 -0.094,-0.009 -0.19228,-0.0214 -0.29483,-0.0385 -0.094,-0.0171 -0.18373,-0.0385 -0.26919,-0.0641 -0.0855,-0.0171 -0.15382,-0.0342 -0.20509,-0.0513 l -0.0128,-1.30749 c 0.0854,0.0256 0.19655,0.047 0.33328,0.0641 0.14527,0.0171 0.25209,0.0256 0.32046,0.0256 0.34183,0 0.64093,-0.0556 0.8973,-0.16664 0.26491,-0.10255 0.49565,-0.26065 0.6922,-0.47428 0.20509,-0.2051 0.38455,-0.46575 0.53838,-0.78193 0.15382,-0.30765 0.29055,-0.66657 0.41019,-1.07676 l 0.53838,-1.79459 -4.3583,-13.77992 1.56386,0 3.44818,11.52386"
+       id="path3018"
+       inkscape:connector-curvature="0" />
+    <path
+       d="m 139.93568,124.86788 c -2e-5,1.11949 -0.10256,2.08942 -0.30765,2.9098 -0.19656,0.82039 -0.48284,1.49977 -0.85884,2.03815 -0.37602,0.53838 -0.84176,0.94003 -1.39722,1.20494 -0.55548,0.25637 -1.18358,0.38456 -1.88432,0.38456 -0.83748,0 -1.55532,-0.16664 -2.15351,-0.49993 -0.58966,-0.34182 -1.07249,-0.81611 -1.4485,-1.42285 l 0,6.99891 -1.41003,0 0,-19.20215 1.30749,0 0.0641,1.89715 c 0.38455,-0.6751 0.87165,-1.20066 1.46131,-1.57668 0.58965,-0.38455 1.30321,-0.57682 2.14069,-0.57684 0.71783,2e-5 1.35449,0.12393 1.90996,0.37174 0.55546,0.24784 1.02548,0.63667 1.41004,1.16649 0.38455,0.52984 0.6751,1.20922 0.87166,2.03814 0.19654,0.8204 0.29481,1.81169 0.29483,2.9739 l 0,1.29467 m -1.42286,-1.29467 c -1e-5,-1.77749 -0.27774,-3.08498 -0.8332,-3.92247 -0.54694,-0.83746 -1.40578,-1.2562 -2.57653,-1.25621 -0.43583,1e-5 -0.82893,0.0641 -1.1793,0.19227 -0.34183,0.11966 -0.64521,0.2863 -0.91012,0.49993 -0.25637,0.21365 -0.47856,0.4572 -0.66656,0.73065 -0.17946,0.27347 -0.33328,0.56403 -0.46147,0.87166 l 0,7.30656 c 0.13673,0.2991 0.30337,0.57684 0.49993,0.8332 0.20509,0.25638 0.44009,0.47856 0.70501,0.66657 0.26492,0.188 0.56401,0.33328 0.8973,0.43583 0.34182,0.10255 0.72211,0.15382 1.14085,0.15382 1.15366,0 2.00395,-0.42301 2.55089,-1.26904 0.55546,-0.85456 0.83319,-2.17059 0.8332,-3.9481 l 0,-1.29467"
+       id="path3020"
+       inkscape:connector-curvature="0" />
+    <path
+       d="m 145.58044,113.7414 0,3.53791 2.37143,0 0,1.28186 -2.37143,0 0,9.21651 c 0,0.47857 0.0384,0.86739 0.11537,1.16649 0.0855,0.29056 0.19654,0.51702 0.33328,0.67938 0.13673,0.16237 0.29055,0.27347 0.46147,0.33328 0.17945,0.0513 0.36746,0.0769 0.56401,0.0769 0.188,1e-5 0.37173,-0.0128 0.5512,-0.0384 0.17945,-0.0342 0.33755,-0.0641 0.47428,-0.0897 l 0.0385,1.28185 c -0.15383,0.0684 -0.35893,0.11964 -0.61529,0.15382 -0.24783,0.0427 -0.50847,0.0641 -0.78193,0.0641 -0.36747,0 -0.7093,-0.0598 -1.02548,-0.17946 -0.30765,-0.11964 -0.57684,-0.32047 -0.80757,-0.60247 -0.23074,-0.28201 -0.41019,-0.65375 -0.53838,-1.11521 -0.12819,-0.47002 -0.19228,-1.05112 -0.19228,-1.74332 l 0,-9.2037 -2.14069,0 0,-1.28186 2.14069,0 0,-3.53791 1.42286,0"
+       id="path3022"
+       inkscape:connector-curvature="0" />
+    <path
+       d="m 150.43046,123.50912 c 0,-1.05111 0.12391,-1.97832 0.37174,-2.78162 0.24782,-0.80329 0.59392,-1.47839 1.0383,-2.02533 0.44437,-0.55546 0.9742,-0.97419 1.5895,-1.25622 0.62382,-0.28199 1.31175,-0.42299 2.06378,-0.42301 0.76056,2e-5 1.45276,0.14102 2.0766,0.42301 0.62382,0.28203 1.15793,0.70076 1.60231,1.25622 0.44437,0.54694 0.7862,1.22204 1.02549,2.02533 0.24781,0.8033 0.37172,1.73051 0.37173,2.78162 l 0,1.43567 c -1e-5,1.05112 -0.12392,1.97833 -0.37173,2.78162 -0.23929,0.8033 -0.58112,1.47841 -1.02549,2.02533 -0.44438,0.53838 -0.97849,0.94857 -1.60231,1.23058 -0.6153,0.282 -1.29895,0.42301 -2.05097,0.42301 -0.76057,0 -1.45277,-0.14101 -2.0766,-0.42301 -0.62383,-0.28201 -1.15794,-0.6922 -1.60231,-1.23058 -0.44438,-0.54692 -0.79048,-1.22203 -1.0383,-2.02533 -0.24783,-0.80329 -0.37174,-1.7305 -0.37174,-2.78162 l 0,-1.43567 m 1.43568,1.43567 c -1e-5,0.79475 0.0812,1.50832 0.24355,2.14069 0.16236,0.63239 0.39737,1.17077 0.70502,1.61514 0.31618,0.44438 0.70074,0.7862 1.15366,1.02548 0.45292,0.23928 0.96993,0.35892 1.55104,0.35892 0.61529,0 1.14939,-0.11964 1.60232,-0.35892 0.45291,-0.23928 0.82892,-0.5811 1.12803,-1.02548 0.29909,-0.44437 0.52128,-0.98275 0.66656,-1.61514 0.15382,-0.63237 0.23073,-1.34594 0.23074,-2.14069 l 0,-1.43567 c -1e-5,-0.77765 -0.0812,-1.48267 -0.24356,-2.11506 -0.16237,-0.64092 -0.40165,-1.18357 -0.71783,-1.62795 -0.30766,-0.45291 -0.68794,-0.79901 -1.14085,-1.0383 -0.45293,-0.24782 -0.96994,-0.37173 -1.55104,-0.37174 -0.57257,1e-5 -1.08531,0.12392 -1.53823,0.37174 -0.44438,0.23929 -0.82466,0.58539 -1.14084,1.0383 -0.30765,0.44438 -0.54266,0.98703 -0.70502,1.62795 -0.16237,0.63239 -0.24356,1.33741 -0.24355,2.11506 l 0,1.43567"
+       id="path3024"
+       inkscape:connector-curvature="0" />
+    <path
+       d="m 172.37218,112.48519 5.65297,16.42052 5.6786,-16.42052 1.9356,0 0,18.66377 -1.46131,0 0,-8.11413 0.12818,-8.11412 -5.71706,16.22825 -1.12803,0 -5.69142,-16.15134 0.12818,8.03721 0,8.11413 -1.46131,0 0,-18.66377 1.9356,0"
+       id="path3026"
+       inkscape:connector-curvature="0" />
+    <path
+       d="m 197.29601,131.14896 c -0.0684,-0.23074 -0.12392,-0.51702 -0.16664,-0.85884 -0.0427,-0.35038 -0.0726,-0.70502 -0.0897,-1.06394 -0.17947,0.29055 -0.39311,0.56829 -0.64093,0.8332 -0.24783,0.25637 -0.53411,0.48711 -0.85884,0.6922 -0.3162,0.19655 -0.67084,0.35465 -1.06394,0.47429 -0.3931,0.11964 -0.81611,0.17946 -1.26903,0.17946 -0.57256,0 -1.09385,-0.0812 -1.56386,-0.24356 -0.46147,-0.16236 -0.85884,-0.40591 -1.19212,-0.73065 -0.33329,-0.32474 -0.58966,-0.73066 -0.76911,-1.21776 -0.17946,-0.4871 -0.26919,-1.05539 -0.26919,-1.70486 0,-0.64093 0.11109,-1.23058 0.33328,-1.76896 0.22219,-0.54692 0.55119,-1.01693 0.98703,-1.41004 0.44437,-0.39309 0.99556,-0.70074 1.65359,-0.92293 0.65801,-0.22218 1.42285,-0.33328 2.29451,-0.33328 l 2.34579,0 0,-1.9356 c -1e-5,-0.99129 -0.24783,-1.70058 -0.74347,-2.12788 -0.48711,-0.43581 -1.20495,-0.65373 -2.15352,-0.65374 -0.44438,1e-5 -0.85457,0.0684 -1.23057,0.2051 -0.36747,0.13674 -0.68366,0.32902 -0.94857,0.57683 -0.26492,0.23929 -0.47002,0.52984 -0.61529,0.87166 -0.14528,0.33329 -0.21792,0.70076 -0.21792,1.10239 l -1.42285,-0.0128 c -1e-5,-0.53836 0.10681,-1.0511 0.32046,-1.53822 0.21364,-0.49564 0.51701,-0.93147 0.91011,-1.30749 0.3931,-0.376 0.86739,-0.67509 1.42286,-0.8973 0.55546,-0.22217 1.17075,-0.33326 1.84587,-0.33328 0.62383,2e-5 1.19211,0.0769 1.70486,0.23074 0.52128,0.14529 0.96993,0.38457 1.34595,0.71783 0.376,0.32475 0.66655,0.75204 0.87166,1.28186 0.21363,0.52129 0.32045,1.15795 0.32046,1.90996 l 0,7.07582 c -1e-5,0.23928 0.009,0.48711 0.0256,0.74348 0.0171,0.25637 0.0384,0.50847 0.0641,0.75629 0.0342,0.23928 0.0726,0.47001 0.11537,0.6922 0.0513,0.21364 0.10681,0.40165 0.16664,0.56401 l 0,0.15383 -1.51259,0 m -3.90965,-1.11522 c 0.44437,1e-5 0.85884,-0.0598 1.2434,-0.17945 0.39309,-0.12819 0.74346,-0.2991 1.05112,-0.51275 0.30763,-0.22218 0.57255,-0.47855 0.79474,-0.76911 0.23073,-0.29055 0.41446,-0.60246 0.5512,-0.93575 l 0,-3.37127 -2.14069,0 c -1.34168,1e-5 -2.35007,0.28201 -3.02517,0.84602 -0.67512,0.56402 -1.01267,1.32459 -1.01267,2.2817 0,0.91439 0.22219,1.58523 0.66657,2.01251 0.45291,0.41874 1.07675,0.62811 1.8715,0.6281"
+       id="path3028"
+       inkscape:connector-curvature="0" />
+    <path
+       d="m 204.10726,131.14896 -1.43568,0 0,-13.86965 1.43568,0 0,13.86965 m -1.64077,-17.86903 c 0,-0.29053 0.0812,-0.53836 0.24355,-0.74347 0.16237,-0.20508 0.3931,-0.30763 0.6922,-0.30764 0.2991,1e-5 0.52983,0.10256 0.6922,0.30764 0.17091,0.20511 0.25637,0.45294 0.25637,0.74347 0,0.29058 -0.0855,0.5384 -0.25637,0.74348 -0.16237,0.19657 -0.3931,0.29484 -0.6922,0.29482 -0.2991,2e-5 -0.52983,-0.0982 -0.6922,-0.29482 -0.16237,-0.20508 -0.24355,-0.4529 -0.24355,-0.74348"
+       id="path3030"
+       inkscape:connector-curvature="0" />
+    <path
+       d="m 209.84175,131.14896 -1.43568,0 0,-19.68926 1.43568,0 0,19.68926"
+       id="path3032"
+       inkscape:connector-curvature="0" />
+    <path
+       d="m 220.92157,127.73923 c -1e-5,-0.282 -0.0556,-0.54692 -0.16664,-0.79475 -0.10256,-0.24782 -0.27774,-0.4871 -0.52556,-0.71784 -0.23929,-0.23073 -0.55975,-0.46573 -0.96139,-0.70502 -0.39311,-0.23927 -0.88448,-0.49564 -1.47413,-0.76911 -0.63239,-0.282 -1.1964,-0.55119 -1.69205,-0.80756 -0.49565,-0.26491 -0.91439,-0.54692 -1.25621,-0.84603 -0.33328,-0.30763 -0.58965,-0.64946 -0.76911,-1.02548 -0.17946,-0.38454 -0.26919,-0.83747 -0.26919,-1.35876 0,-0.51273 0.094,-0.99129 0.28201,-1.43568 0.19655,-0.45291 0.47428,-0.84601 0.8332,-1.1793 0.35892,-0.33327 0.79475,-0.59391 1.30749,-0.78193 0.51274,-0.19654 1.0853,-0.29481 1.71768,-0.29483 0.6751,2e-5 1.28185,0.10257 1.82023,0.30765 0.53837,0.19656 0.99129,0.4743 1.35877,0.8332 0.376,0.35893 0.66228,0.79049 0.85884,1.29467 0.19654,0.49566 0.29481,1.03831 0.29482,1.62796 l -1.42285,0 c -1e-5,-0.35891 -0.0641,-0.70074 -0.19228,-1.02549 -0.12819,-0.33327 -0.3162,-0.62382 -0.56402,-0.87166 -0.24783,-0.25635 -0.5512,-0.45718 -0.91011,-0.60247 -0.35893,-0.15381 -0.77339,-0.23072 -1.2434,-0.23073 -0.48711,1e-5 -0.90157,0.0684 -1.24339,0.2051 -0.34184,0.12819 -0.62384,0.30338 -0.84603,0.52556 -0.22219,0.21365 -0.38456,0.46147 -0.4871,0.74347 -0.10255,0.27347 -0.15383,0.55121 -0.15382,0.8332 -1e-5,0.28202 0.0427,0.53412 0.12818,0.7563 0.0855,0.21365 0.23928,0.42302 0.46147,0.6281 0.23073,0.20511 0.53837,0.41875 0.92293,0.64093 0.38455,0.21365 0.8802,0.46575 1.48695,0.75629 0.64092,0.28202 1.21775,0.55548 1.7305,0.82039 0.51273,0.26492 0.94429,0.55975 1.29467,0.88448 0.35891,0.31619 0.63237,0.67511 0.82039,1.07675 0.19654,0.40165 0.29481,0.88021 0.29482,1.43568 -1e-5,0.57256 -0.10255,1.08957 -0.30764,1.55104 -0.20511,0.46147 -0.49993,0.85457 -0.88448,1.1793 -0.37602,0.32474 -0.83321,0.57684 -1.37158,0.7563 -0.52984,0.17091 -1.11949,0.25637 -1.76896,0.25637 -0.75202,0 -1.41431,-0.10682 -1.98687,-0.32047 -0.57256,-0.22218 -1.05539,-0.51701 -1.44849,-0.88447 -0.38456,-0.36747 -0.67938,-0.79475 -0.88448,-1.28186 -0.19655,-0.4871 -0.29483,-1.00411 -0.29483,-1.55104 l 1.43568,0 c 0.0256,0.54693 0.13673,0.99558 0.33328,1.34595 0.20509,0.35037 0.45719,0.62811 0.75629,0.8332 0.2991,0.2051 0.63238,0.3461 0.99985,0.42301 0.36746,0.0769 0.73065,0.11537 1.08957,0.11537 0.47001,0 0.88447,-0.0598 1.2434,-0.17946 0.36746,-0.12818 0.67083,-0.29483 0.91012,-0.49992 0.24781,-0.21364 0.43154,-0.46147 0.55119,-0.74348 0.12818,-0.29055 0.19227,-0.59819 0.19228,-0.92293"
+       id="path3034"
+       inkscape:connector-curvature="0" />
+  </g>
+  <g
+     id="g3186"
+     transform="translate(9.9114061,8.2675716)">
+    <g
+       transform="matrix(1.2473152,0,0,1.2473152,-1270.0924,-84.630526)"
+       style="font-size:40px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;text-align:center;line-height:125%;letter-spacing:0.30000001px;word-spacing:0px;writing-mode:lr-tb;text-anchor:middle;fill:#3d3d3b;fill-opacity:1;stroke:none;font-family:Roboto Condensed;-inkscape-font-specification:'Roboto Condensed, Bold'"
+       id="flowRoot4199">
+      <path
+         d="m 1110.6414,141.23568 c -0.2995,0.32552 -0.7031,0.69661 -1.2109,1.11328 -0.5079,0.41667 -1.1459,0.8138 -1.9141,1.1914 -0.7552,0.36459 -1.6471,0.67058 -2.6758,0.91797 -1.0286,0.26042 -2.2135,0.39063 -3.5547,0.39063 -1.5885,0 -3.0208,-0.2474 -4.2968,-0.74219 -1.2761,-0.49479 -2.3698,-1.24349 -3.2813,-2.24609 -0.9114,-1.0026 -1.6146,-2.26562 -2.1094,-3.78907 -0.4817,-1.53645 -0.7226,-3.33983 -0.7226,-5.41015 l 0,-4.80469 c 0,-2.07029 0.2344,-3.86717 0.7031,-5.39062 0.4688,-1.53644 1.1328,-2.81248 1.9922,-3.82813 0.8724,-1.0156 1.9271,-1.7708 3.1641,-2.26562 1.2499,-0.49477 2.6497,-0.74216 4.1992,-0.74219 1.6145,3e-5 3.0078,0.20185 4.1797,0.60547 1.1718,0.40367 2.1484,1.00914 2.9296,1.8164 0.7813,0.7943 1.3802,1.78388 1.7969,2.96875 0.4167,1.1719 0.6836,2.52607 0.8008,4.0625 l -5.5859,0 c -0.078,-0.89841 -0.2084,-1.64711 -0.3907,-2.24609 -0.1692,-0.59894 -0.4166,-1.0742 -0.7421,-1.42578 -0.3126,-0.36456 -0.7032,-0.62498 -1.1719,-0.78125 -0.4558,-0.15623 -1.0026,-0.23435 -1.6406,-0.23438 -0.7553,3e-5 -1.4128,0.13675 -1.9727,0.41016 -0.5599,0.26044 -1.0287,0.69013 -1.4063,1.28906 -0.3645,0.58596 -0.638,1.35419 -0.8203,2.30469 -0.1823,0.93752 -0.2734,2.07684 -0.2734,3.41797 l 0,4.84375 c 0,1.35418 0.098,2.50001 0.293,3.4375 0.2083,0.93751 0.5143,1.70573 0.9179,2.30469 0.4167,0.58594 0.9375,1.01563 1.5625,1.28906 0.625,0.26042 1.3607,0.39063 2.2071,0.39062 0.5078,1e-5 0.9375,-0.0391 1.289,-0.11718 0.3646,-0.0781 0.6706,-0.16927 0.918,-0.27344 0.2604,-0.11718 0.4687,-0.23437 0.625,-0.35156 0.1693,-0.11719 0.3125,-0.21484 0.4297,-0.29297 l 0,-5.21485 -4.0235,0 0,-4.33593 9.7852,0 0,11.73828"
+         id="path3002"
+         inkscape:connector-curvature="0" />
+      <path
+         d="m 1131.2344,134.55599 c 0,3.32032 -0.573,5.86589 -1.7188,7.63672 -1.1328,1.77083 -2.8255,2.65625 -5.0781,2.65625 -0.8984,0 -1.6927,-0.18229 -2.3828,-0.54688 -0.6771,-0.36458 -1.263,-0.8789 -1.7578,-1.54297 l 0,9.82422 -5.5274,0 0,-29.25781 5.1172,0 0.1953,1.93359 c 0.5078,-0.74216 1.1133,-1.31508 1.8164,-1.71875 0.7162,-0.40362 1.5495,-0.60544 2.5,-0.60546 2.2787,2e-5 3.9844,0.83986 5.1172,2.51953 1.1458,1.6797 1.7188,4.25131 1.7188,7.71484 l 0,1.38672 m -5.5078,-1.38672 c -10e-5,-1.00259 -0.052,-1.85545 -0.1563,-2.55859 -0.1042,-0.71613 -0.2734,-1.29556 -0.5078,-1.73828 -0.2344,-0.45572 -0.5404,-0.78775 -0.918,-0.9961 -0.3646,-0.20831 -0.8203,-0.31248 -1.3672,-0.3125 -0.5859,2e-5 -1.0872,0.12372 -1.5039,0.3711 -0.4036,0.24741 -0.7291,0.59897 -0.9765,1.05468 l 0,9.90235 c 0.2343,0.42969 0.5534,0.76823 0.957,1.01562 0.4167,0.23438 0.9375,0.35157 1.5625,0.35156 1.0937,1e-5 1.849,-0.46223 2.2656,-1.38671 0.4297,-0.92448 0.6445,-2.36328 0.6446,-4.31641 l 0,-1.38672"
+         id="path3004"
+         inkscape:connector-curvature="0" />
+      <path
+         d="m 1134.2492,133.2474 c 0,-3.46353 0.625,-6.04816 1.875,-7.75391 1.25,-1.70571 3.0013,-2.55857 5.2539,-2.55859 1.0287,2e-5 1.9011,0.20184 2.6172,0.60546 0.7161,0.39065 1.3216,0.94403 1.8164,1.66016 l 0.2149,-1.875 4.9804,0 0,21.13281 c 0,1.44531 -0.2148,2.6888 -0.6445,3.73047 -0.4167,1.05468 -1.0091,1.92057 -1.7773,2.59766 -0.7683,0.67707 -1.6928,1.17838 -2.7735,1.5039 -1.0677,0.32552 -2.2591,0.48828 -3.5742,0.48829 -0.4948,-1e-5 -1.0417,-0.0521 -1.6406,-0.15625 -0.599,-0.10418 -1.1979,-0.26043 -1.7969,-0.46875 -0.599,-0.19532 -1.1719,-0.44923 -1.7188,-0.76172 -0.5338,-0.29949 -0.983,-0.65756 -1.3476,-1.07422 l 1.8555,-3.82813 c 0.2474,0.26042 0.5403,0.5013 0.8789,0.72266 0.3515,0.23437 0.7161,0.42968 1.0937,0.58594 0.3906,0.16926 0.7943,0.29947 1.211,0.39062 0.4166,0.10416 0.8203,0.15625 1.2109,0.15625 0.5599,0 1.0547,-0.0651 1.4844,-0.19531 0.4427,-0.11719 0.8138,-0.32552 1.1132,-0.625 0.2995,-0.29948 0.5209,-0.69662 0.6641,-1.19141 0.1562,-0.49479 0.2344,-1.11328 0.2344,-1.85547 l 0,-1.69921 c -0.5078,0.66406 -1.1003,1.17838 -1.7774,1.54296 -0.664,0.35157 -1.4453,0.52735 -2.3437,0.52735 -1.1198,0 -2.1224,-0.22136 -3.0078,-0.66406 -0.8724,-0.44271 -1.6146,-1.09375 -2.2266,-1.95313 -0.5989,-0.85937 -1.0612,-1.92057 -1.3867,-3.18359 -0.3255,-1.27604 -0.4883,-2.74739 -0.4883,-4.41407 l 0,-1.38671 m 5.5274,1.38671 c 0,1.95314 0.2539,3.37892 0.7617,4.27735 0.5078,0.88542 1.3151,1.32813 2.4219,1.32812 0.5989,1e-5 1.1002,-0.10416 1.5039,-0.3125 0.4166,-0.22135 0.7552,-0.52734 1.0156,-0.91797 l 0,-10.09765 c -0.2735,-0.42967 -0.6185,-0.7617 -1.0352,-0.9961 -0.4036,-0.23435 -0.8854,-0.35154 -1.4453,-0.35156 -1.0937,2e-5 -1.9075,0.44924 -2.4414,1.34766 -0.5208,0.89845 -0.7812,2.34376 -0.7812,4.33594 l 0,1.38671"
+         id="path3006"
+         inkscape:connector-curvature="0" />
+    </g>
+    <g
+       transform="matrix(1.2831852,0,0,1.2831852,-1242.5744,-88.562445)"
+       style="font-size:40px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;text-align:center;line-height:125%;letter-spacing:0.30000001px;word-spacing:0px;writing-mode:lr-tb;text-anchor:middle;fill:#1f8ece;fill-opacity:1;stroke:none;font-family:Roboto Condensed;-inkscape-font-specification:'Roboto Condensed, Bold'"
+       id="flowRoot4213">
+      <path
+         d="m 1121.475,132.79818 c 0,1.99219 -0.2474,3.74349 -0.7422,5.2539 -0.4948,1.51042 -1.1914,2.76693 -2.0898,3.76953 -0.8855,1.00261 -1.9597,1.75782 -3.2227,2.26563 -1.25,0.50781 -2.6367,0.76172 -4.1601,0.76172 -1.5235,0 -2.9167,-0.25391 -4.1797,-0.76172 -1.2631,-0.50781 -2.3503,-1.26302 -3.2618,-2.26563 -0.8984,-1.0026 -1.6015,-2.25911 -2.1093,-3.76953 -0.4948,-1.51041 -0.7422,-3.26171 -0.7422,-5.2539 l 0,-4.72657 c 0,-2.04425 0.2474,-3.84112 0.7422,-5.39062 0.4948,-1.56248 1.1914,-2.86456 2.0898,-3.90625 0.8985,-1.04164 1.9792,-1.82289 3.2422,-2.34375 1.263,-0.53383 2.6562,-0.80075 4.1797,-0.80078 1.5234,3e-5 2.9101,0.26695 4.1601,0.80078 1.2631,0.52086 2.3438,1.30211 3.2422,2.34375 0.9115,1.04169 1.6146,2.34377 2.1094,3.90625 0.4948,1.5495 0.7422,3.34637 0.7422,5.39062 l 0,4.72657 m -5.7617,-4.76563 c 0,-1.35415 -0.098,-2.50649 -0.293,-3.45703 -0.1953,-0.96352 -0.4818,-1.75128 -0.8594,-2.36328 -0.3776,-0.61196 -0.8463,-1.06118 -1.4062,-1.34766 -0.5599,-0.28643 -1.2045,-0.42966 -1.9336,-0.42968 -0.7422,2e-5 -1.3932,0.14325 -1.9531,0.42968 -0.5599,0.28648 -1.0287,0.7357 -1.4063,1.34766 -0.3776,0.612 -0.6641,1.39976 -0.8594,2.36328 -0.1953,0.95054 -0.2929,2.10288 -0.2929,3.45703 l 0,4.76563 c 0,1.28907 0.098,2.39584 0.2929,3.32031 0.1953,0.91147 0.4818,1.66016 0.8594,2.24609 0.3906,0.58595 0.8659,1.01563 1.4258,1.28907 0.5729,0.27344 1.2305,0.41016 1.9727,0.41015 0.7291,1e-5 1.3671,-0.13671 1.914,-0.41015 0.5599,-0.27344 1.0286,-0.70312 1.4063,-1.28907 0.3776,-0.58593 0.6575,-1.33462 0.8398,-2.24609 0.1953,-0.92447 0.293,-2.03124 0.293,-3.32031 l 0,-4.76563"
+         style="fill:#1f8ece;fill-opacity:1"
+         id="path3009"
+         inkscape:connector-curvature="0" />
+      <path
+         d="m 1131.7164,139.69271 10.0781,0 0,4.76562 -15.8203,0 0,-28.4375 5.7422,0 0,23.67188"
+         style="fill:#1f8ece;fill-opacity:1"
+         id="path3011"
+         inkscape:connector-curvature="0" />
+    </g>
+  </g>
+</svg>

commit cce2a22442aefb9e65b5cc10fed0db4e5d9e11b8
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 9 13:06:28 2017 +0100

    Say PGP/Inline instead of inline-pgp
    
    * src/addion-options.cpp (set_labels): Change inline-pgp to
    PGP/Inline.
    
    --
    This should be more inline with PGP/MIME

diff --git a/src/addin-options.cpp b/src/addin-options.cpp
index 083d89e..eb7d596 100644
--- a/src/addin-options.cpp
+++ b/src/addin-options.cpp
@@ -43,7 +43,7 @@ set_labels (HWND dlg)
     { IDC_ENCRYPT_DEFAULT,  N_("&Encrypt new messages by default")},
     { IDC_SIGN_DEFAULT,     N_("&Sign new messages by default")},
     { IDC_INLINE_PGP,       N_("&Send OpenPGP mails without "
-                               "attachments as inline-pgp")},
+                               "attachments as PGP/Inline")},
 //    { IDC_AUTORRESOLVE,     N_("&Search for OpenPGP keys automatically when encrypting")},
 
 

-----------------------------------------------------------------------

Summary of changes:
 src/addin-options.cpp    |   2 +-
 src/dialogs.h            |   2 +
 src/dialogs.rc           |  10 ++-
 src/gpgoladdin.cpp       |  10 +--
 src/icons/Makefile.am    |   3 +-
 src/icons/logo.bmp       | Bin 0 -> 30774 bytes
 src/icons/logo.svg       | 174 +++++++++++++++++++++++++++++++++++++++++++++++
 src/mail.cpp             |  31 ++++-----
 src/ribbon-callbacks.cpp |  29 +++++---
 src/ribbon-callbacks.h   |   6 +-
 10 files changed, 228 insertions(+), 39 deletions(-)
 create mode 100644 src/icons/logo.bmp
 create mode 100644 src/icons/logo.svg


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 10 12:43:58 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 10 Jan 2017 12:43:58 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-52-gc8cfc62
Message-ID: <E1cQuqP-0001hd-R9@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  c8cfc62125aceee0ca48aab5c8a9fea1ec1ef652 (commit)
       via  bfd6a490129ffc7c7ac8776bf5a5da3b1ddf6d42 (commit)
      from  0cc975d8a1cd54115938202432e43263b8893ea4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c8cfc62125aceee0ca48aab5c8a9fea1ec1ef652
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 10 12:38:07 2017 +0100

    tests: Add test for gpgconf.
    
    * tests/openpgp/Makefile.am (XTESTS): Add new test.
    * tests/openpgp/defs.scm (percent-encode): New function.
    (gpg-conf): Generalize so that we can feed stdin.
    (gpg-config): New function.
    * tests/openpgp/gpgconf.scm: New file.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index c93857f..d1dd449 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -92,6 +92,7 @@ XTESTS = \
 	quick-key-manipulation.scm \
 	key-selection.scm \
 	delete-keys.scm \
+	gpgconf.scm \
 	issue2015.scm \
 	issue2346.scm \
 	issue2417.scm \
diff --git a/tests/openpgp/defs.scm b/tests/openpgp/defs.scm
index 837e096..1895a75 100644
--- a/tests/openpgp/defs.scm
+++ b/tests/openpgp/defs.scm
@@ -1,6 +1,6 @@
 ;; Common definitions for the OpenPGP test scripts.
 ;;
-;; Copyright (C) 2016 g10 Code GmbH
+;; Copyright (C) 2016, 2017 g10 Code GmbH
 ;;
 ;; This file is part of GnuPG.
 ;;
@@ -96,6 +96,21 @@
 (assert (equal? (percent-decode "%61") "a"))
 (assert (equal? (percent-decode "foob%61r") "foobar"))
 
+(define (percent-encode s)
+  (define (encode c)
+    `(#\% ,@(string->list (number->string (char->integer c) 16))))
+  (let loop ((acc '()) (cs (reverse (string->list s))))
+    (if (null? cs)
+	(list->string acc)
+	(case (car cs)
+	  ((#\: #\%)
+	   (loop (append (encode (car cs)) acc) (cdr cs)))
+	  (else
+	   (loop (cons (car cs) acc) (cdr cs)))))))
+(assert (equal? (percent-encode "") ""))
+(assert (equal? (percent-encode "%61") "%2561"))
+(assert (equal? (percent-encode "foob%61r") "foob%2561r"))
+
 (define tools
   '((gpgv "GPGV" "g10/gpgv")
     (gpg-connect-agent "GPG_CONNECT_AGENT" "tools/gpg-connect-agent")
@@ -117,13 +132,27 @@
 			  (string-append (getenv "objdir") "/" (caddr t)))))))
 
 (define (gpg-conf . args)
-  (let ((s (call-popen `(,(tool-hardcoded 'gpgconf) , at args) "")))
+  (gpg-conf' "" args))
+(define (gpg-conf' input args)
+  (let ((s (call-popen `(,(tool-hardcoded 'gpgconf) , at args) input)))
     (map (lambda (line) (map percent-decode (string-split line #\:)))
 	 (string-split-newlines s))))
 (define :gc:c:name car)
 (define :gc:c:description cadr)
 (define :gc:c:pgmname caddr)
 
+(define (gpg-config component key)
+  (package
+   (define (value)
+     (assoc key (gpg-conf '--list-options component)))
+   (define (update value)
+     (gpg-conf' (string-append key ":0:" (percent-encode value))
+		`(--change-options ,component)))
+   (define (clear)
+     (gpg-conf' (string-append key ":1:")
+		`(--change-options ,component)))))
+
+
 (unless installed?
 	(setenv "GNUPG_BUILDDIR" (getenv "objdir") #t))
 (define gpg-components (apply gpg-conf
diff --git a/tests/openpgp/gpgconf.scm b/tests/openpgp/gpgconf.scm
new file mode 100644
index 0000000..cdb6b76
--- /dev/null
+++ b/tests/openpgp/gpgconf.scm
@@ -0,0 +1,41 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2017 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(load (with-path "defs.scm"))
+(setup-environment)
+
+(for-each-p'
+ "Checking reading and writing configuration via gpgconf... "
+ (lambda (name opt make-value)
+   (call-with-progress
+    ""
+    (lambda (progress)
+      (do ((i 0 (+ 1 i))) ((> i 12) #t)
+	(opt::update (make-value i))
+	(assert (string=? (make-value i) (list-ref (opt::value) 9)))
+	(progress ".")))))
+ (lambda (name . rest) name)
+ (list "keyserver" "verbose")
+ (list (gpg-config 'gpg "keyserver")
+       (gpg-config 'gpg "verbose"))
+ (list (lambda (i) (if (even? i) "\"hkp://foo.bar" "\"hkps://bar.baz"))
+       (lambda (i) (number->string
+		    ;; gpgconf: argument for option verbose of type 0
+		    ;; (none) must be positive
+		    (+ 1 i)))))

commit bfd6a490129ffc7c7ac8776bf5a5da3b1ddf6d42
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 10 12:31:46 2017 +0100

    common: Fix fallback code.
    
    * common/logging.c (_log_assert): Fix the variant for compilers that
    do not support __FUNCTION__.
    * common/logging.h (_log_assert): Likewise.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/common/logging.c b/common/logging.c
index ca1341c..c06a34f 100644
--- a/common/logging.c
+++ b/common/logging.c
@@ -1007,7 +1007,7 @@ void
 _log_assert (const char *expr, const char *file, int line)
 {
   log_log (GPGRT_LOG_BUG, "Assertion \"%s\" failed (%s:%d)\n",
-           file, line, func);
+           expr, file, line);
   abort (); /* Never called; just to make the compiler happy.  */
 }
 #endif /*!GPGRT_HAVE_MACRO_FUNCTION*/
diff --git a/common/logging.h b/common/logging.h
index fc9e846..8edc5c9 100644
--- a/common/logging.h
+++ b/common/logging.h
@@ -62,7 +62,7 @@ estream_t log_get_stream (void);
    : _log_assert (#expr, __FILE__, __LINE__, __FUNCTION__))
 #else /*!GPGRT_HAVE_MACRO_FUNCTION*/
   void bug_at (const char *file, int line);
-  void _log_assert (const char *expr, const char *file, int line;
+  void _log_assert (const char *expr, const char *file, int line);
 # define BUG() bug_at( __FILE__ , __LINE__ )
 # define log_assert(expr)                                       \
   ((expr)                                                       \

-----------------------------------------------------------------------

Summary of changes:
 common/logging.c                              |  2 +-
 common/logging.h                              |  2 +-
 tests/openpgp/Makefile.am                     |  1 +
 tests/openpgp/defs.scm                        | 33 +++++++++++++++++++++++++--
 tests/openpgp/{4gb-packet.scm => gpgconf.scm} | 27 ++++++++++++++++------
 5 files changed, 54 insertions(+), 11 deletions(-)
 copy tests/openpgp/{4gb-packet.scm => gpgconf.scm} (51%)
 mode change 100755 => 100644


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 10 16:08:48 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 10 Jan 2017 16:08:48 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-54-g88e42ef
Message-ID: <E1cQy2c-0002OL-RF@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  88e42ef08d65d4d1bc29c6cea48df19ca0d5e2bd (commit)
       via  1f5caf90bfaaaf7b9d8c06c12087aeeae3748032 (commit)
      from  c8cfc62125aceee0ca48aab5c8a9fea1ec1ef652 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 88e42ef08d65d4d1bc29c6cea48df19ca0d5e2bd
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 10 15:50:57 2017 +0100

    tests: Improve gpgconf test.
    
    * tests/openpgp/defs.scm (valgrind): New variable.
    (gpg-config): Fix clearing an option.
    * tests/openpgp/gpgconf.scm: Also toggle 'quiet'.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/defs.scm b/tests/openpgp/defs.scm
index 1895a75..548476b 100644
--- a/tests/openpgp/defs.scm
+++ b/tests/openpgp/defs.scm
@@ -131,6 +131,15 @@
 			  (string-append bin-prefix "/" (basename (caddr t)))
 			  (string-append (getenv "objdir") "/" (caddr t)))))))
 
+;; You can splice VALGRIND into your argument vector to run programs
+;; under valgrind.  For example, to run valgrind on gpg, you may want
+;; to redefine gpg:
+;;
+;; (set! gpg `(, at valgrind , at gpg))
+;;
+(define valgrind
+  '("/usr/bin/valgrind" --leak-check=full --error-exitcode=154))
+
 (define (gpg-conf . args)
   (gpg-conf' "" args))
 (define (gpg-conf' input args)
@@ -149,7 +158,7 @@
      (gpg-conf' (string-append key ":0:" (percent-encode value))
 		`(--change-options ,component)))
    (define (clear)
-     (gpg-conf' (string-append key ":1:")
+     (gpg-conf' (string-append key ":16:")
 		`(--change-options ,component)))))
 
 
diff --git a/tests/openpgp/gpgconf.scm b/tests/openpgp/gpgconf.scm
index cdb6b76..b4cc9cb 100644
--- a/tests/openpgp/gpgconf.scm
+++ b/tests/openpgp/gpgconf.scm
@@ -27,15 +27,25 @@
     ""
     (lambda (progress)
       (do ((i 0 (+ 1 i))) ((> i 12) #t)
-	(opt::update (make-value i))
-	(assert (string=? (make-value i) (list-ref (opt::value) 9)))
+	(let ((value (make-value i)))
+	  (if value
+	      (begin
+		(opt::update value)
+		(assert (string=? value (list-ref (opt::value) 9))))
+	      (begin
+		(opt::clear)
+		(let ((v (opt::value)))
+		  (assert (or (< (length v) 10)
+			      (string=? "" (list-ref v 9))))))))
 	(progress ".")))))
  (lambda (name . rest) name)
- (list "keyserver" "verbose")
+ (list "keyserver" "verbose" "quiet")
  (list (gpg-config 'gpg "keyserver")
-       (gpg-config 'gpg "verbose"))
+       (gpg-config 'gpg "verbose")
+       (gpg-config 'gpg "quiet"))
  (list (lambda (i) (if (even? i) "\"hkp://foo.bar" "\"hkps://bar.baz"))
        (lambda (i) (number->string
 		    ;; gpgconf: argument for option verbose of type 0
 		    ;; (none) must be positive
-		    (+ 1 i)))))
+		    (+ 1 i)))
+       (lambda (i) (if (even? i) #f "1"))))

commit 1f5caf90bfaaaf7b9d8c06c12087aeeae3748032
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 10 15:42:27 2017 +0100

    tools: Fix memory leaks and improve error handling.
    
    * tools/gpgconf-comp.c (gc_option_free): New function.
    (gc_components_free): Likewise.
    (gc_components_init): Likewise.
    (retrieve_options_from_program): Use 'xfree', fix memory leak.
    (change_options_program): Improve error handling.
    (gc_component_change_options): Fix memory leaks.
    * tools/gpgconf.c (main): Initialize components.
    * tools/gpgconf.h (gc_components_init): New prototype.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index 925f1cf..2dcf075 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -1102,6 +1102,35 @@ struct error_line_s
 
 
 

+
+/* Initialization and finalization.  */
+
+static void
+gc_option_free (gc_option_t *o)
+{
+  if (o == NULL || o->name == NULL)
+    return;
+
+  xfree (o->value);
+  gc_option_free (o + 1);
+}
+
+static void
+gc_components_free (void)
+{
+  int i;
+  for (i = 0; i < DIM (gc_component); i++)
+    gc_option_free (gc_component[i].options);
+}
+
+void
+gc_components_init (void)
+{
+  atexit (gc_components_free);
+}
+
+

+
 /* Engine specific support.  */
 static void
 gpg_agent_runtime_change (int killflag)
@@ -2183,7 +2212,7 @@ retrieve_options_from_program (gc_component_t component, gc_backend_t backend)
 	      if (!(option->flags & GC_OPT_FLAG_LIST))
 		{
 		  if (option->value)
-		    free (option->value);
+		    xfree (option->value);
 		  option->value = opt_value;
 		}
 	      else
@@ -2192,10 +2221,9 @@ retrieve_options_from_program (gc_component_t component, gc_backend_t backend)
 		    option->value = opt_value;
 		  else
 		    {
-		      char *opt_val = opt_value;
-
-		      option->value = xasprintf ("%s,%s", option->value,
-						 opt_val);
+		      char *old = option->value;
+		      option->value = xasprintf ("%s,%s", old, opt_value);
+		      xfree (old);
 		      xfree (opt_value);
 		    }
 		}
@@ -2872,7 +2900,12 @@ change_options_program (gc_component_t component, gc_backend_t backend,
   res = link (dest_filename, orig_filename);
 #endif
   if (res < 0 && errno != ENOENT)
-    return -1;
+    {
+      xfree (dest_filename);
+      xfree (src_filename);
+      xfree (orig_filename);
+      return -1;
+    }
   if (res < 0)
     {
       xfree (orig_filename);
@@ -3365,6 +3398,7 @@ gc_component_change_options (int component, estream_t in, estream_t out,
 		}
 	      if (err)
 		break;
+	      xfree (src_filename[i]);
 	      src_filename[i] = NULL;
 	    }
 	}
@@ -3434,10 +3468,17 @@ gc_component_change_options (int component, estream_t in, estream_t out,
 	unlink (backup_filename);
 #endif /* HAVE_W32_SYSTEM */
 	rename (orig_filename[backend], backup_filename);
+	xfree (backup_filename);
       }
 
  leave:
   xfree (line);
+  for (backend = 0; backend < GC_BACKEND_NR; backend++)
+    {
+      xfree (src_filename[backend]);
+      xfree (dest_filename[backend]);
+      xfree (orig_filename[backend]);
+    }
 }
 
 
diff --git a/tools/gpgconf.c b/tools/gpgconf.c
index af65424..a1034e6 100644
--- a/tools/gpgconf.c
+++ b/tools/gpgconf.c
@@ -470,6 +470,7 @@ main (int argc, char **argv)
   /* Make sure that our subsystems are ready.  */
   i18n_init();
   init_common_subsystems (&argc, &argv);
+  gc_components_init ();
 
   /* Parse the command line. */
   pargs.argc  = &argc;
diff --git a/tools/gpgconf.h b/tools/gpgconf.h
index 39d34b6..d6d7627 100644
--- a/tools/gpgconf.h
+++ b/tools/gpgconf.h
@@ -38,6 +38,10 @@ struct
 
 
 /*-- gpgconf-comp.c --*/
+
+/* Initialize the components.  */
+void gc_components_init (void);
+
 /* Percent-Escape special characters.  The string is valid until the
    next invocation of the function.  */
 char *gc_percent_escape (const char *src);

-----------------------------------------------------------------------

Summary of changes:
 tests/openpgp/defs.scm    | 11 +++++++++-
 tests/openpgp/gpgconf.scm | 20 +++++++++++++-----
 tools/gpgconf-comp.c      | 53 +++++++++++++++++++++++++++++++++++++++++------
 tools/gpgconf.c           |  1 +
 tools/gpgconf.h           |  4 ++++
 5 files changed, 77 insertions(+), 12 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 10 16:29:07 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 10 Jan 2017 16:29:07 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-55-g7345c64
Message-ID: <E1cQyMH-0003Cd-Ei@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  7345c64b0887e51d8c8c6eaf49c9dbf5b0f45228 (commit)
      from  88e42ef08d65d4d1bc29c6cea48df19ca0d5e2bd (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 7345c64b0887e51d8c8c6eaf49c9dbf5b0f45228
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 10 16:24:31 2017 +0100

    doc: Mention dirmngr.conf
    
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
index fc617d8..4448bf0 100644
--- a/doc/dirmngr.texi
+++ b/doc/dirmngr.texi
@@ -131,6 +131,10 @@ will thus trigger reading of fresh CRLs.
 @node Dirmngr Options
 @section Option Summary
 
+Note that all long options with the exception of @option{--options}
+and @option{--homedir} may also be given in the configuration file
+after stripping off the two leading dashes.
+
 @table @gnupgtabopt
 
 @item --options @var{file}
@@ -497,11 +501,20 @@ certificate for that pool.  Otherwise, it will use the system CAs.
 @section Configuration
 
 Dirmngr makes use of several directories when running in daemon mode:
+There are a few configuration files whih control the operation of
+dirmngr.  By default they may all be found in the current home
+directory (@pxref{option --homedir}).
 
 @table @file
 
- at item ~/.gnupg
-This is the standard home directory for all configuration files.
+ at item dirmngr.conf
+ at efindex dirmngr.conf
+This is the standard configuration file read by @command{dirmngr} on
+startup.  It may contain any valid long option; the leading two dashes
+may not be entered and the option may not be abbreviated.  This file
+is also read after a @code{SIGHUP} however not all options will
+actually have an effect.  This default name may be changed on the
+command line (@pxref{option --options}).  You should backup this file.
 
 @item /etc/gnupg/trusted-certs
 This directory should be filled with certificates of Root CAs you

-----------------------------------------------------------------------

Summary of changes:
 doc/dirmngr.texi | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 10 23:17:44 2017
From: cvs at cvs.gnupg.org (by Daniel Kahn Gillmor)
Date: Tue, 10 Jan 2017 23:17:44 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-56-ga20a450
Message-ID: <E1cR4ji-0004wr-Na@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  a20a450ac4ef10847fd59a5fd3acbbd2bfcaa6a2 (commit)
      from  7345c64b0887e51d8c8c6eaf49c9dbf5b0f45228 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a20a450ac4ef10847fd59a5fd3acbbd2bfcaa6a2
Author: Daniel Kahn Gillmor <dkg at fifthhorseman.net>
Date:   Tue Jan 10 17:12:09 2017 -0500

    systemd-user: Enable "systemctl --user reload {dirmngr,gpg-agent}"
    
    * doc/examples/systemd-user/*.service: Add ExecReload directives to
      indicate the canonical way to reload the services.
    
    GnuPG recommends reloading the agent and dirmngr with "gpgconf
    --reload".  if anyone is running them as systemd user services, they
    might ask them to reload in the systemd way, so teach systemd the
    right thing to do.
    
    Signed-off-by: Daniel Kahn Gillmor <dkg at fifthhorseman.net>

diff --git a/doc/examples/systemd-user/dirmngr.service b/doc/examples/systemd-user/dirmngr.service
index c79dfc5..ded533b 100644
--- a/doc/examples/systemd-user/dirmngr.service
+++ b/doc/examples/systemd-user/dirmngr.service
@@ -8,3 +8,4 @@ RefuseManualStart=true
 
 [Service]
 ExecStart=/usr/bin/dirmngr --supervised
+ExecReload=/usr/bin/gpgconf --reload dirmngr
diff --git a/doc/examples/systemd-user/gpg-agent.service b/doc/examples/systemd-user/gpg-agent.service
index 9ab9220..e88dc7f 100644
--- a/doc/examples/systemd-user/gpg-agent.service
+++ b/doc/examples/systemd-user/gpg-agent.service
@@ -8,3 +8,4 @@ RefuseManualStart=true
 
 [Service]
 ExecStart=/usr/bin/gpg-agent --supervised
+ExecReload=/usr/bin/gpgconf --reload gpg-agent

-----------------------------------------------------------------------

Summary of changes:
 doc/examples/systemd-user/dirmngr.service   | 1 +
 doc/examples/systemd-user/gpg-agent.service | 1 +
 2 files changed, 2 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 10 23:53:40 2017
From: cvs at cvs.gnupg.org (by Daniel Kahn Gillmor)
Date: Tue, 10 Jan 2017 23:53:40 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.26-6-g19de4ce
Message-ID: <E1cR5IU-0006H6-Sn@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  19de4cef279272d3969e36dd8cd2fa05a7bf5276 (commit)
      from  704c31992e8716bbe61e6d5751e125a64badeef0 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 19de4cef279272d3969e36dd8cd2fa05a7bf5276
Author: Daniel Kahn Gillmor <dkg at fifthhorseman.net>
Date:   Tue Jan 10 17:49:31 2017 -0500

    doc,configure: Be consistent about preferring --with-libgpg-error-prefix
    
    * doc/gpgrt.texi: Say "--with-libgpg-error-prefix" instead of
      "--with-gpg-error-prefix".
    * src/gpg-error.m4: When warning about library locations, warn with
      the preferred "--with-libgpg-error-prefix" name.
    
    --
    
    in src/gpg-error.m4, it already says:
    
    >  dnl --with-libgpg-error-prefix=PFX is the preferred name for this option,
    >  dnl since that is consistent with how our three siblings use the directory/
    >  dnl package name in --with-$dir_name-prefix=PFX.
    
    so this is an attempt to live up to that expectation.
    
    Signed-off-by: Daniel Kahn Gillmor <dkg at fifthhorseman.net>

diff --git a/doc/gpgrt.texi b/doc/gpgrt.texi
index 53beef8..857973a 100644
--- a/doc/gpgrt.texi
+++ b/doc/gpgrt.texi
@@ -275,8 +275,8 @@ you are cross-compiling, it is useful to set the environment variable
 then first look for the helper program in the @file{bin} directory
 below that top directory.  An absolute directory name must be used for
 @code{SYSROOT}.  Finally, if the configure command line option
- at code{--with-gpg-error-prefix} is used, only its value is used for the top
-directory below which the helper script is expected.
+ at code{--with-libgpg-error-prefix} is used, only its value is used for
+the top directory below which the helper script is expected.
 
 @end defmac
 
diff --git a/src/gpg-error.m4 b/src/gpg-error.m4
index 1661204..60c88d8 100644
--- a/src/gpg-error.m4
+++ b/src/gpg-error.m4
@@ -100,7 +100,7 @@ AC_DEFUN([AM_PATH_GPG_ERROR],
 *** The config script $GPG_ERROR_CONFIG was
 *** built for $gpg_error_config_host and thus may not match the
 *** used host $host.
-*** You may want to use the configure option --with-gpg-error-prefix
+*** You may want to use the configure option --with-libgpg-error-prefix
 *** to specify a matching config script or use \$SYSROOT.
 ***]])
         gpg_config_script_warn="$gpg_config_script_warn libgpg-error"

-----------------------------------------------------------------------

Summary of changes:
 doc/gpgrt.texi   | 4 ++--
 src/gpg-error.m4 | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 11 08:34:29 2017
From: cvs at cvs.gnupg.org (by Daniel Kahn Gillmor)
Date: Wed, 11 Jan 2017 08:34:29 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-57-g7249ab0
Message-ID: <E1cRDQW-0004WD-GO@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  7249ab0f95d1f6cb8ee61eefedc79801bb56398f (commit)
      from  a20a450ac4ef10847fd59a5fd3acbbd2bfcaa6a2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 7249ab0f95d1f6cb8ee61eefedc79801bb56398f
Author: Daniel Kahn Gillmor <dkg at fifthhorseman.net>
Date:   Tue Jan 10 15:59:36 2017 -0500

    common: Avoid unnecessary ambiguity in argparse.
    
    * common/argparse.c (find_long_option): Avoid unnecessary ambiguity.
    --
    
    If two struct ARGPARSE_OPTS share a prefix in their long_opt name, but
    have the exact same short_opt and flags, they are aliases and not
    distinct options.  Avoid reporting this as an ambiguity, so that (for
    example) both --clearsign and --clear-sign can be invoked as --clear.
    
    Signed-off-by: Daniel Kahn Gillmor <dkg at fifthhorseman.net>
    Debian-Bug-Id: 850475

diff --git a/common/argparse.c b/common/argparse.c
index dce725a..d395229 100644
--- a/common/argparse.c
+++ b/common/argparse.c
@@ -898,7 +898,9 @@ find_long_option( ARGPARSE_ARGS *arg,
 	    int j;
 	    for(j=i+1; opts[j].short_opt; j++ ) {
 		if( opts[j].long_opt
-		    && !strncmp( opts[j].long_opt, keyword, n ) )
+		    && !strncmp( opts[j].long_opt, keyword, n )
+                    && !(opts[j].short_opt == opts[i].short_opt
+                         && opts[j].flags == opts[i].flags ) )
 		    return -2;	/* abbreviation is ambiguous */
 	    }
 	    return i;

-----------------------------------------------------------------------

Summary of changes:
 common/argparse.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 11 10:50:45 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 11 Jan 2017 10:50:45 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-61-g915864e
Message-ID: <E1cRFYP-0001xE-Nz@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  915864e7f0315b0c96315d0bcd48b1b93592353a (commit)
       via  da894c48ec3393e7c815f575daa5a52ab37cc102 (commit)
       via  02ab4b0085f8b4cdfe163d25ddd0fc80753d7f4a (commit)
       via  088d71d3671e74eb088386026f0e439a7e3b5543 (commit)
      from  7249ab0f95d1f6cb8ee61eefedc79801bb56398f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 915864e7f0315b0c96315d0bcd48b1b93592353a
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 11 10:48:20 2017 +0100

    dirmngr: Remove warnings about unused global variables.
    
    * dirmngr/crlcache.c (oidstr_issuingDistributionPoint): Comment.
    * dirmngr/ocsp.c (oidstr_certHash): Comment.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/crlcache.c b/dirmngr/crlcache.c
index 07fa5b1..2e471cb 100644
--- a/dirmngr/crlcache.c
+++ b/dirmngr/crlcache.c
@@ -127,7 +127,7 @@
 
 
 static const char oidstr_crlNumber[] = "2.5.29.20";
-static const char oidstr_issuingDistributionPoint[] = "2.5.29.28";
+/* static const char oidstr_issuingDistributionPoint[] = "2.5.29.28"; */
 static const char oidstr_authorityKeyIdentifier[] = "2.5.29.35";
 
 
diff --git a/dirmngr/ocsp.c b/dirmngr/ocsp.c
index 8c893aa..9127cf7 100644
--- a/dirmngr/ocsp.c
+++ b/dirmngr/ocsp.c
@@ -44,7 +44,7 @@ static const char oidstr_ocsp[] = "1.3.6.1.5.5.7.48.1";
       HashAlgorithm    AlgorithmIdentifier,
       certificateHash OCTET STRING }
  */
-static const char oidstr_certHash[] = "1.3.36.8.3.13";
+/* static const char oidstr_certHash[] = "1.3.36.8.3.13"; */
 
 
 

commit da894c48ec3393e7c815f575daa5a52ab37cc102
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 11 10:35:46 2017 +0100

    dirmngr: Implement debug option "network" for http.
    
    * dirmngr/dirmngr.c (parse_rereadable_options): Set http debugging.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index f50e935..92984b6 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -651,6 +651,7 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread)
     }
 
   set_dns_verbose (opt.verbose, !!DBG_DNS);
+  http_set_verbose (opt.verbose, !!DBG_NETWORK);
 
   return 1; /* Handled. */
 }
diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
index 4448bf0..e27157c 100644
--- a/doc/dirmngr.texi
+++ b/doc/dirmngr.texi
@@ -198,9 +198,11 @@ however carefully selected to best aid in debugging.
 
 @item --debug @var{flags}
 @opindex debug
-This option is only useful for debugging and the behavior may change at
-any time without notice.  FLAGS are bit encoded and may be given in
-usual C-Syntax.
+Set debugging flags.  This option is only useful for debugging and its
+behavior may change with a new release.  All flags are or-ed and may
+be given in C syntax (e.g. 0x0042) or as a comma separated list of
+flag names.  To get a list of all supported flags the single word
+"help" can be used.
 
 @item --debug-all
 @opindex debug-all

commit 02ab4b0085f8b4cdfe163d25ddd0fc80753d7f4a
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 11 10:34:49 2017 +0100

    dirmngr: Add debug code to http.c.
    
    * dirmngr/http.c (opt_verbose, opt_debug): New vars.
    (http_set_verbose): New function.
    (_my_socket_new): Add debug output.
    (_my_socket_ref, _my_socket_unref, session_unref): Call log_debug if
    OPT_DEBUG has ben set to 2 in a debugger.
    (http_session_new, http_session_ref): Ditto.
    (send_request, http_start_data): Print debug output for the request.
    (parse_response): Change to use log_debug_string for the response.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 0a47d9f..c1a60be 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -2,7 +2,7 @@
  * Copyright (C) 1999, 2001, 2002, 2003, 2004, 2006, 2009, 2010,
  *               2011 Free Software Foundation, Inc.
  * Copyright (C) 2014 Werner Koch
- * Copyright (C) 2015 g10 Code GmbH
+ * Copyright (C) 2015-2017 g10 Code GmbH
  *
  * This file is part of GnuPG.
  *
@@ -255,6 +255,12 @@ struct http_context_s
 };
 
 
+/* Two flags to enable verbose and debug mode.  Although currently not
+ * set-able a value > 1 for OPT_DEBUG enables debugging of the session
+ * reference counting.  */
+static int opt_verbose;
+static int opt_debug;
+
 /* The global callback for the verification function.  */
 static gpg_error_t (*tls_callback) (http_t, http_session_t, int);
 
@@ -330,9 +336,9 @@ _my_socket_new (int lnr, assuan_fd_t fd)
     }
   so->fd = fd;
   so->refcount = 1;
-  /* log_debug ("http.c:socket_new(%d): object %p for fd %d created\n", */
-  /*            lnr, so, so->fd); */
-  (void)lnr;
+  if (opt_debug)
+    log_debug ("http.c:%d:socket_new: object %p for fd %d created\n",
+               lnr, so, so->fd);
   return so;
 }
 #define my_socket_new(a) _my_socket_new (__LINE__, (a))
@@ -342,9 +348,9 @@ static my_socket_t
 _my_socket_ref (int lnr, my_socket_t so)
 {
   so->refcount++;
-  /* log_debug ("http.c:socket_ref(%d) object %p for fd %d refcount now %d\n", */
-  /*            lnr, so, so->fd, so->refcount); */
-  (void)lnr;
+  if (opt_debug > 1)
+    log_debug ("http.c:%d:socket_ref: object %p for fd %d refcount now %d\n",
+               lnr, so, so->fd, so->refcount);
   return so;
 }
 #define my_socket_ref(a) _my_socket_ref (__LINE__,(a))
@@ -360,9 +366,10 @@ _my_socket_unref (int lnr, my_socket_t so,
   if (so)
     {
       so->refcount--;
-      /* log_debug ("http.c:socket_unref(%d): object %p for fd %d ref now %d\n", */
-      /*            lnr, so, so->fd, so->refcount); */
-      (void)lnr;
+      if (opt_debug > 1)
+        log_debug ("http.c:%d:socket_unref: object %p for fd %d ref now %d\n",
+                   lnr, so, so->fd, so->refcount);
+
       if (!so->refcount)
         {
           if (preclose)
@@ -469,6 +476,15 @@ make_header_line (const char *prefix, const char *suffix,
 
 
 

+/* Set verbosity and debug mode for this module. */
+void
+http_set_verbose (int verbose, int debug)
+{
+  opt_verbose = verbose;
+  opt_debug = debug;
+}
+
+
 /* Register a non-standard global TLS callback function.  If no
    verification is desired a callback needs to be registered which
    always returns NULL.  */
@@ -562,9 +578,9 @@ session_unref (int lnr, http_session_t sess)
     return;
 
   sess->refcount--;
-  /* log_debug ("http.c:session_unref(%d): sess %p ref now %d\n", */
-  /*            lnr, sess, sess->refcount); */
-  (void)lnr;
+  if (opt_debug > 1)
+    log_debug ("http.c:%d:session_unref: sess %p ref now %d\n",
+               lnr, sess, sess->refcount);
   if (sess->refcount)
     return;
 
@@ -731,7 +747,8 @@ http_session_new (http_session_t *r_session, const char *tls_priority,
   }
 #endif /*!HTTP_USE_GNUTLS*/
 
-  /* log_debug ("http.c:session_new: sess %p created\n", sess); */
+  if (opt_debug > 1)
+    log_debug ("http.c:session_new: sess %p created\n", sess);
   err = 0;
 
 #if USE_TLS
@@ -754,8 +771,9 @@ http_session_ref (http_session_t sess)
   if (sess)
     {
       sess->refcount++;
-      /* log_debug ("http.c:session_ref: sess %p ref now %d\n", sess, */
-      /*            sess->refcount); */
+      if (opt_debug > 1)
+        log_debug ("http.c:session_ref: sess %p ref now %d\n",
+                   sess, sess->refcount);
     }
   return sess;
 }
@@ -937,6 +955,8 @@ http_start_data (http_t hd)
 {
   if (!hd->in_data)
     {
+      if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP))
+        log_debug_with_string ("\r\n", "http.c:request-header:");
       es_fputs ("\r\n", hd->fp_write);
       es_fflush (hd->fp_write);
       hd->in_data = 1;
@@ -1881,7 +1901,8 @@ send_request (http_t hd, const char *httphost, const char *auth,
       return err;
     }
 
-  /* log_debug ("request:\n%s\nEND request\n", request); */
+  if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP))
+    log_debug_with_string (request, "http.c:request:");
 
   /* First setup estream so that we can write even the first line
      using estream.  This is also required for the sake of gnutls. */
@@ -1916,6 +1937,8 @@ send_request (http_t hd, const char *httphost, const char *auth,
     {
       for (;headers; headers=headers->next)
         {
+          if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP))
+            log_debug_with_string (headers->d, "http.c:request-header:");
           if ((es_fputs (headers->d, hd->fp_write) || es_fflush (hd->fp_write))
               || (es_fputs("\r\n",hd->fp_write) || es_fflush(hd->fp_write)))
             {
@@ -2167,8 +2190,7 @@ parse_response (http_t hd)
 	return GPG_ERR_EOF;
 
       if ((hd->flags & HTTP_FLAG_LOG_RESP))
-        log_info ("RESP: '%.*s'\n",
-                  (int)strlen(line)-(*line&&line[1]?2:0),line);
+        log_debug_with_string (line, "http.c:response:\n");
     }
   while (!*line);
 
@@ -2213,7 +2235,7 @@ parse_response (http_t hd)
       if ((*line == '\r' && line[1] == '\n') || *line == '\n')
 	*line = 0;
       if ((hd->flags & HTTP_FLAG_LOG_RESP))
-        log_info ("RESP: '%.*s'\n",
+        log_info ("http.c:RESP: '%.*s'\n",
                   (int)strlen(line)-(*line&&line[1]?2:0),line);
       if (*line)
         {
@@ -2341,6 +2363,9 @@ connect_server (const char *server, unsigned short port,
     {
 #ifdef ASSUAN_SOCK_TOR
 
+      if (opt_debug)
+        log_debug ("http.c:connect_server:onion: name='%s' port=%hu\n",
+                   server, port);
       sock = assuan_sock_connect_byname (server, port, 0, NULL,
                                          ASSUAN_SOCK_TOR);
       if (sock == ASSUAN_INVALID_FD)
@@ -2389,6 +2414,9 @@ connect_server (const char *server, unsigned short port,
     {
       dns_addrinfo_t aibuf, ai;
 
+      if (opt_debug)
+        log_debug ("http.c:connect_server: trying name='%s' port=%hu\n",
+                   serverlist[srv].target, port);
       err = resolve_dns_name (serverlist[srv].target, port, 0, SOCK_STREAM,
                               &aibuf, NULL);
       if (err)
@@ -2539,7 +2567,8 @@ cookie_read (void *cookie, void *buffer, size_t size)
 
       ntbtls_get_stream (c->session->tls_session, &in, &out);
       nread = es_fread (buffer, 1, size, in);
-      log_debug ("TLS network read: %d/%u\n", nread, size);
+      if (opt_debug)
+        log_debug ("TLS network read: %d/%u\n", nread, size);
     }
   else
 #elif HTTP_USE_GNUTLS
@@ -2631,7 +2660,8 @@ cookie_write (void *cookie, const void *buffer_arg, size_t size)
         es_fflush (out);
       else
         nwritten = es_fwrite (buffer, 1, size, out);
-      log_debug ("TLS network write: %d/%u\n", nwritten, size);
+      if (opt_debug)
+        log_debug ("TLS network write: %d/%u\n", nwritten, size);
     }
   else
 #elif HTTP_USE_GNUTLS
diff --git a/dirmngr/http.h b/dirmngr/http.h
index 32556a4..0b581fe 100644
--- a/dirmngr/http.h
+++ b/dirmngr/http.h
@@ -97,6 +97,8 @@ typedef struct http_session_s *http_session_t;
 struct http_context_s;
 typedef struct http_context_s *http_t;
 
+void http_set_verbose (int verbose, int debug);
+
 void http_register_tls_callback (gpg_error_t (*cb)(http_t,http_session_t,int));
 void http_register_tls_ca (const char *fname);
 void http_register_netactivity_cb (void (*cb)(void));

commit 088d71d3671e74eb088386026f0e439a7e3b5543
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 11 10:21:32 2017 +0100

    common: New function log_debug_with_string.
    
    * common/logging.c (do_logv): Factor some code out to ...
    (print_prefix): new.
    (log_logv): Add arg EXTRASTRING and print it.  Change all callers to
    pass NULL for it.
    (log_debug_with_string): New.  Uses EXTRASTRING.
    --
    
    This function can be used to print a human readable buffer in addition
    to a log message to the log stream.  This function will keep all lines
    together and prefix them with ">> ".
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/logging.c b/common/logging.c
index c06a34f..0db1860 100644
--- a/common/logging.c
+++ b/common/logging.c
@@ -665,31 +665,10 @@ log_get_stream ()
   return logstream;
 }
 
+
 static void
-do_logv (int level, int ignore_arg_ptr, const char *fmt, va_list arg_ptr)
+print_prefix (int level, int leading_backspace)
 {
-  if (!logstream)
-    {
-#ifdef HAVE_W32_SYSTEM
-      char *tmp;
-
-      tmp = (no_registry
-             ? NULL
-             : read_w32_registry_string (NULL, GNUPG_REGISTRY_DIR,
-                                         "DefaultLogFile"));
-      log_set_file (tmp && *tmp? tmp : NULL);
-      xfree (tmp);
-#else
-      log_set_file (NULL); /* Make sure a log stream has been set.  */
-#endif
-      assert (logstream);
-    }
-
-  es_flockfile (logstream);
-  if (missing_lf && level != GPGRT_LOG_CONT)
-    es_putc_unlocked ('\n', logstream );
-  missing_lf = 0;
-
   if (level != GPGRT_LOG_CONT)
     { /* Note this does not work for multiple line logging as we would
        * need to print to a buffer first */
@@ -720,11 +699,9 @@ do_logv (int level, int ignore_arg_ptr, const char *fmt, va_list arg_ptr)
         es_putc_unlocked (':', logstream);
       /* A leading backspace suppresses the extra space so that we can
          correctly output, programname, filename and linenumber. */
-      if (fmt && *fmt == '\b')
-        fmt++;
-      else
-        if (with_time || with_prefix || with_pid || force_prefixes)
-          es_putc_unlocked (' ', logstream);
+      if (!leading_backspace
+          && (with_time || with_prefix || with_pid || force_prefixes))
+        es_putc_unlocked (' ', logstream);
     }
 
   switch (level)
@@ -741,6 +718,40 @@ do_logv (int level, int ignore_arg_ptr, const char *fmt, va_list arg_ptr)
       es_fprintf_unlocked (logstream,"[Unknown log level %d]: ", level);
       break;
     }
+}
+
+
+static void
+do_logv (int level, int ignore_arg_ptr, const char *extrastring,
+         const char *fmt, va_list arg_ptr)
+{
+  int leading_backspace = (fmt && *fmt == '\b');
+
+  if (!logstream)
+    {
+#ifdef HAVE_W32_SYSTEM
+      char *tmp;
+
+      tmp = (no_registry
+             ? NULL
+             : read_w32_registry_string (NULL, GNUPG_REGISTRY_DIR,
+                                         "DefaultLogFile"));
+      log_set_file (tmp && *tmp? tmp : NULL);
+      xfree (tmp);
+#else
+      log_set_file (NULL); /* Make sure a log stream has been set.  */
+#endif
+      assert (logstream);
+    }
+
+  es_flockfile (logstream);
+  if (missing_lf && level != GPGRT_LOG_CONT)
+    es_putc_unlocked ('\n', logstream );
+  missing_lf = 0;
+
+  print_prefix (level, leading_backspace);
+  if (leading_backspace)
+    fmt++;
 
   if (fmt)
     {
@@ -766,6 +777,48 @@ do_logv (int level, int ignore_arg_ptr, const char *fmt, va_list arg_ptr)
         missing_lf = 1;
     }
 
+  /* If we have an EXTRASTRING print it now while we still hold the
+   * lock on the logstream.  */
+  if (extrastring)
+    {
+      int c;
+
+      if (missing_lf)
+        {
+          es_putc_unlocked ('\n', logstream);
+          missing_lf = 0;
+        }
+      print_prefix (level, leading_backspace);
+      es_fputs_unlocked (">> ", logstream);
+      missing_lf = 1;
+      while ((c = *extrastring++))
+        {
+          missing_lf = 1;
+          if (c == '\\')
+            es_fputs_unlocked ("\\\\", logstream);
+          else if (c == '\r')
+            es_fputs_unlocked ("\\r", logstream);
+          else if ((c == '\n'))
+            {
+              es_fputs_unlocked ("\\n\n", logstream);
+              if (*extrastring)
+                {
+                  print_prefix (level, leading_backspace);
+                  es_fputs_unlocked (">> ", logstream);
+                }
+              else
+                missing_lf = 0;
+            }
+          else
+            es_putc_unlocked (c, logstream);
+        }
+      if (missing_lf)
+        {
+          es_putc_unlocked ('\n', logstream);
+          missing_lf = 0;
+        }
+    }
+
   if (level == GPGRT_LOG_FATAL)
     {
       if (missing_lf)
@@ -804,7 +857,7 @@ log_log (int level, const char *fmt, ...)
   va_list arg_ptr ;
 
   va_start (arg_ptr, fmt) ;
-  do_logv (level, 0, fmt, arg_ptr);
+  do_logv (level, 0, NULL, fmt, arg_ptr);
   va_end (arg_ptr);
 }
 
@@ -812,7 +865,7 @@ log_log (int level, const char *fmt, ...)
 void
 log_logv (int level, const char *fmt, va_list arg_ptr)
 {
-  do_logv (level, 0, fmt, arg_ptr);
+  do_logv (level, 0, NULL, fmt, arg_ptr);
 }
 
 
@@ -821,7 +874,7 @@ do_log_ignore_arg (int level, const char *str, ...)
 {
   va_list arg_ptr;
   va_start (arg_ptr, str);
-  do_logv (level, 1, str, arg_ptr);
+  do_logv (level, 1, NULL, str, arg_ptr);
   va_end (arg_ptr);
 }
 
@@ -843,7 +896,7 @@ log_info (const char *fmt, ...)
   va_list arg_ptr ;
 
   va_start (arg_ptr, fmt);
-  do_logv (GPGRT_LOG_INFO, 0, fmt, arg_ptr);
+  do_logv (GPGRT_LOG_INFO, 0, NULL, fmt, arg_ptr);
   va_end (arg_ptr);
 }
 
@@ -854,7 +907,7 @@ log_error (const char *fmt, ...)
   va_list arg_ptr ;
 
   va_start (arg_ptr, fmt);
-  do_logv (GPGRT_LOG_ERROR, 0, fmt, arg_ptr);
+  do_logv (GPGRT_LOG_ERROR, 0, NULL, fmt, arg_ptr);
   va_end (arg_ptr);
   /* Protect against counter overflow.  */
   if (errorcount < 30000)
@@ -868,7 +921,7 @@ log_fatal (const char *fmt, ...)
   va_list arg_ptr ;
 
   va_start (arg_ptr, fmt);
-  do_logv (GPGRT_LOG_FATAL, 0, fmt, arg_ptr);
+  do_logv (GPGRT_LOG_FATAL, 0, NULL, fmt, arg_ptr);
   va_end (arg_ptr);
   abort (); /* Never called; just to make the compiler happy.  */
 }
@@ -880,7 +933,7 @@ log_bug (const char *fmt, ...)
   va_list arg_ptr ;
 
   va_start (arg_ptr, fmt);
-  do_logv (GPGRT_LOG_BUG, 0, fmt, arg_ptr);
+  do_logv (GPGRT_LOG_BUG, 0, NULL, fmt, arg_ptr);
   va_end (arg_ptr);
   abort (); /* Never called; just to make the compiler happy.  */
 }
@@ -892,7 +945,21 @@ log_debug (const char *fmt, ...)
   va_list arg_ptr ;
 
   va_start (arg_ptr, fmt);
-  do_logv (GPGRT_LOG_DEBUG, 0, fmt, arg_ptr);
+  do_logv (GPGRT_LOG_DEBUG, 0, NULL, fmt, arg_ptr);
+  va_end (arg_ptr);
+}
+
+
+/* The same as log_debug but at the end of the output STRING is
+ * printed with LFs expanded to include the prefix and a final --end--
+ * marker.  */
+void
+log_debug_with_string (const char *string, const char *fmt, ...)
+{
+  va_list arg_ptr ;
+
+  va_start (arg_ptr, fmt);
+  do_logv (GPGRT_LOG_DEBUG, 0, string, fmt, arg_ptr);
   va_end (arg_ptr);
 }
 
@@ -903,7 +970,7 @@ log_printf (const char *fmt, ...)
   va_list arg_ptr;
 
   va_start (arg_ptr, fmt);
-  do_logv (fmt ? GPGRT_LOG_CONT : GPGRT_LOG_BEGIN, 0, fmt, arg_ptr);
+  do_logv (fmt ? GPGRT_LOG_CONT : GPGRT_LOG_BEGIN, 0, NULL, fmt, arg_ptr);
   va_end (arg_ptr);
 }
 
diff --git a/common/logging.h b/common/logging.h
index 8edc5c9..ed1d3b9 100644
--- a/common/logging.h
+++ b/common/logging.h
@@ -96,6 +96,8 @@ void log_fatal (const char *fmt, ...)  GPGRT_ATTR_NR_PRINTF(1,2);
 void log_error (const char *fmt, ...)  GPGRT_ATTR_PRINTF(1,2);
 void log_info (const char *fmt, ...)   GPGRT_ATTR_PRINTF(1,2);
 void log_debug (const char *fmt, ...)  GPGRT_ATTR_PRINTF(1,2);
+void log_debug_with_string (const char *string, const char *fmt,
+                            ...) GPGRT_ATTR_PRINTF(2,3);
 void log_printf (const char *fmt, ...) GPGRT_ATTR_PRINTF(1,2);
 void log_flush (void);
 

-----------------------------------------------------------------------

Summary of changes:
 common/logging.c   | 141 +++++++++++++++++++++++++++++++++++++++--------------
 common/logging.h   |   2 +
 dirmngr/crlcache.c |   2 +-
 dirmngr/dirmngr.c  |   1 +
 dirmngr/http.c     |  74 +++++++++++++++++++---------
 dirmngr/http.h     |   2 +
 dirmngr/ocsp.c     |   2 +-
 doc/dirmngr.texi   |   8 +--
 8 files changed, 168 insertions(+), 64 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 11 12:05:35 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 11 Jan 2017 12:05:35 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 22fce826b8aec87f80861acd583fed2adbdc80c5
Message-ID: <E1cRGio-00054M-0w@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  22fce826b8aec87f80861acd583fed2adbdc80c5 (commit)
       via  c96cd8d6fcb47f281414966f048e0c4e61561307 (commit)
       via  5d9e4b2972a2d7fb9859240e4d3861d4f5f943f1 (commit)
       via  7baf4445fe3fa7119970bd3f1d7b6ea1d22ace06 (commit)
       via  e83f04fdf5ebd962958228fd8ebbbb263615bb35 (commit)
       via  f82f0c36c69dc8099d447e640e062b2eaed4dfd9 (commit)
      from  537908a28758e0816ed956182a6a84981764401e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 22fce826b8aec87f80861acd583fed2adbdc80c5
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 11 12:02:51 2017 +0100

    jenkins: add glue for testing on a windows vm
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index eb5d973..72f18ab 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -171,6 +171,8 @@ case "$XTARGET" in
 	case "$JOB_NAME" in
 		gnupg/*|gnupg-2.2/*)
 			bash /home/jenkins/bin/make-windows-cd.sh
+			# We need to pass the absolute path of the iso.
+			bash $HOME/bin/run-tests-w32.bash "$(readlink -f gnupg-test.iso)" || true
 			;;
 	esac
         ;;
diff --git a/misc/jenkins/bin/gnupg-2.0-w32.patch b/misc/jenkins/bin/gnupg-2.0-w32.patch
new file mode 100644
index 0000000..0cd6e59
--- /dev/null
+++ b/misc/jenkins/bin/gnupg-2.0-w32.patch
@@ -0,0 +1,21 @@
+diff --git a/autogen.sh b/autogen.sh
+index 605babfa9..1a9654f0d 100755
+--- a/autogen.sh
++++ b/autogen.sh
+@@ -87,15 +87,7 @@ if test "$1" = "--build-w32"; then
+     $tsdir/configure --enable-maintainer-mode --prefix=${w32root}  \
+              --host=${host} --build=${build} \
+              --enable-gpgtar \
+-             --with-gpg-error-prefix=${w32root} \
+-	     --with-ksba-prefix=${w32root} \
+-	     --with-libgcrypt-prefix=${w32root} \
+-	     --with-libassuan-prefix=${w32root} \
+-	     --with-zlib=${w32root} \
+-	     --with-regex=${w32root} \
+-             --with-pth-prefix=${w32root} \
+-             --with-libiconv-prefix=${w32root} \
+-             --with-adns=${w32root} "$@"
++	     "$@"
+     rc=$?
+     exit $rc
+ fi
diff --git a/misc/jenkins/bin/gnupg-2.2-w32.patch b/misc/jenkins/bin/gnupg-2.2-w32.patch
new file mode 120000
index 0000000..d829c6e
--- /dev/null
+++ b/misc/jenkins/bin/gnupg-2.2-w32.patch
@@ -0,0 +1 @@
+gnupg-w32.patch
\ No newline at end of file
diff --git a/misc/jenkins/bin/gnupg-w32.patch b/misc/jenkins/bin/gnupg-w32.patch
new file mode 100644
index 0000000..1927ceb
--- /dev/null
+++ b/misc/jenkins/bin/gnupg-w32.patch
@@ -0,0 +1,18 @@
+diff --git a/autogen.rc b/autogen.rc
+index 36948178f..4aa1993d8 100644
+--- a/autogen.rc
++++ b/autogen.rc
+@@ -15,13 +15,6 @@ esac
+ case "$myhost" in
+   w32)
+     configure_opts="
+-      --with-gpg-error-prefix=@SYSROOT@
+-      --with-ksba-prefix=@SYSROOT@
+-      --with-libgcrypt-prefix=@SYSROOT@
+-      --with-libassuan-prefix=@SYSROOT@
+-      --with-zlib=@SYSROOT@
+-      --with-regex=@SYSROOT@
+-      --with-npth-prefix=@SYSROOT@
+       --disable-g13
+       "
+     ;;
diff --git a/misc/jenkins/bin/run-tests-w32.bash b/misc/jenkins/bin/run-tests-w32.bash
new file mode 100755
index 0000000..44e303d
--- /dev/null
+++ b/misc/jenkins/bin/run-tests-w32.bash
@@ -0,0 +1,69 @@
+#!/bin/bash
+
+# Locking.
+exec 9<"$0"
+echo -n "Aquiring lock on $0... "
+if ! flock --timeout 15 9 ; then
+    echo "failed!"
+    exit 1
+fi
+echo "ok."
+
+set -ex
+
+URI="qemu:///system"
+GUEST="win8.1"
+GUEST_CDROM="sda"
+SSH="gpg at 192.168.122.117"
+
+function vdo() {
+    virsh -c "$URI" "$@"
+}
+
+function vssh() {
+    # OpenSSH on Windows does not cope well with a closed stdin.
+    timeout </dev/zero 10m ssh "$SSH" "$@"
+}
+
+function vping() {
+    if ssh </dev/zero >/dev/null 2>&1 -oConnectTimeout=1 \
+                                      "$SSH" "echo pong" ; then
+	return 0
+    else
+	return 1
+    fi
+}
+
+function vwait() {
+    echo >&2 -n "Waiting for the machine to boot... "
+    while ! vping ; do echo >&2 -n . ; sleep 1 ; done
+}
+
+# Revert to current snapshot and start the machine.
+vdo snapshot-revert --current --force --running "$GUEST"
+
+# Insert the CD.
+vdo change-media --update "$GUEST" "$GUEST_CDROM" "$1"
+
+set +x
+vwait
+set -x
+
+#sleep 5 # XXX: Let things settle.
+
+if [ "$2" ]; then
+    scp "$2" "$SSH:"
+    sleep 1 # XXX: openssh on windows is a bit fragile...
+    time vssh "cmd /c $(basename $2)"
+else
+    time vssh "cmd /c d:/run-tests.bat"
+fi
+
+sleep 1 # XXX: openssh on windows is a bit fragile...
+
+# The scp server is a bit fragile as well, and I believe globbing does
+# not work.  Simply use gpgtar.
+vssh 'powershell -Command "cd c:\temp\logs ; d:/gnupg/gpgtar.exe --create ."' | tar x --warning=no-timestamp
+
+# Shutdown.
+vdo shutdown "$GUEST"
diff --git a/misc/jenkins/bin/run-tests.bat b/misc/jenkins/bin/run-tests.bat
index d88e197..adef960 100644
--- a/misc/jenkins/bin/run-tests.bat
+++ b/misc/jenkins/bin/run-tests.bat
@@ -1,27 +1,21 @@
 @echo off
-cd /d d:\
 
-set TARGET=gnupg-test
-
-set GNUPGHOME=c:/%TARGET%/tests/openpgp
-c:/%TARGET%/gpg-connect-agent.exe killagent /bye
-rem is there a nicer way to sleep?
-ping -n 1 localhost > nul
-set GNUPGHOME=
-
-rmdir /q /s c:\%TARGET%
-mkdir c:\%TARGET%
-xcopy /q /s d:\gnupg c:\%TARGET%
-
-set GPGSCM_PATH=c:/%TARGET%/tests/gpgscm;c:/%TARGET%/tests/openpgp
+set BIN_PREFIX=d:\gnupg
+set GPGSCM_PATH=%BIN_PREFIX%/tests/gpgscm;%BIN_PREFIX%/tests/openpgp
 set EXEEXT=.exe
-set srcdir=/%TARGET%/tests/openpgp
-set BIN_PREFIX=c:/%TARGET%
+set srcdir=%BIN_PREFIX%/tests/openpgp
 set TMP=c:\temp
+set WD=c:\temp\logs
 mkdir %TMP%
+mkdir %WD%
+
+cd /d %BIN_PREFIX%
+%BIN_PREFIX%\gpgscm.exe --verbose tests/gpgscm/t-child.scm
+
+cd /d %WD%
 
-cd /d c:\%TARGET%
-c:\%TARGET%\gpgscm.exe --verbose tests/gpgscm/t-child.scm
+rem the gpgtar.scm is acting up (looping), and we don't deal with that
+rem well atm, so we simply omit it
 
-cd /d c:\%TARGET%\tests\openpgp
-c:\%TARGET%\gpgscm.exe run-tests.scm --shared version.scm mds.scm decrypt.scm decrypt-dsa.scm sigs.scm sigs-dsa.scm encrypt.scm encrypt-dsa.scm seat.scm clearsig.scm encryptp.scm detach.scm detachm.scm armsigs.scm armencrypt.scm armencryptp.scm signencrypt.scm signencrypt-dsa.scm armsignencrypt.scm armdetach.scm armdetachm.scm genkey1024.scm conventional.scm conventional-mdc.scm multisig.scm verify.scm gpgv-forged-keyring.scm armor.scm import.scm ecc.scm 4gb-packet.scm tofu.scm gpgtar.scm use-exact-key.scm default-key.scm export.scm ssh.scm quick-key-manipulation.scm issue2015.scm issue2346.scm issue2417.scm issue2419.scm
+echo Running tests...
+%BIN_PREFIX%\gpgscm.exe %srcdir%/run-tests.scm --parallel version.scm enarmor.scm mds.scm decrypt.scm decrypt-multifile.scm decrypt-dsa.scm decrypt-session-key.scm sigs.scm sigs-dsa.scm encrypt.scm encrypt-multifile.scm encrypt-dsa.scm compression.scm seat.scm clearsig.scm encryptp.scm detach.scm detachm.scm armsigs.scm armencrypt.scm armencryptp.scm signencrypt.scm signencrypt-dsa.scm armsignencrypt.scm armdetach.scm armdetachm.scm genkey1024.scm conventional.scm conventional-mdc.scm multisig.scm verify.scm verify-multifile.scm gpgv-forged-keyring.scm armor.scm import.scm import-revocation-certificate.scm ecc.scm 4gb-packet.scm tofu.scm use-exact-key.scm default-key.scm export.scm ssh-import.scm ssh-export.scm quick-key-manipulation.scm key-selection.scm delete-keys.scm gpgconf.scm issue2015.scm issue2346.scm issue2417.scm issue2419.scm

commit c96cd8d6fcb47f281414966f048e0c4e61561307
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 4 17:04:28 2017 +0100

    jenkins: tweak gnupg-2.0 configuration

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 7616e59..eb5d973 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -151,7 +151,14 @@ case "$XTARGET" in
 	  ( cd .. && patch -p1 <"/home/jenkins/bin/$(dirname $JOB_NAME)-w32.patch" )
 	fi
 	# We need to point it to npth and adns then...
-	CONFIGUREFLAGS="${CONFIGUREFLAGS} --with-npth-prefix=$ORIGINAL_PREFIX --with-adns=$ORIGINAL_PREFIX"
+	case "$JOB_NAME" in
+	    gnupg/XTARGET=w32|gnupg-2.2/XTARGET=w32)
+		CONFIGUREFLAGS="${CONFIGUREFLAGS} --with-npth-prefix=$ORIGINAL_PREFIX --with-adns=$ORIGINAL_PREFIX"
+		;;
+	    gnupg-2.0/XTARGET=w32)
+		CONFIGUREFLAGS="${CONFIGUREFLAGS} --with-pth-prefix=$ORIGINAL_PREFIX --with-adns=$ORIGINAL_PREFIX"
+		;;
+	esac
 
         # gpg1's autogen.sh does not add --enable-maintainer-mode, so
         # version.texi is not generated.  we add it here to be sure.

commit 5d9e4b2972a2d7fb9859240e4d3861d4f5f943f1
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 3 15:18:37 2017 +0100

    jenkins: use make -k check

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 0f32883..7616e59 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -117,7 +117,7 @@ case "$XTARGET" in
 	           CXXFLAGS="$CXXFLAGS -fPIC -std=c++11"
         make $MAKEFLAGS
 
-        make check verbose=2 || true
+        make -k check verbose=2 || true
         # Jenkins looks for "tests? failed" to mark a build unstable,
         # hence || true here
 
@@ -134,7 +134,7 @@ case "$XTARGET" in
 	           CXXFLAGS="$CXXFLAGS $SANFLAGS -fPIC -std=c++11"
         $SCANBUILD make $MAKEFLAGS
 
-        make check verbose=2 || true
+        make -k check verbose=2 || true
         # Jenkins looks for "tests? failed" to mark a build unstable,
         # hence || true here
 

commit 7baf4445fe3fa7119970bd3f1d7b6ea1d22ace06
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 3 15:18:00 2017 +0100

    jenkins: disable python bindings for the sanitizer target

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index f5bad38..0f32883 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -76,8 +76,9 @@ case "$JOB_NAME" in
         MAKEFLAGS="$MAKEFLAGS GPG=/usr/bin/gpg2"
         ;;
     *gpgme*)
-        # using libasan for python broke again, so disable the python bindings for the native build
-        if [ "$XTARGET" = native ] && [ "$label" != macos ]; then
+        # using libasan for python broke again, so disable the python
+        # bindings for the sanitizer build
+        if [ "$XTARGET" = sanitizer ]; then
             CONFIGUREFLAGS_0="--enable-languages=cpp qt"
         fi
         ;;

commit e83f04fdf5ebd962958228fd8ebbbb263615bb35
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 3 13:22:26 2017 +0100

    jenkins: add a sanitizer target

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 1dfe3f2..f5bad38 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -59,7 +59,7 @@ fi
 CONFIGUREFLAGS=
 SANFLAGS=""
 if [ "$(uname)" = Linux ]; then
-    # XXX: We should really have an analyzer target
+    # XXX: We should check if the sanitizers are available.
     SANFLAGS="-fsanitize=undefined -fsanitize=address"
 fi
 
@@ -109,6 +109,20 @@ cd obj
 # Switch on the different targets.
 case "$XTARGET" in
     native)
+        ../configure --prefix=$PREFIX --enable-maintainer-mode \
+	           $CONFIGUREFLAGS \
+	           "$CONFIGUREFLAGS_0" \
+	           CFLAGS="$CFLAGS -fPIC" \
+	           CXXFLAGS="$CXXFLAGS -fPIC -std=c++11"
+        make $MAKEFLAGS
+
+        make check verbose=2 || true
+        # Jenkins looks for "tests? failed" to mark a build unstable,
+        # hence || true here
+
+        make install
+        ;;
+    sanitizer)
 	# asan breaks the configure tests, so we disable it here.
         ASAN_OPTIONS=detect_leaks=0 \
         $SCANBUILD \

commit f82f0c36c69dc8099d447e640e062b2eaed4dfd9
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 3 10:41:39 2017 +0100

    jenkins: use more jobs

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index e886ca1..1dfe3f2 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -43,10 +43,11 @@ git clean -fdx
 # Run out autogen - note that --force is not required due to the git clean.
 ./autogen.sh
 
-# Out current box seems to have cache coherency problems, thus we have
-# disabled all but one CPU.
-MAKEFLAGS="-j2"
+# Parallel jobs.
+MAKEFLAGS="-j6"
 
+# Parallel tests with our test suite.
+export TESTFLAGS="--parallel"
 
 SCANBUILD=
 if [ "$(uname)" = Linux ] \

-----------------------------------------------------------------------

Summary of changes:
 misc/jenkins/bin/build.bash          | 41 ++++++++++++++++-----
 misc/jenkins/bin/gnupg-2.0-w32.patch | 21 +++++++++++
 misc/jenkins/bin/gnupg-2.2-w32.patch |  1 +
 misc/jenkins/bin/gnupg-w32.patch     | 18 ++++++++++
 misc/jenkins/bin/run-tests-w32.bash  | 69 ++++++++++++++++++++++++++++++++++++
 misc/jenkins/bin/run-tests.bat       | 34 ++++++++----------
 6 files changed, 156 insertions(+), 28 deletions(-)
 create mode 100644 misc/jenkins/bin/gnupg-2.0-w32.patch
 create mode 120000 misc/jenkins/bin/gnupg-2.2-w32.patch
 create mode 100644 misc/jenkins/bin/gnupg-w32.patch
 create mode 100755 misc/jenkins/bin/run-tests-w32.bash


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 11 13:50:36 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 11 Jan 2017 13:50:36 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 538b6dec949b89247963ba90e676c2dd87c32db7
Message-ID: <E1cRIMQ-0001Fj-2S@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  538b6dec949b89247963ba90e676c2dd87c32db7 (commit)
       via  ae96d42087437f00937c3f1df37c7be73953bc30 (commit)
       via  4de5c741944997463104679ca906900b7cf30f2f (commit)
       via  360c4db6378c6892bc9e2317e556472fa4e36250 (commit)
       via  abfd1df10c00f129cfad4791311bf00bedf9e78b (commit)
       via  e85b8a56beb6e44081fedfc7f985a796f3a8de4c (commit)
      from  22fce826b8aec87f80861acd583fed2adbdc80c5 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 538b6dec949b89247963ba90e676c2dd87c32db7
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 11 13:50:00 2017 +0100

    jenkins: fix PATH in build script

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 293e682..4869979 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -18,7 +18,7 @@ esac
 # Setup important envars
 PREFIX=$HOME/prefix/$XTARGET
 ORIGINAL_PREFIX=$HOME/prefix/$XTARGET
-export PATH=/home/jenkins/bin:$PREFIX/bin:$PATH
+export PATH=$PREFIX/bin:$PATH
 
 # Print the environment.
 env

commit ae96d42087437f00937c3f1df37c7be73953bc30
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 11 13:41:48 2017 +0100

    jenkins: delete python hacks
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/misc/jenkins/bin/python.txt b/misc/jenkins/bin/python.txt
deleted file mode 100644
index 6eaf41a..0000000
--- a/misc/jenkins/bin/python.txt
+++ /dev/null
@@ -1 +0,0 @@
-leak:python
diff --git a/misc/jenkins/bin/python3 b/misc/jenkins/bin/python3
deleted file mode 100755
index fed5c24..0000000
--- a/misc/jenkins/bin/python3
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/bin/sh
-LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libasan.so.2 \
-LSAN_OPTIONS=suppressions=/home/jenkins/bin/python.txt \
-exec /usr/bin/python3 "$@"

commit 4de5c741944997463104679ca906900b7cf30f2f
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 11 13:36:12 2017 +0100

    jenkins: use gmake on OpenBSD
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 911234c..293e682 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -5,6 +5,16 @@
 set -xe
 renice -n 10 -p $$
 
+# Configuration.
+MAKE=make
+
+# Platform-specific configuration.
+case "$(uname)" in
+    OpenBSD)
+	MAKE=gmake
+	;;
+esac
+
 # Setup important envars
 PREFIX=$HOME/prefix/$XTARGET
 ORIGINAL_PREFIX=$HOME/prefix/$XTARGET
@@ -121,13 +131,13 @@ case "$XTARGET" in
         ../configure --prefix=$PREFIX --enable-maintainer-mode \
 	           $CONFIGUREFLAGS \
 	           "$CONFIGUREFLAGS_0"
-        make $MAKEFLAGS
+        $MAKE $MAKEFLAGS
 
-        make -k check verbose=2 || true
+        $MAKE -k check verbose=2 || true
         # Jenkins looks for "tests? failed" to mark a build unstable,
         # hence || true here
 
-        make install
+        $MAKE install
         ;;
     sanitizer)
 	# asan breaks the configure tests, so we disable it here.
@@ -138,13 +148,13 @@ case "$XTARGET" in
 	           "$CONFIGUREFLAGS_0" \
 	           CFLAGS="$CFLAGS $SANFLAGS -fPIC" \
 	           CXXFLAGS="$CXXFLAGS $SANFLAGS -fPIC -std=c++11"
-        $SCANBUILD make $MAKEFLAGS
+        $SCANBUILD $MAKE $MAKEFLAGS
 
-        make -k check verbose=2 || true
+        $MAKE -k check verbose=2 || true
         # Jenkins looks for "tests? failed" to mark a build unstable,
         # hence || true here
 
-        make install
+        $MAKE install
         ;;
     w32)
         export w32root=$PREFIX
@@ -171,8 +181,8 @@ case "$XTARGET" in
         # likewise for --prefix
         ../autogen.sh --build-w32 --enable-maintainer-mode --prefix=$PREFIX \
           $CONFIGUREFLAGS
-        make $MAKEFLAGS
-        make install
+        $MAKE $MAKEFLAGS
+        $MAKE install
 
 	case "$JOB_NAME" in
 		gnupg/*|gnupg-2.2/*)
@@ -198,7 +208,7 @@ case "$XTARGET" in
 	  cd "$WORKDIR"
           $abs_configure --prefix=$PREFIX --enable-maintainer-mode \
                    $CONFIGUREFLAGS
-          make $MAKEFLAGS distcheck
+          $MAKE $MAKEFLAGS distcheck
 
           # Extract the tarname from the package
           tarname=$(awk <config.h '
@@ -216,8 +226,8 @@ case "$XTARGET" in
           # And do a final build using the generated tarball
 	  cd ${tarname}
 	  ./configure --prefix=$PREFIX $CONFIGUREFLAGS LD_LIBRARY_PATH=$PREFIX/lib
-	  make $MAKEFLAGS
-	  make $MAKEFLAGS install
+	  $MAKE $MAKEFLAGS
+	  $MAKE $MAKEFLAGS install
 
         ;;
     *)

commit 360c4db6378c6892bc9e2317e556472fa4e36250
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 11 12:49:26 2017 +0100

    jenkins: avoid -fPIC
    
    I do not remember why I added this in the first place, likely to make
    GPGME's Python bindings work with -fsanitize=address.  This turns out
    to be more trouble than it is worth, so we simply omit the bindings in
    the sanitizer build.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index d1d583b..911234c 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -120,9 +120,7 @@ case "$XTARGET" in
     native)
         ../configure --prefix=$PREFIX --enable-maintainer-mode \
 	           $CONFIGUREFLAGS \
-	           "$CONFIGUREFLAGS_0" \
-	           CFLAGS="$CFLAGS -fPIC" \
-	           CXXFLAGS="$CXXFLAGS -fPIC -std=c++11"
+	           "$CONFIGUREFLAGS_0"
         make $MAKEFLAGS
 
         make -k check verbose=2 || true

commit abfd1df10c00f129cfad4791311bf00bedf9e78b
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 11 12:48:37 2017 +0100

    jenkins: we no longer need adns for master and stable-2.2
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 09c7312..d1d583b 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -158,10 +158,10 @@ case "$XTARGET" in
 	if [ -f "/home/jenkins/bin/$(dirname $JOB_NAME)-w32.patch" ]; then
 	  ( cd .. && patch -p1 <"/home/jenkins/bin/$(dirname $JOB_NAME)-w32.patch" )
 	fi
-	# We need to point it to npth and adns then...
+	# We need to point it to npth then...
 	case "$JOB_NAME" in
 	    gnupg/XTARGET=w32|gnupg-2.2/XTARGET=w32)
-		CONFIGUREFLAGS="${CONFIGUREFLAGS} --with-npth-prefix=$ORIGINAL_PREFIX --with-adns=$ORIGINAL_PREFIX"
+		CONFIGUREFLAGS="${CONFIGUREFLAGS} --with-npth-prefix=$ORIGINAL_PREFIX"
 		;;
 	    gnupg-2.0/XTARGET=w32)
 		CONFIGUREFLAGS="${CONFIGUREFLAGS} --with-pth-prefix=$ORIGINAL_PREFIX --with-adns=$ORIGINAL_PREFIX"

commit e85b8a56beb6e44081fedfc7f985a796f3a8de4c
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 11 12:32:45 2017 +0100

    jenkins: dump relevant configuration files from build environment
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 72f18ab..09c7312 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -13,6 +13,14 @@ export PATH=/home/jenkins/bin:$PREFIX/bin:$PATH
 # Print the environment.
 env
 ulimit -a
+set +x
+for f in /etc/gcrypt/hwf.deny /etc/gcrypt/fips_enabled ; do
+  if [ -f "$f" ]; then
+    echo "=== $f ==="
+    cat -n "$f"
+  fi
+done
+set -x
 
 # Tweak the prefix we're installing this project into.  For gnupg-1.4
 # and friends.

-----------------------------------------------------------------------

Summary of changes:
 misc/jenkins/bin/build.bash | 50 ++++++++++++++++++++++++++++++---------------
 misc/jenkins/bin/python.txt |  1 -
 misc/jenkins/bin/python3    |  4 ----
 3 files changed, 33 insertions(+), 22 deletions(-)
 delete mode 100644 misc/jenkins/bin/python.txt
 delete mode 100755 misc/jenkins/bin/python3


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 11 15:54:32 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Wed, 11 Jan 2017 15:54:32 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-23-gefe58fe
Message-ID: <E1cRKIM-0006ZF-Hz@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  efe58fe011f195d98adb4f03b1e1068a26ba287b (commit)
       via  2e661b9e1a9b50656a5c9646d7444a98477010c1 (commit)
      from  b14419f68b3aaa90025e0e97151de7c3da7806fb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit efe58fe011f195d98adb4f03b1e1068a26ba287b
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Jan 11 15:52:44 2017 +0100

    Fix Qgpgme build for macos
    
    * lang/qt/src/dn.cpp: Include string.h
    (parse_dn_part): Use qstrdup.
    * lang/qt/tests/t-support.h (getPassphrase): Use qstrdup.

diff --git a/lang/qt/src/dn.cpp b/lang/qt/src/dn.cpp
index 0f81a4c..3376aef 100644
--- a/lang/qt/src/dn.cpp
+++ b/lang/qt/src/dn.cpp
@@ -37,6 +37,8 @@
 
 #include "dn.h"
 
+#include <strings.h>
+
 static const struct {
     const char *name;
     const char *oid;
@@ -165,7 +167,7 @@ parse_dn_part(DnPair *array, const unsigned char *string)
     for (unsigned int i = 0; i < numOidMaps; ++i)
         if (!strcasecmp((char *)p, oidmap[i].oid)) {
             free(p);
-            p = strdup(oidmap[i].name);
+            p = qstrdup(oidmap[i].name);
             break;
         }
     array->key = p;
diff --git a/lang/qt/tests/t-support.h b/lang/qt/tests/t-support.h
index 704fab4..2630b7d 100644
--- a/lang/qt/tests/t-support.h
+++ b/lang/qt/tests/t-support.h
@@ -42,7 +42,7 @@ public:
     char *getPassphrase(const char * /*useridHint*/, const char * /*description*/,
                         bool /*previousWasBad*/, bool &/*canceled*/) Q_DECL_OVERRIDE
     {
-        return strdup("abc");
+        return qstrdup("abc");
     }
 };
 } // namespace GpgME

commit 2e661b9e1a9b50656a5c9646d7444a98477010c1
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Jan 11 15:49:00 2017 +0100

    Fix cmake configuration files for MacOS
    
    * configure.ac: Set HAVE_MACOS_SYSTEM conditional.
    * lang/qt/src/Makefile.am,
    lang/cpp/src/Makefile.am,
    lang/qt/src/QGpgmeConfig.cmake.in.in,
    lang/cpp/src/GpgmeConfig.cmake.in.in: Use libsuffix again to
    distinguish between macos .dylib
    
    --
    GnuPG-Bug-Id: 2884

diff --git a/configure.ac b/configure.ac
index 4495093..7109194 100644
--- a/configure.ac
+++ b/configure.ac
@@ -182,6 +182,7 @@ have_dosish_system=no
 have_android_system=no
 have_w32_system=no
 have_w64_system=no
+have_macos_system=no
 build_w32_glib=no
 build_w32_qt=no
 available_languages="cl cpp python python2 python3 qt"
@@ -196,6 +197,9 @@ case "${host}" in
     *-linux-androideabi)
         have_android_system=yes
         ;;
+    *-apple-darwin*)
+        have_macos_system=yes
+        ;;
 esac
 case "${host}" in
     *-mingw32ce*|*-mingw32*)
@@ -253,6 +257,12 @@ if test "$have_android_system" = yes; then
 fi
 AM_CONDITIONAL(HAVE_ANDROID_SYSTEM, test "$have_android_system" = yes)
 
+if test "$have_macos_system" = yes; then
+   AC_DEFINE(HAVE_MACOS_SYSTEM,1,
+             [Defined if we build for an MacOS system])
+fi
+AM_CONDITIONAL(HAVE_MACOS_SYSTEM, test "$have_macos_system" = yes)
+
 AM_CONDITIONAL(BUILD_W32_GLIB, test "$build_w32_glib" = yes)
 
 
diff --git a/lang/cpp/src/GpgmeppConfig.cmake.in.in b/lang/cpp/src/GpgmeppConfig.cmake.in.in
index cbe9713..7f42f31 100644
--- a/lang/cpp/src/GpgmeppConfig.cmake.in.in
+++ b/lang/cpp/src/GpgmeppConfig.cmake.in.in
@@ -64,7 +64,7 @@ add_library(Gpgmepp SHARED IMPORTED)
 set_target_properties(Gpgmepp PROPERTIES
   INTERFACE_INCLUDE_DIRECTORIES "@resolved_includedir@/gpgme++;@resolved_includedir@"
   INTERFACE_LINK_LIBRARIES "pthread;@resolved_libdir@/libgpgme.so;@LIBASSUAN_LIBS@"
-  IMPORTED_LOCATION "@resolved_libdir@/libgpgmepp.so"
+  IMPORTED_LOCATION "@resolved_libdir@/libgpgmepp at libsuffix@"
 )
 
 if(CMAKE_VERSION VERSION_LESS 2.8.12)
diff --git a/lang/cpp/src/Makefile.am b/lang/cpp/src/Makefile.am
index 92ed784..c62bd6c 100644
--- a/lang/cpp/src/Makefile.am
+++ b/lang/cpp/src/Makefile.am
@@ -69,6 +69,12 @@ libgpgmepp_la_LIBADD = ../../../src/libgpgme.la @LIBASSUAN_LIBS@
 libgpgmepp_la_LDFLAGS = -no-undefined -version-info \
     @LIBGPGMEPP_LT_CURRENT@:@LIBGPGMEPP_LT_REVISION@:@LIBGPGMEPP_LT_AGE@
 
+if HAVE_MACOS_SYSTEM
+libsuffix=.dylib
+else
+libsuffix=.so
+endif
+
 if HAVE_W32_SYSTEM
 GpgmeppConfig.cmake: GpgmeppConfig-w32.cmake.in
 	sed -e 's|[@]resolved_bindir@|$(bindir)|g' < "$<" | \
@@ -77,6 +83,7 @@ GpgmeppConfig.cmake: GpgmeppConfig-w32.cmake.in
 else
 GpgmeppConfig.cmake: GpgmeppConfig.cmake.in
 	sed -e 's|[@]resolved_libdir@|$(libdir)|g' < "$<" | \
+	sed -e 's|[@]libsuffix@|$(libsuffix)|g' | \
 	sed -e 's|[@]resolved_includedir@|$(includedir)|g' > $@
 endif
 install-cmake-files: GpgmeppConfig.cmake GpgmeppConfigVersion.cmake
diff --git a/lang/qt/src/Makefile.am b/lang/qt/src/Makefile.am
index 87e2ec2..55af1cf 100644
--- a/lang/qt/src/Makefile.am
+++ b/lang/qt/src/Makefile.am
@@ -220,6 +220,12 @@ libqgpgme_la_LIBADD = ../../cpp/src/libgpgmepp.la ../../../src/libgpgme.la \
 libqgpgme_la_LDFLAGS = -no-undefined -version-info \
     @LIBQGPGME_LT_CURRENT@:@LIBQGPGME_LT_REVISION@:@LIBQGPGME_LT_AGE@
 
+if HAVE_MACOS_SYSTEM
+libsuffix=.dylib
+else
+libsuffix=.so
+endif
+
 if HAVE_W32_SYSTEM
 QGpgmeConfig.cmake: QGpgmeConfig-w32.cmake.in
 	sed -e 's|[@]resolved_bindir@|$(bindir)|g' < "$<" | \
@@ -228,6 +234,7 @@ QGpgmeConfig.cmake: QGpgmeConfig-w32.cmake.in
 else
 QGpgmeConfig.cmake: QGpgmeConfig.cmake.in
 	sed -e 's|[@]resolved_libdir@|$(libdir)|g' < "$<" | \
+	sed -e 's|[@]libsuffix@|$(libsuffix)|g' | \
 	sed -e 's|[@]resolved_includedir@|$(includedir)|g' > $@
 endif
 
diff --git a/lang/qt/src/QGpgmeConfig.cmake.in.in b/lang/qt/src/QGpgmeConfig.cmake.in.in
index 88ed242..a17a19f 100644
--- a/lang/qt/src/QGpgmeConfig.cmake.in.in
+++ b/lang/qt/src/QGpgmeConfig.cmake.in.in
@@ -64,7 +64,7 @@ add_library(QGpgme SHARED IMPORTED)
 set_target_properties(QGpgme PROPERTIES
   INTERFACE_INCLUDE_DIRECTORIES "@resolved_includedir@/qgpgme;@resolved_includedir@"
   INTERFACE_LINK_LIBRARIES "Gpgmepp;Qt5::Core"
-  IMPORTED_LOCATION "@resolved_libdir@/libqgpgme.so"
+  IMPORTED_LOCATION "@resolved_libdir@/libqgpgme at libsuffix@"
 )
 
 if(CMAKE_VERSION VERSION_LESS 2.8.12)

-----------------------------------------------------------------------

Summary of changes:
 configure.ac                           | 10 ++++++++++
 lang/cpp/src/GpgmeppConfig.cmake.in.in |  2 +-
 lang/cpp/src/Makefile.am               |  7 +++++++
 lang/qt/src/Makefile.am                |  7 +++++++
 lang/qt/src/QGpgmeConfig.cmake.in.in   |  2 +-
 lang/qt/src/dn.cpp                     |  4 +++-
 lang/qt/tests/t-support.h              |  2 +-
 7 files changed, 30 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 11 16:21:32 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Wed, 11 Jan 2017 16:21:32 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-26-g56926c9
Message-ID: <E1cRKiU-0007zG-RM@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  56926c9b5012e8135541a933af1d69c5a81f02b3 (commit)
       via  9e643ab67168dfbd189ccc0bfed8fb59253ee79c (commit)
       via  e416f9961837039f259558edf41fccbc181ad128 (commit)
      from  efe58fe011f195d98adb4f03b1e1068a26ba287b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 56926c9b5012e8135541a933af1d69c5a81f02b3
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Jan 11 16:20:31 2017 +0100

    qt: Clean up test dirs on failure
    
    * t-encrypt.cpp,
    t-keylist.cpp,
    t-keylocate.cpp,
    t-ownertrust.cpp,
    t-tofuinfo.cpp,
    t-various.cpp,
    t-verify.cpp,
    t-wkspublish.cpp: Use QVERIFY instead of Q_ASSERT

diff --git a/lang/qt/tests/t-encrypt.cpp b/lang/qt/tests/t-encrypt.cpp
index 4d65dc7..57b586d 100644
--- a/lang/qt/tests/t-encrypt.cpp
+++ b/lang/qt/tests/t-encrypt.cpp
@@ -85,18 +85,18 @@ private Q_SLOTS:
         std::vector<Key> keys;
         auto keylistresult = listjob->exec(QStringList() << QStringLiteral("alfa at example.net"),
                                           false, keys);
-        Q_ASSERT(!keylistresult.error());
-        Q_ASSERT(keys.size() == 1);
+        QVERIFY(!keylistresult.error());
+        QVERIFY(keys.size() == 1);
         delete listjob;
 
         auto job = openpgp()->encryptJob(/*ASCII Armor */true, /* Textmode */ true);
-        Q_ASSERT(job);
+        QVERIFY(job);
         QByteArray cipherText;
         auto result = job->exec(keys, QStringLiteral("Hello World").toUtf8(), Context::AlwaysTrust, cipherText);
         delete job;
-        Q_ASSERT(!result.error());
+        QVERIFY(!result.error());
         const auto cipherString = QString::fromUtf8(cipherText);
-        Q_ASSERT(cipherString.startsWith("-----BEGIN PGP MESSAGE-----"));
+        QVERIFY(cipherString.startsWith("-----BEGIN PGP MESSAGE-----"));
 
         /* Now decrypt */
         if (!decryptSupported()) {
@@ -109,8 +109,8 @@ private Q_SLOTS:
         auto decJob = new QGpgMEDecryptJob(ctx);
         QByteArray plainText;
         auto decResult = decJob->exec(cipherText, plainText);
-        Q_ASSERT(!result.error());
-        Q_ASSERT(QString::fromUtf8(plainText) == QStringLiteral("Hello World"));
+        QVERIFY(!result.error());
+        QVERIFY(QString::fromUtf8(plainText) == QStringLiteral("Hello World"));
         delete decJob;
     }
 
@@ -125,12 +125,12 @@ private Q_SLOTS:
         std::vector<Key> keys;
         auto keylistresult = listjob->exec(QStringList() << QStringLiteral("alfa at example.net"),
                                           false, keys);
-        Q_ASSERT(!keylistresult.error());
-        Q_ASSERT(keys.size() == 1);
+        QVERIFY(!keylistresult.error());
+        QVERIFY(keys.size() == 1);
         delete listjob;
 
         auto job = openpgp()->encryptJob(/*ASCII Armor */false, /* Textmode */ false);
-        Q_ASSERT(job);
+        QVERIFY(job);
         QByteArray plainBa;
         plainBa.fill('X', PROGRESS_TEST_SIZE);
         QByteArray cipherText;
@@ -140,21 +140,21 @@ private Q_SLOTS:
         connect(job, &Job::progress, this, [this, &initSeen, &finishSeen] (const QString&, int current, int total) {
                 // We only check for progress 0 and max progress as the other progress
                 // lines depend on the system speed and are as such unreliable to test.
-                Q_ASSERT(total == PROGRESS_TEST_SIZE);
+                QVERIFY(total == PROGRESS_TEST_SIZE);
                 if (current == 0) {
                     initSeen = true;
                 }
                 if (current == total) {
                     finishSeen = true;
                 }
-                Q_ASSERT(current >= 0 && current <= total);
+                QVERIFY(current >= 0 && current <= total);
             });
         connect(job, &EncryptJob::result, this, [this, &initSeen, &finishSeen] (const GpgME::EncryptionResult &,
                                                                                 const QByteArray &,
                                                                                 const QString,
                                                                                 const GpgME::Error) {
-                Q_ASSERT(initSeen);
-                Q_ASSERT(finishSeen);
+                QVERIFY(initSeen);
+                QVERIFY(finishSeen);
                 Q_EMIT asyncDone();
             });
 
@@ -165,7 +165,7 @@ private Q_SLOTS:
 
         job->start(keys, inptr, outptr, Context::AlwaysTrust);
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
     }
 
     void testSymmetricEncryptDecrypt()
@@ -183,9 +183,9 @@ private Q_SLOTS:
         QByteArray cipherText;
         auto result = job->exec(std::vector<Key>(), QStringLiteral("Hello symmetric World").toUtf8(), Context::AlwaysTrust, cipherText);
         delete job;
-        Q_ASSERT(!result.error());
+        QVERIFY(!result.error());
         const auto cipherString = QString::fromUtf8(cipherText);
-        Q_ASSERT(cipherString.startsWith("-----BEGIN PGP MESSAGE-----"));
+        QVERIFY(cipherString.startsWith("-----BEGIN PGP MESSAGE-----"));
 
         killAgent(mDir.path());
 
@@ -195,8 +195,8 @@ private Q_SLOTS:
         auto decJob = new QGpgMEDecryptJob(ctx2);
         QByteArray plainText;
         auto decResult = decJob->exec(cipherText, plainText);
-        Q_ASSERT(!result.error());
-        Q_ASSERT(QString::fromUtf8(plainText) == QStringLiteral("Hello symmetric World"));
+        QVERIFY(!result.error());
+        QVERIFY(QString::fromUtf8(plainText) == QStringLiteral("Hello symmetric World"));
         delete decJob;
     }
 
@@ -212,8 +212,8 @@ private:
         std::vector<Key> keys;
         auto keylistresult = listjob->exec(QStringList() << QStringLiteral("alfa at example.net"),
                                           false, keys);
-        Q_ASSERT(!keylistresult.error());
-        Q_ASSERT(keys.size() == 1);
+        QVERIFY(!keylistresult.error());
+        QVERIFY(keys.size() == 1);
         delete listjob;
 
         auto ctx = Context::createForProtocol(OpenPGP);
@@ -229,10 +229,10 @@ private:
                                 cipherText);
         printf("After exec\n");
         delete job;
-        Q_ASSERT(!result.error());
+        QVERIFY(!result.error());
         printf("Cipher:\n%s\n", cipherText.constData());
         const auto cipherString = QString::fromUtf8(cipherText);
-        Q_ASSERT(cipherString.startsWith("-----BEGIN PGP MESSAGE-----"));
+        QVERIFY(cipherString.startsWith("-----BEGIN PGP MESSAGE-----"));
 
         killAgent(mDir.path());
 
@@ -240,7 +240,7 @@ private:
         QTemporaryDir tmp;
         qputenv("GNUPGHOME", tmp.path().toUtf8());
         QFile agentConf(tmp.path() + QStringLiteral("/gpg-agent.conf"));
-        Q_ASSERT(agentConf.open(QIODevice::WriteOnly));
+        QVERIFY(agentConf.open(QIODevice::WriteOnly));
         agentConf.write("allow-loopback-pinentry");
         agentConf.close();
 
@@ -251,9 +251,9 @@ private:
         auto decJob = new QGpgMEDecryptJob(ctx2);
         QByteArray plainText;
         auto decResult = decJob->exec(cipherText, plainText);
-        Q_ASSERT(!decResult.error());
+        QVERIFY(!decResult.error());
         qDebug() << "Plain: " << plainText;
-        Q_ASSERT(QString::fromUtf8(plainText) == QStringLiteral("Hello symmetric World"));
+        QVERIFY(QString::fromUtf8(plainText) == QStringLiteral("Hello symmetric World"));
         delete decJob;
 
         killAgent(tmp.path());
@@ -267,12 +267,12 @@ public Q_SLOT:
         QGpgMETest::initTestCase();
         const QString gpgHome = qgetenv("GNUPGHOME");
         qputenv("GNUPGHOME", mDir.path().toUtf8());
-        Q_ASSERT(mDir.isValid());
+        QVERIFY(mDir.isValid());
         QFile agentConf(mDir.path() + QStringLiteral("/gpg-agent.conf"));
-        Q_ASSERT(agentConf.open(QIODevice::WriteOnly));
+        QVERIFY(agentConf.open(QIODevice::WriteOnly));
         agentConf.write("allow-loopback-pinentry");
         agentConf.close();
-        Q_ASSERT(copyKeyrings(gpgHome, mDir.path()));
+        QVERIFY(copyKeyrings(gpgHome, mDir.path()));
     }
 
 private:
diff --git a/lang/qt/tests/t-keylist.cpp b/lang/qt/tests/t-keylist.cpp
index 2578576..5e88a5e 100644
--- a/lang/qt/tests/t-keylist.cpp
+++ b/lang/qt/tests/t-keylist.cpp
@@ -61,14 +61,14 @@ private Q_SLOTS:
         GpgME::KeyListResult result = job->exec(QStringList() << QStringLiteral("alfa at example.net"),
                                                 false, keys);
         delete job;
-        Q_ASSERT (!result.error());
-        Q_ASSERT (keys.size() == 1);
+        QVERIFY (!result.error());
+        QVERIFY (keys.size() == 1);
         const QString kId = QLatin1String(keys.front().keyID());
-        Q_ASSERT (kId == QStringLiteral("2D727CC768697734"));
+        QVERIFY (kId == QStringLiteral("2D727CC768697734"));
 
-        Q_ASSERT (keys[0].subkeys().size() == 2);
-        Q_ASSERT (keys[0].subkeys()[0].publicKeyAlgorithm() == Subkey::AlgoDSA);
-        Q_ASSERT (keys[0].subkeys()[1].publicKeyAlgorithm() == Subkey::AlgoELG_E);
+        QVERIFY (keys[0].subkeys().size() == 2);
+        QVERIFY (keys[0].subkeys()[0].publicKeyAlgorithm() == Subkey::AlgoDSA);
+        QVERIFY (keys[0].subkeys()[1].publicKeyAlgorithm() == Subkey::AlgoELG_E);
     }
 
     void testPubkeyAlgoAsString()
@@ -87,7 +87,7 @@ private Q_SLOTS:
             { Subkey::AlgoUnknown, QString() }
         };
         Q_FOREACH (Subkey::PubkeyAlgo algo, expected.keys()) {
-            Q_ASSERT(QString::fromUtf8(Subkey::publicKeyAlgorithmAsString(algo)) ==
+            QVERIFY(QString::fromUtf8(Subkey::publicKeyAlgorithmAsString(algo)) ==
                      expected.value(algo));
         }
     }
@@ -97,12 +97,12 @@ private Q_SLOTS:
         KeyListJob *job = openpgp()->keyListJob();
         connect(job, &KeyListJob::result, job, [this, job](KeyListResult, std::vector<Key> keys, QString, Error)
         {
-            Q_ASSERT(keys.size() == 1);
+            QVERIFY(keys.size() == 1);
             Q_EMIT asyncDone();
         });
         job->start(QStringList() << "alfa at example.net");
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
     }
 };
 
diff --git a/lang/qt/tests/t-keylocate.cpp b/lang/qt/tests/t-keylocate.cpp
index 63cb836..550305c 100644
--- a/lang/qt/tests/t-keylocate.cpp
+++ b/lang/qt/tests/t-keylocate.cpp
@@ -63,7 +63,7 @@ private Q_SLOTS:
         qputenv("GNUPGHOME", dir.path().toUtf8());
         /* Could do this with gpgconf but this is not a gpgconf test ;-) */
         QFile conf(dir.path() + QStringLiteral("/gpg.conf"));
-        Q_ASSERT(conf.open(QIODevice::WriteOnly));
+        QVERIFY(conf.open(QIODevice::WriteOnly));
         conf.write("auto-key-locate dane");
         conf.close();
 
@@ -71,11 +71,11 @@ private Q_SLOTS:
         mTestpattern = QStringLiteral("wk at gnupg.org");
         connect(job, &KeyListJob::result, job, [this, job](KeyListResult result, std::vector<Key> keys, QString, Error)
         {
-            Q_ASSERT(!result.error());
-            Q_ASSERT(keys.size() == 1);
+            QVERIFY(!result.error());
+            QVERIFY(keys.size() == 1);
 
             Key k = keys.front();
-            Q_ASSERT(k.numUserIDs());
+            QVERIFY(k.numUserIDs());
             bool found = false;
             Q_FOREACH (const UserID uid, k.userIDs()) {
                 const QString mailBox = QString::fromUtf8(uid.email());
@@ -83,12 +83,12 @@ private Q_SLOTS:
                     found = true;
                 }
             }
-            Q_ASSERT(found);
+            QVERIFY(found);
             Q_EMIT asyncDone();
         });
         job->start(QStringList() << mTestpattern);
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
         qputenv("GNUPGHOME", oldHome.toUtf8());
     }
 #endif
@@ -103,13 +103,13 @@ private Q_SLOTS:
 
         connect(job, &KeyListJob::result, job, [this, job](KeyListResult result, std::vector<Key> keys, QString, Error)
         {
-            Q_ASSERT(!result.isNull());
-            Q_ASSERT(!result.isTruncated());
-            Q_ASSERT(!result.error());
-            Q_ASSERT(keys.size() == 1);
+            QVERIFY(!result.isNull());
+            QVERIFY(!result.isTruncated());
+            QVERIFY(!result.error());
+            QVERIFY(keys.size() == 1);
 
             Key k = keys.front();
-            Q_ASSERT(k.numUserIDs());
+            QVERIFY(k.numUserIDs());
             bool found = false;
             Q_FOREACH (const UserID uid, k.userIDs()) {
                 const QString mailBox = QString::fromUtf8(uid.email());
@@ -117,12 +117,12 @@ private Q_SLOTS:
                     found = true;
                 }
             }
-            Q_ASSERT(found);
+            QVERIFY(found);
             Q_EMIT asyncDone();
         });
         job->start(QStringList() << mTestpattern);
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
     }
 
 private:
diff --git a/lang/qt/tests/t-ownertrust.cpp b/lang/qt/tests/t-ownertrust.cpp
index db863b2..f2fa3c8 100644
--- a/lang/qt/tests/t-ownertrust.cpp
+++ b/lang/qt/tests/t-ownertrust.cpp
@@ -62,10 +62,10 @@ private Q_SLOTS:
         GpgME::KeyListResult result = job->exec(QStringList() << QStringLiteral("alfa at example.net"),
                                                 false, keys);
         delete job;
-        Q_ASSERT (!result.error());
-        Q_ASSERT (keys.size() == 1);
+        QVERIFY (!result.error());
+        QVERIFY (keys.size() == 1);
         Key key = keys.front();
-        Q_ASSERT (key.ownerTrust() == Key::Unknown);
+        QVERIFY (key.ownerTrust() == Key::Unknown);
 
         ChangeOwnerTrustJob *job2 = openpgp()->changeOwnerTrustJob();
         connect(job2, &ChangeOwnerTrustJob::result, this, [this](Error e)
@@ -73,28 +73,28 @@ private Q_SLOTS:
             if (e) {
                 qDebug() <<  "Error in result: " << e.asString();
             }
-            Q_ASSERT(!e);
+            QVERIFY(!e);
             Q_EMIT asyncDone();
         });
         job2->start(key, Key::Ultimate);
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
 
         job = openpgp()->keyListJob(false, true, true);
         result = job->exec(QStringList() << QStringLiteral("alfa at example.net"),
                            false, keys);
         delete job;
         key = keys.front();
-        Q_ASSERT (key.ownerTrust() == Key::Ultimate);
+        QVERIFY (key.ownerTrust() == Key::Ultimate);
 
         ChangeOwnerTrustJob *job3 = openpgp()->changeOwnerTrustJob();
         connect(job3, &ChangeOwnerTrustJob::result, this, [this](Error e)
         {
-            Q_ASSERT(!e);
+            QVERIFY(!e);
             Q_EMIT asyncDone();
         });
         job3->start(key, Key::Unknown);
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
 
         job = openpgp()->keyListJob(false, true, true);
         result = job->exec(QStringList() << QStringLiteral("alfa at example.net"),
@@ -102,7 +102,7 @@ private Q_SLOTS:
         delete job;
 
         key = keys.front();
-        Q_ASSERT (key.ownerTrust() == Key::Unknown);
+        QVERIFY (key.ownerTrust() == Key::Unknown);
     }
 };
 
diff --git a/lang/qt/tests/t-tofuinfo.cpp b/lang/qt/tests/t-tofuinfo.cpp
index f89e1c2..d88861c 100644
--- a/lang/qt/tests/t-tofuinfo.cpp
+++ b/lang/qt/tests/t-tofuinfo.cpp
@@ -72,12 +72,12 @@ class TofuInfoTest: public QGpgMETest
 
     void testTofuCopy(TofuInfo other, const TofuInfo &orig)
     {
-        Q_ASSERT(!orig.isNull());
-        Q_ASSERT(!other.isNull());
-        Q_ASSERT(orig.signLast() == other.signLast());
-        Q_ASSERT(orig.signCount() == other.signCount());
-        Q_ASSERT(orig.validity() == other.validity());
-        Q_ASSERT(orig.policy() == other.policy());
+        QVERIFY(!orig.isNull());
+        QVERIFY(!other.isNull());
+        QVERIFY(orig.signLast() == other.signLast());
+        QVERIFY(orig.signCount() == other.signCount());
+        QVERIFY(orig.validity() == other.validity());
+        QVERIFY(orig.policy() == other.policy());
     }
 
     void signAndVerify(const QString &what, const GpgME::Key &key, int expected)
@@ -94,10 +94,10 @@ class TofuInfoTest: public QGpgMETest
         auto sigResult = job->exec(keys, what.toUtf8(), NormalSignatureMode, signedData);
         delete job;
 
-        Q_ASSERT(!sigResult.error());
+        QVERIFY(!sigResult.error());
         foreach (const auto uid, keys[0].userIDs()) {
             auto info = uid.tofuInfo();
-            Q_ASSERT(info.signCount() == expected - 1);
+            QVERIFY(info.signCount() == expected - 1);
         }
 
         auto verifyJob = openpgp()->verifyOpaqueJob();
@@ -106,25 +106,25 @@ class TofuInfoTest: public QGpgMETest
         auto result = verifyJob->exec(signedData, verified);
         delete verifyJob;
 
-        Q_ASSERT(!result.error());
-        Q_ASSERT(verified == what.toUtf8());
+        QVERIFY(!result.error());
+        QVERIFY(verified == what.toUtf8());
 
-        Q_ASSERT(result.numSignatures() == 1);
+        QVERIFY(result.numSignatures() == 1);
         auto sig = result.signatures()[0];
 
         auto key2 = sig.key();
-        Q_ASSERT(!key.isNull());
-        Q_ASSERT(!strcmp (key2.primaryFingerprint(), key.primaryFingerprint()));
-        Q_ASSERT(!strcmp (key.primaryFingerprint(), sig.fingerprint()));
+        QVERIFY(!key.isNull());
+        QVERIFY(!strcmp (key2.primaryFingerprint(), key.primaryFingerprint()));
+        QVERIFY(!strcmp (key.primaryFingerprint(), sig.fingerprint()));
         auto stats = key2.userID(0).tofuInfo();
-        Q_ASSERT(!stats.isNull());
+        QVERIFY(!stats.isNull());
         if (stats.signCount() != expected) {
             std::cout << "################ Key before verify: "
                       << key
                       << "################ Key after verify: "
                       << key2;
         }
-        Q_ASSERT(stats.signCount() == expected);
+        QVERIFY(stats.signCount() == expected);
     }
 
 private Q_SLOTS:
@@ -134,13 +134,13 @@ private Q_SLOTS:
             return;
         }
         TofuInfo tofu;
-        Q_ASSERT(tofu.isNull());
-        Q_ASSERT(!tofu.description());
-        Q_ASSERT(!tofu.signCount());
-        Q_ASSERT(!tofu.signLast());
-        Q_ASSERT(!tofu.signFirst());
-        Q_ASSERT(tofu.validity() == TofuInfo::ValidityUnknown);
-        Q_ASSERT(tofu.policy() == TofuInfo::PolicyUnknown);
+        QVERIFY(tofu.isNull());
+        QVERIFY(!tofu.description());
+        QVERIFY(!tofu.signCount());
+        QVERIFY(!tofu.signLast());
+        QVERIFY(!tofu.signFirst());
+        QVERIFY(tofu.validity() == TofuInfo::ValidityUnknown);
+        QVERIFY(tofu.policy() == TofuInfo::PolicyUnknown);
     }
 
     void testTofuInfo()
@@ -153,30 +153,30 @@ private Q_SLOTS:
         QByteArray plaintext;
 
         auto ctx = Job::context(job);
-        Q_ASSERT(ctx);
+        QVERIFY(ctx);
         ctx->setSender("alfa at example.net");
 
         auto result = job->exec(data1, plaintext);
         delete job;
 
-        Q_ASSERT(!result.isNull());
-        Q_ASSERT(!result.error());
-        Q_ASSERT(!strcmp(plaintext.constData(), "Just GNU it!\n"));
+        QVERIFY(!result.isNull());
+        QVERIFY(!result.error());
+        QVERIFY(!strcmp(plaintext.constData(), "Just GNU it!\n"));
 
-        Q_ASSERT(result.numSignatures() == 1);
+        QVERIFY(result.numSignatures() == 1);
         Signature sig = result.signatures()[0];
         /* TOFU is always marginal */
-        Q_ASSERT(sig.validity() == Signature::Marginal);
+        QVERIFY(sig.validity() == Signature::Marginal);
 
         auto stats = sig.key().userID(0).tofuInfo();
-        Q_ASSERT(!stats.isNull());
-        Q_ASSERT(sig.key().primaryFingerprint());
-        Q_ASSERT(sig.fingerprint());
-        Q_ASSERT(!strcmp(sig.key().primaryFingerprint(), sig.fingerprint()));
-        Q_ASSERT(stats.signFirst() == stats.signLast());
-        Q_ASSERT(stats.signCount() == 1);
-        Q_ASSERT(stats.policy() == TofuInfo::PolicyAuto);
-        Q_ASSERT(stats.validity() == TofuInfo::LittleHistory);
+        QVERIFY(!stats.isNull());
+        QVERIFY(sig.key().primaryFingerprint());
+        QVERIFY(sig.fingerprint());
+        QVERIFY(!strcmp(sig.key().primaryFingerprint(), sig.fingerprint()));
+        QVERIFY(stats.signFirst() == stats.signLast());
+        QVERIFY(stats.signCount() == 1);
+        QVERIFY(stats.policy() == TofuInfo::PolicyAuto);
+        QVERIFY(stats.validity() == TofuInfo::LittleHistory);
 
         testTofuCopy(stats, stats);
 
@@ -186,42 +186,42 @@ private Q_SLOTS:
         result = job->exec(data1, plaintext);
         delete job;
 
-        Q_ASSERT(!result.isNull());
-        Q_ASSERT(!result.error());
+        QVERIFY(!result.isNull());
+        QVERIFY(!result.error());
 
-        Q_ASSERT(result.numSignatures() == 1);
+        QVERIFY(result.numSignatures() == 1);
         sig = result.signatures()[0];
         /* TOFU is always marginal */
-        Q_ASSERT(sig.validity() == Signature::Marginal);
+        QVERIFY(sig.validity() == Signature::Marginal);
 
         stats = sig.key().userID(0).tofuInfo();
-        Q_ASSERT(!stats.isNull());
-        Q_ASSERT(!strcmp(sig.key().primaryFingerprint(), sig.fingerprint()));
-        Q_ASSERT(stats.signFirst() == stats.signLast());
-        Q_ASSERT(stats.signCount() == 1);
-        Q_ASSERT(stats.policy() == TofuInfo::PolicyAuto);
-        Q_ASSERT(stats.validity() == TofuInfo::LittleHistory);
+        QVERIFY(!stats.isNull());
+        QVERIFY(!strcmp(sig.key().primaryFingerprint(), sig.fingerprint()));
+        QVERIFY(stats.signFirst() == stats.signLast());
+        QVERIFY(stats.signCount() == 1);
+        QVERIFY(stats.policy() == TofuInfo::PolicyAuto);
+        QVERIFY(stats.validity() == TofuInfo::LittleHistory);
 
         /* Verify that another call yields the same result */
         job = openpgp()->verifyOpaqueJob(true);
         result = job->exec(data1, plaintext);
         delete job;
 
-        Q_ASSERT(!result.isNull());
-        Q_ASSERT(!result.error());
+        QVERIFY(!result.isNull());
+        QVERIFY(!result.error());
 
-        Q_ASSERT(result.numSignatures() == 1);
+        QVERIFY(result.numSignatures() == 1);
         sig = result.signatures()[0];
         /* TOFU is always marginal */
-        Q_ASSERT(sig.validity() == Signature::Marginal);
+        QVERIFY(sig.validity() == Signature::Marginal);
 
         stats = sig.key().userID(0).tofuInfo();
-        Q_ASSERT(!stats.isNull());
-        Q_ASSERT(!strcmp(sig.key().primaryFingerprint(), sig.fingerprint()));
-        Q_ASSERT(stats.signFirst() == stats.signLast());
-        Q_ASSERT(stats.signCount() == 1);
-        Q_ASSERT(stats.policy() == TofuInfo::PolicyAuto);
-        Q_ASSERT(stats.validity() == TofuInfo::LittleHistory);
+        QVERIFY(!stats.isNull());
+        QVERIFY(!strcmp(sig.key().primaryFingerprint(), sig.fingerprint()));
+        QVERIFY(stats.signFirst() == stats.signLast());
+        QVERIFY(stats.signCount() == 1);
+        QVERIFY(stats.policy() == TofuInfo::PolicyAuto);
+        QVERIFY(stats.validity() == TofuInfo::LittleHistory);
     }
 
     void testTofuSignCount()
@@ -235,9 +235,9 @@ private Q_SLOTS:
         GpgME::KeyListResult result = job->exec(QStringList() << QStringLiteral("zulu at example.net"),
                                                 true, keys);
         delete job;
-        Q_ASSERT(!keys.empty());
+        QVERIFY(!keys.empty());
         Key key = keys[0];
-        Q_ASSERT(!key.isNull());
+        QVERIFY(!key.isNull());
 
         /* As we sign & verify quickly here we need different
          * messages to avoid having them treated as the same
@@ -266,10 +266,10 @@ private Q_SLOTS:
         auto result = job->exec(QStringList() << QStringLiteral("zulu at example.net"),
                                                  true, keys);
         delete job;
-        Q_ASSERT(!keys.empty());
+        QVERIFY(!keys.empty());
         auto key = keys[0];
-        Q_ASSERT(!key.isNull());
-        Q_ASSERT(key.userID(0).tofuInfo().isNull());
+        QVERIFY(!key.isNull());
+        QVERIFY(key.userID(0).tofuInfo().isNull());
         auto keyCopy = key;
         keyCopy.update();
         auto sigCnt = keyCopy.userID(0).tofuInfo().signCount();
@@ -285,13 +285,13 @@ private Q_SLOTS:
         result = job->exec(QStringList() << QStringLiteral("zulu at example.net"),
                            true, keys);
         delete job;
-        Q_ASSERT(!result.error());
-        Q_ASSERT(!keys.empty());
+        QVERIFY(!result.error());
+        QVERIFY(!keys.empty());
         auto key2 = keys[0];
-        Q_ASSERT(!key2.isNull());
+        QVERIFY(!key2.isNull());
         auto info = key2.userID(0).tofuInfo();
-        Q_ASSERT(!info.isNull());
-        Q_ASSERT(info.signCount());
+        QVERIFY(!info.isNull());
+        QVERIFY(info.signCount());
     }
 
     void testTofuPolicy()
@@ -326,25 +326,25 @@ private Q_SLOTS:
                          << ">\n fpr: " << key.primaryFingerprint();
             }
         }
-        Q_ASSERT(!result.error());
-        Q_ASSERT(!keys.empty());
+        QVERIFY(!result.error());
+        QVERIFY(!keys.empty());
         auto key = keys[0];
-        Q_ASSERT(!key.isNull());
-        Q_ASSERT(key.userID(0).tofuInfo().policy() != TofuInfo::PolicyBad);
+        QVERIFY(!key.isNull());
+        QVERIFY(key.userID(0).tofuInfo().policy() != TofuInfo::PolicyBad);
         auto *tofuJob = openpgp()->tofuPolicyJob();
         auto err = tofuJob->exec(key, TofuInfo::PolicyBad);
-        Q_ASSERT(!err);
+        QVERIFY(!err);
         result = job->exec(QStringList() << QStringLiteral("bravo at example.net"),
                                             false, keys);
-        Q_ASSERT(!keys.empty());
+        QVERIFY(!keys.empty());
         key = keys[0];
-        Q_ASSERT(key.userID(0).tofuInfo().policy() == TofuInfo::PolicyBad);
+        QVERIFY(key.userID(0).tofuInfo().policy() == TofuInfo::PolicyBad);
         err = tofuJob->exec(key, TofuInfo::PolicyGood);
 
         result = job->exec(QStringList() << QStringLiteral("bravo at example.net"),
                                             false, keys);
         key = keys[0];
-        Q_ASSERT(key.userID(0).tofuInfo().policy() == TofuInfo::PolicyGood);
+        QVERIFY(key.userID(0).tofuInfo().policy() == TofuInfo::PolicyGood);
         delete tofuJob;
         delete job;
     }
@@ -354,16 +354,16 @@ private Q_SLOTS:
         QGpgMETest::initTestCase();
         const QString gpgHome = qgetenv("GNUPGHOME");
         qputenv("GNUPGHOME", mDir.path().toUtf8());
-        Q_ASSERT(mDir.isValid());
+        QVERIFY(mDir.isValid());
         QFile conf(mDir.path() + QStringLiteral("/gpg.conf"));
-        Q_ASSERT(conf.open(QIODevice::WriteOnly));
+        QVERIFY(conf.open(QIODevice::WriteOnly));
         conf.write("trust-model tofu+pgp");
         conf.close();
         QFile agentConf(mDir.path() + QStringLiteral("/gpg-agent.conf"));
-        Q_ASSERT(agentConf.open(QIODevice::WriteOnly));
+        QVERIFY(agentConf.open(QIODevice::WriteOnly));
         agentConf.write("allow-loopback-pinentry");
         agentConf.close();
-        Q_ASSERT(copyKeyrings(gpgHome, mDir.path()));
+        QVERIFY(copyKeyrings(gpgHome, mDir.path()));
     }
 private:
     QTemporaryDir mDir;
diff --git a/lang/qt/tests/t-various.cpp b/lang/qt/tests/t-various.cpp
index 330e62d..aa45b62 100644
--- a/lang/qt/tests/t-various.cpp
+++ b/lang/qt/tests/t-various.cpp
@@ -66,15 +66,15 @@ private Q_SLOTS:
         GpgME::KeyListResult result = job->exec(QStringList() << QStringLiteral("alfa at example.net"),
                                                 false, keys);
         delete job;
-        Q_ASSERT (!result.error());
-        Q_ASSERT (keys.size() == 1);
+        QVERIFY (!result.error());
+        QVERIFY (keys.size() == 1);
         Key key = keys.front();
 
         QVERIFY (key.numUserIDs() == 3);
         const char uid[] = "Foo Bar (with comment) <foo at bar.baz>";
 
         auto ctx = Context::createForProtocol(key.protocol());
-        Q_ASSERT (ctx);
+        QVERIFY (ctx);
         TestPassphraseProvider provider;
         ctx->setPassphraseProvider(&provider);
         ctx->setPinentryMode(Context::PinentryLoopback);
@@ -106,14 +106,14 @@ private Q_SLOTS:
                 break;
             }
         }
-        Q_ASSERT(id_revoked);
+        QVERIFY(id_revoked);
     }
 
     void initTestCase()
     {
         QGpgMETest::initTestCase();
         const QString gpgHome = qgetenv("GNUPGHOME");
-        Q_ASSERT(copyKeyrings(gpgHome, mDir.path()));
+        QVERIFY(copyKeyrings(gpgHome, mDir.path()));
         qputenv("GNUPGHOME", mDir.path().toUtf8());
     }
 
diff --git a/lang/qt/tests/t-verify.cpp b/lang/qt/tests/t-verify.cpp
index aedfc19..7caed28 100644
--- a/lang/qt/tests/t-verify.cpp
+++ b/lang/qt/tests/t-verify.cpp
@@ -70,14 +70,14 @@ private Q_SLOTS:
         QByteArray verified;
 
         auto result = verifyJob->exec(signedData, verified);
-        Q_ASSERT(!result.error());
+        QVERIFY(!result.error());
         delete verifyJob;
 
-        Q_ASSERT(result.numSignatures() == 1);
+        QVERIFY(result.numSignatures() == 1);
         auto sig = result.signatures()[0];
 
         const auto key = sig.key(true, false);
-        Q_ASSERT(!key.isNull());
+        QVERIFY(!key.isNull());
 
         bool found = false;
         for (const auto subkey: key.subkeys()) {
@@ -85,7 +85,7 @@ private Q_SLOTS:
                 found = true;
             }
         }
-        Q_ASSERT(found);
+        QVERIFY(found);
     }
 };
 
diff --git a/lang/qt/tests/t-wkspublish.cpp b/lang/qt/tests/t-wkspublish.cpp
index 326ecaa..64f101e 100644
--- a/lang/qt/tests/t-wkspublish.cpp
+++ b/lang/qt/tests/t-wkspublish.cpp
@@ -127,12 +127,12 @@ private Q_SLOTS:
         auto job = openpgp()->wksPublishJob();
         connect(job, &WKSPublishJob::result, this,
                 [this] (Error err, QByteArray, QByteArray, QString, Error) {
-            Q_ASSERT(err);
+            QVERIFY(err);
             Q_EMIT asyncDone();
         });
         job->startCheck ("testuser1 at localhost");
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
     }
 #ifdef DO_ONLINE_TESTS
 private Q_SLOTS:
@@ -147,15 +147,15 @@ private:
                 [this] (Error err, QByteArray, QByteArray, QString, Error) {
             if (GpgME::engineInfo(GpgME::GpgEngine).engineVersion() < "2.0.16") {
                 std::cout << err;
-                Q_ASSERT(err);
+                QVERIFY(err);
             } else {
-                Q_ASSERT(!err);
+                QVERIFY(!err);
             }
             Q_EMIT asyncDone();
         });
         job->startCheck ("testuser1 at test.gnupg.org");
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
     }
 
     void testWKSPublishErrors() {
@@ -166,13 +166,13 @@ private:
         auto job = openpgp()->wksPublishJob();
         connect(job, &WKSPublishJob::result, this,
                 [this] (Error err, QByteArray, QByteArray, QString, Error) {
-            Q_ASSERT(err);
+            QVERIFY(err);
             Q_EMIT asyncDone();
         });
         job->startCreate("AB874F24E98EBB8487EE7B170F8E3D97FE7011B7",
                          QStringLiteral("Foo at bar.baz"));
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
     }
 
     void testWKSPublishCreate() {
@@ -199,31 +199,31 @@ private:
         connect(keygenjob, &KeyGenerationJob::result, this,
                 [this, &fpr](KeyGenerationResult result, QByteArray, QString, Error)
         {
-            Q_ASSERT(!result.error());
+            QVERIFY(!result.error());
             fpr = QByteArray(result.fingerprint());
-            Q_ASSERT(!fpr.isEmpty());
+            QVERIFY(!fpr.isEmpty());
             Q_EMIT asyncDone();
         });
         keygenjob->start(args);
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
 
         /* Then try to create a request. */
         auto job = openpgp()->wksPublishJob();
         connect(job, &WKSPublishJob::result, this,
                 [this] (Error err, QByteArray out, QByteArray, QString, Error) {
-            Q_ASSERT(!err);
+            QVERIFY(!err);
             Q_EMIT asyncDone();
             const QString outstr = QString(out);
-            Q_ASSERT(outstr.contains(
+            QVERIFY(outstr.contains(
                      QStringLiteral("-----BEGIN PGP PUBLIC KEY BLOCK-----")));
-            Q_ASSERT(outstr.contains(
+            QVERIFY(outstr.contains(
                      QStringLiteral("Content-Type: application/pgp-keys")));
-            Q_ASSERT(outstr.contains(
+            QVERIFY(outstr.contains(
                      QStringLiteral("From: " TEST_ADDRESS)));
         });
         job->startCreate(fpr.constData(), QLatin1String(TEST_ADDRESS));
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
     }
 
     void testWKSPublishReceive() {
@@ -235,31 +235,31 @@ private:
         connect(importjob, &ImportJob::result, this,
                 [this](ImportResult result, QString, Error)
         {
-            Q_ASSERT(!result.error());
-            Q_ASSERT(!result.imports().empty());
-            Q_ASSERT(result.numSecretKeysImported());
+            QVERIFY(!result.error());
+            QVERIFY(!result.imports().empty());
+            QVERIFY(result.numSecretKeysImported());
             Q_EMIT asyncDone();
         });
         importjob->start(QByteArray(testSecKey));
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
 
         /* Get a response. */
         auto job = openpgp()->wksPublishJob();
         connect(job, &WKSPublishJob::result, this,
                 [this] (Error err, QByteArray out, QByteArray, QString, Error) {
-            Q_ASSERT(!err);
+            QVERIFY(!err);
             Q_EMIT asyncDone();
             const QString outstr = QString(out);
-            Q_ASSERT(outstr.contains(
+            QVERIFY(outstr.contains(
                      QStringLiteral("-----BEGIN PGP MESSAGE-----")));
-            Q_ASSERT(outstr.contains(
+            QVERIFY(outstr.contains(
                      QStringLiteral("Content-Type: multipart/encrypted;")));
-            Q_ASSERT(outstr.contains(
+            QVERIFY(outstr.contains(
                      QStringLiteral("From: " TEST_ADDRESS)));
         });
         job->startReceive(QByteArray(testResponse));
-        Q_ASSERT(spy.wait());
+        QVERIFY(spy.wait());
     }
 
     void initTestCase()
@@ -267,9 +267,9 @@ private:
         QGpgMETest::initTestCase();
         const QString gpgHome = qgetenv("GNUPGHOME");
         qputenv("GNUPGHOME", mDir.path().toUtf8());
-        Q_ASSERT(mDir.isValid());
+        QVERIFY(mDir.isValid());
         QFile agentConf(mDir.path() + QStringLiteral("/gpg-agent.conf"));
-        Q_ASSERT(agentConf.open(QIODevice::WriteOnly));
+        QVERIFY(agentConf.open(QIODevice::WriteOnly));
         agentConf.write("allow-loopback-pinentry");
         agentConf.close();
     }

commit 9e643ab67168dfbd189ccc0bfed8fb59253ee79c
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Jan 11 16:18:17 2017 +0100

    qt: Add test for uid functions
    
    * lang/qt/tests/t-various.cpp: New.
    * lang/qt/tests/Makefile.am: Update accordingly.

diff --git a/lang/qt/tests/Makefile.am b/lang/qt/tests/Makefile.am
index ad08ad4..aba7be8 100644
--- a/lang/qt/tests/Makefile.am
+++ b/lang/qt/tests/Makefile.am
@@ -25,10 +25,11 @@ TESTS_ENVIRONMENT = GNUPGHOME=$(abs_builddir)
 EXTRA_DIST = initial.test
 
 TESTS = initial.test t-keylist t-keylocate t-ownertrust t-tofuinfo \
-        t-encrypt t-verify
+        t-encrypt t-verify t-various
 
 moc_files = t-keylist.moc t-keylocate.moc t-ownertrust.moc t-tofuinfo.moc \
-            t-encrypt.moc t-support.hmoc t-wkspublish.moc t-verify.moc
+            t-encrypt.moc t-support.hmoc t-wkspublish.moc t-verify.moc \
+            t-various.moc
 
 AM_LDFLAGS = -no-install
 
@@ -57,6 +58,7 @@ t_tofuinfo_SOURCES = t-tofuinfo.cpp $(support_src)
 t_encrypt_SOURCES = t-encrypt.cpp $(support_src)
 t_wkspublish_SOURCES = t-wkspublish.cpp $(support_src)
 t_verify_SOURCES = t-verify.cpp $(support_src)
+t_various_SOURCES = t-various.cpp $(support_src)
 run_keyformailboxjob_SOURCES = run-keyformailboxjob.cpp
 
 nodist_t_keylist_SOURCES = $(moc_files)
@@ -64,7 +66,7 @@ nodist_t_keylist_SOURCES = $(moc_files)
 BUILT_SOURCES = $(moc_files)
 
 noinst_PROGRAMS = t-keylist t-keylocate t-ownertrust t-tofuinfo t-encrypt \
-    run-keyformailboxjob t-wkspublish t-verify
+    run-keyformailboxjob t-wkspublish t-verify t-various
 
 CLEANFILES = secring.gpg pubring.gpg pubring.kbx trustdb.gpg dirmngr.conf \
 	gpg-agent.conf pubring.kbx~ S.gpg-agent gpg.conf pubring.gpg~ \
diff --git a/lang/qt/tests/t-various.cpp b/lang/qt/tests/t-various.cpp
new file mode 100644
index 0000000..330e62d
--- /dev/null
+++ b/lang/qt/tests/t-various.cpp
@@ -0,0 +1,126 @@
+/* t-various.cpp
+
+    This file is part of qgpgme, the Qt API binding for gpgme
+    Copyright (c) 2017 Intevation GmbH
+
+    QGpgME is free software; you can redistribute it and/or
+    modify it under the terms of the GNU General Public License as
+    published by the Free Software Foundation; either version 2 of the
+    License, or (at your option) any later version.
+
+    QGpgME is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+    In addition, as a special exception, the copyright holders give
+    permission to link the code of this program with any edition of
+    the Qt library by Trolltech AS, Norway (or with modified versions
+    of Qt that use the same license as Qt), and distribute linked
+    combinations including the two.  You must obey the GNU General
+    Public License in all respects for all of the code used other than
+    Qt.  If you modify this file, you may extend this exception to
+    your version of the file, but you are not obligated to do so.  If
+    you do not wish to do so, delete this exception statement from
+    your version.
+*/
+
+#ifdef HAVE_CONFIG_H
+ #include "config.h"
+#endif
+
+#include <QDebug>
+#include <QTest>
+#include <QSignalSpy>
+#include "keylistjob.h"
+#include "protocol.h"
+#include "keylistresult.h"
+#include "context.h"
+#include "engineinfo.h"
+
+#include "t-support.h"
+
+using namespace QGpgME;
+using namespace GpgME;
+
+class TestVarious: public QGpgMETest
+{
+    Q_OBJECT
+
+Q_SIGNALS:
+    void asyncDone();
+
+private Q_SLOTS:
+
+    void testQuickUid()
+    {
+        if (GpgME::engineInfo(GpgME::GpgEngine).engineVersion() < "2.1.13") {
+            return;
+        }
+        KeyListJob *job = openpgp()->keyListJob(false, true, true);
+        std::vector<GpgME::Key> keys;
+        GpgME::KeyListResult result = job->exec(QStringList() << QStringLiteral("alfa at example.net"),
+                                                false, keys);
+        delete job;
+        Q_ASSERT (!result.error());
+        Q_ASSERT (keys.size() == 1);
+        Key key = keys.front();
+
+        QVERIFY (key.numUserIDs() == 3);
+        const char uid[] = "Foo Bar (with comment) <foo at bar.baz>";
+
+        auto ctx = Context::createForProtocol(key.protocol());
+        Q_ASSERT (ctx);
+        TestPassphraseProvider provider;
+        ctx->setPassphraseProvider(&provider);
+        ctx->setPinentryMode(Context::PinentryLoopback);
+
+        QVERIFY(!ctx->addUid(key, uid));
+        delete ctx;
+        key.update();
+
+        QVERIFY (key.numUserIDs() == 4);
+        bool id_found = false;;
+        for (const auto &u: key.userIDs()) {
+            if (!strcmp (u.id(), uid)) {
+                QVERIFY (!u.isRevoked());
+                id_found = true;
+                break;
+            }
+        }
+        QVERIFY (id_found);
+
+        ctx = Context::createForProtocol(key.protocol());
+        QVERIFY (!ctx->revUid(key, uid));
+        delete ctx;
+        key.update();
+
+        bool id_revoked = false;;
+        for (const auto &u: key.userIDs()) {
+            if (!strcmp (u.id(), uid)) {
+                id_revoked = true;
+                break;
+            }
+        }
+        Q_ASSERT(id_revoked);
+    }
+
+    void initTestCase()
+    {
+        QGpgMETest::initTestCase();
+        const QString gpgHome = qgetenv("GNUPGHOME");
+        Q_ASSERT(copyKeyrings(gpgHome, mDir.path()));
+        qputenv("GNUPGHOME", mDir.path().toUtf8());
+    }
+
+private:
+    QTemporaryDir mDir;
+};
+
+QTEST_MAIN(TestVarious)
+
+#include "t-various.moc"

commit e416f9961837039f259558edf41fccbc181ad128
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Jan 11 16:14:45 2017 +0100

    cpp: Add revuid and adduid support
    
    * lang/cpp/src/context.cpp
    (Context::revUid, Context::startRevUid),
    (Context::addUid, Context::startAddUid): New.
    * lang/cpp/src/context.h: Declare new functions.
    * lang/cpp/src/key.cpp (Key::UserID::revoke)
    (Key::addUid): Idomatic helpers.
    lang/cpp/src/key.h: Declare new functions.
    * NEWS: Update accordingly.

diff --git a/NEWS b/NEWS
index 39b41f6..c0ae27f 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,17 @@
 Noteworthy changes in version 1.8.1 (unreleased)
 ------------------------------------------------
 
+ * cpp: Support for adduid and revuid operations.
+
+ * Interface changes relative to the 1.8.0 release:
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ cpp: Context::revUid(const Key&, const char*)      NEW.
+ cpp: Context::startRevUid(const Key&, const char*) NEW.
+ cpp: Context::addUid(const Key&, const char*)      NEW.
+ cpp: Context::startAddUid(const Key&, const char*) NEW.
+ cpp: Key::UserID::revoke()                         NEW.
+ cpp: Key::addUid()                                 NEW.
+
 
 Noteworthy changes in version 1.8.0 (2016-11-16)
 ------------------------------------------------
diff --git a/lang/cpp/src/context.cpp b/lang/cpp/src/context.cpp
index ada7bea..040e8f3 100644
--- a/lang/cpp/src/context.cpp
+++ b/lang/cpp/src/context.cpp
@@ -1376,6 +1376,30 @@ Error Context::setTofuPolicyStart(const Key &k, unsigned int policy)
                  k.impl(), to_tofu_policy_t(policy)));
 }
 
+Error Context::addUid(const Key &k, const char *userid)
+{
+    return Error(d->lasterr = gpgme_op_adduid(d->ctx,
+                 k.impl(), userid, 0));
+}
+
+Error Context::startAddUid(const Key &k, const char *userid)
+{
+    return Error(d->lasterr = gpgme_op_adduid_start(d->ctx,
+                 k.impl(), userid, 0));
+}
+
+Error Context::revUid(const Key &k, const char *userid)
+{
+    return Error(d->lasterr = gpgme_op_revuid(d->ctx,
+                 k.impl(), userid, 0));
+}
+
+Error Context::startRevUid(const Key &k, const char *userid)
+{
+    return Error(d->lasterr = gpgme_op_revuid_start(d->ctx,
+                 k.impl(), userid, 0));
+}
+
 // Engine Spawn stuff
 Error Context::spawn(const char *file, const char *argv[],
                      Data &input, Data &output, Data &err,
diff --git a/lang/cpp/src/context.h b/lang/cpp/src/context.h
index 2c205b0..b075bf1 100644
--- a/lang/cpp/src/context.h
+++ b/lang/cpp/src/context.h
@@ -214,6 +214,12 @@ public:
     GpgME::Error edit(const Key &key, std::unique_ptr<EditInteractor> function, Data &out);
     GpgME::Error startEditing(const Key &key, std::unique_ptr<EditInteractor> function, Data &out);
 
+    Error addUid(const Key &key, const char *userid);
+    Error startAddUid(const Key &key, const char *userid);
+
+    Error revUid(const Key &key, const char *userid);
+    Error startRevUid(const Key &key, const char *userid);
+
     // using TofuInfo::Policy
     Error setTofuPolicy(const Key &k, unsigned int policy);
     Error setTofuPolicyStart(const Key &k, unsigned int policy);
diff --git a/lang/cpp/src/key.cpp b/lang/cpp/src/key.cpp
index 4f7ec54..3cc26a7 100644
--- a/lang/cpp/src/key.cpp
+++ b/lang/cpp/src/key.cpp
@@ -906,6 +906,34 @@ std::string UserID::addrSpec() const
     return uid->address;
 }
 
+Error UserID::revoke()
+{
+    if (isNull()) {
+        return Error::fromCode(GPG_ERR_GENERAL);
+    }
+    auto ctx = Context::createForProtocol(parent().protocol());
+    if (!ctx) {
+        return Error::fromCode(GPG_ERR_INV_ENGINE);
+    }
+    Error ret = ctx->revUid(key, id());
+    delete ctx;
+    return ret;
+}
+
+Error Key::addUid(const char *uid)
+{
+    if (isNull()) {
+        return Error::fromCode(GPG_ERR_GENERAL);
+    }
+    auto ctx = Context::createForProtocol(protocol());
+    if (!ctx) {
+        return Error::fromCode(GPG_ERR_INV_ENGINE);
+    }
+    Error ret = ctx->addUid(key, uid);
+    delete ctx;
+    return ret;
+}
+
 std::ostream &operator<<(std::ostream &os, const UserID &uid)
 {
     os << "GpgME::UserID(";
diff --git a/lang/cpp/src/key.h b/lang/cpp/src/key.h
index 3f596a8..b0599c7 100644
--- a/lang/cpp/src/key.h
+++ b/lang/cpp/src/key.h
@@ -152,6 +152,17 @@ public:
      * how long the keylisting takes.*/
     void update();
 
+    /**
+     * @brief Add a user id to this key.
+     *
+     * Needs gnupg 2.1.13 and the key needs to be updated
+     * afterwards to see the new uid.
+     *
+     * @param uid should be fully formated and UTF-8 encoded.
+     *
+     * @returns a possible error.
+     **/
+    Error addUid(const char *uid);
 private:
     gpgme_key_t impl() const
     {
@@ -335,6 +346,13 @@ public:
      * @returns a normalized mail address for this userid
      * or an empty string. */
     std::string addrSpec() const;
+
+    /*! Revoke the user id.
+     *
+     * Key needs update afterwards.
+     *
+     * @returns an error on error.*/
+    Error revoke();
 private:
     shared_gpgme_key_t key;
     gpgme_user_id_t uid;

-----------------------------------------------------------------------

Summary of changes:
 NEWS                                              |  11 ++
 lang/cpp/src/context.cpp                          |  24 ++++
 lang/cpp/src/context.h                            |   6 +
 lang/cpp/src/key.cpp                              |  28 ++++
 lang/cpp/src/key.h                                |  18 +++
 lang/qt/tests/Makefile.am                         |   8 +-
 lang/qt/tests/t-encrypt.cpp                       |  58 ++++----
 lang/qt/tests/t-keylist.cpp                       |  18 +--
 lang/qt/tests/t-keylocate.cpp                     |  26 ++--
 lang/qt/tests/t-ownertrust.cpp                    |  18 +--
 lang/qt/tests/t-tofuinfo.cpp                      | 158 +++++++++++-----------
 lang/qt/tests/{t-ownertrust.cpp => t-various.cpp} | 103 ++++++++------
 lang/qt/tests/t-verify.cpp                        |   8 +-
 lang/qt/tests/t-wkspublish.cpp                    |  52 +++----
 14 files changed, 320 insertions(+), 216 deletions(-)
 copy lang/qt/tests/{t-ownertrust.cpp => t-various.cpp} (54%)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 11 16:47:01 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 11 Jan 2017 16:47:01 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-63-g76fb2fe
Message-ID: <E1cRL7A-0000nw-0P@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  76fb2febde10da8237bbe7613830b51af2a45139 (commit)
       via  09aeac41c97bc8ecb44a09886c7fdbd9a6ec5c7f (commit)
      from  915864e7f0315b0c96315d0bcd48b1b93592353a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 76fb2febde10da8237bbe7613830b51af2a45139
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 11 16:43:30 2017 +0100

    dirmngr: Mark hosts dead on ENETDOWN.
    
    * dirmngr/ks-engine-hkp.c (handle_send_request_error): Take care of
    ENETDOWN.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 5f6e5f4..ddeba45 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -1132,10 +1132,14 @@ handle_send_request_error (gpg_error_t err, const char *request,
 {
   int retry = 0;
 
+  /* Fixme: Should we disable all hosts of a protocol family if a
+   * request for an address of that familiy returned ENETDOWN?  */
+
   switch (gpg_err_code (err))
     {
     case GPG_ERR_ECONNREFUSED:
     case GPG_ERR_ENETUNREACH:
+    case GPG_ERR_ENETDOWN:
     case GPG_ERR_UNKNOWN_HOST:
     case GPG_ERR_NETWORK:
       if (mark_host_dead (request) && *tries_left)
@@ -1148,6 +1152,7 @@ handle_send_request_error (gpg_error_t err, const char *request,
           log_info ("selecting a different host due to a timeout\n");
           retry = 1;
         }
+      break;
 
     default:
       break;

commit 09aeac41c97bc8ecb44a09886c7fdbd9a6ec5c7f
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 11 16:41:15 2017 +0100

    dirmngr: Fix Tor access for v6 addresses.
    
    * dirmngr/http.c (use_socks): New.
    (my_sock_new_for_addr): New.
    (connect_server): Replace assuan_sock_new by my_sock_new_for_addr.
    --
    
    Libassuan always uses 127.0.0.1 to connect to the local Tor proxy.
    https.c used to create a socket for the actual address family and thus
    the connect call in Libassuan fails when it tries to connect to a v6
    address using a v4 socket.
    
    It would be cleaner to have the my_sock_new_for_addr function as a
    public interface in Libassuan; for now we need to duplicate some code.
    from Libassuan.
    
    GnuPG-bug-id: 2902
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index c1a60be..75701ec 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -2337,6 +2337,68 @@ start_server ()
 }
 #endif
 
+
+
+/* Return true if SOCKS shall be used.  This is the case if tor_mode
+ * is enabled and the desired address is not the loopback address.
+ * This function is basically a copy of the same internal fucntion in
+ * Libassuan.  */
+static int
+use_socks (struct sockaddr *addr)
+{
+  int mode;
+
+  if (assuan_sock_get_flag (ASSUAN_INVALID_FD, "tor-mode", &mode) || !mode)
+    return 0;  /* Not in Tor mode.  */
+  else if (addr->sa_family == AF_INET6)
+    {
+      struct sockaddr_in6 *addr_in6 = (struct sockaddr_in6 *)addr;
+      const unsigned char *s;
+      int i;
+
+      s = (unsigned char *)&addr_in6->sin6_addr.s6_addr;
+      if (s[15] != 1)
+        return 1;   /* Last octet is not 1 - not the loopback address.  */
+      for (i=0; i < 15; i++, s++)
+        if (*s)
+          return 1; /* Non-zero octet found - not the loopback address.  */
+
+      return 0; /* This is the loopback address.  */
+    }
+  else if (addr->sa_family == AF_INET)
+    {
+      struct sockaddr_in *addr_in = (struct sockaddr_in *)addr;
+
+      if (*(unsigned char*)&addr_in->sin_addr.s_addr == 127)
+        return 0; /* Loopback (127.0.0.0/8) */
+
+      return 1;
+    }
+  else
+    return 0;
+}
+
+
+/* Wrapper around assuan_sock_new which takes the domain from an
+ * address parameter.  */
+static assuan_fd_t
+my_sock_new_for_addr (struct sockaddr *addr, int type, int proto)
+{
+  int domain;
+
+  if (use_socks (addr))
+    {
+      /* Libassaun always uses 127.0.0.1 to connect to the socks
+       * server (i.e. the Tor daemon).  */
+      domain = AF_INET;
+    }
+  else
+    domain = addr->sa_family;
+
+  return assuan_sock_new (domain, type, proto);
+}
+
+
 /* Actually connect to a server.  Returns the file descriptor or -1 on
    error.  ERRNO is set on error. */
 static assuan_fd_t
@@ -2436,7 +2498,7 @@ connect_server (const char *server, unsigned short port,
 
           if (sock != ASSUAN_INVALID_FD)
             assuan_sock_close (sock);
-          sock = assuan_sock_new (ai->family, ai->socktype, ai->protocol);
+          sock = my_sock_new_for_addr (ai->addr, ai->socktype, ai->protocol);
           if (sock == ASSUAN_INVALID_FD)
             {
               int save_errno = errno;

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/http.c          | 64 ++++++++++++++++++++++++++++++++++++++++++++++++-
 dirmngr/ks-engine-hkp.c |  5 ++++
 2 files changed, 68 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 11 17:11:45 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 11 Jan 2017 17:11:45 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-64-g20dfcfe
Message-ID: <E1cRLV5-0001cw-Ft@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  20dfcfe08c618d23134d5d6efef7676b090f30d3 (commit)
      from  76fb2febde10da8237bbe7613830b51af2a45139 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 20dfcfe08c618d23134d5d6efef7676b090f30d3
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 11 17:09:16 2017 +0100

    dirmngr: After a connection failure log a hint if Tor is not running.
    
    * dirmngr/ks-engine-hkp.c (handle_send_request_error): Check whether
    Tor is running.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index ddeba45..5febb13 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -1138,6 +1138,17 @@ handle_send_request_error (gpg_error_t err, const char *request,
   switch (gpg_err_code (err))
     {
     case GPG_ERR_ECONNREFUSED:
+      if (opt.use_tor)
+        {
+          assuan_fd_t sock;
+
+          sock = assuan_sock_connect_byname (NULL, 0, 0, NULL, ASSUAN_SOCK_TOR);
+          if (sock == ASSUAN_INVALID_FD)
+            log_info ("(it seems Tor is not running)\n");
+          else
+            assuan_sock_close (sock);
+        }
+      /*FALLTHRU*/
     case GPG_ERR_ENETUNREACH:
     case GPG_ERR_ENETDOWN:
     case GPG_ERR_UNKNOWN_HOST:

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/ks-engine-hkp.c | 11 +++++++++++
 1 file changed, 11 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 12 09:24:45 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 12 Jan 2017 09:24:45 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-66-g97372b3
Message-ID: <E1cRagj-0001mf-6S@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  97372b39cd9b4c84a083eadbf072fff77799617f (commit)
       via  0fadff9cdde47e42f7e428bc903b3626c67ba9c0 (commit)
      from  20dfcfe08c618d23134d5d6efef7676b090f30d3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 97372b39cd9b4c84a083eadbf072fff77799617f
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 12 09:22:14 2017 +0100

    libdns: Silence -Wstrict-prototypes on some function ptrs.
    
    * dirmngr/dns.c (dns_rrtype): Ignore -Wstrict-prototypes warning.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns.c b/dirmngr/dns.c
index b580e40..016ff44 100644
--- a/dirmngr/dns.c
+++ b/dirmngr/dns.c
@@ -4246,6 +4246,15 @@ size_t dns_txt_print(void *_dst, size_t lim, struct dns_txt *txt) {
 } /* dns_txt_print() */
 
 
+/* Some of the function pointers of DNS_RRTYPES are initialized with
+ * slighlly different fucntions, thus we can't use prototypes.  */
+DNS_PRAGMA_PUSH
+#if __clang__
+#pragma clang diagnostic ignored "-Wstrict-prototypes"
+#elif DNS_GNUC_PREREQ(4,6,0)
+#pragma GCC   diagnostic ignored "-Wstrict-prototypes"
+#endif
+
 static const struct dns_rrtype {
 	enum dns_type type;
 	const char *name;
@@ -4271,6 +4280,10 @@ static const struct dns_rrtype {
 	{ DNS_T_AXFR,   "AXFR",   0,                 0,                 0,                0,               0,                 0,                },
 }; /* dns_rrtypes[] */
 
+DNS_PRAGMA_POP  /*(-Wstrict-prototypes)*/
+
+
+
 static const struct dns_rrtype *dns_rrtype(enum dns_type type) {
 	const struct dns_rrtype *t;
 

commit 0fadff9cdde47e42f7e428bc903b3626c67ba9c0
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 12 09:20:49 2017 +0100

    libdns: Provide replacement for EPROTO.
    
    * dirmngr/dns.c (EPROTO) ![EPROTO]: Define to EPROTONOSUPPORT.
    --
    
    This is the same replacement we use in Libassuan
    (commit 8ab3b9273524bd344bdb90dd5d3bc8e5f53ead6e) to make it work on
    OpenBSD and may other BSD based OSes.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns.c b/dirmngr/dns.c
index 4b61b72..b580e40 100644
--- a/dirmngr/dns.c
+++ b/dirmngr/dns.c
@@ -288,6 +288,10 @@ int dns_v_api(void) {
  *
  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
 
+#ifndef EPROTO
+# define EPROTO EPROTONOSUPPORT
+#endif
+
 #if _WIN32
 
 #define DNS_EINTR	WSAEINTR

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dns.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 12 10:43:51 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 12 Jan 2017 10:43:51 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-69-gc99a09f
Message-ID: <E1cRbvG-00053W-V6@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  c99a09f111c5980ae034faaea61a00d9ad60463c (commit)
       via  5c0777e1ca02ff1767755c417b64d6f78e02f475 (commit)
       via  3c00b52f7cb0fbd756c0bbe5134b8f2d69c60dd1 (commit)
      from  97372b39cd9b4c84a083eadbf072fff77799617f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c99a09f111c5980ae034faaea61a00d9ad60463c
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 12 10:40:26 2017 +0100

    gpg: Rename a var to avoid a shadowing warning.
    
    * g10/keygen.c (keygen_set_std_prefs): Rename variable.
    --
    
    I consider it better not to use the name of a commonly used function.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/keygen.c b/g10/keygen.c
index b4fddba..98ef29e 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -434,9 +434,11 @@ keygen_set_std_prefs (const char *string,int personal)
 
     if(strlen(string))
       {
-	char *dup, *tok, *prefstring;
+	char *prefstringbuf;
+        char *tok, *prefstring;
 
-	dup = prefstring = xstrdup (string); /* need a writable string! */
+        /* We need a writable string. */
+	prefstring = prefstringbuf = xstrdup (string);
 
 	while((tok=strsep(&prefstring," ,")))
 	  {
@@ -470,7 +472,7 @@ keygen_set_std_prefs (const char *string,int personal)
 	      }
 	  }
 
-	xfree (dup);
+	xfree (prefstringbuf);
       }
 
     if(!rc)

commit 5c0777e1ca02ff1767755c417b64d6f78e02f475
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 12 10:39:19 2017 +0100

    tests: Fix t-gettime for a time_t of 64 and a long of 32 bit.
    
    * configure.ac (AC_CHECK_HEADERS): Add stdint.h.
    * common/t-gettime.c: Include stdint.h.
    (UINTMAX_C): Define replacement.
    (test_isotime2epoch): Use UINTMAX_C for the >32 bit constants.
    --
    
    This is for example the case on 32 bit OpenBSD.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/t-gettime.c b/common/t-gettime.c
index 9d9881a..13cb1a2 100644
--- a/common/t-gettime.c
+++ b/common/t-gettime.c
@@ -20,9 +20,18 @@
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
+#ifdef HAVE_STDINT_H
+# include <stdint.h>
+#endif
 
 #include "util.h"
 
+/* In case we do not have stdint.h and no other version of that
+ * conversion macro provide shortcut it.  */
+#ifndef UINTMAX_C
+#define UINTMAX_C (c)  (c)
+#endif
+
 #define pass()  do { ; } while(0)
 #define fail(a)  do { fprintf (stderr, "%s:%d: test %d failed\n",\
                                __FILE__,__LINE__, (a));          \
@@ -55,10 +64,10 @@ test_isotime2epoch (void)
     { "20070629T160000\n", 1183132800 },
     { "20070629T160000.",  INVALID },
 #if SIZEOF_TIME_T > 4
-    { "21060207T062815", (time_t)0x0ffffffff },
-    { "21060207T062816", (time_t)0x100000000 },
-    { "21060207T062817", (time_t)0x100000001 },
-    { "21060711T120001", (time_t)4308292801  },
+    { "21060207T062815", (time_t)UINTMAX_C(0x0ffffffff) },
+    { "21060207T062816", (time_t)UINTMAX_C(0x100000000) },
+    { "21060207T062817", (time_t)UINTMAX_C(0x100000001) },
+    { "21060711T120001", (time_t)UINTMAX_C(4308292801)  },
 #endif /*SIZEOF_TIME_T > 4*/
     { NULL, 0 }
   };
diff --git a/configure.ac b/configure.ac
index fa206c9..f929cb6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1258,7 +1258,7 @@ AC_MSG_NOTICE([checking for header files])
 AC_HEADER_STDC
 AC_CHECK_HEADERS([string.h unistd.h langinfo.h termio.h locale.h getopt.h \
                   pty.h utmp.h pwd.h inttypes.h signal.h sys/select.h     \
-                  signal.h])
+                  stdint.h signal.h])
 AC_HEADER_TIME
 
 

commit 3c00b52f7cb0fbd756c0bbe5134b8f2d69c60dd1
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 12 09:58:57 2017 +0100

    build: Make autogen.sh more POSIX friendly.
    
    * autogen.sh: Replace non POSIX "cp -a" and "head -c".
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/autogen.sh b/autogen.sh
index 92c6df8..f2af5a7 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -225,7 +225,7 @@ if [ "$myhost" = "find-version" ]; then
       fi
       [ -n "$tmp" ] && beta=yes
       rev=$(git rev-parse --short HEAD | tr -d '\n\r')
-      rvd=$((0x$(echo ${rev} | head -c 4)))
+      rvd=$((0x$(echo ${rev} | dd bs=1 count=2 2>/dev/null)))
     else
       ingit=no
       beta=yes
@@ -417,8 +417,11 @@ fi
 
 # Check the git setup.
 if [ -d .git ]; then
-  CP="cp -a"
-  [ -z "${SILENT}" ] && CP="$CP -v"
+  CP="cp -p"
+  # If we have a GNU cp we can add -v
+  if cp --version >/dev/null 2>/dev/null; then
+    [ -z "${SILENT}" ] && CP="$CP -v"
+  fi
   if [ -f .git/hooks/pre-commit.sample -a ! -f .git/hooks/pre-commit ] ; then
     [ -z "${SILENT}" ] && cat <<EOF
 *** Activating trailing whitespace git pre-commit hook. ***

-----------------------------------------------------------------------

Summary of changes:
 autogen.sh         |  9 ++++++---
 common/t-gettime.c | 17 +++++++++++++----
 configure.ac       |  2 +-
 g10/keygen.c       |  8 +++++---
 4 files changed, 25 insertions(+), 11 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 12 11:25:38 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 12 Jan 2017 11:25:38 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-70-g3db76c9
Message-ID: <E1cRcZg-0006ul-KP@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  3db76c9277d918dec9721a6439f4db3b3c06aba3 (commit)
      from  c99a09f111c5980ae034faaea61a00d9ad60463c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3db76c9277d918dec9721a6439f4db3b3c06aba3
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 12 11:22:37 2017 +0100

    build: Make autogen.sh more POSIX friendly (next try)
    
    * autogen.sh: Fix dd count to 5.
    --
    
    Fixes-commit: 3c00b52f7cb0fbd756c0bbe5134b8f2d69c60dd1
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/autogen.sh b/autogen.sh
index f2af5a7..3ef1ea0 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -225,7 +225,7 @@ if [ "$myhost" = "find-version" ]; then
       fi
       [ -n "$tmp" ] && beta=yes
       rev=$(git rev-parse --short HEAD | tr -d '\n\r')
-      rvd=$((0x$(echo ${rev} | dd bs=1 count=2 2>/dev/null)))
+      rvd=$((0x$(echo ${rev} | dd bs=1 count=4 2>/dev/null)))
     else
       ingit=no
       beta=yes

-----------------------------------------------------------------------

Summary of changes:
 autogen.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 12 11:46:28 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 12 Jan 2017 11:46:28 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-27-ga09ed3f
Message-ID: <E1cRctq-00085o-D3@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  a09ed3f26a1fab54079c37c49df5c440cc792f78 (commit)
      from  56926c9b5012e8135541a933af1d69c5a81f02b3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a09ed3f26a1fab54079c37c49df5c440cc792f78
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Jan 12 11:44:11 2017 +0100

    qt: Don't use qstrdup in test passphrase cb
    
    * lang/qt/tests/t-support.h (TestPassphraseProvider::getPassphrase):
    Use gpgrt_asprintf instead of strdup.
    
    --
    To avoid problems on MacOS we want to avoid strdup so that
    qgpgme can be built without extensions. But qstrdup allocates
    with new and not with malloc, so use gpgrt_asprintf instead.

diff --git a/lang/qt/tests/t-support.h b/lang/qt/tests/t-support.h
index 2630b7d..e3f0e78 100644
--- a/lang/qt/tests/t-support.h
+++ b/lang/qt/tests/t-support.h
@@ -34,6 +34,8 @@
 #include "interfaces/passphraseprovider.h"
 #include <QObject>
 
+#include <gpg-error.h>
+
 namespace GpgME
 {
 class TestPassphraseProvider : public PassphraseProvider
@@ -42,7 +44,9 @@ public:
     char *getPassphrase(const char * /*useridHint*/, const char * /*description*/,
                         bool /*previousWasBad*/, bool &/*canceled*/) Q_DECL_OVERRIDE
     {
-        return qstrdup("abc");
+        char *ret;
+        gpgrt_asprintf(&ret, "abc");
+        return ret;
     }
 };
 } // namespace GpgME

-----------------------------------------------------------------------

Summary of changes:
 lang/qt/tests/t-support.h | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 12 12:27:55 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 12 Jan 2017 12:27:55 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. ca620a23d9f5b25ed58be0c9f3dae10251dfc6c0
Message-ID: <E1cRdXx-00012j-S9@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  ca620a23d9f5b25ed58be0c9f3dae10251dfc6c0 (commit)
       via  47cb17b41070317543a6907911b0640d651ca85f (commit)
       via  18057085478bef22ffb1963bae815ff4ecf39c9c (commit)
      from  538b6dec949b89247963ba90e676c2dd87c32db7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ca620a23d9f5b25ed58be0c9f3dae10251dfc6c0
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jan 12 12:27:15 2017 +0100

    jenkins: add notes on the openbsd installation

diff --git a/misc/jenkins/README.org b/misc/jenkins/README.org
index 8691018..0fe24c7 100644
--- a/misc/jenkins/README.org
+++ b/misc/jenkins/README.org
@@ -10,3 +10,16 @@ and a build tree at
   $HOME/src/gpgme-for-gnupgs-tests/obj
 
 The tests from there are executed in GnuPG's test suite.
+* Virtual machines
+** openbsd60
+Packages installed:
+
+  # pkg_add zile zsh git autoconf-2.69p2 automake-1.15p0 gettext-tools \
+    gmake xfig bison readline libusb-compat ImageMagick makeinfo
+
+Add some compatibility links to PATH:
+
+  $ mkdir compat
+  $ cd compat
+  $ ln -s /usr/local/bin/gmakeinfo makeinfo
+  $ [ add $HOME/compat to ~/.profile ]

commit 47cb17b41070317543a6907911b0640d651ca85f
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jan 12 12:25:25 2017 +0100

    jenkins: explicitly point configure to iconv on openbsd

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 84777c8..87f0037 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -110,6 +110,9 @@ case "$JOB_NAME" in
 	if [ "$NODE_NAME" = zygalski ]; then
 	    CONFIGUREFLAGS="$CONFIGUREFLAGS --with-libiconv-prefix=$HOME/pkg"
 	fi
+	if [ "$NODE_NAME" = openbsd60 ]; then
+	    CONFIGUREFLAGS="$CONFIGUREFLAGS --with-libiconv-prefix=/usr/local"
+	fi
         ;;
 esac
 

commit 18057085478bef22ffb1963bae815ff4ecf39c9c
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jan 12 12:22:38 2017 +0100

    jenkins: honor CFLAGS, fixes gpgme build on macos

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 4869979..84777c8 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -130,7 +130,9 @@ case "$XTARGET" in
     native)
         ../configure --prefix=$PREFIX --enable-maintainer-mode \
 	           $CONFIGUREFLAGS \
-	           "$CONFIGUREFLAGS_0"
+	           "$CONFIGUREFLAGS_0" \
+		   CFLAGS="$CFLAGS" \
+	           CXXFLAGS="$CXXFLAGS -std=c++11"
         $MAKE $MAKEFLAGS
 
         $MAKE -k check verbose=2 || true

-----------------------------------------------------------------------

Summary of changes:
 misc/jenkins/README.org     | 13 +++++++++++++
 misc/jenkins/bin/build.bash |  7 ++++++-
 2 files changed, 19 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 12 13:04:55 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 12 Jan 2017 13:04:55 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-28-g9640dc5
Message-ID: <E1cRe7l-00030d-Au@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  9640dc58e498966b482dcded6990cf4b47c556ac (commit)
      from  a09ed3f26a1fab54079c37c49df5c440cc792f78 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9640dc58e498966b482dcded6990cf4b47c556ac
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Jan 12 12:57:00 2017 +0100

    qt: Add support for stringValueList in CryptoConf
    
    * lang/qt/src/Makefile.am (qgpgme_sources): Add cryptoconfig.cpp
    * lang/qt/src/cryptoconfig.cpp: New.
    * lang/qt/src/cryptoconfig.h (CryptoConfigEntry::stringValueList):
    New.
    * lang/qt/src/qgpgmenewcryptoconfig.cpp
    (QGpgMENewCryptoConfigEntry::stringValueList): New.
    * lang/qt/src/qgpgmenewcryptoconfig.h: Update accordingly.
    
    --
    This is a pardigm change in cryptoconfig.h to avoid ABI breaks
    with each new config value we support it now has an implementation
    that is directly related to qgpgmenewcryptoconfig, which is now
    the only one.

diff --git a/NEWS b/NEWS
index c0ae27f..0fca77a 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,7 @@ Noteworthy changes in version 1.8.1 (unreleased)
  cpp: Context::startAddUid(const Key&, const char*) NEW.
  cpp: Key::UserID::revoke()                         NEW.
  cpp: Key::addUid()                                 NEW.
+ qt: CryptoConfig::stringValueList()                NEW.
 
 
 Noteworthy changes in version 1.8.0 (2016-11-16)
diff --git a/lang/qt/src/Makefile.am b/lang/qt/src/Makefile.am
index 55af1cf..c81461e 100644
--- a/lang/qt/src/Makefile.am
+++ b/lang/qt/src/Makefile.am
@@ -37,7 +37,7 @@ qgpgme_sources = \
     qgpgmekeyformailboxjob.cpp gpgme_backend_debug.cpp \
     qgpgmetofupolicyjob.cpp \
     defaultkeygenerationjob.cpp qgpgmewkspublishjob.cpp \
-    dn.cpp
+    dn.cpp cryptoconfig.cpp
 
 # If you add one here make sure that you also add one in camelcase
 qgpgme_headers= \
diff --git a/lang/qt/src/cryptoconfig.cpp b/lang/qt/src/cryptoconfig.cpp
new file mode 100644
index 0000000..be265d8
--- /dev/null
+++ b/lang/qt/src/cryptoconfig.cpp
@@ -0,0 +1,44 @@
+/*
+    cryptoconfig.cpp
+
+    This file is part of qgpgme, the Qt API binding for gpgme
+    Copyright (c) 2017 Intevation GmbH
+
+    QGpgME is free software; you can redistribute it and/or
+    modify it under the terms of the GNU General Public License as
+    published by the Free Software Foundation; either version 2 of the
+    License, or (at your option) any later version.
+
+    QGpgME is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+    In addition, as a special exception, the copyright holders give
+    permission to link the code of this program with any edition of
+    the Qt library by Trolltech AS, Norway (or with modified versions
+    of Qt that use the same license as Qt), and distribute linked
+    combinations including the two.  You must obey the GNU General
+    Public License in all respects for all of the code used other than
+    Qt.  If you modify this file, you may extend this exception to
+    your version of the file, but you are not obligated to do so.  If
+    you do not wish to do so, delete this exception statement from
+    your version.
+*/
+#include "cryptoconfig.h"
+#include "qgpgmenewcryptoconfig.h"
+
+using namespace QGpgME;
+
+QStringList CryptoConfigEntry::stringValueList() const
+{
+    const QGpgMENewCryptoConfigEntry *entry = dynamic_cast <const QGpgMENewCryptoConfigEntry*> (this);
+    if (!entry) {
+        return QStringList();
+    }
+    return entry->stringValueList();
+}
diff --git a/lang/qt/src/cryptoconfig.h b/lang/qt/src/cryptoconfig.h
index 452bfbb..c4de22d 100644
--- a/lang/qt/src/cryptoconfig.h
+++ b/lang/qt/src/cryptoconfig.h
@@ -248,6 +248,15 @@ public:
      * @return true if the value was changed
      */
     virtual bool isDirty() const = 0;
+
+    // Design change from here on we are closely bound to one implementation
+    // of cryptoconfig. To avoid ABI breaks with every new function we
+    // add real functions from now on.
+
+    /**
+     * @return a stringValueList.
+     */
+    QStringList stringValueList() const;
 };
 
 /**
diff --git a/lang/qt/src/qgpgmenewcryptoconfig.cpp b/lang/qt/src/qgpgmenewcryptoconfig.cpp
index 49b27ca..4738a03 100644
--- a/lang/qt/src/qgpgmenewcryptoconfig.cpp
+++ b/lang/qt/src/qgpgmenewcryptoconfig.cpp
@@ -546,6 +546,18 @@ std::vector<unsigned int> QGpgMENewCryptoConfigEntry::uintValueList() const
     return m_option.currentValue().uintValues();
 }
 
+QStringList QGpgMENewCryptoConfigEntry::stringValueList() const
+{
+    Q_ASSERT(isList());
+    const Argument arg = m_option.currentValue();
+    const std::vector<const char *> values = arg.stringValues();
+    QStringList ret;
+    for(const char *value: values) {
+        ret << QString::fromUtf8(value);
+    }
+    return ret;
+}
+
 QList<QUrl> QGpgMENewCryptoConfigEntry::urlValueList() const
 {
     const Type type = m_option.type();
diff --git a/lang/qt/src/qgpgmenewcryptoconfig.h b/lang/qt/src/qgpgmenewcryptoconfig.h
index 81b4cb4..7100e70 100644
--- a/lang/qt/src/qgpgmenewcryptoconfig.h
+++ b/lang/qt/src/qgpgmenewcryptoconfig.h
@@ -93,6 +93,8 @@ public:
     void setURLValueList(const QList<QUrl> &) Q_DECL_OVERRIDE;
     bool isDirty() const Q_DECL_OVERRIDE;
 
+    QStringList stringValueList() const;
+
 #if 0
     void setDirty(bool b);
     QString outputString() const;

-----------------------------------------------------------------------

Summary of changes:
 NEWS                                               |  1 +
 lang/qt/src/Makefile.am                            |  2 +-
 .../src/{abstractimportjob.h => cryptoconfig.cpp}  | 42 ++++++----------------
 lang/qt/src/cryptoconfig.h                         |  9 +++++
 lang/qt/src/qgpgmenewcryptoconfig.cpp              | 12 +++++++
 lang/qt/src/qgpgmenewcryptoconfig.h                |  2 ++
 6 files changed, 36 insertions(+), 32 deletions(-)
 copy lang/qt/src/{abstractimportjob.h => cryptoconfig.cpp} (68%)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 12 14:24:18 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 12 Jan 2017 14:24:18 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-30-g186dcd3
Message-ID: <E1cRfMa-0006SG-6s@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  186dcd3494eda7383de57a530fd15776410531a5 (commit)
       via  ea7bb62f5d981615847528b3ce53be9cc4d741a7 (commit)
      from  9640dc58e498966b482dcded6990cf4b47c556ac (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 186dcd3494eda7383de57a530fd15776410531a5
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jan 12 14:01:00 2017 +0100

    tests: Improve the gpgconf test.
    
    * tests/gpg/t-gpgconf.c: Include support functions.
    (fail_if_err): Remove macro.
    (init_gpgme): Remove function.
    (lookup): New function.
    (main): Update some values and verify that the changes are applied.
    * tests/gpg/t-support.h (test): New assert-like macro.
    
    GnuPG-bug-id: 2881
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpg/t-gpgconf.c b/tests/gpg/t-gpgconf.c
index 1074eef..d199d2e 100644
--- a/tests/gpg/t-gpgconf.c
+++ b/tests/gpg/t-gpgconf.c
@@ -34,37 +34,7 @@
 
 #include <gpgme.h>
 
-
-#define fail_if_err(err)					\
-  do								\
-    {								\
-      if (err)							\
-        {							\
-          fprintf (stderr, "%s:%d: %s: %s\n",			\
-                   __FILE__, __LINE__, gpgme_strsource (err),	\
-		   gpgme_strerror (err));			\
-          exit (1);						\
-        }							\
-    }								\
-  while (0)
-
-
-void
-init_gpgme (gpgme_protocol_t proto)
-{
-  gpgme_error_t err;
-
-  gpgme_check_version (NULL);
-  setlocale (LC_ALL, "");
-  gpgme_set_locale (NULL, LC_CTYPE, setlocale (LC_CTYPE, NULL));
-#ifndef HAVE_W32_SYSTEM
-  gpgme_set_locale (NULL, LC_MESSAGES, setlocale (LC_MESSAGES, NULL));
-#endif
-
-  err = gpgme_engine_check_version (proto);
-  fail_if_err (err);
-}
-
+#include "t-support.h"
 

 static char *
 spaces (char *str, int extra)
@@ -251,6 +221,34 @@ dump_comp (gpgme_conf_comp_t comp)
 
 
 int
+lookup (gpgme_conf_comp_t conf,
+	const char *component,
+	const char *option,
+	gpgme_conf_comp_t *comp,
+	gpgme_conf_opt_t *opt)
+{
+  *comp = conf;
+  while (*comp && strcmp ((*comp)->name, component))
+    *comp = (*comp)->next;
+
+  if (*comp)
+    {
+      *opt = (*comp)->options;
+      while (*opt && strcmp ((*opt)->name, option))
+	*opt = (*opt)->next;
+
+      /* Allow for the option not to be there.  */
+      if (*opt)
+	return 1;	/* Found.  */
+    }
+
+  return 0;		/* Not found.  */
+}
+
+#include <assert.h>
+
+
+int
 main (void)
 {
   gpgme_ctx_t ctx;
@@ -258,6 +256,7 @@ main (void)
   gpgme_conf_comp_t conf;
   gpgme_conf_comp_t comp;
   int first;
+  int i, N = 100;
 
   init_gpgme (GPGME_PROTOCOL_GPGCONF);
 
@@ -279,40 +278,89 @@ main (void)
       comp = comp->next;
     }
 
-#if 1
   /* Now change something.  */
-  {
-    unsigned int count = 1;
+  fprintf (stderr, " dirmngr.verbose ");
+  for (i = 0; i < N; i++) {
+    unsigned int count = i % 4 + 1; /* counts must not be zero */
     gpgme_conf_arg_t arg;
     gpgme_conf_opt_t opt;
 
     err = gpgme_conf_arg_new (&arg, GPGME_CONF_NONE, &count);
     fail_if_err (err);
 
-    comp = conf;
-    while (comp && strcmp (comp->name, "dirmngr"))
-      comp = comp->next;
+    if (lookup (conf, "dirmngr", "verbose", &comp, &opt))
+      {
+	/* Found.  */
+	err = gpgme_conf_opt_change (opt, 0, arg);
+	fail_if_err (err);
 
-    if (comp)
+	err = gpgme_op_conf_save (ctx, comp);
+	fail_if_err (err);
+      }
+    else
       {
-	opt = comp->options;
-	while (opt && strcmp (opt->name, "verbose"))
-	  opt = opt->next;
-
-	/* Allow for the verbose option not to be there.  */
-	if (opt)
-	  {
-	    err = gpgme_conf_opt_change (opt, 0, arg);
-	    fail_if_err (err);
-
-	    err = gpgme_op_conf_save (ctx, comp);
-	    fail_if_err (err);
-	  }
+	fprintf (stderr, "Skipping test, option dirmngr.verbose not found.\n");
+	break;
       }
+
+    /* Reload config and verify that the value was updated.  */
+    gpgme_conf_release (conf);
+    err = gpgme_op_conf_load (ctx, &conf);
+    fail_if_err (err);
+    if (lookup (conf, "dirmngr", "verbose", &comp, &opt))
+      {
+	/* Found.  */
+	test (opt->alt_type == GPGME_CONF_NONE);
+	test ((unsigned long) opt->value->value.count == count);
+      }
+
+    fprintf (stderr, ".");
+    fflush (stderr);
   }
-#endif
 
-  gpgme_conf_release (conf);
+  /* Now change something else.  */
+  fprintf (stderr, " gpg.keyserver ");
+  for (i = 0; i < N; i++) {
+    const char *values[2] = { "hkp://foo.bar", "hkps://bar.foo" };
+    gpgme_conf_arg_t arg;
+    gpgme_conf_opt_t opt;
 
+    err = gpgme_conf_arg_new (&arg, GPGME_CONF_STRING, values[i%2]);
+    fail_if_err (err);
+
+    if (lookup (conf, "gpg", "keyserver", &comp, &opt))
+      {
+	/* Found.  */
+	test (opt->alt_type == GPGME_CONF_STRING);
+	err = gpgme_conf_opt_change (opt, 0, arg);
+	fail_if_err (err);
+
+	err = gpgme_op_conf_save (ctx, comp);
+	fail_if_err (err);
+      }
+    else
+      {
+	fprintf (stderr, "Skipping test, option gpg.keyserver not found.\n");
+	break;
+      }
+
+    /* Reload config and verify that the value was updated.  */
+    gpgme_conf_release (conf);
+    err = gpgme_op_conf_load (ctx, &conf);
+    fail_if_err (err);
+    if (lookup (conf, "gpg", "keyserver", &comp, &opt))
+      {
+	/* Found.  */
+	test (opt->alt_type == GPGME_CONF_STRING);
+	test (strcmp (opt->value->value.string, values[i%2]) == 0);
+      }
+
+    fprintf (stderr, ".");
+    fflush (stderr);
+  }
+  fprintf (stderr, "\n");
+
+  gpgme_conf_release (conf);
+  gpgme_release (ctx);
   return 0;
 }
diff --git a/tests/gpg/t-support.h b/tests/gpg/t-support.h
index db69dd0..f6dec68 100644
--- a/tests/gpg/t-support.h
+++ b/tests/gpg/t-support.h
@@ -48,6 +48,34 @@
   while (0)
 
 
+#ifdef GPGRT_HAVE_MACRO_FUNCTION
+void GPGRT_ATTR_NORETURN
+_test (const char *expr, const char *file, int line,
+       const char *func)
+{
+  fprintf (stderr, "Test \"%s\" in %s failed (%s:%d)\n",
+           expr, func, file, line);
+  exit (1);
+}
+# define test(expr)                                             \
+  ((expr)                                                       \
+   ? (void) 0                                                   \
+   : _test (#expr, __FILE__, __LINE__, __FUNCTION__))
+#else /*!GPGRT_HAVE_MACRO_FUNCTION*/
+void
+_test (const char *expr, const char *file, int line)
+{
+  fprintf (stderr, "Test \"%s\" failed (%s:%d)\n",
+           expr, file, line);
+  exit (1);
+}
+# define test(expr)                                             \
+  ((expr)                                                       \
+   ? (void) 0                                                   \
+   : _test (#expr, __FILE__, __LINE__))
+#endif /*!GPGRT_HAVE_MACRO_FUNCTION*/
+
+
 static const char *
 nonnull (const char *s)
 {

commit ea7bb62f5d981615847528b3ce53be9cc4d741a7
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 9 13:09:39 2017 +0100

    tests: Enable gpgconf test.
    
    --
    Fixes: 02ba35c1b6a2cbb3361b2f2ad507c53564b2be0b
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpg/t-gpgconf.c b/tests/gpg/t-gpgconf.c
index 55033bf..1074eef 100644
--- a/tests/gpg/t-gpgconf.c
+++ b/tests/gpg/t-gpgconf.c
@@ -259,10 +259,6 @@ main (void)
   gpgme_conf_comp_t comp;
   int first;
 
-#ifndef ENABLE_GPGCONF
-  return 0;
-#endif
-
   init_gpgme (GPGME_PROTOCOL_GPGCONF);
 
   err = gpgme_new (&ctx);

-----------------------------------------------------------------------

Summary of changes:
 tests/gpg/t-gpgconf.c | 158 ++++++++++++++++++++++++++++++++------------------
 tests/gpg/t-support.h |  28 +++++++++
 2 files changed, 129 insertions(+), 57 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 13 06:24:53 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 13 Jan 2017 06:24:53 +0100
Subject: [git] Pinentry - branch, master, updated. pinentry-1.0.0-6-gc725fdd
Message-ID: <E1cRuMA-0006Gs-W8@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The standard pinentry collection".

The branch, master has been updated
       via  c725fdd260b0c2291660ff954e6b2250006ec08f (commit)
      from  1acb06aac3dd08f573d7c2e3be75226346e61ed2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c725fdd260b0c2291660ff954e6b2250006ec08f
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 13 14:22:33 2017 +0900

    gnome3: Fix CONFIRM condition.
    
    * gnome3/pinentry-gnome3.c (gnome3_cmd_handler): No buffer for PIN means
    it's not passphrase input but confirmation dialog.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/gnome3/pinentry-gnome3.c b/gnome3/pinentry-gnome3.c
index d5a49d6..29cd997 100644
--- a/gnome3/pinentry-gnome3.c
+++ b/gnome3/pinentry-gnome3.c
@@ -247,7 +247,7 @@ gnome3_cmd_handler (pinentry_t pe)
   state.ret = 0;
   state.timeout_id = 0;
   state.timed_out = 0;
-  state.prompt = create_prompt (pe, !!(pe->pin));
+  state.prompt = create_prompt (pe, !(pe->pin));
   if (!state.prompt)
     {
       pe->canceled = 1;

-----------------------------------------------------------------------

Summary of changes:
 gnome3/pinentry-gnome3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The standard pinentry collection
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 13 12:36:23 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Fri, 13 Jan 2017 12:36:23 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-246-g0af871c
Message-ID: <E1cS09h-0006Yh-9j@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  0af871c4f9969b6f2324fc26c3ceae8702b16151 (commit)
       via  fde0567164d55520d726a001a179d8350da7acce (commit)
      from  54c973fd2e45ee71664a89c500b00d5088107081 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0af871c4f9969b6f2324fc26c3ceae8702b16151
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Jan 13 12:35:25 2017 +0100

    Do not release the central application obj
    
    * src/oomhelp.cpp (get_active_hwnd): Do not release central
    application Object.
    
    --
    This was a 0x8000FFFF

diff --git a/src/oomhelp.cpp b/src/oomhelp.cpp
index dba6cae..85d1c46 100644
--- a/src/oomhelp.cpp
+++ b/src/oomhelp.cpp
@@ -1680,8 +1680,6 @@ get_active_hwnd ()
     }
 
   LPDISPATCH activeWindow = get_oom_object (app, "ActiveWindow");
-  gpgol_release (app);
-
   if (!activeWindow)
     {
       TRACEPOINT;

commit fde0567164d55520d726a001a179d8350da7acce
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Jan 13 12:34:30 2017 +0100

    Handle QueryInterface errors
    
    * src/oomhelp.cpp (get_oom_object): Handle QueryInterface errors.
    
    --
    Not a problem in practice but noticed that an error there is
    unhandled while debugging another problem.

diff --git a/src/oomhelp.cpp b/src/oomhelp.cpp
index 87665d2..dba6cae 100644
--- a/src/oomhelp.cpp
+++ b/src/oomhelp.cpp
@@ -188,7 +188,13 @@ get_oom_object (LPDISPATCH pStart, const char *fullname)
           gpgol_release (pDisp);
           pDisp = NULL;
         }
-      pObj->QueryInterface (IID_IDispatch, (LPVOID*)&pDisp);
+      if (pObj->QueryInterface (IID_IDispatch, (LPVOID*)&pDisp) != S_OK)
+        {
+          log_error ("%s:%s Object does not support IDispatch",
+                     SRCNAME, __func__);
+          gpgol_release (pObj);
+          return NULL;
+        }
       if (pObj != pStart)
         gpgol_release (pObj);
       pObj = NULL;

-----------------------------------------------------------------------

Summary of changes:
 src/oomhelp.cpp | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 13 17:24:42 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Fri, 13 Jan 2017 17:24:42 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-251-ge200928
Message-ID: <E1cS4ei-0002ZR-8v@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  e20092844ccc46b4074d01d235f4a55788002d35 (commit)
       via  52716f463c859f1197dc413f56c187771bf05b14 (commit)
       via  0fde2c349d6e914b3fec96fa61ec9ec607f67f31 (commit)
       via  573f6407bc050495f3b75ecb3e5c78e7e732bc35 (commit)
      from  0ce0b67505ca0a7bd1338244c7133680d6a00e69 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e20092844ccc46b4074d01d235f4a55788002d35
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Jan 13 17:23:38 2017 +0100

    Improve decryption failed errors
    
    * src/parsecontroller.cpp (format_recipients): Add names to
    known recipients and add the GPGME Error.
    
    --
    This would be much nicer if gnupg would return decent errors
    e.g. if a user canceled the pinentry. Now we mostly have
    "Decryption Failed: Decryption Failed" Super!

diff --git a/src/parsecontroller.cpp b/src/parsecontroller.cpp
index 60e03a7..3342371 100644
--- a/src/parsecontroller.cpp
+++ b/src/parsecontroller.cpp
@@ -140,12 +140,25 @@ is_smime (Data &data)
 }
 
 static std::string
-format_recipients(GpgME::DecryptionResult result)
+format_recipients(GpgME::DecryptionResult result, Protocol protocol)
 {
   std::string msg;
   for (const auto recipient: result.recipients())
     {
-      msg += std::string("<br/>0x") + recipient.keyID() + "</a>";
+      auto ctx = Context::createForProtocol(protocol);
+      Error e;
+      if (!ctx) {
+          /* Can't happen */
+          TRACEPOINT;
+          continue;
+      }
+      const auto key = ctx->key(recipient.keyID(), e, false);
+      delete ctx;
+      if (!key.isNull() && key.numUserIDs() && !e) {
+        msg += std::string("<br/>") + key.userIDs()[0].id() + " (0x" + recipient.keyID() + ")";
+        continue;
+      }
+      msg += std::string("<br/>") + _("Unknown Key:") + " 0x" + recipient.keyID();
     }
   return msg;
 }
@@ -174,12 +187,13 @@ format_error(GpgME::DecryptionResult result, Protocol protocol)
   if (no_sec)
     {
       msg = _("No secret key found to decrypt the message. "
-              "It is encrypted for following keys:");
-      msg += format_recipients (result);
+              "It is encrypted to the following keys:");
+      msg += format_recipients (result, protocol);
     }
   else
     {
-      msg = _("Could not decrypt the data.");
+      msg = _("Could not decrypt the data: ");
+      msg += result.error().asString();
     }
 
   if (gpgrt_asprintf (&buf, opt.prefer_html ? decrypt_template_html :

commit 52716f463c859f1197dc413f56c187771bf05b14
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Jan 13 17:22:25 2017 +0100

    Disable explorer sigstatus icon if preview off
    
    * src/ribbon-callbacks.cpp (get_mail_from_control): Don't show
    wrong sigstatus when preview pane is disabled.

diff --git a/src/ribbon-callbacks.cpp b/src/ribbon-callbacks.cpp
index 34a964d..0a5ab5a 100644
--- a/src/ribbon-callbacks.cpp
+++ b/src/ribbon-callbacks.cpp
@@ -1462,6 +1462,32 @@ get_mail_from_control (LPDISPATCH ctrl, bool *none_selected)
         {
           *none_selected = true;
         }
+      else
+        {
+          // Avoid showing wrong crypto state if we don't have a reading
+          // pane. In that case the parser will finish for a mail which is gone
+          // and the crypto state will not get updated.
+          LPDISPATCH tableView = get_oom_object (context, "CurrentView");
+          if (!tableView)
+            {
+              // Woops, should not happen.
+              TRACEPOINT;
+              *none_selected = true;
+              gpgol_release (mailitem);
+              mailitem = nullptr;
+            }
+          else
+            {
+              int hasReadingPane = get_oom_bool (tableView, "ShowReadingPane");
+              gpgol_release (tableView);
+              if (!hasReadingPane)
+                {
+                  *none_selected = true;
+                  gpgol_release (mailitem);
+                  mailitem = nullptr;
+                }
+            }
+        }
     }
 
   gpgol_release (context);

commit 0fde2c349d6e914b3fec96fa61ec9ec607f67f31
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Jan 13 17:01:04 2017 +0100

    Only invalidate UI when mail is not crypto mail
    
    * src/application-events.cpp (EVENT_SINK_INVOKE): Don't
    invalidate on every load.
    * src/mailitem-events.cpp (EVENT_SINK_INVOKE): Invalidate on
    Read.
    
    --
    For crypto mails the invalidation will be done after the
    mail has been processed. This further reduces uneccesary invalidations.

diff --git a/src/application-events.cpp b/src/application-events.cpp
index 8f089d4..7835733 100644
--- a/src/application-events.cpp
+++ b/src/application-events.cpp
@@ -90,8 +90,6 @@ EVENT_SINK_INVOKE(ApplicationEvents)
           log_debug ("%s:%s: Creating mail object for item: %p",
                      SRCNAME, __func__, mailItem);
           new Mail (mailItem);
-          /* Ensure that all UI's are nicely updated for the new mail */
-          gpgoladdin_invalidate_ui ();
           break;
         }
       case Quit:
diff --git a/src/mailitem-events.cpp b/src/mailitem-events.cpp
index b6ad311..1ec0ec3 100644
--- a/src/mailitem-events.cpp
+++ b/src/mailitem-events.cpp
@@ -27,6 +27,7 @@
 #include "windowmessages.h"
 #include "mail.h"
 #include "mapihelp.h"
+#include "gpgoladdin.h"
 
 #undef _
 #define _(a) utf8_gettext (a)
@@ -193,7 +194,8 @@ EVENT_SINK_INVOKE(MailItemEvents)
                          SRCNAME, __func__, m_mail);
           if (!m_mail->is_crypto_mail())
             {
-              /* Not for us. */
+              /* Ensure that no wrong sigstatus is shown */
+              gpgoladdin_invalidate_ui ();
               break;
             }
           if (m_mail->set_uuid ())

commit 573f6407bc050495f3b75ecb3e5c78e7e732bc35
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Jan 13 17:00:10 2017 +0100

    Reduce UI invalidations
    
    * src/explorer-events.cpp (EVENT_SINK_INVOKE): Only invalidate
    if the current explorer has a reading pane.

diff --git a/src/explorer-events.cpp b/src/explorer-events.cpp
index 4b8a7ab..4f14ef4 100644
--- a/src/explorer-events.cpp
+++ b/src/explorer-events.cpp
@@ -81,6 +81,18 @@ EVENT_SINK_INVOKE(ExplorerEvents)
         {
           log_oom_extra ("%s:%s: Selection change in explorer: %p",
                          SRCNAME, __func__, this);
+          LPDISPATCH tableView = get_oom_object (m_object, "CurrentView");
+          if (!tableView)
+            {
+              TRACEPOINT;
+              break;
+            }
+          int hasReadingPane = get_oom_bool (tableView, "ShowReadingPane");
+          gpgol_release (tableView);
+          if (!hasReadingPane)
+            {
+              break;
+            }
           HANDLE thread = CreateThread (NULL, 0, invalidate_ui, (LPVOID) this, 0,
                                         NULL);
 

-----------------------------------------------------------------------

Summary of changes:
 src/application-events.cpp |  2 --
 src/explorer-events.cpp    | 12 ++++++++++++
 src/mailitem-events.cpp    |  4 +++-
 src/parsecontroller.cpp    | 24 +++++++++++++++++++-----
 src/ribbon-callbacks.cpp   | 26 ++++++++++++++++++++++++++
 5 files changed, 60 insertions(+), 8 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 16 02:36:07 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Mon, 16 Jan 2017 02:36:07 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-72-g0801f49
Message-ID: <E1cSwDT-00079v-3Y@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  0801f49b0dc7102943f0e9fa51061f50f5708ca6 (commit)
       via  2e6f1c99d4f66a23a752092397e20a84964edf48 (commit)
      from  3db76c9277d918dec9721a6439f4db3b3c06aba3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0801f49b0dc7102943f0e9fa51061f50f5708ca6
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jan 16 10:33:08 2017 +0900

    agent: Ask specific SERIALNO for pksign/pkdecrypt.
    
    * agent/call-scd.c (agent_card_serialno): Add DEMAND argument.
    * agent/command-ssh.c (card_key_available): Follow the change.
    * agent/learncard.c (agent_handle_learn): Likewise.
    * agent/divert-scd.c (ask_for_card): Use DEMAND argument.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/agent/agent.h b/agent/agent.h
index 89dc46d..2db5a5c 100644
--- a/agent/agent.h
+++ b/agent/agent.h
@@ -532,7 +532,7 @@ int agent_card_learn (ctrl_t ctrl,
                       void (*sinfo_cb)(void*, const char *,
                                        size_t, const char *),
                       void *sinfo_cb_arg);
-int agent_card_serialno (ctrl_t ctrl, char **r_serialno);
+int agent_card_serialno (ctrl_t ctrl, char **r_serialno, const char *demand);
 int agent_card_pksign (ctrl_t ctrl,
                        const char *keyid,
                        int (*getpin_cb)(void *, const char *, char*, size_t),
diff --git a/agent/call-scd.c b/agent/call-scd.c
index ba59c18..15a2ba5 100644
--- a/agent/call-scd.c
+++ b/agent/call-scd.c
@@ -679,16 +679,22 @@ get_serialno_cb (void *opaque, const char *line)
 /* Return the serial number of the card or an appropriate error.  The
    serial number is returned as a hexstring. */
 int
-agent_card_serialno (ctrl_t ctrl, char **r_serialno)
+agent_card_serialno (ctrl_t ctrl, char **r_serialno, const char *demand)
 {
   int rc;
   char *serialno = NULL;
+  char line[ASSUAN_LINELENGTH];
 
   rc = start_scd (ctrl);
   if (rc)
     return rc;
 
-  rc = assuan_transact (ctrl->scd_local->ctx, "SERIALNO",
+  if (!demand)
+    strcpy (line, "SERIALNO");
+  else
+    snprintf (line, DIM(line), "SERIALNO --demand=%s", demand);
+
+  rc = assuan_transact (ctrl->scd_local->ctx, line,
                         NULL, NULL, NULL, NULL,
                         get_serialno_cb, &serialno);
   if (rc)
diff --git a/agent/command-ssh.c b/agent/command-ssh.c
index 95cef41..79cb057 100644
--- a/agent/command-ssh.c
+++ b/agent/command-ssh.c
@@ -2408,7 +2408,7 @@ card_key_available (ctrl_t ctrl, gcry_sexp_t *r_pk, char **cardsn)
   if ( gpg_err_code (err) == GPG_ERR_CARD_REMOVED )
     {
       /* Ask for the serial number to reset the card.  */
-      err = agent_card_serialno (ctrl, &serialno);
+      err = agent_card_serialno (ctrl, &serialno, NULL);
       if (err)
         {
           if (opt.verbose)
diff --git a/agent/divert-scd.c b/agent/divert-scd.c
index 7b07008..7331f58 100644
--- a/agent/divert-scd.c
+++ b/agent/divert-scd.c
@@ -58,7 +58,7 @@ ask_for_card (ctrl_t ctrl, const unsigned char *shadow_info, char **r_kid)
 
   for (;;)
     {
-      rc = agent_card_serialno (ctrl, &serialno);
+      rc = agent_card_serialno (ctrl, &serialno, want_sn);
       if (!rc)
         {
           log_debug ("detected card with S/N %s\n", serialno);
@@ -72,11 +72,17 @@ ask_for_card (ctrl_t ctrl, const unsigned char *shadow_info, char **r_kid)
               return 0; /* yes, we have the correct card */
             }
         }
+      else if (gpg_err_code (rc) == GPG_ERR_ENODEV)
+        {
+          log_debug ("no device present\n");
+          rc = 0;
+          no_card = 1;
+        }
       else if (gpg_err_code (rc) == GPG_ERR_CARD_NOT_PRESENT)
         {
           log_debug ("no card present\n");
           rc = 0;
-          no_card = 1;
+          no_card = 2;
         }
       else
         {
diff --git a/agent/learncard.c b/agent/learncard.c
index 57bce7a..cce9c3a 100644
--- a/agent/learncard.c
+++ b/agent/learncard.c
@@ -330,7 +330,7 @@ agent_handle_learn (ctrl_t ctrl, int send, void *assuan_context, int force)
   cparm.ctrl = ctrl;
 
   /* Check whether a card is present and get the serial number */
-  rc = agent_card_serialno (ctrl, &serialno);
+  rc = agent_card_serialno (ctrl, &serialno, NULL);
   if (rc)
     goto leave;
 

commit 2e6f1c99d4f66a23a752092397e20a84964edf48
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jan 16 10:26:16 2017 +0900

    scd: Add --demand option for SERIALNO.
    
    * scd/app.c (select_application): Add SERIALNO_BIN and SERIALNO_BIN_LEN
    arguments.  Return matched APP with a serial number when specified.
    * scd/command.c (open_card): Modify for the implicit open only.
    (open_card_with_request): New for explicit open and support match with a
    serial number.
    (cmd_serialno): Support --demand option.
    (cmd_learn, cmd_readcert, cmd_readkey, cmd_pksign, cmd_pkauth)
    (cmd_pkdecrypt, cmd_getattr, cmd_setattr, cmd_writecert, cmd_writekey)
    (cmd_genkey, cmd_random, cmd_passwd, cmd_checkpin, cmd_apdu): Follow
    the change of open_card.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app-common.h b/scd/app-common.h
index 2371818..fb0fe55 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -129,7 +129,8 @@ void application_notify_card_reset (int slot);
 gpg_error_t check_application_conflict (const char *name, app_t app);
 gpg_error_t app_reset (app_t app, ctrl_t ctrl, int send_reset);
 gpg_error_t select_application (ctrl_t ctrl, const char *name, app_t *r_app,
-                                int scan);
+                                int scan, const unsigned char *serialno_bin,
+                                size_t serialno_bin_len);
 char *get_supported_applications (void);
 void release_application (app_t app);
 gpg_error_t app_munge_serialno (app_t app);
diff --git a/scd/app.c b/scd/app.c
index 6db9e27..06850d8 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -317,10 +317,12 @@ app_new_register (int slot, ctrl_t ctrl, const char *name)
    and return a context.  Returns an error code and stores NULL at
    R_APP if no application was found or no card is present. */
 gpg_error_t
-select_application (ctrl_t ctrl, const char *name, app_t *r_app, int scan)
+select_application (ctrl_t ctrl, const char *name, app_t *r_app,
+                    int scan, const unsigned char *serialno_bin,
+                    size_t serialno_bin_len)
 {
   gpg_error_t err = 0;
-  app_t app;
+  app_t a;
 
   *r_app = NULL;
 
@@ -352,33 +354,50 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app, int scan)
 
           if (!sw || sw == SW_HOST_ALREADY_CONNECTED)
             err = 0;
+          else if (sw == SW_HOST_NO_CARD)
+            err = gpg_error (GPG_ERR_CARD_NOT_PRESENT);
           else
             err = gpg_error (GPG_ERR_ENODEV);
 
           if (!err)
             err = app_new_register (slot, ctrl, name);
           else
-            apdu_close_reader (slot);
+            {
+              /* We close a reader with no card.  */
+              apdu_close_reader (slot);
+            }
         }
 
       apdu_dev_list_finish (l);
     }
 
-  app = app_top;
-  if (app)
+  npth_mutex_lock (&app_list_lock);
+  for (a = app_top; a; a = a->next)
     {
-      lock_app (app, ctrl);
-      err = check_conflict (app, name);
+      lock_app (a, ctrl);
+      if (serialno_bin == NULL)
+        break;
+      if (a->serialnolen == serialno_bin_len
+          && !memcmp (a->serialno, serialno_bin, a->serialnolen))
+        break;
+      unlock_app (a);
+    }
+
+  if (a)
+    {
+      err = check_conflict (a, name);
       if (!err)
         {
-          app->ref_count++;
-          *r_app = app;
+          a->ref_count++;
+          *r_app = a;
         }
-      unlock_app (app);
+      unlock_app (a);
     }
   else
     err = gpg_error (GPG_ERR_ENODEV);
 
+  npth_mutex_unlock (&app_list_lock);
+
   return err;
 }
 
diff --git a/scd/command.c b/scd/command.c
index ce2be34..dc854e3 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -193,10 +193,8 @@ option_handler (assuan_context_t ctx, const char *key, const char *value)
 
 /* If the card has not yet been opened, do it.  */
 static gpg_error_t
-open_card (ctrl_t ctrl, const char *apptype, int scan)
+open_card (ctrl_t ctrl)
 {
-  gpg_error_t err;
-
   /* If we ever got a card not present error code, return that.  Only
      the SERIALNO command and a reset are able to clear from that
      state. */
@@ -206,24 +204,46 @@ open_card (ctrl_t ctrl, const char *apptype, int scan)
   if ( IS_LOCKED (ctrl) )
     return gpg_error (GPG_ERR_LOCKED);
 
+  if (ctrl->app_ctx)
+    return 0;
+
+  return select_application (ctrl, NULL, &ctrl->app_ctx, 0, NULL, 0);
+}
+
+/* Explicitly open a card for a specific use of APPTYPE or SERIALNO.  */
+static gpg_error_t
+open_card_with_request (ctrl_t ctrl, const char *apptype, const char *serialno)
+{
+  gpg_error_t err;
+  unsigned char *serialno_bin = NULL;
+  size_t serialno_bin_len = 0;
+
   /* If we are already initialized for one specific application we
      need to check that the client didn't requested a specific
      application different from the one in use before we continue. */
-  if (!scan && ctrl->app_ctx)
+  if (apptype && ctrl->app_ctx)
     return check_application_conflict (apptype, ctrl->app_ctx);
 
-  err = select_application (ctrl, apptype, &ctrl->app_ctx, scan);
+  if (serialno)
+    serialno_bin = hex_to_buffer (serialno, &serialno_bin_len);
+
+  err = select_application (ctrl, apptype, &ctrl->app_ctx, 1,
+                            serialno_bin, serialno_bin_len);
+  xfree (serialno_bin);
 
   return err;
 }
 
 
 static const char hlp_serialno[] =
-  "SERIALNO [<apptype>]\n"
+  "SERIALNO [--demand=<serialno>] [<apptype>]\n"
   "\n"
   "Return the serial number of the card using a status response.  This\n"
   "function should be used to check for the presence of a card.\n"
   "\n"
+  "If --demand is given, an application on the card with SERIALNO is\n"
+  "selected and an error is returned if no such card available.\n"
+  "\n"
   "If APPTYPE is given, an application of that type is selected and an\n"
   "error is returned if the application is not supported or available.\n"
   "The default is to auto-select the application using a hardwired\n"
@@ -245,17 +265,29 @@ cmd_serialno (assuan_context_t ctx, char *line)
   int rc = 0;
   char *serial;
   time_t stamp;
+  const char *demand;
 
-  /* Clear the remove flag so that the open_card is able to reread it.  */
-  if (ctrl->server_local->card_removed)
-    {
-      if ( IS_LOCKED (ctrl) )
-        return gpg_error (GPG_ERR_LOCKED);
+  if ( IS_LOCKED (ctrl) )
+    return gpg_error (GPG_ERR_LOCKED);
 
-      ctrl->server_local->card_removed = 0;
+  if ((demand = has_option_name (line, "--demand")))
+    {
+      if (*demand != '=')
+        return set_error (GPG_ERR_ASS_PARAMETER, "missing value for option");
+      line = (char *)++demand;
+      for (; *line && !spacep (line); line++)
+        ;
+      if (*line)
+        *line++ = 0;
     }
+  else
+    demand = NULL;
+
+  /* Clear the remove flag so that the open_card is able to reread it.  */
+  if (ctrl->server_local->card_removed)
+    ctrl->server_local->card_removed = 0;
 
-  if ((rc = open_card (ctrl, *line? line:NULL, 1)))
+  if ((rc = open_card_with_request (ctrl, *line? line:NULL, demand)))
     {
       ctrl->server_local->card_removed = 1;
       return rc;
@@ -357,7 +389,7 @@ cmd_learn (assuan_context_t ctx, char *line)
   int rc = 0;
   int only_keypairinfo = has_option (line, "--keypairinfo");
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   /* Unless the force option is used we try a shortcut by identifying
@@ -440,7 +472,7 @@ cmd_readcert (assuan_context_t ctx, char *line)
   unsigned char *cert;
   size_t ncert;
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   line = xstrdup (line); /* Need a copy of the line. */
@@ -482,7 +514,7 @@ cmd_readkey (assuan_context_t ctx, char *line)
   unsigned char *pk;
   size_t pklen;
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   if (has_option (line, "--advanced"))
@@ -704,7 +736,7 @@ cmd_pksign (assuan_context_t ctx, char *line)
 
   line = skip_options (line);
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   /* We have to use a copy of the key ID because the function may use
@@ -748,7 +780,7 @@ cmd_pkauth (assuan_context_t ctx, char *line)
   size_t outdatalen;
   char *keyidstr;
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -793,7 +825,7 @@ cmd_pkdecrypt (assuan_context_t ctx, char *line)
   char *keyidstr;
   unsigned int infoflags;
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   keyidstr = xtrystrdup (line);
@@ -846,7 +878,7 @@ cmd_getattr (assuan_context_t ctx, char *line)
   int rc;
   const char *keyword;
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   keyword = line;
@@ -888,7 +920,7 @@ cmd_setattr (assuan_context_t ctx, char *orig_line)
   size_t nbytes;
   char *line, *linebuf;
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   /* We need to use a copy of LINE, because PIN_CB uses the same
@@ -943,7 +975,7 @@ cmd_writecert (assuan_context_t ctx, char *line)
     line++;
   *line = 0;
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1005,7 +1037,7 @@ cmd_writekey (assuan_context_t ctx, char *line)
     line++;
   *line = 0;
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1092,7 +1124,7 @@ cmd_genkey (assuan_context_t ctx, char *line)
     line++;
   *line = 0;
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1130,7 +1162,7 @@ cmd_random (assuan_context_t ctx, char *line)
                       "number of requested bytes missing");
   nbytes = strtoul (line, NULL, 0);
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1183,7 +1215,7 @@ cmd_passwd (assuan_context_t ctx, char *line)
     line++;
   *line = 0;
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1240,7 +1272,7 @@ cmd_checkpin (assuan_context_t ctx, char *line)
   int rc;
   char *idstr;
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   if (!ctrl->app_ctx)
@@ -1531,7 +1563,7 @@ cmd_apdu (assuan_context_t ctx, char *line)
 
   line = skip_options (line);
 
-  if ((rc = open_card (ctrl, NULL, 0)))
+  if ((rc = open_card (ctrl)))
     return rc;
 
   app = ctrl->app_ctx;

-----------------------------------------------------------------------

Summary of changes:
 agent/agent.h       |  2 +-
 agent/call-scd.c    | 10 ++++--
 agent/command-ssh.c |  2 +-
 agent/divert-scd.c  | 10 ++++--
 agent/learncard.c   |  2 +-
 scd/app-common.h    |  3 +-
 scd/app.c           | 39 ++++++++++++++++++------
 scd/command.c       | 88 ++++++++++++++++++++++++++++++++++++-----------------
 8 files changed, 110 insertions(+), 46 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 16 12:56:14 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 16 Jan 2017 12:56:14 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-31-g0e24227
Message-ID: <E1cT5tZ-0007UA-Fv@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  0e242278dfaa64ce31a45b72f5fa0806a3dba898 (commit)
      from  186dcd3494eda7383de57a530fd15776410531a5 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0e242278dfaa64ce31a45b72f5fa0806a3dba898
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jan 12 14:05:15 2017 +0100

    Fix changing options with gpgconf.
    
    * src/engine-gpgconf.c (gpgconf_write): Connect a pipe to the child's
    stderr, and wait for it to be closed as an indication that gpgconf has
    exited.  Also improve error handling.
    
    GnuPG-bug-id: 2881
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/src/engine-gpgconf.c b/src/engine-gpgconf.c
index 01a60eb..3e46310 100644
--- a/src/engine-gpgconf.c
+++ b/src/engine-gpgconf.c
@@ -710,8 +710,11 @@ gpgconf_write (void *engine, const char *arg1, char *arg2, gpgme_data_t conf)
   int buflen = 0;
   char *argv[7];
   int argc = 0;
-  int rp[2];
-  struct spawn_fd_item_s cfd[] = { {-1, 0 /* STDIN_FILENO */}, {-1, -1} };
+  int rp[2] = { -1, -1 };
+  int errp[2] = { -1, -1 };
+  struct spawn_fd_item_s cfd[] = { {-1, 0 /* STDIN_FILENO */},
+                                   {-1, 2 /* STDERR_FILENO */, -1},
+                                   {-1, -1} };
   int status;
   int nwrite;
 
@@ -731,19 +734,31 @@ gpgconf_write (void *engine, const char *arg1, char *arg2, gpgme_data_t conf)
   assert (argc < DIM (argv));
 
   if (_gpgme_io_pipe (rp, 0) < 0)
-    return gpg_error_from_syserror ();
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
+
+  if (_gpgme_io_pipe (errp, 1) < 0)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
 
   cfd[0].fd = rp[0];
+  cfd[1].fd = errp[1];
 
   status = _gpgme_io_spawn (gpgconf->file_name, argv,
                             IOSPAWN_FLAG_DETACHED, cfd, NULL, NULL, NULL);
   if (status < 0)
     {
-      _gpgme_io_close (rp[0]);
-      _gpgme_io_close (rp[1]);
-      return gpg_error_from_syserror ();
+      err = gpg_error_from_syserror ();
+      goto leave;
     }
 
+  rp[0] = -1;
+  errp[1] = -1;
+
   for (;;)
     {
       if (buflen == 0)
@@ -757,14 +772,29 @@ gpgconf_write (void *engine, const char *arg1, char *arg2, gpgme_data_t conf)
 	  if (buflen < 0)
 	    {
 	      err = gpg_error_from_syserror ();
-	      _gpgme_io_close (rp[1]);
-	      return err;
+              goto leave;
 	    }
 	  else if (buflen == 0)
 	    {
 	      /* All is written.  */
 	      _gpgme_io_close (rp[1]);
-	      return 0;
+              rp[1] = -1;
+
+              for (;;)
+                {
+                  do
+                    {
+                      buflen = _gpgme_io_read (errp[0], buf, BUFLEN);
+                    }
+                  while (buflen < 0 && errno == EAGAIN);
+
+                  if (buflen == 0)
+                    {
+                      err = 0;
+                      goto leave;
+                    }
+                  /* XXX: Do something useful with BUF.  */
+                }
 	    }
 	}
 
@@ -782,12 +812,24 @@ gpgconf_write (void *engine, const char *arg1, char *arg2, gpgme_data_t conf)
 	}
       else if (nwrite < 0)
 	{
-	  _gpgme_io_close (rp[1]);
-	  return gpg_error_from_syserror ();
+	  err = gpg_error_from_syserror ();
+          goto leave;
 	}
     }
 
-  return 0;
+  assert (! "reached");
+
+ leave:
+  if (rp[0] != -1)
+    _gpgme_io_close (rp[0]);
+  if (rp[1] != -1)
+  _gpgme_io_close (rp[1]);
+  if (errp[0] != -1)
+    _gpgme_io_close (errp[0]);
+  if (errp[1] != -1)
+  _gpgme_io_close (errp[1]);
+
+  return err;
 }
 
 

-----------------------------------------------------------------------

Summary of changes:
 src/engine-gpgconf.c | 66 ++++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 54 insertions(+), 12 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 16 13:22:20 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 16 Jan 2017 13:22:20 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-32-g92543da
Message-ID: <E1cT6Io-0000Ds-DY@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  92543da94cbf8e807b1b33070d273f995cdd5c62 (commit)
      from  0e242278dfaa64ce31a45b72f5fa0806a3dba898 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 92543da94cbf8e807b1b33070d273f995cdd5c62
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 16 13:21:02 2017 +0100

    tests: Fix distcheck.
    
    * tests/gpg/Makefile.am (CLEANFILES): Remove gpgconf backups.
    
    Fixes-commit: ea7bb62f5d981615847528b3ce53be9cc4d741a7
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpg/Makefile.am b/tests/gpg/Makefile.am
index 6b6b5a8..8e26a92 100644
--- a/tests/gpg/Makefile.am
+++ b/tests/gpg/Makefile.am
@@ -46,7 +46,7 @@ TESTS = initial.test $(c_tests) final.test
 CLEANFILES = secring.gpg pubring.gpg pubring.kbx trustdb.gpg dirmngr.conf \
 	gpg-agent.conf pubring.kbx~ S.gpg-agent gpg.conf pubring.gpg~ \
 	random_seed S.gpg-agent .gpg-v21-migrated pubring-stamp \
-	tofu.db
+	tofu.db *.conf.gpgconf.bak
 
 private_keys = \
         13CD0F3BDF24BE53FE192D62F18737256FF6E4FD \

-----------------------------------------------------------------------

Summary of changes:
 tests/gpg/Makefile.am | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 16 14:01:50 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 16 Jan 2017 14:01:50 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-73-g8b1611a
Message-ID: <E1cT6v3-0002Uw-QK@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  8b1611a9605b636db3e07a9d81016a11b318724c (commit)
      from  0801f49b0dc7102943f0e9fa51061f50f5708ca6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8b1611a9605b636db3e07a9d81016a11b318724c
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 16 13:59:56 2017 +0100

    tests: Improve GPGHOME handling.
    
    * tests/openpgp/defs.scm (GPGHOME): New variable.
    * tests/openpgp/ssh-import.scm: Remove redundant code, use 'path-join'.
    * tests/openpgp/tofu.scm: Likewise.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/defs.scm b/tests/openpgp/defs.scm
index 548476b..1d8173d 100644
--- a/tests/openpgp/defs.scm
+++ b/tests/openpgp/defs.scm
@@ -253,6 +253,7 @@
 
 (setenv "GPG_AGENT_INFO" "" #t)
 (setenv "GNUPGHOME" (getcwd) #t)
+(define GNUPGHOME (getcwd))
 
 ;;
 ;; GnuPG helper.
diff --git a/tests/openpgp/ssh-import.scm b/tests/openpgp/ssh-import.scm
index e8f12d3..ad5acc5 100755
--- a/tests/openpgp/ssh-import.scm
+++ b/tests/openpgp/ssh-import.scm
@@ -20,10 +20,6 @@
 (load (with-path "defs.scm"))
 (setup-environment)
 
-(define GNUPGHOME (getenv "GNUPGHOME"))
-(if (string=? "" GNUPGHOME)
-    (fail "GNUPGHOME not set"))
-
 (setenv "SSH_AUTH_SOCK"
         (call-check `(,(tool 'gpgconf) --null --list-dirs agent-ssh-socket))
         #t)
@@ -55,7 +51,7 @@
  car keys)
 
 (info "Checking for issue2316...")
-(unlink (string-append GNUPGHOME "/sshcontrol"))
+(unlink (path-join GNUPGHOME "sshcontrol"))
 (pipe:do
  (pipe:open (path-join (in-srcdir "samplekeys")
 		       (string-append "ssh-rsa.key"))
diff --git a/tests/openpgp/tofu.scm b/tests/openpgp/tofu.scm
index cfcd5c8..ca5786b 100755
--- a/tests/openpgp/tofu.scm
+++ b/tests/openpgp/tofu.scm
@@ -30,9 +30,6 @@
 
 ;; Redefine GPG without --always-trust and a fixed time.
 (define GPG `(,(tool 'gpg) --no-permission-warning ,(faketime 0)))
-(define GNUPGHOME (getenv "GNUPGHOME"))
-(if (string=? "" GNUPGHOME)
-    (fail "GNUPGHOME not set"))
 
 (catch (skip "Tofu not supported")
        (call-check `(, at GPG --trust-model=tofu --list-config)))
@@ -106,7 +103,7 @@
 (info "Checking tofu policies and trust...")
 
 ;; Carefully remove the TOFU db.
-(catch '() (unlink (string-append GNUPGHOME "/tofu.db")))
+(catch '() (unlink (path-join GNUPGHOME "tofu.db")))
 
 ;; Verify a message.  There should be no conflict and the trust
 ;; policy should be set to auto.
@@ -205,7 +202,7 @@
     ))
 
 ;; Carefully remove the TOFU db.
-(catch '() (unlink (string-append GNUPGHOME "/tofu.db")))
+(catch '() (unlink (path-join GNUPGHOME "tofu.db")))
 
 (check-counts "1C005AF3" 0 0 0 0)
 (check-counts "BE04EB2B" 0 0 0 0)
@@ -288,7 +285,7 @@
 	      --faked-system-time=1476304861))
 
 ;; Carefully remove the TOFU db.
-(catch '() (unlink (string-append GNUPGHOME "/tofu.db")))
+(catch '() (unlink (path-join GNUPGHOME "tofu.db")))
 
 (define DIR "tofu/cross-sigs")
 ;; The test keys.
@@ -380,7 +377,7 @@
 	      --faked-system-time=1476304861))
 
 ;; Carefully remove the TOFU db.
-(catch '() (unlink (string-append GNUPGHOME "/tofu.db")))
+(catch '() (unlink (path-join GNUPGHOME "tofu.db")))
 
 (define DIR "tofu/cross-sigs")
 ;; The test keys.

-----------------------------------------------------------------------

Summary of changes:
 tests/openpgp/defs.scm       |  1 +
 tests/openpgp/ssh-import.scm |  6 +-----
 tests/openpgp/tofu.scm       | 11 ++++-------
 3 files changed, 6 insertions(+), 12 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 16 14:14:06 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 16 Jan 2017 14:14:06 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-33-g8aba08d
Message-ID: <E1cT76u-0002by-PP@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  8aba08d1d0871f439fb7193adc4a2f43a81ee216 (commit)
      from  92543da94cbf8e807b1b33070d273f995cdd5c62 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8aba08d1d0871f439fb7193adc4a2f43a81ee216
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Dec 21 10:32:25 2016 +0100

    qt: Add test for CryptoConfig
    
    * lang/qt/tests/t-config.cpp: New.
    * lang/qt/tests/Makefile.am: Update accordingly.

diff --git a/lang/qt/tests/Makefile.am b/lang/qt/tests/Makefile.am
index aba7be8..e3aa3be 100644
--- a/lang/qt/tests/Makefile.am
+++ b/lang/qt/tests/Makefile.am
@@ -25,11 +25,11 @@ TESTS_ENVIRONMENT = GNUPGHOME=$(abs_builddir)
 EXTRA_DIST = initial.test
 
 TESTS = initial.test t-keylist t-keylocate t-ownertrust t-tofuinfo \
-        t-encrypt t-verify t-various
+        t-encrypt t-verify t-various t-config
 
 moc_files = t-keylist.moc t-keylocate.moc t-ownertrust.moc t-tofuinfo.moc \
             t-encrypt.moc t-support.hmoc t-wkspublish.moc t-verify.moc \
-            t-various.moc
+            t-various.moc t-config.moc
 
 AM_LDFLAGS = -no-install
 
@@ -59,6 +59,7 @@ t_encrypt_SOURCES = t-encrypt.cpp $(support_src)
 t_wkspublish_SOURCES = t-wkspublish.cpp $(support_src)
 t_verify_SOURCES = t-verify.cpp $(support_src)
 t_various_SOURCES = t-various.cpp $(support_src)
+t_config_SOURCES = t-config.cpp $(support_src)
 run_keyformailboxjob_SOURCES = run-keyformailboxjob.cpp
 
 nodist_t_keylist_SOURCES = $(moc_files)
@@ -66,7 +67,7 @@ nodist_t_keylist_SOURCES = $(moc_files)
 BUILT_SOURCES = $(moc_files)
 
 noinst_PROGRAMS = t-keylist t-keylocate t-ownertrust t-tofuinfo t-encrypt \
-    run-keyformailboxjob t-wkspublish t-verify t-various
+    run-keyformailboxjob t-wkspublish t-verify t-various t-config
 
 CLEANFILES = secring.gpg pubring.gpg pubring.kbx trustdb.gpg dirmngr.conf \
 	gpg-agent.conf pubring.kbx~ S.gpg-agent gpg.conf pubring.gpg~ \
diff --git a/lang/qt/tests/t-config.cpp b/lang/qt/tests/t-config.cpp
new file mode 100644
index 0000000..046147c
--- /dev/null
+++ b/lang/qt/tests/t-config.cpp
@@ -0,0 +1,94 @@
+/* t-config.cpp
+
+    This file is part of qgpgme, the Qt API binding for gpgme
+    Copyright (c) 2016 Intevation GmbH
+
+    QGpgME is free software; you can redistribute it and/or
+    modify it under the terms of the GNU General Public License as
+    published by the Free Software Foundation; either version 2 of the
+    License, or (at your option) any later version.
+
+    QGpgME is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+
+    In addition, as a special exception, the copyright holders give
+    permission to link the code of this program with any edition of
+    the Qt library by Trolltech AS, Norway (or with modified versions
+    of Qt that use the same license as Qt), and distribute linked
+    combinations including the two.  You must obey the GNU General
+    Public License in all respects for all of the code used other than
+    Qt.  If you modify this file, you may extend this exception to
+    your version of the file, but you are not obligated to do so.  If
+    you do not wish to do so, delete this exception statement from
+    your version.
+*/
+#ifdef HAVE_CONFIG_H
+ #include "config.h"
+#endif
+
+#include <QDebug>
+#include <QTest>
+#include <QTemporaryDir>
+#include "t-support.h"
+#include "protocol.h"
+#include "cryptoconfig.h"
+#include <unistd.h>
+
+using namespace QGpgME;
+
+class CryptoConfigTest: public QGpgMETest
+{
+    Q_OBJECT
+
+private Q_SLOTS:
+    void testKeyserver()
+    {
+        // Repeatedly set a config value and clear it
+        // this war broken at some point so it gets a
+        // unit test.
+        for (int i = 0; i < 10; i++) {
+            auto conf = cryptoConfig();
+            Q_ASSERT (conf);
+            auto entry = conf->entry(QStringLiteral("gpg"),
+                    QStringLiteral("Keyserver"),
+                    QStringLiteral("keyserver"));
+            Q_ASSERT(entry);
+            const QString url(QStringLiteral("hkp://foo.bar.baz"));
+            entry->setStringValue(url);
+            conf->sync(false);
+            conf->clear();
+            entry = conf->entry(QStringLiteral("gpg"),
+                    QStringLiteral("Keyserver"),
+                    QStringLiteral("keyserver"));
+            QCOMPARE (entry->stringValue(), url);
+            entry->setStringValue(QString());
+            conf->sync(false);
+            conf->clear();
+            entry = conf->entry(QStringLiteral("gpg"),
+                    QStringLiteral("Keyserver"),
+                    QStringLiteral("keyserver"));
+            QCOMPARE (entry->stringValue(), QString());
+        }
+    }
+
+    void initTestCase()
+    {
+        QGpgMETest::initTestCase();
+        const QString gpgHome = qgetenv("GNUPGHOME");
+        qputenv("GNUPGHOME", mDir.path().toUtf8());
+        Q_ASSERT(mDir.isValid());
+    }
+private:
+    QTemporaryDir mDir;
+
+};
+
+QTEST_MAIN(CryptoConfigTest)
+
+#include "t-config.moc"

-----------------------------------------------------------------------

Summary of changes:
 lang/qt/tests/Makefile.am                    |  7 ++-
 lang/qt/tests/{t-verify.cpp => t-config.cpp} | 91 ++++++++++++++--------------
 2 files changed, 50 insertions(+), 48 deletions(-)
 copy lang/qt/tests/{t-verify.cpp => t-config.cpp} (51%)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 16 14:16:51 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 16 Jan 2017 14:16:51 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-34-gabfd241
Message-ID: <E1cT79Z-0003Ac-4N@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  abfd241d1a1ae8e30e18b7c5e0658b8c54d89544 (commit)
      from  8aba08d1d0871f439fb7193adc4a2f43a81ee216 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit abfd241d1a1ae8e30e18b7c5e0658b8c54d89544
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 16 14:16:20 2017 +0100

    qt: Use QVERIFY instead of Q_ASSERT in conf test
    
    * lang/qt/tests/t-config.cpp: Use QVERIFY instead of Q_ASSERT.

diff --git a/lang/qt/tests/t-config.cpp b/lang/qt/tests/t-config.cpp
index 046147c..0a7df22 100644
--- a/lang/qt/tests/t-config.cpp
+++ b/lang/qt/tests/t-config.cpp
@@ -54,11 +54,11 @@ private Q_SLOTS:
         // unit test.
         for (int i = 0; i < 10; i++) {
             auto conf = cryptoConfig();
-            Q_ASSERT (conf);
+            QVERIFY(conf);
             auto entry = conf->entry(QStringLiteral("gpg"),
                     QStringLiteral("Keyserver"),
                     QStringLiteral("keyserver"));
-            Q_ASSERT(entry);
+            QVERIFY(entry);
             const QString url(QStringLiteral("hkp://foo.bar.baz"));
             entry->setStringValue(url);
             conf->sync(false);
@@ -82,7 +82,7 @@ private Q_SLOTS:
         QGpgMETest::initTestCase();
         const QString gpgHome = qgetenv("GNUPGHOME");
         qputenv("GNUPGHOME", mDir.path().toUtf8());
-        Q_ASSERT(mDir.isValid());
+        QVERIFY(mDir.isValid());
     }
 private:
     QTemporaryDir mDir;

-----------------------------------------------------------------------

Summary of changes:
 lang/qt/tests/t-config.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 16 15:34:41 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 16 Jan 2017 15:34:41 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-253-g94faa08
Message-ID: <E1cT8Mt-0006Ne-Om@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  94faa08526668e51d861d5281a8e562a5bc9b9a2 (commit)
       via  6cb234470e47364900368fbd062134206db4482c (commit)
      from  e20092844ccc46b4074d01d235f4a55788002d35 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 94faa08526668e51d861d5281a8e562a5bc9b9a2
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 16 15:33:54 2017 +0100

    Handle non trustworthy or unknown CA better
    
    * src/mail.cpp (Mail::get_crypto_details): Add handling for
    unknown validity for S/MIME

diff --git a/src/mail.cpp b/src/mail.cpp
index dd6562c..b713f3e 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1814,7 +1814,14 @@ Mail::get_crypto_details()
                (m_sig.validity() == 0))&& !general_problem)
         {
            /* Bit of a catch all for weird results. */
-          message += _("is not certified by any trustworthy key.");
+          if (isOpenPGP)
+            {
+              message += _("is not certified by any trustworthy key.");
+            }
+          else
+            {
+              message += _("is not certified by a trustworthy Certificate Authority or the Certificate Authority is unknown.");
+            }
         }
       else if (m_uid.isRevoked())
         {

commit 6cb234470e47364900368fbd062134206db4482c
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Fri Jan 13 17:42:19 2017 +0100

    Add option to disable crypt reply selection
    
    * src/addin-options.cpp: Update accordingly.
    * src/dialogs.h, src/dialogs.rc: Add new option.
    * src/mailitem-events.cpp (EVENT_SINK_INVOKE): Handle option.
    * src/main.c (read_options, write_options): Handle new option.
    
    --
    There are some usecases e.g. when using an encryption gateway
    where choosing the reply crypto state based on the original
    message might not be welcome. So make it optional.

diff --git a/src/addin-options.cpp b/src/addin-options.cpp
index eb7d596..20d2128 100644
--- a/src/addin-options.cpp
+++ b/src/addin-options.cpp
@@ -44,6 +44,8 @@ set_labels (HWND dlg)
     { IDC_SIGN_DEFAULT,     N_("&Sign new messages by default")},
     { IDC_INLINE_PGP,       N_("&Send OpenPGP mails without "
                                "attachments as PGP/Inline")},
+    { IDC_REPLYCRYPT,       N_("S&elect crypto settings automatically "
+                               "for reply and foward.")},
 //    { IDC_AUTORRESOLVE,     N_("&Search for OpenPGP keys automatically when encrypting")},
 
 
@@ -94,6 +96,8 @@ options_window_proc (HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
 #endif
           SendDlgItemMessage (hDlg, IDC_INLINE_PGP, BM_SETCHECK,
                               !!opt.inline_pgp, 0L);
+          SendDlgItemMessage (hDlg, IDC_REPLYCRYPT, BM_SETCHECK,
+                              !!opt.reply_crypt, 0L);
 //          SendDlgItemMessage (hDlg, IDC_AUTORRESOLVE, BM_SETCHECK,
 //                              !!opt.autoresolve, 0L);
           enable_disable_opts (hDlg);
@@ -133,6 +137,9 @@ options_window_proc (HWND hDlg, UINT uMsg, WPARAM wParam, LPARAM lParam)
                 opt.inline_pgp = !!SendDlgItemMessage
                   (hDlg, IDC_INLINE_PGP, BM_GETCHECK, 0, 0L);
 
+                opt.reply_crypt = !!SendDlgItemMessage
+                  (hDlg, IDC_REPLYCRYPT, BM_GETCHECK, 0, 0L);
+
 //                opt.autoresolve = !!SendDlgItemMessage
 ////                  (hDlg, IDC_AUTORRESOLVE, BM_GETCHECK, 0, 0L);
 
diff --git a/src/common_indep.h b/src/common_indep.h
index a5c04f3..7eca780 100644
--- a/src/common_indep.h
+++ b/src/common_indep.h
@@ -197,6 +197,7 @@ struct
   int mime_ui;               /* Only for Addin. Use the PGP/MIME ui */
   int inline_pgp;            /* Only for Addin. Use Inline PGP by default. */
   int autoresolve;           /* Autresolve keys with --locate-keys. */
+  int reply_crypt;           /* Only for Addin. Encrypt / Sign based on cryptostatus. */
 
   /* The compatibility flags. */
   struct
diff --git a/src/dialogs.h b/src/dialogs.h
index e6f925d..2cce4ad 100644
--- a/src/dialogs.h
+++ b/src/dialogs.h
@@ -106,6 +106,7 @@
 #define IDC_MIME_UI                     0x5133
 #define IDC_INLINE_PGP                  0x5134
 #define IDC_AUTORRESOLVE                0x5135
+#define IDC_REPLYCRYPT                  0x5136
 
 /* Ids for PNG Images */
 #define IDI_ENCRYPT_16_PNG              0x6000
diff --git a/src/dialogs.rc b/src/dialogs.rc
index 0454f19..3d27293 100644
--- a/src/dialogs.rc
+++ b/src/dialogs.rc
@@ -309,7 +309,7 @@ BEGIN
                     198, 96, 50, 14
 END
 
-IDD_ADDIN_OPTIONS DIALOGEX DISCARDABLE  300, 300, 266, 170
+IDD_ADDIN_OPTIONS DIALOGEX DISCARDABLE  300, 300, 266, 180
 STYLE DS_MODALFRAME | WS_POPUP | WS_VISIBLE | WS_CAPTION | WS_SYSMENU | DS_SHELLFONT | DS_SETFONT
 CAPTION "GpgOL"
 FONT 8, "MS Shell Dlg"
@@ -333,7 +333,7 @@ BEGIN
 
     /* Send options box.  */
     GROUPBOX        "send-options", IDC_G_SEND,
-                    9, 50, 250, 50
+                    9, 50, 250, 57
 
     CONTROL         "encrypt-by-default", IDC_ENCRYPT_DEFAULT,
                     "Button", BS_AUTOCHECKBOX | WS_TABSTOP,
@@ -347,6 +347,10 @@ BEGIN
                     "Button", BS_AUTOCHECKBOX | WS_TABSTOP,
                     24, 82, 215, 10
 
+    CONTROL         "replycrypt", IDC_REPLYCRYPT,
+                    "Button", BS_AUTOCHECKBOX | WS_TABSTOP,
+                    24, 93, 215, 10
+
 //    CONTROL         "autoresolve", IDC_AUTORRESOLVE,
 //                    "Button", BS_AUTOCHECKBOX | WS_TABSTOP,
 //                    24, 93, 215, 10
@@ -354,18 +358,18 @@ BEGIN
     /* Stuff at the lower left corner.  */
     CONTROL         IDB_LOGO, IDC_BITMAP,
                     "Static", SS_BITMAP | SS_REALSIZEIMAGE,
-                      10, 105, 128, 80
+                      10, 115, 128, 80
 
     LTEXT           "Version x ", IDC_VERSION_INFO,
-                      10, 155, 100, 9
+                      10, 165, 100, 9
 
     PUSHBUTTON      "advanced", IDC_GPG_OPTIONS,
-                    180, 120, 70, 14
+                    180, 130, 70, 14
 
     PUSHBUTTON      "gpgconf", IDC_GPG_CONF,
-                    180, 135, 70, 14
+                    180, 145, 70, 14
 
     DEFPUSHBUTTON   "&OK", IDOK,
-                    180, 150, 70, 14
+                    180, 160, 70, 14
 
 END
diff --git a/src/mailitem-events.cpp b/src/mailitem-events.cpp
index 1ec0ec3..e23242a 100644
--- a/src/mailitem-events.cpp
+++ b/src/mailitem-events.cpp
@@ -446,6 +446,10 @@ EVENT_SINK_INVOKE(MailItemEvents)
         {
           log_oom_extra ("%s:%s: Reply Forward ReplyAll: %p",
                          SRCNAME, __func__, m_mail);
+          if (!opt.reply_crypt)
+            {
+              break;
+            }
           int crypto_flags = 0;
           if (!(crypto_flags = m_mail->get_crypto_flags ()))
             {
diff --git a/src/main.c b/src/main.c
index d2e7122..52833f0 100644
--- a/src/main.c
+++ b/src/main.c
@@ -421,6 +421,9 @@ read_options (void)
   load_extension_value ("autoresolve", &val);
   opt.autoresolve = val == NULL || *val != '1'? 0 : 1;
   xfree (val); val = NULL;
+  load_extension_value ("replyCrypt", &val);
+  opt.reply_crypt = val == NULL || *val != '1'? 1 : 0;
+  xfree (val); val = NULL;
   /* Note, that on purpose these flags are only Registry changeable.
      The format of the entry is a string of of "0" and "1" digits; see
      the switch below for a description. */
@@ -493,6 +496,7 @@ write_options (void)
     {"mimeUI", MIME_UI_DEFAULT, opt.mime_ui, NULL},
     {"inlinePGP",                0, opt.inline_pgp, NULL},
     {"autoresolve",              0, opt.autoresolve, NULL},
+    {"replyCrypt",               0, opt.reply_crypt, NULL},
     {NULL, 0, 0, NULL}
   };
   char buf[32];

-----------------------------------------------------------------------

Summary of changes:
 src/addin-options.cpp   |  7 +++++++
 src/common_indep.h      |  1 +
 src/dialogs.h           |  1 +
 src/dialogs.rc          | 18 +++++++++++-------
 src/mail.cpp            |  9 ++++++++-
 src/mailitem-events.cpp |  4 ++++
 src/main.c              |  4 ++++
 7 files changed, 36 insertions(+), 8 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 16 16:20:54 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 16 Jan 2017 16:20:54 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-254-gfdc2575
Message-ID: <E1cT95c-0008Qc-UG@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  fdc2575c657abd4e7630cbb1461a9f270ea2046a (commit)
      from  94faa08526668e51d861d5281a8e562a5bc9b9a2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit fdc2575c657abd4e7630cbb1461a9f270ea2046a
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 16 15:52:37 2017 +0100

    Programatically resize window after category set
    
    * src/mail.cpp (resize_active_window): New. Resize window by 1px
    and back.
    (Mail::update_categories): Use it.
    
    --
    This fixes a display issue when categories are updated, mostly..

diff --git a/src/mail.cpp b/src/mail.cpp
index b713f3e..03c2382 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1374,6 +1374,68 @@ Mail::remove_categories ()
   remove_category (m_mailitem, verifyCategory);
 }
 
+/* Now for some tasty hack: Outlook sometimes does
+   not show the new categories properly but instead
+   does some weird scrollbar thing. This can be
+   avoided by resizing the message a bit. But somehow
+   this only needs to be done once.
+
+   Weird isn't it? But as this workaround worked let's
+   do it programatically. Fun. Wan't some tomato sauce
+   with this hack? */
+static void
+resize_active_window ()
+{
+  HWND wnd = get_active_hwnd ();
+  static std::vector<HWND> resized_windows;
+  if(std::find(resized_windows.begin(), resized_windows.end(), wnd) != resized_windows.end()) {
+      /* We only need to do this once per window. XXX But sometimes we also
+         need to do this once per view of the explorer. So for now this might
+         break but we reduce the flicker. A better solution would be to find
+         the current view and track that. */
+      return;
+  }
+
+  if (!wnd)
+    {
+      TRACEPOINT;
+      return;
+    }
+  RECT oldpos;
+  if (!GetWindowRect (wnd, &oldpos))
+    {
+      TRACEPOINT;
+      return;
+    }
+
+  if (!SetWindowPos (wnd, nullptr,
+                     (int)oldpos.left,
+                     (int)oldpos.top,
+                     /* Anything smaller then 19 was ignored when the window was
+                      * maximized on Windows 10 at least with a 1980*1024
+                      * resolution. So I assume it's at least 1 percent.
+                      * This is all hackish and ugly but should work for 90%...
+                      * hopefully.
+                      */
+                     (int)oldpos.right - oldpos.left - 20,
+                     (int)oldpos.bottom - oldpos.top, 0))
+    {
+      TRACEPOINT;
+      return;
+    }
+
+  if (!SetWindowPos (wnd, nullptr,
+                     (int)oldpos.left,
+                     (int)oldpos.top,
+                     (int)oldpos.right - oldpos.left,
+                     (int)oldpos.bottom - oldpos.top, 0))
+    {
+      TRACEPOINT;
+      return;
+    }
+  resized_windows.push_back(wnd);
+}
+
 void
 Mail::update_categories ()
 {
@@ -1400,6 +1462,9 @@ Mail::update_categories ()
          categories */
       remove_category (m_mailitem, decCategory);
     }
+
+  resize_active_window();
+
   return;
 }
 

-----------------------------------------------------------------------

Summary of changes:
 src/mail.cpp | 65 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 16 16:33:36 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 16 Jan 2017 16:33:36 +0100
Subject: [git] Pinentry - branch, master, updated. pinentry-1.0.0-7-g8e3aa32
Message-ID: <E1cT9Hu-0000fr-St@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The standard pinentry collection".

The branch, master has been updated
       via  8e3aa3204e74e8d7a7538e0d0f04e555f140131b (commit)
      from  c725fdd260b0c2291660ff954e6b2250006ec08f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8e3aa3204e74e8d7a7538e0d0f04e555f140131b
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 16 16:29:10 2017 +0100

    gnome3: Use the program name as default title.
    
    * gnome3/pinentry-gnome3.c (create_prompt): If no title is requested,
    use the program name as the default title.  This mimics what the GTK+2
    variant does (although the GTK+2 pinentry seems to use
    basename(argv[0])).
    
    GnuPG-bug-id: 2920
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/gnome3/pinentry-gnome3.c b/gnome3/pinentry-gnome3.c
index 29cd997..c148fd9 100644
--- a/gnome3/pinentry-gnome3.c
+++ b/gnome3/pinentry-gnome3.c
@@ -149,12 +149,9 @@ create_prompt (pinentry_t pe, int confirm)
     }
 
   /* Set the messages for the various buttons, etc.  */
-  if (pe->title)
-    {
-      msg = pinentry_utf8_validate (pe->title);
-      gcr_prompt_set_title (prompt, msg);
-      g_free (msg);
-    }
+  msg = pinentry_utf8_validate (pe->title ? pe->title : PGMNAME);
+  gcr_prompt_set_title (prompt, msg);
+  g_free (msg);
 
   if (pe->description)
     {

-----------------------------------------------------------------------

Summary of changes:
 gnome3/pinentry-gnome3.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
The standard pinentry collection
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 16 19:14:58 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 16 Jan 2017 19:14:58 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-77-ge6aebfe
Message-ID: <E1cTBo5-0007M6-MF@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e6aebfe3d0f16c483296fd125b66a44017fe15f4 (commit)
       via  9850124c7bdf0a0e7c1866abc85f3437257d7095 (commit)
       via  daae97bc14742c75408c4eb05808a2102cfe2bcf (commit)
       via  82646bbf1a5a7d745da81b239a12667a51703dc1 (commit)
      from  8b1611a9605b636db3e07a9d81016a11b318724c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e6aebfe3d0f16c483296fd125b66a44017fe15f4
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 16 19:04:58 2017 +0100

    dirmngr: Implement hkps lookups using literal addresses.
    
    * dirmngr/ks-engine-hkp.c (map_host): For literal addresses do a
    reverse lookup.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 8c171a5..08ef851 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -85,7 +85,7 @@ struct hostinfo_s
   time_t died_at;    /* The time the host was marked dead.  If this is
                         0 the host has been manually marked dead.  */
   char *cname;       /* Canonical name of the host.  Only set if this
-                        is a pool.  */
+                        is a pool or NAME has a numerical IP address.  */
   char *v4addr;      /* A string with the v4 IP address of the host.
                         NULL if NAME has a numeric IP address or no v4
                         address is available.  */
@@ -571,6 +571,34 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
       hi = hosttable[hi->poolidx];
       assert (hi);
     }
+  else if (r_httphost && is_ip_address (hi->name))
+    {
+      /* This is a numerical IP address and not a pool.  We want to
+       * find the canonical name so that it can be used in the HTTP
+       * Host header.  Fixme: We should store that name in the
+       * hosttable. */
+      dns_addrinfo_t aibuf, ai;
+      char *host;
+
+      err = resolve_dns_name (hi->name, 0, 0, SOCK_STREAM, &aibuf, NULL);
+      if (!err)
+        {
+          for (ai = aibuf; ai; ai = ai->next)
+            {
+              if (ai->family == AF_INET6 || ai->family == AF_INET)
+                {
+                  err = resolve_dns_addr (ai->addr, ai->addrlen, 0, &host);
+                  if (!err)
+                    {
+                      /* Okay, we return the first found name.  */
+                      *r_httphost = host;
+                      break;
+                    }
+                }
+            }
+        }
+      free_dns_addrinfo (aibuf);
+    }
 
   if (hi->dead)
     {

commit 9850124c7bdf0a0e7c1866abc85f3437257d7095
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 16 19:03:39 2017 +0100

    dirmngr: Allow reverse DNS lookups in Tor-mode.
    
    * dirmngr/dns-stuff.c (resolve_dns_name): Move up in the file.
    (resolve_addr_libdns): New.
    (resolve_dns_addr): Divert to resolve_dns_addr.
    --
    
    In the old code reverse lookups where disabled in Tor mode.  By
    implementing the reverse lookups via libdns it is now possible to do
    them also in Tor mode.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 2debdca..28ecb18 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -892,6 +892,177 @@ resolve_name_standard (const char *name, unsigned short port,
 }
 
 
+/* This a wrapper around getaddrinfo with slightly different semantics.
+   NAME is the name to resolve.
+   PORT is the requested port or 0.
+   WANT_FAMILY is either 0 (AF_UNSPEC), AF_INET6, or AF_INET4.
+   WANT_SOCKETTYPE is either SOCK_STREAM or SOCK_DGRAM.
+
+   On success the result is stored in a linked list with the head
+   stored at the address R_AI; the caller must call gpg_addrinfo_free
+   on this.  If R_CANONNAME is not NULL the official name of the host
+   is stored there as a malloced string; if that name is not available
+   NULL is stored.  */
+gpg_error_t
+resolve_dns_name (const char *name, unsigned short port,
+                  int want_family, int want_socktype,
+                  dns_addrinfo_t *r_ai, char **r_canonname)
+{
+  gpg_error_t err;
+
+#ifdef USE_LIBDNS
+  if (!standard_resolver)
+    {
+      err = resolve_name_libdns (name, port, want_family, want_socktype,
+                                  r_ai, r_canonname);
+      if (err && libdns_switch_port_p (err))
+        err = resolve_name_libdns (name, port, want_family, want_socktype,
+                                   r_ai, r_canonname);
+    }
+  else
+#endif /*USE_LIBDNS*/
+    err = resolve_name_standard (name, port, want_family, want_socktype,
+                                 r_ai, r_canonname);
+  if (opt_debug)
+    log_debug ("dns: resolve_dns_name(%s): %s\n", name, gpg_strerror (err));
+  return err;
+}
+
+
+#ifdef USE_LIBDNS
+/* Resolve an address using libdns.  */
+static gpg_error_t
+resolve_addr_libdns (const struct sockaddr *addr, int addrlen,
+                     unsigned int flags, char **r_name)
+{
+  gpg_error_t err;
+  char host[DNS_D_MAXNAME + 1];
+  struct dns_resolver *res;
+  struct dns_packet *ans = NULL;
+  struct dns_ptr ptr;
+  int derr;
+
+  *r_name = NULL;
+
+  /* First we turn ADDR into a DNS name (with ".arpa" suffix).  */
+  err = 0;
+  if (addr->sa_family == AF_INET6)
+    {
+      const struct sockaddr_in6 *a6 = (const struct sockaddr_in6 *)addr;
+      if (!dns_aaaa_arpa (host, sizeof host, (void*)&a6->sin6_addr))
+        err = gpg_error (GPG_ERR_INV_OBJ);
+    }
+  else if (addr->sa_family == AF_INET)
+    {
+      const struct sockaddr_in *a4 = (const struct sockaddr_in *)addr;
+      if (!dns_a_arpa (host, sizeof host, (void*)&a4->sin_addr))
+        err = gpg_error (GPG_ERR_INV_OBJ);
+    }
+  else
+    err = gpg_error (GPG_ERR_EAFNOSUPPORT);
+  if (err)
+    goto leave;
+
+
+  err = libdns_res_open (&res);
+  if (err)
+    goto leave;
+
+  err = libdns_res_submit (res, host, DNS_T_PTR, DNS_C_IN);
+  if (err)
+    goto leave;
+
+  err = libdns_res_wait (res);
+  if (err)
+    goto leave;
+
+  ans = dns_res_fetch (res, &derr);
+  if (!ans)
+    {
+      err = libdns_error_to_gpg_error (derr);
+      goto leave;
+    }
+
+  /* Check the rcode.  */
+  switch (dns_p_rcode (ans))
+    {
+    case DNS_RC_NOERROR:
+      break;
+    case DNS_RC_NXDOMAIN:
+      err = gpg_error (GPG_ERR_NO_NAME);
+      break;
+    default:
+      err = GPG_ERR_SERVER_FAILED;
+      goto leave;
+    }
+
+  /* Parse the result.  */
+  if (!err)
+    {
+      struct dns_rr rr;
+      struct dns_rr_i rri;
+
+      memset (&rri, 0, sizeof rri);
+      dns_rr_i_init (&rri, ans);
+      rri.section = DNS_S_ALL & ~DNS_S_QD;
+      rri.name    = host;
+      rri.type    = DNS_T_PTR;
+
+      if (!dns_rr_grep (&rr, 1, &rri, ans, &derr))
+        {
+          err = gpg_error (GPG_ERR_NOT_FOUND);
+          goto leave;
+        }
+
+      err = libdns_error_to_gpg_error (dns_ptr_parse (&ptr, &rr, ans));
+      if (err)
+        goto leave;
+
+      /* Copy result.  */
+      *r_name = xtrystrdup (ptr.host);
+      if (!*r_name)
+        {
+          err = gpg_error_from_syserror ();
+          goto leave;
+        }
+      /* Libdns appends the root zone part which is problematic
+       * for most other functions - strip it.  */
+      if (**r_name && (*r_name)[strlen (*r_name)-1] == '.')
+        (*r_name)[strlen (*r_name)-1] = 0;
+    }
+  else /* GPG_ERR_NO_NAME */
+    {
+      char *buffer, *p;
+      int buflen;
+      int ec;
+
+      buffer = ptr.host;
+      buflen = sizeof ptr.host;
+
+      p = buffer;
+      if (addr->sa_family == AF_INET6 && (flags & DNS_WITHBRACKET))
+        {
+          *p++ = '[';
+          buflen -= 2;
+        }
+      ec = getnameinfo (addr, addrlen, p, buflen, NULL, 0, NI_NUMERICHOST);
+      if (ec)
+        {
+          err = map_eai_to_gpg_error (ec);
+          goto leave;
+        }
+      if (addr->sa_family == AF_INET6 && (flags & DNS_WITHBRACKET))
+        strcat (buffer, "]");
+    }
+
+ leave:
+  dns_free (ans);
+  dns_res_close (res);
+  return err;
+}
+#endif /*USE_LIBDNS*/
+
+
 /* Resolve an address using the standard system function.  */
 static gpg_error_t
 resolve_addr_standard (const struct sockaddr *addr, int addrlen,
@@ -952,51 +1123,31 @@ resolve_addr_standard (const struct sockaddr *addr, int addrlen,
 }
 
 
-/* This a wrapper around getaddrinfo with slightly different semantics.
-   NAME is the name to resolve.
-   PORT is the requested port or 0.
-   WANT_FAMILY is either 0 (AF_UNSPEC), AF_INET6, or AF_INET4.
-   WANT_SOCKETTYPE is either SOCK_STREAM or SOCK_DGRAM.
-
-   On success the result is stored in a linked list with the head
-   stored at the address R_AI; the caller must call gpg_addrinfo_free
-   on this.  If R_CANONNAME is not NULL the official name of the host
-   is stored there as a malloced string; if that name is not available
-   NULL is stored.  */
+/* A wrapper around getnameinfo.  */
 gpg_error_t
-resolve_dns_name (const char *name, unsigned short port,
-                  int want_family, int want_socktype,
-                  dns_addrinfo_t *r_ai, char **r_canonname)
+resolve_dns_addr (const struct sockaddr *addr, int addrlen,
+                  unsigned int flags, char **r_name)
 {
   gpg_error_t err;
 
 #ifdef USE_LIBDNS
-  if (!standard_resolver)
+  /* Note that we divert to the standard resolver for NUMERICHOST.  */
+  if (!standard_resolver && !(flags & DNS_NUMERICHOST))
     {
-      err = resolve_name_libdns (name, port, want_family, want_socktype,
-                                  r_ai, r_canonname);
+      err = resolve_addr_libdns (addr, addrlen, flags, r_name);
       if (err && libdns_switch_port_p (err))
-        err = resolve_name_libdns (name, port, want_family, want_socktype,
-                                   r_ai, r_canonname);
+        err = resolve_addr_libdns (addr, addrlen, flags, r_name);
     }
   else
 #endif /*USE_LIBDNS*/
-    err = resolve_name_standard (name, port, want_family, want_socktype,
-                                 r_ai, r_canonname);
+    err = resolve_addr_standard (addr, addrlen, flags, r_name);
+
   if (opt_debug)
-    log_debug ("dns: resolve_dns_name(%s): %s\n", name, gpg_strerror (err));
+    log_debug ("dns: resolve_dns_addr(): %s\n", gpg_strerror (err));
   return err;
 }
 
 
-gpg_error_t
-resolve_dns_addr (const struct sockaddr *addr, int addrlen,
-                  unsigned int flags, char **r_name)
-{
-  return resolve_addr_standard (addr, addrlen, flags, r_name);
-}
-
-
 /* Check whether NAME is an IP address.  Returns a true if it is
  * either an IPv6 or a IPv4 numerical address.  The actual return
  * values can also be used to identify whether it is v4 or v6: The
@@ -1096,7 +1247,7 @@ get_dns_cert_libdns (const char *name, int want_certtype,
   int derr;
   int qtype;
 
-  /* Gte the query type from WANT_CERTTYPE (which in general indicates
+  /* Get the query type from WANT_CERTTYPE (which in general indicates
    * the subtype we want). */
   qtype = (want_certtype < DNS_CERTTYPE_RRBASE
            ? T_CERT

commit daae97bc14742c75408c4eb05808a2102cfe2bcf
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 16 09:10:46 2017 +0100

    dirmngr: Avoid network queries for literal IP addresses.
    
    * dirmngr/dns-stuff.c (resolve_name_libdns): USe flags AI_NUMERICHOST
    for literal IP addresses.
    (resolve_name_standard): Ditto.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 1b30c2c..2debdca 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -685,6 +685,8 @@ resolve_name_libdns (const char *name, unsigned short port,
   hints.ai_flags = AI_ADDRCONFIG;
   if (r_canonname)
     hints.ai_flags |= AI_CANONNAME;
+  if (is_ip_address (name))
+    hints.ai_flags |= AI_NUMERICHOST;
 
   if (port)
     {
@@ -806,6 +808,8 @@ resolve_name_standard (const char *name, unsigned short port,
   hints.ai_flags = AI_ADDRCONFIG;
   if (r_canonname)
     hints.ai_flags |= AI_CANONNAME;
+  if (is_ip_address (name))
+    hints.ai_flags |= AI_NUMERICHOST;
 
   if (port)
     snprintf (portstr, sizeof portstr, "%hu", port);

commit 82646bbf1a5a7d745da81b239a12667a51703dc1
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 12 21:09:42 2017 +0100

    dirmngr: Fix URL creation for literal IPv6 addresses in HKP.
    
    * dirmngr/dns-stuff.c (is_ip_address): Make the return value depend on
    the address family.
    * dirmngr/ks-engine-hkp.c (map_host): Rename arg R_POOLNAME to
    R_HTTPHOST because that is its purpose.  Note that the former
    behaviour of storing a NULL to indicate that it is not a pool has not
    been used.
    (make_host_part): Ditto.
    (make_host_part): Make sure that literal v6 addresses are correclty
    marked in the constructed URL.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index a8713eb..1b30c2c 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -993,8 +993,10 @@ resolve_dns_addr (const struct sockaddr *addr, int addrlen,
 }
 
 
-/* Check whether NAME is an IP address.  Returns true if it is either
-   an IPv6 or IPv4 numerical address.  */
+/* Check whether NAME is an IP address.  Returns a true if it is
+ * either an IPv6 or a IPv4 numerical address.  The actual return
+ * values can also be used to identify whether it is v4 or v6: The
+ * true value will surprisingly be 4 for IPv4 and 6 for IPv6.  */
 int
 is_ip_address (const char *name)
 {
@@ -1002,7 +1004,7 @@ is_ip_address (const char *name)
   int ndots, dblcol, n;
 
   if (*name == '[')
-    return 1; /* yes: A legal DNS name may not contain this character;
+    return 6; /* yes: A legal DNS name may not contain this character;
                  this mut be bracketed v6 address.  */
   if (*name == '.')
     return 0; /* No.  A leading dot is not a valid IP address.  */
@@ -1035,7 +1037,7 @@ is_ip_address (const char *name)
   if (ndots > 7)
     return 0; /* No: Too many colons.  */
   else if (ndots > 1)
-    return 1; /* Yes: At least 2 colons indicate an v6 address.  */
+    return 6; /* Yes: At least 2 colons indicate an v6 address.  */
 
  legacy:
   /* Check whether it is legacy IP address.  */
@@ -1056,7 +1058,7 @@ is_ip_address (const char *name)
       else if (++n > 3)
         return 0; /* No: More than 3 digits.  */
     }
-  return !!(ndots == 3);
+  return (ndots == 3)? 4 : 0;
 }
 
 
diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 5febb13..8c171a5 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -384,13 +384,14 @@ add_host (const char *name, int is_pool,
  * NULL is stored.  If we know the port used by the selected host from
  * a service record, a string representation is written to R_PORTSTR,
  * otherwise it is left untouched.  If R_HTTPFLAGS is not NULL it will
- * receive flags which are to be passed to http_open.  If R_POOLNAME
- * is not NULL a malloced name of the pool is stored or NULL if it is
- * not a pool. */
+ * receive flags which are to be passed to http_open.  If R_HTTPHOST
+ * is not NULL a malloced name of the host is stored there; this might
+ * be different from R_HOST in case it has been selected from a
+ * pool.  */
 static gpg_error_t
 map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
           char **r_host, char *r_portstr,
-          unsigned int *r_httpflags, char **r_poolname)
+          unsigned int *r_httpflags, char **r_httphost)
 {
   gpg_error_t err = 0;
   hostinfo_t hi;
@@ -399,8 +400,8 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
   *r_host = NULL;
   if (r_httpflags)
     *r_httpflags = 0;
-  if (r_poolname)
-    *r_poolname = NULL;
+  if (r_httphost)
+    *r_httphost = NULL;
 
   /* No hostname means localhost.  */
   if (!name || !*name)
@@ -535,10 +536,10 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
   if (hi->pool)
     {
       /* Deal with the pool name before selecting a host. */
-      if (r_poolname)
+      if (r_httphost)
         {
-          *r_poolname = xtrystrdup (hi->cname? hi->cname : hi->name);
-          if (!*r_poolname)
+          *r_httphost = xtrystrdup (hi->cname? hi->cname : hi->name);
+          if (!*r_httphost)
             return gpg_error_from_syserror ();
         }
 
@@ -557,10 +558,10 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
           if (hi->poolidx == -1)
             {
               log_error ("no alive host found in pool '%s'\n", name);
-              if (r_poolname)
+              if (r_httphost)
                 {
-                  xfree (*r_poolname);
-                  *r_poolname = NULL;
+                  xfree (*r_httphost);
+                  *r_httphost = NULL;
                 }
               return gpg_error (GPG_ERR_NO_KEYSERVER);
             }
@@ -574,10 +575,10 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
   if (hi->dead)
     {
       log_error ("host '%s' marked as dead\n", hi->name);
-      if (r_poolname)
+      if (r_httphost)
         {
-          xfree (*r_poolname);
-          *r_poolname = NULL;
+          xfree (*r_httphost);
+          *r_httphost = NULL;
         }
       return gpg_error (GPG_ERR_NO_KEYSERVER);
     }
@@ -604,10 +605,10 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
   if (!*r_host)
     {
       err = gpg_error_from_syserror ();
-      if (r_poolname)
+      if (r_httphost)
         {
-          xfree (*r_poolname);
-          *r_poolname = NULL;
+          xfree (*r_httphost);
+          *r_httphost = NULL;
         }
       return err;
     }
@@ -851,13 +852,15 @@ ks_hkp_help (ctrl_t ctrl, parsed_uri_t uri)
 
 /* Build the remote part of the URL from SCHEME, HOST and an optional
  * PORT.  If NO_SRV is set no SRV record lookup will be done.  Returns
- * an allocated string at R_HOSTPORT or NULL on failure If R_POOLNAME
- * is not NULL it receives a malloced string with the poolname.  */
+ * an allocated string at R_HOSTPORT or NULL on failure.  If
+ * R_HTTPHOST is not NULL it receives a malloced string with the
+ * hostname; this may be different from HOST if HOST is selected from
+ * a pool.  */
 static gpg_error_t
 make_host_part (ctrl_t ctrl,
                 const char *scheme, const char *host, unsigned short port,
                 int force_reselect, int no_srv,
-                char **r_hostport, unsigned int *r_httpflags, char **r_poolname)
+                char **r_hostport, unsigned int *r_httpflags, char **r_httphost)
 {
   gpg_error_t err;
   const char *srvtag;
@@ -879,7 +882,7 @@ make_host_part (ctrl_t ctrl,
 
   portstr[0] = 0;
   err = map_host (ctrl, host, srvtag, force_reselect,
-                  &hostname, portstr, r_httpflags, r_poolname);
+                  &hostname, portstr, r_httpflags, r_httphost);
   if (err)
     return err;
 
@@ -896,14 +899,17 @@ make_host_part (ctrl_t ctrl,
   else
     strcpy (portstr, "11371");
 
-  *r_hostport = strconcat (scheme, "://", hostname, ":", portstr, NULL);
+  if (*hostname != '[' && is_ip_address (hostname) == 6)
+    *r_hostport = strconcat (scheme, "://[", hostname, "]:", portstr, NULL);
+  else
+    *r_hostport = strconcat (scheme, "://", hostname, ":", portstr, NULL);
   xfree (hostname);
   if (!*r_hostport)
     {
-      if (r_poolname)
+      if (r_httphost)
         {
-          xfree (*r_poolname);
-          *r_poolname = NULL;
+          xfree (*r_httphost);
+          *r_httphost = NULL;
         }
       return gpg_error_from_syserror ();
     }

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dns-stuff.c     | 229 ++++++++++++++++++++++++++++++++++++++++--------
 dirmngr/ks-engine-hkp.c |  88 +++++++++++++------
 2 files changed, 254 insertions(+), 63 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 16 23:12:58 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 16 Jan 2017 23:12:58 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 65df8d99e68abfc323060afaff8ece55fe4af216
Message-ID: <E1cTFWP-0000f7-8p@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  65df8d99e68abfc323060afaff8ece55fe4af216 (commit)
       via  4c7f31f2ee54c21981134f8bbe9b79e2071a90ed (commit)
      from  ca620a23d9f5b25ed58be0c9f3dae10251dfc6c0 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 65df8d99e68abfc323060afaff8ece55fe4af216
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 16 23:08:20 2017 +0100

    blog: Finish Neals blog post
    
    We started a mail discussion on this but unfortunately Neal's mail
    server died during his vacation and thus we could not finish that
    discussion.  Instead I applied the suggested changes by dkg and
    Justus.  I also removed the misleading claim that a mail address
    search for anna at examle.org would also return a key for
    nanna at examle.org; the README always mentioned how to specify a user ID
    and gives this example:
    
        * By an email address:
    
    	"<heinrichh at uni-duesseldorf.de>"
    
    Thus the angle brackets make sure that a complete mail match is done.
    Nevertheless, the mentioned patch improves the selection a lot.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/misc/blog.gnupg.org/20170116-gnupg-this-past-fall.org b/misc/blog.gnupg.org/20170116-gnupg-this-past-fall.org
index 9027d51..f44e057 100644
--- a/misc/blog.gnupg.org/20170116-gnupg-this-past-fall.org
+++ b/misc/blog.gnupg.org/20170116-gnupg-this-past-fall.org
@@ -12,50 +12,49 @@ GnuPG 2.1 code base so that we can release GnuPG 2.2.  This is
 particularly important to us, because we want the latest features to
 be available in the next release of Debian stable, which is about to
 freeze.  All of the main developers have participated in this effort,
-but I want to particularly point out Daniel Kahn Gillmor's many
+but I want to particularly point out Daniel Kahn Gillmor?s many
 patches in this area.  Even prior to this effort, Daniel has regularly
 submitted patches for relatively minor, boring issues.  But, it is
 exactly these types of fixes that result in a polished product.
 
 A relatively major change that went into the most recent release of
-GnuPG is the replacement of ADNS with William Ahern's [[http://25thandclement.com/~william/projects/dns.c.html][libdns]].
+GnuPG is the replacement of ADNS with William Ahern?s [[http://25thandclement.com/~william/projects/dns.c.html][libdns]].
 Unfortunately, our patches for Tor support for ADNS have been in limbo
 for such a long time, that [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-December/032350.html][we decided to change to a different DNS
 resolver]].
 
-Daniel Kahn Gillmor also helped implement and debug GnuPG's new
-supervisor mode.  This mode allows GnuPG's daemons to be auto-started
+Daniel Kahn Gillmor also helped implement and debug GnuPG?s new
+supervisor mode.  This mode allows GnuPG?s daemons to be auto-started
 and auto-stopped by systemd.  If you are tracking Debian testing or
 Debian unstable, you can try enabling this by following the
 instructions in ~/usr/share/doc/gnupg-agent/README.Debian~.  This is
-based on the [[https://git.gnupg.org/cgi-bin/gitweb.cgi?p%3Dgnupg.git%3Ba%3Dtree%3Bf%3Ddoc/examples/systemd-user%3Bh%3D2d589564e565b0b886d8c8d9071ca52290fb87e3%3Bhb%3Drefs/heads/master][reference implementation for starting GnuPG's daemons
+based on the [[https://git.gnupg.org/cgi-bin/gitweb.cgi?p%3Dgnupg.git%3Ba%3Dtree%3Bf%3Ddoc/examples/systemd-user%3Bh%3D2d589564e565b0b886d8c8d9071ca52290fb87e3%3Bhb%3Drefs/heads/master][reference implementation for starting GnuPG?s daemons
 from systemd]] that Daniel also contributed and is included in GnuPG
-proper.  Distributions are encouraged to base their systemd scripts on
-this implementation.
+proper.  Linux distributions that use systemd are encouraged to base
+their systemd unit files on this implementation.
 
 Justus also made significant improvements to our relatively new
-Scheme-based testing framework.  He's also written many new tests,
+Scheme-based testing framework.  He?s also written many new tests,
 fixed bugs in [[http://tinyscheme.sourceforge.net/][TinyScheme]], the Scheme interpreter that we are using,
-and radically improved TinyScheme's debugging facilities.
-Unfortunately, although he submitted some patches upstream, they have
-been mostly ignored.  Thus, if you are using TinyScheme, you might
-want to consider including our patches.
-
-We've decided to change the [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-December/032298.html][default expiration time for new keys to 2
+and radically improved TinyScheme?s debugging facilities.
+Furthermore, TinyScheme used to spent about 75% of the execution time
+in the garbage collector alone, now it typically spends less than 40%
+of the time in the memory allocator.  Unfortunately, although he
+submitted some patches upstream, they have been mostly ignored.  Thus,
+if you are using TinyScheme, you might want to consider including our
+patches.
+
+We?ve decided to change the [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-December/032298.html][default expiration time for new keys to 2
 years]].  (Previously, keys did not expire by default.)  Using an
 expiration provides an emergency break for users who lose access to
 their secret key material and any revocation certificate.  But note:
 just because a key has expired does not mean that one has to create a
-new key; it is entirely possible to extend a key's expiration, even
+new key; it is entirely possible to extend a key?s expiration, even
 after the key has expired.
 
 Another minor, but notable improvement that Justus implemented is to
-GnuPG's search algorithm.  Previously, when GnuPG searched for a key,
-[[https://bugs.gnupg.org/gnupg/issue2359][it took the first matching result even if a better result came later]].
-For instance, if searching for ~anna at example.org~, gpg would return
-the key for ~danna at example.org~ (a partial match) even if there was a
-key for ~anna at example.org~ latter (a complete match).  Justus changed
-gpg's behavior to [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-October/031994.html][take the best match instead of the first match]].
+GnuPG?s search algorithm.  Justus changed gpg?s behavior to [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-October/031994.html][take the
+best match instead of the first match]].
 
 Niibe has continued to polish the smart card support including
 improving support for v3 of the [[http://g10code.com/docs/openpgp-card-3.0.pdf][OpenPGPcard]] specification, and initial
@@ -66,7 +65,7 @@ by Arnaud Fontaine.
 Andre has made significant progress on GPGOL, our plugin for Outlook.
 He plans to release a beta in the coming week.  Part of this work
 included fleshing out [[https://wiki.gnupg.org/EasyGpg2016/AutomatedEncryption][how the automatic encryption system should work]],
-and thinking about what it can and cannot protect against.  We've
+and thinking about what it can and cannot protect against.  We?ve
 documented this in the wiki.  Comments (to the mailing list) are
 welcome!
 
@@ -83,13 +82,13 @@ This should make finding the bindings easier.
 There was also a discussion about [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-December/032366.html][the right way to deal with any
 missing dependencies (in particular, a sufficiently new GPGME) for the
 Python bindings]] when they are installed from pip.  Unfortunately, we
-don't have sufficient resources to properly package them so any users
+don?t have sufficient resources to properly package them so any users
 will need to make sure they have a recent operating system or build
 GPGME themselves.
 
 *** Releases
 
-We've released new versions of GPGME including [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000397.html][1.7.0]] and [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-November/032182.html][1.8.0]].  1.7.0
+We?ve released new versions of GPGME including [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000397.html][1.7.0]] and [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-November/032182.html][1.8.0]].  1.7.0
 includes our new [[https://gnupg.org/blog/20160921-python-bindings-for-gpgme.html][Python bindings for GPGME]], and 1.8.0 includes the
 renaming of the namespace from ~pyme3~ to ~gpg~.
 
@@ -97,26 +96,20 @@ The GnuPG proper saw two releases: version [[https://lists.gnupg.org/pipermail/g
 The latter was released exactly [[https://www.gnupg.org/download/release_notes.html#sec-1-2-70][19 years after Werner released version
 0.0.0]]!
 
-We released version 1.7.5 of [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000399.html][libgcrypt]], which includes an important
+We released version 1.7.5 of [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000399.html][Libgcrypt]], which includes an important
 bug fix for a [[https://bugs.gnupg.org/gnupg/issue2870][secure memory exhaustion regression]] ([[https://lists.gnupg.org/pipermail/gnupg-devel/2016-November/032157.html][see also this
 post]]), which was introduced in 1.7.4.
 
-And, [[http://scute.org][Scute]] version 1.5 was released.  Scute provides a [[https://en.wikipedia.org/wiki/PKCS_11][PKCS #11]]
-interface for security tokens.  This allow using a security token to,
-e.g., do client authentication over TLS (using [[https://en.wikipedia.org/wiki/Network_Security_Services][NSS]]), and document
-signing with LibreOffice.  Special thanks go to Damien Goutte-Gattat,
-who has helped take care of Scute!
-
 *** Public Appearances
 
 In October and November, I traveled a fair amount.  Before leaving, I
 contacted a few local groups about giving my "An Advanced Introduction
 to GnuPG" presentation.  In the end, I held it in New York City at the
-[[https://www.meetup.com/nylug-meetings/events/234083247/][NYLUG meetup]] ([[https://www.youtube.com/watch?v%3DfX0pgV8hPq8][recording]]), in Baltimore at [[https://www.acm.jhu.edu/][JHU's ACM chapter]], and in
+[[https://www.meetup.com/nylug-meetings/events/234083247/][NYLUG meetup]] ([[https://www.youtube.com/watch?v%3DfX0pgV8hPq8][recording]]), in Baltimore at [[https://www.acm.jhu.edu/][JHU?s ACM chapter]], and in
 San Francisco at [[https://www.meetup.com/de-DE/OpenLate/events/234006159/][OpenLate]], at [[https://noisebridge.net/wiki/Advanced_Introduction_to_GnuPG][NoiseBridge]], ([[https://begriffs.com/posts/2016-11-05-advanced-intro-gnupg.html][recording]]) and at the
 [[https://theintercept.com/][Intercept]].  The interest in GnuPG in New York is impressive: we filled
 the 150 person room and there was a waiting list.  The audience was
-also very engaged and asked many questions.  Joe Nelson's [[https://begriffs.com/posts/2016-11-05-advanced-intro-gnupg.html][recording at
+also very engaged and asked many questions.  Joe Nelson?s [[https://begriffs.com/posts/2016-11-05-advanced-intro-gnupg.html][recording at
 NoiseBridge]] is probably the best recording so far (I had a lapel mic
 and the slides were recorded separately).  If you are interested in
 seeing the presentation, that is the recording that I currently
@@ -127,13 +120,13 @@ While traveling, I also interviewed a number of GnuPG users
 donation campaign.  If you or your company/organization are willing to
 talk about how you use GnuPG on camera, [[http://k.gnupg.net/8F17777118A33DDA9BA48E62AACB3243630052D9][please get in touch with me]].
 
-At the end of December, I attended the [[https://events.ccc.de/tag/33c3/][CCC's annual congress]].  I
+At the end of December, I attended the [[https://events.ccc.de/tag/33c3/][CCC?s annual congress]].  I
 participated in a [[https://fossil.net2o.de/33c3/doc/trunk/wiki/panel.md][panel discussion]] with Volker Birk from [[https://pep.foundation/][pEp]] and
 Holger Krekel from [[https://github.com/autocrypt/autocrypt][Autocrypt]].  Unfortunately, we only had half an
 hour, which made the discussion rather superficial.  Other talks more
 or less related to GnuPG were presented in the [[https://fossil.net2o.de/33c3/doc/trunk/wiki/33c3.md][#wefixthenet session]].
 
-A few GnuPG team members will be present at this year's [[https://fosdem.org/2017/][FOSDEM]].  And,
+A few GnuPG team members will be present at this year?s [[https://fosdem.org/2017/][FOSDEM]].  And,
 I, Daniel, and some of the Autocrypt people attend the [[Internet%20Freedom%20Festival][Internet
 Freedom Festival]] in March in Valencia, Spain.
 
@@ -148,7 +141,7 @@ for macOSX Sierra]].
 
 [[http://autocrypt.readthedocs.io/en/latest/][Autocrypt]] is a new, loose knit group working on a new key discovery
 protocol for opportunistic encryption.  Autocrypt is different from
-WKD in that it transmits keys via email, and, as such, doesn't require
+WKD in that it transmits keys via email, and, as such, doesn?t require
 any new third-party infrastructure, but is more susceptible to attacks
 than WKD.  This approach is complementary to WKD, and similar to what
 pEp is doing.
@@ -160,7 +153,7 @@ to be to submit them as IETF internet drafts.
 
 [[https://supporters.eff.org/donate/eff-wired%20][The EFF expects surveillance and censorship to increase]] under
 President Trump.  And, the same appears to be inevitable in Great
-Britain with their recently introduced [[http://www.theregister.co.uk/2016/11/30/investigatory_powers_act_backdoors/][Snoopers' Charter]].  The EFF
+Britain with their recently introduced [[http://www.theregister.co.uk/2016/11/30/investigatory_powers_act_backdoors/][Snoopers? Charter]].  The EFF
 encourages technology companies to, among other things, improve their
 support for end-to-end encryption.  We agree, and add that even
 individuals can help: start using encryption tools, and, if you know
@@ -171,12 +164,12 @@ which got picked up by Ars Technica, and endorsed by [[https://twitter.com/matth
 [[https://www.schneier.com/blog/archives/2016/12/giving_up_on_pg.html][Bruce Schneier]] ([[https://www.schneier.com/blog/archives/2016/12/the_pro-pgp_pos.html][again]]).  [[http://arstechnica.com/information-technology/2016/12/signal-does-not-replace-pgp/][I composed a response]], which Ars Technica
 also carried.  In short, one of the major reasons that Filippo is
 giving up on PGP in favor of Signal and WhatsApp is due to the lack of
-forward secrecy.  It's true that OpenPGP doesn't support forward
+forward secrecy.  It?s true that OpenPGP doesn?t support forward
 secrecy (although it can be approximated with a bit of work).  But,
-it's not clear to us whether that should be the most important
+it?s not clear to us whether that should be the most important
 consideration.  We know from Snowden, that when properly implemented,
 "[[https://www.seas.harvard.edu/news/2015/01/reengineering-privacy-post-snowden][encryption ... really is one of the few things that we can rely on]]."
-In other words, when nation states crack encryption, they aren't
+In other words, when nation states crack encryption, they aren?t
 breaking the actual encryption, they are circumventing it.  Thus, if
 you are like Filippo and are really worried about something like an
 [[https://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html][evil maid attack]], then you are probably better off storing your
@@ -189,11 +182,7 @@ the Internet.  There are been other responses including those from
 [[https://www.mailpile.is/blog/2016-12-13_Too_Cool_for_PGP.html][Bjarni R?nar]] (Mailpile), [[http://sites.bu.edu/perryd/2016/12/17/rethinking-pgp-encryption/][Perry Donham]] (BU), and [[https://www.foo.be/2016/12/OpenPGP-really-works][Alexandre Dulaunoy]]
 ([[https://news.ycombinator.com/item?id%3D13301307][HN comments]]).
 
-Simon Josefsson recently posted an article about [[https://blog.josefsson.org/2016/11/03/why-i-dont-use-2048-or-4096-rsa-key-sizes/][why he doesn't use
-standard RSA key sizes]].  The formulation of the argument is similar to
-why [[https://weakdh.org/][using the same prime numbers for DH key exchange is a bad idea]].
-
-Tobias M?ller also wrote a blog post about his [[https://blogs.gnome.org/muelli/2016/10/first-openpgp-conf-2016-in-cologne-germany/][impressions of the
+Tobias M?ller recently wrote a blog post about his [[https://blogs.gnome.org/muelli/2016/10/first-openpgp-conf-2016-in-cologne-germany/][impressions of the
 OpenPGP conference]].
 
 [[https://www.fsf.org/blogs/licensing/the-licensing-and-compliance-lab-interviews-micah-lee-of-gpg-sync][Micah Lee was interviewed about his project about GPG Sync]] by the FSF.

commit 4c7f31f2ee54c21981134f8bbe9b79e2071a90ed
Author: Neal Walfield <neal at gnupg.org>
Date:   Mon Jan 16 21:41:12 2017 +0100

    blog: Add draft for status report.

diff --git a/misc/blog.gnupg.org/20170116-gnupg-this-past-fall.org b/misc/blog.gnupg.org/20170116-gnupg-this-past-fall.org
new file mode 100644
index 0000000..9027d51
--- /dev/null
+++ b/misc/blog.gnupg.org/20170116-gnupg-this-past-fall.org
@@ -0,0 +1,212 @@
+# GnuPG this Past Fall
+#+STARTUP: showall
+#+AUTHOR: Neal
+#+DATE: January 6, 2017
+
+** GnuPG this Past Fall
+
+*** Development
+
+The focus of development the past few months has been on polishing the
+GnuPG 2.1 code base so that we can release GnuPG 2.2.  This is
+particularly important to us, because we want the latest features to
+be available in the next release of Debian stable, which is about to
+freeze.  All of the main developers have participated in this effort,
+but I want to particularly point out Daniel Kahn Gillmor's many
+patches in this area.  Even prior to this effort, Daniel has regularly
+submitted patches for relatively minor, boring issues.  But, it is
+exactly these types of fixes that result in a polished product.
+
+A relatively major change that went into the most recent release of
+GnuPG is the replacement of ADNS with William Ahern's [[http://25thandclement.com/~william/projects/dns.c.html][libdns]].
+Unfortunately, our patches for Tor support for ADNS have been in limbo
+for such a long time, that [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-December/032350.html][we decided to change to a different DNS
+resolver]].
+
+Daniel Kahn Gillmor also helped implement and debug GnuPG's new
+supervisor mode.  This mode allows GnuPG's daemons to be auto-started
+and auto-stopped by systemd.  If you are tracking Debian testing or
+Debian unstable, you can try enabling this by following the
+instructions in ~/usr/share/doc/gnupg-agent/README.Debian~.  This is
+based on the [[https://git.gnupg.org/cgi-bin/gitweb.cgi?p%3Dgnupg.git%3Ba%3Dtree%3Bf%3Ddoc/examples/systemd-user%3Bh%3D2d589564e565b0b886d8c8d9071ca52290fb87e3%3Bhb%3Drefs/heads/master][reference implementation for starting GnuPG's daemons
+from systemd]] that Daniel also contributed and is included in GnuPG
+proper.  Distributions are encouraged to base their systemd scripts on
+this implementation.
+
+Justus also made significant improvements to our relatively new
+Scheme-based testing framework.  He's also written many new tests,
+fixed bugs in [[http://tinyscheme.sourceforge.net/][TinyScheme]], the Scheme interpreter that we are using,
+and radically improved TinyScheme's debugging facilities.
+Unfortunately, although he submitted some patches upstream, they have
+been mostly ignored.  Thus, if you are using TinyScheme, you might
+want to consider including our patches.
+
+We've decided to change the [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-December/032298.html][default expiration time for new keys to 2
+years]].  (Previously, keys did not expire by default.)  Using an
+expiration provides an emergency break for users who lose access to
+their secret key material and any revocation certificate.  But note:
+just because a key has expired does not mean that one has to create a
+new key; it is entirely possible to extend a key's expiration, even
+after the key has expired.
+
+Another minor, but notable improvement that Justus implemented is to
+GnuPG's search algorithm.  Previously, when GnuPG searched for a key,
+[[https://bugs.gnupg.org/gnupg/issue2359][it took the first matching result even if a better result came later]].
+For instance, if searching for ~anna at example.org~, gpg would return
+the key for ~danna at example.org~ (a partial match) even if there was a
+key for ~anna at example.org~ latter (a complete match).  Justus changed
+gpg's behavior to [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-October/031994.html][take the best match instead of the first match]].
+
+Niibe has continued to polish the smart card support including
+improving support for v3 of the [[http://g10code.com/docs/openpgp-card-3.0.pdf][OpenPGPcard]] specification, and initial
+support for [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-December/032403.html][multiple card readers]].  He has also reviewed and
+integrated a number of bugs fixes and small improvements contributed
+by Arnaud Fontaine.
+
+Andre has made significant progress on GPGOL, our plugin for Outlook.
+He plans to release a beta in the coming week.  Part of this work
+included fleshing out [[https://wiki.gnupg.org/EasyGpg2016/AutomatedEncryption][how the automatic encryption system should work]],
+and thinking about what it can and cannot protect against.  We've
+documented this in the wiki.  Comments (to the mailing list) are
+welcome!
+
+As usual, Jussi Kivilinna contributed a number of improvements to
+libgcrypt.  Alon Bar-Lev, a GnuPG maintainer for Gentoo, submitted a
+number of patches.  Mike Blumenkrantz contributed a new [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-October/031807.html][EFL-based
+pinentry]].  And, Tobias Mueller provided a number of improvements to
+the Python bindings.
+
+After a [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-October/031810.html][long discussion]], we decided to change the Python GPGME
+bindings to use the [[https://pypi.python.org/pypi/gpg][~gpg~]] namespace instead of the ~pyme3~ namespace.
+This should make finding the bindings easier.
+
+There was also a discussion about [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-December/032366.html][the right way to deal with any
+missing dependencies (in particular, a sufficiently new GPGME) for the
+Python bindings]] when they are installed from pip.  Unfortunately, we
+don't have sufficient resources to properly package them so any users
+will need to make sure they have a recent operating system or build
+GPGME themselves.
+
+*** Releases
+
+We've released new versions of GPGME including [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000397.html][1.7.0]] and [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-November/032182.html][1.8.0]].  1.7.0
+includes our new [[https://gnupg.org/blog/20160921-python-bindings-for-gpgme.html][Python bindings for GPGME]], and 1.8.0 includes the
+renaming of the namespace from ~pyme3~ to ~gpg~.
+
+The GnuPG proper saw two releases: version [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000398.html][2.1.16]] and version [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000398.html][2.1.17]].
+The latter was released exactly [[https://www.gnupg.org/download/release_notes.html#sec-1-2-70][19 years after Werner released version
+0.0.0]]!
+
+We released version 1.7.5 of [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000399.html][libgcrypt]], which includes an important
+bug fix for a [[https://bugs.gnupg.org/gnupg/issue2870][secure memory exhaustion regression]] ([[https://lists.gnupg.org/pipermail/gnupg-devel/2016-November/032157.html][see also this
+post]]), which was introduced in 1.7.4.
+
+And, [[http://scute.org][Scute]] version 1.5 was released.  Scute provides a [[https://en.wikipedia.org/wiki/PKCS_11][PKCS #11]]
+interface for security tokens.  This allow using a security token to,
+e.g., do client authentication over TLS (using [[https://en.wikipedia.org/wiki/Network_Security_Services][NSS]]), and document
+signing with LibreOffice.  Special thanks go to Damien Goutte-Gattat,
+who has helped take care of Scute!
+
+*** Public Appearances
+
+In October and November, I traveled a fair amount.  Before leaving, I
+contacted a few local groups about giving my "An Advanced Introduction
+to GnuPG" presentation.  In the end, I held it in New York City at the
+[[https://www.meetup.com/nylug-meetings/events/234083247/][NYLUG meetup]] ([[https://www.youtube.com/watch?v%3DfX0pgV8hPq8][recording]]), in Baltimore at [[https://www.acm.jhu.edu/][JHU's ACM chapter]], and in
+San Francisco at [[https://www.meetup.com/de-DE/OpenLate/events/234006159/][OpenLate]], at [[https://noisebridge.net/wiki/Advanced_Introduction_to_GnuPG][NoiseBridge]], ([[https://begriffs.com/posts/2016-11-05-advanced-intro-gnupg.html][recording]]) and at the
+[[https://theintercept.com/][Intercept]].  The interest in GnuPG in New York is impressive: we filled
+the 150 person room and there was a waiting list.  The audience was
+also very engaged and asked many questions.  Joe Nelson's [[https://begriffs.com/posts/2016-11-05-advanced-intro-gnupg.html][recording at
+NoiseBridge]] is probably the best recording so far (I had a lapel mic
+and the slides were recorded separately).  If you are interested in
+seeing the presentation, that is the recording that I currently
+recommend.
+
+While traveling, I also interviewed a number of GnuPG users
+(journalists, lawyers, activists, and companies) for our upcoming
+donation campaign.  If you or your company/organization are willing to
+talk about how you use GnuPG on camera, [[http://k.gnupg.net/8F17777118A33DDA9BA48E62AACB3243630052D9][please get in touch with me]].
+
+At the end of December, I attended the [[https://events.ccc.de/tag/33c3/][CCC's annual congress]].  I
+participated in a [[https://fossil.net2o.de/33c3/doc/trunk/wiki/panel.md][panel discussion]] with Volker Birk from [[https://pep.foundation/][pEp]] and
+Holger Krekel from [[https://github.com/autocrypt/autocrypt][Autocrypt]].  Unfortunately, we only had half an
+hour, which made the discussion rather superficial.  Other talks more
+or less related to GnuPG were presented in the [[https://fossil.net2o.de/33c3/doc/trunk/wiki/33c3.md][#wefixthenet session]].
+
+A few GnuPG team members will be present at this year's [[https://fosdem.org/2017/][FOSDEM]].  And,
+I, Daniel, and some of the Autocrypt people attend the [[Internet%20Freedom%20Festival][Internet
+Freedom Festival]] in March in Valencia, Spain.
+
+*** Ecosystem
+
+[[https://www.openkeychain.org/k-9-5.200][K9]] had a major release (5.2) with significantly better OpenPGP
+support.  Of particular note is support for PGP/MIME.
+Congratulations!
+
+The developers of GPGTools have released a [[https://gpgtools.tenderapp.com/discussions/problems/49449-will-not-work-on-macosx-sierra][beta version of GPGTools
+for macOSX Sierra]].
+
+[[http://autocrypt.readthedocs.io/en/latest/][Autocrypt]] is a new, loose knit group working on a new key discovery
+protocol for opportunistic encryption.  Autocrypt is different from
+WKD in that it transmits keys via email, and, as such, doesn't require
+any new third-party infrastructure, but is more susceptible to attacks
+than WKD.  This approach is complementary to WKD, and similar to what
+pEp is doing.
+
+pEp has also begun to [[https://letsencrypt.pep.foundation/dev/repos/internet-drafts/][document their protocols]].  Their intent appears
+to be to submit them as IETF internet drafts.
+
+*** Press
+
+[[https://supporters.eff.org/donate/eff-wired%20][The EFF expects surveillance and censorship to increase]] under
+President Trump.  And, the same appears to be inevitable in Great
+Britain with their recently introduced [[http://www.theregister.co.uk/2016/11/30/investigatory_powers_act_backdoors/][Snoopers' Charter]].  The EFF
+encourages technology companies to, among other things, improve their
+support for end-to-end encryption.  We agree, and add that even
+individuals can help: start using encryption tools, and, if you know
+how, volunteer at a local [[https://www.cryptoparty.in/][CryptoParty]].
+
+Filippo Valsorda wrote an article about [[http://arstechnica.com/security/2016/12/op-ed-im-giving-up-on-pgp/][why he is giving up on PGP]],
+which got picked up by Ars Technica, and endorsed by [[https://twitter.com/matthew_d_green/status/806135647199252480][Matthew Green]] and
+[[https://www.schneier.com/blog/archives/2016/12/giving_up_on_pg.html][Bruce Schneier]] ([[https://www.schneier.com/blog/archives/2016/12/the_pro-pgp_pos.html][again]]).  [[http://arstechnica.com/information-technology/2016/12/signal-does-not-replace-pgp/][I composed a response]], which Ars Technica
+also carried.  In short, one of the major reasons that Filippo is
+giving up on PGP in favor of Signal and WhatsApp is due to the lack of
+forward secrecy.  It's true that OpenPGP doesn't support forward
+secrecy (although it can be approximated with a bit of work).  But,
+it's not clear to us whether that should be the most important
+consideration.  We know from Snowden, that when properly implemented,
+"[[https://www.seas.harvard.edu/news/2015/01/reengineering-privacy-post-snowden][encryption ... really is one of the few things that we can rely on]]."
+In other words, when nation states crack encryption, they aren't
+breaking the actual encryption, they are circumventing it.  Thus, if
+you are like Filippo and are really worried about something like an
+[[https://www.schneier.com/blog/archives/2009/10/evil_maid_attac.html][evil maid attack]], then you are probably better off storing your
+encryption keys on a smart card, which is something that GnuPG
+supports, but Signal does not.  Another major problem with Signal,
+which Filippo does not address, is its use of telephone numbers as
+identifiers.  This seriously undermines anonymity, and makes
+harassment easier, which is a particular problem for women who post on
+the Internet.  There are been other responses including those from
+[[https://www.mailpile.is/blog/2016-12-13_Too_Cool_for_PGP.html][Bjarni R?nar]] (Mailpile), [[http://sites.bu.edu/perryd/2016/12/17/rethinking-pgp-encryption/][Perry Donham]] (BU), and [[https://www.foo.be/2016/12/OpenPGP-really-works][Alexandre Dulaunoy]]
+([[https://news.ycombinator.com/item?id%3D13301307][HN comments]]).
+
+Simon Josefsson recently posted an article about [[https://blog.josefsson.org/2016/11/03/why-i-dont-use-2048-or-4096-rsa-key-sizes/][why he doesn't use
+standard RSA key sizes]].  The formulation of the argument is similar to
+why [[https://weakdh.org/][using the same prime numbers for DH key exchange is a bad idea]].
+
+Tobias M?ller also wrote a blog post about his [[https://blogs.gnome.org/muelli/2016/10/first-openpgp-conf-2016-in-cologne-germany/][impressions of the
+OpenPGP conference]].
+
+[[https://www.fsf.org/blogs/licensing/the-licensing-and-compliance-lab-interviews-micah-lee-of-gpg-sync][Micah Lee was interviewed about his project about GPG Sync]] by the FSF.
+
+Heise published an article with [[https://www.heise.de/download/specials/E-Mails-mit-PGP-verschluesseln-3342397][tips for encrypting emails]] (in
+German).
+
+LinuxFR published a primer covering [[http://linuxfr.org/users/gouttegd/journaux/de-la-confiance-dans-le-monde-openpgp][key validity and trust models]],
+including TOFU (in French).  And, NextInpact published an article with
+[[https://www.nextinpact.com/news/98509-openpgp-et-gnupg-25-ans-chiffrement-pour-tous-ce-quil-faut-savoir-avant-sy-mettre.htm][a brief history of PGP and GnuPG, a number of tips for using GnuPG,
+and some tradeoffs]] (in French).
+
+*** Donations
+
+We recently received [[https://lists.gnupg.org/pipermail/gnupg-devel/2016-November/032211.html][an account statement]] from the Wau Holland
+foundation on the GnuPG account that they manage for us.

-----------------------------------------------------------------------

Summary of changes:
 .../20170116-gnupg-this-past-fall.org              | 201 +++++++++++++++++++++
 1 file changed, 201 insertions(+)
 create mode 100644 misc/blog.gnupg.org/20170116-gnupg-this-past-fall.org


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 17 05:39:34 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 17 Jan 2017 05:39:34 +0100
Subject: [git] Poldi - branch, master, updated. release-0.4.1-52-gd9a9ff9
Message-ID: <E1cTLYW-0007nP-4p@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PAM for the OpenPGP card".

The branch, master has been updated
       via  d9a9ff970ecbc57758a243858d30cbb398b7315e (commit)
      from  553060d8bbaac1381d0501b4525f4b102ccd3324 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d9a9ff970ecbc57758a243858d30cbb398b7315e
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jan 17 13:38:45 2017 +0900

    Fix pclose.
    
    * src/scd/scd.c (get_agent_socket_name): Use pclose.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/src/scd/scd.c b/src/scd/scd.c
index 5d1b835..a53195c 100644
--- a/src/scd/scd.c
+++ b/src/scd/scd.c
@@ -119,7 +119,7 @@ get_agent_socket_name (char **gpg_agent_sockname)
     }
 
   len = fread (result, 1, 256, input);
-  fclose (input);
+  pclose (input);
 
   if (len)
     {

-----------------------------------------------------------------------

Summary of changes:
 src/scd/scd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
PAM for the OpenPGP card
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 17 10:29:35 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 17 Jan 2017 10:29:35 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-81-g3563237
Message-ID: <E1cTQ5D-0002cC-Hg@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  356323768a1a29138581d0aceed0336ab8be0d5c (commit)
       via  766c25018b288a7185c6da6adac0dec01a64e94a (commit)
       via  bae42e543799a428e59bad870aed9719dd6e6e45 (commit)
       via  adbfbf608e75cdd72ae7b3a538b91bc0e236a18f (commit)
      from  e6aebfe3d0f16c483296fd125b66a44017fe15f4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 356323768a1a29138581d0aceed0336ab8be0d5c
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 17 10:26:34 2017 +0100

    gpg: Clean bogus subkey binding when cleaning a key.
    
    * g10/trust.c (clean_key): Also clean bogus subkey bindings.
    --
    
    GnuPG-bug-id: 2922
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/export.c b/g10/export.c
index ad42b41..b36200a 100644
--- a/g10/export.c
+++ b/g10/export.c
@@ -1518,6 +1518,7 @@ do_export_one_keyblock (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid,
   u32 subkidbuf[2], *subkid;
   kbnode_t kbctx, node;
 
+  /* NB: walk_kbnode skips packets marked as deleted.  */
   for (kbctx=NULL; (node = walk_kbnode (keyblock, &kbctx, 0)); )
     {
       if (skip_until_subkey)
diff --git a/g10/trust.c b/g10/trust.c
index 1024448..888b4ca 100644
--- a/g10/trust.c
+++ b/g10/trust.c
@@ -756,21 +756,41 @@ clean_one_uid (kbnode_t keyblock, kbnode_t uidnode, int noisy, int self_only,
 }
 
 
+/* NB: This function marks the deleted nodes only and the caller is
+ * responsible to skip or remove them.  */
 void
 clean_key (kbnode_t keyblock, int noisy, int self_only,
            int *uids_cleaned, int *sigs_cleaned)
 {
-  kbnode_t uidnode;
+  kbnode_t node;
 
   merge_keys_and_selfsig (keyblock);
 
-  for (uidnode = keyblock->next;
-       uidnode && !(uidnode->pkt->pkttype == PKT_PUBLIC_SUBKEY
-                    || uidnode->pkt->pkttype == PKT_SECRET_SUBKEY);
-       uidnode = uidnode->next)
+  for (node = keyblock->next;
+       node && !(node->pkt->pkttype == PKT_PUBLIC_SUBKEY
+                    || node->pkt->pkttype == PKT_SECRET_SUBKEY);
+       node = node->next)
     {
-      if (uidnode->pkt->pkttype == PKT_USER_ID)
-        clean_one_uid (keyblock, uidnode,noisy, self_only,
+      if (node->pkt->pkttype == PKT_USER_ID)
+        clean_one_uid (keyblock, node, noisy, self_only,
                        uids_cleaned, sigs_cleaned);
     }
+
+  /* Remove bogus subkey binding signatures: The only signatures
+   * allowed are of class 0x18 and 0x28.  */
+  log_assert (!node || (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
+                        || node->pkt->pkttype == PKT_SECRET_SUBKEY));
+  for (; node; node = node->next)
+    {
+      if (is_deleted_kbnode (node))
+        continue;
+      if (node->pkt->pkttype == PKT_SIGNATURE
+          && !(IS_SUBKEY_SIG (node->pkt->pkt.signature)
+                || IS_SUBKEY_REV (node->pkt->pkt.signature)))
+        {
+          delete_kbnode (node);
+          if (sigs_cleaned)
+            ++*sigs_cleaned;
+        }
+    }
 }

commit 766c25018b288a7185c6da6adac0dec01a64e94a
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 17 10:23:52 2017 +0100

    gpg: Sync print of additional sig data in --edit-key.
    
    * g10/keylist.c (show_policy_url): Implement MODE -1.
    (show_keyserver_url): Ditto.
    (show_notation): Ditto.
    * g10/keyedit.c (print_one_sig): Print policy URL, keyserver URL and
    notation data to the tty.
    --
    
    With this change the listing of signatures in the key edit menu does
    now include policy URLs et al in order and not possible after leaving
    the menu (it used to go to stdout and not the tty).
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/keyedit.c b/g10/keyedit.c
index dadf586..1456d28 100644
--- a/g10/keyedit.c
+++ b/g10/keyedit.c
@@ -281,11 +281,11 @@ print_one_sig (int rc, KBNODE keyblock, KBNODE node,
 
       if (sig->flags.policy_url
           && ((opt.list_options & LIST_SHOW_POLICY_URLS) || extended))
-	show_policy_url (sig, 3, 0);
+	show_policy_url (sig, 3, -1);
 
       if (sig->flags.notation
           && ((opt.list_options & LIST_SHOW_NOTATIONS) || extended))
-	show_notation (sig, 3, 0,
+	show_notation (sig, 3, -1,
 		       ((opt.
 			 list_options & LIST_SHOW_STD_NOTATIONS) ? 1 : 0) +
 		       ((opt.
@@ -293,7 +293,7 @@ print_one_sig (int rc, KBNODE keyblock, KBNODE node,
 
       if (sig->flags.pref_ks
           && ((opt.list_options & LIST_SHOW_KEYSERVER_URLS) || extended))
-	show_keyserver_url (sig, 3, 0);
+	show_keyserver_url (sig, 3, -1);
 
       if (extended)
         {
diff --git a/g10/keylist.c b/g10/keylist.c
index a5fdc06..4fe1e40 100644
--- a/g10/keylist.c
+++ b/g10/keylist.c
@@ -304,6 +304,7 @@ status_one_subpacket (sigsubpkttype_t type, size_t len, int flags,
 
 
 /* Print a policy URL.  Allowed values for MODE are:
+ *  -1 - print to the TTY
  *   0 - print to stdout.
  *   1 - use log_info and emit status messages.
  *   2 - emit only status messages.
@@ -314,50 +315,48 @@ show_policy_url (PKT_signature * sig, int indent, int mode)
   const byte *p;
   size_t len;
   int seq = 0, crit;
-  estream_t fp = mode ? log_get_stream () : es_stdout;
+  estream_t fp = mode < 0? NULL : mode ? log_get_stream () : es_stdout;
 
   while ((p =
 	  enum_sig_subpkt (sig->hashed, SIGSUBPKT_POLICY, &len, &seq, &crit)))
     {
       if (mode != 2)
 	{
-	  int i;
 	  const char *str;
 
-	  for (i = 0; i < indent; i++)
-	    es_putc (' ', fp);
+          tty_fprintf (fp, "%*s", indent, "");
 
 	  if (crit)
 	    str = _("Critical signature policy: ");
 	  else
 	    str = _("Signature policy: ");
-	  if (mode)
+	  if (mode > 0)
 	    log_info ("%s", str);
 	  else
-	    es_fprintf (fp, "%s", str);
-	  print_utf8_buffer (fp, p, len);
-	  es_fprintf (fp, "\n");
+	    tty_fprintf (fp, "%s", str);
+	  tty_print_utf8_string2 (fp, p, len, 0);
+	  tty_fprintf (fp, "\n");
 	}
 
-      if (mode)
+      if (mode > 0)
 	write_status_buffer (STATUS_POLICY_URL, p, len, 0);
     }
 }
 
 
-/*
-  mode=0 for stdout.
-  mode=1 for log_info + status messages
-  mode=2 for status messages only
-*/
-/* TODO: use this */
+/* Print a keyserver URL.  Allowed values for MODE are:
+ *  -1 - print to the TTY
+ *   0 - print to stdout.
+ *   1 - use log_info and emit status messages.
+ *   2 - emit only status messages.
+ */
 void
 show_keyserver_url (PKT_signature * sig, int indent, int mode)
 {
   const byte *p;
   size_t len;
   int seq = 0, crit;
-  estream_t fp = mode ? log_get_stream () : es_stdout;
+  estream_t fp = mode < 0? NULL : mode ? log_get_stream () : es_stdout;
 
   while ((p =
 	  enum_sig_subpkt (sig->hashed, SIGSUBPKT_PREF_KS, &len, &seq,
@@ -365,43 +364,43 @@ show_keyserver_url (PKT_signature * sig, int indent, int mode)
     {
       if (mode != 2)
 	{
-	  int i;
 	  const char *str;
 
-	  for (i = 0; i < indent; i++)
-	    es_putc (' ', es_stdout);
+          tty_fprintf (fp, "%*s", indent, "");
 
 	  if (crit)
 	    str = _("Critical preferred keyserver: ");
 	  else
 	    str = _("Preferred keyserver: ");
-	  if (mode)
+	  if (mode > 0)
 	    log_info ("%s", str);
 	  else
-	    es_fprintf (es_stdout, "%s", str);
-	  print_utf8_buffer (fp, p, len);
-	  es_fprintf (fp, "\n");
+	    tty_fprintf (es_stdout, "%s", str);
+	  tty_print_utf8_string2 (fp, p, len, 0);
+	  tty_fprintf (fp, "\n");
 	}
 
-      if (mode)
+      if (mode > 0)
 	status_one_subpacket (SIGSUBPKT_PREF_KS, len,
 			      (crit ? 0x02 : 0) | 0x01, p);
     }
 }
 
-/*
-  mode=0 for stdout.
-  mode=1 for log_info + status messages
-  mode=2 for status messages only
-
-  Defined bits in WHICH:
-    1 == standard notations
-    2 == user notations
-*/
+
+/* Print notation data.  Allowed values for MODE are:
+ *  -1 - print to the TTY
+ *   0 - print to stdout.
+ *   1 - use log_info and emit status messages.
+ *   2 - emit only status messages.
+ *
+ * Defined bits in WHICH:
+ *   1 - standard notations
+ *   2 - user notations
+ */
 void
 show_notation (PKT_signature * sig, int indent, int mode, int which)
 {
-  estream_t fp = mode ? log_get_stream () : es_stdout;
+  estream_t fp = mode < 0? NULL : mode ? log_get_stream () : es_stdout;
   notation_t nd, notations;
 
   if (which == 0)
@@ -418,34 +417,32 @@ show_notation (PKT_signature * sig, int indent, int mode, int which)
 
 	  if ((which & 1 && !has_at) || (which & 2 && has_at))
 	    {
-	      int i;
 	      const char *str;
 
-	      for (i = 0; i < indent; i++)
-		es_putc (' ', es_stdout);
+              tty_fprintf (fp, "%*s", indent, "");
 
 	      if (nd->flags.critical)
 		str = _("Critical signature notation: ");
 	      else
 		str = _("Signature notation: ");
-	      if (mode)
+	      if (mode > 0)
 		log_info ("%s", str);
 	      else
-		es_fprintf (es_stdout, "%s", str);
+		tty_fprintf (es_stdout, "%s", str);
 	      /* This is all UTF8 */
-	      print_utf8_buffer (fp, nd->name, strlen (nd->name));
-	      es_fprintf (fp, "=");
-	      print_utf8_buffer (fp, nd->value, strlen (nd->value));
+	      tty_print_utf8_string2 (fp, nd->name, strlen (nd->name), 0);
+	      tty_fprintf (fp, "=");
+	      tty_print_utf8_string2 (fp, nd->value, strlen (nd->value), 0);
               /* (We need to use log_printf so that the next call to a
                   log function does not insert an extra LF.)  */
-              if (mode)
+              if (mode > 0)
                 log_printf ("\n");
               else
-                es_putc ('\n', fp);
+                tty_fprintf (fp, "\n");
 	    }
 	}
 
-      if (mode)
+      if (mode > 0)
 	{
 	  write_status_buffer (STATUS_NOTATION_NAME,
 			       nd->name, strlen (nd->name), 0);

commit bae42e543799a428e59bad870aed9719dd6e6e45
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 17 10:19:06 2017 +0100

    common: Remove unused function tty_print_string.
    
    * common/ttyio.c (tty_print_string): Rename to ...
    (do_print_string): this.  Make local.  Simplify FP case by using
    print_utf8_buffer.  Change caller.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/ttyio.c b/common/ttyio.c
index 5fb620d..29af1b3 100644
--- a/common/ttyio.c
+++ b/common/ttyio.c
@@ -309,95 +309,59 @@ tty_fprintf (estream_t fp, const char *fmt, ... )
 }
 
 
-/****************
- * Print a string, but filter all control characters out.  If FP is
- * not NULL print to that stream instead to the tty.
- */
-void
-tty_print_string (estream_t fp, const byte *p, size_t n )
+/* Print a string, but filter all control characters out.  If FP is
+ * not NULL print to that stream instead to the tty.  */
+static void
+do_print_string (estream_t fp, const byte *p, size_t n )
 {
-    if (no_terminal && !fp)
-	return;
+  if (no_terminal && !fp)
+    return;
 
-    if( !initialized & !fp)
-	init_ttyfp();
+  if (!initialized && !fp)
+    init_ttyfp();
+
+  if (fp)
+    {
+      print_utf8_buffer (fp, p, n);
+      return;
+    }
 
 #ifdef USE_W32_CONSOLE
-    /* not so effective, change it if you want */
-    if (fp)
-      {
-        for( ; n; n--, p++ )
-          {
-            if( iscntrl( *p ) )
-              {
-                if( *p == '\n' )
-                  tty_fprintf (fp, "\\n");
-                else if( !*p )
-                  tty_fprintf (fp, "\\0");
-                else
-                  tty_fprintf (fp, "\\x%02x", *p);
-              }
-            else
-              tty_fprintf (fp, "%c", *p);
-          }
-      }
-    else
-      {
-        for( ; n; n--, p++ )
-          {
-            if( iscntrl( *p ) )
-              {
-                if( *p == '\n' )
-                  tty_printf ("\\n");
-                else if( !*p )
-                  tty_printf ("\\0");
-                else
-                  tty_printf ("\\x%02x", *p);
-              }
-            else
-              tty_printf ("%c", *p);
-          }
-      }
+  /* Not so effective, change it if you want */
+  for (; n; n--, p++)
+    {
+      if (iscntrl (*p))
+        {
+          if( *p == '\n' )
+            tty_printf ("\\n");
+          else if( !*p )
+            tty_printf ("\\0");
+          else
+            tty_printf ("\\x%02x", *p);
+        }
+      else
+        tty_printf ("%c", *p);
+    }
 #else
-    if (fp)
-      {
-        for( ; n; n--, p++ )
-          {
-            if (iscntrl (*p))
-              {
-                es_putc ('\\', fp);
-                if ( *p == '\n' )
-                  es_putc ('n', fp);
-                else if ( !*p )
-                  es_putc ('0', fp);
-                else
-                  es_fprintf (fp, "x%02x", *p);
-              }
-            else
-              es_putc (*p, fp);
-          }
-      }
-    else
-      {
-        for (; n; n--, p++)
-          {
-            if (iscntrl (*p))
-              {
-                putc ('\\', ttyfp);
-                if ( *p == '\n' )
-                  putc ('n', ttyfp);
-                else if ( !*p )
-                  putc ('0', ttyfp);
-                else
-                  fprintf (ttyfp, "x%02x", *p );
-              }
-            else
-              putc (*p, ttyfp);
-          }
-      }
+  for (; n; n--, p++)
+    {
+      if (iscntrl (*p))
+        {
+          putc ('\\', ttyfp);
+          if ( *p == '\n' )
+            putc ('n', ttyfp);
+          else if ( !*p )
+            putc ('0', ttyfp);
+          else
+            fprintf (ttyfp, "x%02x", *p );
+        }
+      else
+        putc (*p, ttyfp);
+    }
 #endif
 }
 
+
 void
 tty_print_utf8_string2 (estream_t fp, const byte *p, size_t n, size_t max_n)
 {
@@ -425,7 +389,7 @@ tty_print_utf8_string2 (estream_t fp, const byte *p, size_t n, size_t max_n)
 	if( max_n && (n > max_n) ) {
 	    n = max_n;
 	}
-	tty_print_string (fp, p, n );
+	do_print_string (fp, p, n );
     }
 }
 
diff --git a/common/ttyio.h b/common/ttyio.h
index 004aa85..5bff82f 100644
--- a/common/ttyio.h
+++ b/common/ttyio.h
@@ -47,7 +47,6 @@ void tty_printf (const char *fmt, ... );
 void tty_fprintf (estream_t fp, const char *fmt, ... );
 char *tty_getf (const char *promptfmt, ... );
 #endif
-void tty_print_string (estream_t fp, const unsigned char *p, size_t n);
 void tty_print_utf8_string (const unsigned char *p, size_t n);
 void tty_print_utf8_string2 (estream_t fp,
                              const unsigned char *p, size_t n, size_t max_n);

commit adbfbf608e75cdd72ae7b3a538b91bc0e236a18f
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 17 09:14:44 2017 +0100

    gpg: Prepare some key cleaning function for use with secret key packets.
    
    * g10/trust.c (mark_usable_uid_certs): Allow use of secret key packets.
    (clean_sigs_from_uid): Ditto.
    (clean_uid_from_key): Ditto.
    (clean_one_uid): Ditto.
    (clean_key): Ditto.
    --
    
    Since 2.1 secret keys and public keys use identical data structure and
    thus we should not restrict those key cleaning functions to work only
    with public key packets.  This change has no immediate effect but may
    come handy in the future.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/trust.c b/g10/trust.c
index 080926a..1024448 100644
--- a/g10/trust.c
+++ b/g10/trust.c
@@ -434,7 +434,8 @@ mark_usable_uid_certs (kbnode_t keyblock, kbnode_t uidnode,
 
       node->flag &= ~(1<<8 | 1<<9 | 1<<10 | 1<<11 | 1<<12);
       if (node->pkt->pkttype == PKT_USER_ID
-          || node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
+          || node->pkt->pkttype == PKT_PUBLIC_SUBKEY
+          || node->pkt->pkttype == PKT_SECRET_SUBKEY)
         break; /* ready */
       if (node->pkt->pkttype != PKT_SIGNATURE)
         continue;
@@ -476,7 +477,8 @@ mark_usable_uid_certs (kbnode_t keyblock, kbnode_t uidnode,
       u32 kid[2];
       u32 sigdate;
 
-      if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
+      if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
+          || node->pkt->pkttype == PKT_SECRET_SUBKEY)
         break;
       if ( !(node->flag & (1<<9)) )
         continue; /* not a node to look at */
@@ -491,7 +493,8 @@ mark_usable_uid_certs (kbnode_t keyblock, kbnode_t uidnode,
       /* Now find the latest and greatest signature */
       for (n=uidnode->next; n; n = n->next)
         {
-          if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY)
+          if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY
+              || n->pkt->pkttype == PKT_SECRET_SUBKEY)
             break;
           if ( !(n->flag & (1<<9)) )
             continue;
@@ -588,7 +591,8 @@ clean_sigs_from_uid (kbnode_t keyblock, kbnode_t uidnode,
   kbnode_t node;
   u32 keyid[2];
 
-  log_assert (keyblock->pkt->pkttype==PKT_PUBLIC_KEY);
+  log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY
+              || keyblock->pkt->pkttype == PKT_SECRET_KEY);
 
   keyid_from_pk (keyblock->pkt->pkt.public_key, keyid);
 
@@ -681,7 +685,8 @@ clean_uid_from_key (kbnode_t keyblock, kbnode_t uidnode, int noisy)
   PKT_user_id *uid = uidnode->pkt->pkt.user_id;
   int deleted = 0;
 
-  log_assert (keyblock->pkt->pkttype==PKT_PUBLIC_KEY);
+  log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY
+              || keyblock->pkt->pkttype == PKT_SECRET_KEY);
   log_assert (uidnode->pkt->pkttype==PKT_USER_ID);
 
   /* Skip valid user IDs, compacted user IDs, and non-self-signed user
@@ -733,7 +738,8 @@ clean_one_uid (kbnode_t keyblock, kbnode_t uidnode, int noisy, int self_only,
 {
   int dummy = 0;
 
-  log_assert (keyblock->pkt->pkttype==PKT_PUBLIC_KEY);
+  log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY
+              || keyblock->pkt->pkttype == PKT_SECRET_KEY);
   log_assert (uidnode->pkt->pkttype==PKT_USER_ID);
 
   if (!uids_cleaned)
@@ -759,7 +765,8 @@ clean_key (kbnode_t keyblock, int noisy, int self_only,
   merge_keys_and_selfsig (keyblock);
 
   for (uidnode = keyblock->next;
-       uidnode && uidnode->pkt->pkttype != PKT_PUBLIC_SUBKEY;
+       uidnode && !(uidnode->pkt->pkttype == PKT_PUBLIC_SUBKEY
+                    || uidnode->pkt->pkttype == PKT_SECRET_SUBKEY);
        uidnode = uidnode->next)
     {
       if (uidnode->pkt->pkttype == PKT_USER_ID)

-----------------------------------------------------------------------

Summary of changes:
 common/ttyio.c | 128 +++++++++++++++++++++------------------------------------
 common/ttyio.h |   1 -
 g10/export.c   |   1 +
 g10/keyedit.c  |   6 +--
 g10/keylist.c  |  87 +++++++++++++++++++--------------------
 g10/trust.c    |  51 +++++++++++++++++------
 6 files changed, 131 insertions(+), 143 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 17 11:56:55 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Tue, 17 Jan 2017 11:56:55 +0100
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-256-gafb10a7
Message-ID: <E1cTRRh-0006Bl-0m@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  afb10a7a8b17f0e0028b43ae4d9c613bbecc4c18 (commit)
       via  13380236374cbfbc7eb0558ba3377ddad0d32adc (commit)
      from  fdc2575c657abd4e7630cbb1461a9f270ea2046a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit afb10a7a8b17f0e0028b43ae4d9c613bbecc4c18
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Tue Jan 17 11:55:55 2017 +0100

    Update translations and add german translation
    
    * po/de.po: Translate
    * po/fr.po, po/pt.po, po/sv.po, po/zh_CN.po, po/zh_TW.po: Auto update.

diff --git a/po/de.po b/po/de.po
index 18c0269..2be8a89 100644
--- a/po/de.po
+++ b/po/de.po
@@ -3,13 +3,13 @@
 # This file is distributed under the same license as the GpgOL package.
 #
 # Werner Koch <wk at gnupg.org>, 2005, 2007.
-# Andre Heinecke <andre.heinecke at intevation.de>, 2016.
+# Andre Heinecke <andre.heinecke at intevation.de>, 2016, 2017.
 msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL 1.0.0\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2017-01-13 15:34+0100\n"
-"PO-Revision-Date: 2016-11-14 15:02+0100\n"
+"POT-Creation-Date: 2017-01-17 11:54+0100\n"
+"PO-Revision-Date: 2017-01-17 11:54+0100\n"
 "Last-Translator: Andre Heinecke <andre.heinecke at intevation.de>\n"
 "Language-Team: American English <kde-i18n-doc at kde.org>\n"
 "Language: en_US\n"
@@ -45,32 +45,35 @@ msgid "&Sign new messages by default"
 msgstr "Neue Nachrichten per Voreinstellung signieren"
 
 #: src/addin-options.cpp:45
-#, fuzzy
 msgid "&Send OpenPGP mails without attachments as PGP/Inline"
-msgstr "&OpenPGP mails ohne Anh?nge als inline-pgp verschl?sseln"
+msgstr "&OpenPGP Nachrichten ohne Anh?nge als PGP/Inline verschl?sseln"
+
+#: src/addin-options.cpp:47
+msgid "S&elect crypto settings automatically for reply and foward."
+msgstr "Krypto &Einstellungen beim Antworten und weiterleiten ?bernehmen."
 
-#: src/addin-options.cpp:50
+#: src/addin-options.cpp:52
 msgid "Debug..."
 msgstr "Debug..."
 
-#: src/addin-options.cpp:51
+#: src/addin-options.cpp:53
 msgid "Configure GnuPG"
 msgstr "GnuPG konfigurieren "
 
-#: src/addin-options.cpp:52
+#: src/addin-options.cpp:54
 msgid "Version "
 msgstr "Version"
 
-#: src/addin-options.cpp:128
+#: src/addin-options.cpp:132
 msgid "Changing the interface requires a restart of Outlook."
 msgstr "Die Benutzeroberfl?che zu ?ndern erfordert einen Neustart von Outlook"
 
-#: src/addin-options.cpp:129 src/cmdbarcontrols.cpp:105 src/engine.c:377
+#: src/addin-options.cpp:133 src/cmdbarcontrols.cpp:105 src/engine.c:377
 #: src/explorers.cpp:204 src/explorers.cpp:209 src/gpgoladdin.cpp:312
 #: src/gpgoladdin.cpp:862 src/gpgoladdin.cpp:905 src/gpgoladdin.cpp:978
 #: src/gpgoladdin.cpp:980 src/gpgoladdin.cpp:1137 src/gpgoladdin.cpp:1220
 #: src/gpgoladdin.cpp:1226 src/gpgoladdin.cpp:1299 src/gpgoladdin.cpp:1303
-#: src/main.c:461 src/message.cpp:300 src/ribbon-callbacks.cpp:133
+#: src/main.c:464 src/message.cpp:300 src/ribbon-callbacks.cpp:133
 #: src/ribbon-callbacks.cpp:247 src/ribbon-callbacks.cpp:262
 #: src/ribbon-callbacks.cpp:274 src/ribbon-callbacks.cpp:311
 #: src/ribbon-callbacks.cpp:323 src/ribbon-callbacks.cpp:668
@@ -78,8 +81,8 @@ msgstr "Die Benutzeroberfl?che zu ?ndern erfordert einen Neustart von Outlook"
 #: src/ribbon-callbacks.cpp:712 src/ribbon-callbacks.cpp:735
 #: src/ribbon-callbacks.cpp:795 src/ribbon-callbacks.cpp:1077
 #: src/ribbon-callbacks.cpp:1111 src/ribbon-callbacks.cpp:1123
-#: src/ribbon-callbacks.cpp:1148 src/ribbon-callbacks.cpp:1629
-#: src/ribbon-callbacks.cpp:1679
+#: src/ribbon-callbacks.cpp:1148 src/ribbon-callbacks.cpp:1655
+#: src/ribbon-callbacks.cpp:1705
 msgid "GpgOL"
 msgstr "GpgOL"
 
@@ -167,55 +170,51 @@ msgstr ""
 msgid "Do you want to revert this folder?"
 msgstr "M?chten Sie diesen Ordner von GpgOL befreien?"
 
-#: src/gpgoladdin.cpp:444 src/mail.cpp:1371 src/mail.cpp:1380
+#: src/gpgoladdin.cpp:444 src/mail.cpp:1371 src/mail.cpp:1442
 msgid "GpgOL: Encrypted Message"
 msgstr "GpgOL: Verschl?sselte Nachricht"
 
-#: src/gpgoladdin.cpp:445 src/mail.cpp:1372 src/mail.cpp:1381
-#, fuzzy
+#: src/gpgoladdin.cpp:445 src/mail.cpp:1372 src/mail.cpp:1443
 msgid "GpgOL: Trusted Sender Address"
-msgstr "GpgOL: Verifizierter Absender"
+msgstr "GpgOL: Vertraute Absenderadresse"
 
 #: src/gpgoladdin.cpp:798
-#, fuzzy
 msgid "Encrypt the message"
-msgstr "Die Nachricht verschl?sseln."
+msgstr "Die Nachricht verschl?sseln"
 
 #: src/gpgoladdin.cpp:800
-#, fuzzy
 msgid "Encrypts the message and all attachments before sending"
-msgstr "Verschl?sselt die Nachricht und alle Anh?nge beim Mailversand."
+msgstr "Verschl?sselt die Nachricht und alle ihre Anh?nge vor dem versenden"
 
 #: src/gpgoladdin.cpp:802
-#, fuzzy
 msgid "Sign the message"
-msgstr "Die Nachricht signieren."
+msgstr "Die Nachricht signieren"
 
 #: src/gpgoladdin.cpp:804
-#, fuzzy
 msgid "Sign the message and all attachments before sending"
-msgstr "Verschl?sselt die Nachricht und alle Anh?nge beim Mailversand. "
+msgstr "Die Nachricht und alle ihre Anh?nge vor dem senden signieren"
 
 #: src/gpgoladdin.cpp:807
-#, fuzzy
 msgid "Sign and encrypt the message"
-msgstr "Entschl?sseln der Nachricht."
+msgstr "Nachricht signieren und verschl?sseln"
 
 #: src/gpgoladdin.cpp:809
 msgid ""
-"Encrypting and cryptographically signing a message means that the recipient "
+"Encrypting and cryptographically signing a message means that the recipients "
 "can be sure that no one modified the message and only the recipients can "
 "read it"
 msgstr ""
+"Die Nachricht zu verschl?sseln und zu signieren bedeutet das die Empf?nger "
+"sicher sein k?nnen das niemand die Nachricht modifiziert hat und das nur die "
+"Empf?nger die Nachricht lesen k?nnen"
 
 #: src/gpgoladdin.cpp:813
-#, fuzzy
 msgid "Open the settings dialog for GpgOL"
-msgstr "Die Einstellungen von GpgOL ?ffnen. "
+msgstr "Die Einstellungen von GpgOL ?ffnen"
 
 #: src/gpgoladdin.cpp:863 src/gpgoladdin.cpp:981
 msgid "Secure"
-msgstr ""
+msgstr "Sicher"
 
 #: src/gpgoladdin.cpp:864 src/gpgoladdin.cpp:982 src/gpgoladdin.cpp:1143
 msgid "Sign"
@@ -385,6 +384,9 @@ msgid ""
 "The unsigned / unencrypted attachments are:\n"
 "\n"
 msgstr ""
+"Nicht alle Anh?nge waren verschl?sselt order signiert.\n"
+"Die unsignierten / unverschl?sselten Anh?nge sind:\n"
+"\n"
 
 #: src/mail.cpp:289
 msgid ""
@@ -392,6 +394,9 @@ msgid ""
 "The unsigned attachments are:\n"
 "\n"
 msgstr ""
+"Nicht alle Anh?nge sind signiert.\n"
+"Die unsignierten Anh?nge sind:\n"
+"\n"
 
 #: src/mail.cpp:294
 msgid ""
@@ -399,18 +404,23 @@ msgid ""
 "The unencrypted attachments are:\n"
 "\n"
 msgstr ""
+"Nicht alle Anh?nge sind verschl?sselt.\n"
+"Die unverschl?sselten Anh?nge sind:\n"
+"\n"
 
 #: src/mail.cpp:332
 msgid ""
 "Note: The attachments may be encrypted or signed on a file level but the "
 "GpgOL status does not apply to them."
 msgstr ""
+"Note: Die Anh?nge k?nnten auf Dateiebene verschl?sselt oder singiert sein, "
+"aber GpgOL kann deren Kryptostatus nicht anzeigen."
 
 #: src/mail.cpp:335
 msgid "GpgOL Warning"
-msgstr ""
+msgstr "GpgOL Warnung"
 
-#: src/mail.cpp:656 src/mail.cpp:1623
+#: src/mail.cpp:656 src/mail.cpp:1688
 msgid "Encrypted message"
 msgstr "Verschl?sselte Nachricht"
 
@@ -418,222 +428,218 @@ msgstr "Verschl?sselte Nachricht"
 msgid "Please wait while the message is being decrypted / verified..."
 msgstr "Bitte warten Sie w?hrend die Nachricht entschl?sselt / gepr?ft wird..."
 
-#: src/mail.cpp:1568
+#: src/mail.cpp:1633
 msgid "Security Level 4"
-msgstr ""
+msgstr "Sicherheit Stufe 4"
 
-#: src/mail.cpp:1572
+#: src/mail.cpp:1637
 msgid "Trust Level 4"
-msgstr ""
+msgstr "Vertrauen Stufe 4"
 
-#: src/mail.cpp:1576
+#: src/mail.cpp:1641
 msgid "Security Level 3"
-msgstr ""
+msgstr "Sicherheit Stufe 3"
 
-#: src/mail.cpp:1580
+#: src/mail.cpp:1645
 msgid "Trust Level 3"
-msgstr ""
+msgstr "Vertrauen Stufe 3"
 
-#: src/mail.cpp:1584
+#: src/mail.cpp:1649
 msgid "Security Level 2"
-msgstr ""
+msgstr "Sicherheit Stufe 2"
 
-#: src/mail.cpp:1588
+#: src/mail.cpp:1653
 msgid "Trust Level 2"
-msgstr ""
+msgstr "Vertrauen Stufe 2"
 
-#: src/mail.cpp:1592
+#: src/mail.cpp:1657
 msgid "Encrypted"
 msgstr "Verschl?sselt"
 
-#: src/mail.cpp:1601 src/mail.cpp:1603 src/ribbon-callbacks.cpp:1542
+#: src/mail.cpp:1666 src/mail.cpp:1668 src/ribbon-callbacks.cpp:1568
 msgid "Insecure"
-msgstr ""
+msgstr "Unsicher"
 
-#: src/mail.cpp:1615
-#, fuzzy
+#: src/mail.cpp:1680
 msgid "Signed and encrypted message"
-msgstr "Verschl?sselte Nachricht"
+msgstr "Signierte und verschl?sselte Nachricht"
 
-#: src/mail.cpp:1619
-#, fuzzy
+#: src/mail.cpp:1684
 msgid "Signed message"
-msgstr "Die Nachricht signieren."
+msgstr "Signierte Nachricht"
 
-#: src/mail.cpp:1626 src/ribbon-callbacks.cpp:1565
-#, fuzzy
+#: src/mail.cpp:1691 src/ribbon-callbacks.cpp:1591
 msgid "Insecure message"
-msgstr "Verschl?sselte Nachricht"
+msgstr "Unsichere Nachricht"
 
-#: src/mail.cpp:1635
-#, fuzzy
+#: src/mail.cpp:1700
 msgid "You cannot be sure who sent, modified and read the message in transit."
-msgstr "Sie k?nnen nicht sicher sein wer der Absender dieser Nachricht ist."
+msgstr ""
+"Sie k?nnen nicht sicher sein wer die Nachricht gesendet, modifiziert oder "
+"w?hrend der ?bertragung gelesen hat."
 
-#: src/mail.cpp:1640
-#, fuzzy
+#: src/mail.cpp:1705
 msgid "But you cannot be sure who sent the message because it is not signed."
-msgstr "Sie k?nnen nicht sicher sein wer der Absender dieser Nachricht ist."
+msgstr ""
+"Aber Sie k?nnen nicht sicher sein wer der Absender der Nachricht ist da "
+"diese nicht signiert wurde."
 
-#: src/mail.cpp:1664
-#, fuzzy
+#: src/mail.cpp:1729
 msgid "You signed this message."
-msgstr "Die Nachricht signieren."
+msgstr "Sie haben diese Nachricht signiert."
 
-#: src/mail.cpp:1668
-#, fuzzy
+#: src/mail.cpp:1733
 msgid "The senders identity was certified by yourself."
-msgstr ""
-"Der Absender ist nicht verifizert da:\n"
-"\n"
+msgstr "Die Idenit?t des Absenders wurde von ihnen selbst beglaubigt."
 
-#: src/mail.cpp:1672
-msgid "The sender is allowed to manage your mail trust."
-msgstr ""
+#: src/mail.cpp:1737
+msgid "The sender is allowed to certify identities for you."
+msgstr "Der Absender ist berechtigt f?r Sie Identit?ten zu beglaubigen."
 
-#: src/mail.cpp:1685
-#, fuzzy
+#: src/mail.cpp:1750
 msgid "The senders identity was certified by several trusted people."
-msgstr "wurde nicht von gen?gend vertrauensw?rdigen Schl?sseln beglaubigt. "
+msgstr ""
+"The Identit?t des Absenders wurde von mehreren vertrauensw?rdigen Personen "
+"beglaubigt."
 
-#: src/mail.cpp:1690
-#, fuzzy, c-format
+#: src/mail.cpp:1755
+#, c-format
 msgid ""
-"The senders identity is cerified by the trusted issuer:\n"
+"The senders identity is certified by the trusted issuer:\n"
 "'%s'\n"
 msgstr ""
-"wurde von dem vertrauensw?rden Zertifikatsaussteller:\n"
+"Die Idenit?t des Absenders wurde best?tigt von:\n"
 "'%s'\n"
-"ausgestellt.\n"
 
-#: src/mail.cpp:1698
+#: src/mail.cpp:1763
 msgid "Some trusted people have certified the senders identity."
 msgstr ""
+"Einige vertrauensw?rde Personen haben die Identit?t des Absenders beglaubigt."
 
-#: src/mail.cpp:1708
+#: src/mail.cpp:1773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
 "history with this address starting on %s.\n"
 "You encrypted %i and verified %i messages since."
 msgstr ""
+"Die Absenderadresse ist vertrauensw?rdig, da Sie eine l?ngere "
+"Kommunikationshistorie mit dieser Adresse aufgebaut haben.\n"
+"Seit %s haben Sie %i Nachrichten an diesen Absender verschl?sselt und %i "
+"Signaturen gepr?ft."
 
-#: src/mail.cpp:1724
+#: src/mail.cpp:1789
 msgid "The senders signature was verified for the first time."
-msgstr ""
+msgstr "The Signatur des Absenders wurde das erste mal verifiziert."
 
-#: src/mail.cpp:1731
+#: src/mail.cpp:1796
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
 "messages and encrypted %i messages to it since %s."
 msgstr ""
+"Die Absenderadresse ist noch nicht vertrauensw?rdig da Sie erst %i "
+"Nachrichten von diesem absender verifziert und %i Nachrichten verschl?ssel "
+"haben. Seit dem %s."
 
-#: src/mail.cpp:1745
-#, fuzzy
+#: src/mail.cpp:1810
 msgid "But the sender address is not trustworthy because:"
-msgstr ""
-"Der Absender ist nicht verifizert da:\n"
-"\n"
+msgstr "Aber die Absenderadresse ist nicht vertrauensw?rdig da:"
 
-#: src/mail.cpp:1746
-#, fuzzy
+#: src/mail.cpp:1811
 msgid "The sender address is not trustworthy because:"
-msgstr ""
-"Der Absender ist nicht verifizert da:\n"
-"\n"
+msgstr "Die Absenderadresse ist nicht vertrauensw?rdig da:"
 
-#: src/mail.cpp:1754
-#, fuzzy
+#: src/mail.cpp:1819
 msgid "The signature is invalid: \n"
-msgstr "Diese Signatur ist falsch.\n"
+msgstr "Die Signatur ist ung?ltig: \n"
 
-#: src/mail.cpp:1759
+#: src/mail.cpp:1824
 msgid "There was an error verifying the signature.\n"
 msgstr "Beim ?berpr?fen der Signatur ist ein Fehler aufgetreten.\n"
 
-#: src/mail.cpp:1763
+#: src/mail.cpp:1828
 msgid "The signature is expired.\n"
 msgstr "Die Signatur ist abgelaufen.\n"
 
-#: src/mail.cpp:1767
+#: src/mail.cpp:1832
 msgid "The used key"
 msgstr "Der verwendete Schl?ssel"
 
-#: src/mail.cpp:1767
+#: src/mail.cpp:1832
 msgid "The used certificate"
 msgstr "Das verwendete Zertifikat"
 
-#: src/mail.cpp:1775
-#, fuzzy
+#: src/mail.cpp:1840
 msgid "is not available."
-msgstr "Die CRL ist nicht verf?gbar\n"
+msgstr "ist nicht verf?gbar."
 
-#: src/mail.cpp:1779
+#: src/mail.cpp:1844
 msgid "is revoked."
 msgstr "wurde zur?ckgezogen."
 
-#: src/mail.cpp:1783
+#: src/mail.cpp:1848
 msgid "is expired."
 msgstr "ist veraltet. "
 
-#: src/mail.cpp:1787
+#: src/mail.cpp:1852
 msgid "is not meant for signing."
 msgstr "ist nicht zum signieren vorgesehen. "
 
-#: src/mail.cpp:1791 src/mail.cpp:1795
+#: src/mail.cpp:1856 src/mail.cpp:1860
 msgid "could not be checked for revocation."
 msgstr "wurde m?glicherweise zur?ckgezogen."
 
-#: src/mail.cpp:1800
-#, fuzzy
+#: src/mail.cpp:1865
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
-"steht in konflikt mit einem andere Schl?ssel der bereits f?r diesen Absender "
-"verwendet wurde. "
+"ist nicht der gleiche Schl?ssel der in der vergangenheit f?r diese Adresse "
+"verwendet wurde."
 
-#: src/mail.cpp:1806
+#: src/mail.cpp:1871
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr "passt nicht zu der mailaddresse: \"%s\". "
 
-#: src/mail.cpp:1817
-#, fuzzy
+#: src/mail.cpp:1884
 msgid "is not certified by any trustworthy key."
-msgstr "wurde nicht von gen?gend vertrauensw?rdigen Schl?sseln beglaubigt. "
+msgstr "wurde von keinem vertrauensw?rdigen Schl?ssel beglaubigt."
 
-#: src/mail.cpp:1821
-msgid "The sender marked this address as revoked."
+#: src/mail.cpp:1888
+msgid ""
+"is not certified by a trustworthy Certificate Authority or the Certificate "
+"Authority is unknown."
 msgstr ""
+"wurde von keiner vertrauensw?rdigen Zertifizierungsstelle beglaubigt oder "
+"die Zertifizierungsstelle ist unbekannt."
 
-#: src/mail.cpp:1825
-#, fuzzy
+#: src/mail.cpp:1893
+msgid "The sender marked this address as revoked."
+msgstr "Der Absender hat diese Adresse zur?ckgezogen."
+
+#: src/mail.cpp:1897
 msgid "is marked as not trustworthy."
-msgstr "ist als eigener Schl?ssel markiert."
+msgstr "ist als nicht vertrauensw?rdig markiert."
 
-#: src/mail.cpp:1831
-#, fuzzy
+#: src/mail.cpp:1903
 msgid "Click here to change the key used for this address."
-msgstr ""
-"Klicken Sie hier um den Schl?ssel auf dem konfigurierten Schl?sselserver zu "
-"suchen. "
+msgstr "Klicken Sie hier um den Schl?ssel f?r diese Adresse zu ?ndern."
 
-#: src/mail.cpp:1835
+#: src/mail.cpp:1907
 msgid "Click here for details about the key."
 msgstr "Klicken Sie hier f?r Details zu dem Schl?ssel"
 
-#: src/mail.cpp:1836
-#, fuzzy
+#: src/mail.cpp:1908
 msgid "Click here for details about the certificate."
-msgstr "Klicken Sie hier f?r Details zu dem Schl?ssel"
+msgstr "Klicken Sie hier f?r Details zu dem Zertifiakt."
 
-#: src/mail.cpp:1840
+#: src/mail.cpp:1912
 msgid "Click here to search the key on the configured keyserver."
 msgstr ""
 "Klicken Sie hier um den Schl?ssel auf dem konfigurierten Schl?sselserver zu "
 "suchen. "
 
-#: src/mail.cpp:1841
+#: src/mail.cpp:1913
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 "Klicken Sie hier um das Zertifikat auf dem konfigurierten X509 "
@@ -650,11 +656,11 @@ msgstr ""
 "Sie sicher, da? lediglich das Text Format ausgew?hlt wurde.\n"
 "(In der Men?leiste: \"Format\" => \"Nur Text\")"
 
-#: src/mailitem-events.cpp:282
+#: src/mailitem-events.cpp:284
 msgid "Sorry, that's not possible, yet"
 msgstr "Sorry, dies ist leider noch nicht m?glich"
 
-#: src/mailitem-events.cpp:284
+#: src/mailitem-events.cpp:286
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -676,7 +682,7 @@ msgstr ""
 "Beispielsweise durch einen Rechtsklick auf die Nachricht wenn diese nicht "
 "ausgew?hlt ist.\n"
 
-#: src/main.c:460
+#: src/main.c:463
 #, c-format
 msgid "Note: Using compatibility flags: %s"
 msgstr "Notiz: Diese Kompatibilit?tsflags werden verwendet: %s"
@@ -909,14 +915,13 @@ msgstr "Dies ist GpgOL Version %s"
 
 #: src/parsecontroller.cpp:161
 msgid "Unknown Key:"
-msgstr ""
+msgstr "Unbekannter Schl?ssel:"
 
 #: src/parsecontroller.cpp:176
 msgid "Decryption canceled or timed out."
 msgstr "Entschl?sselung abgebrochen oder Passworteingabe dauerte zu lange."
 
 #: src/parsecontroller.cpp:189
-#, fuzzy
 msgid ""
 "No secret key found to decrypt the message. It is encrypted to the following "
 "keys:"
@@ -925,9 +930,8 @@ msgstr ""
 "folgenden Schl?sseln lesbar:"
 
 #: src/parsecontroller.cpp:195
-#, fuzzy
 msgid "Could not decrypt the data: "
-msgstr "Daten konnten nicht entschl?sselt werden."
+msgstr "Daten konnten nicht entschl?sselt werden:"
 
 #: src/parsecontroller.cpp:202 src/parsecontroller.cpp:252
 msgid "Encrypted message (decryption not possible)"
@@ -1005,27 +1009,33 @@ msgstr "Signierter Text"
 msgid "Select file to encrypt"
 msgstr "Ausw?hlen der zu verschl?sselnden Datei"
 
-#: src/ribbon-callbacks.cpp:1569
-#, fuzzy
+#: src/ribbon-callbacks.cpp:1595
 msgid "No message selected"
-msgstr "Diese Nachricht ist nicht verschl?sselt."
+msgstr "Keine Nachricht ausgew?hlt"
 
-#: src/ribbon-callbacks.cpp:1589
+#: src/ribbon-callbacks.cpp:1615
 msgid ""
 "You cannot be sure who sent, modified and read the message in transit.\n"
 "\n"
 "Click here to learn more."
 msgstr ""
+"Sie k?nnen nicht sicher sein wer die Nachricht gesendet, modifiziert oder "
+"w?hrend der ?bertragung gelesen hat.\n"
+"\n"
+"Klicken Sie hier um mehr zu erfahren."
 
-#: src/ribbon-callbacks.cpp:1626
+#: src/ribbon-callbacks.cpp:1652
 #, c-format
 msgid ""
 "The message was not cryptographically signed.\n"
 "There is no additional information available if it was actually sent by '%s' "
 "or if someone faked the sender address."
 msgstr ""
+"Die Nachricht ist nicht kryptographisch signiert.\n"
+"Es gibt keine zus?tzliche Information dar?ber ob sie wirklich von '%s'  "
+"gesendet wurde oder ob jemand die Absenderadresse vort?uscht."
 
-#: src/ribbon-callbacks.cpp:1677
+#: src/ribbon-callbacks.cpp:1703
 msgid ""
 "Could not find Kleopatra.\n"
 "Please reinstall Gpg4win with the Kleopatra component enabled."
diff --git a/po/fr.po b/po/fr.po
index 845434d..3cd2d70 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2017-01-13 15:34+0100\n"
+"POT-Creation-Date: 2017-01-17 11:54+0100\n"
 "PO-Revision-Date: 2015-10-01 17:05+0200\n"
 "Last-Translator: Olivier Serve <olivier.serve at atos.net>\n"
 "Language-Team: French <kde-i18n-doc at kde.org>\n"
@@ -46,28 +46,32 @@ msgstr "&Signer les nouveaux messages par d?faut"
 msgid "&Send OpenPGP mails without attachments as PGP/Inline"
 msgstr ""
 
-#: src/addin-options.cpp:50
+#: src/addin-options.cpp:47
+msgid "S&elect crypto settings automatically for reply and foward."
+msgstr ""
+
+#: src/addin-options.cpp:52
 msgid "Debug..."
 msgstr ""
 
-#: src/addin-options.cpp:51
+#: src/addin-options.cpp:53
 msgid "Configure GnuPG"
 msgstr ""
 
-#: src/addin-options.cpp:52
+#: src/addin-options.cpp:54
 msgid "Version "
 msgstr ""
 
-#: src/addin-options.cpp:128
+#: src/addin-options.cpp:132
 msgid "Changing the interface requires a restart of Outlook."
 msgstr ""
 
-#: src/addin-options.cpp:129 src/cmdbarcontrols.cpp:105 src/engine.c:377
+#: src/addin-options.cpp:133 src/cmdbarcontrols.cpp:105 src/engine.c:377
 #: src/explorers.cpp:204 src/explorers.cpp:209 src/gpgoladdin.cpp:312
 #: src/gpgoladdin.cpp:862 src/gpgoladdin.cpp:905 src/gpgoladdin.cpp:978
 #: src/gpgoladdin.cpp:980 src/gpgoladdin.cpp:1137 src/gpgoladdin.cpp:1220
 #: src/gpgoladdin.cpp:1226 src/gpgoladdin.cpp:1299 src/gpgoladdin.cpp:1303
-#: src/main.c:461 src/message.cpp:300 src/ribbon-callbacks.cpp:133
+#: src/main.c:464 src/message.cpp:300 src/ribbon-callbacks.cpp:133
 #: src/ribbon-callbacks.cpp:247 src/ribbon-callbacks.cpp:262
 #: src/ribbon-callbacks.cpp:274 src/ribbon-callbacks.cpp:311
 #: src/ribbon-callbacks.cpp:323 src/ribbon-callbacks.cpp:668
@@ -75,8 +79,8 @@ msgstr ""
 #: src/ribbon-callbacks.cpp:712 src/ribbon-callbacks.cpp:735
 #: src/ribbon-callbacks.cpp:795 src/ribbon-callbacks.cpp:1077
 #: src/ribbon-callbacks.cpp:1111 src/ribbon-callbacks.cpp:1123
-#: src/ribbon-callbacks.cpp:1148 src/ribbon-callbacks.cpp:1629
-#: src/ribbon-callbacks.cpp:1679
+#: src/ribbon-callbacks.cpp:1148 src/ribbon-callbacks.cpp:1655
+#: src/ribbon-callbacks.cpp:1705
 msgid "GpgOL"
 msgstr "GpgOL"
 
@@ -163,12 +167,12 @@ msgstr ""
 msgid "Do you want to revert this folder?"
 msgstr "Voulez-vous r?cup?rer ce dossier ?"
 
-#: src/gpgoladdin.cpp:444 src/mail.cpp:1371 src/mail.cpp:1380
+#: src/gpgoladdin.cpp:444 src/mail.cpp:1371 src/mail.cpp:1442
 #, fuzzy
 msgid "GpgOL: Encrypted Message"
 msgstr "D?chiffrer le message"
 
-#: src/gpgoladdin.cpp:445 src/mail.cpp:1372 src/mail.cpp:1381
+#: src/gpgoladdin.cpp:445 src/mail.cpp:1372 src/mail.cpp:1443
 msgid "GpgOL: Trusted Sender Address"
 msgstr ""
 
@@ -197,7 +201,7 @@ msgstr "D?chiffrer le message"
 
 #: src/gpgoladdin.cpp:809
 msgid ""
-"Encrypting and cryptographically signing a message means that the recipient "
+"Encrypting and cryptographically signing a message means that the recipients "
 "can be sure that no one modified the message and only the recipients can "
 "read it"
 msgstr ""
@@ -400,7 +404,7 @@ msgstr ""
 msgid "GpgOL Warning"
 msgstr ""
 
-#: src/mail.cpp:656 src/mail.cpp:1623
+#: src/mail.cpp:656 src/mail.cpp:1688
 #, fuzzy
 msgid "Encrypted message"
 msgstr "D?chiffrer le message"
@@ -409,91 +413,91 @@ msgstr "D?chiffrer le message"
 msgid "Please wait while the message is being decrypted / verified..."
 msgstr ""
 
-#: src/mail.cpp:1568
+#: src/mail.cpp:1633
 msgid "Security Level 4"
 msgstr ""
 
-#: src/mail.cpp:1572
+#: src/mail.cpp:1637
 msgid "Trust Level 4"
 msgstr ""
 
-#: src/mail.cpp:1576
+#: src/mail.cpp:1641
 msgid "Security Level 3"
 msgstr ""
 
-#: src/mail.cpp:1580
+#: src/mail.cpp:1645
 msgid "Trust Level 3"
 msgstr ""
 
-#: src/mail.cpp:1584
+#: src/mail.cpp:1649
 msgid "Security Level 2"
 msgstr ""
 
-#: src/mail.cpp:1588
+#: src/mail.cpp:1653
 msgid "Trust Level 2"
 msgstr ""
 
-#: src/mail.cpp:1592
+#: src/mail.cpp:1657
 #, fuzzy
 msgid "Encrypted"
 msgstr "Chiffrer"
 
-#: src/mail.cpp:1601 src/mail.cpp:1603 src/ribbon-callbacks.cpp:1542
+#: src/mail.cpp:1666 src/mail.cpp:1668 src/ribbon-callbacks.cpp:1568
 msgid "Insecure"
 msgstr ""
 
-#: src/mail.cpp:1615
+#: src/mail.cpp:1680
 #, fuzzy
 msgid "Signed and encrypted message"
 msgstr "D?chiffrer le message"
 
-#: src/mail.cpp:1619
+#: src/mail.cpp:1684
 #, fuzzy
 msgid "Signed message"
 msgstr "D?chiffrer le message"
 
-#: src/mail.cpp:1626 src/ribbon-callbacks.cpp:1565
+#: src/mail.cpp:1691 src/ribbon-callbacks.cpp:1591
 #, fuzzy
 msgid "Insecure message"
 msgstr "D?chiffrer le message"
 
-#: src/mail.cpp:1635
+#: src/mail.cpp:1700
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
-#: src/mail.cpp:1640
+#: src/mail.cpp:1705
 msgid "But you cannot be sure who sent the message because it is not signed."
 msgstr ""
 
-#: src/mail.cpp:1664
+#: src/mail.cpp:1729
 #, fuzzy
 msgid "You signed this message."
 msgstr "D?chiffrer le message"
 
-#: src/mail.cpp:1668
+#: src/mail.cpp:1733
 msgid "The senders identity was certified by yourself."
 msgstr ""
 
-#: src/mail.cpp:1672
-msgid "The sender is allowed to manage your mail trust."
+#: src/mail.cpp:1737
+msgid "The sender is allowed to certify identities for you."
 msgstr ""
 
-#: src/mail.cpp:1685
+#: src/mail.cpp:1750
 msgid "The senders identity was certified by several trusted people."
 msgstr ""
 
-#: src/mail.cpp:1690
+#: src/mail.cpp:1755
 #, c-format
 msgid ""
-"The senders identity is cerified by the trusted issuer:\n"
+"The senders identity is certified by the trusted issuer:\n"
 "'%s'\n"
 msgstr ""
 
-#: src/mail.cpp:1698
+#: src/mail.cpp:1763
 msgid "Some trusted people have certified the senders identity."
 msgstr ""
 
-#: src/mail.cpp:1708
+#: src/mail.cpp:1773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -501,107 +505,113 @@ msgid ""
 "You encrypted %i and verified %i messages since."
 msgstr ""
 
-#: src/mail.cpp:1724
+#: src/mail.cpp:1789
 msgid "The senders signature was verified for the first time."
 msgstr ""
 
-#: src/mail.cpp:1731
+#: src/mail.cpp:1796
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
 "messages and encrypted %i messages to it since %s."
 msgstr ""
 
-#: src/mail.cpp:1745
+#: src/mail.cpp:1810
 msgid "But the sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:1746
+#: src/mail.cpp:1811
 msgid "The sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:1754
+#: src/mail.cpp:1819
 #, fuzzy
 msgid "The signature is invalid: \n"
 msgstr "Cette signature est valide\n"
 
-#: src/mail.cpp:1759
+#: src/mail.cpp:1824
 msgid "There was an error verifying the signature.\n"
 msgstr ""
 
-#: src/mail.cpp:1763
+#: src/mail.cpp:1828
 #, fuzzy
 msgid "The signature is expired.\n"
 msgstr "Cette signature est valide\n"
 
-#: src/mail.cpp:1767
+#: src/mail.cpp:1832
 msgid "The used key"
 msgstr ""
 
-#: src/mail.cpp:1767
+#: src/mail.cpp:1832
 #, fuzzy
 msgid "The used certificate"
 msgstr "Erreur de v?rification"
 
-#: src/mail.cpp:1775
+#: src/mail.cpp:1840
 #, fuzzy
 msgid "is not available."
 msgstr "La liste de r?vocation (CRL) n'est pas disponible\n"
 
-#: src/mail.cpp:1779
+#: src/mail.cpp:1844
 msgid "is revoked."
 msgstr ""
 
-#: src/mail.cpp:1783
+#: src/mail.cpp:1848
 msgid "is expired."
 msgstr ""
 
-#: src/mail.cpp:1787
+#: src/mail.cpp:1852
 msgid "is not meant for signing."
 msgstr ""
 
-#: src/mail.cpp:1791 src/mail.cpp:1795
+#: src/mail.cpp:1856 src/mail.cpp:1860
 msgid "could not be checked for revocation."
 msgstr ""
 
-#: src/mail.cpp:1800
+#: src/mail.cpp:1865
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
 
-#: src/mail.cpp:1806
+#: src/mail.cpp:1871
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr ""
 
-#: src/mail.cpp:1817
+#: src/mail.cpp:1884
 msgid "is not certified by any trustworthy key."
 msgstr ""
 
-#: src/mail.cpp:1821
+#: src/mail.cpp:1888
+msgid ""
+"is not certified by a trustworthy Certificate Authority or the Certificate "
+"Authority is unknown."
+msgstr ""
+
+#: src/mail.cpp:1893
 msgid "The sender marked this address as revoked."
 msgstr ""
 
-#: src/mail.cpp:1825
+#: src/mail.cpp:1897
 msgid "is marked as not trustworthy."
 msgstr ""
 
-#: src/mail.cpp:1831
+#: src/mail.cpp:1903
 msgid "Click here to change the key used for this address."
 msgstr ""
 
-#: src/mail.cpp:1835
+#: src/mail.cpp:1907
 msgid "Click here for details about the key."
 msgstr ""
 
-#: src/mail.cpp:1836
+#: src/mail.cpp:1908
 msgid "Click here for details about the certificate."
 msgstr ""
 
-#: src/mail.cpp:1840
+#: src/mail.cpp:1912
 msgid "Click here to search the key on the configured keyserver."
 msgstr ""
 
-#: src/mail.cpp:1841
+#: src/mail.cpp:1913
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 
@@ -615,11 +625,11 @@ msgstr ""
 "et non des messages RTF. Merci de v?rifier que seul le format texte\n"
 "a ?t? s?lectionn?."
 
-#: src/mailitem-events.cpp:282
+#: src/mailitem-events.cpp:284
 msgid "Sorry, that's not possible, yet"
 msgstr ""
 
-#: src/mailitem-events.cpp:284
+#: src/mailitem-events.cpp:286
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -631,7 +641,7 @@ msgid ""
 "For example by right clicking but not selecting the message.\n"
 msgstr ""
 
-#: src/main.c:460
+#: src/main.c:463
 #, c-format
 msgid "Note: Using compatibility flags: %s"
 msgstr "Note?: Utilisation de marqueurs de compatibilit??: %s"
@@ -929,19 +939,19 @@ msgstr "Texte sign?"
 msgid "Select file to encrypt"
 msgstr "S?lectionner le fichier ? chiffrer"
 
-#: src/ribbon-callbacks.cpp:1569
+#: src/ribbon-callbacks.cpp:1595
 #, fuzzy
 msgid "No message selected"
 msgstr "Ce message n'est pas chiffr?"
 
-#: src/ribbon-callbacks.cpp:1589
+#: src/ribbon-callbacks.cpp:1615
 msgid ""
 "You cannot be sure who sent, modified and read the message in transit.\n"
 "\n"
 "Click here to learn more."
 msgstr ""
 
-#: src/ribbon-callbacks.cpp:1626
+#: src/ribbon-callbacks.cpp:1652
 #, c-format
 msgid ""
 "The message was not cryptographically signed.\n"
@@ -949,7 +959,7 @@ msgid ""
 "or if someone faked the sender address."
 msgstr ""
 
-#: src/ribbon-callbacks.cpp:1677
+#: src/ribbon-callbacks.cpp:1703
 msgid ""
 "Could not find Kleopatra.\n"
 "Please reinstall Gpg4win with the Kleopatra component enabled."
diff --git a/po/pt.po b/po/pt.po
index 68f5348..dd12025 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL 1.1.1\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2017-01-13 15:34+0100\n"
+"POT-Creation-Date: 2017-01-17 11:54+0100\n"
 "PO-Revision-Date: 2016-02-02 17:33+0000\n"
 "Last-Translator: Marco A.G.Pinto <marcoagpinto at mail.telepac.pt>\n"
 "Language-Team: Portuguese <marcoagpinto at mail.telepac.pt>\n"
@@ -47,28 +47,32 @@ msgstr "Assinar novas mensagens por defeito"
 msgid "&Send OpenPGP mails without attachments as PGP/Inline"
 msgstr ""
 
-#: src/addin-options.cpp:50
+#: src/addin-options.cpp:47
+msgid "S&elect crypto settings automatically for reply and foward."
+msgstr ""
+
+#: src/addin-options.cpp:52
 msgid "Debug..."
 msgstr ""
 
-#: src/addin-options.cpp:51
+#: src/addin-options.cpp:53
 msgid "Configure GnuPG"
 msgstr ""
 
-#: src/addin-options.cpp:52
+#: src/addin-options.cpp:54
 msgid "Version "
 msgstr ""
 
-#: src/addin-options.cpp:128
+#: src/addin-options.cpp:132
 msgid "Changing the interface requires a restart of Outlook."
 msgstr ""
 
-#: src/addin-options.cpp:129 src/cmdbarcontrols.cpp:105 src/engine.c:377
+#: src/addin-options.cpp:133 src/cmdbarcontrols.cpp:105 src/engine.c:377
 #: src/explorers.cpp:204 src/explorers.cpp:209 src/gpgoladdin.cpp:312
 #: src/gpgoladdin.cpp:862 src/gpgoladdin.cpp:905 src/gpgoladdin.cpp:978
 #: src/gpgoladdin.cpp:980 src/gpgoladdin.cpp:1137 src/gpgoladdin.cpp:1220
 #: src/gpgoladdin.cpp:1226 src/gpgoladdin.cpp:1299 src/gpgoladdin.cpp:1303
-#: src/main.c:461 src/message.cpp:300 src/ribbon-callbacks.cpp:133
+#: src/main.c:464 src/message.cpp:300 src/ribbon-callbacks.cpp:133
 #: src/ribbon-callbacks.cpp:247 src/ribbon-callbacks.cpp:262
 #: src/ribbon-callbacks.cpp:274 src/ribbon-callbacks.cpp:311
 #: src/ribbon-callbacks.cpp:323 src/ribbon-callbacks.cpp:668
@@ -76,8 +80,8 @@ msgstr ""
 #: src/ribbon-callbacks.cpp:712 src/ribbon-callbacks.cpp:735
 #: src/ribbon-callbacks.cpp:795 src/ribbon-callbacks.cpp:1077
 #: src/ribbon-callbacks.cpp:1111 src/ribbon-callbacks.cpp:1123
-#: src/ribbon-callbacks.cpp:1148 src/ribbon-callbacks.cpp:1629
-#: src/ribbon-callbacks.cpp:1679
+#: src/ribbon-callbacks.cpp:1148 src/ribbon-callbacks.cpp:1655
+#: src/ribbon-callbacks.cpp:1705
 msgid "GpgOL"
 msgstr "GpgOL"
 
@@ -164,12 +168,12 @@ msgstr ""
 msgid "Do you want to revert this folder?"
 msgstr "Queres reverter esta pasta?"
 
-#: src/gpgoladdin.cpp:444 src/mail.cpp:1371 src/mail.cpp:1380
+#: src/gpgoladdin.cpp:444 src/mail.cpp:1371 src/mail.cpp:1442
 #, fuzzy
 msgid "GpgOL: Encrypted Message"
 msgstr "Encriptar a mensagem."
 
-#: src/gpgoladdin.cpp:445 src/mail.cpp:1372 src/mail.cpp:1381
+#: src/gpgoladdin.cpp:445 src/mail.cpp:1372 src/mail.cpp:1443
 msgid "GpgOL: Trusted Sender Address"
 msgstr ""
 
@@ -200,7 +204,7 @@ msgstr "Desencriptar a mensagem"
 
 #: src/gpgoladdin.cpp:809
 msgid ""
-"Encrypting and cryptographically signing a message means that the recipient "
+"Encrypting and cryptographically signing a message means that the recipients "
 "can be sure that no one modified the message and only the recipients can "
 "read it"
 msgstr ""
@@ -406,7 +410,7 @@ msgstr ""
 msgid "GpgOL Warning"
 msgstr ""
 
-#: src/mail.cpp:656 src/mail.cpp:1623
+#: src/mail.cpp:656 src/mail.cpp:1688
 #, fuzzy
 msgid "Encrypted message"
 msgstr "Encriptar a mensagem."
@@ -415,91 +419,91 @@ msgstr "Encriptar a mensagem."
 msgid "Please wait while the message is being decrypted / verified..."
 msgstr ""
 
-#: src/mail.cpp:1568
+#: src/mail.cpp:1633
 msgid "Security Level 4"
 msgstr ""
 
-#: src/mail.cpp:1572
+#: src/mail.cpp:1637
 msgid "Trust Level 4"
 msgstr ""
 
-#: src/mail.cpp:1576
+#: src/mail.cpp:1641
 msgid "Security Level 3"
 msgstr ""
 
-#: src/mail.cpp:1580
+#: src/mail.cpp:1645
 msgid "Trust Level 3"
 msgstr ""
 
-#: src/mail.cpp:1584
+#: src/mail.cpp:1649
 msgid "Security Level 2"
 msgstr ""
 
-#: src/mail.cpp:1588
+#: src/mail.cpp:1653
 msgid "Trust Level 2"
 msgstr ""
 
-#: src/mail.cpp:1592
+#: src/mail.cpp:1657
 #, fuzzy
 msgid "Encrypted"
 msgstr "Encriptar"
 
-#: src/mail.cpp:1601 src/mail.cpp:1603 src/ribbon-callbacks.cpp:1542
+#: src/mail.cpp:1666 src/mail.cpp:1668 src/ribbon-callbacks.cpp:1568
 msgid "Insecure"
 msgstr ""
 
-#: src/mail.cpp:1615
+#: src/mail.cpp:1680
 #, fuzzy
 msgid "Signed and encrypted message"
 msgstr "Encriptar a mensagem."
 
-#: src/mail.cpp:1619
+#: src/mail.cpp:1684
 #, fuzzy
 msgid "Signed message"
 msgstr "Assinar a mensagem."
 
-#: src/mail.cpp:1626 src/ribbon-callbacks.cpp:1565
+#: src/mail.cpp:1691 src/ribbon-callbacks.cpp:1591
 #, fuzzy
 msgid "Insecure message"
 msgstr "Encriptar a mensagem."
 
-#: src/mail.cpp:1635
+#: src/mail.cpp:1700
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
-#: src/mail.cpp:1640
+#: src/mail.cpp:1705
 msgid "But you cannot be sure who sent the message because it is not signed."
 msgstr ""
 
-#: src/mail.cpp:1664
+#: src/mail.cpp:1729
 #, fuzzy
 msgid "You signed this message."
 msgstr "Assinar a mensagem."
 
-#: src/mail.cpp:1668
+#: src/mail.cpp:1733
 msgid "The senders identity was certified by yourself."
 msgstr ""
 
-#: src/mail.cpp:1672
-msgid "The sender is allowed to manage your mail trust."
+#: src/mail.cpp:1737
+msgid "The sender is allowed to certify identities for you."
 msgstr ""
 
-#: src/mail.cpp:1685
+#: src/mail.cpp:1750
 msgid "The senders identity was certified by several trusted people."
 msgstr ""
 
-#: src/mail.cpp:1690
+#: src/mail.cpp:1755
 #, c-format
 msgid ""
-"The senders identity is cerified by the trusted issuer:\n"
+"The senders identity is certified by the trusted issuer:\n"
 "'%s'\n"
 msgstr ""
 
-#: src/mail.cpp:1698
+#: src/mail.cpp:1763
 msgid "Some trusted people have certified the senders identity."
 msgstr ""
 
-#: src/mail.cpp:1708
+#: src/mail.cpp:1773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -507,107 +511,113 @@ msgid ""
 "You encrypted %i and verified %i messages since."
 msgstr ""
 
-#: src/mail.cpp:1724
+#: src/mail.cpp:1789
 msgid "The senders signature was verified for the first time."
 msgstr ""
 
-#: src/mail.cpp:1731
+#: src/mail.cpp:1796
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
 "messages and encrypted %i messages to it since %s."
 msgstr ""
 
-#: src/mail.cpp:1745
+#: src/mail.cpp:1810
 msgid "But the sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:1746
+#: src/mail.cpp:1811
 msgid "The sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:1754
+#: src/mail.cpp:1819
 #, fuzzy
 msgid "The signature is invalid: \n"
 msgstr "Esta assinatura ? v?lida\n"
 
-#: src/mail.cpp:1759
+#: src/mail.cpp:1824
 msgid "There was an error verifying the signature.\n"
 msgstr ""
 
-#: src/mail.cpp:1763
+#: src/mail.cpp:1828
 #, fuzzy
 msgid "The signature is expired.\n"
 msgstr "Esta assinatura ? v?lida\n"
 
-#: src/mail.cpp:1767
+#: src/mail.cpp:1832
 msgid "The used key"
 msgstr ""
 
-#: src/mail.cpp:1767
+#: src/mail.cpp:1832
 #, fuzzy
 msgid "The used certificate"
 msgstr "?berpr?fung"
 
-#: src/mail.cpp:1775
+#: src/mail.cpp:1840
 #, fuzzy
 msgid "is not available."
 msgstr "O CRL n?o est? dispon?vel\n"
 
-#: src/mail.cpp:1779
+#: src/mail.cpp:1844
 msgid "is revoked."
 msgstr ""
 
-#: src/mail.cpp:1783
+#: src/mail.cpp:1848
 msgid "is expired."
 msgstr ""
 
-#: src/mail.cpp:1787
+#: src/mail.cpp:1852
 msgid "is not meant for signing."
 msgstr ""
 
-#: src/mail.cpp:1791 src/mail.cpp:1795
+#: src/mail.cpp:1856 src/mail.cpp:1860
 msgid "could not be checked for revocation."
 msgstr ""
 
-#: src/mail.cpp:1800
+#: src/mail.cpp:1865
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
 
-#: src/mail.cpp:1806
+#: src/mail.cpp:1871
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr ""
 
-#: src/mail.cpp:1817
+#: src/mail.cpp:1884
 msgid "is not certified by any trustworthy key."
 msgstr ""
 
-#: src/mail.cpp:1821
+#: src/mail.cpp:1888
+msgid ""
+"is not certified by a trustworthy Certificate Authority or the Certificate "
+"Authority is unknown."
+msgstr ""
+
+#: src/mail.cpp:1893
 msgid "The sender marked this address as revoked."
 msgstr ""
 
-#: src/mail.cpp:1825
+#: src/mail.cpp:1897
 msgid "is marked as not trustworthy."
 msgstr ""
 
-#: src/mail.cpp:1831
+#: src/mail.cpp:1903
 msgid "Click here to change the key used for this address."
 msgstr ""
 
-#: src/mail.cpp:1835
+#: src/mail.cpp:1907
 msgid "Click here for details about the key."
 msgstr ""
 
-#: src/mail.cpp:1836
+#: src/mail.cpp:1908
 msgid "Click here for details about the certificate."
 msgstr ""
 
-#: src/mail.cpp:1840
+#: src/mail.cpp:1912
 msgid "Click here to search the key on the configured keyserver."
 msgstr ""
 
-#: src/mail.cpp:1841
+#: src/mail.cpp:1913
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 
@@ -621,11 +631,11 @@ msgstr ""
 "n?o mensagens RTF. Por favor certifica-te que apenas o formato\n"
 "de texto foi seleccionado."
 
-#: src/mailitem-events.cpp:282
+#: src/mailitem-events.cpp:284
 msgid "Sorry, that's not possible, yet"
 msgstr ""
 
-#: src/mailitem-events.cpp:284
+#: src/mailitem-events.cpp:286
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -637,7 +647,7 @@ msgid ""
 "For example by right clicking but not selecting the message.\n"
 msgstr ""
 
-#: src/main.c:460
+#: src/main.c:463
 #, c-format
 msgid "Note: Using compatibility flags: %s"
 msgstr "Nota: A usar flags de compatibilidade: %s"
@@ -950,19 +960,19 @@ msgstr "Texto assinado"
 msgid "Select file to encrypt"
 msgstr "Selecciona ficheiro a encriptar"
 
-#: src/ribbon-callbacks.cpp:1569
+#: src/ribbon-callbacks.cpp:1595
 #, fuzzy
 msgid "No message selected"
 msgstr "Esta mensagem n?o est? encriptada."
 
-#: src/ribbon-callbacks.cpp:1589
+#: src/ribbon-callbacks.cpp:1615
 msgid ""
 "You cannot be sure who sent, modified and read the message in transit.\n"
 "\n"
 "Click here to learn more."
 msgstr ""
 
-#: src/ribbon-callbacks.cpp:1626
+#: src/ribbon-callbacks.cpp:1652
 #, c-format
 msgid ""
 "The message was not cryptographically signed.\n"
@@ -970,7 +980,7 @@ msgid ""
 "or if someone faked the sender address."
 msgstr ""
 
-#: src/ribbon-callbacks.cpp:1677
+#: src/ribbon-callbacks.cpp:1703
 msgid ""
 "Could not find Kleopatra.\n"
 "Please reinstall Gpg4win with the Kleopatra component enabled."
diff --git a/po/sv.po b/po/sv.po
index 9f150f8..605a9bd 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GPGol\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2017-01-13 15:34+0100\n"
+"POT-Creation-Date: 2017-01-17 11:54+0100\n"
 "PO-Revision-Date: 2006-12-12 23:52+0100\n"
 "Last-Translator: Daniel Nylander <po at danielnylander.se>\n"
 "Language-Team: Swedish <tp-sv at listor.tp-sv.se>\n"
@@ -46,28 +46,32 @@ msgstr ""
 msgid "&Send OpenPGP mails without attachments as PGP/Inline"
 msgstr ""
 
-#: src/addin-options.cpp:50
+#: src/addin-options.cpp:47
+msgid "S&elect crypto settings automatically for reply and foward."
+msgstr ""
+
+#: src/addin-options.cpp:52
 msgid "Debug..."
 msgstr ""
 
-#: src/addin-options.cpp:51
+#: src/addin-options.cpp:53
 msgid "Configure GnuPG"
 msgstr ""
 
-#: src/addin-options.cpp:52
+#: src/addin-options.cpp:54
 msgid "Version "
 msgstr ""
 
-#: src/addin-options.cpp:128
+#: src/addin-options.cpp:132
 msgid "Changing the interface requires a restart of Outlook."
 msgstr ""
 
-#: src/addin-options.cpp:129 src/cmdbarcontrols.cpp:105 src/engine.c:377
+#: src/addin-options.cpp:133 src/cmdbarcontrols.cpp:105 src/engine.c:377
 #: src/explorers.cpp:204 src/explorers.cpp:209 src/gpgoladdin.cpp:312
 #: src/gpgoladdin.cpp:862 src/gpgoladdin.cpp:905 src/gpgoladdin.cpp:978
 #: src/gpgoladdin.cpp:980 src/gpgoladdin.cpp:1137 src/gpgoladdin.cpp:1220
 #: src/gpgoladdin.cpp:1226 src/gpgoladdin.cpp:1299 src/gpgoladdin.cpp:1303
-#: src/main.c:461 src/message.cpp:300 src/ribbon-callbacks.cpp:133
+#: src/main.c:464 src/message.cpp:300 src/ribbon-callbacks.cpp:133
 #: src/ribbon-callbacks.cpp:247 src/ribbon-callbacks.cpp:262
 #: src/ribbon-callbacks.cpp:274 src/ribbon-callbacks.cpp:311
 #: src/ribbon-callbacks.cpp:323 src/ribbon-callbacks.cpp:668
@@ -75,8 +79,8 @@ msgstr ""
 #: src/ribbon-callbacks.cpp:712 src/ribbon-callbacks.cpp:735
 #: src/ribbon-callbacks.cpp:795 src/ribbon-callbacks.cpp:1077
 #: src/ribbon-callbacks.cpp:1111 src/ribbon-callbacks.cpp:1123
-#: src/ribbon-callbacks.cpp:1148 src/ribbon-callbacks.cpp:1629
-#: src/ribbon-callbacks.cpp:1679
+#: src/ribbon-callbacks.cpp:1148 src/ribbon-callbacks.cpp:1655
+#: src/ribbon-callbacks.cpp:1705
 msgid "GpgOL"
 msgstr ""
 
@@ -155,12 +159,12 @@ msgstr ""
 msgid "Do you want to revert this folder?"
 msgstr ""
 
-#: src/gpgoladdin.cpp:444 src/mail.cpp:1371 src/mail.cpp:1380
+#: src/gpgoladdin.cpp:444 src/mail.cpp:1371 src/mail.cpp:1442
 #, fuzzy
 msgid "GpgOL: Encrypted Message"
 msgstr "Dekryptera och validera meddelandet."
 
-#: src/gpgoladdin.cpp:445 src/mail.cpp:1372 src/mail.cpp:1381
+#: src/gpgoladdin.cpp:445 src/mail.cpp:1372 src/mail.cpp:1443
 msgid "GpgOL: Trusted Sender Address"
 msgstr ""
 
@@ -189,7 +193,7 @@ msgstr "Dekryptera och validera meddelandet."
 
 #: src/gpgoladdin.cpp:809
 msgid ""
-"Encrypting and cryptographically signing a message means that the recipient "
+"Encrypting and cryptographically signing a message means that the recipients "
 "can be sure that no one modified the message and only the recipients can "
 "read it"
 msgstr ""
@@ -389,7 +393,7 @@ msgstr ""
 msgid "GpgOL Warning"
 msgstr ""
 
-#: src/mail.cpp:656 src/mail.cpp:1623
+#: src/mail.cpp:656 src/mail.cpp:1688
 #, fuzzy
 msgid "Encrypted message"
 msgstr "Dekryptera och validera meddelandet."
@@ -398,91 +402,91 @@ msgstr "Dekryptera och validera meddelandet."
 msgid "Please wait while the message is being decrypted / verified..."
 msgstr ""
 
-#: src/mail.cpp:1568
+#: src/mail.cpp:1633
 msgid "Security Level 4"
 msgstr ""
 
-#: src/mail.cpp:1572
+#: src/mail.cpp:1637
 msgid "Trust Level 4"
 msgstr ""
 
-#: src/mail.cpp:1576
+#: src/mail.cpp:1641
 msgid "Security Level 3"
 msgstr ""
 
-#: src/mail.cpp:1580
+#: src/mail.cpp:1645
 msgid "Trust Level 3"
 msgstr ""
 
-#: src/mail.cpp:1584
+#: src/mail.cpp:1649
 msgid "Security Level 2"
 msgstr ""
 
-#: src/mail.cpp:1588
+#: src/mail.cpp:1653
 msgid "Trust Level 2"
 msgstr ""
 
-#: src/mail.cpp:1592
+#: src/mail.cpp:1657
 #, fuzzy
 msgid "Encrypted"
 msgstr "Kryptering"
 
-#: src/mail.cpp:1601 src/mail.cpp:1603 src/ribbon-callbacks.cpp:1542
+#: src/mail.cpp:1666 src/mail.cpp:1668 src/ribbon-callbacks.cpp:1568
 msgid "Insecure"
 msgstr ""
 
-#: src/mail.cpp:1615
+#: src/mail.cpp:1680
 #, fuzzy
 msgid "Signed and encrypted message"
 msgstr "Dekryptera och validera meddelandet."
 
-#: src/mail.cpp:1619
+#: src/mail.cpp:1684
 #, fuzzy
 msgid "Signed message"
 msgstr "Dekryptera och validera meddelandet."
 
-#: src/mail.cpp:1626 src/ribbon-callbacks.cpp:1565
+#: src/mail.cpp:1691 src/ribbon-callbacks.cpp:1591
 #, fuzzy
 msgid "Insecure message"
 msgstr "Dekryptera och validera meddelandet."
 
-#: src/mail.cpp:1635
+#: src/mail.cpp:1700
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
-#: src/mail.cpp:1640
+#: src/mail.cpp:1705
 msgid "But you cannot be sure who sent the message because it is not signed."
 msgstr ""
 
-#: src/mail.cpp:1664
+#: src/mail.cpp:1729
 #, fuzzy
 msgid "You signed this message."
 msgstr "Dekryptera och validera meddelandet."
 
-#: src/mail.cpp:1668
+#: src/mail.cpp:1733
 msgid "The senders identity was certified by yourself."
 msgstr ""
 
-#: src/mail.cpp:1672
-msgid "The sender is allowed to manage your mail trust."
+#: src/mail.cpp:1737
+msgid "The sender is allowed to certify identities for you."
 msgstr ""
 
-#: src/mail.cpp:1685
+#: src/mail.cpp:1750
 msgid "The senders identity was certified by several trusted people."
 msgstr ""
 
-#: src/mail.cpp:1690
+#: src/mail.cpp:1755
 #, c-format
 msgid ""
-"The senders identity is cerified by the trusted issuer:\n"
+"The senders identity is certified by the trusted issuer:\n"
 "'%s'\n"
 msgstr ""
 
-#: src/mail.cpp:1698
+#: src/mail.cpp:1763
 msgid "Some trusted people have certified the senders identity."
 msgstr ""
 
-#: src/mail.cpp:1708
+#: src/mail.cpp:1773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -490,107 +494,113 @@ msgid ""
 "You encrypted %i and verified %i messages since."
 msgstr ""
 
-#: src/mail.cpp:1724
+#: src/mail.cpp:1789
 msgid "The senders signature was verified for the first time."
 msgstr ""
 
-#: src/mail.cpp:1731
+#: src/mail.cpp:1796
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
 "messages and encrypted %i messages to it since %s."
 msgstr ""
 
-#: src/mail.cpp:1745
+#: src/mail.cpp:1810
 msgid "But the sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:1746
+#: src/mail.cpp:1811
 msgid "The sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:1754
+#: src/mail.cpp:1819
 #, fuzzy
 msgid "The signature is invalid: \n"
 msgstr "Den h?r signaturen ?r giltig\n"
 
-#: src/mail.cpp:1759
+#: src/mail.cpp:1824
 msgid "There was an error verifying the signature.\n"
 msgstr ""
 
-#: src/mail.cpp:1763
+#: src/mail.cpp:1828
 #, fuzzy
 msgid "The signature is expired.\n"
 msgstr "Den h?r signaturen ?r giltig\n"
 
-#: src/mail.cpp:1767
+#: src/mail.cpp:1832
 msgid "The used key"
 msgstr ""
 
-#: src/mail.cpp:1767
+#: src/mail.cpp:1832
 #, fuzzy
 msgid "The used certificate"
 msgstr "Validering"
 
-#: src/mail.cpp:1775
+#: src/mail.cpp:1840
 #, fuzzy
 msgid "is not available."
 msgstr "Sp?rrlistan ?r inte tillg?nglig\n"
 
-#: src/mail.cpp:1779
+#: src/mail.cpp:1844
 msgid "is revoked."
 msgstr ""
 
-#: src/mail.cpp:1783
+#: src/mail.cpp:1848
 msgid "is expired."
 msgstr ""
 
-#: src/mail.cpp:1787
+#: src/mail.cpp:1852
 msgid "is not meant for signing."
 msgstr ""
 
-#: src/mail.cpp:1791 src/mail.cpp:1795
+#: src/mail.cpp:1856 src/mail.cpp:1860
 msgid "could not be checked for revocation."
 msgstr ""
 
-#: src/mail.cpp:1800
+#: src/mail.cpp:1865
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
 
-#: src/mail.cpp:1806
+#: src/mail.cpp:1871
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr ""
 
-#: src/mail.cpp:1817
+#: src/mail.cpp:1884
 msgid "is not certified by any trustworthy key."
 msgstr ""
 
-#: src/mail.cpp:1821
+#: src/mail.cpp:1888
+msgid ""
+"is not certified by a trustworthy Certificate Authority or the Certificate "
+"Authority is unknown."
+msgstr ""
+
+#: src/mail.cpp:1893
 msgid "The sender marked this address as revoked."
 msgstr ""
 
-#: src/mail.cpp:1825
+#: src/mail.cpp:1897
 msgid "is marked as not trustworthy."
 msgstr ""
 
-#: src/mail.cpp:1831
+#: src/mail.cpp:1903
 msgid "Click here to change the key used for this address."
 msgstr ""
 
-#: src/mail.cpp:1835
+#: src/mail.cpp:1907
 msgid "Click here for details about the key."
 msgstr ""
 
-#: src/mail.cpp:1836
+#: src/mail.cpp:1908
 msgid "Click here for details about the certificate."
 msgstr ""
 
-#: src/mail.cpp:1840
+#: src/mail.cpp:1912
 msgid "Click here to search the key on the configured keyserver."
 msgstr ""
 
-#: src/mail.cpp:1841
+#: src/mail.cpp:1913
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 
@@ -605,11 +615,11 @@ msgstr ""
 "och inte RTF-meddelanden. Se till att endast textformatet\n"
 "har valts i inst?llningarna."
 
-#: src/mailitem-events.cpp:282
+#: src/mailitem-events.cpp:284
 msgid "Sorry, that's not possible, yet"
 msgstr ""
 
-#: src/mailitem-events.cpp:284
+#: src/mailitem-events.cpp:286
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -621,7 +631,7 @@ msgid ""
 "For example by right clicking but not selecting the message.\n"
 msgstr ""
 
-#: src/main.c:460
+#: src/main.c:463
 #, c-format
 msgid "Note: Using compatibility flags: %s"
 msgstr ""
@@ -891,18 +901,18 @@ msgstr ""
 msgid "Select file to encrypt"
 msgstr "V?lj ?tminstone en mottagarnyckel."
 
-#: src/ribbon-callbacks.cpp:1569
+#: src/ribbon-callbacks.cpp:1595
 msgid "No message selected"
 msgstr ""
 
-#: src/ribbon-callbacks.cpp:1589
+#: src/ribbon-callbacks.cpp:1615
 msgid ""
 "You cannot be sure who sent, modified and read the message in transit.\n"
 "\n"
 "Click here to learn more."
 msgstr ""
 
-#: src/ribbon-callbacks.cpp:1626
+#: src/ribbon-callbacks.cpp:1652
 #, c-format
 msgid ""
 "The message was not cryptographically signed.\n"
@@ -910,7 +920,7 @@ msgid ""
 "or if someone faked the sender address."
 msgstr ""
 
-#: src/ribbon-callbacks.cpp:1677
+#: src/ribbon-callbacks.cpp:1703
 msgid ""
 "Could not find Kleopatra.\n"
 "Please reinstall Gpg4win with the Kleopatra component enabled."
diff --git a/po/zh_CN.po b/po/zh_CN.po
index 15dfbf9..bfa7bb5 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2017-01-13 15:34+0100\n"
+"POT-Creation-Date: 2017-01-17 11:54+0100\n"
 "PO-Revision-Date: 2015-08-15 21:58+0800\n"
 "Last-Translator: Mingye Wang (Arthur2e5) <arthur200126 at hotmail.com>\n"
 "Language-Team: \n"
@@ -47,28 +47,32 @@ msgstr "????????&S?"
 msgid "&Send OpenPGP mails without attachments as PGP/Inline"
 msgstr ""
 
-#: src/addin-options.cpp:50
+#: src/addin-options.cpp:47
+msgid "S&elect crypto settings automatically for reply and foward."
+msgstr ""
+
+#: src/addin-options.cpp:52
 msgid "Debug..."
 msgstr ""
 
-#: src/addin-options.cpp:51
+#: src/addin-options.cpp:53
 msgid "Configure GnuPG"
 msgstr ""
 
-#: src/addin-options.cpp:52
+#: src/addin-options.cpp:54
 msgid "Version "
 msgstr ""
 
-#: src/addin-options.cpp:128
+#: src/addin-options.cpp:132
 msgid "Changing the interface requires a restart of Outlook."
 msgstr ""
 
-#: src/addin-options.cpp:129 src/cmdbarcontrols.cpp:105 src/engine.c:377
+#: src/addin-options.cpp:133 src/cmdbarcontrols.cpp:105 src/engine.c:377
 #: src/explorers.cpp:204 src/explorers.cpp:209 src/gpgoladdin.cpp:312
 #: src/gpgoladdin.cpp:862 src/gpgoladdin.cpp:905 src/gpgoladdin.cpp:978
 #: src/gpgoladdin.cpp:980 src/gpgoladdin.cpp:1137 src/gpgoladdin.cpp:1220
 #: src/gpgoladdin.cpp:1226 src/gpgoladdin.cpp:1299 src/gpgoladdin.cpp:1303
-#: src/main.c:461 src/message.cpp:300 src/ribbon-callbacks.cpp:133
+#: src/main.c:464 src/message.cpp:300 src/ribbon-callbacks.cpp:133
 #: src/ribbon-callbacks.cpp:247 src/ribbon-callbacks.cpp:262
 #: src/ribbon-callbacks.cpp:274 src/ribbon-callbacks.cpp:311
 #: src/ribbon-callbacks.cpp:323 src/ribbon-callbacks.cpp:668
@@ -76,8 +80,8 @@ msgstr ""
 #: src/ribbon-callbacks.cpp:712 src/ribbon-callbacks.cpp:735
 #: src/ribbon-callbacks.cpp:795 src/ribbon-callbacks.cpp:1077
 #: src/ribbon-callbacks.cpp:1111 src/ribbon-callbacks.cpp:1123
-#: src/ribbon-callbacks.cpp:1148 src/ribbon-callbacks.cpp:1629
-#: src/ribbon-callbacks.cpp:1679
+#: src/ribbon-callbacks.cpp:1148 src/ribbon-callbacks.cpp:1655
+#: src/ribbon-callbacks.cpp:1705
 msgid "GpgOL"
 msgstr "GpgOL"
 
@@ -159,12 +163,12 @@ msgstr ""
 msgid "Do you want to revert this folder?"
 msgstr "????????????"
 
-#: src/gpgoladdin.cpp:444 src/mail.cpp:1371 src/mail.cpp:1380
+#: src/gpgoladdin.cpp:444 src/mail.cpp:1371 src/mail.cpp:1442
 #, fuzzy
 msgid "GpgOL: Encrypted Message"
 msgstr "????"
 
-#: src/gpgoladdin.cpp:445 src/mail.cpp:1372 src/mail.cpp:1381
+#: src/gpgoladdin.cpp:445 src/mail.cpp:1372 src/mail.cpp:1443
 msgid "GpgOL: Trusted Sender Address"
 msgstr ""
 
@@ -193,7 +197,7 @@ msgstr "????"
 
 #: src/gpgoladdin.cpp:809
 msgid ""
-"Encrypting and cryptographically signing a message means that the recipient "
+"Encrypting and cryptographically signing a message means that the recipients "
 "can be sure that no one modified the message and only the recipients can "
 "read it"
 msgstr ""
@@ -388,7 +392,7 @@ msgstr ""
 msgid "GpgOL Warning"
 msgstr ""
 
-#: src/mail.cpp:656 src/mail.cpp:1623
+#: src/mail.cpp:656 src/mail.cpp:1688
 #, fuzzy
 msgid "Encrypted message"
 msgstr "????"
@@ -397,91 +401,91 @@ msgstr "????"
 msgid "Please wait while the message is being decrypted / verified..."
 msgstr ""
 
-#: src/mail.cpp:1568
+#: src/mail.cpp:1633
 msgid "Security Level 4"
 msgstr ""
 
-#: src/mail.cpp:1572
+#: src/mail.cpp:1637
 msgid "Trust Level 4"
 msgstr ""
 
-#: src/mail.cpp:1576
+#: src/mail.cpp:1641
 msgid "Security Level 3"
 msgstr ""
 
-#: src/mail.cpp:1580
+#: src/mail.cpp:1645
 msgid "Trust Level 3"
 msgstr ""
 
-#: src/mail.cpp:1584
+#: src/mail.cpp:1649
 msgid "Security Level 2"
 msgstr ""
 
-#: src/mail.cpp:1588
+#: src/mail.cpp:1653
 msgid "Trust Level 2"
 msgstr ""
 
-#: src/mail.cpp:1592
+#: src/mail.cpp:1657
 #, fuzzy
 msgid "Encrypted"
 msgstr "??"
 
-#: src/mail.cpp:1601 src/mail.cpp:1603 src/ribbon-callbacks.cpp:1542
+#: src/mail.cpp:1666 src/mail.cpp:1668 src/ribbon-callbacks.cpp:1568
 msgid "Insecure"
 msgstr ""
 
-#: src/mail.cpp:1615
+#: src/mail.cpp:1680
 #, fuzzy
 msgid "Signed and encrypted message"
 msgstr "????"
 
-#: src/mail.cpp:1619
+#: src/mail.cpp:1684
 #, fuzzy
 msgid "Signed message"
 msgstr "????"
 
-#: src/mail.cpp:1626 src/ribbon-callbacks.cpp:1565
+#: src/mail.cpp:1691 src/ribbon-callbacks.cpp:1591
 #, fuzzy
 msgid "Insecure message"
 msgstr "????"
 
-#: src/mail.cpp:1635
+#: src/mail.cpp:1700
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
-#: src/mail.cpp:1640
+#: src/mail.cpp:1705
 msgid "But you cannot be sure who sent the message because it is not signed."
 msgstr ""
 
-#: src/mail.cpp:1664
+#: src/mail.cpp:1729
 #, fuzzy
 msgid "You signed this message."
 msgstr "????"
 
-#: src/mail.cpp:1668
+#: src/mail.cpp:1733
 msgid "The senders identity was certified by yourself."
 msgstr ""
 
-#: src/mail.cpp:1672
-msgid "The sender is allowed to manage your mail trust."
+#: src/mail.cpp:1737
+msgid "The sender is allowed to certify identities for you."
 msgstr ""
 
-#: src/mail.cpp:1685
+#: src/mail.cpp:1750
 msgid "The senders identity was certified by several trusted people."
 msgstr ""
 
-#: src/mail.cpp:1690
+#: src/mail.cpp:1755
 #, c-format
 msgid ""
-"The senders identity is cerified by the trusted issuer:\n"
+"The senders identity is certified by the trusted issuer:\n"
 "'%s'\n"
 msgstr ""
 
-#: src/mail.cpp:1698
+#: src/mail.cpp:1763
 msgid "Some trusted people have certified the senders identity."
 msgstr ""
 
-#: src/mail.cpp:1708
+#: src/mail.cpp:1773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -489,107 +493,113 @@ msgid ""
 "You encrypted %i and verified %i messages since."
 msgstr ""
 
-#: src/mail.cpp:1724
+#: src/mail.cpp:1789
 msgid "The senders signature was verified for the first time."
 msgstr ""
 
-#: src/mail.cpp:1731
+#: src/mail.cpp:1796
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
 "messages and encrypted %i messages to it since %s."
 msgstr ""
 
-#: src/mail.cpp:1745
+#: src/mail.cpp:1810
 msgid "But the sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:1746
+#: src/mail.cpp:1811
 msgid "The sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:1754
+#: src/mail.cpp:1819
 #, fuzzy
 msgid "The signature is invalid: \n"
 msgstr "????\n"
 
-#: src/mail.cpp:1759
+#: src/mail.cpp:1824
 msgid "There was an error verifying the signature.\n"
 msgstr ""
 
-#: src/mail.cpp:1763
+#: src/mail.cpp:1828
 #, fuzzy
 msgid "The signature is expired.\n"
 msgstr "????\n"
 
-#: src/mail.cpp:1767
+#: src/mail.cpp:1832
 msgid "The used key"
 msgstr ""
 
-#: src/mail.cpp:1767
+#: src/mail.cpp:1832
 #, fuzzy
 msgid "The used certificate"
 msgstr "????"
 
-#: src/mail.cpp:1775
+#: src/mail.cpp:1840
 #, fuzzy
 msgid "is not available."
 msgstr "???????CRL????\n"
 
-#: src/mail.cpp:1779
+#: src/mail.cpp:1844
 msgid "is revoked."
 msgstr ""
 
-#: src/mail.cpp:1783
+#: src/mail.cpp:1848
 msgid "is expired."
 msgstr ""
 
-#: src/mail.cpp:1787
+#: src/mail.cpp:1852
 msgid "is not meant for signing."
 msgstr ""
 
-#: src/mail.cpp:1791 src/mail.cpp:1795
+#: src/mail.cpp:1856 src/mail.cpp:1860
 msgid "could not be checked for revocation."
 msgstr ""
 
-#: src/mail.cpp:1800
+#: src/mail.cpp:1865
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
 
-#: src/mail.cpp:1806
+#: src/mail.cpp:1871
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr ""
 
-#: src/mail.cpp:1817
+#: src/mail.cpp:1884
 msgid "is not certified by any trustworthy key."
 msgstr ""
 
-#: src/mail.cpp:1821
+#: src/mail.cpp:1888
+msgid ""
+"is not certified by a trustworthy Certificate Authority or the Certificate "
+"Authority is unknown."
+msgstr ""
+
+#: src/mail.cpp:1893
 msgid "The sender marked this address as revoked."
 msgstr ""
 
-#: src/mail.cpp:1825
+#: src/mail.cpp:1897
 msgid "is marked as not trustworthy."
 msgstr ""
 
-#: src/mail.cpp:1831
+#: src/mail.cpp:1903
 msgid "Click here to change the key used for this address."
 msgstr ""
 
-#: src/mail.cpp:1835
+#: src/mail.cpp:1907
 msgid "Click here for details about the key."
 msgstr ""
 
-#: src/mail.cpp:1836
+#: src/mail.cpp:1908
 msgid "Click here for details about the certificate."
 msgstr ""
 
-#: src/mail.cpp:1840
+#: src/mail.cpp:1912
 msgid "Click here to search the key on the configured keyserver."
 msgstr ""
 
-#: src/mail.cpp:1841
+#: src/mail.cpp:1913
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 
@@ -603,11 +613,11 @@ msgstr ""
 "?????????????????\n"
 "????"
 
-#: src/mailitem-events.cpp:282
+#: src/mailitem-events.cpp:284
 msgid "Sorry, that's not possible, yet"
 msgstr ""
 
-#: src/mailitem-events.cpp:284
+#: src/mailitem-events.cpp:286
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -619,7 +629,7 @@ msgid ""
 "For example by right clicking but not selecting the message.\n"
 msgstr ""
 
-#: src/main.c:460
+#: src/main.c:463
 #, c-format
 msgid "Note: Using compatibility flags: %s"
 msgstr "???????????%s"
@@ -914,19 +924,19 @@ msgstr "??????"
 msgid "Select file to encrypt"
 msgstr "????????"
 
-#: src/ribbon-callbacks.cpp:1569
+#: src/ribbon-callbacks.cpp:1595
 #, fuzzy
 msgid "No message selected"
 msgstr "????????"
 
-#: src/ribbon-callbacks.cpp:1589
+#: src/ribbon-callbacks.cpp:1615
 msgid ""
 "You cannot be sure who sent, modified and read the message in transit.\n"
 "\n"
 "Click here to learn more."
 msgstr ""
 
-#: src/ribbon-callbacks.cpp:1626
+#: src/ribbon-callbacks.cpp:1652
 #, c-format
 msgid ""
 "The message was not cryptographically signed.\n"
@@ -934,7 +944,7 @@ msgid ""
 "or if someone faked the sender address."
 msgstr ""
 
-#: src/ribbon-callbacks.cpp:1677
+#: src/ribbon-callbacks.cpp:1703
 msgid ""
 "Could not find Kleopatra.\n"
 "Please reinstall Gpg4win with the Kleopatra component enabled."
diff --git a/po/zh_TW.po b/po/zh_TW.po
index 2ba87ed..e0466e8 100644
--- a/po/zh_TW.po
+++ b/po/zh_TW.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2017-01-13 15:34+0100\n"
+"POT-Creation-Date: 2017-01-17 11:54+0100\n"
 "PO-Revision-Date: 2015-08-15 21:58+0800\n"
 "Last-Translator: Mingye Wang (Arthur2e5) <arthur200126 at hotmail.com>\n"
 "Language-Team: \n"
@@ -47,28 +47,32 @@ msgstr "????????&S?"
 msgid "&Send OpenPGP mails without attachments as PGP/Inline"
 msgstr ""
 
-#: src/addin-options.cpp:50
+#: src/addin-options.cpp:47
+msgid "S&elect crypto settings automatically for reply and foward."
+msgstr ""
+
+#: src/addin-options.cpp:52
 msgid "Debug..."
 msgstr ""
 
-#: src/addin-options.cpp:51
+#: src/addin-options.cpp:53
 msgid "Configure GnuPG"
 msgstr ""
 
-#: src/addin-options.cpp:52
+#: src/addin-options.cpp:54
 msgid "Version "
 msgstr ""
 
-#: src/addin-options.cpp:128
+#: src/addin-options.cpp:132
 msgid "Changing the interface requires a restart of Outlook."
 msgstr ""
 
-#: src/addin-options.cpp:129 src/cmdbarcontrols.cpp:105 src/engine.c:377
+#: src/addin-options.cpp:133 src/cmdbarcontrols.cpp:105 src/engine.c:377
 #: src/explorers.cpp:204 src/explorers.cpp:209 src/gpgoladdin.cpp:312
 #: src/gpgoladdin.cpp:862 src/gpgoladdin.cpp:905 src/gpgoladdin.cpp:978
 #: src/gpgoladdin.cpp:980 src/gpgoladdin.cpp:1137 src/gpgoladdin.cpp:1220
 #: src/gpgoladdin.cpp:1226 src/gpgoladdin.cpp:1299 src/gpgoladdin.cpp:1303
-#: src/main.c:461 src/message.cpp:300 src/ribbon-callbacks.cpp:133
+#: src/main.c:464 src/message.cpp:300 src/ribbon-callbacks.cpp:133
 #: src/ribbon-callbacks.cpp:247 src/ribbon-callbacks.cpp:262
 #: src/ribbon-callbacks.cpp:274 src/ribbon-callbacks.cpp:311
 #: src/ribbon-callbacks.cpp:323 src/ribbon-callbacks.cpp:668
@@ -76,8 +80,8 @@ msgstr ""
 #: src/ribbon-callbacks.cpp:712 src/ribbon-callbacks.cpp:735
 #: src/ribbon-callbacks.cpp:795 src/ribbon-callbacks.cpp:1077
 #: src/ribbon-callbacks.cpp:1111 src/ribbon-callbacks.cpp:1123
-#: src/ribbon-callbacks.cpp:1148 src/ribbon-callbacks.cpp:1629
-#: src/ribbon-callbacks.cpp:1679
+#: src/ribbon-callbacks.cpp:1148 src/ribbon-callbacks.cpp:1655
+#: src/ribbon-callbacks.cpp:1705
 msgid "GpgOL"
 msgstr "GpgOL"
 
@@ -159,12 +163,12 @@ msgstr ""
 msgid "Do you want to revert this folder?"
 msgstr "????????????"
 
-#: src/gpgoladdin.cpp:444 src/mail.cpp:1371 src/mail.cpp:1380
+#: src/gpgoladdin.cpp:444 src/mail.cpp:1371 src/mail.cpp:1442
 #, fuzzy
 msgid "GpgOL: Encrypted Message"
 msgstr "????"
 
-#: src/gpgoladdin.cpp:445 src/mail.cpp:1372 src/mail.cpp:1381
+#: src/gpgoladdin.cpp:445 src/mail.cpp:1372 src/mail.cpp:1443
 msgid "GpgOL: Trusted Sender Address"
 msgstr ""
 
@@ -193,7 +197,7 @@ msgstr "????"
 
 #: src/gpgoladdin.cpp:809
 msgid ""
-"Encrypting and cryptographically signing a message means that the recipient "
+"Encrypting and cryptographically signing a message means that the recipients "
 "can be sure that no one modified the message and only the recipients can "
 "read it"
 msgstr ""
@@ -388,7 +392,7 @@ msgstr ""
 msgid "GpgOL Warning"
 msgstr ""
 
-#: src/mail.cpp:656 src/mail.cpp:1623
+#: src/mail.cpp:656 src/mail.cpp:1688
 #, fuzzy
 msgid "Encrypted message"
 msgstr "????"
@@ -397,91 +401,91 @@ msgstr "????"
 msgid "Please wait while the message is being decrypted / verified..."
 msgstr ""
 
-#: src/mail.cpp:1568
+#: src/mail.cpp:1633
 msgid "Security Level 4"
 msgstr ""
 
-#: src/mail.cpp:1572
+#: src/mail.cpp:1637
 msgid "Trust Level 4"
 msgstr ""
 
-#: src/mail.cpp:1576
+#: src/mail.cpp:1641
 msgid "Security Level 3"
 msgstr ""
 
-#: src/mail.cpp:1580
+#: src/mail.cpp:1645
 msgid "Trust Level 3"
 msgstr ""
 
-#: src/mail.cpp:1584
+#: src/mail.cpp:1649
 msgid "Security Level 2"
 msgstr ""
 
-#: src/mail.cpp:1588
+#: src/mail.cpp:1653
 msgid "Trust Level 2"
 msgstr ""
 
-#: src/mail.cpp:1592
+#: src/mail.cpp:1657
 #, fuzzy
 msgid "Encrypted"
 msgstr "??"
 
-#: src/mail.cpp:1601 src/mail.cpp:1603 src/ribbon-callbacks.cpp:1542
+#: src/mail.cpp:1666 src/mail.cpp:1668 src/ribbon-callbacks.cpp:1568
 msgid "Insecure"
 msgstr ""
 
-#: src/mail.cpp:1615
+#: src/mail.cpp:1680
 #, fuzzy
 msgid "Signed and encrypted message"
 msgstr "????"
 
-#: src/mail.cpp:1619
+#: src/mail.cpp:1684
 #, fuzzy
 msgid "Signed message"
 msgstr "????"
 
-#: src/mail.cpp:1626 src/ribbon-callbacks.cpp:1565
+#: src/mail.cpp:1691 src/ribbon-callbacks.cpp:1591
 #, fuzzy
 msgid "Insecure message"
 msgstr "????"
 
-#: src/mail.cpp:1635
+#: src/mail.cpp:1700
 msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
-#: src/mail.cpp:1640
+#: src/mail.cpp:1705
 msgid "But you cannot be sure who sent the message because it is not signed."
 msgstr ""
 
-#: src/mail.cpp:1664
+#: src/mail.cpp:1729
 #, fuzzy
 msgid "You signed this message."
 msgstr "????"
 
-#: src/mail.cpp:1668
+#: src/mail.cpp:1733
 msgid "The senders identity was certified by yourself."
 msgstr ""
 
-#: src/mail.cpp:1672
-msgid "The sender is allowed to manage your mail trust."
+#: src/mail.cpp:1737
+msgid "The sender is allowed to certify identities for you."
 msgstr ""
 
-#: src/mail.cpp:1685
+#: src/mail.cpp:1750
 msgid "The senders identity was certified by several trusted people."
 msgstr ""
 
-#: src/mail.cpp:1690
+#: src/mail.cpp:1755
 #, c-format
 msgid ""
-"The senders identity is cerified by the trusted issuer:\n"
+"The senders identity is certified by the trusted issuer:\n"
 "'%s'\n"
 msgstr ""
 
-#: src/mail.cpp:1698
+#: src/mail.cpp:1763
 msgid "Some trusted people have certified the senders identity."
 msgstr ""
 
-#: src/mail.cpp:1708
+#: src/mail.cpp:1773
 #, c-format
 msgid ""
 "The senders address is trusted, because you have established a communication "
@@ -489,107 +493,113 @@ msgid ""
 "You encrypted %i and verified %i messages since."
 msgstr ""
 
-#: src/mail.cpp:1724
+#: src/mail.cpp:1789
 msgid "The senders signature was verified for the first time."
 msgstr ""
 
-#: src/mail.cpp:1731
+#: src/mail.cpp:1796
 #, c-format
 msgid ""
 "The senders address is not trustworthy yet because you only verified %i "
 "messages and encrypted %i messages to it since %s."
 msgstr ""
 
-#: src/mail.cpp:1745
+#: src/mail.cpp:1810
 msgid "But the sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:1746
+#: src/mail.cpp:1811
 msgid "The sender address is not trustworthy because:"
 msgstr ""
 
-#: src/mail.cpp:1754
+#: src/mail.cpp:1819
 #, fuzzy
 msgid "The signature is invalid: \n"
 msgstr "????\n"
 
-#: src/mail.cpp:1759
+#: src/mail.cpp:1824
 msgid "There was an error verifying the signature.\n"
 msgstr ""
 
-#: src/mail.cpp:1763
+#: src/mail.cpp:1828
 #, fuzzy
 msgid "The signature is expired.\n"
 msgstr "????\n"
 
-#: src/mail.cpp:1767
+#: src/mail.cpp:1832
 msgid "The used key"
 msgstr ""
 
-#: src/mail.cpp:1767
+#: src/mail.cpp:1832
 #, fuzzy
 msgid "The used certificate"
 msgstr "????"
 
-#: src/mail.cpp:1775
+#: src/mail.cpp:1840
 #, fuzzy
 msgid "is not available."
 msgstr "???????CRL????\n"
 
-#: src/mail.cpp:1779
+#: src/mail.cpp:1844
 msgid "is revoked."
 msgstr ""
 
-#: src/mail.cpp:1783
+#: src/mail.cpp:1848
 msgid "is expired."
 msgstr ""
 
-#: src/mail.cpp:1787
+#: src/mail.cpp:1852
 msgid "is not meant for signing."
 msgstr ""
 
-#: src/mail.cpp:1791 src/mail.cpp:1795
+#: src/mail.cpp:1856 src/mail.cpp:1860
 msgid "could not be checked for revocation."
 msgstr ""
 
-#: src/mail.cpp:1800
+#: src/mail.cpp:1865
 msgid "is not the same as the key that was used for this address in the past."
 msgstr ""
 
-#: src/mail.cpp:1806
+#: src/mail.cpp:1871
 #, c-format
 msgid "does not claim the address: \"%s\"."
 msgstr ""
 
-#: src/mail.cpp:1817
+#: src/mail.cpp:1884
 msgid "is not certified by any trustworthy key."
 msgstr ""
 
-#: src/mail.cpp:1821
+#: src/mail.cpp:1888
+msgid ""
+"is not certified by a trustworthy Certificate Authority or the Certificate "
+"Authority is unknown."
+msgstr ""
+
+#: src/mail.cpp:1893
 msgid "The sender marked this address as revoked."
 msgstr ""
 
-#: src/mail.cpp:1825
+#: src/mail.cpp:1897
 msgid "is marked as not trustworthy."
 msgstr ""
 
-#: src/mail.cpp:1831
+#: src/mail.cpp:1903
 msgid "Click here to change the key used for this address."
 msgstr ""
 
-#: src/mail.cpp:1835
+#: src/mail.cpp:1907
 msgid "Click here for details about the key."
 msgstr ""
 
-#: src/mail.cpp:1836
+#: src/mail.cpp:1908
 msgid "Click here for details about the certificate."
 msgstr ""
 
-#: src/mail.cpp:1840
+#: src/mail.cpp:1912
 msgid "Click here to search the key on the configured keyserver."
 msgstr ""
 
-#: src/mail.cpp:1841
+#: src/mail.cpp:1913
 msgid "Click here to search the certificate on the configured X509 keyserver."
 msgstr ""
 
@@ -603,11 +613,11 @@ msgstr ""
 "?????????????????\n"
 "????"
 
-#: src/mailitem-events.cpp:282
+#: src/mailitem-events.cpp:284
 msgid "Sorry, that's not possible, yet"
 msgstr ""
 
-#: src/mailitem-events.cpp:284
+#: src/mailitem-events.cpp:286
 #, c-format
 msgid ""
 "GpgOL has prevented the change to the \"%s\" property.\n"
@@ -619,7 +629,7 @@ msgid ""
 "For example by right clicking but not selecting the message.\n"
 msgstr ""
 
-#: src/main.c:460
+#: src/main.c:463
 #, c-format
 msgid "Note: Using compatibility flags: %s"
 msgstr "???????????%s"
@@ -916,19 +926,19 @@ msgstr "??????"
 msgid "Select file to encrypt"
 msgstr "????????"
 
-#: src/ribbon-callbacks.cpp:1569
+#: src/ribbon-callbacks.cpp:1595
 #, fuzzy
 msgid "No message selected"
 msgstr "????????"
 
-#: src/ribbon-callbacks.cpp:1589
+#: src/ribbon-callbacks.cpp:1615
 msgid ""
 "You cannot be sure who sent, modified and read the message in transit.\n"
 "\n"
 "Click here to learn more."
 msgstr ""
 
-#: src/ribbon-callbacks.cpp:1626
+#: src/ribbon-callbacks.cpp:1652
 #, c-format
 msgid ""
 "The message was not cryptographically signed.\n"
@@ -936,7 +946,7 @@ msgid ""
 "or if someone faked the sender address."
 msgstr ""
 
-#: src/ribbon-callbacks.cpp:1677
+#: src/ribbon-callbacks.cpp:1703
 msgid ""
 "Could not find Kleopatra.\n"
 "Please reinstall Gpg4win with the Kleopatra component enabled."

commit 13380236374cbfbc7eb0558ba3377ddad0d32adc
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Tue Jan 17 11:55:45 2017 +0100

    Minor string improvements
    
    --

diff --git a/src/gpgoladdin.cpp b/src/gpgoladdin.cpp
index 9eda8c2..3968487 100644
--- a/src/gpgoladdin.cpp
+++ b/src/gpgoladdin.cpp
@@ -807,7 +807,7 @@ GetCustomUI_MIME (BSTR RibbonID, BSTR * RibbonXml)
     _("Sign and encrypt the message");
   const char *secureSTip =
     _("Encrypting and cryptographically signing a message means that the "
-      "recipient can be sure that no one modified the message and only the "
+      "recipients can be sure that no one modified the message and only the "
       "recipients can read it");
   const char *optsSTip =
     _("Open the settings dialog for GpgOL");
diff --git a/src/mail.cpp b/src/mail.cpp
index 03c2382..89219eb 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1734,7 +1734,7 @@ Mail::get_crypto_details()
         }
       else if (four_check == 2)
         {
-          message = _("The sender is allowed to manage your mail trust.");
+          message = _("The sender is allowed to certify identities for you.");
         }
       else
         {
@@ -1752,7 +1752,7 @@ Mail::get_crypto_details()
   else if (level == 3 && !isOpenPGP)
     {
       /* Level three is the only level for trusted S/MIME keys. */
-      gpgrt_asprintf (&buf, _("The senders identity is cerified by the trusted issuer:\n'%s'\n"),
+      gpgrt_asprintf (&buf, _("The senders identity is certified by the trusted issuer:\n'%s'\n"),
                       m_sig.key().issuerName());
       message = buf;
       xfree (buf);

-----------------------------------------------------------------------

Summary of changes:
 po/de.po           | 306 +++++++++++++++++++++++++++--------------------------
 po/fr.po           | 142 +++++++++++++------------
 po/pt.po           | 142 +++++++++++++------------
 po/sv.po           | 142 +++++++++++++------------
 po/zh_CN.po        | 142 +++++++++++++------------
 po/zh_TW.po        | 142 +++++++++++++------------
 src/gpgoladdin.cpp |   2 +-
 src/mail.cpp       |   4 +-
 8 files changed, 541 insertions(+), 481 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 17 12:31:52 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 17 Jan 2017 12:31:52 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.26-7-g66275ac
Message-ID: <E1cTRzW-0008FF-Om@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  66275ac5b8db9d83a72b5497eec4e6d9ac3b4e65 (commit)
      from  19de4cef279272d3969e36dd8cd2fa05a7bf5276 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 66275ac5b8db9d83a72b5497eec4e6d9ac3b4e65
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 17 12:27:12 2017 +0100

    build: Modernize autogen.sh.
    
    * autogen.sh: Update from GnuPG.
    * autogen.rc (version_parts): New.
    * configure.ac: Change to use autogen.sh --find-version helper.
    * Makefile.am (dist-hook): Do not create VERSION
    (EXTRA_DIST): Add VERSION.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/.gitignore b/.gitignore
index 27dd2e9..fa9b999 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,3 +48,4 @@ src/err-sources.h
 /doc/gpgrt.info
 /doc/stamp-vti
 /doc/version.texi
+/VERSION
diff --git a/Makefile.am b/Makefile.am
index 5abd97d..f5d0b81 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -23,7 +23,7 @@ DISTCHECK_CONFIGURE_FLAGS = --enable-doc
 GITLOG_TO_CHANGELOG=gitlog-to-changelog
 
 EXTRA_DIST = autogen.sh autogen.rc libgpg-error.spec.in 		\
-             COPYING COPYING.LIB potomo doc/HACKING ChangeLog-2011   	\
+             VERSION COPYING COPYING.LIB potomo doc/HACKING ChangeLog-2011 \
 	     po/ChangeLog-2011 m4/ChangeLog-2011 contrib/ChangeLog-2011 \
              build-aux/git-log-footer  build-aux/git-log-fix
 
@@ -51,7 +51,6 @@ SUBDIRS = m4 src $(doc) $(tests) po $(lang_subdirs)
 dist-hook: gen-ChangeLog
 	sed -e 's/@pkg_version@/$(VERSION)/g' \
 	    $(top_srcdir)/libgpg-error.spec.in  > $(distdir)/libgpg-error.spec
-	@set -e; echo "$(VERSION)" > $(distdir)/VERSION
 
 distcheck-hook:
 	set -e; ( \
diff --git a/autogen.rc b/autogen.rc
index a9cf145..b128361 100644
--- a/autogen.rc
+++ b/autogen.rc
@@ -1,5 +1,7 @@
 # autogen.sh configuration for libgpg-error                   -*- sh -*-
 
+version_parts=2
+
 case "$myhost:$myhostsub" in
   w32:ce)
     extraoptions=
diff --git a/autogen.sh b/autogen.sh
index 91f35a6..e5ba5bf 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -1,6 +1,6 @@
 #! /bin/sh
 # autogen.sh
-# Copyright (C) 2003, 2014 g10 Code GmbH
+# Copyright (C) 2003, 2014, 2017 g10 Code GmbH
 #
 # This file is free software; as a special exception the author gives
 # unlimited permission to copy and/or distribute it, with or without
@@ -15,7 +15,7 @@
 # configure it for the respective package.  It is maintained as part of
 # GnuPG and source copied by other packages.
 #
-# Version: 2014-01-10
+# Version: 2017-01-17
 
 configure_ac="configure.ac"
 
@@ -41,7 +41,7 @@ fatal () {
 
 info () {
     if [ -z "${SILENT}" ]; then
-      echo "autogen.sh:" "$*"
+      echo "autogen.sh:" "$*" >&2
     fi
 }
 
@@ -70,14 +70,27 @@ MSGMERGE=${GETTEXT_PREFIX}${MSGMERGE:-msgmerge}${GETTEXT_SUFFIX}
 DIE=no
 FORCE=
 SILENT=
+PRINT_HOST=no
+PRINT_BUILD=no
 tmp=$(dirname "$0")
 tsdir=$(cd "${tmp}"; pwd)
+version_parts=3
 
 if [ -n "${AUTOGEN_SH_SILENT}" ]; then
   SILENT=" --silent"
 fi
 if test x"$1" = x"--help"; then
-  echo "usage: ./autogen.sh [--silent] [--force] [--build-TYPE] [ARGS]"
+  echo "usage: ./autogen.sh [OPTIONS] [ARGS]"
+  echo "  Options:"
+  echo "    --silent       Silent operation"
+  echo "    --force        Pass --force to autoconf"
+  echo "    --find-version Helper for configure.ac"
+  echo "    --build-TYPE   Configure to cross build for TYPE"
+  echo "    --print-host   Print only the host triplet"
+  echo "    --print-build  Print only the build platform triplet"
+  echo ""
+  echo "  ARGS are passed to configure in --build-TYPE mode."
+  echo "  Configuration for this script is expected in autogen.rc"
   exit 0
 fi
 if test x"$1" = x"--silent"; then
@@ -88,6 +101,14 @@ if test x"$1" = x"--force"; then
   FORCE=" --force"
   shift
 fi
+if test x"$1" = x"--print-host"; then
+  PRINT_HOST=yes
+  shift
+fi
+if test x"$1" = x"--print-build"; then
+  PRINT_BUILD=yes
+  shift
+fi
 
 
 # Reject unsafe characters in $HOME, $tsdir and cwd.  We consider spaces
@@ -133,6 +154,11 @@ amd64_toolprefixes=
 myhost=""
 myhostsub=""
 case "$1" in
+    --find-version)
+        myhost="find-version"
+        SILENT=" --silent"
+        shift
+        ;;
     --build-w32)
         myhost="w32"
         shift
@@ -172,16 +198,81 @@ if [ -f "$HOME/.gnupg-autogen.rc" ]; then
     . "$HOME/.gnupg-autogen.rc"
 fi
 
+
+# **** FIND VERSION ****
+# This is a helper for the configure.ac M4 magic
+# Called
+#   ./autogen.sh --find-version PACKAGE MAJOR MINOR [MICRO]
+# returns a complete version string with automatic beta numbering.
+if [ "$myhost" = "find-version" ]; then
+    package="$1"
+    major="$2"
+    minor="$3"
+    micro="$4"
+
+    if [ -z "$package" -o -z "$major" -o -z "$minor" ]; then
+      echo "usage: ./autogen.sh --find-version PACKAGE MAJOR MINOR [MICRO]" >&2
+      exit 1
+    fi
+
+    case "$version_parts" in
+      2)
+        matchstr1="$package-$major.[0-9]*"
+        matchstr2="$package-$major-base"
+        vers="$major.$minor"
+        ;;
+      *)
+        matchstr1="$package-$major.$minor.[0-9]*"
+        matchstr2="$package-$major.$minor-base"
+        vers="$major.$minor.$micro"
+        ;;
+    esac
+
+    beta=no
+    if [ -e .git ]; then
+      ingit=yes
+      tmp=$(git describe --match "${matchstr1}" --long 2>/dev/null)
+      tmp=$(echo "$tmp" | sed s/^"$package"//)
+      if [ -n "$tmp" ]; then
+          tmp=$(echo "$tmp" | sed s/^"$package"//  \
+                | awk -F- '$3!=0 && $3 !~ /^beta/ {print"-beta"$3}')
+      else
+          tmp=$(git describe --match "${matchstr2}" --long 2>/dev/null \
+                | awk -F- '$4!=0{print"-beta"$4}')
+      fi
+      [ -n "$tmp" ] && beta=yes
+      rev=$(git rev-parse --short HEAD | tr -d '\n\r')
+      rvd=$((0x$(echo ${rev} | dd bs=1 count=4 2>/dev/null)))
+    else
+      ingit=no
+      beta=yes
+      tmp="-unknown"
+      rev="0000000"
+      rvd="0"
+    fi
+
+    echo "$package-$vers$tmp:$beta:$ingit:$vers$tmp:$vers:$tmp:$rev:$rvd:"
+    exit 0
+fi
+# **** end FIND VERSION ****
+
+
+if [ ! -f "$tsdir/build-aux/config.guess" ]; then
+    fatal "$tsdir/build-aux/config.guess not found"
+    exit 1
+fi
+build=`$tsdir/build-aux/config.guess`
+if [ $PRINT_BUILD = yes ]; then
+    echo "$build"
+    exit 0
+fi
+
+
+
 # ******************
 #  W32 build script
 # ******************
 if [ "$myhost" = "w32" ]; then
-    if [ ! -f "$tsdir/build-aux/config.guess" ]; then
-        fatal "$tsdir/build-aux/config.guess not found"
-        exit 1
-    fi
-    build=`$tsdir/build-aux/config.guess`
-
     case $myhostsub in
         ce)
           w32root="$w32ce_root"
@@ -222,6 +313,10 @@ if [ "$myhost" = "w32" ]; then
         fi
         die_p
     fi
+    if [ $PRINT_HOST = yes ]; then
+        echo "$host"
+        exit 0
+    fi
 
     if [ -f "$tsdir/config.log" ]; then
         if ! head $tsdir/config.log | grep "$host" >/dev/null; then
@@ -232,7 +327,8 @@ if [ "$myhost" = "w32" ]; then
 
     $tsdir/configure --enable-maintainer-mode ${SILENT} \
              --prefix=${w32root}  \
-             --host=${host} --build=${build} \
+             --host=${host} --build=${build} SYSROOT=${w32root} \
+             PKG_CONFIG_LIBDIR=${w32root}/lib/pkgconfig \
              ${configure_opts} ${extraoptions} "$@"
     rc=$?
     exit $rc
@@ -242,13 +338,6 @@ fi
 # ***** AMD64 cross build script *******
 # Used to cross-compile for AMD64 (for testing)
 if [ "$myhost" = "amd64" ]; then
-    shift
-    if [ ! -f $tsdir/build-aux/config.guess ]; then
-        echo "$tsdir/build-aux/config.guess not found" >&2
-        exit 1
-    fi
-    build=`$tsdir/build-aux/config.guess`
-
     [ -z "$amd64root" ] && amd64root="$HOME/amd64root"
     info "Using $amd64root as standard install directory"
     replace_sysroot
@@ -269,6 +358,10 @@ if [ "$myhost" = "amd64" ]; then
         echo "Stop." >&2
         exit 1
     fi
+    if [ $PRINT_HOST = yes ]; then
+        echo "$host"
+        exit 0
+    fi
 
     if [ -f "$tsdir/config.log" ]; then
         if ! head $tsdir/config.log | grep "$host" >/dev/null; then
@@ -341,8 +434,11 @@ fi
 
 # Check the git setup.
 if [ -d .git ]; then
-  CP="cp -a"
-  [ -z "${SILENT}" ] && CP="$CP -v"
+  CP="cp -p"
+  # If we have a GNU cp we can add -v
+  if cp --version >/dev/null 2>/dev/null; then
+    [ -z "${SILENT}" ] && CP="$CP -v"
+  fi
   if [ -f .git/hooks/pre-commit.sample -a ! -f .git/hooks/pre-commit ] ; then
     [ -z "${SILENT}" ] && cat <<EOF
 *** Activating trailing whitespace git pre-commit hook. ***
diff --git a/configure.ac b/configure.ac
index 6d4f173..30a46bc 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,5 +1,5 @@
 # configure.ac for libgpg-error
-# Copyright (C) 2003, 2004, 2006, 2010, 2013, 2014, 2015, 2016 g10 Code GmbH
+# Copyright (C) 2003, 2004, 2006, 2010, 2013-2017 g10 Code GmbH
 #
 # This file is part of libgpg-error.
 #
@@ -26,25 +26,22 @@ min_automake_version="1.14"
 # Please bump the version number immediately after the release, do
 # another commit, and a push so that the git magic is able to work.
 # See below for the LT versions.
-m4_define([mym4_version_major], [1])
-m4_define([mym4_version_minor], [27])
+m4_define([mym4_package],[libgpg-error])
+m4_define([mym4_major], [1])
+m4_define([mym4_minor], [27])
 
 # Below is m4 magic to extract and compute the revision number, the
 # decimalized short revision number, a beta version string, and a flag
 # indicating a development version (mym4_isgit). Note that the m4
 # processing is done by autoconf and not during the configure run.
-m4_define([mym4_version], [mym4_version_major.mym4_version_minor])
-m4_define([mym4_revision],
-          m4_esyscmd([git rev-parse --short HEAD | tr -d '\n\r']))
-m4_define([mym4_revision_dec],
-          m4_esyscmd_s([echo $((0x$(echo ]mym4_revision[|head -c 4)))]))
-m4_define([mym4_betastring],
-       m4_esyscmd_s([git describe --match 'libgpg-error-[0-9].*[0-9]' --long|\
-                        awk -F- '$4!=0{print"-beta"$4}']))
-m4_define([mym4_isgit],m4_if(mym4_betastring,[],[no],[yes]))
-m4_define([mym4_full_version],[mym4_version[]mym4_betastring])
-
-AC_INIT([libgpg-error],[mym4_full_version],[https://bugs.gnupg.org])
+m4_define([mym4_verslist], m4_split(m4_esyscmd([./autogen.sh --find-version] \
+                           mym4_package mym4_major mym4_minor),[:]))
+m4_define([mym4_isbeta],       m4_argn(2, mym4_verslist))
+m4_define([mym4_version],      m4_argn(4, mym4_verslist))
+m4_define([mym4_revision],     m4_argn(7, mym4_verslist))
+m4_define([mym4_revision_dec], m4_argn(8, mym4_verslist))
+m4_esyscmd([echo ]mym4_version[>VERSION])
+AC_INIT([mym4_package],[mym4_version], [https://bugs.gnupg.org])
 # LT Version numbers, remember to change them just *before* a release.
 #   (Code changed:			REVISION++)
 #   (Interfaces added/removed/changed:	CURRENT++, REVISION=0)
@@ -60,8 +57,7 @@ AC_SUBST(LIBGPG_ERROR_LT_CURRENT)
 AC_SUBST(LIBGPG_ERROR_LT_AGE)
 AC_SUBST(LIBGPG_ERROR_LT_REVISION)
 
-VERSION_NUMBER=m4_esyscmd(printf "0x%02x%02x00" mym4_version_major \
-                          mym4_version_minor)
+VERSION_NUMBER=m4_esyscmd(printf "0x%02x%02x00" mym4_major mym4_minor)
 AC_SUBST(VERSION_NUMBER)
 
 AC_CONFIG_AUX_DIR([build-aux])
@@ -572,7 +568,7 @@ if test "$have_w32_system" != yes; then
    fi
 fi
 echo "
-        $PACKAGE_NAME-$PACKAGE_VERSION prepared for make
+        $PACKAGE_NAME v$PACKAGE_VERSION has been configured as follows:
 
         Revision: mym4_revision  (mym4_revision_dec)
         Platform: $host$tmp

-----------------------------------------------------------------------

Summary of changes:
 .gitignore   |   1 +
 Makefile.am  |   3 +-
 autogen.rc   |   2 +
 autogen.sh   | 136 ++++++++++++++++++++++++++++++++++++++++++++++++++---------
 configure.ac |  32 ++++++--------
 5 files changed, 134 insertions(+), 40 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 17 12:32:37 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 17 Jan 2017 12:32:37 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-82-ga09f258
Message-ID: <E1cTS0F-0008Id-O9@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  a09f258b1412209763222e2e81bab79663e4d685 (commit)
      from  356323768a1a29138581d0aceed0336ab8be0d5c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a09f258b1412209763222e2e81bab79663e4d685
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 17 12:14:53 2017 +0100

    build: Handle packages with dashes in --find-version.
    
    * autogen.sh (--find-version): Improve version extraction.
    * (--help): Extend.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/autogen.sh b/autogen.sh
index 3ef1ea0..e5ba5bf 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -1,6 +1,6 @@
 #! /bin/sh
 # autogen.sh
-# Copyright (C) 2003, 2014 g10 Code GmbH
+# Copyright (C) 2003, 2014, 2017 g10 Code GmbH
 #
 # This file is free software; as a special exception the author gives
 # unlimited permission to copy and/or distribute it, with or without
@@ -15,7 +15,7 @@
 # configure it for the respective package.  It is maintained as part of
 # GnuPG and source copied by other packages.
 #
-# Version: 2014-06-06
+# Version: 2017-01-17
 
 configure_ac="configure.ac"
 
@@ -80,7 +80,17 @@ if [ -n "${AUTOGEN_SH_SILENT}" ]; then
   SILENT=" --silent"
 fi
 if test x"$1" = x"--help"; then
-  echo "usage: ./autogen.sh [--silent] [--force] [--build-TYPE] [ARGS]"
+  echo "usage: ./autogen.sh [OPTIONS] [ARGS]"
+  echo "  Options:"
+  echo "    --silent       Silent operation"
+  echo "    --force        Pass --force to autoconf"
+  echo "    --find-version Helper for configure.ac"
+  echo "    --build-TYPE   Configure to cross build for TYPE"
+  echo "    --print-host   Print only the host triplet"
+  echo "    --print-build  Print only the build platform triplet"
+  echo ""
+  echo "  ARGS are passed to configure in --build-TYPE mode."
+  echo "  Configuration for this script is expected in autogen.rc"
   exit 0
 fi
 if test x"$1" = x"--silent"; then
@@ -200,6 +210,11 @@ if [ "$myhost" = "find-version" ]; then
     minor="$3"
     micro="$4"
 
+    if [ -z "$package" -o -z "$major" -o -z "$minor" ]; then
+      echo "usage: ./autogen.sh --find-version PACKAGE MAJOR MINOR [MICRO]" >&2
+      exit 1
+    fi
+
     case "$version_parts" in
       2)
         matchstr1="$package-$major.[0-9]*"
@@ -217,8 +232,10 @@ if [ "$myhost" = "find-version" ]; then
     if [ -e .git ]; then
       ingit=yes
       tmp=$(git describe --match "${matchstr1}" --long 2>/dev/null)
+      tmp=$(echo "$tmp" | sed s/^"$package"//)
       if [ -n "$tmp" ]; then
-          tmp=$(echo "$tmp"|awk -F- '$3!=0 && $3 !~ /^beta/ {print"-beta"$3}')
+          tmp=$(echo "$tmp" | sed s/^"$package"//  \
+                | awk -F- '$3!=0 && $3 !~ /^beta/ {print"-beta"$3}')
       else
           tmp=$(git describe --match "${matchstr2}" --long 2>/dev/null \
                 | awk -F- '$4!=0{print"-beta"$4}')
@@ -426,7 +443,7 @@ if [ -d .git ]; then
     [ -z "${SILENT}" ] && cat <<EOF
 *** Activating trailing whitespace git pre-commit hook. ***
     For more information see this thread:
-      http://mail.gnome.org/archives/desktop-devel-list/2009-May/msg00084.html
+      https://mail.gnome.org/archives/desktop-devel-list/2009-May/msg00084.html
     To deactivate this pre-commit hook again move .git/hooks/pre-commit
     and .git/hooks/pre-commit.sample out of the way.
 EOF

-----------------------------------------------------------------------

Summary of changes:
 autogen.sh | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 17 15:22:05 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Tue, 17 Jan 2017 15:22:05 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-35-gca69df8
Message-ID: <E1cTUeF-0007Nq-Bf@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  ca69df8c8d3f044340aee2a118cc20d33cd600a1 (commit)
      from  abfd241d1a1ae8e30e18b7c5e0658b8c54d89544 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ca69df8c8d3f044340aee2a118cc20d33cd600a1
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Tue Jan 17 15:20:56 2017 +0100

    tests: Add safeguards against nullptr deref
    
    * t-gpgconf.c (main): Test some values before dereferencing them.

diff --git a/tests/gpg/t-gpgconf.c b/tests/gpg/t-gpgconf.c
index d199d2e..52f0f8b 100644
--- a/tests/gpg/t-gpgconf.c
+++ b/tests/gpg/t-gpgconf.c
@@ -309,9 +309,10 @@ main (void)
     fail_if_err (err);
     if (lookup (conf, "dirmngr", "verbose", &comp, &opt))
       {
-	/* Found.  */
-	test (opt->alt_type == GPGME_CONF_NONE);
-	test ((unsigned long) opt->value->value.count == count);
+        /* Found.  */
+        test (opt->alt_type == GPGME_CONF_NONE);
+        test (opt->value);
+        test ((unsigned long) opt->value->value.count == count);
       }
 
     fprintf (stderr, ".");
@@ -350,9 +351,11 @@ main (void)
     fail_if_err (err);
     if (lookup (conf, "gpg", "keyserver", &comp, &opt))
       {
-	/* Found.  */
-	test (opt->alt_type == GPGME_CONF_STRING);
-	test (strcmp (opt->value->value.string, values[i%2]) == 0);
+        /* Found.  */
+        test (opt->alt_type == GPGME_CONF_STRING);
+        test (opt->value);
+        test (opt->value->value.string);
+        test (strcmp (opt->value->value.string, values[i%2]) == 0);
       }
 
     fprintf (stderr, ".");

-----------------------------------------------------------------------

Summary of changes:
 tests/gpg/t-gpgconf.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 18 08:08:14 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Wed, 18 Jan 2017 08:08:14 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-84-g79cea89
Message-ID: <E1cTkLx-0008M0-DQ@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  79cea89774e6327b6785e22b7057f9e3e188ac2b (commit)
       via  8b1f24a29ebc7651437c01990215a55b1136dae0 (commit)
      from  a09f258b1412209763222e2e81bab79663e4d685 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 79cea89774e6327b6785e22b7057f9e3e188ac2b
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Jan 18 15:48:50 2017 +0900

    scd: Cleanup SERIALNO protocol.
    
    * scd/app.c (app_get_serial_and_stamp): Remove.
    (app_get_serialno): New.
    (app_write_learn_status): Use send_status_direct.
    (app_getattr): Use app_get_serialno for SERIALNO and
    send with send_status_direct.
    * scd/app-openpgp.c (do_getattr): Likewise.
    * scd/command.c (cmd_serialno): Don't send TIMESTAMP of 0.
    (cmd_learn): Likewise.  Don't inquire with TIMESTAMP of 0.
    
    --
    
    In the SERIALNO protocol, timestamp used to be considered, but had never
    used at all.  In the new implementation, removed card/token is always
    detected and connection becomes invalid, no timestamp is required any
    more.  Examined scute and poldi as well for this protocol change.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/doc/scdaemon.texi b/doc/scdaemon.texi
index 4cf44bc..1617801 100644
--- a/doc/scdaemon.texi
+++ b/doc/scdaemon.texi
@@ -516,11 +516,10 @@ done on the same card unless he call this function.
 Return the serial number of the card using a status response like:
 
 @example
-  S SERIALNO D27600000000000000000000 0
+  S SERIALNO D27600000000000000000000
 @end example
 
-The trailing 0 should be ignored for now, it is reserved for a future
-extension.  The serial number is the hex encoded value identified by
+The serial number is the hex encoded value identified by
 the @code{0x5A} tag in the GDO file (FIX=0x2F02).
 
 
@@ -537,7 +536,7 @@ used without the @option{--force} option, the command might do an INQUIRE
 like this:
 
 @example
-      INQUIRE KNOWNCARDP <hexstring_with_serialNumber> <timestamp>
+      INQUIRE KNOWNCARDP <hexstring_with_serialNumber>
 @end example
 
 The client should just send an @code{END} if the processing should go on
diff --git a/scd/app-common.h b/scd/app-common.h
index 7c6822f..b979f54 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -124,6 +124,7 @@ size_t app_help_read_length_of_cert (int slot, int fid, size_t *r_certoff);
 app_t app_list_start (void);
 void app_list_finish (void);
 void app_send_card_list (ctrl_t ctrl);
+char *app_get_serialno (app_t app);
 
 void app_dump_state (void);
 void application_notify_card_reset (int slot);
@@ -135,7 +136,6 @@ gpg_error_t select_application (ctrl_t ctrl, const char *name, app_t *r_app,
 char *get_supported_applications (void);
 void release_application (app_t app);
 gpg_error_t app_munge_serialno (app_t app);
-gpg_error_t app_get_serial_and_stamp (app_t app, char **serial, time_t *stamp);
 gpg_error_t app_write_learn_status (app_t app, ctrl_t ctrl,
                                     unsigned int flags);
 gpg_error_t app_readcert (app_t app, ctrl_t ctrl, const char *certid,
diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index 4d8b1bc..71c9e1b 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -978,21 +978,13 @@ do_getattr (app_t app, ctrl_t ctrl, const char *name)
   if (table[idx].special == -1)
     {
       /* The serial number is very special.  We could have used the
-         AID DO to retrieve it, but we have it already in the app
-         context and the stamp argument is required anyway which we
-         can't by other means. The AID DO is available anyway but not
-         hex formatted. */
-      char *serial;
-      time_t stamp;
-      char tmp[50];
-
-      if (!app_get_serial_and_stamp (app, &serial, &stamp))
+         AID DO to retrieve it.  The AID DO is available anyway but
+         not hex formatted. */
+      char *serial = app_get_serialno (app);
+
+      if (serial)
         {
-          sprintf (tmp, "%lu", (unsigned long)stamp);
-          send_status_info (ctrl, "SERIALNO",
-                            serial, strlen (serial),
-                            tmp, strlen (tmp),
-                            NULL, 0);
+          send_status_direct (ctrl, "SERIALNO", serial);
           xfree (serial);
         }
       return 0;
@@ -1029,10 +1021,9 @@ do_getattr (app_t app, ctrl_t ctrl, const char *name)
     }
   if (table[idx].special == -4)
     {
-      char *serial;
-      time_t stamp;
+      char *serial = app_get_serialno (app);
 
-      if (!app_get_serial_and_stamp (app, &serial, &stamp))
+      if (serial)
         {
           if (strlen (serial) > 16+12)
             {
diff --git a/scd/app.c b/scd/app.c
index 681acb8..b10a452 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -534,33 +534,23 @@ app_munge_serialno (app_t app)
 
 
 
-/* Retrieve the serial number and the time of the last update of the
-   card.  The serial number is returned as a malloced string (hex
-   encoded) in SERIAL and the time of update is returned in STAMP.  If
-   no update time is available the returned value is 0.  Caller must
-   free SERIAL unless the function returns an error.  If STAMP is not
-   of interest, NULL may be passed. */
-gpg_error_t
-app_get_serial_and_stamp (app_t app, char **serial, time_t *stamp)
+/* Retrieve the serial number of the card.  The serial number is
+   returned as a malloced string (hex encoded) in SERIAL.  Caller must
+   free SERIAL unless the function returns an error.  */
+char *
+app_get_serialno (app_t app)
 {
-  char *buf;
-
-  if (!app || !serial)
-    return gpg_error (GPG_ERR_INV_VALUE);
+  char *serial;
 
-  *serial = NULL;
-  if (stamp)
-    *stamp = 0; /* not available */
+  if (!app)
+    return NULL;
 
   if (!app->serialnolen)
-    buf = xtrystrdup ("FF7F00");
+    serial = xtrystrdup ("FF7F00");
   else
-    buf = bin2hex (app->serialno, app->serialnolen, NULL);
-  if (!buf)
-    return gpg_error_from_syserror ();
+    serial = bin2hex (app->serialno, app->serialnolen, NULL);
 
-  *serial = buf;
-  return 0;
+  return serial;
 }
 
 
@@ -578,8 +568,7 @@ app_write_learn_status (app_t app, ctrl_t ctrl, unsigned int flags)
 
   /* We do not send APPTYPE if only keypairinfo is requested.  */
   if (app->apptype && !(flags & 1))
-    send_status_info (ctrl, "APPTYPE",
-                      app->apptype, strlen (app->apptype), NULL, 0);
+    send_status_direct (ctrl, "APPTYPE", app->apptype);
   err = lock_app (app, ctrl);
   if (err)
     return err;
@@ -660,20 +649,18 @@ app_getattr (app_t app, ctrl_t ctrl, const char *name)
 
   if (app->apptype && name && !strcmp (name, "APPTYPE"))
     {
-      send_status_info (ctrl, "APPTYPE",
-                        app->apptype, strlen (app->apptype), NULL, 0);
+      send_status_direct (ctrl, "APPTYPE", app->apptype);
       return 0;
     }
   if (name && !strcmp (name, "SERIALNO"))
     {
       char *serial;
-      time_t stamp;
-      int rc;
 
-      rc = app_get_serial_and_stamp (app, &serial, &stamp);
-      if (rc)
-        return rc;
-      send_status_info (ctrl, "SERIALNO", serial, strlen (serial), NULL, 0);
+      serial = app_get_serialno (app);
+      if (!serial)
+        return gpg_error (GPG_ERR_INV_VALUE);
+
+      send_status_direct (ctrl, "SERIALNO", serial);
       xfree (serial);
       return 0;
     }
@@ -1114,7 +1101,7 @@ app_send_card_list (ctrl_t ctrl)
   for (a = app_top; a; a = a->next)
     {
       if (DIM (buf) < 2 * a->serialnolen + 1)
-	continue;
+        continue;
 
       bin2hex (a->serialno, a->serialnolen, buf);
       send_status_direct (ctrl, "SERIALNO", buf);
diff --git a/scd/command.c b/scd/command.c
index cad8c6e..8c7ca20 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -264,7 +264,6 @@ cmd_serialno (assuan_context_t ctx, char *line)
   struct server_local_s *sl;
   int rc = 0;
   char *serial;
-  time_t stamp;
   const char *demand;
 
   if ( IS_LOCKED (ctrl) )
@@ -302,12 +301,11 @@ cmd_serialno (assuan_context_t ctx, char *line)
         c->server_local->card_removed = 0;
     }
 
-  rc = app_get_serial_and_stamp (ctrl->app_ctx, &serial, &stamp);
-  if (rc)
-    return rc;
+  serial = app_get_serialno (ctrl->app_ctx);
+  if (!serial)
+    return gpg_error (GPG_ERR_INV_VALUE);
 
-  rc = print_assuan_status (ctx, "SERIALNO", "%s %lu",
-                            serial, (unsigned long)stamp);
+  rc = assuan_write_status (ctx, "SERIALNO", serial);
   xfree (serial);
   return rc;
 }
@@ -320,7 +318,7 @@ static const char hlp_learn[] =
   "used without the force options, the command might do an INQUIRE\n"
   "like this:\n"
   "\n"
-  "   INQUIRE KNOWNCARDP <hexstring_with_serialNumber> <timestamp>\n"
+  "   INQUIRE KNOWNCARDP <hexstring_with_serialNumber>\n"
   "\n"
   "The client should just send an \"END\" if the processing should go on\n"
   "or a \"CANCEL\" to force the function to terminate with a Cancel\n"
@@ -400,7 +398,6 @@ cmd_learn (assuan_context_t ctx, char *line)
     {
       const char *reader;
       char *serial;
-      time_t stamp;
       app_t app = ctrl->app_ctx;
 
       if (!app)
@@ -412,12 +409,11 @@ cmd_learn (assuan_context_t ctx, char *line)
       send_status_direct (ctrl, "READER", reader);
       /* No need to free the string of READER.  */
 
-      rc = app_get_serial_and_stamp (ctrl->app_ctx, &serial, &stamp);
-      if (rc)
-        return rc;
+      serial = app_get_serialno (ctrl->app_ctx);
+      if (!serial)
+	return gpg_error (GPG_ERR_INV_VALUE);
 
-      rc = print_assuan_status (ctx, "SERIALNO", "%s %lu",
-                                serial, (unsigned long)stamp);
+      rc = assuan_write_status (ctx, "SERIALNO", serial);
       if (rc < 0)
         {
           xfree (serial);
@@ -428,8 +424,7 @@ cmd_learn (assuan_context_t ctx, char *line)
         {
           char *command;
 
-          rc = gpgrt_asprintf (&command, "KNOWNCARDP %s %lu",
-                               serial, (unsigned long)stamp);
+          rc = gpgrt_asprintf (&command, "KNOWNCARDP %s", serial);
           if (rc < 0)
             {
               xfree (serial);

commit 8b1f24a29ebc7651437c01990215a55b1136dae0
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Jan 18 15:19:38 2017 +0900

    scd: Add "card_list" sub command for GETINFO.
    
    * scd/app.c (app_send_card_list): New.
    * scd/command.c (cmd_getinfo): Fix "status" sub command.
    Add "card_list" sub command.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app-common.h b/scd/app-common.h
index fb0fe55..7c6822f 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -123,6 +123,7 @@ size_t app_help_read_length_of_cert (int slot, int fid, size_t *r_certoff);
 /*-- app.c --*/
 app_t app_list_start (void);
 void app_list_finish (void);
+void app_send_card_list (ctrl_t ctrl);
 
 void app_dump_state (void);
 void application_notify_card_reset (int slot);
diff --git a/scd/app.c b/scd/app.c
index 06850d8..681acb8 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -1103,3 +1103,21 @@ app_list_finish (void)
 {
   npth_mutex_unlock (&app_list_lock);
 }
+
+void
+app_send_card_list (ctrl_t ctrl)
+{
+  app_t a;
+  char buf[65];
+
+  npth_mutex_lock (&app_list_lock);
+  for (a = app_top; a; a = a->next)
+    {
+      if (DIM (buf) < 2 * a->serialnolen + 1)
+	continue;
+
+      bin2hex (a->serialno, a->serialnolen, buf);
+      send_status_direct (ctrl, "SERIALNO", buf);
+    }
+  npth_mutex_unlock (&app_list_lock);
+}
diff --git a/scd/command.c b/scd/command.c
index dc854e3..cad8c6e 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -1392,7 +1392,10 @@ static const char hlp_getinfo[] =
   "\n"
   "app_list    - Return a list of supported applications.  One\n"
   "              application per line, fields delimited by colons,\n"
-  "              first field is the name.";
+  "              first field is the name.\n"
+  "\n"
+  "card_list   - Return a list of serial numbers of active cards,\n"
+  "              using a status response.";
 static gpg_error_t
 cmd_getinfo (assuan_context_t ctx, char *line)
 {
@@ -1422,10 +1425,11 @@ cmd_getinfo (assuan_context_t ctx, char *line)
   else if (!strcmp (line, "status"))
     {
       ctrl_t ctrl = assuan_get_pointer (ctx);
-      app_t app = ctrl->app_ctx;
-      char flag = 'r';
+      char flag;
 
-      if (!ctrl->server_local->card_removed && app)
+      if (open_card (ctrl))
+        flag = 'r';
+      else
         flag = 'u';
 
       rc = assuan_send_data (ctx, &flag, 1);
@@ -1455,6 +1459,12 @@ cmd_getinfo (assuan_context_t ctx, char *line)
         rc = 0;
       xfree (s);
     }
+  else if (!strcmp (line, "card_list"))
+    {
+      ctrl_t ctrl = assuan_get_pointer (ctx);
+
+      app_send_card_list (ctrl);
+    }
   else
     rc = set_error (GPG_ERR_ASS_PARAMETER, "unknown value for WHAT");
   return rc;

-----------------------------------------------------------------------

Summary of changes:
 doc/scdaemon.texi |  7 +++---
 scd/app-common.h  |  3 ++-
 scd/app-openpgp.c | 25 +++++++--------------
 scd/app.c         | 67 ++++++++++++++++++++++++++++++-------------------------
 scd/command.c     | 43 +++++++++++++++++++----------------
 5 files changed, 73 insertions(+), 72 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 18 10:12:24 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 18 Jan 2017 10:12:24 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-86-g2312248
Message-ID: <E1cTmI8-0004sH-6z@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  2312248b2e3adffa52d8a3ac4f24fe2c88f0f569 (commit)
       via  701f54eccf3da3319dd6d74f46b852c64d90bc52 (commit)
      from  79cea89774e6327b6785e22b7057f9e3e188ac2b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2312248b2e3adffa52d8a3ac4f24fe2c88f0f569
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 18 10:01:55 2017 +0100

    gpgconf: Allow "all" for --launch, --kill, and --reload.
    
    * tools/gpgconf-comp.c (gc_component_launch): Allow -1 for COMPONENT.
    (gc_component_kill): Ditto.
    (gc_component_reload): For robustness change the condition to < 0.
    * tools/gpgconf.c (main) <aLaunch, aKill, aReload>: Support argument
    "all".
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/tools.texi b/doc/tools.texi
index f0e6fe7..bdef6a2 100644
--- a/doc/tools.texi
+++ b/doc/tools.texi
@@ -336,9 +336,10 @@ force an update of that file this command can be used:
 
 @item --reload [@var{component}]
 @opindex reload
-Reload all or the given component. This is basically the same as sending
-a SIGHUP to the component.  Components which don't support reloading are
-ignored.
+Reload all or the given component. This is basically the same as
+sending a SIGHUP to the component.  Components which don't support
+reloading are ignored.  Without @var{component} or by using "all" for
+ at var{component} all components which are daemons are reloaded.
 
 @item --launch [@var{component}]
 @opindex launch
@@ -346,14 +347,16 @@ If the @var{component} is not already running, start it.
 @command{component} must be a daemon.  This is in general not required
 because the system starts these daemons as needed.  However, external
 software making direct use of @command{gpg-agent} or @command{dirmngr}
-may use this command to ensure that they are started.
+may use this command to ensure that they are started.  Using "all" for
+ at var{component} launches all components which are daemons.
 
 @item --kill [@var{component}]
 @opindex kill
 Kill the given component.  Components which support killing are
 @command{gpg-agent} and @command{scdaemon}.  Components which don't
-support reloading are ignored.  Note that as of now reload and kill
-have the same effect for @command{scdaemon}.
+support reloading are ignored.  Using "all" for @var{component} kills
+all components running as daemons.  Note that as of now reload and
+kill have the same effect for @command{scdaemon}.
 
 @item --create-socketdir
 @opindex create-socketdir
diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index 2dcf075..300f63d 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -1263,6 +1263,14 @@ gc_component_launch (int component)
   int i;
   pid_t pid;
 
+  if (component < 0)
+    {
+      err = gc_component_launch (GC_COMPONENT_GPG_AGENT);
+      if (!err)
+        err = gc_component_launch (GC_COMPONENT_DIRMNGR);
+      return err;
+    }
+
   if (!(component == GC_COMPONENT_GPG_AGENT
         || component == GC_COMPONENT_DIRMNGR))
     {
@@ -1304,7 +1312,16 @@ gc_component_kill (int component)
   for (backend = 0; backend < GC_BACKEND_NR; backend++)
     runtime[backend] = 0;
 
-  if (component >= 0)
+  if (component < 0)
+    {
+      for (component = 0; component < GC_COMPONENT_NR; component++)
+        {
+          option = gc_component[component].options;
+          for (; option && option->name; option++)
+            runtime[option->backend] = 1;
+        }
+    }
+  else
     {
       assert (component < GC_COMPONENT_NR);
       option = gc_component[component].options;
@@ -1333,7 +1350,7 @@ gc_component_reload (int component)
   for (backend = 0; backend < GC_BACKEND_NR; backend++)
     runtime[backend] = 0;
 
-  if (component == -1)
+  if (component < 0)
     {
       for (component = 0; component < GC_COMPONENT_NR; component++)
         {
diff --git a/tools/gpgconf.c b/tools/gpgconf.c
index a1034e6..c69b1c3 100644
--- a/tools/gpgconf.c
+++ b/tools/gpgconf.c
@@ -589,6 +589,18 @@ main (int argc, char **argv)
 	  es_putc ('\n', es_stderr);
 	  exit (2);
 	}
+      else if (!strcmp (fname, "all"))
+        {
+          if (cmd == aLaunch)
+            {
+              if (gc_component_launch (-1))
+                exit (1);
+            }
+          else
+            {
+              gc_component_kill (-1);
+            }
+        }
       else
         {
           /* Launch/Kill a given component.  */
@@ -617,7 +629,7 @@ main (int argc, char **argv)
       break;
 
     case aReload:
-      if (!fname)
+      if (!fname || !strcmp (fname, "all"))
 	{
           /* Reload all.  */
           gc_component_reload (-1);

commit 701f54eccf3da3319dd6d74f46b852c64d90bc52
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 17 12:43:13 2017 +0100

    gpg: Remove unused definitions.
    
    * g10/keydb.h (rt_UNKNOWN, rt_RING): Remove constants.
    (keyblock_pos_struct, KBPOS): Remove struct and type.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/keydb.h b/g10/keydb.h
index 8daa9ee..c9f5b1c 100644
--- a/g10/keydb.h
+++ b/g10/keydb.h
@@ -61,12 +61,6 @@ struct kbnode_struct {
 #define is_cloned_kbnode(a)   ((a)->private_flag & 2)
 
 
-enum resource_type {
-    rt_UNKNOWN = 0,
-    rt_RING = 1
-};
-
-
 /* Bit flags used with build_pk_list.  */
 enum
   {
@@ -75,28 +69,14 @@ enum
     PK_LIST_CONFIG     = 4, /* Specified via config file.          */
     PK_LIST_FROM_FILE  = 8  /* Take key from file with that name.  */
   };
+
 /* To store private data in the flags the private data must be left
-   shifted by this value.  */
+ * shifted by this value.  */
 enum
   {
     PK_LIST_SHIFT = 4
   };
 
-/****************
- * A data structure to hold information about the external position
- * of a keyblock.
- */
-struct keyblock_pos_struct {
-    int   resno;     /* resource number */
-    enum resource_type rt;
-    off_t offset;    /* position information */
-    unsigned count;  /* length of the keyblock in packets */
-    iobuf_t  fp;     /* Used by enum_keyblocks. */
-    int secret;      /* working on a secret keyring */
-    PACKET *pkt;     /* ditto */
-    int valid;
-};
-typedef struct keyblock_pos_struct KBPOS;
 
 /* Structure to hold a couple of public key certificates. */
 typedef struct pk_list *PK_LIST;  /* Deprecated. */

-----------------------------------------------------------------------

Summary of changes:
 doc/tools.texi       | 15 +++++++++------
 g10/keydb.h          | 24 ++----------------------
 tools/gpgconf-comp.c | 21 +++++++++++++++++++--
 tools/gpgconf.c      | 14 +++++++++++++-
 4 files changed, 43 insertions(+), 31 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 18 10:15:53 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 18 Jan 2017 10:15:53 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-87-g3d356d1
Message-ID: <E1cTmLU-0004tu-4N@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  3d356d165aed7d76a3ea811b1d24ed0a05ac90d4 (commit)
      from  2312248b2e3adffa52d8a3ac4f24fe2c88f0f569 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3d356d165aed7d76a3ea811b1d24ed0a05ac90d4
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 18 10:13:04 2017 +0100

    agent: Reduce sleep time in the progress callback.
    
    * agent/gpg-agent.c (agent_libgcrypt_progress_cb): Reduce sleep time
    from 100ms to 1ms or use gpgrt_yield when build against a recent
    libgpg-error.
    --
    
    Debian-bug-id: 851298
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
index 724b55a..b203b07 100644
--- a/agent/gpg-agent.c
+++ b/agent/gpg-agent.c
@@ -1763,11 +1763,19 @@ agent_libgcrypt_progress_cb (void *data, const char *what, int printchar,
 
   /* Libgcrypt < 1.8 does not know about nPth and thus when it reads
    * from /dev/random this will block the process.  To mitigate this
-   * problem we take a short nap when Libgcrypt tells us that it needs
+   * problem we yield the thread when Libgcrypt tells us that it needs
    * more entropy.  This way other threads have chance to run.  */
 #if GCRYPT_VERSION_NUMBER < 0x010800 /* 1.8.0 */
   if (what && !strcmp (what, "need_entropy"))
-    npth_usleep (100000); /* 100ms */
+    {
+#if GPGRT_VERSION_NUMBER < 0x011900 /* 1.25 */
+      /* In older gpg-error versions gpgrt_yield is buggy for use with
+       * nPth and thus we need to resort to a sleep call.  */
+      npth_usleep (1000); /* 1ms */
+#else
+      gpgrt_yield ();
+#endif
+    }
 #endif
 }
 

-----------------------------------------------------------------------

Summary of changes:
 agent/gpg-agent.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 18 10:21:32 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 18 Jan 2017 10:21:32 +0100
Subject: [git] GCRYPT - branch, LIBGCRYPT-1-7-BRANCH,
 updated. libgcrypt-1.7.5-2-ge4c0159
Message-ID: <E1cTmQw-0005S8-Vs@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, LIBGCRYPT-1-7-BRANCH has been updated
       via  e4c0159974b011ddc1979acdec311234d9bc2ea8 (commit)
      from  4dc4748bb6de79cb89c4cd39052b56de3a7b8227 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e4c0159974b011ddc1979acdec311234d9bc2ea8
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 18 10:18:55 2017 +0100

    random: Call getrandom before select and emitting a progress callback.
    
    * random/rndlinux.c (_gcry_rndlinux_gather_random): Move the getrandom
    call before the select.
    --
    
    A select for getrandom does not make any sense because there is no
    file descriptor for getrandom.  Thus if getrandom is available we now
    select only when we want to read from the blocking /dev/random.  In
    most cases this avoids all progress callbacks.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/random/rndlinux.c b/random/rndlinux.c
index 2b563bf..4ef3d39 100644
--- a/random/rndlinux.c
+++ b/random/rndlinux.c
@@ -195,47 +195,6 @@ _gcry_rndlinux_gather_random (void (*add)(const void*, size_t,
       struct timeval tv;
       int rc;
 
-      /* If we collected some bytes update the progress indicator.  We
-         do this always and not just if the select timed out because
-         often just a few bytes are gathered within the timeout
-         period.  */
-      if (any_need_entropy || last_so_far != (want - length) )
-        {
-          last_so_far = want - length;
-          _gcry_random_progress ("need_entropy", 'X',
-                                 (int)last_so_far, (int)want);
-          any_need_entropy = 1;
-        }
-
-      /* If the system has no limit on the number of file descriptors
-         and we encounter an fd which is larger than the fd_set size,
-         we don't use the select at all.  The select code is only used
-         to emit progress messages.  A better solution would be to
-         fall back to poll() if available.  */
-#ifdef FD_SETSIZE
-      if (fd < FD_SETSIZE)
-#endif
-        {
-          FD_ZERO(&rfds);
-          FD_SET(fd, &rfds);
-          tv.tv_sec = delay;
-          tv.tv_usec = delay? 0 : 100000;
-          if ( !(rc=select(fd+1, &rfds, NULL, NULL, &tv)) )
-            {
-              any_need_entropy = 1;
-              delay = 3; /* Use 3 seconds henceforth.  */
-              continue;
-            }
-          else if( rc == -1 )
-            {
-              log_error ("select() error: %s\n", strerror(errno));
-              if (!delay)
-                delay = 1; /* Use 1 second if we encounter an error before
-                              we have ever blocked.  */
-              continue;
-            }
-        }
-
       /* If we have a modern Linux kernel and we want to read from the
        * the non-blocking /dev/urandom, we first try to use the new
        * getrandom syscall.  That call guarantees that the kernel's
@@ -278,6 +237,48 @@ _gcry_rndlinux_gather_random (void (*add)(const void*, size_t,
         }
 #endif
 
+      /* If we collected some bytes update the progress indicator.  We
+         do this always and not just if the select timed out because
+         often just a few bytes are gathered within the timeout
+         period.  */
+      if (any_need_entropy || last_so_far != (want - length) )
+        {
+          last_so_far = want - length;
+          _gcry_random_progress ("need_entropy", 'X',
+                                 (int)last_so_far, (int)want);
+          any_need_entropy = 1;
+        }
+
+      /* If the system has no limit on the number of file descriptors
+         and we encounter an fd which is larger than the fd_set size,
+         we don't use the select at all.  The select code is only used
+         to emit progress messages.  A better solution would be to
+         fall back to poll() if available.  */
+#ifdef FD_SETSIZE
+      if (fd < FD_SETSIZE)
+#endif
+        {
+          FD_ZERO(&rfds);
+          FD_SET(fd, &rfds);
+          tv.tv_sec = delay;
+          tv.tv_usec = delay? 0 : 100000;
+          if ( !(rc=select(fd+1, &rfds, NULL, NULL, &tv)) )
+            {
+              any_need_entropy = 1;
+              delay = 3; /* Use 3 seconds henceforth.  */
+              continue;
+            }
+          else if( rc == -1 )
+            {
+              log_error ("select() error: %s\n", strerror(errno));
+              if (!delay)
+                delay = 1; /* Use 1 second if we encounter an error before
+                              we have ever blocked.  */
+              continue;
+            }
+        }
+
+      /* Read from the device.  */
       do
         {
           size_t nbytes;

-----------------------------------------------------------------------

Summary of changes:
 random/rndlinux.c | 83 ++++++++++++++++++++++++++++---------------------------
 1 file changed, 42 insertions(+), 41 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 18 10:27:29 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 18 Jan 2017 10:27:29 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-55-g623aab8
Message-ID: <E1cTmWh-0005UB-5g@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  623aab8a940ea61afe3fef650ad485a755ed9fe7 (commit)
      from  ddcfe31e2425e88b280e7cdaf3f0eaaad8ccc023 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 623aab8a940ea61afe3fef650ad485a755ed9fe7
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 18 10:24:06 2017 +0100

    random: Call getrandom before select and emitting a progress callback.
    
    * random/rndlinux.c (_gcry_rndlinux_gather_random): Move the getrandom
    call before the select.
    --
    
    A select for getrandom does not make any sense because there is no
    file descriptor for getrandom.  Thus if getrandom is available we now
    select only when we want to read from the blocking /dev/random.  In
    most cases this avoids all progress callbacks.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/random/rndlinux.c b/random/rndlinux.c
index 562149a..d3a144a 100644
--- a/random/rndlinux.c
+++ b/random/rndlinux.c
@@ -195,50 +195,6 @@ _gcry_rndlinux_gather_random (void (*add)(const void*, size_t,
       struct timeval tv;
       int rc;
 
-      /* If we collected some bytes update the progress indicator.  We
-         do this always and not just if the select timed out because
-         often just a few bytes are gathered within the timeout
-         period.  */
-      if (any_need_entropy || last_so_far != (want - length) )
-        {
-          last_so_far = want - length;
-          _gcry_random_progress ("need_entropy", 'X',
-                                 (int)last_so_far, (int)want);
-          any_need_entropy = 1;
-        }
-
-      /* If the system has no limit on the number of file descriptors
-         and we encounter an fd which is larger than the fd_set size,
-         we don't use the select at all.  The select code is only used
-         to emit progress messages.  A better solution would be to
-         fall back to poll() if available.  */
-#ifdef FD_SETSIZE
-      if (fd < FD_SETSIZE)
-#endif
-        {
-          FD_ZERO(&rfds);
-          FD_SET(fd, &rfds);
-          tv.tv_sec = delay;
-          tv.tv_usec = delay? 0 : 100000;
-          _gcry_pre_syscall ();
-          rc = select (fd+1, &rfds, NULL, NULL, &tv);
-          _gcry_post_syscall ();
-          if (!rc)
-            {
-              any_need_entropy = 1;
-              delay = 3; /* Use 3 seconds henceforth.  */
-              continue;
-            }
-          else if( rc == -1 )
-            {
-              log_error ("select() error: %s\n", strerror(errno));
-              if (!delay)
-                delay = 1; /* Use 1 second if we encounter an error before
-                              we have ever blocked.  */
-              continue;
-            }
-        }
-
       /* If we have a modern Linux kernel and we want to read from the
        * the non-blocking /dev/urandom, we first try to use the new
        * getrandom syscall.  That call guarantees that the kernel's
@@ -283,6 +239,50 @@ _gcry_rndlinux_gather_random (void (*add)(const void*, size_t,
         }
 #endif
 
+      /* If we collected some bytes update the progress indicator.  We
+         do this always and not just if the select timed out because
+         often just a few bytes are gathered within the timeout
+         period.  */
+      if (any_need_entropy || last_so_far != (want - length) )
+        {
+          last_so_far = want - length;
+          _gcry_random_progress ("need_entropy", 'X',
+                                 (int)last_so_far, (int)want);
+          any_need_entropy = 1;
+        }
+
+      /* If the system has no limit on the number of file descriptors
+         and we encounter an fd which is larger than the fd_set size,
+         we don't use the select at all.  The select code is only used
+         to emit progress messages.  A better solution would be to
+         fall back to poll() if available.  */
+#ifdef FD_SETSIZE
+      if (fd < FD_SETSIZE)
+#endif
+        {
+          FD_ZERO(&rfds);
+          FD_SET(fd, &rfds);
+          tv.tv_sec = delay;
+          tv.tv_usec = delay? 0 : 100000;
+          _gcry_pre_syscall ();
+          rc = select (fd+1, &rfds, NULL, NULL, &tv);
+          _gcry_post_syscall ();
+          if (!rc)
+            {
+              any_need_entropy = 1;
+              delay = 3; /* Use 3 seconds henceforth.  */
+              continue;
+            }
+          else if( rc == -1 )
+            {
+              log_error ("select() error: %s\n", strerror(errno));
+              if (!delay)
+                delay = 1; /* Use 1 second if we encounter an error before
+                              we have ever blocked.  */
+              continue;
+            }
+        }
+
       do
         {
           size_t nbytes;

-----------------------------------------------------------------------

Summary of changes:
 random/rndlinux.c | 88 +++++++++++++++++++++++++++----------------------------
 1 file changed, 44 insertions(+), 44 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 18 10:58:31 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 18 Jan 2017 10:58:31 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 78016c09edb65207946c75d57de5da3e381fe807
Message-ID: <E1cTn0j-0006um-Pg@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  78016c09edb65207946c75d57de5da3e381fe807 (commit)
       via  743a2839a5a24105a488328a1293f2e57015d0bb (commit)
      from  65df8d99e68abfc323060afaff8ece55fe4af216 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 78016c09edb65207946c75d57de5da3e381fe807
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 18 10:45:47 2017 +0100

    jenkins: set LD_LIBRARY_PATH for GnuPG tests

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index cdd3d34..cc15bf4 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -101,6 +101,11 @@ case "$JOB_NAME" in
 	if [ "$NODE_NAME" = openbsd60 ]; then
 	    CONFIGUREFLAGS="$CONFIGUREFLAGS --with-libiconv-prefix=/usr/local"
 	fi
+
+	# The libraries use rpath when linking the tests, so they
+	# locate their dependencies that way.  GnuPG, however, does
+	# not.  Therefore, we set LD_LIBRARY_PATH.
+	test_environment="LD_LIBRARY_PATH=$ORIGINAL_PREFIX/lib"
         ;;
 esac
 
@@ -140,7 +145,7 @@ case "$XTARGET" in
 	           CXXFLAGS="$CXXFLAGS -std=c++11"
         $MAKE $MAKEFLAGS
 
-        $MAKE -k check verbose=2 || true
+        env $test_environment $MAKE -k check verbose=2 || true
         # Jenkins looks for "tests? failed" to mark a build unstable,
         # hence || true here
 
@@ -157,7 +162,7 @@ case "$XTARGET" in
 	           CXXFLAGS="$CXXFLAGS $SANFLAGS -fPIC -std=c++11"
         $SCANBUILD $MAKE $MAKEFLAGS
 
-        $MAKE -k check verbose=2 || true
+        env $test_environment $MAKE -k check verbose=2 || true
         # Jenkins looks for "tests? failed" to mark a build unstable,
         # hence || true here
 
@@ -215,7 +220,7 @@ case "$XTARGET" in
 	  cd "$WORKDIR"
           $abs_configure --prefix=$PREFIX --enable-maintainer-mode \
                    $CONFIGUREFLAGS
-          $MAKE $MAKEFLAGS distcheck
+          env $test_environment $MAKE $MAKEFLAGS distcheck
 
           # Extract the tarname from the package
           tarname=$(awk <config.h '

commit 743a2839a5a24105a488328a1293f2e57015d0bb
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 18 10:40:13 2017 +0100

    jenkins: dump environment right before build

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 87f0037..cdd3d34 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -20,18 +20,6 @@ PREFIX=$HOME/prefix/$XTARGET
 ORIGINAL_PREFIX=$HOME/prefix/$XTARGET
 export PATH=$PREFIX/bin:$PATH
 
-# Print the environment.
-env
-ulimit -a
-set +x
-for f in /etc/gcrypt/hwf.deny /etc/gcrypt/fips_enabled ; do
-  if [ -f "$f" ]; then
-    echo "=== $f ==="
-    cat -n "$f"
-  fi
-done
-set -x
-
 # Tweak the prefix we're installing this project into.  For gnupg-1.4
 # and friends.
 case "$JOB_NAME" in
@@ -128,6 +116,20 @@ abs_configure="$(pwd)/configure"
 mkdir -p obj
 cd obj
 
+
+# Print the environment.
+env
+ulimit -a
+set +x
+for f in /etc/gcrypt/hwf.deny /etc/gcrypt/fips_enabled ; do
+  if [ -f "$f" ]; then
+    echo "=== $f ==="
+    cat -n "$f"
+  fi
+done
+set -x
+
+
 # Switch on the different targets.
 case "$XTARGET" in
     native)

-----------------------------------------------------------------------

Summary of changes:
 misc/jenkins/bin/build.bash | 37 ++++++++++++++++++++++---------------
 1 file changed, 22 insertions(+), 15 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 18 11:53:20 2017
From: cvs at cvs.gnupg.org (by Jussi Kivilinna)
Date: Wed, 18 Jan 2017 11:53:20 +0100
Subject: [git] GCRYPT - branch, LIBGCRYPT-1-7-BRANCH,
 updated. libgcrypt-1.7.5-5-g1817c9e
Message-ID: <E1cTnrm-0000om-JF@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, LIBGCRYPT-1-7-BRANCH has been updated
       via  1817c9eab5699c097d3713f197e4a3e8b5c1442c (commit)
       via  a77c36921bde79418cdf6d7a7543514c39c9796c (commit)
       via  34135cd4128b7d2b288323474a8d05a38022b4fa (commit)
      from  e4c0159974b011ddc1979acdec311234d9bc2ea8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1817c9eab5699c097d3713f197e4a3e8b5c1442c
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Wed Jan 4 22:30:26 2017 +0200

    mpi: amd64: fix too large jump alignment in mpih-rshift
    
    * mpi/amd64/mpih-rshift.S (_gcry_mpih_rshift): Use 16-byte alignment
    with 'ALIGN(4)' instead of 256-byte.
    --
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>
    (cherry picked from commit ddcfe31e2425e88b280e7cdaf3f0eaaad8ccc023)

diff --git a/mpi/amd64/mpih-rshift.S b/mpi/amd64/mpih-rshift.S
index 311b85b..7bd5942 100644
--- a/mpi/amd64/mpih-rshift.S
+++ b/mpi/amd64/mpih-rshift.S
@@ -57,7 +57,7 @@ C_SYMBOL_NAME(_gcry_mpih_rshift:)
 	addq	$2, %rdx
 	jg	.Lendo
 
-	ALIGN(8)			/* minimal alignment for claimed speed */
+	ALIGN(4)			/* minimal alignment for claimed speed */
 .Loop:	movq	-8(%rsi,%rdx,8), %mm6
 	movq	%mm6, %mm2
 	psllq	%mm0, %mm6

commit a77c36921bde79418cdf6d7a7543514c39c9796c
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Wed Jan 4 19:16:26 2017 +0200

    rijndael-ssse3: move assembly functions to separate source-file
    
    * cipher/Makefile.am: Add 'rinjdael-ssse3-amd64-asm.S'.
    * cipher/rinjdael-ssse3-amd64-asm.S: Moved assembly functions
    here ...
    * cipher/rinjdael-ssse3-amd64.c: ... from this file.
    (_gcry_aes_ssse3_enc_preload, _gcry_aes_ssse3_dec_preload)
    (_gcry_aes_ssse3_shedule_core, _gcry_aes_ssse3_encrypt_core)
    (_gcry_aes_ssse3_decrypt_core): New.
    (vpaes_ssse3_prepare_enc, vpaes_ssse3_prepare_dec)
    (_gcry_aes_ssse3_do_setkey, _gcry_aes_ssse3_prepare_decryption)
    (do_vpaes_ssse3_enc, do_vpaes_ssse3_dec): Update to use external
    assembly functions; remove 'aes_const_ptr' variable usage.
    (_gcry_aes_ssse3_encrypt, _gcry_aes_ssse3_decrypt)
    (_gcry_aes_ssse3_cfb_enc, _gcry_aes_ssse3_cbc_enc)
    (_gcry_aes_ssse3_ctr_enc, _gcry_aes_ssse3_cfb_dec)
    (_gcry_aes_ssse3_cbc_dec, ssse3_ocb_enc, ssse3_ocb_dec)
    (_gcry_aes_ssse3_ocb_auth): Remove 'aes_const_ptr' variable usage.
    * configure.ac: Add 'rinjdael-ssse3-amd64-asm.lo'.
    --
    
    After this change, libgcrypt can be compiled with -flto optimization
    enabled on x86-64.
    
    GnuPG-bug-id: 2882
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>
    (cherry picked from commit 54c57bc49edb5c00e9ed8103cc4837bb72c5e863)

diff --git a/cipher/Makefile.am b/cipher/Makefile.am
index ac0ec58..e4a6be1 100644
--- a/cipher/Makefile.am
+++ b/cipher/Makefile.am
@@ -80,7 +80,8 @@ md4.c \
 md5.c \
 poly1305-sse2-amd64.S poly1305-avx2-amd64.S poly1305-armv7-neon.S \
 rijndael.c rijndael-internal.h rijndael-tables.h rijndael-aesni.c \
-  rijndael-padlock.c rijndael-amd64.S rijndael-arm.S rijndael-ssse3-amd64.c \
+  rijndael-padlock.c rijndael-amd64.S rijndael-arm.S \
+  rijndael-ssse3-amd64.c rijndael-ssse3-amd64-asm.S \
   rijndael-armv8-ce.c rijndael-armv8-aarch32-ce.S rijndael-armv8-aarch64-ce.S \
   rijndael-aarch64.S \
 rmd160.c \
diff --git a/cipher/rijndael-ssse3-amd64-asm.S b/cipher/rijndael-ssse3-amd64-asm.S
new file mode 100644
index 0000000..3ae55e8
--- /dev/null
+++ b/cipher/rijndael-ssse3-amd64-asm.S
@@ -0,0 +1,853 @@
+/* SSSE3 vector permutation AES for Libgcrypt
+ * Copyright (C) 2014-2017 Jussi Kivilinna <jussi.kivilinna at iki.fi>
+ *
+ * This file is part of Libgcrypt.
+ *
+ * Libgcrypt is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * Libgcrypt is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not, see <http://www.gnu.org/licenses/>.
+ *
+ *
+ * The code is based on the public domain library libvpaes version 0.5
+ * available at http://crypto.stanford.edu/vpaes/ and which carries
+ * this notice:
+ *
+ *     libvpaes: constant-time SSSE3 AES encryption and decryption.
+ *     version 0.5
+ *
+ *     By Mike Hamburg, Stanford University, 2009.  Public domain.
+ *     I wrote essentially all of this code.  I did not write the test
+ *     vectors; they are the NIST known answer tests.  I hereby release all
+ *     the code and documentation here that I wrote into the public domain.
+ *
+ *     This is an implementation of AES following my paper,
+ *       "Accelerating AES with Vector Permute Instructions
+ *       CHES 2009; http://shiftleft.org/papers/vector_aes/
+ */
+
+#if defined(__x86_64__)
+#include <config.h>
+#if defined(HAVE_GCC_INLINE_ASM_SSSE3) && \
+    (defined(HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS) || \
+     defined(HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS))
+
+#ifdef HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS
+# define ELF(...)
+#else
+# define ELF(...) __VA_ARGS__
+#endif
+
+.text
+
+##
+##  _gcry_aes_ssse3_enc_preload
+##
+ELF(.type _gcry_aes_ssse3_enc_preload, at function)
+.globl _gcry_aes_ssse3_enc_preload
+_gcry_aes_ssse3_enc_preload:
+	lea	.Laes_consts(%rip), %rax
+	movdqa	          (%rax), %xmm9  # 0F
+	movdqa	.Lk_inv   (%rax), %xmm10 # inv
+	movdqa	.Lk_inv+16(%rax), %xmm11 # inva
+	movdqa	.Lk_sb1   (%rax), %xmm13 # sb1u
+	movdqa	.Lk_sb1+16(%rax), %xmm12 # sb1t
+	movdqa	.Lk_sb2   (%rax), %xmm15 # sb2u
+	movdqa	.Lk_sb2+16(%rax), %xmm14 # sb2t
+	ret
+ELF(.size _gcry_aes_ssse3_enc_preload,.-_gcry_aes_ssse3_enc_preload)
+
+##
+##  _gcry_aes_ssse3_dec_preload
+##
+ELF(.type _gcry_aes_ssse3_dec_preload, at function)
+.globl _gcry_aes_ssse3_dec_preload
+_gcry_aes_ssse3_dec_preload:
+	lea	.Laes_consts(%rip), %rax
+	movdqa	          (%rax), %xmm9   # 0F
+	movdqa	.Lk_inv   (%rax), %xmm10  # inv
+	movdqa	.Lk_inv+16(%rax), %xmm11  # inva
+	movdqa	.Lk_dsb9   (%rax), %xmm13 # sb9u
+	movdqa	.Lk_dsb9+16(%rax), %xmm12 # sb9t
+	movdqa	.Lk_dsbd   (%rax), %xmm15 # sbdu
+	movdqa	.Lk_dsbb   (%rax), %xmm14 # sbbu
+	movdqa	.Lk_dsbe   (%rax), %xmm8  # sbeu
+	ret
+ELF(.size _gcry_aes_ssse3_dec_preload,.-_gcry_aes_ssse3_dec_preload)
+
+##
+## Constant-time SSSE3 AES core implementation.
+##
+## By Mike Hamburg (Stanford University), 2009
+## Public domain.
+##
+
+##
+##  _aes_encrypt_core
+##
+##  AES-encrypt %xmm0.
+##
+##  Inputs:
+##     %xmm0 = input
+##     %xmm9-%xmm15 as in .Laes_preheat
+##    (%rdx) = scheduled keys
+##     %rax  = nrounds - 1
+##
+##  Output in %xmm0
+##  Clobbers  %xmm1-%xmm4, %r9, %r11, %rax, %rcx
+##  Preserves %xmm6 - %xmm7 so you get some local vectors
+##
+##
+.align 16
+ELF(.type _gcry_aes_ssse3_encrypt_core, at function)
+.globl _gcry_aes_ssse3_encrypt_core
+_gcry_aes_ssse3_encrypt_core:
+_aes_encrypt_core:
+	lea	.Laes_consts(%rip), %rcx
+	leaq	.Lk_mc_backward(%rcx), %rdi
+	mov	$16,	%rsi
+	movdqa	.Lk_ipt   (%rcx), %xmm2 # iptlo
+	movdqa	%xmm9,	%xmm1
+	pandn	%xmm0,	%xmm1
+	psrld	$4,	%xmm1
+	pand	%xmm9,	%xmm0
+	pshufb	%xmm0,	%xmm2
+	movdqa	.Lk_ipt+16(%rcx), %xmm0 # ipthi
+	pshufb	%xmm1,	%xmm0
+	pxor	(%rdx),%xmm2
+	pxor	%xmm2,	%xmm0
+	add	$16,	%rdx
+	jmp	.Laes_entry
+
+.align 8
+.Laes_loop:
+	# middle of middle round
+	movdqa  %xmm13,	%xmm4	# 4 : sb1u
+	pshufb  %xmm2,	%xmm4   # 4 = sb1u
+	pxor	(%rdx),	%xmm4	# 4 = sb1u + k
+	movdqa  %xmm12,	%xmm0	# 0 : sb1t
+	pshufb  %xmm3,	%xmm0	# 0 = sb1t
+	pxor	%xmm4,	%xmm0	# 0 = A
+	movdqa  %xmm15,	%xmm4	# 4 : sb2u
+	pshufb	%xmm2,	%xmm4	# 4 = sb2u
+	movdqa	.Lk_mc_forward-.Lk_mc_backward(%rsi,%rdi), %xmm1
+	movdqa	%xmm14, %xmm2	# 2 : sb2t
+	pshufb	%xmm3,  %xmm2	# 2 = sb2t
+	pxor	%xmm4,  %xmm2	# 2 = 2A
+	movdqa	%xmm0,  %xmm3	# 3 = A
+	pshufb  %xmm1,  %xmm0	# 0 = B
+	pxor	%xmm2,  %xmm0	# 0 = 2A+B
+	pshufb	(%rsi,%rdi), %xmm3  # 3 = D
+	lea	16(%esi),%esi	# next mc
+	pxor	%xmm0,	%xmm3	# 3 = 2A+B+D
+	lea	16(%rdx),%rdx	# next key
+	pshufb  %xmm1,	%xmm0	# 0 = 2B+C
+	pxor	%xmm3,	%xmm0	# 0 = 2A+3B+C+D
+	and	$48, %rsi	# ... mod 4
+	dec	%rax		# nr--
+
+.Laes_entry:
+	# top of round
+	movdqa  %xmm9, 	%xmm1	# 1 : i
+	pandn	%xmm0, 	%xmm1	# 1 = i<<4
+	psrld	$4,    	%xmm1   # 1 = i
+	pand	%xmm9, 	%xmm0   # 0 = k
+	movdqa	%xmm11, %xmm2	# 2 : a/k
+	pshufb  %xmm0,  %xmm2	# 2 = a/k
+	pxor	%xmm1,	%xmm0	# 0 = j
+	movdqa  %xmm10,	%xmm3  	# 3 : 1/i
+	pshufb  %xmm1, 	%xmm3  	# 3 = 1/i
+	pxor	%xmm2, 	%xmm3  	# 3 = iak = 1/i + a/k
+	movdqa	%xmm10,	%xmm4  	# 4 : 1/j
+	pshufb	%xmm0, 	%xmm4  	# 4 = 1/j
+	pxor	%xmm2, 	%xmm4  	# 4 = jak = 1/j + a/k
+	movdqa  %xmm10,	%xmm2  	# 2 : 1/iak
+	pshufb  %xmm3,	%xmm2  	# 2 = 1/iak
+	pxor	%xmm0, 	%xmm2  	# 2 = io
+	movdqa  %xmm10, %xmm3   # 3 : 1/jak
+	pshufb  %xmm4,  %xmm3   # 3 = 1/jak
+	pxor	%xmm1,  %xmm3   # 3 = jo
+	jnz	.Laes_loop
+
+	# middle of last round
+	movdqa	.Lk_sbo(%rcx), %xmm4	# 3 : sbou
+	pshufb  %xmm2,  %xmm4   # 4 = sbou
+	pxor	(%rdx), %xmm4   # 4 = sb1u + k
+	movdqa	.Lk_sbo+16(%rcx), %xmm0	# 0 : sbot
+	pshufb  %xmm3,	%xmm0	# 0 = sb1t
+	pxor	%xmm4,	%xmm0	# 0 = A
+	pshufb	.Lk_sr(%rsi,%rcx), %xmm0
+	ret
+ELF(.size _aes_encrypt_core,.-_aes_encrypt_core)
+
+##
+##  Decryption core
+##
+##  Same API as encryption core.
+##
+.align 16
+.globl _gcry_aes_ssse3_decrypt_core
+ELF(.type _gcry_aes_ssse3_decrypt_core, at function)
+_gcry_aes_ssse3_decrypt_core:
+_aes_decrypt_core:
+	lea	.Laes_consts(%rip), %rcx
+	movl	%eax,	%esi
+	shll	$4,	%esi
+	xorl	$48,	%esi
+	andl	$48,	%esi
+	movdqa	.Lk_dipt   (%rcx), %xmm2 # iptlo
+	movdqa	%xmm9,	%xmm1
+	pandn	%xmm0,	%xmm1
+	psrld	$4,	%xmm1
+	pand	%xmm9,	%xmm0
+	pshufb	%xmm0,	%xmm2
+	movdqa	.Lk_dipt+16(%rcx), %xmm0 # ipthi
+	pshufb	%xmm1,	%xmm0
+	pxor	(%rdx),	%xmm2
+	pxor	%xmm2,	%xmm0
+	movdqa	.Lk_mc_forward+48(%rcx), %xmm5
+	lea	16(%rdx), %rdx
+	neg	%rax
+	jmp	.Laes_dec_entry
+
+.align 16
+.Laes_dec_loop:
+##
+##  Inverse mix columns
+##
+	movdqa  %xmm13,	%xmm4		# 4 : sb9u
+	pshufb	%xmm2,	%xmm4		# 4 = sb9u
+	pxor	(%rdx),	%xmm4
+	movdqa  %xmm12,	%xmm0		# 0 : sb9t
+	pshufb	%xmm3,	%xmm0		# 0 = sb9t
+	movdqa  .Lk_dsbd+16(%rcx),%xmm1	# 1 : sbdt
+	pxor	%xmm4,	%xmm0		# 0 = ch
+	lea	16(%rdx), %rdx		# next round key
+
+	pshufb	%xmm5,	%xmm0		# MC ch
+	movdqa  %xmm15,	%xmm4		# 4 : sbdu
+	pshufb	%xmm2,	%xmm4		# 4 = sbdu
+	pxor	%xmm0,	%xmm4		# 4 = ch
+	pshufb	%xmm3,	%xmm1		# 1 = sbdt
+	pxor	%xmm4,	%xmm1		# 1 = ch
+
+	pshufb	%xmm5,	%xmm1		# MC ch
+	movdqa  %xmm14,	%xmm4		# 4 : sbbu
+	pshufb	%xmm2,	%xmm4		# 4 = sbbu
+	inc     %rax                    # nr--
+	pxor	%xmm1,	%xmm4		# 4 = ch
+	movdqa  .Lk_dsbb+16(%rcx),%xmm0	# 0 : sbbt
+	pshufb	%xmm3,	%xmm0		# 0 = sbbt
+	pxor	%xmm4,	%xmm0		# 0 = ch
+
+	pshufb	%xmm5,	%xmm0		# MC ch
+	movdqa  %xmm8,	%xmm4		# 4 : sbeu
+	pshufb	%xmm2,	%xmm4		# 4 = sbeu
+	pshufd	$0x93,	%xmm5,	%xmm5
+	pxor	%xmm0,	%xmm4		# 4 = ch
+	movdqa  .Lk_dsbe+16(%rcx),%xmm0	# 0 : sbet
+	pshufb	%xmm3,	%xmm0		# 0 = sbet
+	pxor	%xmm4,	%xmm0		# 0 = ch
+
+.Laes_dec_entry:
+	# top of round
+	movdqa  %xmm9, 	%xmm1	# 1 : i
+	pandn	%xmm0, 	%xmm1	# 1 = i<<4
+	psrld	$4,    	%xmm1   # 1 = i
+	pand	%xmm9, 	%xmm0   # 0 = k
+	movdqa	%xmm11, %xmm2	# 2 : a/k
+	pshufb  %xmm0,  %xmm2	# 2 = a/k
+	pxor	%xmm1,	%xmm0	# 0 = j
+	movdqa  %xmm10,	%xmm3  	# 3 : 1/i
+	pshufb  %xmm1, 	%xmm3  	# 3 = 1/i
+	pxor	%xmm2, 	%xmm3  	# 3 = iak = 1/i + a/k
+	movdqa	%xmm10,	%xmm4  	# 4 : 1/j
+	pshufb	%xmm0, 	%xmm4  	# 4 = 1/j
+	pxor	%xmm2, 	%xmm4  	# 4 = jak = 1/j + a/k
+	movdqa  %xmm10,	%xmm2  	# 2 : 1/iak
+	pshufb  %xmm3,	%xmm2  	# 2 = 1/iak
+	pxor	%xmm0, 	%xmm2  	# 2 = io
+	movdqa  %xmm10, %xmm3   # 3 : 1/jak
+	pshufb  %xmm4,  %xmm3   # 3 = 1/jak
+	pxor	%xmm1,  %xmm3   # 3 = jo
+	jnz	.Laes_dec_loop
+
+	# middle of last round
+	movdqa	.Lk_dsbo(%rcx), %xmm4		# 3 : sbou
+	pshufb  %xmm2,  %xmm4   # 4 = sbou
+	pxor	(%rdx), %xmm4   # 4 = sb1u + k
+	movdqa	.Lk_dsbo+16(%rcx), %xmm0	# 0 : sbot
+	pshufb  %xmm3,	%xmm0	# 0 = sb1t
+	pxor	%xmm4,	%xmm0	# 0 = A
+	pshufb	.Lk_sr(%rsi,%rcx), %xmm0
+	ret
+ELF(.size _aes_decrypt_core,.-_aes_decrypt_core)
+
+########################################################
+##                                                    ##
+##                  AES key schedule                  ##
+##                                                    ##
+########################################################
+
+.align 16
+.globl _gcry_aes_ssse3_schedule_core
+ELF(.type _gcry_aes_ssse3_schedule_core, at function)
+_gcry_aes_ssse3_schedule_core:
+_aes_schedule_core:
+	# rdi = key
+	# rsi = size in bits
+	# rdx = buffer
+	# rcx = direction.  0=encrypt, 1=decrypt
+
+	# load the tables
+	lea	.Laes_consts(%rip), %r10
+	movdqa	          (%r10), %xmm9  # 0F
+	movdqa	.Lk_inv   (%r10), %xmm10 # inv
+	movdqa	.Lk_inv+16(%r10), %xmm11 # inva
+	movdqa	.Lk_sb1   (%r10), %xmm13 # sb1u
+	movdqa	.Lk_sb1+16(%r10), %xmm12 # sb1t
+	movdqa	.Lk_sb2   (%r10), %xmm15 # sb2u
+	movdqa	.Lk_sb2+16(%r10), %xmm14 # sb2t
+
+	movdqa	.Lk_rcon(%r10), %xmm8	# load rcon
+	movdqu	(%rdi),	%xmm0		# load key (unaligned)
+
+	# input transform
+	movdqu	%xmm0,	%xmm3
+	lea	.Lk_ipt(%r10), %r11
+	call	.Laes_schedule_transform
+	movdqu	%xmm0,	%xmm7
+
+	test	%rcx,	%rcx
+	jnz	.Laes_schedule_am_decrypting
+
+	# encrypting, output zeroth round key after transform
+	movdqa	%xmm0,	(%rdx)
+	jmp	.Laes_schedule_go
+
+.Laes_schedule_am_decrypting:
+	# decrypting, output zeroth round key after shiftrows
+	pshufb  .Lk_sr(%r8,%r10),%xmm3
+	movdqa	%xmm3,	(%rdx)
+	xor	$48, 	%r8
+
+.Laes_schedule_go:
+	cmp	$192,	%rsi
+	je	.Laes_schedule_192
+	cmp	$256,	%rsi
+	je	.Laes_schedule_256
+	# 128: fall though
+
+##
+##  .Laes_schedule_128
+##
+##  128-bit specific part of key schedule.
+##
+##  This schedule is really simple, because all its parts
+##  are accomplished by the subroutines.
+##
+.Laes_schedule_128:
+	mov	$10, %rsi
+
+.Laes_schedule_128_L:
+	call 	.Laes_schedule_round
+	dec	%rsi
+	jz 	.Laes_schedule_mangle_last
+	call	.Laes_schedule_mangle	# write output
+	jmp 	.Laes_schedule_128_L
+
+##
+##  .Laes_schedule_192
+##
+##  192-bit specific part of key schedule.
+##
+##  The main body of this schedule is the same as the 128-bit
+##  schedule, but with more smearing.  The long, high side is
+##  stored in %xmm7 as before, and the short, low side is in
+##  the high bits of %xmm6.
+##
+##  This schedule is somewhat nastier, however, because each
+##  round produces 192 bits of key material, or 1.5 round keys.
+##  Therefore, on each cycle we do 2 rounds and produce 3 round
+##  keys.
+##
+.Laes_schedule_192:
+	movdqu	8(%rdi),%xmm0		# load key part 2 (very unaligned)
+	call	.Laes_schedule_transform	# input transform
+	pshufd	$0x0E,	%xmm0,	%xmm6
+	pslldq	$8,	%xmm6		# clobber low side with zeros
+	mov	$4,	%rsi
+
+.Laes_schedule_192_L:
+	call	.Laes_schedule_round
+	palignr	$8,%xmm6,%xmm0
+	call	.Laes_schedule_mangle	# save key n
+	call	.Laes_schedule_192_smear
+	call	.Laes_schedule_mangle	# save key n+1
+	call	.Laes_schedule_round
+	dec	%rsi
+	jz 	.Laes_schedule_mangle_last
+	call	.Laes_schedule_mangle	# save key n+2
+	call	.Laes_schedule_192_smear
+	jmp	.Laes_schedule_192_L
+
+##
+##  .Laes_schedule_192_smear
+##
+##  Smear the short, low side in the 192-bit key schedule.
+##
+##  Inputs:
+##    %xmm7: high side, b  a  x  y
+##    %xmm6:  low side, d  c  0  0
+##    %xmm13: 0
+##
+##  Outputs:
+##    %xmm6: b+c+d  b+c  0  0
+##    %xmm0: b+c+d  b+c  b  a
+##
+.Laes_schedule_192_smear:
+	pshufd	$0x80,	%xmm6,	%xmm0	# d c 0 0 -> c 0 0 0
+	pxor	%xmm0,	%xmm6		# -> c+d c 0 0
+	pshufd	$0xFE,	%xmm7,	%xmm0	# b a _ _ -> b b b a
+	pxor	%xmm6,	%xmm0		# -> b+c+d b+c b a
+	pshufd	$0x0E,	%xmm0,	%xmm6
+	pslldq	$8,	%xmm6		# clobber low side with zeros
+	ret
+
+##
+##  .Laes_schedule_256
+##
+##  256-bit specific part of key schedule.
+##
+##  The structure here is very similar to the 128-bit
+##  schedule, but with an additional 'low side' in
+##  %xmm6.  The low side's rounds are the same as the
+##  high side's, except no rcon and no rotation.
+##
+.Laes_schedule_256:
+	movdqu	16(%rdi),%xmm0		# load key part 2 (unaligned)
+	call	.Laes_schedule_transform	# input transform
+	mov	$7, %rsi
+
+.Laes_schedule_256_L:
+	call	.Laes_schedule_mangle	# output low result
+	movdqa	%xmm0,	%xmm6		# save cur_lo in xmm6
+
+	# high round
+	call	.Laes_schedule_round
+	dec	%rsi
+	jz 	.Laes_schedule_mangle_last
+	call	.Laes_schedule_mangle
+
+	# low round. swap xmm7 and xmm6
+	pshufd	$0xFF,	%xmm0,	%xmm0
+	movdqa	%xmm7,	%xmm5
+	movdqa	%xmm6,	%xmm7
+	call	.Laes_schedule_low_round
+	movdqa	%xmm5,	%xmm7
+
+	jmp	.Laes_schedule_256_L
+
+##
+##  .Laes_schedule_round
+##
+##  Runs one main round of the key schedule on %xmm0, %xmm7
+##
+##  Specifically, runs subbytes on the high dword of %xmm0
+##  then rotates it by one byte and xors into the low dword of
+##  %xmm7.
+##
+##  Adds rcon from low byte of %xmm8, then rotates %xmm8 for
+##  next rcon.
+##
+##  Smears the dwords of %xmm7 by xoring the low into the
+##  second low, result into third, result into highest.
+##
+##  Returns results in %xmm7 = %xmm0.
+##  Clobbers %xmm1-%xmm4, %r11.
+##
+.Laes_schedule_round:
+	# extract rcon from xmm8
+	pxor	%xmm1,	%xmm1
+	palignr	$15,	%xmm8,	%xmm1
+	palignr	$15,	%xmm8,	%xmm8
+	pxor	%xmm1,	%xmm7
+
+	# rotate
+	pshufd	$0xFF,	%xmm0,	%xmm0
+	palignr	$1,	%xmm0,	%xmm0
+
+	# fall through...
+
+	# low round: same as high round, but no rotation and no rcon.
+.Laes_schedule_low_round:
+	# smear xmm7
+	movdqa	%xmm7,	%xmm1
+	pslldq	$4,	%xmm7
+	pxor	%xmm1,	%xmm7
+	movdqa	%xmm7,	%xmm1
+	pslldq	$8,	%xmm7
+	pxor	%xmm1,	%xmm7
+	pxor	.Lk_s63(%r10), %xmm7
+
+	# subbytes
+	movdqa  %xmm9, 	%xmm1
+	pandn	%xmm0, 	%xmm1
+	psrld	$4,    	%xmm1		# 1 = i
+	pand	%xmm9, 	%xmm0		# 0 = k
+	movdqa	%xmm11, %xmm2		# 2 : a/k
+	pshufb  %xmm0,  %xmm2		# 2 = a/k
+	pxor	%xmm1,	%xmm0		# 0 = j
+	movdqa  %xmm10,	%xmm3		# 3 : 1/i
+	pshufb  %xmm1, 	%xmm3		# 3 = 1/i
+	pxor	%xmm2, 	%xmm3		# 3 = iak = 1/i + a/k
+	movdqa	%xmm10,	%xmm4		# 4 : 1/j
+	pshufb	%xmm0, 	%xmm4		# 4 = 1/j
+	pxor	%xmm2, 	%xmm4		# 4 = jak = 1/j + a/k
+	movdqa  %xmm10,	%xmm2		# 2 : 1/iak
+	pshufb  %xmm3,	%xmm2		# 2 = 1/iak
+	pxor	%xmm0, 	%xmm2		# 2 = io
+	movdqa  %xmm10, %xmm3		# 3 : 1/jak
+	pshufb  %xmm4,  %xmm3		# 3 = 1/jak
+	pxor	%xmm1,  %xmm3		# 3 = jo
+	movdqa	.Lk_sb1(%r10), %xmm4	# 4 : sbou
+	pshufb  %xmm2,  %xmm4		# 4 = sbou
+	movdqa	.Lk_sb1+16(%r10), %xmm0	# 0 : sbot
+	pshufb  %xmm3,	%xmm0		# 0 = sb1t
+	pxor	%xmm4, 	%xmm0		# 0 = sbox output
+
+	# add in smeared stuff
+	pxor	%xmm7,	%xmm0
+	movdqa	%xmm0,	%xmm7
+	ret
+
+##
+##  .Laes_schedule_transform
+##
+##  Linear-transform %xmm0 according to tables at (%r11)
+##
+##  Requires that %xmm9 = 0x0F0F... as in preheat
+##  Output in %xmm0
+##  Clobbers %xmm1, %xmm2
+##
+.Laes_schedule_transform:
+	movdqa	%xmm9,	%xmm1
+	pandn	%xmm0,	%xmm1
+	psrld	$4,	%xmm1
+	pand	%xmm9,	%xmm0
+	movdqa	(%r11), %xmm2 	# lo
+	pshufb	%xmm0,	%xmm2
+	movdqa	16(%r11), %xmm0 # hi
+	pshufb	%xmm1,	%xmm0
+	pxor	%xmm2,	%xmm0
+	ret
+
+##
+##  .Laes_schedule_mangle
+##
+##  Mangle xmm0 from (basis-transformed) standard version
+##  to our version.
+##
+##  On encrypt,
+##    xor with 0x63
+##    multiply by circulant 0,1,1,1
+##    apply shiftrows transform
+##
+##  On decrypt,
+##    xor with 0x63
+##    multiply by 'inverse mixcolumns' circulant E,B,D,9
+##    deskew
+##    apply shiftrows transform
+##
+##
+##  Writes out to (%rdx), and increments or decrements it
+##  Keeps track of round number mod 4 in %r8
+##  Preserves xmm0
+##  Clobbers xmm1-xmm5
+##
+.Laes_schedule_mangle:
+	movdqa	%xmm0,	%xmm4	# save xmm0 for later
+	movdqa	.Lk_mc_forward(%r10),%xmm5
+	test	%rcx, 	%rcx
+	jnz	.Laes_schedule_mangle_dec
+
+	# encrypting
+	add	$16,	%rdx
+	pxor	.Lk_s63(%r10),%xmm4
+	pshufb	%xmm5,	%xmm4
+	movdqa	%xmm4,	%xmm3
+	pshufb	%xmm5,	%xmm4
+	pxor	%xmm4,	%xmm3
+	pshufb	%xmm5,	%xmm4
+	pxor	%xmm4,	%xmm3
+
+	jmp	.Laes_schedule_mangle_both
+
+.Laes_schedule_mangle_dec:
+	lea	.Lk_dks_1(%r10), %r11	# first table: *9
+	call 	.Laes_schedule_transform
+	movdqa	%xmm0,	%xmm3
+	pshufb	%xmm5,	%xmm3
+
+	add	$32, 	%r11		# next table:  *B
+	call 	.Laes_schedule_transform
+	pxor	%xmm0,	%xmm3
+	pshufb	%xmm5,	%xmm3
+
+	add	$32, 	%r11		# next table:  *D
+	call 	.Laes_schedule_transform
+	pxor	%xmm0,	%xmm3
+	pshufb	%xmm5,	%xmm3
+
+	add	$32, 	%r11		# next table:  *E
+	call 	.Laes_schedule_transform
+	pxor	%xmm0,	%xmm3
+	pshufb	%xmm5,	%xmm3
+
+	movdqa	%xmm4,	%xmm0		# restore %xmm0
+	add	$-16,	%rdx
+
+.Laes_schedule_mangle_both:
+	pshufb	.Lk_sr(%r8,%r10),%xmm3
+	add	$-16,	%r8
+	and	$48,	%r8
+	movdqa	%xmm3,	(%rdx)
+	ret
+
+##
+##  .Laes_schedule_mangle_last
+##
+##  Mangler for last round of key schedule
+##  Mangles %xmm0
+##    when encrypting, outputs out(%xmm0) ^ 63
+##    when decrypting, outputs unskew(%xmm0)
+##
+##  Always called right before return... jumps to cleanup and exits
+##
+.Laes_schedule_mangle_last:
+	# schedule last round key from xmm0
+	lea	.Lk_deskew(%r10),%r11	# prepare to deskew
+	test	%rcx, 	%rcx
+	jnz	.Laes_schedule_mangle_last_dec
+
+	# encrypting
+	pshufb	.Lk_sr(%r8,%r10),%xmm0	# output permute
+	lea	.Lk_opt(%r10),	%r11	# prepare to output transform
+	add	$32,	%rdx
+
+.Laes_schedule_mangle_last_dec:
+	add	$-16,	%rdx
+	pxor	.Lk_s63(%r10),	%xmm0
+	call	.Laes_schedule_transform # output transform
+	movdqa	%xmm0,	(%rdx)		# save last key
+
+	#_aes_cleanup
+	pxor	%xmm0,  %xmm0
+	pxor	%xmm1,  %xmm1
+	pxor	%xmm2,  %xmm2
+	pxor	%xmm3,  %xmm3
+	pxor	%xmm4,  %xmm4
+	pxor	%xmm5,  %xmm5
+	pxor	%xmm6,  %xmm6
+	pxor	%xmm7,  %xmm7
+	pxor	%xmm8,  %xmm8
+	ret
+ELF(.size _aes_schedule_core,.-_aes_schedule_core)
+
+########################################################
+##                                                    ##
+##                     Constants                      ##
+##                                                    ##
+########################################################
+
+.align 16
+ELF(.type _aes_consts, at object)
+.Laes_consts:
+_aes_consts:
+	# s0F
+	.Lk_s0F = .-.Laes_consts
+	.quad	0x0F0F0F0F0F0F0F0F
+	.quad	0x0F0F0F0F0F0F0F0F
+
+	# input transform (lo, hi)
+	.Lk_ipt = .-.Laes_consts
+	.quad	0xC2B2E8985A2A7000
+	.quad	0xCABAE09052227808
+	.quad	0x4C01307D317C4D00
+	.quad	0xCD80B1FCB0FDCC81
+
+	# inv, inva
+	.Lk_inv = .-.Laes_consts
+	.quad	0x0E05060F0D080180
+	.quad	0x040703090A0B0C02
+	.quad	0x01040A060F0B0780
+	.quad	0x030D0E0C02050809
+
+	# sb1u, sb1t
+	.Lk_sb1 = .-.Laes_consts
+	.quad	0xB19BE18FCB503E00
+	.quad	0xA5DF7A6E142AF544
+	.quad	0x3618D415FAE22300
+	.quad	0x3BF7CCC10D2ED9EF
+
+
+	# sb2u, sb2t
+	.Lk_sb2 = .-.Laes_consts
+	.quad	0xE27A93C60B712400
+	.quad	0x5EB7E955BC982FCD
+	.quad	0x69EB88400AE12900
+	.quad	0xC2A163C8AB82234A
+
+	# sbou, sbot
+	.Lk_sbo = .-.Laes_consts
+	.quad	0xD0D26D176FBDC700
+	.quad	0x15AABF7AC502A878
+	.quad	0xCFE474A55FBB6A00
+	.quad	0x8E1E90D1412B35FA
+
+	# mc_forward
+	.Lk_mc_forward = .-.Laes_consts
+	.quad	0x0407060500030201
+	.quad	0x0C0F0E0D080B0A09
+	.quad	0x080B0A0904070605
+	.quad	0x000302010C0F0E0D
+	.quad	0x0C0F0E0D080B0A09
+	.quad	0x0407060500030201
+	.quad	0x000302010C0F0E0D
+	.quad	0x080B0A0904070605
+
+	# mc_backward
+	.Lk_mc_backward = .-.Laes_consts
+	.quad	0x0605040702010003
+	.quad	0x0E0D0C0F0A09080B
+	.quad	0x020100030E0D0C0F
+	.quad	0x0A09080B06050407
+	.quad	0x0E0D0C0F0A09080B
+	.quad	0x0605040702010003
+	.quad	0x0A09080B06050407
+	.quad	0x020100030E0D0C0F
+
+	# sr
+	.Lk_sr = .-.Laes_consts
+	.quad	0x0706050403020100
+	.quad	0x0F0E0D0C0B0A0908
+	.quad	0x030E09040F0A0500
+	.quad	0x0B06010C07020D08
+	.quad	0x0F060D040B020900
+	.quad	0x070E050C030A0108
+	.quad	0x0B0E0104070A0D00
+	.quad	0x0306090C0F020508
+
+	# rcon
+	.Lk_rcon = .-.Laes_consts
+	.quad	0x1F8391B9AF9DEEB6
+	.quad	0x702A98084D7C7D81
+
+	# s63: all equal to 0x63 transformed
+	.Lk_s63 = .-.Laes_consts
+	.quad	0x5B5B5B5B5B5B5B5B
+	.quad	0x5B5B5B5B5B5B5B5B
+
+	# output transform
+	.Lk_opt = .-.Laes_consts
+	.quad	0xFF9F4929D6B66000
+	.quad	0xF7974121DEBE6808
+	.quad	0x01EDBD5150BCEC00
+	.quad	0xE10D5DB1B05C0CE0
+
+	# deskew tables: inverts the sbox's 'skew'
+	.Lk_deskew = .-.Laes_consts
+	.quad	0x07E4A34047A4E300
+	.quad	0x1DFEB95A5DBEF91A
+	.quad	0x5F36B5DC83EA6900
+	.quad	0x2841C2ABF49D1E77
+
+##
+##  Decryption stuff
+##  Key schedule constants
+##
+	# decryption key schedule: x -> invskew x*9
+	.Lk_dks_1 = .-.Laes_consts
+	.quad	0xB6116FC87ED9A700
+	.quad	0x4AED933482255BFC
+	.quad	0x4576516227143300
+	.quad	0x8BB89FACE9DAFDCE
+
+	# decryption key schedule: invskew x*9 -> invskew x*D
+	.Lk_dks_2 = .-.Laes_consts
+	.quad	0x27438FEBCCA86400
+	.quad	0x4622EE8AADC90561
+	.quad	0x815C13CE4F92DD00
+	.quad	0x73AEE13CBD602FF2
+
+	# decryption key schedule: invskew x*D -> invskew x*B
+	.Lk_dks_3 = .-.Laes_consts
+	.quad	0x03C4C50201C6C700
+	.quad	0xF83F3EF9FA3D3CFB
+	.quad	0xEE1921D638CFF700
+	.quad	0xA5526A9D7384BC4B
+
+	# decryption key schedule: invskew x*B -> invskew x*E + 0x63
+	.Lk_dks_4 = .-.Laes_consts
+	.quad	0xE3C390B053732000
+	.quad	0xA080D3F310306343
+	.quad	0xA0CA214B036982E8
+	.quad	0x2F45AEC48CE60D67
+
+##
+##  Decryption stuff
+##  Round function constants
+##
+	# decryption input transform
+	.Lk_dipt = .-.Laes_consts
+	.quad	0x0F505B040B545F00
+	.quad	0x154A411E114E451A
+	.quad	0x86E383E660056500
+	.quad	0x12771772F491F194
+
+	# decryption sbox output *9*u, *9*t
+	.Lk_dsb9 = .-.Laes_consts
+	.quad	0x851C03539A86D600
+	.quad	0xCAD51F504F994CC9
+	.quad	0xC03B1789ECD74900
+	.quad	0x725E2C9EB2FBA565
+
+	# decryption sbox output *D*u, *D*t
+	.Lk_dsbd = .-.Laes_consts
+	.quad	0x7D57CCDFE6B1A200
+	.quad	0xF56E9B13882A4439
+	.quad	0x3CE2FAF724C6CB00
+	.quad	0x2931180D15DEEFD3
+
+	# decryption sbox output *B*u, *B*t
+	.Lk_dsbb = .-.Laes_consts
+	.quad	0xD022649296B44200
+	.quad	0x602646F6B0F2D404
+	.quad	0xC19498A6CD596700
+	.quad	0xF3FF0C3E3255AA6B
+
+	# decryption sbox output *E*u, *E*t
+	.Lk_dsbe = .-.Laes_consts
+	.quad	0x46F2929626D4D000
+	.quad	0x2242600464B4F6B0
+	.quad	0x0C55A6CDFFAAC100
+	.quad	0x9467F36B98593E32
+
+	# decryption sbox final output
+	.Lk_dsbo = .-.Laes_consts
+	.quad	0x1387EA537EF94000
+	.quad	0xC7AA6DB9D4943E2D
+	.quad	0x12D7560F93441D00
+	.quad	0xCA4B8159D8C58E9C
+ELF(.size _aes_consts,.-_aes_consts)
+
+#endif
+#endif
diff --git a/cipher/rijndael-ssse3-amd64.c b/cipher/rijndael-ssse3-amd64.c
index e2ee0c9..30a129a 100644
--- a/cipher/rijndael-ssse3-amd64.c
+++ b/cipher/rijndael-ssse3-amd64.c
@@ -1,5 +1,5 @@
 /* SSSE3 vector permutation AES for Libgcrypt
- * Copyright (C) 2014-2015 Jussi Kivilinna <jussi.kivilinna at iki.fi>
+ * Copyright (C) 2014-2017 Jussi Kivilinna <jussi.kivilinna at iki.fi>
  *
  * This file is part of Libgcrypt.
  *
@@ -57,11 +57,22 @@
 #endif
 
 
+/* Assembly functions in rijndael-ssse3-amd64-asm.S. Note that these
+   have custom calling convention and need to be called from assembly
+   blocks, not directly. */
+extern void _gcry_aes_ssse3_enc_preload(void);
+extern void _gcry_aes_ssse3_dec_preload(void);
+extern void _gcry_aes_ssse3_schedule_core(void);
+extern void _gcry_aes_ssse3_encrypt_core(void);
+extern void _gcry_aes_ssse3_decrypt_core(void);
+
+
+
 /* Two macros to be called prior and after the use of SSSE3
-  instructions.  There should be no external function calls between
-  the use of these macros.  There purpose is to make sure that the
-  SSE registers are cleared and won't reveal any information about
-  the key or the data.  */
+   instructions.  There should be no external function calls between
+   the use of these macros.  There purpose is to make sure that the
+   SSE registers are cleared and won't reveal any information about
+   the key or the data.  */
 #ifdef HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS
 # define SSSE3_STATE_SIZE (16 * 10)
 /* XMM6-XMM15 are callee-saved registers on WIN64. */
@@ -115,34 +126,19 @@
                   ::: "memory" )
 #endif
 
-#define vpaes_ssse3_prepare_enc(const_ptr) \
+#define vpaes_ssse3_prepare_enc() \
     vpaes_ssse3_prepare(); \
-    asm volatile ("lea	.Laes_consts(%%rip), %q0 \n\t" \
-                  "movdqa	          (%q0), %%xmm9  # 0F \n\t" \
-                  "movdqa	.Lk_inv   (%q0), %%xmm10 # inv \n\t" \
-                  "movdqa	.Lk_inv+16(%q0), %%xmm11 # inva \n\t" \
-                  "movdqa	.Lk_sb1   (%q0), %%xmm13 # sb1u \n\t" \
-                  "movdqa	.Lk_sb1+16(%q0), %%xmm12 # sb1t \n\t" \
-                  "movdqa	.Lk_sb2   (%q0), %%xmm15 # sb2u \n\t" \
-                  "movdqa	.Lk_sb2+16(%q0), %%xmm14 # sb2t \n\t" \
-                  : "=c" (const_ptr) \
+    asm volatile ("call *%[core] \n\t" \
                   : \
-                  : "memory" )
+                  : [core] "r" (_gcry_aes_ssse3_enc_preload) \
+                  : "rax", "cc", "memory" )
 
-#define vpaes_ssse3_prepare_dec(const_ptr) \
+#define vpaes_ssse3_prepare_dec() \
     vpaes_ssse3_prepare(); \
-    asm volatile ("lea	.Laes_consts(%%rip), %q0 \n\t" \
-                  "movdqa	          (%q0), %%xmm9  # 0F \n\t" \
-                  "movdqa	.Lk_inv   (%q0), %%xmm10 # inv \n\t" \
-                  "movdqa	.Lk_inv+16(%q0), %%xmm11 # inva \n\t" \
-                  "movdqa	.Lk_dsb9   (%q0), %%xmm13 # sb9u \n\t" \
-                  "movdqa	.Lk_dsb9+16(%q0), %%xmm12 # sb9t \n\t" \
-                  "movdqa	.Lk_dsbd   (%q0), %%xmm15 # sbdu \n\t" \
-                  "movdqa	.Lk_dsbb   (%q0), %%xmm14 # sbbu \n\t" \
-                  "movdqa	.Lk_dsbe   (%q0), %%xmm8 # sbeu \n\t" \
-                  : "=c" (const_ptr) \
+    asm volatile ("call *%[core] \n\t" \
                   : \
-                  : "memory" )
+                  : [core] "r" (_gcry_aes_ssse3_dec_preload) \
+                  : "rax", "cc", "memory" )
 
 
 
@@ -159,9 +155,10 @@ _gcry_aes_ssse3_do_setkey (RIJNDAEL_context *ctx, const byte *key)
                 "leaq %[buf], %%rdx"			"\n\t"
                 "movl %[dir], %%ecx"			"\n\t"
                 "movl %[rotoffs], %%r8d"		"\n\t"
-                "call _aes_schedule_core"		"\n\t"
+                "call *%[core]"				"\n\t"
                 :
-                : [key] "m" (*key),
+                : [core] "r" (&_gcry_aes_ssse3_schedule_core),
+                  [key] "m" (*key),
                   [bits] "g" (keybits),
                   [buf] "m" (ctx->keyschenc32[0][0]),
                   [dir] "g" (0),
@@ -169,10 +166,31 @@ _gcry_aes_ssse3_do_setkey (RIJNDAEL_context *ctx, const byte *key)
                 : "r8", "r9", "r10", "r11", "rax", "rcx", "rdx", "rdi", "rsi",
                   "cc", "memory");
 
-  vpaes_ssse3_cleanup();
-
   /* Save key for setting up decryption. */
-  memcpy(&ctx->keyschdec32[0][0], key, keybits / 8);
+  if (keybits > 192)
+    asm volatile ("movdqu   (%[src]), %%xmm0\n\t"
+		  "movdqu 16(%[src]), %%xmm1\n\t"
+		  "movdqu %%xmm0,   (%[dst])\n\t"
+		  "movdqu %%xmm1, 16(%[dst])\n\t"
+		  : /* No output */
+		  : [dst] "r" (&ctx->keyschdec32[0][0]), [src] "r" (key)
+		  : "memory" );
+  else if (keybits == 192)
+    asm volatile ("movdqu   (%[src]), %%xmm0\n\t"
+		  "movq   16(%[src]), %%xmm1\n\t"
+		  "movdqu %%xmm0,   (%[dst])\n\t"
+		  "movq   %%xmm1, 16(%[dst])\n\t"
+		  : /* No output */
+		  : [dst] "r" (&ctx->keyschdec32[0][0]), [src] "r" (key)
+		  : "memory" );
+  else
+    asm volatile ("movdqu (%[src]), %%xmm0\n\t"
+		  "movdqu %%xmm0, (%[dst])\n\t"
+		  : /* No output */
+		  : [dst] "r" (&ctx->keyschdec32[0][0]), [src] "r" (key)
+		  : "memory" );
+
+  vpaes_ssse3_cleanup();
 }
 
 
@@ -190,9 +208,10 @@ _gcry_aes_ssse3_prepare_decryption (RIJNDAEL_context *ctx)
                 "leaq %[buf], %%rdx"			"\n\t"
                 "movl %[dir], %%ecx"			"\n\t"
                 "movl %[rotoffs], %%r8d"		"\n\t"
-                "call _aes_schedule_core"		"\n\t"
+                "call *%[core]"				"\n\t"
                 :
-                : [key] "m" (ctx->keyschdec32[0][0]),
+                : [core] "r" (_gcry_aes_ssse3_schedule_core),
+                  [key] "m" (ctx->keyschdec32[0][0]),
                   [bits] "g" (keybits),
                   [buf] "m" (ctx->keyschdec32[ctx->rounds][0]),
                   [dir] "g" (1),
@@ -207,32 +226,30 @@ _gcry_aes_ssse3_prepare_decryption (RIJNDAEL_context *ctx)
 /* Encrypt one block using the Intel SSSE3 instructions.  Block is input
 * and output through SSE register xmm0. */
 static inline void
-do_vpaes_ssse3_enc (const RIJNDAEL_context *ctx, unsigned int nrounds,
-                    const void *aes_const_ptr)
+do_vpaes_ssse3_enc (const RIJNDAEL_context *ctx, unsigned int nrounds)
 {
   unsigned int middle_rounds = nrounds - 1;
   const void *keysched = ctx->keyschenc32;
 
-  asm volatile ("call _aes_encrypt_core"		"\n\t"
-                : "+a" (middle_rounds), "+d" (keysched)
-                : "c" (aes_const_ptr)
-                : "rdi", "rsi", "cc", "memory");
+  asm volatile ("call *%[core]"				"\n\t"
+		: "+a" (middle_rounds), "+d" (keysched)
+		: [core] "r" (_gcry_aes_ssse3_encrypt_core)
+		: "rcx", "rsi", "rdi", "cc", "memory");
 }
 
 
 /* Decrypt one block using the Intel SSSE3 instructions.  Block is input
 * and output through SSE register xmm0. */
 static inline void
-do_vpaes_ssse3_dec (const RIJNDAEL_context *ctx, unsigned int nrounds,
-                    const void *aes_const_ptr)
+do_vpaes_ssse3_dec (const RIJNDAEL_context *ctx, unsigned int nrounds)
 {
   unsigned int middle_rounds = nrounds - 1;
   const void *keysched = ctx->keyschdec32;
 
-  asm volatile ("call _aes_decrypt_core"		"\n\t"
+  asm volatile ("call *%[core]"				"\n\t"
                 : "+a" (middle_rounds), "+d" (keysched)
-                : "c" (aes_const_ptr)
-                : "rsi", "cc", "memory");
+		: [core] "r" (_gcry_aes_ssse3_decrypt_core)
+                : "rcx", "rsi", "cc", "memory");
 }
 
 
@@ -241,15 +258,14 @@ _gcry_aes_ssse3_encrypt (const RIJNDAEL_context *ctx, unsigned char *dst,
                         const unsigned char *src)
 {
   unsigned int nrounds = ctx->rounds;
-  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_enc (aes_const_ptr);
+  vpaes_ssse3_prepare_enc ();
   asm volatile ("movdqu %[src], %%xmm0\n\t"
                 :
                 : [src] "m" (*src)
                 : "memory" );
-  do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
+  do_vpaes_ssse3_enc (ctx, nrounds);
   asm volatile ("movdqu %%xmm0, %[dst]\n\t"
                 : [dst] "=m" (*dst)
                 :
@@ -265,10 +281,9 @@ _gcry_aes_ssse3_cfb_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
                         size_t nblocks)
 {
   unsigned int nrounds = ctx->rounds;
-  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_enc (aes_const_ptr);
+  vpaes_ssse3_prepare_enc ();
 
   asm volatile ("movdqu %[iv], %%xmm0\n\t"
                 : /* No output */
@@ -277,7 +292,7 @@ _gcry_aes_ssse3_cfb_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
 
   for ( ;nblocks; nblocks-- )
     {
-      do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
+      do_vpaes_ssse3_enc (ctx, nrounds);
 
       asm volatile ("movdqu %[inbuf], %%xmm1\n\t"
                     "pxor %%xmm1, %%xmm0\n\t"
@@ -305,10 +320,9 @@ _gcry_aes_ssse3_cbc_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
                         size_t nblocks, int cbc_mac)
 {
   unsigned int nrounds = ctx->rounds;
-  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_enc (aes_const_ptr);
+  vpaes_ssse3_prepare_enc ();
 
   asm volatile ("movdqu %[iv], %%xmm7\n\t"
                 : /* No output */
@@ -323,7 +337,7 @@ _gcry_aes_ssse3_cbc_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
                     : [inbuf] "m" (*inbuf)
                     : "memory" );
 
-      do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
+      do_vpaes_ssse3_enc (ctx, nrounds);
 
       asm volatile ("movdqa %%xmm0, %%xmm7\n\t"
                     "movdqu %%xmm0, %[outbuf]\n\t"
@@ -353,11 +367,10 @@ _gcry_aes_ssse3_ctr_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
   static const unsigned char be_mask[16] __attribute__ ((aligned (16))) =
     { 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 };
   unsigned int nrounds = ctx->rounds;
-  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
   u64 ctrlow;
 
-  vpaes_ssse3_prepare_enc (aes_const_ptr);
+  vpaes_ssse3_prepare_enc ();
 
   asm volatile ("movdqa %[mask], %%xmm6\n\t" /* Preload mask */
                 "movdqa (%[ctr]), %%xmm7\n\t"  /* Preload CTR */
@@ -388,10 +401,10 @@ _gcry_aes_ssse3_ctr_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
 
                     "pshufb %%xmm6, %%xmm7\n\t"
                     : [ctrlow] "+r" (ctrlow)
-                    : [ctr] "r" (ctr)
+                    :
                     : "cc", "memory");
 
-      do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
+      do_vpaes_ssse3_enc (ctx, nrounds);
 
       asm volatile ("movdqu %[src], %%xmm1\n\t"      /* xmm1 := input   */
                     "pxor %%xmm1, %%xmm0\n\t"        /* EncCTR ^= input  */
@@ -418,15 +431,14 @@ _gcry_aes_ssse3_decrypt (const RIJNDAEL_context *ctx, unsigned char *dst,
                         const unsigned char *src)
 {
   unsigned int nrounds = ctx->rounds;
-  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_dec (aes_const_ptr);
+  vpaes_ssse3_prepare_dec ();
   asm volatile ("movdqu %[src], %%xmm0\n\t"
                 :
                 : [src] "m" (*src)
                 : "memory" );
-  do_vpaes_ssse3_dec (ctx, nrounds, aes_const_ptr);
+  do_vpaes_ssse3_dec (ctx, nrounds);
   asm volatile ("movdqu %%xmm0, %[dst]\n\t"
                 : [dst] "=m" (*dst)
                 :
@@ -442,10 +454,9 @@ _gcry_aes_ssse3_cfb_dec (RIJNDAEL_context *ctx, unsigned char *outbuf,
                         size_t nblocks)
 {
   unsigned int nrounds = ctx->rounds;
-  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_enc (aes_const_ptr);
+  vpaes_ssse3_prepare_enc ();
 
   asm volatile ("movdqu %[iv], %%xmm0\n\t"
                 : /* No output */
@@ -454,7 +465,7 @@ _gcry_aes_ssse3_cfb_dec (RIJNDAEL_context *ctx, unsigned char *outbuf,
 
   for ( ;nblocks; nblocks-- )
     {
-      do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
+      do_vpaes_ssse3_enc (ctx, nrounds);
 
       asm volatile ("movdqa %%xmm0, %%xmm6\n\t"
                     "movdqu %[inbuf], %%xmm0\n\t"
@@ -483,45 +494,40 @@ _gcry_aes_ssse3_cbc_dec (RIJNDAEL_context *ctx, unsigned char *outbuf,
                         size_t nblocks)
 {
   unsigned int nrounds = ctx->rounds;
-  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_dec (aes_const_ptr);
+  vpaes_ssse3_prepare_dec ();
 
-  asm volatile
-    ("movdqu %[iv], %%xmm7\n\t"	/* use xmm7 as fast IV storage */
-    : /* No output */
-    : [iv] "m" (*iv)
-    : "memory");
+  asm volatile ("movdqu %[iv], %%xmm7\n\t"	/* use xmm7 as fast IV storage */
+		: /* No output */
+		: [iv] "m" (*iv)
+		: "memory");
 
   for ( ;nblocks; nblocks-- )
     {
-      asm volatile
-        ("movdqu %[inbuf], %%xmm0\n\t"
-        "movdqa %%xmm0, %%xmm6\n\t"    /* use xmm6 as savebuf */
-        : /* No output */
-        : [inbuf] "m" (*inbuf)
-        : "memory");
-
-      do_vpaes_ssse3_dec (ctx, nrounds, aes_const_ptr);
-
-      asm volatile
-        ("pxor %%xmm7, %%xmm0\n\t"	/* xor IV with output */
-        "movdqu %%xmm0, %[outbuf]\n\t"
-        "movdqu %%xmm6, %%xmm7\n\t"	/* store savebuf as new IV */
-        : [outbuf] "=m" (*outbuf)
-        :
-        : "memory");
+      asm volatile ("movdqu %[inbuf], %%xmm0\n\t"
+		    "movdqa %%xmm0, %%xmm6\n\t"    /* use xmm6 as savebuf */
+		    : /* No output */
+		    : [inbuf] "m" (*inbuf)
+		    : "memory");
+
+      do_vpaes_ssse3_dec (ctx, nrounds);
+
+      asm volatile ("pxor %%xmm7, %%xmm0\n\t"	/* xor IV with output */
+		    "movdqu %%xmm0, %[outbuf]\n\t"
+		    "movdqu %%xmm6, %%xmm7\n\t"	/* store savebuf as new IV */
+		    : [outbuf] "=m" (*outbuf)
+		    :
+		    : "memory");
 
       outbuf += BLOCKSIZE;
       inbuf  += BLOCKSIZE;
     }
 
-  asm volatile
-    ("movdqu %%xmm7, %[iv]\n\t"	/* store IV */
-    : /* No output */
-    : [iv] "m" (*iv)
-    : "memory");
+  asm volatile ("movdqu %%xmm7, %[iv]\n\t"	/* store IV */
+		: /* No output */
+		: [iv] "m" (*iv)
+		: "memory");
 
   vpaes_ssse3_cleanup ();
 }
@@ -618,10 +624,9 @@ ssse3_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
   const unsigned char *inbuf = inbuf_arg;
   u64 n = c->u_mode.ocb.data_nblocks;
   unsigned int nrounds = ctx->rounds;
-  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_enc (aes_const_ptr);
+  vpaes_ssse3_prepare_enc ();
 
   /* Preload Offset and Checksum */
   asm volatile ("movdqu %[iv], %%xmm7\n\t"
@@ -651,7 +656,7 @@ ssse3_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
                       [inbuf] "m" (*inbuf)
                     : "memory" );
 
-      do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
+      do_vpaes_ssse3_enc (ctx, nrounds);
 
       asm volatile ("pxor   %%xmm7, %%xmm0\n\t"
                     "movdqu %%xmm0, %[outbuf]\n\t"
@@ -685,10 +690,9 @@ ssse3_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
   const unsigned char *inbuf = inbuf_arg;
   u64 n = c->u_mode.ocb.data_nblocks;
   unsigned int nrounds = ctx->rounds;
-  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_dec (aes_const_ptr);
+  vpaes_ssse3_prepare_dec ();
 
   /* Preload Offset and Checksum */
   asm volatile ("movdqu %[iv], %%xmm7\n\t"
@@ -717,7 +721,7 @@ ssse3_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
                       [inbuf] "m" (*inbuf)
                     : "memory" );
 
-      do_vpaes_ssse3_dec (ctx, nrounds, aes_const_ptr);
+      do_vpaes_ssse3_dec (ctx, nrounds);
 
       asm volatile ("pxor   %%xmm7, %%xmm0\n\t"
                     "pxor   %%xmm0, %%xmm6\n\t"
@@ -763,10 +767,9 @@ _gcry_aes_ssse3_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
   const unsigned char *abuf = abuf_arg;
   u64 n = c->u_mode.ocb.aad_nblocks;
   unsigned int nrounds = ctx->rounds;
-  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_enc (aes_const_ptr);
+  vpaes_ssse3_prepare_enc ();
 
   /* Preload Offset and Sum */
   asm volatile ("movdqu %[iv], %%xmm7\n\t"
@@ -794,7 +797,7 @@ _gcry_aes_ssse3_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
                       [abuf] "m" (*abuf)
                     : "memory" );
 
-      do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
+      do_vpaes_ssse3_enc (ctx, nrounds);
 
       asm volatile ("pxor   %%xmm0,   %%xmm6\n\t"
                     :
@@ -816,774 +819,4 @@ _gcry_aes_ssse3_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
   vpaes_ssse3_cleanup ();
 }
 
-
-#ifdef HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS
-# define X(...)
-#else
-# define X(...) __VA_ARGS__
-#endif
-
-asm (
-  "\n\t" "##"
-  "\n\t" "## Constant-time SSSE3 AES core implementation."
-  "\n\t" "##"
-  "\n\t" "## By Mike Hamburg (Stanford University), 2009"
-  "\n\t" "## Public domain."
-  "\n\t" "##"
-
-  "\n\t" ".text"
-
-  "\n\t" "##"
-  "\n\t" "##  _aes_encrypt_core"
-  "\n\t" "##"
-  "\n\t" "##  AES-encrypt %xmm0."
-  "\n\t" "##"
-  "\n\t" "##  Inputs:"
-  "\n\t" "##     %xmm0 = input"
-  "\n\t" "##     %xmm9-%xmm15 as in .Laes_preheat"
-  "\n\t" "##     %rcx  = .Laes_consts"
-  "\n\t" "##    (%rdx) = scheduled keys"
-  "\n\t" "##     %rax  = nrounds - 1"
-  "\n\t" "##"
-  "\n\t" "##  Output in %xmm0"
-  "\n\t" "##  Clobbers  %xmm1-%xmm4, %r9, %r11, %rax"
-  "\n\t" "##  Preserves %xmm6 - %xmm7 so you get some local vectors"
-  "\n\t" "##"
-  "\n\t" "##"
-  "\n\t" ".align 16"
-X("\n\t" ".type _aes_encrypt_core, at function")
-  "\n\t" "_aes_encrypt_core:"
-  "\n\t" "	leaq	.Lk_mc_backward(%rcx), %rdi"
-  "\n\t" "	mov	$16,	%rsi"
-  "\n\t" "	movdqa	.Lk_ipt   (%rcx), %xmm2 # iptlo"
-  "\n\t" "	movdqa	%xmm9,	%xmm1"
-  "\n\t" "	pandn	%xmm0,	%xmm1"
-  "\n\t" "	psrld	$4,	%xmm1"
-  "\n\t" "	pand	%xmm9,	%xmm0"
-  "\n\t" "	pshufb	%xmm0,	%xmm2"
-  "\n\t" "	movdqa	.Lk_ipt+16(%rcx), %xmm0 # ipthi"
-  "\n\t" "	pshufb	%xmm1,	%xmm0"
-  "\n\t" "	pxor	(%rdx),%xmm2"
-  "\n\t" "	pxor	%xmm2,	%xmm0"
-  "\n\t" "	add	$16,	%rdx"
-  "\n\t" "	jmp	.Laes_entry"
-
-  "\n\t" ".align 8"
-  "\n\t" ".Laes_loop:"
-  "\n\t" "	# middle of middle round"
-  "\n\t" "	movdqa  %xmm13,	%xmm4	# 4 : sb1u"
-  "\n\t" "	pshufb  %xmm2,	%xmm4   # 4 = sb1u"
-  "\n\t" "	pxor	(%rdx),	%xmm4	# 4 = sb1u + k"
-  "\n\t" "	movdqa  %xmm12,	%xmm0	# 0 : sb1t"
-  "\n\t" "	pshufb  %xmm3,	%xmm0	# 0 = sb1t"
-  "\n\t" "	pxor	%xmm4,	%xmm0	# 0 = A"
-  "\n\t" "	movdqa  %xmm15,	%xmm4	# 4 : sb2u"
-  "\n\t" "	pshufb	%xmm2,	%xmm4	# 4 = sb2u"
-  "\n\t" "	movdqa	.Lk_mc_forward-.Lk_mc_backward(%rsi,%rdi), %xmm1"
-  "\n\t" "	movdqa	%xmm14, %xmm2	# 2 : sb2t"
-  "\n\t" "	pshufb	%xmm3,  %xmm2	# 2 = sb2t"
-  "\n\t" "	pxor	%xmm4,  %xmm2	# 2 = 2A"
-  "\n\t" "	movdqa	%xmm0,  %xmm3	# 3 = A"
-  "\n\t" "	pshufb  %xmm1,  %xmm0	# 0 = B"
-  "\n\t" "	pxor	%xmm2,  %xmm0	# 0 = 2A+B"
-  "\n\t" "	pshufb	(%rsi,%rdi), %xmm3  # 3 = D"
-  "\n\t" "	lea	16(%esi),%esi	# next mc"
-  "\n\t" "	pxor	%xmm0,	%xmm3	# 3 = 2A+B+D"
-  "\n\t" "	lea	16(%rdx),%rdx	# next key"
-  "\n\t" "	pshufb  %xmm1,	%xmm0	# 0 = 2B+C"
-  "\n\t" "	pxor	%xmm3,	%xmm0	# 0 = 2A+3B+C+D"
-  "\n\t" "	and	$48, %rsi	# ... mod 4"
-  "\n\t" "	dec	%rax		# nr--"
-
-  "\n\t" ".Laes_entry:"
-  "\n\t" "	# top of round"
-  "\n\t" "	movdqa  %xmm9, 	%xmm1	# 1 : i"
-  "\n\t" "	pandn	%xmm0, 	%xmm1	# 1 = i<<4"
-  "\n\t" "	psrld	$4,    	%xmm1   # 1 = i"
-  "\n\t" "	pand	%xmm9, 	%xmm0   # 0 = k"
-  "\n\t" "	movdqa	%xmm11, %xmm2	# 2 : a/k"
-  "\n\t" "	pshufb  %xmm0,  %xmm2	# 2 = a/k"
-  "\n\t" "	pxor	%xmm1,	%xmm0	# 0 = j"
-  "\n\t" "	movdqa  %xmm10,	%xmm3  	# 3 : 1/i"
-  "\n\t" "	pshufb  %xmm1, 	%xmm3  	# 3 = 1/i"
-  "\n\t" "	pxor	%xmm2, 	%xmm3  	# 3 = iak = 1/i + a/k"
-  "\n\t" "	movdqa	%xmm10,	%xmm4  	# 4 : 1/j"
-  "\n\t" "	pshufb	%xmm0, 	%xmm4  	# 4 = 1/j"
-  "\n\t" "	pxor	%xmm2, 	%xmm4  	# 4 = jak = 1/j + a/k"
-  "\n\t" "	movdqa  %xmm10,	%xmm2  	# 2 : 1/iak"
-  "\n\t" "	pshufb  %xmm3,	%xmm2  	# 2 = 1/iak"
-  "\n\t" "	pxor	%xmm0, 	%xmm2  	# 2 = io"
-  "\n\t" "	movdqa  %xmm10, %xmm3   # 3 : 1/jak"
-  "\n\t" "	pshufb  %xmm4,  %xmm3   # 3 = 1/jak"
-  "\n\t" "	pxor	%xmm1,  %xmm3   # 3 = jo"
-  "\n\t" "	jnz	.Laes_loop"
-
-  "\n\t" "	# middle of last round"
-  "\n\t" "	movdqa	.Lk_sbo(%rcx), %xmm4	# 3 : sbou"
-  "\n\t" "	pshufb  %xmm2,  %xmm4   # 4 = sbou"
-  "\n\t" "	pxor	(%rdx), %xmm4   # 4 = sb1u + k"
-  "\n\t" "	movdqa	.Lk_sbo+16(%rcx), %xmm0	# 0 : sbot"
-  "\n\t" "	pshufb  %xmm3,	%xmm0	# 0 = sb1t"
-  "\n\t" "	pxor	%xmm4,	%xmm0	# 0 = A"
-  "\n\t" "	pshufb	.Lk_sr(%rsi,%rcx), %xmm0"
-  "\n\t" "	ret"
-X("\n\t" ".size _aes_encrypt_core,.-_aes_encrypt_core")
-
-  "\n\t" "##"
-  "\n\t" "##  Decryption core"
-  "\n\t" "##"
-  "\n\t" "##  Same API as encryption core."
-  "\n\t" "##"
-  "\n\t" ".align 16"
-X("\n\t" ".type _aes_decrypt_core, at function")
-  "\n\t" "_aes_decrypt_core:"
-  "\n\t" "	movl	%eax,	%esi"
-  "\n\t" "	shll	$4,	%esi"
-  "\n\t" "	xorl	$48,	%esi"
-  "\n\t" "	andl	$48,	%esi"
-  "\n\t" "	movdqa	.Lk_dipt   (%rcx), %xmm2 # iptlo"
-  "\n\t" "	movdqa	%xmm9,	%xmm1"
-  "\n\t" "	pandn	%xmm0,	%xmm1"
-  "\n\t" "	psrld	$4,	%xmm1"
-  "\n\t" "	pand	%xmm9,	%xmm0"
-  "\n\t" "	pshufb	%xmm0,	%xmm2"
-  "\n\t" "	movdqa	.Lk_dipt+16(%rcx), %xmm0 # ipthi"
-  "\n\t" "	pshufb	%xmm1,	%xmm0"
-  "\n\t" "	pxor	(%rdx),	%xmm2"
-  "\n\t" "	pxor	%xmm2,	%xmm0"
-  "\n\t" "	movdqa	.Lk_mc_forward+48(%rcx), %xmm5"
-  "\n\t" "	lea	16(%rdx), %rdx"
-  "\n\t" "	neg	%rax"
-  "\n\t" "	jmp	.Laes_dec_entry"
-
-  "\n\t" ".align 16"
-  "\n\t" ".Laes_dec_loop:"
-  "\n\t" "##"
-  "\n\t" "##  Inverse mix columns"
-  "\n\t" "##"
-  "\n\t" "	movdqa  %xmm13,	%xmm4		# 4 : sb9u"
-  "\n\t" "	pshufb	%xmm2,	%xmm4		# 4 = sb9u"
-  "\n\t" "	pxor	(%rdx),	%xmm4"
-  "\n\t" "	movdqa  %xmm12,	%xmm0		# 0 : sb9t"
-  "\n\t" "	pshufb	%xmm3,	%xmm0		# 0 = sb9t"
-  "\n\t" "	movdqa  .Lk_dsbd+16(%rcx),%xmm1	# 1 : sbdt"
-  "\n\t" "	pxor	%xmm4,	%xmm0		# 0 = ch"
-  "\n\t" "	lea	16(%rdx), %rdx		# next round key"
-
-  "\n\t" "	pshufb	%xmm5,	%xmm0		# MC ch"
-  "\n\t" "	movdqa  %xmm15,	%xmm4		# 4 : sbdu"
-  "\n\t" "	pshufb	%xmm2,	%xmm4		# 4 = sbdu"
-  "\n\t" "	pxor	%xmm0,	%xmm4		# 4 = ch"
-  "\n\t" "	pshufb	%xmm3,	%xmm1		# 1 = sbdt"
-  "\n\t" "	pxor	%xmm4,	%xmm1		# 1 = ch"
-
-  "\n\t" "	pshufb	%xmm5,	%xmm1		# MC ch"
-  "\n\t" "	movdqa  %xmm14,	%xmm4		# 4 : sbbu"
-  "\n\t" "	pshufb	%xmm2,	%xmm4		# 4 = sbbu"
-  "\n\t" "      inc     %rax                    # nr--"
-  "\n\t" "	pxor	%xmm1,	%xmm4		# 4 = ch"
-  "\n\t" "	movdqa  .Lk_dsbb+16(%rcx),%xmm0	# 0 : sbbt"
-  "\n\t" "	pshufb	%xmm3,	%xmm0		# 0 = sbbt"
-  "\n\t" "	pxor	%xmm4,	%xmm0		# 0 = ch"
-
-  "\n\t" "	pshufb	%xmm5,	%xmm0		# MC ch"
-  "\n\t" "	movdqa  %xmm8,	%xmm4		# 4 : sbeu"
-  "\n\t" "	pshufb	%xmm2,	%xmm4		# 4 = sbeu"
-  "\n\t" "	pshufd	$0x93,	%xmm5,	%xmm5"
-  "\n\t" "	pxor	%xmm0,	%xmm4		# 4 = ch"
-  "\n\t" "	movdqa  .Lk_dsbe+16(%rcx),%xmm0	# 0 : sbet"
-  "\n\t" "	pshufb	%xmm3,	%xmm0		# 0 = sbet"
-  "\n\t" "	pxor	%xmm4,	%xmm0		# 0 = ch"
-
-  "\n\t" ".Laes_dec_entry:"
-  "\n\t" "	# top of round"
-  "\n\t" "	movdqa  %xmm9, 	%xmm1	# 1 : i"
-  "\n\t" "	pandn	%xmm0, 	%xmm1	# 1 = i<<4"
-  "\n\t" "	psrld	$4,    	%xmm1   # 1 = i"
-  "\n\t" "	pand	%xmm9, 	%xmm0   # 0 = k"
-  "\n\t" "	movdqa	%xmm11, %xmm2	# 2 : a/k"
-  "\n\t" "	pshufb  %xmm0,  %xmm2	# 2 = a/k"
-  "\n\t" "	pxor	%xmm1,	%xmm0	# 0 = j"
-  "\n\t" "	movdqa  %xmm10,	%xmm3  	# 3 : 1/i"
-  "\n\t" "	pshufb  %xmm1, 	%xmm3  	# 3 = 1/i"
-  "\n\t" "	pxor	%xmm2, 	%xmm3  	# 3 = iak = 1/i + a/k"
-  "\n\t" "	movdqa	%xmm10,	%xmm4  	# 4 : 1/j"
-  "\n\t" "	pshufb	%xmm0, 	%xmm4  	# 4 = 1/j"
-  "\n\t" "	pxor	%xmm2, 	%xmm4  	# 4 = jak = 1/j + a/k"
-  "\n\t" "	movdqa  %xmm10,	%xmm2  	# 2 : 1/iak"
-  "\n\t" "	pshufb  %xmm3,	%xmm2  	# 2 = 1/iak"
-  "\n\t" "	pxor	%xmm0, 	%xmm2  	# 2 = io"
-  "\n\t" "	movdqa  %xmm10, %xmm3   # 3 : 1/jak"
-  "\n\t" "	pshufb  %xmm4,  %xmm3   # 3 = 1/jak"
-  "\n\t" "	pxor	%xmm1,  %xmm3   # 3 = jo"
-  "\n\t" "	jnz	.Laes_dec_loop"
-
-  "\n\t" "	# middle of last round"
-  "\n\t" "	movdqa	.Lk_dsbo(%rcx), %xmm4		# 3 : sbou"
-  "\n\t" "	pshufb  %xmm2,  %xmm4   # 4 = sbou"
-  "\n\t" "	pxor	(%rdx), %xmm4   # 4 = sb1u + k"
-  "\n\t" "	movdqa	.Lk_dsbo+16(%rcx), %xmm0	# 0 : sbot"
-  "\n\t" "	pshufb  %xmm3,	%xmm0	# 0 = sb1t"
-  "\n\t" "	pxor	%xmm4,	%xmm0	# 0 = A"
-  "\n\t" "	pshufb	.Lk_sr(%rsi,%rcx), %xmm0"
-  "\n\t" "	ret"
-X("\n\t" ".size _aes_decrypt_core,.-_aes_decrypt_core")
-
-  "\n\t" "########################################################"
-  "\n\t" "##                                                    ##"
-  "\n\t" "##                  AES key schedule                  ##"
-  "\n\t" "##                                                    ##"
-  "\n\t" "########################################################"
-
-  "\n\t" ".align 16"
-X("\n\t" ".type _aes_schedule_core, at function")
-  "\n\t" "_aes_schedule_core:"
-  "\n\t" "	# rdi = key"
-  "\n\t" "	# rsi = size in bits"
-  "\n\t" "	# rdx = buffer"
-  "\n\t" "	# rcx = direction.  0=encrypt, 1=decrypt"
-
-  "\n\t" "	# load the tables"
-  "\n\t" "	lea	.Laes_consts(%rip), %r10"
-  "\n\t" "	movdqa	          (%r10), %xmm9  # 0F"
-  "\n\t" "	movdqa	.Lk_inv   (%r10), %xmm10 # inv"
-  "\n\t" "	movdqa	.Lk_inv+16(%r10), %xmm11 # inva"
-  "\n\t" "	movdqa	.Lk_sb1   (%r10), %xmm13 # sb1u"
-  "\n\t" "	movdqa	.Lk_sb1+16(%r10), %xmm12 # sb1t"
-  "\n\t" "	movdqa	.Lk_sb2   (%r10), %xmm15 # sb2u"
-  "\n\t" "	movdqa	.Lk_sb2+16(%r10), %xmm14 # sb2t"
-
-  "\n\t" "	movdqa	.Lk_rcon(%r10), %xmm8	# load rcon"
-  "\n\t" "	movdqu	(%rdi),	%xmm0		# load key (unaligned)"
-
-  "\n\t" "	# input transform"
-  "\n\t" "	movdqu	%xmm0,	%xmm3"
-  "\n\t" "	lea	.Lk_ipt(%r10), %r11"
-  "\n\t" "	call	.Laes_schedule_transform"
-  "\n\t" "	movdqu	%xmm0,	%xmm7"
-
-  "\n\t" "	test	%rcx,	%rcx"
-  "\n\t" "	jnz	.Laes_schedule_am_decrypting"
-
-  "\n\t" "	# encrypting, output zeroth round key after transform"
-  "\n\t" "	movdqa	%xmm0,	(%rdx)"
-  "\n\t" "	jmp	.Laes_schedule_go"
-
-  "\n\t" ".Laes_schedule_am_decrypting:"
-  "\n\t" "	# decrypting, output zeroth round key after shiftrows"
-  "\n\t" "	pshufb  .Lk_sr(%r8,%r10),%xmm3"
-  "\n\t" "	movdqa	%xmm3,	(%rdx)"
-  "\n\t" "	xor	$48, 	%r8"
-
-  "\n\t" ".Laes_schedule_go:"
-  "\n\t" "	cmp	$192,	%rsi"
-  "\n\t" "	je	.Laes_schedule_192"
-  "\n\t" "	cmp	$256,	%rsi"
-  "\n\t" "	je	.Laes_schedule_256"
-  "\n\t" "	# 128: fall though"
-
-  "\n\t" "##"
-  "\n\t" "##  .Laes_schedule_128"
-  "\n\t" "##"
-  "\n\t" "##  128-bit specific part of key schedule."
-  "\n\t" "##"
-  "\n\t" "##  This schedule is really simple, because all its parts"
-  "\n\t" "##  are accomplished by the subroutines."
-  "\n\t" "##"
-  "\n\t" ".Laes_schedule_128:"
-  "\n\t" "	mov	$10, %rsi"
-
-  "\n\t" ".Laes_schedule_128_L:"
-  "\n\t" "	call 	.Laes_schedule_round"
-  "\n\t" "	dec	%rsi"
-  "\n\t" "	jz 	.Laes_schedule_mangle_last"
-  "\n\t" "	call	.Laes_schedule_mangle	# write output"
-  "\n\t" "	jmp 	.Laes_schedule_128_L"
-
-  "\n\t" "##"
-  "\n\t" "##  .Laes_schedule_192"
-  "\n\t" "##"
-  "\n\t" "##  192-bit specific part of key schedule."
-  "\n\t" "##"
-  "\n\t" "##  The main body of this schedule is the same as the 128-bit"
-  "\n\t" "##  schedule, but with more smearing.  The long, high side is"
-  "\n\t" "##  stored in %xmm7 as before, and the short, low side is in"
-  "\n\t" "##  the high bits of %xmm6."
-  "\n\t" "##"
-  "\n\t" "##  This schedule is somewhat nastier, however, because each"
-  "\n\t" "##  round produces 192 bits of key material, or 1.5 round keys."
-  "\n\t" "##  Therefore, on each cycle we do 2 rounds and produce 3 round"
-  "\n\t" "##  keys."
-  "\n\t" "##"
-  "\n\t" ".Laes_schedule_192:"
-  "\n\t" "	movdqu	8(%rdi),%xmm0		# load key part 2 (very unaligned)"
-  "\n\t" "	call	.Laes_schedule_transform	# input transform"
-  "\n\t" "	pshufd	$0x0E,	%xmm0,	%xmm6"
-  "\n\t" "	pslldq	$8,	%xmm6		# clobber low side with zeros"
-  "\n\t" "	mov	$4,	%rsi"
-
-  "\n\t" ".Laes_schedule_192_L:"
-  "\n\t" "	call	.Laes_schedule_round"
-  "\n\t" "	palignr	$8,%xmm6,%xmm0	"
-  "\n\t" "	call	.Laes_schedule_mangle	# save key n"
-  "\n\t" "	call	.Laes_schedule_192_smear"
-  "\n\t" "	call	.Laes_schedule_mangle	# save key n+1"
-  "\n\t" "	call	.Laes_schedule_round"
-  "\n\t" "	dec	%rsi"
-  "\n\t" "	jz 	.Laes_schedule_mangle_last"
-  "\n\t" "	call	.Laes_schedule_mangle	# save key n+2"
-  "\n\t" "	call	.Laes_schedule_192_smear"
-  "\n\t" "	jmp	.Laes_schedule_192_L"
-
-  "\n\t" "##"
-  "\n\t" "##  .Laes_schedule_192_smear"
-  "\n\t" "##"
-  "\n\t" "##  Smear the short, low side in the 192-bit key schedule."
-  "\n\t" "##"
-  "\n\t" "##  Inputs:"
-  "\n\t" "##    %xmm7: high side, b  a  x  y"
-  "\n\t" "##    %xmm6:  low side, d  c  0  0"
-  "\n\t" "##    %xmm13: 0"
-  "\n\t" "##"
-  "\n\t" "##  Outputs:"
-  "\n\t" "##    %xmm6: b+c+d  b+c  0  0"
-  "\n\t" "##    %xmm0: b+c+d  b+c  b  a"
-  "\n\t" "##"
-  "\n\t" ".Laes_schedule_192_smear:"
-  "\n\t" "	pshufd	$0x80,	%xmm6,	%xmm0	# d c 0 0 -> c 0 0 0"
-  "\n\t" "	pxor	%xmm0,	%xmm6		# -> c+d c 0 0"
-  "\n\t" "	pshufd	$0xFE,	%xmm7,	%xmm0	# b a _ _ -> b b b a"
-  "\n\t" "	pxor	%xmm6,	%xmm0		# -> b+c+d b+c b a"
-  "\n\t" "	pshufd	$0x0E,	%xmm0,	%xmm6"
-  "\n\t" "	pslldq	$8,	%xmm6		# clobber low side with zeros"
-  "\n\t" "	ret"
-
-  "\n\t" "##"
-  "\n\t" "##  .Laes_schedule_256"
-  "\n\t" "##"
-  "\n\t" "##  256-bit specific part of key schedule."
-  "\n\t" "##"
-  "\n\t" "##  The structure here is very similar to the 128-bit"
-  "\n\t" "##  schedule, but with an additional 'low side' in"
-  "\n\t" "##  %xmm6.  The low side's rounds are the same as the"
-  "\n\t" "##  high side's, except no rcon and no rotation."
-  "\n\t" "##"
-  "\n\t" ".Laes_schedule_256:"
-  "\n\t" "	movdqu	16(%rdi),%xmm0		# load key part 2 (unaligned)"
-  "\n\t" "	call	.Laes_schedule_transform	# input transform"
-  "\n\t" "	mov	$7, %rsi"
-
-  "\n\t" ".Laes_schedule_256_L:"
-  "\n\t" "	call	.Laes_schedule_mangle	# output low result"
-  "\n\t" "	movdqa	%xmm0,	%xmm6		# save cur_lo in xmm6"
-
-  "\n\t" "	# high round"
-  "\n\t" "	call	.Laes_schedule_round"
-  "\n\t" "	dec	%rsi"
-  "\n\t" "	jz 	.Laes_schedule_mangle_last"
-  "\n\t" "	call	.Laes_schedule_mangle	"
-
-  "\n\t" "	# low round. swap xmm7 and xmm6"
-  "\n\t" "	pshufd	$0xFF,	%xmm0,	%xmm0"
-  "\n\t" "	movdqa	%xmm7,	%xmm5"
-  "\n\t" "	movdqa	%xmm6,	%xmm7"
-  "\n\t" "	call	.Laes_schedule_low_round"
-  "\n\t" "	movdqa	%xmm5,	%xmm7"
-
-  "\n\t" "	jmp	.Laes_schedule_256_L"
-
-  "\n\t" "##"
-  "\n\t" "##  .Laes_schedule_round"
-  "\n\t" "##"
-  "\n\t" "##  Runs one main round of the key schedule on %xmm0, %xmm7"
-  "\n\t" "##"
-  "\n\t" "##  Specifically, runs subbytes on the high dword of %xmm0"
-  "\n\t" "##  then rotates it by one byte and xors into the low dword of"
-  "\n\t" "##  %xmm7."
-  "\n\t" "##"
-  "\n\t" "##  Adds rcon from low byte of %xmm8, then rotates %xmm8 for"
-  "\n\t" "##  next rcon."
-  "\n\t" "##"
-  "\n\t" "##  Smears the dwords of %xmm7 by xoring the low into the"
-  "\n\t" "##  second low, result into third, result into highest."
-  "\n\t" "##"
-  "\n\t" "##  Returns results in %xmm7 = %xmm0."
-  "\n\t" "##  Clobbers %xmm1-%xmm4, %r11."
-  "\n\t" "##"
-  "\n\t" ".Laes_schedule_round:"
-  "\n\t" "	# extract rcon from xmm8"
-  "\n\t" "	pxor	%xmm1,	%xmm1"
-  "\n\t" "	palignr	$15,	%xmm8,	%xmm1"
-  "\n\t" "	palignr	$15,	%xmm8,	%xmm8"
-  "\n\t" "	pxor	%xmm1,	%xmm7"
-
-  "\n\t" "	# rotate"
-  "\n\t" "	pshufd	$0xFF,	%xmm0,	%xmm0"
-  "\n\t" "	palignr	$1,	%xmm0,	%xmm0"
-
-  "\n\t" "	# fall through..."
-
-  "\n\t" "	# low round: same as high round, but no rotation and no rcon."
-  "\n\t" ".Laes_schedule_low_round:"
-  "\n\t" "	# smear xmm7"
-  "\n\t" "	movdqa	%xmm7,	%xmm1"
-  "\n\t" "	pslldq	$4,	%xmm7"
-  "\n\t" "	pxor	%xmm1,	%xmm7"
-  "\n\t" "	movdqa	%xmm7,	%xmm1"
-  "\n\t" "	pslldq	$8,	%xmm7"
-  "\n\t" "	pxor	%xmm1,	%xmm7"
-  "\n\t" "	pxor	.Lk_s63(%r10), %xmm7"
-
-  "\n\t" "	# subbytes"
-  "\n\t" "	movdqa  %xmm9, 	%xmm1"
-  "\n\t" "	pandn	%xmm0, 	%xmm1"
-  "\n\t" "	psrld	$4,    	%xmm1		# 1 = i"
-  "\n\t" "	pand	%xmm9, 	%xmm0		# 0 = k"
-  "\n\t" "	movdqa	%xmm11, %xmm2		# 2 : a/k"
-  "\n\t" "	pshufb  %xmm0,  %xmm2		# 2 = a/k"
-  "\n\t" "	pxor	%xmm1,	%xmm0		# 0 = j"
-  "\n\t" "	movdqa  %xmm10,	%xmm3		# 3 : 1/i"
-  "\n\t" "	pshufb  %xmm1, 	%xmm3		# 3 = 1/i"
-  "\n\t" "	pxor	%xmm2, 	%xmm3		# 3 = iak = 1/i + a/k"
-  "\n\t" "	movdqa	%xmm10,	%xmm4		# 4 : 1/j"
-  "\n\t" "	pshufb	%xmm0, 	%xmm4		# 4 = 1/j"
-  "\n\t" "	pxor	%xmm2, 	%xmm4		# 4 = jak = 1/j + a/k"
-  "\n\t" "	movdqa  %xmm10,	%xmm2		# 2 : 1/iak"
-  "\n\t" "	pshufb  %xmm3,	%xmm2		# 2 = 1/iak"
-  "\n\t" "	pxor	%xmm0, 	%xmm2		# 2 = io"
-  "\n\t" "	movdqa  %xmm10, %xmm3		# 3 : 1/jak"
-  "\n\t" "	pshufb  %xmm4,  %xmm3		# 3 = 1/jak"
-  "\n\t" "	pxor	%xmm1,  %xmm3		# 3 = jo"
-  "\n\t" "	movdqa	.Lk_sb1(%r10), %xmm4	# 4 : sbou"
-  "\n\t" "	pshufb  %xmm2,  %xmm4		# 4 = sbou"
-  "\n\t" "	movdqa	.Lk_sb1+16(%r10), %xmm0	# 0 : sbot"
-  "\n\t" "	pshufb  %xmm3,	%xmm0		# 0 = sb1t"
-  "\n\t" "	pxor	%xmm4, 	%xmm0		# 0 = sbox output"
-
-  "\n\t" "	# add in smeared stuff"
-  "\n\t" "	pxor	%xmm7,	%xmm0	"
-  "\n\t" "	movdqa	%xmm0,	%xmm7"
-  "\n\t" "	ret"
-
-  "\n\t" "##"
-  "\n\t" "##  .Laes_schedule_transform"
-  "\n\t" "##"
-  "\n\t" "##  Linear-transform %xmm0 according to tables at (%r11)"
-  "\n\t" "##"
-  "\n\t" "##  Requires that %xmm9 = 0x0F0F... as in preheat"
-  "\n\t" "##  Output in %xmm0"
-  "\n\t" "##  Clobbers %xmm1, %xmm2"
-  "\n\t" "##"
-  "\n\t" ".Laes_schedule_transform:"
-  "\n\t" "	movdqa	%xmm9,	%xmm1"
-  "\n\t" "	pandn	%xmm0,	%xmm1"
-  "\n\t" "	psrld	$4,	%xmm1"
-  "\n\t" "	pand	%xmm9,	%xmm0"
-  "\n\t" "	movdqa	(%r11), %xmm2 	# lo"
-  "\n\t" "	pshufb	%xmm0,	%xmm2"
-  "\n\t" "	movdqa	16(%r11), %xmm0 # hi"
-  "\n\t" "	pshufb	%xmm1,	%xmm0"
-  "\n\t" "	pxor	%xmm2,	%xmm0"
-  "\n\t" "	ret"
-
-  "\n\t" "##"
-  "\n\t" "##  .Laes_schedule_mangle"
-  "\n\t" "##"
-  "\n\t" "##  Mangle xmm0 from (basis-transformed) standard version"
-  "\n\t" "##  to our version."
-  "\n\t" "##"
-  "\n\t" "##  On encrypt,"
-  "\n\t" "##    xor with 0x63"
-  "\n\t" "##    multiply by circulant 0,1,1,1"
-  "\n\t" "##    apply shiftrows transform"
-  "\n\t" "##"
-  "\n\t" "##  On decrypt,"
-  "\n\t" "##    xor with 0x63"
-  "\n\t" "##    multiply by 'inverse mixcolumns' circulant E,B,D,9"
-  "\n\t" "##    deskew"
-  "\n\t" "##    apply shiftrows transform"
-  "\n\t" "##"
-  "\n\t" "##"
-  "\n\t" "##  Writes out to (%rdx), and increments or decrements it"
-  "\n\t" "##  Keeps track of round number mod 4 in %r8"
-  "\n\t" "##  Preserves xmm0"
-  "\n\t" "##  Clobbers xmm1-xmm5"
-  "\n\t" "##"
-  "\n\t" ".Laes_schedule_mangle:"
-  "\n\t" "	movdqa	%xmm0,	%xmm4	# save xmm0 for later"
-  "\n\t" "	movdqa	.Lk_mc_forward(%r10),%xmm5"
-  "\n\t" "	test	%rcx, 	%rcx"
-  "\n\t" "	jnz	.Laes_schedule_mangle_dec"
-
-  "\n\t" "	# encrypting"
-  "\n\t" "	add	$16,	%rdx"
-  "\n\t" "	pxor	.Lk_s63(%r10),%xmm4"
-  "\n\t" "	pshufb	%xmm5,	%xmm4"
-  "\n\t" "	movdqa	%xmm4,	%xmm3"
-  "\n\t" "	pshufb	%xmm5,	%xmm4"
-  "\n\t" "	pxor	%xmm4,	%xmm3"
-  "\n\t" "	pshufb	%xmm5,	%xmm4"
-  "\n\t" "	pxor	%xmm4,	%xmm3"
-
-  "\n\t" "	jmp	.Laes_schedule_mangle_both"
-
-  "\n\t" ".Laes_schedule_mangle_dec:"
-  "\n\t" "	lea	.Lk_dks_1(%r10), %r11	# first table: *9"
-  "\n\t" "	call 	.Laes_schedule_transform"
-  "\n\t" "	movdqa	%xmm0,	%xmm3"
-  "\n\t" "	pshufb	%xmm5,	%xmm3"
-
-  "\n\t" "	add	$32, 	%r11		# next table:  *B"
-  "\n\t" "	call 	.Laes_schedule_transform"
-  "\n\t" "	pxor	%xmm0,	%xmm3"
-  "\n\t" "	pshufb	%xmm5,	%xmm3"
-
-  "\n\t" "	add	$32, 	%r11		# next table:  *D"
-  "\n\t" "	call 	.Laes_schedule_transform"
-  "\n\t" "	pxor	%xmm0,	%xmm3"
-  "\n\t" "	pshufb	%xmm5,	%xmm3"
-
-  "\n\t" "	add	$32, 	%r11		# next table:  *E"
-  "\n\t" "	call 	.Laes_schedule_transform"
-  "\n\t" "	pxor	%xmm0,	%xmm3"
-  "\n\t" "	pshufb	%xmm5,	%xmm3"
-
-  "\n\t" "	movdqa	%xmm4,	%xmm0		# restore %xmm0"
-  "\n\t" "	add	$-16,	%rdx"
-
-  "\n\t" ".Laes_schedule_mangle_both:"
-  "\n\t" "	pshufb	.Lk_sr(%r8,%r10),%xmm3"
-  "\n\t" "	add	$-16,	%r8"
-  "\n\t" "	and	$48,	%r8"
-  "\n\t" "	movdqa	%xmm3,	(%rdx)"
-  "\n\t" "	ret"
-
-  "\n\t" "##"
-  "\n\t" "##  .Laes_schedule_mangle_last"
-  "\n\t" "##"
-  "\n\t" "##  Mangler for last round of key schedule"
-  "\n\t" "##  Mangles %xmm0"
-  "\n\t" "##    when encrypting, outputs out(%xmm0) ^ 63"
-  "\n\t" "##    when decrypting, outputs unskew(%xmm0)"
-  "\n\t" "##"
-  "\n\t" "##  Always called right before return... jumps to cleanup and exits"
-  "\n\t" "##"
-  "\n\t" ".Laes_schedule_mangle_last:"
-  "\n\t" "	# schedule last round key from xmm0"
-  "\n\t" "	lea	.Lk_deskew(%r10),%r11	# prepare to deskew"
-  "\n\t" "	test	%rcx, 	%rcx"
-  "\n\t" "	jnz	.Laes_schedule_mangle_last_dec"
-
-  "\n\t" "	# encrypting"
-  "\n\t" "	pshufb	.Lk_sr(%r8,%r10),%xmm0	# output permute"
-  "\n\t" "	lea	.Lk_opt(%r10),	%r11	# prepare to output transform"
-  "\n\t" "	add	$32,	%rdx"
-
-  "\n\t" ".Laes_schedule_mangle_last_dec:"
-  "\n\t" "	add	$-16,	%rdx"
-  "\n\t" "	pxor	.Lk_s63(%r10),	%xmm0"
-  "\n\t" "	call	.Laes_schedule_transform # output transform"
-  "\n\t" "	movdqa	%xmm0,	(%rdx)		# save last key"
-
-  "\n\t" "	#_aes_cleanup"
-  "\n\t" "	pxor	%xmm0,  %xmm0"
-  "\n\t" "	pxor	%xmm1,  %xmm1"
-  "\n\t" "	pxor	%xmm2,  %xmm2"
-  "\n\t" "	pxor	%xmm3,  %xmm3"
-  "\n\t" "	pxor	%xmm4,  %xmm4"
-  "\n\t" "	pxor	%xmm5,  %xmm5"
-  "\n\t" "	pxor	%xmm6,  %xmm6"
-  "\n\t" "	pxor	%xmm7,  %xmm7"
-  "\n\t" "	pxor	%xmm8,  %xmm8"
-  "\n\t" "	ret"
-X("\n\t" ".size _aes_schedule_core,.-_aes_schedule_core")
-
-  "\n\t" "########################################################"
-  "\n\t" "##                                                    ##"
-  "\n\t" "##                     Constants                      ##"
-  "\n\t" "##                                                    ##"
-  "\n\t" "########################################################"
-
-  "\n\t" ".align 16"
-X("\n\t" ".type _aes_consts, at object")
-  "\n\t" ".Laes_consts:"
-  "\n\t" "_aes_consts:"
-  "\n\t" "	# s0F"
-  "\n\t" "	.Lk_s0F = .-.Laes_consts"
-  "\n\t" "	.quad	0x0F0F0F0F0F0F0F0F"
-  "\n\t" "	.quad	0x0F0F0F0F0F0F0F0F"
-
-  "\n\t" "	# input transform (lo, hi)"
-  "\n\t" "	.Lk_ipt = .-.Laes_consts"
-  "\n\t" "	.quad	0xC2B2E8985A2A7000"
-  "\n\t" "	.quad	0xCABAE09052227808"
-  "\n\t" "	.quad	0x4C01307D317C4D00"
-  "\n\t" "	.quad	0xCD80B1FCB0FDCC81"
-
-  "\n\t" "	# inv, inva"
-  "\n\t" "	.Lk_inv = .-.Laes_consts"
-  "\n\t" "	.quad	0x0E05060F0D080180"
-  "\n\t" "	.quad	0x040703090A0B0C02"
-  "\n\t" "	.quad	0x01040A060F0B0780"
-  "\n\t" "	.quad	0x030D0E0C02050809"
-
-  "\n\t" "	# sb1u, sb1t"
-  "\n\t" "	.Lk_sb1 = .-.Laes_consts"
-  "\n\t" "	.quad	0xB19BE18FCB503E00"
-  "\n\t" "	.quad	0xA5DF7A6E142AF544"
-  "\n\t" "	.quad	0x3618D415FAE22300"
-  "\n\t" "	.quad	0x3BF7CCC10D2ED9EF"
-
-
-  "\n\t" "	# sb2u, sb2t"
-  "\n\t" "	.Lk_sb2 = .-.Laes_consts"
-  "\n\t" "	.quad	0xE27A93C60B712400"
-  "\n\t" "	.quad	0x5EB7E955BC982FCD"
-  "\n\t" "	.quad	0x69EB88400AE12900"
-  "\n\t" "	.quad	0xC2A163C8AB82234A"
-
-  "\n\t" "	# sbou, sbot"
-  "\n\t" "	.Lk_sbo = .-.Laes_consts"
-  "\n\t" "	.quad	0xD0D26D176FBDC700"
-  "\n\t" "	.quad	0x15AABF7AC502A878"
-  "\n\t" "	.quad	0xCFE474A55FBB6A00"
-  "\n\t" "	.quad	0x8E1E90D1412B35FA"
-
-  "\n\t" "	# mc_forward"
-  "\n\t" "	.Lk_mc_forward = .-.Laes_consts"
-  "\n\t" "	.quad	0x0407060500030201"
-  "\n\t" "	.quad	0x0C0F0E0D080B0A09"
-  "\n\t" "	.quad	0x080B0A0904070605"
-  "\n\t" "	.quad	0x000302010C0F0E0D"
-  "\n\t" "	.quad	0x0C0F0E0D080B0A09"
-  "\n\t" "	.quad	0x0407060500030201"
-  "\n\t" "	.quad	0x000302010C0F0E0D"
-  "\n\t" "	.quad	0x080B0A0904070605"
-
-  "\n\t" "	# mc_backward"
-  "\n\t" "	.Lk_mc_backward = .-.Laes_consts"
-  "\n\t" "	.quad	0x0605040702010003"
-  "\n\t" "	.quad	0x0E0D0C0F0A09080B"
-  "\n\t" "	.quad	0x020100030E0D0C0F"
-  "\n\t" "	.quad	0x0A09080B06050407"
-  "\n\t" "	.quad	0x0E0D0C0F0A09080B"
-  "\n\t" "	.quad	0x0605040702010003"
-  "\n\t" "	.quad	0x0A09080B06050407"
-  "\n\t" "	.quad	0x020100030E0D0C0F"
-
-  "\n\t" "	# sr"
-  "\n\t" "	.Lk_sr = .-.Laes_consts"
-  "\n\t" "	.quad	0x0706050403020100"
-  "\n\t" "	.quad	0x0F0E0D0C0B0A0908"
-  "\n\t" "	.quad	0x030E09040F0A0500"
-  "\n\t" "	.quad	0x0B06010C07020D08"
-  "\n\t" "	.quad	0x0F060D040B020900"
-  "\n\t" "	.quad	0x070E050C030A0108"
-  "\n\t" "	.quad	0x0B0E0104070A0D00"
-  "\n\t" "	.quad	0x0306090C0F020508"
-
-  "\n\t" "	# rcon"
-  "\n\t" "	.Lk_rcon = .-.Laes_consts"
-  "\n\t" "	.quad	0x1F8391B9AF9DEEB6"
-  "\n\t" "	.quad	0x702A98084D7C7D81"
-
-  "\n\t" "	# s63: all equal to 0x63 transformed"
-  "\n\t" "	.Lk_s63 = .-.Laes_consts"
-  "\n\t" "	.quad	0x5B5B5B5B5B5B5B5B"
-  "\n\t" "	.quad	0x5B5B5B5B5B5B5B5B"
-
-  "\n\t" "	# output transform"
-  "\n\t" "	.Lk_opt = .-.Laes_consts"
-  "\n\t" "	.quad	0xFF9F4929D6B66000"
-  "\n\t" "	.quad	0xF7974121DEBE6808"
-  "\n\t" "	.quad	0x01EDBD5150BCEC00"
-  "\n\t" "	.quad	0xE10D5DB1B05C0CE0"
-
-  "\n\t" "	# deskew tables: inverts the sbox's 'skew'"
-  "\n\t" "	.Lk_deskew = .-.Laes_consts"
-  "\n\t" "	.quad	0x07E4A34047A4E300"
-  "\n\t" "	.quad	0x1DFEB95A5DBEF91A"
-  "\n\t" "	.quad	0x5F36B5DC83EA6900"
-  "\n\t" "	.quad	0x2841C2ABF49D1E77"
-
-  "\n\t" "##"
-  "\n\t" "##  Decryption stuff"
-  "\n\t" "##  Key schedule constants"
-  "\n\t" "##"
-  "\n\t" "	# decryption key schedule: x -> invskew x*9"
-  "\n\t" "	.Lk_dks_1 = .-.Laes_consts"
-  "\n\t" "	.quad	0xB6116FC87ED9A700"
-  "\n\t" "	.quad	0x4AED933482255BFC"
-  "\n\t" "	.quad	0x4576516227143300"
-  "\n\t" "	.quad	0x8BB89FACE9DAFDCE"
-
-  "\n\t" "	# decryption key schedule: invskew x*9 -> invskew x*D"
-  "\n\t" "	.Lk_dks_2 = .-.Laes_consts"
-  "\n\t" "	.quad	0x27438FEBCCA86400"
-  "\n\t" "	.quad	0x4622EE8AADC90561"
-  "\n\t" "	.quad	0x815C13CE4F92DD00"
-  "\n\t" "	.quad	0x73AEE13CBD602FF2"
-
-  "\n\t" "	# decryption key schedule: invskew x*D -> invskew x*B"
-  "\n\t" "	.Lk_dks_3 = .-.Laes_consts"
-  "\n\t" "	.quad	0x03C4C50201C6C700"
-  "\n\t" "	.quad	0xF83F3EF9FA3D3CFB"
-  "\n\t" "	.quad	0xEE1921D638CFF700"
-  "\n\t" "	.quad	0xA5526A9D7384BC4B"
-
-  "\n\t" "	# decryption key schedule: invskew x*B -> invskew x*E + 0x63"
-  "\n\t" "	.Lk_dks_4 = .-.Laes_consts"
-  "\n\t" "	.quad	0xE3C390B053732000"
-  "\n\t" "	.quad	0xA080D3F310306343"
-  "\n\t" "	.quad	0xA0CA214B036982E8"
-  "\n\t" "	.quad	0x2F45AEC48CE60D67"
-
-  "\n\t" "##"
-  "\n\t" "##  Decryption stuff"
-  "\n\t" "##  Round function constants"
-  "\n\t" "##"
-  "\n\t" "	# decryption input transform"
-  "\n\t" "	.Lk_dipt = .-.Laes_consts"
-  "\n\t" "	.quad	0x0F505B040B545F00"
-  "\n\t" "	.quad	0x154A411E114E451A"
-  "\n\t" "	.quad	0x86E383E660056500"
-  "\n\t" "	.quad	0x12771772F491F194"
-
-  "\n\t" "	# decryption sbox output *9*u, *9*t"
-  "\n\t" "	.Lk_dsb9 = .-.Laes_consts"
-  "\n\t" "	.quad	0x851C03539A86D600"
-  "\n\t" "	.quad	0xCAD51F504F994CC9"
-  "\n\t" "	.quad	0xC03B1789ECD74900"
-  "\n\t" "	.quad	0x725E2C9EB2FBA565"
-
-  "\n\t" "	# decryption sbox output *D*u, *D*t"
-  "\n\t" "	.Lk_dsbd = .-.Laes_consts"
-  "\n\t" "	.quad	0x7D57CCDFE6B1A200"
-  "\n\t" "	.quad	0xF56E9B13882A4439"
-  "\n\t" "	.quad	0x3CE2FAF724C6CB00"
-  "\n\t" "	.quad	0x2931180D15DEEFD3"
-
-  "\n\t" "	# decryption sbox output *B*u, *B*t"
-  "\n\t" "	.Lk_dsbb = .-.Laes_consts"
-  "\n\t" "	.quad	0xD022649296B44200"
-  "\n\t" "	.quad	0x602646F6B0F2D404"
-  "\n\t" "	.quad	0xC19498A6CD596700"
-  "\n\t" "	.quad	0xF3FF0C3E3255AA6B"
-
-  "\n\t" "	# decryption sbox output *E*u, *E*t"
-  "\n\t" "	.Lk_dsbe = .-.Laes_consts"
-  "\n\t" "	.quad	0x46F2929626D4D000"
-  "\n\t" "	.quad	0x2242600464B4F6B0"
-  "\n\t" "	.quad	0x0C55A6CDFFAAC100"
-  "\n\t" "	.quad	0x9467F36B98593E32"
-
-  "\n\t" "	# decryption sbox final output"
-  "\n\t" "	.Lk_dsbo = .-.Laes_consts"
-  "\n\t" "	.quad	0x1387EA537EF94000"
-  "\n\t" "	.quad	0xC7AA6DB9D4943E2D"
-  "\n\t" "	.quad	0x12D7560F93441D00"
-  "\n\t" "	.quad	0xCA4B8159D8C58E9C"
-X("\n\t" ".size _aes_consts,.-_aes_consts")
-);
-
 #endif /* USE_SSSE3 */
diff --git a/configure.ac b/configure.ac
index 7dfbd60..90688d3 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2031,6 +2031,7 @@ if test "$found" = "1" ; then
 
          # Build with the SSSE3 implementation
          GCRYPT_CIPHERS="$GCRYPT_CIPHERS rijndael-ssse3-amd64.lo"
+         GCRYPT_CIPHERS="$GCRYPT_CIPHERS rijndael-ssse3-amd64-asm.lo"
       ;;
       arm*-*-*)
          # Build with the assembly implementation

commit 34135cd4128b7d2b288323474a8d05a38022b4fa
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Wed Jan 4 12:02:36 2017 +0200

    rijndael-ssse3: fix counter operand from read-only to read/write
    
    * cipher/rijndael-ssse3-amd64.c (_gcry_aes_ssse3_ctr_enc): Change
    'ctrlow' operand from read-only to read-write.
    --
    
    With read-only operand, compiler is allowed to pass temporary
    register to assembly block and throw away any calculation that
    have been done on that register. On the other hand, compiler is
    also allowed to keep operand value permanently in one register
    as value is treated as read-only, and effectly operates as
    expected. Selection between these two depends on compiler
    version and used flags.
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>
    (cherry picked from commit aada604594fd42224d366d3cb98f67fd3b989cd6)

diff --git a/cipher/rijndael-ssse3-amd64.c b/cipher/rijndael-ssse3-amd64.c
index 937d868..e2ee0c9 100644
--- a/cipher/rijndael-ssse3-amd64.c
+++ b/cipher/rijndael-ssse3-amd64.c
@@ -387,8 +387,8 @@ _gcry_aes_ssse3_ctr_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
                     ".Lno_carry%=:\n\t"
 
                     "pshufb %%xmm6, %%xmm7\n\t"
-                    :
-                    : [ctr] "r" (ctr), [ctrlow] "r" (ctrlow)
+                    : [ctrlow] "+r" (ctrlow)
+                    : [ctr] "r" (ctr)
                     : "cc", "memory");
 
       do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);

-----------------------------------------------------------------------

Summary of changes:
 cipher/Makefile.am                |   3 +-
 cipher/rijndael-ssse3-amd64-asm.S | 853 +++++++++++++++++++++++++++++++++
 cipher/rijndael-ssse3-amd64.c     | 977 ++++----------------------------------
 configure.ac                      |   1 +
 mpi/amd64/mpih-rshift.S           |   2 +-
 5 files changed, 962 insertions(+), 874 deletions(-)
 create mode 100644 cipher/rijndael-ssse3-amd64-asm.S


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 18 12:36:18 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 18 Jan 2017 12:36:18 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 9336aa31498081afa75da95e9d6794403c6dd151
Message-ID: <E1cToXM-0002ZY-IX@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  9336aa31498081afa75da95e9d6794403c6dd151 (commit)
       via  4df7c271f267961c44940c66374e93213795ab17 (commit)
      from  78016c09edb65207946c75d57de5da3e381fe807 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9336aa31498081afa75da95e9d6794403c6dd151
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 18 12:35:56 2017 +0100

    jenkins: disable ntbtls for now

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index 48cd353..dc31e11 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -102,6 +102,9 @@ case "$JOB_NAME" in
 	    CONFIGUREFLAGS="$CONFIGUREFLAGS --with-libiconv-prefix=/usr/local --with-bzip2=/usr/local"
 	fi
 
+	# Disable NTBTLS for now until it is actually mature and used.
+	CONFIGUREFLAGS="$CONFIGUREFLAGS --disable-ntbtls"
+
 	# The libraries use rpath when linking the tests, so they
 	# locate their dependencies that way.  GnuPG, however, does
 	# not.  Therefore, we set LD_LIBRARY_PATH.

commit 4df7c271f267961c44940c66374e93213795ab17
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 18 12:33:30 2017 +0100

    jenkins: tweak openbsd configuration

diff --git a/misc/jenkins/README.org b/misc/jenkins/README.org
index 0fe24c7..4862601 100644
--- a/misc/jenkins/README.org
+++ b/misc/jenkins/README.org
@@ -23,3 +23,12 @@ Add some compatibility links to PATH:
   $ cd compat
   $ ln -s /usr/local/bin/gmakeinfo makeinfo
   $ [ add $HOME/compat to ~/.profile ]
+
+Tweak limits:
+
+  # echo 'jenkins:\
+        :maxproc-max=1024:\
+        :maxproc-cur=1024:\
+        :tc=pbuild:
+' >> /etc/login.conf
+  # user mod -L jenkins jenkins
diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index cc15bf4..48cd353 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -99,7 +99,7 @@ case "$JOB_NAME" in
 	    CONFIGUREFLAGS="$CONFIGUREFLAGS --with-libiconv-prefix=$HOME/pkg"
 	fi
 	if [ "$NODE_NAME" = openbsd60 ]; then
-	    CONFIGUREFLAGS="$CONFIGUREFLAGS --with-libiconv-prefix=/usr/local"
+	    CONFIGUREFLAGS="$CONFIGUREFLAGS --with-libiconv-prefix=/usr/local --with-bzip2=/usr/local"
 	fi
 
 	# The libraries use rpath when linking the tests, so they

-----------------------------------------------------------------------

Summary of changes:
 misc/jenkins/README.org     | 9 +++++++++
 misc/jenkins/bin/build.bash | 5 ++++-
 2 files changed, 13 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 18 15:24:41 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 18 Jan 2017 15:24:41 +0100
Subject: [git] GCRYPT - branch, LIBGCRYPT-1-7-BRANCH,
 updated. libgcrypt-1.7.5-8-g3d86d5b
Message-ID: <E1cTrAJ-0001J1-Lr@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, LIBGCRYPT-1-7-BRANCH has been updated
       via  3d86d5b1881295f82c852daedea24bc43abd449b (commit)
       via  64e4808c05894b623f06c526a37ae2b77c31e36d (commit)
       via  5053e0112ee3ef757a3a4ae26eed117dd1fb0211 (commit)
      from  1817c9eab5699c097d3713f197e4a3e8b5c1442c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3d86d5b1881295f82c852daedea24bc43abd449b
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 18 15:18:38 2017 +0100

    Post release updates
    
    --

diff --git a/NEWS b/NEWS
index 6775190..305fb99 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,7 @@
+Noteworthy changes in version 1.7.7 (unreleased)  [C21/A1/R_]
+------------------------------------------------
+
+
 Noteworthy changes in version 1.7.6 (2017-01-18)  [C21/A1/R6]
 ------------------------------------------------
 
diff --git a/configure.ac b/configure.ac
index 487a1bc..b285455 100644
--- a/configure.ac
+++ b/configure.ac
@@ -30,7 +30,7 @@ min_automake_version="1.14"
 # for the LT versions.
 m4_define(mym4_version_major, [1])
 m4_define(mym4_version_minor, [7])
-m4_define(mym4_version_micro, [6])
+m4_define(mym4_version_micro, [7])
 
 # Below is m4 magic to extract and compute the revision number, the
 # decimalized short revision number, a beta version string, and a flag

commit 64e4808c05894b623f06c526a37ae2b77c31e36d
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 18 12:37:26 2017 +0100

    Release 1.7.6.
    
    * configure.ac: Set LT version to C21/A1/R6.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/AUTHORS b/AUTHORS
index 25de16c..82f82e2 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -30,11 +30,11 @@ List of Copyright holders
   Copyright (C) 1996-2006 Peter Gutmann, Matt Thomlinson and Blake Coverett
   Copyright (C) 2003 Nikos Mavroyanopoulos
   Copyright (C) 2006-2007 NTT (Nippon Telegraph and Telephone Corporation)
-  Copyright (C) 2012-2016 g10 Code GmbH
+  Copyright (C) 2012-2017 g10 Code GmbH
   Copyright (C) 2012 Simon Josefsson, Niels M?ller
   Copyright (c) 2012 Intel Corporation
   Copyright (C) 2013 Christian Grothoff
-  Copyright (C) 2013-2016 Jussi Kivilinna
+  Copyright (C) 2013-2017 Jussi Kivilinna
   Copyright (C) 2013-2014 Dmitry Eremin-Solenikov
   Copyright (C) 2014 Stephan Mueller
 
diff --git a/NEWS b/NEWS
index ccb04f5..6775190 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,13 @@
-Noteworthy changes in version 1.7.6 (unreleased)  [C21/A1/R_]
+Noteworthy changes in version 1.7.6 (2017-01-18)  [C21/A1/R6]
 ------------------------------------------------
 
+ * Bug fixes:
+
+   - Fix AES CTR self-check detected failure in the SSSE3 based
+     implementation.
+
+   - Remove gratuitous select before the getrandom syscall.
+
 
 Noteworthy changes in version 1.7.5 (2016-12-15)  [C21/A1/R5]
 ------------------------------------------------
diff --git a/README b/README
index 1148a24..7c08a5b 100644
--- a/README
+++ b/README
@@ -3,8 +3,8 @@
                              Version 1.7
 
        Copyright (C) 1989,1991-2016 Free Software Foundation, Inc.
-       Copyright (C) 2012-2016 g10 Code GmbH
-       Copyright (C) 2013-2016 Jussi Kivilinna
+       Copyright (C) 2012-2017 g10 Code GmbH
+       Copyright (C) 2013-2017 Jussi Kivilinna
 
     Libgcrypt is free software.  See the file AUTHORS for full copying
     notices, and LICENSES for notices about contributions that require
diff --git a/compat/compat.c b/compat/compat.c
index 96b3e2e..1bf0682 100644
--- a/compat/compat.c
+++ b/compat/compat.c
@@ -31,8 +31,8 @@ _gcry_compat_identification (void)
     "\n\n"
     "This is Libgcrypt " PACKAGE_VERSION " - The GNU Crypto Library\n"
     "Copyright (C) 2000-2016 Free Software Foundation, Inc.\n"
-    "Copyright (C) 2012-2016 g10 Code GmbH\n"
-    "Copyright (C) 2013-2016 Jussi Kivilinna\n"
+    "Copyright (C) 2012-2017 g10 Code GmbH\n"
+    "Copyright (C) 2013-2017 Jussi Kivilinna\n"
     "\n"
     "(" BUILD_REVISION " " BUILD_TIMESTAMP ")\n"
     "\n\n";
diff --git a/configure.ac b/configure.ac
index 7dfbd60..487a1bc 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,7 +1,7 @@
 # Configure.ac script for Libgcrypt
 # Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2006,
 #               2007, 2008, 2009, 2011 Free Software Foundation, Inc.
-# Copyright (C) 2012, 2013, 2014, 2015, 2016  g10 Code GmbH
+# Copyright (C) 2012, 2013, 2014, 2015, 2016, 2017  g10 Code GmbH
 #
 # This file is part of Libgcrypt.
 #
@@ -56,7 +56,7 @@ AC_INIT([libgcrypt],[mym4_full_version],[http://bugs.gnupg.org])
 #   (No interfaces changed:                   REVISION++)
 LIBGCRYPT_LT_CURRENT=21
 LIBGCRYPT_LT_AGE=1
-LIBGCRYPT_LT_REVISION=5
+LIBGCRYPT_LT_REVISION=6
 
 
 # If the API is changed in an incompatible way: increment the next counter.

commit 5053e0112ee3ef757a3a4ae26eed117dd1fb0211
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jan 18 12:35:27 2017 +0100

    Revert "rijndael-ssse3: move assembly functions to separate source-file"
    
    This reverts commit a77c36921bde79418cdf6d7a7543514c39c9796c.

diff --git a/cipher/Makefile.am b/cipher/Makefile.am
index e4a6be1..ac0ec58 100644
--- a/cipher/Makefile.am
+++ b/cipher/Makefile.am
@@ -80,8 +80,7 @@ md4.c \
 md5.c \
 poly1305-sse2-amd64.S poly1305-avx2-amd64.S poly1305-armv7-neon.S \
 rijndael.c rijndael-internal.h rijndael-tables.h rijndael-aesni.c \
-  rijndael-padlock.c rijndael-amd64.S rijndael-arm.S \
-  rijndael-ssse3-amd64.c rijndael-ssse3-amd64-asm.S \
+  rijndael-padlock.c rijndael-amd64.S rijndael-arm.S rijndael-ssse3-amd64.c \
   rijndael-armv8-ce.c rijndael-armv8-aarch32-ce.S rijndael-armv8-aarch64-ce.S \
   rijndael-aarch64.S \
 rmd160.c \
diff --git a/cipher/rijndael-ssse3-amd64-asm.S b/cipher/rijndael-ssse3-amd64-asm.S
deleted file mode 100644
index 3ae55e8..0000000
--- a/cipher/rijndael-ssse3-amd64-asm.S
+++ /dev/null
@@ -1,853 +0,0 @@
-/* SSSE3 vector permutation AES for Libgcrypt
- * Copyright (C) 2014-2017 Jussi Kivilinna <jussi.kivilinna at iki.fi>
- *
- * This file is part of Libgcrypt.
- *
- * Libgcrypt is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as
- * published by the Free Software Foundation; either version 2.1 of
- * the License, or (at your option) any later version.
- *
- * Libgcrypt is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this program; if not, see <http://www.gnu.org/licenses/>.
- *
- *
- * The code is based on the public domain library libvpaes version 0.5
- * available at http://crypto.stanford.edu/vpaes/ and which carries
- * this notice:
- *
- *     libvpaes: constant-time SSSE3 AES encryption and decryption.
- *     version 0.5
- *
- *     By Mike Hamburg, Stanford University, 2009.  Public domain.
- *     I wrote essentially all of this code.  I did not write the test
- *     vectors; they are the NIST known answer tests.  I hereby release all
- *     the code and documentation here that I wrote into the public domain.
- *
- *     This is an implementation of AES following my paper,
- *       "Accelerating AES with Vector Permute Instructions
- *       CHES 2009; http://shiftleft.org/papers/vector_aes/
- */
-
-#if defined(__x86_64__)
-#include <config.h>
-#if defined(HAVE_GCC_INLINE_ASM_SSSE3) && \
-    (defined(HAVE_COMPATIBLE_GCC_AMD64_PLATFORM_AS) || \
-     defined(HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS))
-
-#ifdef HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS
-# define ELF(...)
-#else
-# define ELF(...) __VA_ARGS__
-#endif
-
-.text
-
-##
-##  _gcry_aes_ssse3_enc_preload
-##
-ELF(.type _gcry_aes_ssse3_enc_preload, at function)
-.globl _gcry_aes_ssse3_enc_preload
-_gcry_aes_ssse3_enc_preload:
-	lea	.Laes_consts(%rip), %rax
-	movdqa	          (%rax), %xmm9  # 0F
-	movdqa	.Lk_inv   (%rax), %xmm10 # inv
-	movdqa	.Lk_inv+16(%rax), %xmm11 # inva
-	movdqa	.Lk_sb1   (%rax), %xmm13 # sb1u
-	movdqa	.Lk_sb1+16(%rax), %xmm12 # sb1t
-	movdqa	.Lk_sb2   (%rax), %xmm15 # sb2u
-	movdqa	.Lk_sb2+16(%rax), %xmm14 # sb2t
-	ret
-ELF(.size _gcry_aes_ssse3_enc_preload,.-_gcry_aes_ssse3_enc_preload)
-
-##
-##  _gcry_aes_ssse3_dec_preload
-##
-ELF(.type _gcry_aes_ssse3_dec_preload, at function)
-.globl _gcry_aes_ssse3_dec_preload
-_gcry_aes_ssse3_dec_preload:
-	lea	.Laes_consts(%rip), %rax
-	movdqa	          (%rax), %xmm9   # 0F
-	movdqa	.Lk_inv   (%rax), %xmm10  # inv
-	movdqa	.Lk_inv+16(%rax), %xmm11  # inva
-	movdqa	.Lk_dsb9   (%rax), %xmm13 # sb9u
-	movdqa	.Lk_dsb9+16(%rax), %xmm12 # sb9t
-	movdqa	.Lk_dsbd   (%rax), %xmm15 # sbdu
-	movdqa	.Lk_dsbb   (%rax), %xmm14 # sbbu
-	movdqa	.Lk_dsbe   (%rax), %xmm8  # sbeu
-	ret
-ELF(.size _gcry_aes_ssse3_dec_preload,.-_gcry_aes_ssse3_dec_preload)
-
-##
-## Constant-time SSSE3 AES core implementation.
-##
-## By Mike Hamburg (Stanford University), 2009
-## Public domain.
-##
-
-##
-##  _aes_encrypt_core
-##
-##  AES-encrypt %xmm0.
-##
-##  Inputs:
-##     %xmm0 = input
-##     %xmm9-%xmm15 as in .Laes_preheat
-##    (%rdx) = scheduled keys
-##     %rax  = nrounds - 1
-##
-##  Output in %xmm0
-##  Clobbers  %xmm1-%xmm4, %r9, %r11, %rax, %rcx
-##  Preserves %xmm6 - %xmm7 so you get some local vectors
-##
-##
-.align 16
-ELF(.type _gcry_aes_ssse3_encrypt_core, at function)
-.globl _gcry_aes_ssse3_encrypt_core
-_gcry_aes_ssse3_encrypt_core:
-_aes_encrypt_core:
-	lea	.Laes_consts(%rip), %rcx
-	leaq	.Lk_mc_backward(%rcx), %rdi
-	mov	$16,	%rsi
-	movdqa	.Lk_ipt   (%rcx), %xmm2 # iptlo
-	movdqa	%xmm9,	%xmm1
-	pandn	%xmm0,	%xmm1
-	psrld	$4,	%xmm1
-	pand	%xmm9,	%xmm0
-	pshufb	%xmm0,	%xmm2
-	movdqa	.Lk_ipt+16(%rcx), %xmm0 # ipthi
-	pshufb	%xmm1,	%xmm0
-	pxor	(%rdx),%xmm2
-	pxor	%xmm2,	%xmm0
-	add	$16,	%rdx
-	jmp	.Laes_entry
-
-.align 8
-.Laes_loop:
-	# middle of middle round
-	movdqa  %xmm13,	%xmm4	# 4 : sb1u
-	pshufb  %xmm2,	%xmm4   # 4 = sb1u
-	pxor	(%rdx),	%xmm4	# 4 = sb1u + k
-	movdqa  %xmm12,	%xmm0	# 0 : sb1t
-	pshufb  %xmm3,	%xmm0	# 0 = sb1t
-	pxor	%xmm4,	%xmm0	# 0 = A
-	movdqa  %xmm15,	%xmm4	# 4 : sb2u
-	pshufb	%xmm2,	%xmm4	# 4 = sb2u
-	movdqa	.Lk_mc_forward-.Lk_mc_backward(%rsi,%rdi), %xmm1
-	movdqa	%xmm14, %xmm2	# 2 : sb2t
-	pshufb	%xmm3,  %xmm2	# 2 = sb2t
-	pxor	%xmm4,  %xmm2	# 2 = 2A
-	movdqa	%xmm0,  %xmm3	# 3 = A
-	pshufb  %xmm1,  %xmm0	# 0 = B
-	pxor	%xmm2,  %xmm0	# 0 = 2A+B
-	pshufb	(%rsi,%rdi), %xmm3  # 3 = D
-	lea	16(%esi),%esi	# next mc
-	pxor	%xmm0,	%xmm3	# 3 = 2A+B+D
-	lea	16(%rdx),%rdx	# next key
-	pshufb  %xmm1,	%xmm0	# 0 = 2B+C
-	pxor	%xmm3,	%xmm0	# 0 = 2A+3B+C+D
-	and	$48, %rsi	# ... mod 4
-	dec	%rax		# nr--
-
-.Laes_entry:
-	# top of round
-	movdqa  %xmm9, 	%xmm1	# 1 : i
-	pandn	%xmm0, 	%xmm1	# 1 = i<<4
-	psrld	$4,    	%xmm1   # 1 = i
-	pand	%xmm9, 	%xmm0   # 0 = k
-	movdqa	%xmm11, %xmm2	# 2 : a/k
-	pshufb  %xmm0,  %xmm2	# 2 = a/k
-	pxor	%xmm1,	%xmm0	# 0 = j
-	movdqa  %xmm10,	%xmm3  	# 3 : 1/i
-	pshufb  %xmm1, 	%xmm3  	# 3 = 1/i
-	pxor	%xmm2, 	%xmm3  	# 3 = iak = 1/i + a/k
-	movdqa	%xmm10,	%xmm4  	# 4 : 1/j
-	pshufb	%xmm0, 	%xmm4  	# 4 = 1/j
-	pxor	%xmm2, 	%xmm4  	# 4 = jak = 1/j + a/k
-	movdqa  %xmm10,	%xmm2  	# 2 : 1/iak
-	pshufb  %xmm3,	%xmm2  	# 2 = 1/iak
-	pxor	%xmm0, 	%xmm2  	# 2 = io
-	movdqa  %xmm10, %xmm3   # 3 : 1/jak
-	pshufb  %xmm4,  %xmm3   # 3 = 1/jak
-	pxor	%xmm1,  %xmm3   # 3 = jo
-	jnz	.Laes_loop
-
-	# middle of last round
-	movdqa	.Lk_sbo(%rcx), %xmm4	# 3 : sbou
-	pshufb  %xmm2,  %xmm4   # 4 = sbou
-	pxor	(%rdx), %xmm4   # 4 = sb1u + k
-	movdqa	.Lk_sbo+16(%rcx), %xmm0	# 0 : sbot
-	pshufb  %xmm3,	%xmm0	# 0 = sb1t
-	pxor	%xmm4,	%xmm0	# 0 = A
-	pshufb	.Lk_sr(%rsi,%rcx), %xmm0
-	ret
-ELF(.size _aes_encrypt_core,.-_aes_encrypt_core)
-
-##
-##  Decryption core
-##
-##  Same API as encryption core.
-##
-.align 16
-.globl _gcry_aes_ssse3_decrypt_core
-ELF(.type _gcry_aes_ssse3_decrypt_core, at function)
-_gcry_aes_ssse3_decrypt_core:
-_aes_decrypt_core:
-	lea	.Laes_consts(%rip), %rcx
-	movl	%eax,	%esi
-	shll	$4,	%esi
-	xorl	$48,	%esi
-	andl	$48,	%esi
-	movdqa	.Lk_dipt   (%rcx), %xmm2 # iptlo
-	movdqa	%xmm9,	%xmm1
-	pandn	%xmm0,	%xmm1
-	psrld	$4,	%xmm1
-	pand	%xmm9,	%xmm0
-	pshufb	%xmm0,	%xmm2
-	movdqa	.Lk_dipt+16(%rcx), %xmm0 # ipthi
-	pshufb	%xmm1,	%xmm0
-	pxor	(%rdx),	%xmm2
-	pxor	%xmm2,	%xmm0
-	movdqa	.Lk_mc_forward+48(%rcx), %xmm5
-	lea	16(%rdx), %rdx
-	neg	%rax
-	jmp	.Laes_dec_entry
-
-.align 16
-.Laes_dec_loop:
-##
-##  Inverse mix columns
-##
-	movdqa  %xmm13,	%xmm4		# 4 : sb9u
-	pshufb	%xmm2,	%xmm4		# 4 = sb9u
-	pxor	(%rdx),	%xmm4
-	movdqa  %xmm12,	%xmm0		# 0 : sb9t
-	pshufb	%xmm3,	%xmm0		# 0 = sb9t
-	movdqa  .Lk_dsbd+16(%rcx),%xmm1	# 1 : sbdt
-	pxor	%xmm4,	%xmm0		# 0 = ch
-	lea	16(%rdx), %rdx		# next round key
-
-	pshufb	%xmm5,	%xmm0		# MC ch
-	movdqa  %xmm15,	%xmm4		# 4 : sbdu
-	pshufb	%xmm2,	%xmm4		# 4 = sbdu
-	pxor	%xmm0,	%xmm4		# 4 = ch
-	pshufb	%xmm3,	%xmm1		# 1 = sbdt
-	pxor	%xmm4,	%xmm1		# 1 = ch
-
-	pshufb	%xmm5,	%xmm1		# MC ch
-	movdqa  %xmm14,	%xmm4		# 4 : sbbu
-	pshufb	%xmm2,	%xmm4		# 4 = sbbu
-	inc     %rax                    # nr--
-	pxor	%xmm1,	%xmm4		# 4 = ch
-	movdqa  .Lk_dsbb+16(%rcx),%xmm0	# 0 : sbbt
-	pshufb	%xmm3,	%xmm0		# 0 = sbbt
-	pxor	%xmm4,	%xmm0		# 0 = ch
-
-	pshufb	%xmm5,	%xmm0		# MC ch
-	movdqa  %xmm8,	%xmm4		# 4 : sbeu
-	pshufb	%xmm2,	%xmm4		# 4 = sbeu
-	pshufd	$0x93,	%xmm5,	%xmm5
-	pxor	%xmm0,	%xmm4		# 4 = ch
-	movdqa  .Lk_dsbe+16(%rcx),%xmm0	# 0 : sbet
-	pshufb	%xmm3,	%xmm0		# 0 = sbet
-	pxor	%xmm4,	%xmm0		# 0 = ch
-
-.Laes_dec_entry:
-	# top of round
-	movdqa  %xmm9, 	%xmm1	# 1 : i
-	pandn	%xmm0, 	%xmm1	# 1 = i<<4
-	psrld	$4,    	%xmm1   # 1 = i
-	pand	%xmm9, 	%xmm0   # 0 = k
-	movdqa	%xmm11, %xmm2	# 2 : a/k
-	pshufb  %xmm0,  %xmm2	# 2 = a/k
-	pxor	%xmm1,	%xmm0	# 0 = j
-	movdqa  %xmm10,	%xmm3  	# 3 : 1/i
-	pshufb  %xmm1, 	%xmm3  	# 3 = 1/i
-	pxor	%xmm2, 	%xmm3  	# 3 = iak = 1/i + a/k
-	movdqa	%xmm10,	%xmm4  	# 4 : 1/j
-	pshufb	%xmm0, 	%xmm4  	# 4 = 1/j
-	pxor	%xmm2, 	%xmm4  	# 4 = jak = 1/j + a/k
-	movdqa  %xmm10,	%xmm2  	# 2 : 1/iak
-	pshufb  %xmm3,	%xmm2  	# 2 = 1/iak
-	pxor	%xmm0, 	%xmm2  	# 2 = io
-	movdqa  %xmm10, %xmm3   # 3 : 1/jak
-	pshufb  %xmm4,  %xmm3   # 3 = 1/jak
-	pxor	%xmm1,  %xmm3   # 3 = jo
-	jnz	.Laes_dec_loop
-
-	# middle of last round
-	movdqa	.Lk_dsbo(%rcx), %xmm4		# 3 : sbou
-	pshufb  %xmm2,  %xmm4   # 4 = sbou
-	pxor	(%rdx), %xmm4   # 4 = sb1u + k
-	movdqa	.Lk_dsbo+16(%rcx), %xmm0	# 0 : sbot
-	pshufb  %xmm3,	%xmm0	# 0 = sb1t
-	pxor	%xmm4,	%xmm0	# 0 = A
-	pshufb	.Lk_sr(%rsi,%rcx), %xmm0
-	ret
-ELF(.size _aes_decrypt_core,.-_aes_decrypt_core)
-
-########################################################
-##                                                    ##
-##                  AES key schedule                  ##
-##                                                    ##
-########################################################
-
-.align 16
-.globl _gcry_aes_ssse3_schedule_core
-ELF(.type _gcry_aes_ssse3_schedule_core, at function)
-_gcry_aes_ssse3_schedule_core:
-_aes_schedule_core:
-	# rdi = key
-	# rsi = size in bits
-	# rdx = buffer
-	# rcx = direction.  0=encrypt, 1=decrypt
-
-	# load the tables
-	lea	.Laes_consts(%rip), %r10
-	movdqa	          (%r10), %xmm9  # 0F
-	movdqa	.Lk_inv   (%r10), %xmm10 # inv
-	movdqa	.Lk_inv+16(%r10), %xmm11 # inva
-	movdqa	.Lk_sb1   (%r10), %xmm13 # sb1u
-	movdqa	.Lk_sb1+16(%r10), %xmm12 # sb1t
-	movdqa	.Lk_sb2   (%r10), %xmm15 # sb2u
-	movdqa	.Lk_sb2+16(%r10), %xmm14 # sb2t
-
-	movdqa	.Lk_rcon(%r10), %xmm8	# load rcon
-	movdqu	(%rdi),	%xmm0		# load key (unaligned)
-
-	# input transform
-	movdqu	%xmm0,	%xmm3
-	lea	.Lk_ipt(%r10), %r11
-	call	.Laes_schedule_transform
-	movdqu	%xmm0,	%xmm7
-
-	test	%rcx,	%rcx
-	jnz	.Laes_schedule_am_decrypting
-
-	# encrypting, output zeroth round key after transform
-	movdqa	%xmm0,	(%rdx)
-	jmp	.Laes_schedule_go
-
-.Laes_schedule_am_decrypting:
-	# decrypting, output zeroth round key after shiftrows
-	pshufb  .Lk_sr(%r8,%r10),%xmm3
-	movdqa	%xmm3,	(%rdx)
-	xor	$48, 	%r8
-
-.Laes_schedule_go:
-	cmp	$192,	%rsi
-	je	.Laes_schedule_192
-	cmp	$256,	%rsi
-	je	.Laes_schedule_256
-	# 128: fall though
-
-##
-##  .Laes_schedule_128
-##
-##  128-bit specific part of key schedule.
-##
-##  This schedule is really simple, because all its parts
-##  are accomplished by the subroutines.
-##
-.Laes_schedule_128:
-	mov	$10, %rsi
-
-.Laes_schedule_128_L:
-	call 	.Laes_schedule_round
-	dec	%rsi
-	jz 	.Laes_schedule_mangle_last
-	call	.Laes_schedule_mangle	# write output
-	jmp 	.Laes_schedule_128_L
-
-##
-##  .Laes_schedule_192
-##
-##  192-bit specific part of key schedule.
-##
-##  The main body of this schedule is the same as the 128-bit
-##  schedule, but with more smearing.  The long, high side is
-##  stored in %xmm7 as before, and the short, low side is in
-##  the high bits of %xmm6.
-##
-##  This schedule is somewhat nastier, however, because each
-##  round produces 192 bits of key material, or 1.5 round keys.
-##  Therefore, on each cycle we do 2 rounds and produce 3 round
-##  keys.
-##
-.Laes_schedule_192:
-	movdqu	8(%rdi),%xmm0		# load key part 2 (very unaligned)
-	call	.Laes_schedule_transform	# input transform
-	pshufd	$0x0E,	%xmm0,	%xmm6
-	pslldq	$8,	%xmm6		# clobber low side with zeros
-	mov	$4,	%rsi
-
-.Laes_schedule_192_L:
-	call	.Laes_schedule_round
-	palignr	$8,%xmm6,%xmm0
-	call	.Laes_schedule_mangle	# save key n
-	call	.Laes_schedule_192_smear
-	call	.Laes_schedule_mangle	# save key n+1
-	call	.Laes_schedule_round
-	dec	%rsi
-	jz 	.Laes_schedule_mangle_last
-	call	.Laes_schedule_mangle	# save key n+2
-	call	.Laes_schedule_192_smear
-	jmp	.Laes_schedule_192_L
-
-##
-##  .Laes_schedule_192_smear
-##
-##  Smear the short, low side in the 192-bit key schedule.
-##
-##  Inputs:
-##    %xmm7: high side, b  a  x  y
-##    %xmm6:  low side, d  c  0  0
-##    %xmm13: 0
-##
-##  Outputs:
-##    %xmm6: b+c+d  b+c  0  0
-##    %xmm0: b+c+d  b+c  b  a
-##
-.Laes_schedule_192_smear:
-	pshufd	$0x80,	%xmm6,	%xmm0	# d c 0 0 -> c 0 0 0
-	pxor	%xmm0,	%xmm6		# -> c+d c 0 0
-	pshufd	$0xFE,	%xmm7,	%xmm0	# b a _ _ -> b b b a
-	pxor	%xmm6,	%xmm0		# -> b+c+d b+c b a
-	pshufd	$0x0E,	%xmm0,	%xmm6
-	pslldq	$8,	%xmm6		# clobber low side with zeros
-	ret
-
-##
-##  .Laes_schedule_256
-##
-##  256-bit specific part of key schedule.
-##
-##  The structure here is very similar to the 128-bit
-##  schedule, but with an additional 'low side' in
-##  %xmm6.  The low side's rounds are the same as the
-##  high side's, except no rcon and no rotation.
-##
-.Laes_schedule_256:
-	movdqu	16(%rdi),%xmm0		# load key part 2 (unaligned)
-	call	.Laes_schedule_transform	# input transform
-	mov	$7, %rsi
-
-.Laes_schedule_256_L:
-	call	.Laes_schedule_mangle	# output low result
-	movdqa	%xmm0,	%xmm6		# save cur_lo in xmm6
-
-	# high round
-	call	.Laes_schedule_round
-	dec	%rsi
-	jz 	.Laes_schedule_mangle_last
-	call	.Laes_schedule_mangle
-
-	# low round. swap xmm7 and xmm6
-	pshufd	$0xFF,	%xmm0,	%xmm0
-	movdqa	%xmm7,	%xmm5
-	movdqa	%xmm6,	%xmm7
-	call	.Laes_schedule_low_round
-	movdqa	%xmm5,	%xmm7
-
-	jmp	.Laes_schedule_256_L
-
-##
-##  .Laes_schedule_round
-##
-##  Runs one main round of the key schedule on %xmm0, %xmm7
-##
-##  Specifically, runs subbytes on the high dword of %xmm0
-##  then rotates it by one byte and xors into the low dword of
-##  %xmm7.
-##
-##  Adds rcon from low byte of %xmm8, then rotates %xmm8 for
-##  next rcon.
-##
-##  Smears the dwords of %xmm7 by xoring the low into the
-##  second low, result into third, result into highest.
-##
-##  Returns results in %xmm7 = %xmm0.
-##  Clobbers %xmm1-%xmm4, %r11.
-##
-.Laes_schedule_round:
-	# extract rcon from xmm8
-	pxor	%xmm1,	%xmm1
-	palignr	$15,	%xmm8,	%xmm1
-	palignr	$15,	%xmm8,	%xmm8
-	pxor	%xmm1,	%xmm7
-
-	# rotate
-	pshufd	$0xFF,	%xmm0,	%xmm0
-	palignr	$1,	%xmm0,	%xmm0
-
-	# fall through...
-
-	# low round: same as high round, but no rotation and no rcon.
-.Laes_schedule_low_round:
-	# smear xmm7
-	movdqa	%xmm7,	%xmm1
-	pslldq	$4,	%xmm7
-	pxor	%xmm1,	%xmm7
-	movdqa	%xmm7,	%xmm1
-	pslldq	$8,	%xmm7
-	pxor	%xmm1,	%xmm7
-	pxor	.Lk_s63(%r10), %xmm7
-
-	# subbytes
-	movdqa  %xmm9, 	%xmm1
-	pandn	%xmm0, 	%xmm1
-	psrld	$4,    	%xmm1		# 1 = i
-	pand	%xmm9, 	%xmm0		# 0 = k
-	movdqa	%xmm11, %xmm2		# 2 : a/k
-	pshufb  %xmm0,  %xmm2		# 2 = a/k
-	pxor	%xmm1,	%xmm0		# 0 = j
-	movdqa  %xmm10,	%xmm3		# 3 : 1/i
-	pshufb  %xmm1, 	%xmm3		# 3 = 1/i
-	pxor	%xmm2, 	%xmm3		# 3 = iak = 1/i + a/k
-	movdqa	%xmm10,	%xmm4		# 4 : 1/j
-	pshufb	%xmm0, 	%xmm4		# 4 = 1/j
-	pxor	%xmm2, 	%xmm4		# 4 = jak = 1/j + a/k
-	movdqa  %xmm10,	%xmm2		# 2 : 1/iak
-	pshufb  %xmm3,	%xmm2		# 2 = 1/iak
-	pxor	%xmm0, 	%xmm2		# 2 = io
-	movdqa  %xmm10, %xmm3		# 3 : 1/jak
-	pshufb  %xmm4,  %xmm3		# 3 = 1/jak
-	pxor	%xmm1,  %xmm3		# 3 = jo
-	movdqa	.Lk_sb1(%r10), %xmm4	# 4 : sbou
-	pshufb  %xmm2,  %xmm4		# 4 = sbou
-	movdqa	.Lk_sb1+16(%r10), %xmm0	# 0 : sbot
-	pshufb  %xmm3,	%xmm0		# 0 = sb1t
-	pxor	%xmm4, 	%xmm0		# 0 = sbox output
-
-	# add in smeared stuff
-	pxor	%xmm7,	%xmm0
-	movdqa	%xmm0,	%xmm7
-	ret
-
-##
-##  .Laes_schedule_transform
-##
-##  Linear-transform %xmm0 according to tables at (%r11)
-##
-##  Requires that %xmm9 = 0x0F0F... as in preheat
-##  Output in %xmm0
-##  Clobbers %xmm1, %xmm2
-##
-.Laes_schedule_transform:
-	movdqa	%xmm9,	%xmm1
-	pandn	%xmm0,	%xmm1
-	psrld	$4,	%xmm1
-	pand	%xmm9,	%xmm0
-	movdqa	(%r11), %xmm2 	# lo
-	pshufb	%xmm0,	%xmm2
-	movdqa	16(%r11), %xmm0 # hi
-	pshufb	%xmm1,	%xmm0
-	pxor	%xmm2,	%xmm0
-	ret
-
-##
-##  .Laes_schedule_mangle
-##
-##  Mangle xmm0 from (basis-transformed) standard version
-##  to our version.
-##
-##  On encrypt,
-##    xor with 0x63
-##    multiply by circulant 0,1,1,1
-##    apply shiftrows transform
-##
-##  On decrypt,
-##    xor with 0x63
-##    multiply by 'inverse mixcolumns' circulant E,B,D,9
-##    deskew
-##    apply shiftrows transform
-##
-##
-##  Writes out to (%rdx), and increments or decrements it
-##  Keeps track of round number mod 4 in %r8
-##  Preserves xmm0
-##  Clobbers xmm1-xmm5
-##
-.Laes_schedule_mangle:
-	movdqa	%xmm0,	%xmm4	# save xmm0 for later
-	movdqa	.Lk_mc_forward(%r10),%xmm5
-	test	%rcx, 	%rcx
-	jnz	.Laes_schedule_mangle_dec
-
-	# encrypting
-	add	$16,	%rdx
-	pxor	.Lk_s63(%r10),%xmm4
-	pshufb	%xmm5,	%xmm4
-	movdqa	%xmm4,	%xmm3
-	pshufb	%xmm5,	%xmm4
-	pxor	%xmm4,	%xmm3
-	pshufb	%xmm5,	%xmm4
-	pxor	%xmm4,	%xmm3
-
-	jmp	.Laes_schedule_mangle_both
-
-.Laes_schedule_mangle_dec:
-	lea	.Lk_dks_1(%r10), %r11	# first table: *9
-	call 	.Laes_schedule_transform
-	movdqa	%xmm0,	%xmm3
-	pshufb	%xmm5,	%xmm3
-
-	add	$32, 	%r11		# next table:  *B
-	call 	.Laes_schedule_transform
-	pxor	%xmm0,	%xmm3
-	pshufb	%xmm5,	%xmm3
-
-	add	$32, 	%r11		# next table:  *D
-	call 	.Laes_schedule_transform
-	pxor	%xmm0,	%xmm3
-	pshufb	%xmm5,	%xmm3
-
-	add	$32, 	%r11		# next table:  *E
-	call 	.Laes_schedule_transform
-	pxor	%xmm0,	%xmm3
-	pshufb	%xmm5,	%xmm3
-
-	movdqa	%xmm4,	%xmm0		# restore %xmm0
-	add	$-16,	%rdx
-
-.Laes_schedule_mangle_both:
-	pshufb	.Lk_sr(%r8,%r10),%xmm3
-	add	$-16,	%r8
-	and	$48,	%r8
-	movdqa	%xmm3,	(%rdx)
-	ret
-
-##
-##  .Laes_schedule_mangle_last
-##
-##  Mangler for last round of key schedule
-##  Mangles %xmm0
-##    when encrypting, outputs out(%xmm0) ^ 63
-##    when decrypting, outputs unskew(%xmm0)
-##
-##  Always called right before return... jumps to cleanup and exits
-##
-.Laes_schedule_mangle_last:
-	# schedule last round key from xmm0
-	lea	.Lk_deskew(%r10),%r11	# prepare to deskew
-	test	%rcx, 	%rcx
-	jnz	.Laes_schedule_mangle_last_dec
-
-	# encrypting
-	pshufb	.Lk_sr(%r8,%r10),%xmm0	# output permute
-	lea	.Lk_opt(%r10),	%r11	# prepare to output transform
-	add	$32,	%rdx
-
-.Laes_schedule_mangle_last_dec:
-	add	$-16,	%rdx
-	pxor	.Lk_s63(%r10),	%xmm0
-	call	.Laes_schedule_transform # output transform
-	movdqa	%xmm0,	(%rdx)		# save last key
-
-	#_aes_cleanup
-	pxor	%xmm0,  %xmm0
-	pxor	%xmm1,  %xmm1
-	pxor	%xmm2,  %xmm2
-	pxor	%xmm3,  %xmm3
-	pxor	%xmm4,  %xmm4
-	pxor	%xmm5,  %xmm5
-	pxor	%xmm6,  %xmm6
-	pxor	%xmm7,  %xmm7
-	pxor	%xmm8,  %xmm8
-	ret
-ELF(.size _aes_schedule_core,.-_aes_schedule_core)
-
-########################################################
-##                                                    ##
-##                     Constants                      ##
-##                                                    ##
-########################################################
-
-.align 16
-ELF(.type _aes_consts, at object)
-.Laes_consts:
-_aes_consts:
-	# s0F
-	.Lk_s0F = .-.Laes_consts
-	.quad	0x0F0F0F0F0F0F0F0F
-	.quad	0x0F0F0F0F0F0F0F0F
-
-	# input transform (lo, hi)
-	.Lk_ipt = .-.Laes_consts
-	.quad	0xC2B2E8985A2A7000
-	.quad	0xCABAE09052227808
-	.quad	0x4C01307D317C4D00
-	.quad	0xCD80B1FCB0FDCC81
-
-	# inv, inva
-	.Lk_inv = .-.Laes_consts
-	.quad	0x0E05060F0D080180
-	.quad	0x040703090A0B0C02
-	.quad	0x01040A060F0B0780
-	.quad	0x030D0E0C02050809
-
-	# sb1u, sb1t
-	.Lk_sb1 = .-.Laes_consts
-	.quad	0xB19BE18FCB503E00
-	.quad	0xA5DF7A6E142AF544
-	.quad	0x3618D415FAE22300
-	.quad	0x3BF7CCC10D2ED9EF
-
-
-	# sb2u, sb2t
-	.Lk_sb2 = .-.Laes_consts
-	.quad	0xE27A93C60B712400
-	.quad	0x5EB7E955BC982FCD
-	.quad	0x69EB88400AE12900
-	.quad	0xC2A163C8AB82234A
-
-	# sbou, sbot
-	.Lk_sbo = .-.Laes_consts
-	.quad	0xD0D26D176FBDC700
-	.quad	0x15AABF7AC502A878
-	.quad	0xCFE474A55FBB6A00
-	.quad	0x8E1E90D1412B35FA
-
-	# mc_forward
-	.Lk_mc_forward = .-.Laes_consts
-	.quad	0x0407060500030201
-	.quad	0x0C0F0E0D080B0A09
-	.quad	0x080B0A0904070605
-	.quad	0x000302010C0F0E0D
-	.quad	0x0C0F0E0D080B0A09
-	.quad	0x0407060500030201
-	.quad	0x000302010C0F0E0D
-	.quad	0x080B0A0904070605
-
-	# mc_backward
-	.Lk_mc_backward = .-.Laes_consts
-	.quad	0x0605040702010003
-	.quad	0x0E0D0C0F0A09080B
-	.quad	0x020100030E0D0C0F
-	.quad	0x0A09080B06050407
-	.quad	0x0E0D0C0F0A09080B
-	.quad	0x0605040702010003
-	.quad	0x0A09080B06050407
-	.quad	0x020100030E0D0C0F
-
-	# sr
-	.Lk_sr = .-.Laes_consts
-	.quad	0x0706050403020100
-	.quad	0x0F0E0D0C0B0A0908
-	.quad	0x030E09040F0A0500
-	.quad	0x0B06010C07020D08
-	.quad	0x0F060D040B020900
-	.quad	0x070E050C030A0108
-	.quad	0x0B0E0104070A0D00
-	.quad	0x0306090C0F020508
-
-	# rcon
-	.Lk_rcon = .-.Laes_consts
-	.quad	0x1F8391B9AF9DEEB6
-	.quad	0x702A98084D7C7D81
-
-	# s63: all equal to 0x63 transformed
-	.Lk_s63 = .-.Laes_consts
-	.quad	0x5B5B5B5B5B5B5B5B
-	.quad	0x5B5B5B5B5B5B5B5B
-
-	# output transform
-	.Lk_opt = .-.Laes_consts
-	.quad	0xFF9F4929D6B66000
-	.quad	0xF7974121DEBE6808
-	.quad	0x01EDBD5150BCEC00
-	.quad	0xE10D5DB1B05C0CE0
-
-	# deskew tables: inverts the sbox's 'skew'
-	.Lk_deskew = .-.Laes_consts
-	.quad	0x07E4A34047A4E300
-	.quad	0x1DFEB95A5DBEF91A
-	.quad	0x5F36B5DC83EA6900
-	.quad	0x2841C2ABF49D1E77
-
-##
-##  Decryption stuff
-##  Key schedule constants
-##
-	# decryption key schedule: x -> invskew x*9
-	.Lk_dks_1 = .-.Laes_consts
-	.quad	0xB6116FC87ED9A700
-	.quad	0x4AED933482255BFC
-	.quad	0x4576516227143300
-	.quad	0x8BB89FACE9DAFDCE
-
-	# decryption key schedule: invskew x*9 -> invskew x*D
-	.Lk_dks_2 = .-.Laes_consts
-	.quad	0x27438FEBCCA86400
-	.quad	0x4622EE8AADC90561
-	.quad	0x815C13CE4F92DD00
-	.quad	0x73AEE13CBD602FF2
-
-	# decryption key schedule: invskew x*D -> invskew x*B
-	.Lk_dks_3 = .-.Laes_consts
-	.quad	0x03C4C50201C6C700
-	.quad	0xF83F3EF9FA3D3CFB
-	.quad	0xEE1921D638CFF700
-	.quad	0xA5526A9D7384BC4B
-
-	# decryption key schedule: invskew x*B -> invskew x*E + 0x63
-	.Lk_dks_4 = .-.Laes_consts
-	.quad	0xE3C390B053732000
-	.quad	0xA080D3F310306343
-	.quad	0xA0CA214B036982E8
-	.quad	0x2F45AEC48CE60D67
-
-##
-##  Decryption stuff
-##  Round function constants
-##
-	# decryption input transform
-	.Lk_dipt = .-.Laes_consts
-	.quad	0x0F505B040B545F00
-	.quad	0x154A411E114E451A
-	.quad	0x86E383E660056500
-	.quad	0x12771772F491F194
-
-	# decryption sbox output *9*u, *9*t
-	.Lk_dsb9 = .-.Laes_consts
-	.quad	0x851C03539A86D600
-	.quad	0xCAD51F504F994CC9
-	.quad	0xC03B1789ECD74900
-	.quad	0x725E2C9EB2FBA565
-
-	# decryption sbox output *D*u, *D*t
-	.Lk_dsbd = .-.Laes_consts
-	.quad	0x7D57CCDFE6B1A200
-	.quad	0xF56E9B13882A4439
-	.quad	0x3CE2FAF724C6CB00
-	.quad	0x2931180D15DEEFD3
-
-	# decryption sbox output *B*u, *B*t
-	.Lk_dsbb = .-.Laes_consts
-	.quad	0xD022649296B44200
-	.quad	0x602646F6B0F2D404
-	.quad	0xC19498A6CD596700
-	.quad	0xF3FF0C3E3255AA6B
-
-	# decryption sbox output *E*u, *E*t
-	.Lk_dsbe = .-.Laes_consts
-	.quad	0x46F2929626D4D000
-	.quad	0x2242600464B4F6B0
-	.quad	0x0C55A6CDFFAAC100
-	.quad	0x9467F36B98593E32
-
-	# decryption sbox final output
-	.Lk_dsbo = .-.Laes_consts
-	.quad	0x1387EA537EF94000
-	.quad	0xC7AA6DB9D4943E2D
-	.quad	0x12D7560F93441D00
-	.quad	0xCA4B8159D8C58E9C
-ELF(.size _aes_consts,.-_aes_consts)
-
-#endif
-#endif
diff --git a/cipher/rijndael-ssse3-amd64.c b/cipher/rijndael-ssse3-amd64.c
index 30a129a..e2ee0c9 100644
--- a/cipher/rijndael-ssse3-amd64.c
+++ b/cipher/rijndael-ssse3-amd64.c
@@ -1,5 +1,5 @@
 /* SSSE3 vector permutation AES for Libgcrypt
- * Copyright (C) 2014-2017 Jussi Kivilinna <jussi.kivilinna at iki.fi>
+ * Copyright (C) 2014-2015 Jussi Kivilinna <jussi.kivilinna at iki.fi>
  *
  * This file is part of Libgcrypt.
  *
@@ -57,22 +57,11 @@
 #endif
 
 
-/* Assembly functions in rijndael-ssse3-amd64-asm.S. Note that these
-   have custom calling convention and need to be called from assembly
-   blocks, not directly. */
-extern void _gcry_aes_ssse3_enc_preload(void);
-extern void _gcry_aes_ssse3_dec_preload(void);
-extern void _gcry_aes_ssse3_schedule_core(void);
-extern void _gcry_aes_ssse3_encrypt_core(void);
-extern void _gcry_aes_ssse3_decrypt_core(void);
-
-
-
 /* Two macros to be called prior and after the use of SSSE3
-   instructions.  There should be no external function calls between
-   the use of these macros.  There purpose is to make sure that the
-   SSE registers are cleared and won't reveal any information about
-   the key or the data.  */
+  instructions.  There should be no external function calls between
+  the use of these macros.  There purpose is to make sure that the
+  SSE registers are cleared and won't reveal any information about
+  the key or the data.  */
 #ifdef HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS
 # define SSSE3_STATE_SIZE (16 * 10)
 /* XMM6-XMM15 are callee-saved registers on WIN64. */
@@ -126,19 +115,34 @@ extern void _gcry_aes_ssse3_decrypt_core(void);
                   ::: "memory" )
 #endif
 
-#define vpaes_ssse3_prepare_enc() \
+#define vpaes_ssse3_prepare_enc(const_ptr) \
     vpaes_ssse3_prepare(); \
-    asm volatile ("call *%[core] \n\t" \
+    asm volatile ("lea	.Laes_consts(%%rip), %q0 \n\t" \
+                  "movdqa	          (%q0), %%xmm9  # 0F \n\t" \
+                  "movdqa	.Lk_inv   (%q0), %%xmm10 # inv \n\t" \
+                  "movdqa	.Lk_inv+16(%q0), %%xmm11 # inva \n\t" \
+                  "movdqa	.Lk_sb1   (%q0), %%xmm13 # sb1u \n\t" \
+                  "movdqa	.Lk_sb1+16(%q0), %%xmm12 # sb1t \n\t" \
+                  "movdqa	.Lk_sb2   (%q0), %%xmm15 # sb2u \n\t" \
+                  "movdqa	.Lk_sb2+16(%q0), %%xmm14 # sb2t \n\t" \
+                  : "=c" (const_ptr) \
                   : \
-                  : [core] "r" (_gcry_aes_ssse3_enc_preload) \
-                  : "rax", "cc", "memory" )
+                  : "memory" )
 
-#define vpaes_ssse3_prepare_dec() \
+#define vpaes_ssse3_prepare_dec(const_ptr) \
     vpaes_ssse3_prepare(); \
-    asm volatile ("call *%[core] \n\t" \
+    asm volatile ("lea	.Laes_consts(%%rip), %q0 \n\t" \
+                  "movdqa	          (%q0), %%xmm9  # 0F \n\t" \
+                  "movdqa	.Lk_inv   (%q0), %%xmm10 # inv \n\t" \
+                  "movdqa	.Lk_inv+16(%q0), %%xmm11 # inva \n\t" \
+                  "movdqa	.Lk_dsb9   (%q0), %%xmm13 # sb9u \n\t" \
+                  "movdqa	.Lk_dsb9+16(%q0), %%xmm12 # sb9t \n\t" \
+                  "movdqa	.Lk_dsbd   (%q0), %%xmm15 # sbdu \n\t" \
+                  "movdqa	.Lk_dsbb   (%q0), %%xmm14 # sbbu \n\t" \
+                  "movdqa	.Lk_dsbe   (%q0), %%xmm8 # sbeu \n\t" \
+                  : "=c" (const_ptr) \
                   : \
-                  : [core] "r" (_gcry_aes_ssse3_dec_preload) \
-                  : "rax", "cc", "memory" )
+                  : "memory" )
 
 
 
@@ -155,10 +159,9 @@ _gcry_aes_ssse3_do_setkey (RIJNDAEL_context *ctx, const byte *key)
                 "leaq %[buf], %%rdx"			"\n\t"
                 "movl %[dir], %%ecx"			"\n\t"
                 "movl %[rotoffs], %%r8d"		"\n\t"
-                "call *%[core]"				"\n\t"
+                "call _aes_schedule_core"		"\n\t"
                 :
-                : [core] "r" (&_gcry_aes_ssse3_schedule_core),
-                  [key] "m" (*key),
+                : [key] "m" (*key),
                   [bits] "g" (keybits),
                   [buf] "m" (ctx->keyschenc32[0][0]),
                   [dir] "g" (0),
@@ -166,31 +169,10 @@ _gcry_aes_ssse3_do_setkey (RIJNDAEL_context *ctx, const byte *key)
                 : "r8", "r9", "r10", "r11", "rax", "rcx", "rdx", "rdi", "rsi",
                   "cc", "memory");
 
-  /* Save key for setting up decryption. */
-  if (keybits > 192)
-    asm volatile ("movdqu   (%[src]), %%xmm0\n\t"
-		  "movdqu 16(%[src]), %%xmm1\n\t"
-		  "movdqu %%xmm0,   (%[dst])\n\t"
-		  "movdqu %%xmm1, 16(%[dst])\n\t"
-		  : /* No output */
-		  : [dst] "r" (&ctx->keyschdec32[0][0]), [src] "r" (key)
-		  : "memory" );
-  else if (keybits == 192)
-    asm volatile ("movdqu   (%[src]), %%xmm0\n\t"
-		  "movq   16(%[src]), %%xmm1\n\t"
-		  "movdqu %%xmm0,   (%[dst])\n\t"
-		  "movq   %%xmm1, 16(%[dst])\n\t"
-		  : /* No output */
-		  : [dst] "r" (&ctx->keyschdec32[0][0]), [src] "r" (key)
-		  : "memory" );
-  else
-    asm volatile ("movdqu (%[src]), %%xmm0\n\t"
-		  "movdqu %%xmm0, (%[dst])\n\t"
-		  : /* No output */
-		  : [dst] "r" (&ctx->keyschdec32[0][0]), [src] "r" (key)
-		  : "memory" );
-
   vpaes_ssse3_cleanup();
+
+  /* Save key for setting up decryption. */
+  memcpy(&ctx->keyschdec32[0][0], key, keybits / 8);
 }
 
 
@@ -208,10 +190,9 @@ _gcry_aes_ssse3_prepare_decryption (RIJNDAEL_context *ctx)
                 "leaq %[buf], %%rdx"			"\n\t"
                 "movl %[dir], %%ecx"			"\n\t"
                 "movl %[rotoffs], %%r8d"		"\n\t"
-                "call *%[core]"				"\n\t"
+                "call _aes_schedule_core"		"\n\t"
                 :
-                : [core] "r" (_gcry_aes_ssse3_schedule_core),
-                  [key] "m" (ctx->keyschdec32[0][0]),
+                : [key] "m" (ctx->keyschdec32[0][0]),
                   [bits] "g" (keybits),
                   [buf] "m" (ctx->keyschdec32[ctx->rounds][0]),
                   [dir] "g" (1),
@@ -226,30 +207,32 @@ _gcry_aes_ssse3_prepare_decryption (RIJNDAEL_context *ctx)
 /* Encrypt one block using the Intel SSSE3 instructions.  Block is input
 * and output through SSE register xmm0. */
 static inline void
-do_vpaes_ssse3_enc (const RIJNDAEL_context *ctx, unsigned int nrounds)
+do_vpaes_ssse3_enc (const RIJNDAEL_context *ctx, unsigned int nrounds,
+                    const void *aes_const_ptr)
 {
   unsigned int middle_rounds = nrounds - 1;
   const void *keysched = ctx->keyschenc32;
 
-  asm volatile ("call *%[core]"				"\n\t"
-		: "+a" (middle_rounds), "+d" (keysched)
-		: [core] "r" (_gcry_aes_ssse3_encrypt_core)
-		: "rcx", "rsi", "rdi", "cc", "memory");
+  asm volatile ("call _aes_encrypt_core"		"\n\t"
+                : "+a" (middle_rounds), "+d" (keysched)
+                : "c" (aes_const_ptr)
+                : "rdi", "rsi", "cc", "memory");
 }
 
 
 /* Decrypt one block using the Intel SSSE3 instructions.  Block is input
 * and output through SSE register xmm0. */
 static inline void
-do_vpaes_ssse3_dec (const RIJNDAEL_context *ctx, unsigned int nrounds)
+do_vpaes_ssse3_dec (const RIJNDAEL_context *ctx, unsigned int nrounds,
+                    const void *aes_const_ptr)
 {
   unsigned int middle_rounds = nrounds - 1;
   const void *keysched = ctx->keyschdec32;
 
-  asm volatile ("call *%[core]"				"\n\t"
+  asm volatile ("call _aes_decrypt_core"		"\n\t"
                 : "+a" (middle_rounds), "+d" (keysched)
-		: [core] "r" (_gcry_aes_ssse3_decrypt_core)
-                : "rcx", "rsi", "cc", "memory");
+                : "c" (aes_const_ptr)
+                : "rsi", "cc", "memory");
 }
 
 
@@ -258,14 +241,15 @@ _gcry_aes_ssse3_encrypt (const RIJNDAEL_context *ctx, unsigned char *dst,
                         const unsigned char *src)
 {
   unsigned int nrounds = ctx->rounds;
+  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_enc ();
+  vpaes_ssse3_prepare_enc (aes_const_ptr);
   asm volatile ("movdqu %[src], %%xmm0\n\t"
                 :
                 : [src] "m" (*src)
                 : "memory" );
-  do_vpaes_ssse3_enc (ctx, nrounds);
+  do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
   asm volatile ("movdqu %%xmm0, %[dst]\n\t"
                 : [dst] "=m" (*dst)
                 :
@@ -281,9 +265,10 @@ _gcry_aes_ssse3_cfb_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
                         size_t nblocks)
 {
   unsigned int nrounds = ctx->rounds;
+  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_enc ();
+  vpaes_ssse3_prepare_enc (aes_const_ptr);
 
   asm volatile ("movdqu %[iv], %%xmm0\n\t"
                 : /* No output */
@@ -292,7 +277,7 @@ _gcry_aes_ssse3_cfb_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
 
   for ( ;nblocks; nblocks-- )
     {
-      do_vpaes_ssse3_enc (ctx, nrounds);
+      do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
 
       asm volatile ("movdqu %[inbuf], %%xmm1\n\t"
                     "pxor %%xmm1, %%xmm0\n\t"
@@ -320,9 +305,10 @@ _gcry_aes_ssse3_cbc_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
                         size_t nblocks, int cbc_mac)
 {
   unsigned int nrounds = ctx->rounds;
+  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_enc ();
+  vpaes_ssse3_prepare_enc (aes_const_ptr);
 
   asm volatile ("movdqu %[iv], %%xmm7\n\t"
                 : /* No output */
@@ -337,7 +323,7 @@ _gcry_aes_ssse3_cbc_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
                     : [inbuf] "m" (*inbuf)
                     : "memory" );
 
-      do_vpaes_ssse3_enc (ctx, nrounds);
+      do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
 
       asm volatile ("movdqa %%xmm0, %%xmm7\n\t"
                     "movdqu %%xmm0, %[outbuf]\n\t"
@@ -367,10 +353,11 @@ _gcry_aes_ssse3_ctr_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
   static const unsigned char be_mask[16] __attribute__ ((aligned (16))) =
     { 15, 14, 13, 12, 11, 10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 };
   unsigned int nrounds = ctx->rounds;
+  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
   u64 ctrlow;
 
-  vpaes_ssse3_prepare_enc ();
+  vpaes_ssse3_prepare_enc (aes_const_ptr);
 
   asm volatile ("movdqa %[mask], %%xmm6\n\t" /* Preload mask */
                 "movdqa (%[ctr]), %%xmm7\n\t"  /* Preload CTR */
@@ -401,10 +388,10 @@ _gcry_aes_ssse3_ctr_enc (RIJNDAEL_context *ctx, unsigned char *outbuf,
 
                     "pshufb %%xmm6, %%xmm7\n\t"
                     : [ctrlow] "+r" (ctrlow)
-                    :
+                    : [ctr] "r" (ctr)
                     : "cc", "memory");
 
-      do_vpaes_ssse3_enc (ctx, nrounds);
+      do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
 
       asm volatile ("movdqu %[src], %%xmm1\n\t"      /* xmm1 := input   */
                     "pxor %%xmm1, %%xmm0\n\t"        /* EncCTR ^= input  */
@@ -431,14 +418,15 @@ _gcry_aes_ssse3_decrypt (const RIJNDAEL_context *ctx, unsigned char *dst,
                         const unsigned char *src)
 {
   unsigned int nrounds = ctx->rounds;
+  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_dec ();
+  vpaes_ssse3_prepare_dec (aes_const_ptr);
   asm volatile ("movdqu %[src], %%xmm0\n\t"
                 :
                 : [src] "m" (*src)
                 : "memory" );
-  do_vpaes_ssse3_dec (ctx, nrounds);
+  do_vpaes_ssse3_dec (ctx, nrounds, aes_const_ptr);
   asm volatile ("movdqu %%xmm0, %[dst]\n\t"
                 : [dst] "=m" (*dst)
                 :
@@ -454,9 +442,10 @@ _gcry_aes_ssse3_cfb_dec (RIJNDAEL_context *ctx, unsigned char *outbuf,
                         size_t nblocks)
 {
   unsigned int nrounds = ctx->rounds;
+  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_enc ();
+  vpaes_ssse3_prepare_enc (aes_const_ptr);
 
   asm volatile ("movdqu %[iv], %%xmm0\n\t"
                 : /* No output */
@@ -465,7 +454,7 @@ _gcry_aes_ssse3_cfb_dec (RIJNDAEL_context *ctx, unsigned char *outbuf,
 
   for ( ;nblocks; nblocks-- )
     {
-      do_vpaes_ssse3_enc (ctx, nrounds);
+      do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
 
       asm volatile ("movdqa %%xmm0, %%xmm6\n\t"
                     "movdqu %[inbuf], %%xmm0\n\t"
@@ -494,40 +483,45 @@ _gcry_aes_ssse3_cbc_dec (RIJNDAEL_context *ctx, unsigned char *outbuf,
                         size_t nblocks)
 {
   unsigned int nrounds = ctx->rounds;
+  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_dec ();
+  vpaes_ssse3_prepare_dec (aes_const_ptr);
 
-  asm volatile ("movdqu %[iv], %%xmm7\n\t"	/* use xmm7 as fast IV storage */
-		: /* No output */
-		: [iv] "m" (*iv)
-		: "memory");
+  asm volatile
+    ("movdqu %[iv], %%xmm7\n\t"	/* use xmm7 as fast IV storage */
+    : /* No output */
+    : [iv] "m" (*iv)
+    : "memory");
 
   for ( ;nblocks; nblocks-- )
     {
-      asm volatile ("movdqu %[inbuf], %%xmm0\n\t"
-		    "movdqa %%xmm0, %%xmm6\n\t"    /* use xmm6 as savebuf */
-		    : /* No output */
-		    : [inbuf] "m" (*inbuf)
-		    : "memory");
-
-      do_vpaes_ssse3_dec (ctx, nrounds);
-
-      asm volatile ("pxor %%xmm7, %%xmm0\n\t"	/* xor IV with output */
-		    "movdqu %%xmm0, %[outbuf]\n\t"
-		    "movdqu %%xmm6, %%xmm7\n\t"	/* store savebuf as new IV */
-		    : [outbuf] "=m" (*outbuf)
-		    :
-		    : "memory");
+      asm volatile
+        ("movdqu %[inbuf], %%xmm0\n\t"
+        "movdqa %%xmm0, %%xmm6\n\t"    /* use xmm6 as savebuf */
+        : /* No output */
+        : [inbuf] "m" (*inbuf)
+        : "memory");
+
+      do_vpaes_ssse3_dec (ctx, nrounds, aes_const_ptr);
+
+      asm volatile
+        ("pxor %%xmm7, %%xmm0\n\t"	/* xor IV with output */
+        "movdqu %%xmm0, %[outbuf]\n\t"
+        "movdqu %%xmm6, %%xmm7\n\t"	/* store savebuf as new IV */
+        : [outbuf] "=m" (*outbuf)
+        :
+        : "memory");
 
       outbuf += BLOCKSIZE;
       inbuf  += BLOCKSIZE;
     }
 
-  asm volatile ("movdqu %%xmm7, %[iv]\n\t"	/* store IV */
-		: /* No output */
-		: [iv] "m" (*iv)
-		: "memory");
+  asm volatile
+    ("movdqu %%xmm7, %[iv]\n\t"	/* store IV */
+    : /* No output */
+    : [iv] "m" (*iv)
+    : "memory");
 
   vpaes_ssse3_cleanup ();
 }
@@ -624,9 +618,10 @@ ssse3_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
   const unsigned char *inbuf = inbuf_arg;
   u64 n = c->u_mode.ocb.data_nblocks;
   unsigned int nrounds = ctx->rounds;
+  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_enc ();
+  vpaes_ssse3_prepare_enc (aes_const_ptr);
 
   /* Preload Offset and Checksum */
   asm volatile ("movdqu %[iv], %%xmm7\n\t"
@@ -656,7 +651,7 @@ ssse3_ocb_enc (gcry_cipher_hd_t c, void *outbuf_arg,
                       [inbuf] "m" (*inbuf)
                     : "memory" );
 
-      do_vpaes_ssse3_enc (ctx, nrounds);
+      do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
 
       asm volatile ("pxor   %%xmm7, %%xmm0\n\t"
                     "movdqu %%xmm0, %[outbuf]\n\t"
@@ -690,9 +685,10 @@ ssse3_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
   const unsigned char *inbuf = inbuf_arg;
   u64 n = c->u_mode.ocb.data_nblocks;
   unsigned int nrounds = ctx->rounds;
+  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_dec ();
+  vpaes_ssse3_prepare_dec (aes_const_ptr);
 
   /* Preload Offset and Checksum */
   asm volatile ("movdqu %[iv], %%xmm7\n\t"
@@ -721,7 +717,7 @@ ssse3_ocb_dec (gcry_cipher_hd_t c, void *outbuf_arg,
                       [inbuf] "m" (*inbuf)
                     : "memory" );
 
-      do_vpaes_ssse3_dec (ctx, nrounds);
+      do_vpaes_ssse3_dec (ctx, nrounds, aes_const_ptr);
 
       asm volatile ("pxor   %%xmm7, %%xmm0\n\t"
                     "pxor   %%xmm0, %%xmm6\n\t"
@@ -767,9 +763,10 @@ _gcry_aes_ssse3_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
   const unsigned char *abuf = abuf_arg;
   u64 n = c->u_mode.ocb.aad_nblocks;
   unsigned int nrounds = ctx->rounds;
+  const void *aes_const_ptr;
   byte ssse3_state[SSSE3_STATE_SIZE];
 
-  vpaes_ssse3_prepare_enc ();
+  vpaes_ssse3_prepare_enc (aes_const_ptr);
 
   /* Preload Offset and Sum */
   asm volatile ("movdqu %[iv], %%xmm7\n\t"
@@ -797,7 +794,7 @@ _gcry_aes_ssse3_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
                       [abuf] "m" (*abuf)
                     : "memory" );
 
-      do_vpaes_ssse3_enc (ctx, nrounds);
+      do_vpaes_ssse3_enc (ctx, nrounds, aes_const_ptr);
 
       asm volatile ("pxor   %%xmm0,   %%xmm6\n\t"
                     :
@@ -819,4 +816,774 @@ _gcry_aes_ssse3_ocb_auth (gcry_cipher_hd_t c, const void *abuf_arg,
   vpaes_ssse3_cleanup ();
 }
 
+
+#ifdef HAVE_COMPATIBLE_GCC_WIN64_PLATFORM_AS
+# define X(...)
+#else
+# define X(...) __VA_ARGS__
+#endif
+
+asm (
+  "\n\t" "##"
+  "\n\t" "## Constant-time SSSE3 AES core implementation."
+  "\n\t" "##"
+  "\n\t" "## By Mike Hamburg (Stanford University), 2009"
+  "\n\t" "## Public domain."
+  "\n\t" "##"
+
+  "\n\t" ".text"
+
+  "\n\t" "##"
+  "\n\t" "##  _aes_encrypt_core"
+  "\n\t" "##"
+  "\n\t" "##  AES-encrypt %xmm0."
+  "\n\t" "##"
+  "\n\t" "##  Inputs:"
+  "\n\t" "##     %xmm0 = input"
+  "\n\t" "##     %xmm9-%xmm15 as in .Laes_preheat"
+  "\n\t" "##     %rcx  = .Laes_consts"
+  "\n\t" "##    (%rdx) = scheduled keys"
+  "\n\t" "##     %rax  = nrounds - 1"
+  "\n\t" "##"
+  "\n\t" "##  Output in %xmm0"
+  "\n\t" "##  Clobbers  %xmm1-%xmm4, %r9, %r11, %rax"
+  "\n\t" "##  Preserves %xmm6 - %xmm7 so you get some local vectors"
+  "\n\t" "##"
+  "\n\t" "##"
+  "\n\t" ".align 16"
+X("\n\t" ".type _aes_encrypt_core, at function")
+  "\n\t" "_aes_encrypt_core:"
+  "\n\t" "	leaq	.Lk_mc_backward(%rcx), %rdi"
+  "\n\t" "	mov	$16,	%rsi"
+  "\n\t" "	movdqa	.Lk_ipt   (%rcx), %xmm2 # iptlo"
+  "\n\t" "	movdqa	%xmm9,	%xmm1"
+  "\n\t" "	pandn	%xmm0,	%xmm1"
+  "\n\t" "	psrld	$4,	%xmm1"
+  "\n\t" "	pand	%xmm9,	%xmm0"
+  "\n\t" "	pshufb	%xmm0,	%xmm2"
+  "\n\t" "	movdqa	.Lk_ipt+16(%rcx), %xmm0 # ipthi"
+  "\n\t" "	pshufb	%xmm1,	%xmm0"
+  "\n\t" "	pxor	(%rdx),%xmm2"
+  "\n\t" "	pxor	%xmm2,	%xmm0"
+  "\n\t" "	add	$16,	%rdx"
+  "\n\t" "	jmp	.Laes_entry"
+
+  "\n\t" ".align 8"
+  "\n\t" ".Laes_loop:"
+  "\n\t" "	# middle of middle round"
+  "\n\t" "	movdqa  %xmm13,	%xmm4	# 4 : sb1u"
+  "\n\t" "	pshufb  %xmm2,	%xmm4   # 4 = sb1u"
+  "\n\t" "	pxor	(%rdx),	%xmm4	# 4 = sb1u + k"
+  "\n\t" "	movdqa  %xmm12,	%xmm0	# 0 : sb1t"
+  "\n\t" "	pshufb  %xmm3,	%xmm0	# 0 = sb1t"
+  "\n\t" "	pxor	%xmm4,	%xmm0	# 0 = A"
+  "\n\t" "	movdqa  %xmm15,	%xmm4	# 4 : sb2u"
+  "\n\t" "	pshufb	%xmm2,	%xmm4	# 4 = sb2u"
+  "\n\t" "	movdqa	.Lk_mc_forward-.Lk_mc_backward(%rsi,%rdi), %xmm1"
+  "\n\t" "	movdqa	%xmm14, %xmm2	# 2 : sb2t"
+  "\n\t" "	pshufb	%xmm3,  %xmm2	# 2 = sb2t"
+  "\n\t" "	pxor	%xmm4,  %xmm2	# 2 = 2A"
+  "\n\t" "	movdqa	%xmm0,  %xmm3	# 3 = A"
+  "\n\t" "	pshufb  %xmm1,  %xmm0	# 0 = B"
+  "\n\t" "	pxor	%xmm2,  %xmm0	# 0 = 2A+B"
+  "\n\t" "	pshufb	(%rsi,%rdi), %xmm3  # 3 = D"
+  "\n\t" "	lea	16(%esi),%esi	# next mc"
+  "\n\t" "	pxor	%xmm0,	%xmm3	# 3 = 2A+B+D"
+  "\n\t" "	lea	16(%rdx),%rdx	# next key"
+  "\n\t" "	pshufb  %xmm1,	%xmm0	# 0 = 2B+C"
+  "\n\t" "	pxor	%xmm3,	%xmm0	# 0 = 2A+3B+C+D"
+  "\n\t" "	and	$48, %rsi	# ... mod 4"
+  "\n\t" "	dec	%rax		# nr--"
+
+  "\n\t" ".Laes_entry:"
+  "\n\t" "	# top of round"
+  "\n\t" "	movdqa  %xmm9, 	%xmm1	# 1 : i"
+  "\n\t" "	pandn	%xmm0, 	%xmm1	# 1 = i<<4"
+  "\n\t" "	psrld	$4,    	%xmm1   # 1 = i"
+  "\n\t" "	pand	%xmm9, 	%xmm0   # 0 = k"
+  "\n\t" "	movdqa	%xmm11, %xmm2	# 2 : a/k"
+  "\n\t" "	pshufb  %xmm0,  %xmm2	# 2 = a/k"
+  "\n\t" "	pxor	%xmm1,	%xmm0	# 0 = j"
+  "\n\t" "	movdqa  %xmm10,	%xmm3  	# 3 : 1/i"
+  "\n\t" "	pshufb  %xmm1, 	%xmm3  	# 3 = 1/i"
+  "\n\t" "	pxor	%xmm2, 	%xmm3  	# 3 = iak = 1/i + a/k"
+  "\n\t" "	movdqa	%xmm10,	%xmm4  	# 4 : 1/j"
+  "\n\t" "	pshufb	%xmm0, 	%xmm4  	# 4 = 1/j"
+  "\n\t" "	pxor	%xmm2, 	%xmm4  	# 4 = jak = 1/j + a/k"
+  "\n\t" "	movdqa  %xmm10,	%xmm2  	# 2 : 1/iak"
+  "\n\t" "	pshufb  %xmm3,	%xmm2  	# 2 = 1/iak"
+  "\n\t" "	pxor	%xmm0, 	%xmm2  	# 2 = io"
+  "\n\t" "	movdqa  %xmm10, %xmm3   # 3 : 1/jak"
+  "\n\t" "	pshufb  %xmm4,  %xmm3   # 3 = 1/jak"
+  "\n\t" "	pxor	%xmm1,  %xmm3   # 3 = jo"
+  "\n\t" "	jnz	.Laes_loop"
+
+  "\n\t" "	# middle of last round"
+  "\n\t" "	movdqa	.Lk_sbo(%rcx), %xmm4	# 3 : sbou"
+  "\n\t" "	pshufb  %xmm2,  %xmm4   # 4 = sbou"
+  "\n\t" "	pxor	(%rdx), %xmm4   # 4 = sb1u + k"
+  "\n\t" "	movdqa	.Lk_sbo+16(%rcx), %xmm0	# 0 : sbot"
+  "\n\t" "	pshufb  %xmm3,	%xmm0	# 0 = sb1t"
+  "\n\t" "	pxor	%xmm4,	%xmm0	# 0 = A"
+  "\n\t" "	pshufb	.Lk_sr(%rsi,%rcx), %xmm0"
+  "\n\t" "	ret"
+X("\n\t" ".size _aes_encrypt_core,.-_aes_encrypt_core")
+
+  "\n\t" "##"
+  "\n\t" "##  Decryption core"
+  "\n\t" "##"
+  "\n\t" "##  Same API as encryption core."
+  "\n\t" "##"
+  "\n\t" ".align 16"
+X("\n\t" ".type _aes_decrypt_core, at function")
+  "\n\t" "_aes_decrypt_core:"
+  "\n\t" "	movl	%eax,	%esi"
+  "\n\t" "	shll	$4,	%esi"
+  "\n\t" "	xorl	$48,	%esi"
+  "\n\t" "	andl	$48,	%esi"
+  "\n\t" "	movdqa	.Lk_dipt   (%rcx), %xmm2 # iptlo"
+  "\n\t" "	movdqa	%xmm9,	%xmm1"
+  "\n\t" "	pandn	%xmm0,	%xmm1"
+  "\n\t" "	psrld	$4,	%xmm1"
+  "\n\t" "	pand	%xmm9,	%xmm0"
+  "\n\t" "	pshufb	%xmm0,	%xmm2"
+  "\n\t" "	movdqa	.Lk_dipt+16(%rcx), %xmm0 # ipthi"
+  "\n\t" "	pshufb	%xmm1,	%xmm0"
+  "\n\t" "	pxor	(%rdx),	%xmm2"
+  "\n\t" "	pxor	%xmm2,	%xmm0"
+  "\n\t" "	movdqa	.Lk_mc_forward+48(%rcx), %xmm5"
+  "\n\t" "	lea	16(%rdx), %rdx"
+  "\n\t" "	neg	%rax"
+  "\n\t" "	jmp	.Laes_dec_entry"
+
+  "\n\t" ".align 16"
+  "\n\t" ".Laes_dec_loop:"
+  "\n\t" "##"
+  "\n\t" "##  Inverse mix columns"
+  "\n\t" "##"
+  "\n\t" "	movdqa  %xmm13,	%xmm4		# 4 : sb9u"
+  "\n\t" "	pshufb	%xmm2,	%xmm4		# 4 = sb9u"
+  "\n\t" "	pxor	(%rdx),	%xmm4"
+  "\n\t" "	movdqa  %xmm12,	%xmm0		# 0 : sb9t"
+  "\n\t" "	pshufb	%xmm3,	%xmm0		# 0 = sb9t"
+  "\n\t" "	movdqa  .Lk_dsbd+16(%rcx),%xmm1	# 1 : sbdt"
+  "\n\t" "	pxor	%xmm4,	%xmm0		# 0 = ch"
+  "\n\t" "	lea	16(%rdx), %rdx		# next round key"
+
+  "\n\t" "	pshufb	%xmm5,	%xmm0		# MC ch"
+  "\n\t" "	movdqa  %xmm15,	%xmm4		# 4 : sbdu"
+  "\n\t" "	pshufb	%xmm2,	%xmm4		# 4 = sbdu"
+  "\n\t" "	pxor	%xmm0,	%xmm4		# 4 = ch"
+  "\n\t" "	pshufb	%xmm3,	%xmm1		# 1 = sbdt"
+  "\n\t" "	pxor	%xmm4,	%xmm1		# 1 = ch"
+
+  "\n\t" "	pshufb	%xmm5,	%xmm1		# MC ch"
+  "\n\t" "	movdqa  %xmm14,	%xmm4		# 4 : sbbu"
+  "\n\t" "	pshufb	%xmm2,	%xmm4		# 4 = sbbu"
+  "\n\t" "      inc     %rax                    # nr--"
+  "\n\t" "	pxor	%xmm1,	%xmm4		# 4 = ch"
+  "\n\t" "	movdqa  .Lk_dsbb+16(%rcx),%xmm0	# 0 : sbbt"
+  "\n\t" "	pshufb	%xmm3,	%xmm0		# 0 = sbbt"
+  "\n\t" "	pxor	%xmm4,	%xmm0		# 0 = ch"
+
+  "\n\t" "	pshufb	%xmm5,	%xmm0		# MC ch"
+  "\n\t" "	movdqa  %xmm8,	%xmm4		# 4 : sbeu"
+  "\n\t" "	pshufb	%xmm2,	%xmm4		# 4 = sbeu"
+  "\n\t" "	pshufd	$0x93,	%xmm5,	%xmm5"
+  "\n\t" "	pxor	%xmm0,	%xmm4		# 4 = ch"
+  "\n\t" "	movdqa  .Lk_dsbe+16(%rcx),%xmm0	# 0 : sbet"
+  "\n\t" "	pshufb	%xmm3,	%xmm0		# 0 = sbet"
+  "\n\t" "	pxor	%xmm4,	%xmm0		# 0 = ch"
+
+  "\n\t" ".Laes_dec_entry:"
+  "\n\t" "	# top of round"
+  "\n\t" "	movdqa  %xmm9, 	%xmm1	# 1 : i"
+  "\n\t" "	pandn	%xmm0, 	%xmm1	# 1 = i<<4"
+  "\n\t" "	psrld	$4,    	%xmm1   # 1 = i"
+  "\n\t" "	pand	%xmm9, 	%xmm0   # 0 = k"
+  "\n\t" "	movdqa	%xmm11, %xmm2	# 2 : a/k"
+  "\n\t" "	pshufb  %xmm0,  %xmm2	# 2 = a/k"
+  "\n\t" "	pxor	%xmm1,	%xmm0	# 0 = j"
+  "\n\t" "	movdqa  %xmm10,	%xmm3  	# 3 : 1/i"
+  "\n\t" "	pshufb  %xmm1, 	%xmm3  	# 3 = 1/i"
+  "\n\t" "	pxor	%xmm2, 	%xmm3  	# 3 = iak = 1/i + a/k"
+  "\n\t" "	movdqa	%xmm10,	%xmm4  	# 4 : 1/j"
+  "\n\t" "	pshufb	%xmm0, 	%xmm4  	# 4 = 1/j"
+  "\n\t" "	pxor	%xmm2, 	%xmm4  	# 4 = jak = 1/j + a/k"
+  "\n\t" "	movdqa  %xmm10,	%xmm2  	# 2 : 1/iak"
+  "\n\t" "	pshufb  %xmm3,	%xmm2  	# 2 = 1/iak"
+  "\n\t" "	pxor	%xmm0, 	%xmm2  	# 2 = io"
+  "\n\t" "	movdqa  %xmm10, %xmm3   # 3 : 1/jak"
+  "\n\t" "	pshufb  %xmm4,  %xmm3   # 3 = 1/jak"
+  "\n\t" "	pxor	%xmm1,  %xmm3   # 3 = jo"
+  "\n\t" "	jnz	.Laes_dec_loop"
+
+  "\n\t" "	# middle of last round"
+  "\n\t" "	movdqa	.Lk_dsbo(%rcx), %xmm4		# 3 : sbou"
+  "\n\t" "	pshufb  %xmm2,  %xmm4   # 4 = sbou"
+  "\n\t" "	pxor	(%rdx), %xmm4   # 4 = sb1u + k"
+  "\n\t" "	movdqa	.Lk_dsbo+16(%rcx), %xmm0	# 0 : sbot"
+  "\n\t" "	pshufb  %xmm3,	%xmm0	# 0 = sb1t"
+  "\n\t" "	pxor	%xmm4,	%xmm0	# 0 = A"
+  "\n\t" "	pshufb	.Lk_sr(%rsi,%rcx), %xmm0"
+  "\n\t" "	ret"
+X("\n\t" ".size _aes_decrypt_core,.-_aes_decrypt_core")
+
+  "\n\t" "########################################################"
+  "\n\t" "##                                                    ##"
+  "\n\t" "##                  AES key schedule                  ##"
+  "\n\t" "##                                                    ##"
+  "\n\t" "########################################################"
+
+  "\n\t" ".align 16"
+X("\n\t" ".type _aes_schedule_core, at function")
+  "\n\t" "_aes_schedule_core:"
+  "\n\t" "	# rdi = key"
+  "\n\t" "	# rsi = size in bits"
+  "\n\t" "	# rdx = buffer"
+  "\n\t" "	# rcx = direction.  0=encrypt, 1=decrypt"
+
+  "\n\t" "	# load the tables"
+  "\n\t" "	lea	.Laes_consts(%rip), %r10"
+  "\n\t" "	movdqa	          (%r10), %xmm9  # 0F"
+  "\n\t" "	movdqa	.Lk_inv   (%r10), %xmm10 # inv"
+  "\n\t" "	movdqa	.Lk_inv+16(%r10), %xmm11 # inva"
+  "\n\t" "	movdqa	.Lk_sb1   (%r10), %xmm13 # sb1u"
+  "\n\t" "	movdqa	.Lk_sb1+16(%r10), %xmm12 # sb1t"
+  "\n\t" "	movdqa	.Lk_sb2   (%r10), %xmm15 # sb2u"
+  "\n\t" "	movdqa	.Lk_sb2+16(%r10), %xmm14 # sb2t"
+
+  "\n\t" "	movdqa	.Lk_rcon(%r10), %xmm8	# load rcon"
+  "\n\t" "	movdqu	(%rdi),	%xmm0		# load key (unaligned)"
+
+  "\n\t" "	# input transform"
+  "\n\t" "	movdqu	%xmm0,	%xmm3"
+  "\n\t" "	lea	.Lk_ipt(%r10), %r11"
+  "\n\t" "	call	.Laes_schedule_transform"
+  "\n\t" "	movdqu	%xmm0,	%xmm7"
+
+  "\n\t" "	test	%rcx,	%rcx"
+  "\n\t" "	jnz	.Laes_schedule_am_decrypting"
+
+  "\n\t" "	# encrypting, output zeroth round key after transform"
+  "\n\t" "	movdqa	%xmm0,	(%rdx)"
+  "\n\t" "	jmp	.Laes_schedule_go"
+
+  "\n\t" ".Laes_schedule_am_decrypting:"
+  "\n\t" "	# decrypting, output zeroth round key after shiftrows"
+  "\n\t" "	pshufb  .Lk_sr(%r8,%r10),%xmm3"
+  "\n\t" "	movdqa	%xmm3,	(%rdx)"
+  "\n\t" "	xor	$48, 	%r8"
+
+  "\n\t" ".Laes_schedule_go:"
+  "\n\t" "	cmp	$192,	%rsi"
+  "\n\t" "	je	.Laes_schedule_192"
+  "\n\t" "	cmp	$256,	%rsi"
+  "\n\t" "	je	.Laes_schedule_256"
+  "\n\t" "	# 128: fall though"
+
+  "\n\t" "##"
+  "\n\t" "##  .Laes_schedule_128"
+  "\n\t" "##"
+  "\n\t" "##  128-bit specific part of key schedule."
+  "\n\t" "##"
+  "\n\t" "##  This schedule is really simple, because all its parts"
+  "\n\t" "##  are accomplished by the subroutines."
+  "\n\t" "##"
+  "\n\t" ".Laes_schedule_128:"
+  "\n\t" "	mov	$10, %rsi"
+
+  "\n\t" ".Laes_schedule_128_L:"
+  "\n\t" "	call 	.Laes_schedule_round"
+  "\n\t" "	dec	%rsi"
+  "\n\t" "	jz 	.Laes_schedule_mangle_last"
+  "\n\t" "	call	.Laes_schedule_mangle	# write output"
+  "\n\t" "	jmp 	.Laes_schedule_128_L"
+
+  "\n\t" "##"
+  "\n\t" "##  .Laes_schedule_192"
+  "\n\t" "##"
+  "\n\t" "##  192-bit specific part of key schedule."
+  "\n\t" "##"
+  "\n\t" "##  The main body of this schedule is the same as the 128-bit"
+  "\n\t" "##  schedule, but with more smearing.  The long, high side is"
+  "\n\t" "##  stored in %xmm7 as before, and the short, low side is in"
+  "\n\t" "##  the high bits of %xmm6."
+  "\n\t" "##"
+  "\n\t" "##  This schedule is somewhat nastier, however, because each"
+  "\n\t" "##  round produces 192 bits of key material, or 1.5 round keys."
+  "\n\t" "##  Therefore, on each cycle we do 2 rounds and produce 3 round"
+  "\n\t" "##  keys."
+  "\n\t" "##"
+  "\n\t" ".Laes_schedule_192:"
+  "\n\t" "	movdqu	8(%rdi),%xmm0		# load key part 2 (very unaligned)"
+  "\n\t" "	call	.Laes_schedule_transform	# input transform"
+  "\n\t" "	pshufd	$0x0E,	%xmm0,	%xmm6"
+  "\n\t" "	pslldq	$8,	%xmm6		# clobber low side with zeros"
+  "\n\t" "	mov	$4,	%rsi"
+
+  "\n\t" ".Laes_schedule_192_L:"
+  "\n\t" "	call	.Laes_schedule_round"
+  "\n\t" "	palignr	$8,%xmm6,%xmm0	"
+  "\n\t" "	call	.Laes_schedule_mangle	# save key n"
+  "\n\t" "	call	.Laes_schedule_192_smear"
+  "\n\t" "	call	.Laes_schedule_mangle	# save key n+1"
+  "\n\t" "	call	.Laes_schedule_round"
+  "\n\t" "	dec	%rsi"
+  "\n\t" "	jz 	.Laes_schedule_mangle_last"
+  "\n\t" "	call	.Laes_schedule_mangle	# save key n+2"
+  "\n\t" "	call	.Laes_schedule_192_smear"
+  "\n\t" "	jmp	.Laes_schedule_192_L"
+
+  "\n\t" "##"
+  "\n\t" "##  .Laes_schedule_192_smear"
+  "\n\t" "##"
+  "\n\t" "##  Smear the short, low side in the 192-bit key schedule."
+  "\n\t" "##"
+  "\n\t" "##  Inputs:"
+  "\n\t" "##    %xmm7: high side, b  a  x  y"
+  "\n\t" "##    %xmm6:  low side, d  c  0  0"
+  "\n\t" "##    %xmm13: 0"
+  "\n\t" "##"
+  "\n\t" "##  Outputs:"
+  "\n\t" "##    %xmm6: b+c+d  b+c  0  0"
+  "\n\t" "##    %xmm0: b+c+d  b+c  b  a"
+  "\n\t" "##"
+  "\n\t" ".Laes_schedule_192_smear:"
+  "\n\t" "	pshufd	$0x80,	%xmm6,	%xmm0	# d c 0 0 -> c 0 0 0"
+  "\n\t" "	pxor	%xmm0,	%xmm6		# -> c+d c 0 0"
+  "\n\t" "	pshufd	$0xFE,	%xmm7,	%xmm0	# b a _ _ -> b b b a"
+  "\n\t" "	pxor	%xmm6,	%xmm0		# -> b+c+d b+c b a"
+  "\n\t" "	pshufd	$0x0E,	%xmm0,	%xmm6"
+  "\n\t" "	pslldq	$8,	%xmm6		# clobber low side with zeros"
+  "\n\t" "	ret"
+
+  "\n\t" "##"
+  "\n\t" "##  .Laes_schedule_256"
+  "\n\t" "##"
+  "\n\t" "##  256-bit specific part of key schedule."
+  "\n\t" "##"
+  "\n\t" "##  The structure here is very similar to the 128-bit"
+  "\n\t" "##  schedule, but with an additional 'low side' in"
+  "\n\t" "##  %xmm6.  The low side's rounds are the same as the"
+  "\n\t" "##  high side's, except no rcon and no rotation."
+  "\n\t" "##"
+  "\n\t" ".Laes_schedule_256:"
+  "\n\t" "	movdqu	16(%rdi),%xmm0		# load key part 2 (unaligned)"
+  "\n\t" "	call	.Laes_schedule_transform	# input transform"
+  "\n\t" "	mov	$7, %rsi"
+
+  "\n\t" ".Laes_schedule_256_L:"
+  "\n\t" "	call	.Laes_schedule_mangle	# output low result"
+  "\n\t" "	movdqa	%xmm0,	%xmm6		# save cur_lo in xmm6"
+
+  "\n\t" "	# high round"
+  "\n\t" "	call	.Laes_schedule_round"
+  "\n\t" "	dec	%rsi"
+  "\n\t" "	jz 	.Laes_schedule_mangle_last"
+  "\n\t" "	call	.Laes_schedule_mangle	"
+
+  "\n\t" "	# low round. swap xmm7 and xmm6"
+  "\n\t" "	pshufd	$0xFF,	%xmm0,	%xmm0"
+  "\n\t" "	movdqa	%xmm7,	%xmm5"
+  "\n\t" "	movdqa	%xmm6,	%xmm7"
+  "\n\t" "	call	.Laes_schedule_low_round"
+  "\n\t" "	movdqa	%xmm5,	%xmm7"
+
+  "\n\t" "	jmp	.Laes_schedule_256_L"
+
+  "\n\t" "##"
+  "\n\t" "##  .Laes_schedule_round"
+  "\n\t" "##"
+  "\n\t" "##  Runs one main round of the key schedule on %xmm0, %xmm7"
+  "\n\t" "##"
+  "\n\t" "##  Specifically, runs subbytes on the high dword of %xmm0"
+  "\n\t" "##  then rotates it by one byte and xors into the low dword of"
+  "\n\t" "##  %xmm7."
+  "\n\t" "##"
+  "\n\t" "##  Adds rcon from low byte of %xmm8, then rotates %xmm8 for"
+  "\n\t" "##  next rcon."
+  "\n\t" "##"
+  "\n\t" "##  Smears the dwords of %xmm7 by xoring the low into the"
+  "\n\t" "##  second low, result into third, result into highest."
+  "\n\t" "##"
+  "\n\t" "##  Returns results in %xmm7 = %xmm0."
+  "\n\t" "##  Clobbers %xmm1-%xmm4, %r11."
+  "\n\t" "##"
+  "\n\t" ".Laes_schedule_round:"
+  "\n\t" "	# extract rcon from xmm8"
+  "\n\t" "	pxor	%xmm1,	%xmm1"
+  "\n\t" "	palignr	$15,	%xmm8,	%xmm1"
+  "\n\t" "	palignr	$15,	%xmm8,	%xmm8"
+  "\n\t" "	pxor	%xmm1,	%xmm7"
+
+  "\n\t" "	# rotate"
+  "\n\t" "	pshufd	$0xFF,	%xmm0,	%xmm0"
+  "\n\t" "	palignr	$1,	%xmm0,	%xmm0"
+
+  "\n\t" "	# fall through..."
+
+  "\n\t" "	# low round: same as high round, but no rotation and no rcon."
+  "\n\t" ".Laes_schedule_low_round:"
+  "\n\t" "	# smear xmm7"
+  "\n\t" "	movdqa	%xmm7,	%xmm1"
+  "\n\t" "	pslldq	$4,	%xmm7"
+  "\n\t" "	pxor	%xmm1,	%xmm7"
+  "\n\t" "	movdqa	%xmm7,	%xmm1"
+  "\n\t" "	pslldq	$8,	%xmm7"
+  "\n\t" "	pxor	%xmm1,	%xmm7"
+  "\n\t" "	pxor	.Lk_s63(%r10), %xmm7"
+
+  "\n\t" "	# subbytes"
+  "\n\t" "	movdqa  %xmm9, 	%xmm1"
+  "\n\t" "	pandn	%xmm0, 	%xmm1"
+  "\n\t" "	psrld	$4,    	%xmm1		# 1 = i"
+  "\n\t" "	pand	%xmm9, 	%xmm0		# 0 = k"
+  "\n\t" "	movdqa	%xmm11, %xmm2		# 2 : a/k"
+  "\n\t" "	pshufb  %xmm0,  %xmm2		# 2 = a/k"
+  "\n\t" "	pxor	%xmm1,	%xmm0		# 0 = j"
+  "\n\t" "	movdqa  %xmm10,	%xmm3		# 3 : 1/i"
+  "\n\t" "	pshufb  %xmm1, 	%xmm3		# 3 = 1/i"
+  "\n\t" "	pxor	%xmm2, 	%xmm3		# 3 = iak = 1/i + a/k"
+  "\n\t" "	movdqa	%xmm10,	%xmm4		# 4 : 1/j"
+  "\n\t" "	pshufb	%xmm0, 	%xmm4		# 4 = 1/j"
+  "\n\t" "	pxor	%xmm2, 	%xmm4		# 4 = jak = 1/j + a/k"
+  "\n\t" "	movdqa  %xmm10,	%xmm2		# 2 : 1/iak"
+  "\n\t" "	pshufb  %xmm3,	%xmm2		# 2 = 1/iak"
+  "\n\t" "	pxor	%xmm0, 	%xmm2		# 2 = io"
+  "\n\t" "	movdqa  %xmm10, %xmm3		# 3 : 1/jak"
+  "\n\t" "	pshufb  %xmm4,  %xmm3		# 3 = 1/jak"
+  "\n\t" "	pxor	%xmm1,  %xmm3		# 3 = jo"
+  "\n\t" "	movdqa	.Lk_sb1(%r10), %xmm4	# 4 : sbou"
+  "\n\t" "	pshufb  %xmm2,  %xmm4		# 4 = sbou"
+  "\n\t" "	movdqa	.Lk_sb1+16(%r10), %xmm0	# 0 : sbot"
+  "\n\t" "	pshufb  %xmm3,	%xmm0		# 0 = sb1t"
+  "\n\t" "	pxor	%xmm4, 	%xmm0		# 0 = sbox output"
+
+  "\n\t" "	# add in smeared stuff"
+  "\n\t" "	pxor	%xmm7,	%xmm0	"
+  "\n\t" "	movdqa	%xmm0,	%xmm7"
+  "\n\t" "	ret"
+
+  "\n\t" "##"
+  "\n\t" "##  .Laes_schedule_transform"
+  "\n\t" "##"
+  "\n\t" "##  Linear-transform %xmm0 according to tables at (%r11)"
+  "\n\t" "##"
+  "\n\t" "##  Requires that %xmm9 = 0x0F0F... as in preheat"
+  "\n\t" "##  Output in %xmm0"
+  "\n\t" "##  Clobbers %xmm1, %xmm2"
+  "\n\t" "##"
+  "\n\t" ".Laes_schedule_transform:"
+  "\n\t" "	movdqa	%xmm9,	%xmm1"
+  "\n\t" "	pandn	%xmm0,	%xmm1"
+  "\n\t" "	psrld	$4,	%xmm1"
+  "\n\t" "	pand	%xmm9,	%xmm0"
+  "\n\t" "	movdqa	(%r11), %xmm2 	# lo"
+  "\n\t" "	pshufb	%xmm0,	%xmm2"
+  "\n\t" "	movdqa	16(%r11), %xmm0 # hi"
+  "\n\t" "	pshufb	%xmm1,	%xmm0"
+  "\n\t" "	pxor	%xmm2,	%xmm0"
+  "\n\t" "	ret"
+
+  "\n\t" "##"
+  "\n\t" "##  .Laes_schedule_mangle"
+  "\n\t" "##"
+  "\n\t" "##  Mangle xmm0 from (basis-transformed) standard version"
+  "\n\t" "##  to our version."
+  "\n\t" "##"
+  "\n\t" "##  On encrypt,"
+  "\n\t" "##    xor with 0x63"
+  "\n\t" "##    multiply by circulant 0,1,1,1"
+  "\n\t" "##    apply shiftrows transform"
+  "\n\t" "##"
+  "\n\t" "##  On decrypt,"
+  "\n\t" "##    xor with 0x63"
+  "\n\t" "##    multiply by 'inverse mixcolumns' circulant E,B,D,9"
+  "\n\t" "##    deskew"
+  "\n\t" "##    apply shiftrows transform"
+  "\n\t" "##"
+  "\n\t" "##"
+  "\n\t" "##  Writes out to (%rdx), and increments or decrements it"
+  "\n\t" "##  Keeps track of round number mod 4 in %r8"
+  "\n\t" "##  Preserves xmm0"
+  "\n\t" "##  Clobbers xmm1-xmm5"
+  "\n\t" "##"
+  "\n\t" ".Laes_schedule_mangle:"
+  "\n\t" "	movdqa	%xmm0,	%xmm4	# save xmm0 for later"
+  "\n\t" "	movdqa	.Lk_mc_forward(%r10),%xmm5"
+  "\n\t" "	test	%rcx, 	%rcx"
+  "\n\t" "	jnz	.Laes_schedule_mangle_dec"
+
+  "\n\t" "	# encrypting"
+  "\n\t" "	add	$16,	%rdx"
+  "\n\t" "	pxor	.Lk_s63(%r10),%xmm4"
+  "\n\t" "	pshufb	%xmm5,	%xmm4"
+  "\n\t" "	movdqa	%xmm4,	%xmm3"
+  "\n\t" "	pshufb	%xmm5,	%xmm4"
+  "\n\t" "	pxor	%xmm4,	%xmm3"
+  "\n\t" "	pshufb	%xmm5,	%xmm4"
+  "\n\t" "	pxor	%xmm4,	%xmm3"
+
+  "\n\t" "	jmp	.Laes_schedule_mangle_both"
+
+  "\n\t" ".Laes_schedule_mangle_dec:"
+  "\n\t" "	lea	.Lk_dks_1(%r10), %r11	# first table: *9"
+  "\n\t" "	call 	.Laes_schedule_transform"
+  "\n\t" "	movdqa	%xmm0,	%xmm3"
+  "\n\t" "	pshufb	%xmm5,	%xmm3"
+
+  "\n\t" "	add	$32, 	%r11		# next table:  *B"
+  "\n\t" "	call 	.Laes_schedule_transform"
+  "\n\t" "	pxor	%xmm0,	%xmm3"
+  "\n\t" "	pshufb	%xmm5,	%xmm3"
+
+  "\n\t" "	add	$32, 	%r11		# next table:  *D"
+  "\n\t" "	call 	.Laes_schedule_transform"
+  "\n\t" "	pxor	%xmm0,	%xmm3"
+  "\n\t" "	pshufb	%xmm5,	%xmm3"
+
+  "\n\t" "	add	$32, 	%r11		# next table:  *E"
+  "\n\t" "	call 	.Laes_schedule_transform"
+  "\n\t" "	pxor	%xmm0,	%xmm3"
+  "\n\t" "	pshufb	%xmm5,	%xmm3"
+
+  "\n\t" "	movdqa	%xmm4,	%xmm0		# restore %xmm0"
+  "\n\t" "	add	$-16,	%rdx"
+
+  "\n\t" ".Laes_schedule_mangle_both:"
+  "\n\t" "	pshufb	.Lk_sr(%r8,%r10),%xmm3"
+  "\n\t" "	add	$-16,	%r8"
+  "\n\t" "	and	$48,	%r8"
+  "\n\t" "	movdqa	%xmm3,	(%rdx)"
+  "\n\t" "	ret"
+
+  "\n\t" "##"
+  "\n\t" "##  .Laes_schedule_mangle_last"
+  "\n\t" "##"
+  "\n\t" "##  Mangler for last round of key schedule"
+  "\n\t" "##  Mangles %xmm0"
+  "\n\t" "##    when encrypting, outputs out(%xmm0) ^ 63"
+  "\n\t" "##    when decrypting, outputs unskew(%xmm0)"
+  "\n\t" "##"
+  "\n\t" "##  Always called right before return... jumps to cleanup and exits"
+  "\n\t" "##"
+  "\n\t" ".Laes_schedule_mangle_last:"
+  "\n\t" "	# schedule last round key from xmm0"
+  "\n\t" "	lea	.Lk_deskew(%r10),%r11	# prepare to deskew"
+  "\n\t" "	test	%rcx, 	%rcx"
+  "\n\t" "	jnz	.Laes_schedule_mangle_last_dec"
+
+  "\n\t" "	# encrypting"
+  "\n\t" "	pshufb	.Lk_sr(%r8,%r10),%xmm0	# output permute"
+  "\n\t" "	lea	.Lk_opt(%r10),	%r11	# prepare to output transform"
+  "\n\t" "	add	$32,	%rdx"
+
+  "\n\t" ".Laes_schedule_mangle_last_dec:"
+  "\n\t" "	add	$-16,	%rdx"
+  "\n\t" "	pxor	.Lk_s63(%r10),	%xmm0"
+  "\n\t" "	call	.Laes_schedule_transform # output transform"
+  "\n\t" "	movdqa	%xmm0,	(%rdx)		# save last key"
+
+  "\n\t" "	#_aes_cleanup"
+  "\n\t" "	pxor	%xmm0,  %xmm0"
+  "\n\t" "	pxor	%xmm1,  %xmm1"
+  "\n\t" "	pxor	%xmm2,  %xmm2"
+  "\n\t" "	pxor	%xmm3,  %xmm3"
+  "\n\t" "	pxor	%xmm4,  %xmm4"
+  "\n\t" "	pxor	%xmm5,  %xmm5"
+  "\n\t" "	pxor	%xmm6,  %xmm6"
+  "\n\t" "	pxor	%xmm7,  %xmm7"
+  "\n\t" "	pxor	%xmm8,  %xmm8"
+  "\n\t" "	ret"
+X("\n\t" ".size _aes_schedule_core,.-_aes_schedule_core")
+
+  "\n\t" "########################################################"
+  "\n\t" "##                                                    ##"
+  "\n\t" "##                     Constants                      ##"
+  "\n\t" "##                                                    ##"
+  "\n\t" "########################################################"
+
+  "\n\t" ".align 16"
+X("\n\t" ".type _aes_consts, at object")
+  "\n\t" ".Laes_consts:"
+  "\n\t" "_aes_consts:"
+  "\n\t" "	# s0F"
+  "\n\t" "	.Lk_s0F = .-.Laes_consts"
+  "\n\t" "	.quad	0x0F0F0F0F0F0F0F0F"
+  "\n\t" "	.quad	0x0F0F0F0F0F0F0F0F"
+
+  "\n\t" "	# input transform (lo, hi)"
+  "\n\t" "	.Lk_ipt = .-.Laes_consts"
+  "\n\t" "	.quad	0xC2B2E8985A2A7000"
+  "\n\t" "	.quad	0xCABAE09052227808"
+  "\n\t" "	.quad	0x4C01307D317C4D00"
+  "\n\t" "	.quad	0xCD80B1FCB0FDCC81"
+
+  "\n\t" "	# inv, inva"
+  "\n\t" "	.Lk_inv = .-.Laes_consts"
+  "\n\t" "	.quad	0x0E05060F0D080180"
+  "\n\t" "	.quad	0x040703090A0B0C02"
+  "\n\t" "	.quad	0x01040A060F0B0780"
+  "\n\t" "	.quad	0x030D0E0C02050809"
+
+  "\n\t" "	# sb1u, sb1t"
+  "\n\t" "	.Lk_sb1 = .-.Laes_consts"
+  "\n\t" "	.quad	0xB19BE18FCB503E00"
+  "\n\t" "	.quad	0xA5DF7A6E142AF544"
+  "\n\t" "	.quad	0x3618D415FAE22300"
+  "\n\t" "	.quad	0x3BF7CCC10D2ED9EF"
+
+
+  "\n\t" "	# sb2u, sb2t"
+  "\n\t" "	.Lk_sb2 = .-.Laes_consts"
+  "\n\t" "	.quad	0xE27A93C60B712400"
+  "\n\t" "	.quad	0x5EB7E955BC982FCD"
+  "\n\t" "	.quad	0x69EB88400AE12900"
+  "\n\t" "	.quad	0xC2A163C8AB82234A"
+
+  "\n\t" "	# sbou, sbot"
+  "\n\t" "	.Lk_sbo = .-.Laes_consts"
+  "\n\t" "	.quad	0xD0D26D176FBDC700"
+  "\n\t" "	.quad	0x15AABF7AC502A878"
+  "\n\t" "	.quad	0xCFE474A55FBB6A00"
+  "\n\t" "	.quad	0x8E1E90D1412B35FA"
+
+  "\n\t" "	# mc_forward"
+  "\n\t" "	.Lk_mc_forward = .-.Laes_consts"
+  "\n\t" "	.quad	0x0407060500030201"
+  "\n\t" "	.quad	0x0C0F0E0D080B0A09"
+  "\n\t" "	.quad	0x080B0A0904070605"
+  "\n\t" "	.quad	0x000302010C0F0E0D"
+  "\n\t" "	.quad	0x0C0F0E0D080B0A09"
+  "\n\t" "	.quad	0x0407060500030201"
+  "\n\t" "	.quad	0x000302010C0F0E0D"
+  "\n\t" "	.quad	0x080B0A0904070605"
+
+  "\n\t" "	# mc_backward"
+  "\n\t" "	.Lk_mc_backward = .-.Laes_consts"
+  "\n\t" "	.quad	0x0605040702010003"
+  "\n\t" "	.quad	0x0E0D0C0F0A09080B"
+  "\n\t" "	.quad	0x020100030E0D0C0F"
+  "\n\t" "	.quad	0x0A09080B06050407"
+  "\n\t" "	.quad	0x0E0D0C0F0A09080B"
+  "\n\t" "	.quad	0x0605040702010003"
+  "\n\t" "	.quad	0x0A09080B06050407"
+  "\n\t" "	.quad	0x020100030E0D0C0F"
+
+  "\n\t" "	# sr"
+  "\n\t" "	.Lk_sr = .-.Laes_consts"
+  "\n\t" "	.quad	0x0706050403020100"
+  "\n\t" "	.quad	0x0F0E0D0C0B0A0908"
+  "\n\t" "	.quad	0x030E09040F0A0500"
+  "\n\t" "	.quad	0x0B06010C07020D08"
+  "\n\t" "	.quad	0x0F060D040B020900"
+  "\n\t" "	.quad	0x070E050C030A0108"
+  "\n\t" "	.quad	0x0B0E0104070A0D00"
+  "\n\t" "	.quad	0x0306090C0F020508"
+
+  "\n\t" "	# rcon"
+  "\n\t" "	.Lk_rcon = .-.Laes_consts"
+  "\n\t" "	.quad	0x1F8391B9AF9DEEB6"
+  "\n\t" "	.quad	0x702A98084D7C7D81"
+
+  "\n\t" "	# s63: all equal to 0x63 transformed"
+  "\n\t" "	.Lk_s63 = .-.Laes_consts"
+  "\n\t" "	.quad	0x5B5B5B5B5B5B5B5B"
+  "\n\t" "	.quad	0x5B5B5B5B5B5B5B5B"
+
+  "\n\t" "	# output transform"
+  "\n\t" "	.Lk_opt = .-.Laes_consts"
+  "\n\t" "	.quad	0xFF9F4929D6B66000"
+  "\n\t" "	.quad	0xF7974121DEBE6808"
+  "\n\t" "	.quad	0x01EDBD5150BCEC00"
+  "\n\t" "	.quad	0xE10D5DB1B05C0CE0"
+
+  "\n\t" "	# deskew tables: inverts the sbox's 'skew'"
+  "\n\t" "	.Lk_deskew = .-.Laes_consts"
+  "\n\t" "	.quad	0x07E4A34047A4E300"
+  "\n\t" "	.quad	0x1DFEB95A5DBEF91A"
+  "\n\t" "	.quad	0x5F36B5DC83EA6900"
+  "\n\t" "	.quad	0x2841C2ABF49D1E77"
+
+  "\n\t" "##"
+  "\n\t" "##  Decryption stuff"
+  "\n\t" "##  Key schedule constants"
+  "\n\t" "##"
+  "\n\t" "	# decryption key schedule: x -> invskew x*9"
+  "\n\t" "	.Lk_dks_1 = .-.Laes_consts"
+  "\n\t" "	.quad	0xB6116FC87ED9A700"
+  "\n\t" "	.quad	0x4AED933482255BFC"
+  "\n\t" "	.quad	0x4576516227143300"
+  "\n\t" "	.quad	0x8BB89FACE9DAFDCE"
+
+  "\n\t" "	# decryption key schedule: invskew x*9 -> invskew x*D"
+  "\n\t" "	.Lk_dks_2 = .-.Laes_consts"
+  "\n\t" "	.quad	0x27438FEBCCA86400"
+  "\n\t" "	.quad	0x4622EE8AADC90561"
+  "\n\t" "	.quad	0x815C13CE4F92DD00"
+  "\n\t" "	.quad	0x73AEE13CBD602FF2"
+
+  "\n\t" "	# decryption key schedule: invskew x*D -> invskew x*B"
+  "\n\t" "	.Lk_dks_3 = .-.Laes_consts"
+  "\n\t" "	.quad	0x03C4C50201C6C700"
+  "\n\t" "	.quad	0xF83F3EF9FA3D3CFB"
+  "\n\t" "	.quad	0xEE1921D638CFF700"
+  "\n\t" "	.quad	0xA5526A9D7384BC4B"
+
+  "\n\t" "	# decryption key schedule: invskew x*B -> invskew x*E + 0x63"
+  "\n\t" "	.Lk_dks_4 = .-.Laes_consts"
+  "\n\t" "	.quad	0xE3C390B053732000"
+  "\n\t" "	.quad	0xA080D3F310306343"
+  "\n\t" "	.quad	0xA0CA214B036982E8"
+  "\n\t" "	.quad	0x2F45AEC48CE60D67"
+
+  "\n\t" "##"
+  "\n\t" "##  Decryption stuff"
+  "\n\t" "##  Round function constants"
+  "\n\t" "##"
+  "\n\t" "	# decryption input transform"
+  "\n\t" "	.Lk_dipt = .-.Laes_consts"
+  "\n\t" "	.quad	0x0F505B040B545F00"
+  "\n\t" "	.quad	0x154A411E114E451A"
+  "\n\t" "	.quad	0x86E383E660056500"
+  "\n\t" "	.quad	0x12771772F491F194"
+
+  "\n\t" "	# decryption sbox output *9*u, *9*t"
+  "\n\t" "	.Lk_dsb9 = .-.Laes_consts"
+  "\n\t" "	.quad	0x851C03539A86D600"
+  "\n\t" "	.quad	0xCAD51F504F994CC9"
+  "\n\t" "	.quad	0xC03B1789ECD74900"
+  "\n\t" "	.quad	0x725E2C9EB2FBA565"
+
+  "\n\t" "	# decryption sbox output *D*u, *D*t"
+  "\n\t" "	.Lk_dsbd = .-.Laes_consts"
+  "\n\t" "	.quad	0x7D57CCDFE6B1A200"
+  "\n\t" "	.quad	0xF56E9B13882A4439"
+  "\n\t" "	.quad	0x3CE2FAF724C6CB00"
+  "\n\t" "	.quad	0x2931180D15DEEFD3"
+
+  "\n\t" "	# decryption sbox output *B*u, *B*t"
+  "\n\t" "	.Lk_dsbb = .-.Laes_consts"
+  "\n\t" "	.quad	0xD022649296B44200"
+  "\n\t" "	.quad	0x602646F6B0F2D404"
+  "\n\t" "	.quad	0xC19498A6CD596700"
+  "\n\t" "	.quad	0xF3FF0C3E3255AA6B"
+
+  "\n\t" "	# decryption sbox output *E*u, *E*t"
+  "\n\t" "	.Lk_dsbe = .-.Laes_consts"
+  "\n\t" "	.quad	0x46F2929626D4D000"
+  "\n\t" "	.quad	0x2242600464B4F6B0"
+  "\n\t" "	.quad	0x0C55A6CDFFAAC100"
+  "\n\t" "	.quad	0x9467F36B98593E32"
+
+  "\n\t" "	# decryption sbox final output"
+  "\n\t" "	.Lk_dsbo = .-.Laes_consts"
+  "\n\t" "	.quad	0x1387EA537EF94000"
+  "\n\t" "	.quad	0xC7AA6DB9D4943E2D"
+  "\n\t" "	.quad	0x12D7560F93441D00"
+  "\n\t" "	.quad	0xCA4B8159D8C58E9C"
+X("\n\t" ".size _aes_consts,.-_aes_consts")
+);
+
 #endif /* USE_SSSE3 */
diff --git a/configure.ac b/configure.ac
index 90688d3..7dfbd60 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2031,7 +2031,6 @@ if test "$found" = "1" ; then
 
          # Build with the SSSE3 implementation
          GCRYPT_CIPHERS="$GCRYPT_CIPHERS rijndael-ssse3-amd64.lo"
-         GCRYPT_CIPHERS="$GCRYPT_CIPHERS rijndael-ssse3-amd64-asm.lo"
       ;;
       arm*-*-*)
          # Build with the assembly implementation

-----------------------------------------------------------------------

Summary of changes:
 AUTHORS                           |   4 +-
 NEWS                              |  13 +-
 README                            |   4 +-
 cipher/Makefile.am                |   3 +-
 cipher/rijndael-ssse3-amd64-asm.S | 853 ---------------------------------
 cipher/rijndael-ssse3-amd64.c     | 977 ++++++++++++++++++++++++++++++++++----
 compat/compat.c                   |   4 +-
 configure.ac                      |   7 +-
 8 files changed, 894 insertions(+), 971 deletions(-)
 delete mode 100644 cipher/rijndael-ssse3-amd64-asm.S


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 18 18:26:11 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 18 Jan 2017 18:26:11 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-88-g34fa2d7
Message-ID: <E1cTtzy-0001ig-3H@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  34fa2d79a07a079be472c3ff486debfdac8c6070 (commit)
      from  3d356d165aed7d76a3ea811b1d24ed0a05ac90d4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 34fa2d79a07a079be472c3ff486debfdac8c6070
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 18 18:14:41 2017 +0100

    common: Fix flushing copy buffers.
    
    * common/exectool.c (copy_buffer_flush): Write and flush the data, but
    do not hide EAGAIN from the caller.
    (gnupg_exec_tool_stream): Retry on EAGAIN.
    
    GnuPG-bug-id: 2425
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/common/exectool.c b/common/exectool.c
index 4593abd..0067fc6 100644
--- a/common/exectool.c
+++ b/common/exectool.c
@@ -276,15 +276,23 @@ static gpg_error_t
 copy_buffer_flush (struct copy_buffer *c, estream_t sink)
 {
   gpg_error_t err;
+  size_t nwritten;
 
-  while (c->nread > 0)
-    {
-      err = copy_buffer_do_copy (c, NULL, sink);
-      if (err)
-        return err;
-    }
+  nwritten = 0;
+  err = es_write (sink, c->writep, c->nread, &nwritten);
+
+  assert (nwritten <= c->nread);
+  c->writep += nwritten;
+  c->nread -= nwritten;
+  assert (c->writep - c->buffer <= sizeof c->buffer);
+
+  if (err)
+    return err;
 
-  return 0;
+  if (es_fflush (sink))
+    err = my_error_from_syserror ();
+
+  return err;
 }
 
 

@@ -444,6 +452,8 @@ gnupg_exec_tool_stream (const char *pgmname, const char *argv[],
           if (es_feof (input))
             {
               err = copy_buffer_flush (cpbuf_in, fds[0].stream);
+              if (err == GPG_ERR_EAGAIN)
+                continue;	/* Retry next time.  */
               if (err)
                 {
                   log_error ("error feeding data to '%s': %s\n",
@@ -470,6 +480,8 @@ gnupg_exec_tool_stream (const char *pgmname, const char *argv[],
           if (es_feof (inextra))
             {
               err = copy_buffer_flush (cpbuf_extra, fds[3].stream);
+              if (err == GPG_ERR_EAGAIN)
+                continue;	/* Retry next time.  */
               if (err)
                 {
                   log_error ("error feeding data to '%s': %s\n",

-----------------------------------------------------------------------

Summary of changes:
 common/exectool.c | 26 +++++++++++++++++++-------
 1 file changed, 19 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 19 07:50:37 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 19 Jan 2017 07:50:37 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-89-g367349b
Message-ID: <E1cU6YR-0004O9-Lp@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  367349b4dcc97718f8ae1163d1389d2a46fc3453 (commit)
      from  34fa2d79a07a079be472c3ff486debfdac8c6070 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 367349b4dcc97718f8ae1163d1389d2a46fc3453
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Thu Jan 19 15:39:55 2017 +0900

    dirmngr: Add setup of CA for NTBTLS.
    
    * dirmngr/http.c [HTTP_USE_NTBTLS] (http_session_new): Add CA by
    ntbtls_set_ca_chain.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 75701ec..9457707 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -621,16 +621,93 @@ http_session_new (http_session_t *r_session, const char *tls_priority,
 
 #if HTTP_USE_NTBTLS
   {
+    x509_cert_t ca_chain;
+    char line[256];
+    estream_t fp, mem_p;
+    size_t nread, nbytes;
+    struct b64state state;
+    void *buf;
+    size_t buflen;
+    char *pemname;
+
     (void)tls_priority;
 
-    /* ntbtls_set_debug (99, NULL, NULL); */
+    pemname = make_filename_try (gnupg_datadir (),
+                                 "sks-keyservers.netCA.pem", NULL);
+    if (!pemname)
+      {
+        err = gpg_error_from_syserror ();
+        log_error ("setting CA from file '%s' failed: %s\n",
+                   pemname, gpg_strerror (err));
+        goto leave;
+      }
+
+    fp = es_fopen (pemname, "r");
+    if (!fp)
+      {
+        err = gpg_error_from_syserror ();
+        log_error ("can't open '%s': %s\n", pemname, gpg_strerror (err));
+        xfree (pemname);
+        goto leave;
+      }
+    xfree (pemname);
+
+    mem_p = es_fopenmem (0, "r+b");
+    err = b64dec_start (&state, "CERTIFICATE");
+    if (err)
+      {
+        log_error ("b64dec failure: %s\n", gpg_strerror (err));
+        goto leave;
+      }
+
+    while ( (nread = es_fread (line, 1, DIM (line), fp)) )
+      {
+        err = b64dec_proc (&state, line, nread, &nbytes);
+        if (err)
+          {
+            if (gpg_err_code (err) == GPG_ERR_EOF)
+              break;
+
+            log_error ("b64dec failure: %s\n", gpg_strerror (err));
+            es_fclose (fp);
+            es_fclose (mem_p);
+            goto leave;
+          }
+        else if (nbytes)
+          es_fwrite (line, 1, nbytes, mem_p);
+      }
+    err = b64dec_finish (&state);
+    if (err)
+      {
+        log_error ("b64dec failure: %s\n", gpg_strerror (err));
+        es_fclose (fp);
+        es_fclose (mem_p);
+        goto leave;
+      }
+
+    es_fclose_snatch (mem_p, &buf, &buflen);
+    es_fclose (fp);
+
+    err = ntbtls_x509_cert_new (&ca_chain);
+    if (err)
+      {
+        log_error ("ntbtls_x509_new failed: %s\n", gpg_strerror (err));
+        xfree (buf);
+        goto leave;
+      }
+
+    err = ntbtls_x509_append_cert (ca_chain, buf, buflen);
+    xfree (buf);
 
     err = ntbtls_new (&sess->tls_session, NTBTLS_CLIENT);
     if (err)
       {
         log_error ("ntbtls_new failed: %s\n", gpg_strerror (err));
+        ntbtls_x509_cert_release (ca_chain);
         goto leave;
       }
+
+    err = ntbtls_set_ca_chain (sess->tls_session, ca_chain, NULL);
   }
 #elif HTTP_USE_GNUTLS
   {

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/http.c | 79 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 78 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 19 10:01:52 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 19 Jan 2017 10:01:52 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-90-g55c9212
Message-ID: <E1cU8bT-0001Qm-Qq@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  55c9212a2338bf0b07c8cf3a69bcedaa28d48d43 (commit)
      from  367349b4dcc97718f8ae1163d1389d2a46fc3453 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 55c9212a2338bf0b07c8cf3a69bcedaa28d48d43
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 19 09:57:27 2017 +0100

    common: Clarify use of vars in buffer copy code.
    
    * common/exectool.c (my_error_from_errno): New.
    (copy_buffer_do_copy): Use separate vars for errno values and
    gpg-error values for clarity.  s/assert/log_assert/.
    (copy_buffer_flush): Ditto.
    (gnupg_exec_tool_stream): Use gpg_err_code when testing.
    --
    
    NB: It is surprising that es_write seems not to set ERRNO but only
    returns the ERRNO value.  Need to check whether this is really the
    case.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/exectool.c b/common/exectool.c
index 0067fc6..8c1f757 100644
--- a/common/exectool.c
+++ b/common/exectool.c
@@ -65,6 +65,12 @@ my_error_from_syserror (void)
   return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
 }
 
+static inline gpg_error_t
+my_error_from_errno (int rc)
+{
+  return gpg_err_make (default_errsource, gpg_err_code_from_errno (rc));
+}
+
 
 static void
 read_and_log_stderr (read_and_log_buffer_t *state, es_poll_t *fderr)
@@ -226,42 +232,44 @@ copy_buffer_shred (struct copy_buffer *c)
 static gpg_error_t
 copy_buffer_do_copy (struct copy_buffer *c, estream_t source, estream_t sink)
 {
+  int rc;
   gpg_error_t err;
   size_t nwritten = 0;
 
   if (c->nread == 0)
     {
       c->writep = c->buffer;
-      err = es_read (source, c->buffer, sizeof c->buffer, &c->nread);
-      if (err)
+      rc = es_read (source, c->buffer, sizeof c->buffer, &c->nread);
+      if (rc)
         {
-          if (errno == EAGAIN)
+          err = my_error_from_syserror ();
+          if (gpg_err_code (err) == GPG_ERR_EAGAIN)
             return 0;	/* We will just retry next time.  */
 
-          return my_error_from_syserror ();
+          return err;
         }
 
-      assert (c->nread <= sizeof c->buffer);
+      log_assert (c->nread <= sizeof c->buffer);
     }
 
   if (c->nread == 0)
     return 0;	/* Done copying.  */
 
-
   nwritten = 0;
-  err = sink? es_write (sink, c->writep, c->nread, &nwritten) : 0;
+  rc = sink? es_write (sink, c->writep, c->nread, &nwritten) : 0;
+  err = rc? my_error_from_errno (rc) : 0;
 
-  assert (nwritten <= c->nread);
+  log_assert (nwritten <= c->nread);
   c->writep += nwritten;
   c->nread -= nwritten;
-  assert (c->writep - c->buffer <= sizeof c->buffer);
+  log_assert (c->writep - c->buffer <= sizeof c->buffer);
 
   if (err)
     {
-      if (errno == EAGAIN)
+      if (gpg_err_code (err) == GPG_ERR_EAGAIN)
         return 0;	/* We will just retry next time.  */
 
-      return my_error_from_syserror ();
+      return err;
     }
 
   if (sink && es_fflush (sink) && errno != EAGAIN)
@@ -275,16 +283,18 @@ copy_buffer_do_copy (struct copy_buffer *c, estream_t source, estream_t sink)
 static gpg_error_t
 copy_buffer_flush (struct copy_buffer *c, estream_t sink)
 {
+  int rc;
   gpg_error_t err;
   size_t nwritten;
 
   nwritten = 0;
-  err = es_write (sink, c->writep, c->nread, &nwritten);
+  rc = es_write (sink, c->writep, c->nread, &nwritten);
+  err = rc? my_error_from_errno (rc) : 0;
 
-  assert (nwritten <= c->nread);
+  log_assert (nwritten <= c->nread);
   c->writep += nwritten;
   c->nread -= nwritten;
-  assert (c->writep - c->buffer <= sizeof c->buffer);
+  log_assert (c->writep - c->buffer <= sizeof c->buffer);
 
   if (err)
     return err;
@@ -452,7 +462,7 @@ gnupg_exec_tool_stream (const char *pgmname, const char *argv[],
           if (es_feof (input))
             {
               err = copy_buffer_flush (cpbuf_in, fds[0].stream);
-              if (err == GPG_ERR_EAGAIN)
+              if (gpg_err_code (err) == GPG_ERR_EAGAIN)
                 continue;	/* Retry next time.  */
               if (err)
                 {
@@ -480,7 +490,7 @@ gnupg_exec_tool_stream (const char *pgmname, const char *argv[],
           if (es_feof (inextra))
             {
               err = copy_buffer_flush (cpbuf_extra, fds[3].stream);
-              if (err == GPG_ERR_EAGAIN)
+              if (gpg_err_code (err) == GPG_ERR_EAGAIN)
                 continue;	/* Retry next time.  */
               if (err)
                 {

-----------------------------------------------------------------------

Summary of changes:
 common/exectool.c | 42 ++++++++++++++++++++++++++----------------
 1 file changed, 26 insertions(+), 16 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 19 10:41:55 2017
From: cvs at cvs.gnupg.org (by Damien Goutte-Gattat)
Date: Thu, 19 Jan 2017 10:41:55 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-91-g3daeef7
Message-ID: <E1cU9EE-0002qL-5J@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  3daeef702b2e6a42f0f396b828f86ffc3f33fc88 (commit)
      from  55c9212a2338bf0b07c8cf3a69bcedaa28d48d43 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3daeef702b2e6a42f0f396b828f86ffc3f33fc88
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Wed Jan 18 18:52:12 2017 +0100

    gpg: Allow to freeze faked system time.
    
    * g10/gpg.c (main): If the parameter for --faked-system-time
    ends with a '!', freeze time at the specified point.
    * common/gettime.c (gnupg_set_time): Allow to freeze the time
    at an arbitrary time instead of only the current time.
    * doc/gpg.texi: Update documentation for --faked-system-time.
    --
    
    This patch allows the user to modify the behavior of the
    --faked-system-time option: by appending a '!' to the parameter,
    time in GnuPG will be frozen at the specified time, instead of
    advancing normally from that time onward.
    
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/common/gettime.c b/common/gettime.c
index e5da4fb..3e1ee55 100644
--- a/common/gettime.c
+++ b/common/gettime.c
@@ -133,7 +133,7 @@ gnupg_set_time (time_t newtime, int freeze)
   else if (freeze)
     {
       timemode = FROZEN;
-      timewarp = current;
+      timewarp = newtime == (time_t)-1 ? current : newtime;
     }
   else if (newtime > current)
     {
diff --git a/doc/gpg.texi b/doc/gpg.texi
index 4ea2cd2..044ba37 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -2748,6 +2748,9 @@ forth to @var{epoch} which is the number of seconds elapsed since the year
 1970.  Alternatively @var{epoch} may be given as a full ISO time string
 (e.g. "20070924T154812").
 
+If you suffix @var{epoch} with an exclamation mark (!), the system time
+will appear to be frozen at the specified time.
+
 @item --enable-progress-filter
 @opindex enable-progress-filter
 Enable certain PROGRESS status outputs. This option allows frontends
diff --git a/g10/gpg.c b/g10/gpg.c
index 8c5b505..f9039ae 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -3493,10 +3493,20 @@ main (int argc, char **argv)
 
           case oFakedSystemTime:
             {
-              time_t faked_time = isotime2epoch (pargs.r.ret_str);
+              size_t len = strlen (pargs.r.ret_str);
+              int freeze = 0;
+              time_t faked_time;
+
+              if (len > 0 && pargs.r.ret_str[len-1] == '!')
+                {
+                  freeze = 1;
+                  pargs.r.ret_str[len-1] = '\0';
+                }
+
+              faked_time = isotime2epoch (pargs.r.ret_str);
               if (faked_time == (time_t)(-1))
                 faked_time = (time_t)strtoul (pargs.r.ret_str, NULL, 10);
-              gnupg_set_time (faked_time, 0);
+              gnupg_set_time (faked_time, freeze);
             }
             break;
 

-----------------------------------------------------------------------

Summary of changes:
 common/gettime.c |  2 +-
 doc/gpg.texi     |  3 +++
 g10/gpg.c        | 14 ++++++++++++--
 3 files changed, 16 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 19 13:00:01 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 19 Jan 2017 13:00:01 +0100
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.26-8-g55c4979
Message-ID: <E1cUBNr-0000mz-Ff@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  55c497904dd0794ca5cfcafe369943736b0d4e62 (commit)
      from  66275ac5b8db9d83a72b5497eec4e6d9ac3b4e65 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 55c497904dd0794ca5cfcafe369943736b0d4e62
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 19 12:55:44 2017 +0100

    estream: Correctly set ERRNO to EOPNOTSUPP.
    
    * src/estream.c (es_flush, es_write_nbf): Fix setting of ERRNO to
    EOPNOTSUPP.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/estream.c b/src/estream.c
index 58d5d03..045182b 100644
--- a/src/estream.c
+++ b/src/estream.c
@@ -1886,7 +1886,8 @@ es_flush (estream_t stream)
 
       if (! func_write)
 	{
-	  err = EOPNOTSUPP;
+          _set_errno (EOPNOTSUPP);
+          err = -1;
 	  goto out;
 	}
 
@@ -2555,7 +2556,8 @@ es_write_nbf (estream_t _GPGRT__RESTRICT stream,
 
   if (bytes_to_write && (! func_write))
     {
-      err = EOPNOTSUPP;
+      _set_errno (EOPNOTSUPP);
+      err = -1;
       goto out;
     }
 

-----------------------------------------------------------------------

Summary of changes:
 src/estream.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 19 17:00:32 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 19 Jan 2017 17:00:32 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-93-ge926f30
Message-ID: <E1cUF8d-0002a5-Ne@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e926f30a1cda75f6334b79c303b5134f0441a3dc (commit)
       via  e031b3c16cfec583c4322c84d299b355f0849c77 (commit)
      from  3daeef702b2e6a42f0f396b828f86ffc3f33fc88 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e926f30a1cda75f6334b79c303b5134f0441a3dc
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 19 15:01:44 2017 +0100

    build: Print a commit id in the generated ChangeLog
    
    * build-aux/gitlog-to-changelog: Print an extra line with the commit
    id.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/build-aux/gitlog-to-changelog b/build-aux/gitlog-to-changelog
index 24a3d72..f70f499 100755
--- a/build-aux/gitlog-to-changelog
+++ b/build-aux/gitlog-to-changelog
@@ -179,6 +179,7 @@ sub parse_amend_file($)
   my $amend_file;
   my $append_dot = 0;
   my $tear_off = 0;
+  my $firstline;
   GetOptions
     (
      help => sub { usage 0 },
@@ -338,7 +339,9 @@ sub parse_amend_file($)
           # Prefix each non-empty line with a TAB.
           @line = map { length $_ ? "\t$_" : '' } @line;
 
-          print "\n", join ("\n", @line), "\n";
+          $firstline = shift @line;
+          print "\n", $firstline, "\n", "\t+ commit $sha\n";
+          print join ("\n", @line), "\n";
         }
 
     SKIPCOMMIT:

commit e031b3c16cfec583c4322c84d299b355f0849c77
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jan 19 14:58:23 2017 +0100

    common: Fix buffer copy code again.
    
    * common/exectool.c (my_error_from_errno): Remove.
    (copy_buffer_do_copy): Do without var RC.
    (copy_buffer_flush): Ditto.  Use ERRNO instead of es_write return
    code.
    (gnupg_exec_tool): Correctly return errors from es_read.
    --
    
    Fixes-commit: 55c9212a2338bf0b07c8cf3a69bcedaa28d48d43
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/exectool.c b/common/exectool.c
index 8c1f757..ed8225a 100644
--- a/common/exectool.c
+++ b/common/exectool.c
@@ -65,12 +65,6 @@ my_error_from_syserror (void)
   return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
 }
 
-static inline gpg_error_t
-my_error_from_errno (int rc)
-{
-  return gpg_err_make (default_errsource, gpg_err_code_from_errno (rc));
-}
-
 
 static void
 read_and_log_stderr (read_and_log_buffer_t *state, es_poll_t *fderr)
@@ -232,15 +226,13 @@ copy_buffer_shred (struct copy_buffer *c)
 static gpg_error_t
 copy_buffer_do_copy (struct copy_buffer *c, estream_t source, estream_t sink)
 {
-  int rc;
   gpg_error_t err;
   size_t nwritten = 0;
 
   if (c->nread == 0)
     {
       c->writep = c->buffer;
-      rc = es_read (source, c->buffer, sizeof c->buffer, &c->nread);
-      if (rc)
+      if (es_read (source, c->buffer, sizeof c->buffer, &c->nread))
         {
           err = my_error_from_syserror ();
           if (gpg_err_code (err) == GPG_ERR_EAGAIN)
@@ -256,8 +248,10 @@ copy_buffer_do_copy (struct copy_buffer *c, estream_t source, estream_t sink)
     return 0;	/* Done copying.  */
 
   nwritten = 0;
-  rc = sink? es_write (sink, c->writep, c->nread, &nwritten) : 0;
-  err = rc? my_error_from_errno (rc) : 0;
+  if (sink && es_write (sink, c->writep, c->nread, &nwritten))
+    err = my_error_from_syserror ();
+  else
+    err = 0;
 
   log_assert (nwritten <= c->nread);
   c->writep += nwritten;
@@ -283,13 +277,11 @@ copy_buffer_do_copy (struct copy_buffer *c, estream_t source, estream_t sink)
 static gpg_error_t
 copy_buffer_flush (struct copy_buffer *c, estream_t sink)
 {
-  int rc;
-  gpg_error_t err;
-  size_t nwritten;
+  gpg_error_t err = 0;
+  size_t nwritten = 0;
 
-  nwritten = 0;
-  rc = es_write (sink, c->writep, c->nread, &nwritten);
-  err = rc? my_error_from_errno (rc) : 0;
+  if (es_write (sink, c->writep, c->nread, &nwritten))
+    err = my_error_from_syserror ();
 
   log_assert (nwritten <= c->nread);
   c->writep += nwritten;
@@ -628,9 +620,11 @@ gnupg_exec_tool (const char *pgmname, const char *argv[],
 
   if (len)
     {
-      err = es_read (output, *result, len, &nread);
-      if (err)
-        goto leave;
+      if (es_read (output, *result, len, &nread))
+        {
+          err = my_error_from_syserror ();
+          goto leave;
+        }
       if (nread != len)
         log_fatal ("%s: short read from memstream\n", __func__);
     }

-----------------------------------------------------------------------

Summary of changes:
 build-aux/gitlog-to-changelog |  5 ++++-
 common/exectool.c             | 34 ++++++++++++++--------------------
 2 files changed, 18 insertions(+), 21 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 20 04:06:18 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 20 Jan 2017 04:06:18 +0100
Subject: [git] NTBTLS - branch, master,
 updated. 876e1b298022b84277890036b84d3d94452c9a1e
Message-ID: <E1cUPWu-0005NS-Ur@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Not Too Bad TLS".

The branch, master has been updated
       via  876e1b298022b84277890036b84d3d94452c9a1e (commit)
      from  2832bfe5373fc1967e0af5d71f9db6af4e35059c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 876e1b298022b84277890036b84d3d94452c9a1e
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 20 12:03:53 2017 +0900

    Add src/versioninfo.rc.in.
    
    * src/versioninfo.rc.in: New.
    * src/Makefile.am (EXTRA_DIST): Add versioninfo.rc.in.
    * configure.ac: Add versioninfo.rc output.
    
    --
    The file is copied from libassuan and edited.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/configure.ac b/configure.ac
index 239a999..29ea3ac 100644
--- a/configure.ac
+++ b/configure.ac
@@ -677,6 +677,7 @@ m4/Makefile
 src/Makefile
 src/ntbtls.h
 src/ntbtls-config
+src/versioninfo.rc
 ])
 AC_CONFIG_COMMANDS([ntbtls-conf],[[
 chmod +x src/ntbtls-config
diff --git a/src/Makefile.am b/src/Makefile.am
index a314ca0..88895ab 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -18,7 +18,8 @@
 
 ## Process this file with automake to produce Makefile.in
 
-EXTRA_DIST = ntbtls.h.in ntbtls.m4 libntbtls.vers libntbtls.def
+EXTRA_DIST = ntbtls.h.in ntbtls.m4 libntbtls.vers libntbtls.def \
+             versioninfo.rc.in
 bin_SCRIPTS = ntbtls-config
 include_HEADERS = ntbtls.h
 lib_LTLIBRARIES = libntbtls.la
diff --git a/src/versioninfo.rc.in b/src/versioninfo.rc.in
new file mode 100644
index 0000000..afbbe02
--- /dev/null
+++ b/src/versioninfo.rc.in
@@ -0,0 +1,51 @@
+/* versioninfo.rc.in - for ntbtls
+ *    Copyright (C) 2005, 2017 g10 Code GmbH
+ *
+ * This file is free software; as a special exception the author gives
+ * unlimited permission to copy and/or distribute it, with or without
+ * modifications, as long as this notice is preserved.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
+ * implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+/* This file is processed by configure to create versioninfo.rc */
+
+#line __LINE__ "versioninfo.rc.in"
+
+#include <afxres.h>
+
+
+VS_VERSION_INFO VERSIONINFO
+ FILEVERSION @BUILD_FILEVERSION@
+ PRODUCTVERSION @BUILD_FILEVERSION@
+ FILEFLAGSMASK 0x3fL
+#ifdef _DEBUG
+ FILEFLAGS 0x21L
+#else
+ FILEFLAGS 0x20L
+#endif
+ FILEOS 0x40004L
+ FILETYPE 0x1L
+ FILESUBTYPE 0x0L
+BEGIN
+    BLOCK "StringFileInfo"
+    BEGIN
+        BLOCK "040904b0"
+        BEGIN
+            VALUE "Comments", "Provided under the terms of the GNU General Public License (GPLv3+).\0"
+            VALUE "CompanyName", "g10 Code GmbH\0"
+            VALUE "FileDescription", "ntbtls - Not Too Bad Transport Layer Security\0"
+            VALUE "FileVersion", "@LIBNTBTLS_LT_CURRENT at .@LIBNTBTLS_LT_AGE at .@LIBNTBTLS_LT_REVISION at .@BUILD_REVISION@\0"
+            VALUE "InternalName", "libntbtls\0"
+            VALUE "LegalCopyright", "Copyright ? 2006-2014 Brainspark B.V., Copyright ? 2014-2015 g10 Code GmbH\0"
+            VALUE "LegalTrademarks", "\0"
+            VALUE "OriginalFilename", "libntbtls.dll\0"
+            VALUE "PrivateBuild", "\0"
+            VALUE "ProductName", "ntbtls\0"
+            VALUE "ProductVersion", "@VERSION@\0"
+            VALUE "SpecialBuild", "@BUILD_TIMESTAMP@\0"
+        END
+    END
+END

-----------------------------------------------------------------------

Summary of changes:
 configure.ac          |  1 +
 src/Makefile.am       |  3 ++-
 src/versioninfo.rc.in | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 54 insertions(+), 1 deletion(-)
 create mode 100644 src/versioninfo.rc.in


hooks/post-receive
-- 
Not Too Bad TLS
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 20 04:29:23 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 20 Jan 2017 04:29:23 +0100
Subject: [git] NTBTLS - branch, master,
 updated. 33f3b5f298ded3c34b65bc08ee714294c9918411
Message-ID: <E1cUPtF-00061j-1Q@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Not Too Bad TLS".

The branch, master has been updated
       via  33f3b5f298ded3c34b65bc08ee714294c9918411 (commit)
      from  876e1b298022b84277890036b84d3d94452c9a1e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 33f3b5f298ded3c34b65bc08ee714294c9918411
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 20 12:28:35 2017 +0900

    Fix ntbtls-cli.c for Windows.
    
    * src/ntbtls-cli.c: Include files fix.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/src/ntbtls-cli.c b/src/ntbtls-cli.c
index 46264cf..29b2784 100644
--- a/src/ntbtls-cli.c
+++ b/src/ntbtls-cli.c
@@ -25,10 +25,18 @@
 
 #include <unistd.h>
 #include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <netdb.h>
+#ifdef HAVE_W32_SYSTEM
+# define WIN32_LEAN_AND_MEAN
+# ifdef HAVE_WINSOCK2_H
+#  include <winsock2.h>
+# endif
+# include <windows.h>
+#else
+# include <sys/socket.h>
+# include <netinet/in.h>
+# include <arpa/inet.h>
+# include <netdb.h>
+#endif
 
 #include "ntbtls.h"
 

-----------------------------------------------------------------------

Summary of changes:
 src/ntbtls-cli.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
Not Too Bad TLS
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 20 05:14:27 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 20 Jan 2017 05:14:27 +0100
Subject: [git] NTBTLS - branch, master,
 updated. af472e2554bf8b8ed0c3387a7625a65792e85ffb
Message-ID: <E1cUQar-0007oi-Ns@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Not Too Bad TLS".

The branch, master has been updated
       via  af472e2554bf8b8ed0c3387a7625a65792e85ffb (commit)
      from  33f3b5f298ded3c34b65bc08ee714294c9918411 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit af472e2554bf8b8ed0c3387a7625a65792e85ffb
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 20 13:13:02 2017 +0900

    configure: Add check for sys/socket.
    
    * configure.ac (gl_HEADER_SYS_SOCKET): Add.
    * m4/sys_socket_h.m4: New from gnupg.
    * src/Makefile.am (libntbtls_la_LIBADD, ntbtls_cli_LDADD): Fix.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/configure.ac b/configure.ac
index 29ea3ac..fec870a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -321,6 +321,8 @@ AC_TYPE_MODE_T
 AC_TYPE_SIGNAL
 AC_DECL_SYS_SIGLIST
 
+gl_HEADER_SYS_SOCKET
+
 # For some systems we know that we have ld_version scripts.
 # Use it then as default.
 have_ld_version_script=no
diff --git a/m4/sys_socket_h.m4 b/m4/sys_socket_h.m4
new file mode 100644
index 0000000..d3e45b4
--- /dev/null
+++ b/m4/sys_socket_h.m4
@@ -0,0 +1,23 @@
+# sys_socket_h.m4 serial 2
+dnl Copyright (C) 2005, 2006 Free Software Foundation, Inc.
+dnl This file is free software; the Free Software Foundation
+dnl gives unlimited permission to copy and/or distribute it,
+dnl with or without modifications, as long as this notice is preserved.
+
+dnl From Simon Josefsson.
+
+AC_DEFUN([gl_HEADER_SYS_SOCKET],
+[
+  AC_CHECK_HEADERS_ONCE([sys/socket.h])
+  if test $ac_cv_header_sys_socket_h = yes; then
+    SYS_SOCKET_H=''
+  else
+    dnl We cannot use AC_CHECK_HEADERS_ONCE here, because that would make
+    dnl the check for those headers unconditional; yet cygwin reports
+    dnl that the headers are present but cannot be compiled (since on
+    dnl cygwin, all socket information should come from sys/socket.h).
+    AC_CHECK_HEADERS([winsock2.h ws2tcpip.h])
+    SYS_SOCKET_H='sys/socket.h'
+  fi
+  AC_SUBST(SYS_SOCKET_H)
+])
diff --git a/src/Makefile.am b/src/Makefile.am
index 88895ab..d0fa8a2 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -75,7 +75,7 @@ libntbtls_la_LDFLAGS = $(no_undefined) $(export_symbols) \
       @LIBNTBTLS_LT_CURRENT@:@LIBNTBTLS_LT_REVISION@:@LIBNTBTLS_LT_AGE@
 libntbtls_la_INCLUDES = -I$(top_srcdir)/lib
 libntbtls_la_DEPENDENCIES = $(srcdir)/libntbtls.vers $(ntbtls_deps)
-libntbtls_la_LIBADD = $(ntbtls_res) @LTLIBOBJS@ @GPG_ERROR_LIBS@
+libntbtls_la_LIBADD = $(ntbtls_res) @LTLIBOBJS@ @LIBGCRYPT_LIBS@ @KSBA_LIBS@ @GPG_ERROR_LIBS@ @NETLIBS@
 
 
 libntbtls_la_SOURCES = \
@@ -100,4 +100,4 @@ uninstall-local: uninstall-def-file
 
 ntbtls_cli_CFLAGS = @LIBGCRYPT_CFLAGS@ @KSBA_CFLAGS@ @GPG_ERROR_CFLAGS@
 ntbtls_cli_LDFLAGS = -no-install
-ntbtls_cli_LDADD = libntbtls.la @LIBGCRYPT_LIBS@ @KSBA_LIBS@ @GPG_ERROR_LIBS@
+ntbtls_cli_LDADD = libntbtls.la @LIBGCRYPT_LIBS@ @KSBA_LIBS@ @GPG_ERROR_LIBS@ @NETLIBS@

-----------------------------------------------------------------------

Summary of changes:
 configure.ac       |  2 ++
 m4/sys_socket_h.m4 | 23 +++++++++++++++++++++++
 src/Makefile.am    |  4 ++--
 3 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 m4/sys_socket_h.m4


hooks/post-receive
-- 
Not Too Bad TLS
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 08:14:41 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Mon, 23 Jan 2017 08:14:41 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-94-g21c9ebb
Message-ID: <E1cVYpw-0006FP-W1@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  21c9ebb908c2ad2e322e7a13e59e5880494c4d67 (commit)
      from  e926f30a1cda75f6334b79c303b5134f0441a3dc (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 21c9ebb908c2ad2e322e7a13e59e5880494c4d67
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jan 23 16:12:41 2017 +0900

    scd: Fix INTERRUPT transfer.
    
    * scd/ccid-driver.c (find_endpoint): Don't return Bulk endpoint as
    Interrupt endpoint.
    (ccid_poll): Call libusb_interrupt_transfer.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index 5e02628..b7f97ed 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -1100,8 +1100,9 @@ find_endpoint (const struct libusb_interface_descriptor *ifcdesc, int mode)
                    == LIBUSB_TRANSFER_TYPE_INTERRUPT)
                && (ep->bEndpointAddress & 0x80))
         return ep->bEndpointAddress;
-      else if (((ep->bmAttributes & LIBUSB_TRANSFER_TYPE_MASK)
-                == LIBUSB_TRANSFER_TYPE_BULK)
+      else if ((mode == 0 || mode == 1)
+               && ((ep->bmAttributes & LIBUSB_TRANSFER_TYPE_MASK)
+                   == LIBUSB_TRANSFER_TYPE_BULK)
                && (ep->bEndpointAddress & 0x80) == want_bulk_in)
         return ep->bEndpointAddress;
     }
@@ -2459,9 +2460,9 @@ ccid_poll (ccid_driver_t handle)
 
   if (handle->idev)
     {
-      rc = libusb_bulk_transfer (handle->idev, handle->ep_intr,
-                                 (char*)msg, sizeof msg, &msglen,
-                                 0 /* ms timeout */ );
+      rc = libusb_interrupt_transfer (handle->idev, handle->ep_intr,
+                                      (char*)msg, sizeof msg, &msglen,
+                                      0 /* ms timeout */ );
       if (rc == LIBUSB_ERROR_TIMEOUT)
         return 0;
     }

-----------------------------------------------------------------------

Summary of changes:
 scd/ccid-driver.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 10:37:31 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 23 Jan 2017 10:37:31 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-96-g65ed117
Message-ID: <E1cVb4B-0004Rb-A5@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  65ed117ac0cc5f567eca78168d5931168c4880bc (commit)
       via  953d4ec6afd1b42feb7465ee57e48d72f033019a (commit)
      from  21c9ebb908c2ad2e322e7a13e59e5880494c4d67 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 65ed117ac0cc5f567eca78168d5931168c4880bc
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 10:33:11 2017 +0100

    po: Fixes to the German translation
    
    --
    
    Justus reported that the German translation for the key listing in
    --edit-key does "usage: E" -> "Aufruf: E" which is clearly wrong.  It
    turnd out that this translation was once marked as fuzzy and
    accidentally unfuzzied by me.
    
       "Aufruf" (bug) -> "Nutzung"
       "Leistungsf?higkeit" -> "Nutzung"
       "Signaturf?higkeit" -> "Signaturnutzbarkeit" etc.
    
    The last two are in the key generation menu.  Also changed the key
    code for "Umschalten der Signaturnutzbarkeit" from "U" to "S".
    
    "Nutzung" is here better than "F?higkeit" because the latter is more
    connected to the property of the algorithm, where the former better
    expresses an arbitrary choice.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/po/de.po b/po/de.po
index feac198..95485b3 100644
--- a/po/de.po
+++ b/po/de.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg-2.1.0\n"
 "Report-Msgid-Bugs-To: translations at gnupg.org\n"
-"PO-Revision-Date: 2016-12-20 11:14+0100\n"
+"PO-Revision-Date: 2017-01-23 10:22+0100\n"
 "Last-Translator: Werner Koch <wk at gnupg.org>\n"
 "Language-Team: German <de at li.org>\n"
 "Language: de\n"
@@ -3423,7 +3423,7 @@ msgstr "verf?llt: %s"
 
 #, c-format
 msgid "usage: %s"
-msgstr "Aufruf: %s"
+msgstr "Nutzung: %s"
 
 msgid "card-no: "
 msgstr "Kartennummer:"
@@ -3760,7 +3760,7 @@ msgstr "Authentisierung"
 #. q = Finish
 #.
 msgid "SsEeAaQq"
-msgstr "UuVvAaQq"
+msgstr "SsVvAaQq"
 
 #, c-format
 msgid "Possible actions for a %s key: "
@@ -3771,15 +3771,15 @@ msgstr "Derzeit erlaubte Vorg?nge: "
 
 #, c-format
 msgid "   (%c) Toggle the sign capability\n"
-msgstr "   (%c) Umschalten der Signaturf?higkeit\n"
+msgstr "   (%c) Umschalten der Signaturnutzbarkeit\n"
 
 #, c-format
 msgid "   (%c) Toggle the encrypt capability\n"
-msgstr "   (%c) Umschalten der Verschl?sselungsf?higkeit\n"
+msgstr "   (%c) Umschalten der Verschl?sselungsnutzbarkeit\n"
 
 #, c-format
 msgid "   (%c) Toggle the authenticate capability\n"
-msgstr "   (%c) Umschalten der Authentisierungsf?higkeit\n"
+msgstr "   (%c) Umschalten der Authentisierungsnutzbarkeit\n"
 
 #, c-format
 msgid "   (%c) Finished\n"
@@ -3814,11 +3814,11 @@ msgstr "   (%d) RSA (nur verschl?sseln)\n"
 
 #, c-format
 msgid "   (%d) DSA (set your own capabilities)\n"
-msgstr "   (%d) DSA (Leistungsf?higkeit selber einstellbar)\n"
+msgstr "   (%d) DSA (Nutzung selber einstellbar)\n"
 
 #, c-format
 msgid "   (%d) RSA (set your own capabilities)\n"
-msgstr "   (%d) RSA (Leistungsf?higkeit selber einstellbar)\n"
+msgstr "   (%d) RSA (Nutzung selber einstellbar)\n"
 
 #, c-format
 msgid "   (%d) ECC and ECC\n"
@@ -3830,7 +3830,7 @@ msgstr "  (%d) ECC (nur signieren)\n"
 
 #, c-format
 msgid "  (%d) ECC (set your own capabilities)\n"
-msgstr "  (%d) ECC (Leistungsf?higkeit selber einstellbar)\n"
+msgstr "  (%d) ECC (Nutzung selber einstellbar)\n"
 
 #, c-format
 msgid "  (%d) ECC (encrypt only)\n"

commit 953d4ec6afd1b42feb7465ee57e48d72f033019a
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 10:12:18 2017 +0100

    gpg: New export and import options "backup" and "restore".
    
    * g10/export.c (parse_export_options): Add "backup" and its alias
    "export-backup".
    (do_export_one_keyblock): Export ring trust packets in backup mode.
    * g10/import.c (parse_import_options): Add "restore" and its alias
    "import-restore".
    (read_block): Import ring trust packets.
    --
    
    These options are intended to, well, backup and restore keys between
    GnuPG implementations.  These options may eventually be enhanced to
    backup and restore all public key related information.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 044ba37..8e1a5e6 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -2283,6 +2283,12 @@ opposite meaning. The options are:
   the most recent self-signature on each user ID. This option is the
   same as running the @option{--edit-key} command "minimize" after import.
   Defaults to no.
+
+  @item restore
+  @itemx import-restore
+  Import in key restore mode.  This imports all data which is usually
+  skipped during import; including all GnuPG specific data.  All other
+  contradicting options are overridden.
 @end table
 
 @item --import-filter @code{@var{name}=@var{expr}}
@@ -2393,6 +2399,13 @@ opposite meaning. The options are:
   @c when the exported subkey is to be used on an unattended machine where
   @c a passphrase doesn't necessarily make sense. Defaults to no.
 
+  @item backup
+  @itemx export-backup
+  Export for use as a backup.  The exported data includes all data
+  which is needed to restore the key or keys later with GnuPG.  The
+  format is basically the OpenPGP format but enhanced with GnuPG
+  specific data.  All other contradicting options are overridden.
+
   @item export-clean
   Compact (remove all signatures from) user IDs on the key being
   exported if the user IDs are not usable. Also, do not export any
diff --git a/g10/export.c b/g10/export.c
index b36200a..f354ca0 100644
--- a/g10/export.c
+++ b/g10/export.c
@@ -116,6 +116,10 @@ parse_export_options(char *str,unsigned int *options,int noisy)
       {"export-pka", EXPORT_PKA_FORMAT, NULL, NULL },
       {"export-dane", EXPORT_DANE_FORMAT, NULL, NULL },
 
+      {"backup", EXPORT_BACKUP, NULL,
+       N_("use the GnuPG key backup format")},
+      {"export-backup", EXPORT_BACKUP, NULL, NULL },
+
       /* Aliases for backward compatibility */
       {"include-local-sigs",EXPORT_LOCAL_SIGS,NULL,NULL},
       {"include-attributes",EXPORT_ATTRIBUTES,NULL,NULL},
@@ -127,8 +131,18 @@ parse_export_options(char *str,unsigned int *options,int noisy)
       {NULL,0,NULL,NULL}
       /* add tags for include revoked and disabled? */
     };
+  int rc;
 
-  return parse_options(str,options,export_opts,noisy);
+  rc = parse_options (str, options, export_opts, noisy);
+  if (rc && (*options & EXPORT_BACKUP))
+    {
+      /* Alter other options we want or don't want for restore.  */
+      *options |= (EXPORT_LOCAL_SIGS | EXPORT_ATTRIBUTES
+                   | EXPORT_SENSITIVE_REVKEYS);
+      *options &= ~(EXPORT_CLEAN | EXPORT_MINIMAL
+                    | EXPORT_PKA_FORMAT | EXPORT_DANE_FORMAT);
+    }
+  return rc;
 }
 
 
@@ -1535,8 +1549,9 @@ do_export_one_keyblock (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid,
       if (node->pkt->pkttype == PKT_COMMENT)
         continue;
 
-      /* Make sure that ring_trust packets never get exported. */
-      if (node->pkt->pkttype == PKT_RING_TRUST)
+      /* Make sure that ring_trust packets are only exported in backup
+       * mode. */
+      if (node->pkt->pkttype == PKT_RING_TRUST && !(options & EXPORT_BACKUP))
         continue;
 
       /* If exact is set, then we only export what was requested
diff --git a/g10/import.c b/g10/import.c
index 1ed11bf..b6c04dc 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -175,6 +175,10 @@ parse_import_options(char *str,unsigned int *options,int noisy)
       {"import-export", IMPORT_EXPORT, NULL,
        N_("run import filters and export key immediately")},
 
+      {"restore", IMPORT_RESTORE, NULL,
+       N_("assume the GnuPG key backup format")},
+      {"import-restore", IMPORT_RESTORE, NULL, NULL},
+
       /* Aliases for backward compatibility */
       {"allow-local-sigs",IMPORT_LOCAL_SIGS,NULL,NULL},
       {"repair-hkp-subkey-bug",IMPORT_REPAIR_PKS_SUBKEY_BUG,NULL,NULL},
@@ -186,8 +190,18 @@ parse_import_options(char *str,unsigned int *options,int noisy)
                                             the new design.  */
       {NULL,0,NULL,NULL}
     };
+  int rc;
 
-  return parse_options(str,options,import_opts,noisy);
+  rc = parse_options (str, options, import_opts, noisy);
+  if (rc && (*options & IMPORT_RESTORE))
+    {
+      /* Alter other options we want or don't want for restore.  */
+      *options |= (IMPORT_LOCAL_SIGS | IMPORT_KEEP_OWNERTTRUST);
+      *options &= ~(IMPORT_MINIMAL | IMPORT_CLEAN
+                    | IMPORT_REPAIR_PKS_SUBKEY_BUG
+                    | IMPORT_MERGE_ONLY);
+    }
+  return rc;
 }
 
 
@@ -833,7 +847,9 @@ read_block( IOBUF a, PACKET **pending_pkt, kbnode_t *ret_root, int *r_v3keys)
 	    break;
 
           case PKT_RING_TRUST:
-            /* Skip those packets.  */
+            /* Skip those packets unless we are in restore mode.  */
+            if ((opt.import_options & IMPORT_RESTORE))
+              goto x_default;
 	    free_packet( pkt );
 	    init_packet(pkt);
             break;
@@ -848,6 +864,7 @@ read_block( IOBUF a, PACKET **pending_pkt, kbnode_t *ret_root, int *r_v3keys)
               }
 	    in_cert = 1;
 	  default:
+          x_default:
 	    if (in_cert && valid_keyblock_packet (pkt->pkttype))
               {
 		if (!root )
diff --git a/g10/options.h b/g10/options.h
index 589b68e..88a8f32 100644
--- a/g10/options.h
+++ b/g10/options.h
@@ -349,6 +349,7 @@ EXTERN_UNLESS_MAIN_MODULE int memory_stat_debug_mode;
 #define IMPORT_NO_SECKEY                 (1<<7)
 #define IMPORT_KEEP_OWNERTTRUST          (1<<8)
 #define IMPORT_EXPORT                    (1<<9)
+#define IMPORT_RESTORE                   (1<<10)
 
 #define EXPORT_LOCAL_SIGS                (1<<0)
 #define EXPORT_ATTRIBUTES                (1<<1)
@@ -358,6 +359,7 @@ EXTERN_UNLESS_MAIN_MODULE int memory_stat_debug_mode;
 #define EXPORT_CLEAN                     (1<<5)
 #define EXPORT_PKA_FORMAT                (1<<6)
 #define EXPORT_DANE_FORMAT               (1<<7)
+#define EXPORT_BACKUP                    (1<<10)
 
 #define LIST_SHOW_PHOTOS                 (1<<0)
 #define LIST_SHOW_POLICY_URLS            (1<<1)

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi  | 13 +++++++++++++
 g10/export.c  | 21 ++++++++++++++++++---
 g10/import.c  | 21 +++++++++++++++++++--
 g10/options.h |  2 ++
 po/de.po      | 18 +++++++++---------
 5 files changed, 61 insertions(+), 14 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 11:06:06 2017
From: cvs at cvs.gnupg.org (by Phil Pennock)
Date: Mon, 23 Jan 2017 11:06:06 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-99-g88ade47
Message-ID: <E1cVbVp-0005qb-V6@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  88ade475c56ac3712d6bd6d41ae38e1421dcb320 (commit)
       via  b3e7a112e0c3536f12a9425a547d4a1c77db8b3c (commit)
       via  a85731ada2d361eacddc5ae92f80d34792dd4b5e (commit)
      from  65ed117ac0cc5f567eca78168d5931168c4880bc (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 88ade475c56ac3712d6bd6d41ae38e1421dcb320
Author: Phil Pennock <gnupg-devel at spodhuis.org>
Date:   Thu Jan 19 01:21:42 2017 -0500

    dirmngr: Handle missing nsswitch.conf.
    
    * dirmngr/dns-stuff.c (libdns_init): Fallback to files,dns.
    
    --
    
    Signed-off-by: Phil Pennock <phil at pennock-tech.com>
    
    ChangeLog entry by wk.
    
    This fixed the problem:
    
      Short version: macOS doesn't include /etc/nsswitch.conf and GnuPG's
      dirmngr is hard-erroring when that file is missing, such that no DNS
      operations succeed and --recv-key returns ENOENT type errors to the
      caller.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 28ecb18..eae888b 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -478,7 +478,16 @@ libdns_init (void)
       if (err)
         {
           log_error ("failed to load '%s': %s\n", fname, gpg_strerror (err));
-          goto leave;
+          /* not fatal, nsswitch.conf is not used on all systems; assume
+           * classic behavior instead.  Our dns library states "bf" which tries
+           * DNS then Files, which is not classic; FreeBSD
+           * /usr/src/lib/libc/net/gethostnamadr.c defines default_src[] which
+           * is Files then DNS, which is. */
+          log_debug ("dns: fallback resolution order, files then DNS");
+          ld.resolv_conf->lookup[0] = 'f';
+          ld.resolv_conf->lookup[1] = 'b';
+          ld.resolv_conf->lookup[2] = '\0';
+          err = GPG_ERR_NO_ERROR;
         }
 
 #endif /* Unix */

commit b3e7a112e0c3536f12a9425a547d4a1c77db8b3c
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 10:54:39 2017 +0100

    dco: Register Phil Pennock.
    
    --

diff --git a/AUTHORS b/AUTHORS
index 50b2095..1054b89 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -204,6 +204,10 @@ Yann E. MORIN <yann.morin.1998 at free.fr>
 Arnaud Fontaine <arnaud.fontaine at ssi.gouv.fr>
 2016-10-17:580484F4.8040806 at ssi.gouv.fr:
 
+Phil Pennock <phil.pennock at spodhuis.org>
+Phil Pennock <phil at pennock-tech.com>
+2017-01-19:20170119061225.GA26207 at breadbox.private.spodhuis.org:
+
 
 Other authors
 =============

commit a85731ada2d361eacddc5ae92f80d34792dd4b5e
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Tue Jan 17 20:42:09 2017 +0100

    gpg: Fix misleading log message when checking regexp.
    
    * src/trustdb.c (check_regexp): Correctly print whether the
    regexp matched or not.
    --
    
    This patch fixes the log message displayed when gpg attempts to
    match the regexp associated with a trust signature with an user ID.
    The current message interprets the 'ret' variable backwards, and
    displays 'YES' when the regexp actually fails to match.
    
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/g10/trustdb.c b/g10/trustdb.c
index c113b7e..75714ab 100644
--- a/g10/trustdb.c
+++ b/g10/trustdb.c
@@ -1550,14 +1550,14 @@ check_regexp(const char *expr,const char *string)
       {
 	ret=regexec(&pat,string,0,NULL,0);
 	regfree(&pat);
-	ret=(ret==0);
       }
+    ret=(ret==0);
   }
 #endif
 
   if(DBG_TRUST)
     log_debug("regexp '%s' ('%s') on '%s': %s\n",
-	      regexp,expr,string,ret==0?"YES":"NO");
+	      regexp,expr,string,ret?"YES":"NO");
 
   xfree(regexp);
 

-----------------------------------------------------------------------

Summary of changes:
 AUTHORS             |  4 ++++
 dirmngr/dns-stuff.c | 11 ++++++++++-
 g10/trustdb.c       |  4 ++--
 3 files changed, 16 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 11:41:58 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 23 Jan 2017 11:41:58 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-100-g9ae0b81
Message-ID: <E1cVc4X-000786-DI@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  9ae0b81e4ff08712da642456d0164f81924a91e4 (commit)
      from  88ade475c56ac3712d6bd6d41ae38e1421dcb320 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9ae0b81e4ff08712da642456d0164f81924a91e4
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 11:39:10 2017 +0100

    dirmngr: Print debug message only with --debug.
    
    * dirmngr/dns-stuff.c (libdns_init): Call log_debug only if opt_debug
    is set.
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index eae888b..adeb392 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -483,7 +483,8 @@ libdns_init (void)
            * DNS then Files, which is not classic; FreeBSD
            * /usr/src/lib/libc/net/gethostnamadr.c defines default_src[] which
            * is Files then DNS, which is. */
-          log_debug ("dns: fallback resolution order, files then DNS");
+          if (opt_debug)
+            log_debug ("dns: fallback resolution order, files then DNS\n");
           ld.resolv_conf->lookup[0] = 'f';
           ld.resolv_conf->lookup[1] = 'b';
           ld.resolv_conf->lookup[2] = '\0';

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dns-stuff.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 13:11:26 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 23 Jan 2017 13:11:26 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-102-g3ca3da8
Message-ID: <E1cVdT7-0003MD-Hr@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  3ca3da8fc4ef802b8cceec5fde398a07b4888848 (commit)
       via  d4c0187dd93163f12e9f953366adef81ecf526a6 (commit)
      from  9ae0b81e4ff08712da642456d0164f81924a91e4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3ca3da8fc4ef802b8cceec5fde398a07b4888848
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 13:07:54 2017 +0100

    dirmngr: On SIGHUP mark all keyservers alive.
    
    * dirmngr/ks-engine-hkp.c (ks_hkp_reload): New.
    * dirmngr/dirmngr.c (dirmngr_sighup_action): Call it.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 92984b6..061cfc3 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -1702,6 +1702,7 @@ dirmngr_sighup_action (void)
   cert_cache_init ();
   crl_cache_init ();
   reload_dns_stuff (0);
+  ks_hkp_reload ();
 }
 
 
diff --git a/dirmngr/dirmngr.h b/dirmngr/dirmngr.h
index 9a87878..35bc000 100644
--- a/dirmngr/dirmngr.h
+++ b/dirmngr/dirmngr.h
@@ -194,6 +194,7 @@ const char* dirmngr_get_current_socket_name (void);
 
 /*-- Various housekeeping functions.  --*/
 void ks_hkp_housekeeping (time_t curtime);
+void ks_hkp_reload (void);
 
 
 /*-- server.c --*/
diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 08ef851..9de6267 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -1003,6 +1003,29 @@ ks_hkp_housekeeping (time_t curtime)
 }
 
 
+/* Reload (SIGHUP) action for this module.  We mark all host alive
+ * even those which have been manually shot.  */
+void
+ks_hkp_reload (void)
+{
+  int idx, count;
+  hostinfo_t hi;
+
+  for (idx=count=0; idx < hosttable_size; idx++)
+    {
+      hi = hosttable[idx];
+      if (!hi)
+        continue;
+      if (!hi->dead)
+        continue;
+      hi->dead = 0;
+      count++;
+    }
+  if (count)
+    log_info ("number of resurrected hosts: %d", count);
+}
+
+
 /* Send an HTTP request.  On success returns an estream object at
    R_FP.  HOSTPORTSTR is only used for diagnostics.  If HTTPHOST is
    not NULL it will be used as HTTP "Host" header.  If POST_CB is not

commit d4c0187dd93163f12e9f953366adef81ecf526a6
Author: Gaetan Bisson <bisson at archlinux.org>
Date:   Mon Jan 23 12:46:35 2017 +0100

    libdns: Hack to skip negation term.
    
    * dirmngr/dns.c (dns_nssconf_loadfile): Skip negation terms in
    nsswitch.conf parser.
    --
    
    This small patch was submitted along with this comment:
    
      We've been having issues over at Arch Linux with the new libdns
      code.  Our /etc/nsswitch.conf contains the following line:
    
        hosts: files mymachines resolve [!UNAVAIL=return] dns myhostname
    
      And it turns out dirmngr fails to parse the negation statement (the
      bang in !UNAVAIL). This results in gnupg not being able to resolve
      any name.
    
      Looking at dirmngr/dns.c it was unclear to me how to properly handle
      such negations. The dns_anyconf_scan calls used in
      dns_nssconf_loadfile do not allow to store a negation bit easily...
    
      In the meantime, I wrote the attached patch which ignores those
      statements altogether. It makes libdns work as expected for us.
    
    Commit log written by wk

diff --git a/dirmngr/dns.c b/dirmngr/dns.c
index 016ff44..869e7ed 100644
--- a/dirmngr/dns.c
+++ b/dirmngr/dns.c
@@ -6071,7 +6071,15 @@ int dns_nssconf_loadfile(struct dns_resolv_conf *resconf, FILE *fp) {
 			if ('[' == dns_anyconf_peek(fp)) {
 				dns_anyconf_skip("[ \t", fp);
 
-				while (dns_anyconf_scan(&cf, "%w_", fp, &error)) {
+				for (;;) {
+					if ('!' == dns_anyconf_peek(fp)) {
+						dns_anyconf_skip("! \t", fp);
+						/* FIXME: negating statuses; currently not implemented */
+						dns_anyconf_skip("^#;]\n", fp); /* skip to end of criteria */
+						break;
+					}
+
+					if (!dns_anyconf_scan(&cf, "%w_", fp, &error)) break;
 					dns_anyconf_skip("= \t", fp);
 					if (!dns_anyconf_scan(&cf, "%w_", fp, &error)) {
 						dns_anyconf_pop(&cf); /* discard status */

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dirmngr.c       |  1 +
 dirmngr/dirmngr.h       |  1 +
 dirmngr/dns.c           | 10 +++++++++-
 dirmngr/ks-engine-hkp.c | 23 +++++++++++++++++++++++
 4 files changed, 34 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 15:20:17 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 23 Jan 2017 15:20:17 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-36-g6f02133
Message-ID: <E1cVfTn-00012M-Do@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  6f02133bb07726afa6950e5b4685e75621276e60 (commit)
      from  ca69df8c8d3f044340aee2a118cc20d33cd600a1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6f02133bb07726afa6950e5b4685e75621276e60
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 23 15:08:23 2017 +0100

    w32: Fix closing file descriptors.
    
    * src/w32-io.c (writer): Only stop once the buffer is drained.
    (destroy_writer): Wait for the writers buffer to be drained.  This
    aligns '_gpgme_io_close's behavior with close(2) and fclose(3).
    
    GnuPG-bug-id: 2881
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/src/w32-io.c b/src/w32-io.c
index 0d1c810..6302ad9 100644
--- a/src/w32-io.c
+++ b/src/w32-io.c
@@ -700,7 +700,7 @@ writer (void *arg)
   for (;;)
     {
       LOCK (ctx->mutex);
-      if (ctx->stop_me)
+      if (ctx->stop_me && !ctx->nbytes)
 	{
 	  UNLOCK (ctx->mutex);
 	  break;
@@ -717,7 +717,7 @@ writer (void *arg)
 	  TRACE_LOG ("got data to send");
 	  LOCK (ctx->mutex);
        	}
-      if (ctx->stop_me)
+      if (ctx->stop_me && !ctx->nbytes)
 	{
 	  UNLOCK (ctx->mutex);
 	  break;
@@ -776,6 +776,9 @@ writer (void *arg)
   TRACE_LOG ("waiting for close");
   WaitForSingleObject (ctx->close_ev, INFINITE);
 
+  if (ctx->nbytes)
+    TRACE_LOG1 ("still %d bytes in buffer at close time", ctx->nbytes);
+
   CloseHandle (ctx->close_ev);
   CloseHandle (ctx->have_data);
   CloseHandle (ctx->is_empty);
@@ -892,6 +895,9 @@ destroy_writer (struct writer_context_s *ctx)
     SetEvent (ctx->have_data);
   UNLOCK (ctx->mutex);
 
+  /* Give the writer a chance to flush the buffer.  */
+  WaitForSingleObject (ctx->is_empty, INFINITE);
+
 #ifdef HAVE_W32CE_SYSTEM
   /* Scenario: We never create a full pipe, but already started
      writing more than the pipe buffer.  Then we need to unblock the

-----------------------------------------------------------------------

Summary of changes:
 src/w32-io.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 16:46:05 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 23 Jan 2017 16:46:05 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.17-103-gaf5979a
Message-ID: <E1cVgop-0004nG-SB@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  af5979a42b9468ffe0f3ac6de5a77d982c5cf8a0 (commit)
      from  3ca3da8fc4ef802b8cceec5fde398a07b4888848 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit af5979a42b9468ffe0f3ac6de5a77d982c5cf8a0
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 16:32:44 2017 +0100

    Fix format string errors and some missing error case initialization.
    
    * common/logging.c (do_logv): Remove extra parentheses in comparison.
    
    * dirmngr/dns-stuff.c (resolve_addr_libdns): Init RES so that
    dns_res_close is given a defined value in the error case.
    
    * dirmngr/http.c (cookie_read, cookie_write) [HTTP_USE_NTBTLS]: Fix
    format string char.
    
    * dirmngr/ks-engine-hkp.c (ks_hkp_help): Remove duplicate "const".
    * dirmngr/ks-engine-http.c (ks_http_help): Ditto.
    * dirmngr/ks-engine-kdns.c (ks_kdns_help): Ditto.
    * dirmngr/ks-engine-ldap.c (ks_ldap_help): Ditto.
    
    * scd/app-p15.c (send_keypairinfo, do_getattr): Fix format string
    char.
    * tools/gpgconf-comp.c (gpg_agent_runtime_change): Init PID for the
    error case.
    (scdaemon_runtime_change): Ditto.
    (dirmngr_runtime_change): Ditto.
    
    * tools/gpgconf.c (query_swdb): Init VALUE_SIZE_UL.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/logging.c b/common/logging.c
index 0db1860..8c70742 100644
--- a/common/logging.c
+++ b/common/logging.c
@@ -798,7 +798,7 @@ do_logv (int level, int ignore_arg_ptr, const char *extrastring,
             es_fputs_unlocked ("\\\\", logstream);
           else if (c == '\r')
             es_fputs_unlocked ("\\r", logstream);
-          else if ((c == '\n'))
+          else if (c == '\n')
             {
               es_fputs_unlocked ("\\n\n", logstream);
               if (*extrastring)
diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index adeb392..9347196 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -947,7 +947,7 @@ resolve_addr_libdns (const struct sockaddr *addr, int addrlen,
 {
   gpg_error_t err;
   char host[DNS_D_MAXNAME + 1];
-  struct dns_resolver *res;
+  struct dns_resolver *res = NULL;
   struct dns_packet *ans = NULL;
   struct dns_ptr ptr;
   int derr;
diff --git a/dirmngr/http.c b/dirmngr/http.c
index 9457707..35877d2 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -2707,7 +2707,7 @@ cookie_read (void *cookie, void *buffer, size_t size)
       ntbtls_get_stream (c->session->tls_session, &in, &out);
       nread = es_fread (buffer, 1, size, in);
       if (opt_debug)
-        log_debug ("TLS network read: %d/%u\n", nread, size);
+        log_debug ("TLS network read: %d/%zu\n", nread, size);
     }
   else
 #elif HTTP_USE_GNUTLS
@@ -2800,7 +2800,7 @@ cookie_write (void *cookie, const void *buffer_arg, size_t size)
       else
         nwritten = es_fwrite (buffer, 1, size, out);
       if (opt_debug)
-        log_debug ("TLS network write: %d/%u\n", nwritten, size);
+        log_debug ("TLS network write: %d/%zu\n", nwritten, size);
     }
   else
 #elif HTTP_USE_GNUTLS
diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 9de6267..45965ce 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -851,7 +851,7 @@ ks_hkp_print_hosttable (ctrl_t ctrl)
 gpg_error_t
 ks_hkp_help (ctrl_t ctrl, parsed_uri_t uri)
 {
-  const char const data[] =
+  const char data[] =
     "Handler for HKP URLs:\n"
     "  hkp://\n"
 #if  HTTP_USE_GNUTLS || HTTP_USE_NTBTLS
diff --git a/dirmngr/ks-engine-http.c b/dirmngr/ks-engine-http.c
index 4c4ab1e..858c943 100644
--- a/dirmngr/ks-engine-http.c
+++ b/dirmngr/ks-engine-http.c
@@ -35,7 +35,7 @@
 gpg_error_t
 ks_http_help (ctrl_t ctrl, parsed_uri_t uri)
 {
-  const char const data[] =
+  const char data[] =
     "Handler for HTTP URLs:\n"
     "  http://\n"
 #if  HTTP_USE_GNUTLS || HTTP_USE_NTBTLS
diff --git a/dirmngr/ks-engine-kdns.c b/dirmngr/ks-engine-kdns.c
index d49d046..9bb0d42 100644
--- a/dirmngr/ks-engine-kdns.c
+++ b/dirmngr/ks-engine-kdns.c
@@ -33,7 +33,7 @@
 gpg_error_t
 ks_kdns_help (ctrl_t ctrl, parsed_uri_t uri)
 {
-  const char const data[] =
+  const char data[] =
     "This keyserver engine accepts URLs of the form:\n"
     "  kdns://[NAMESERVER]/[ROOT][?at=STRING]\n"
     "with\n"
diff --git a/dirmngr/ks-engine-ldap.c b/dirmngr/ks-engine-ldap.c
index ee55bf2..6d520e9 100644
--- a/dirmngr/ks-engine-ldap.c
+++ b/dirmngr/ks-engine-ldap.c
@@ -289,7 +289,7 @@ epoch2ldaptime (time_t stamp)
 gpg_error_t
 ks_ldap_help (ctrl_t ctrl, parsed_uri_t uri)
 {
-  const char const data[] =
+  const char data[] =
     "Handler for LDAP URLs:\n"
     "  ldap://host:port/[BASEDN]???[bindname=BINDNAME,password=PASSWORD]\n"
     "\n"
diff --git a/scd/app-p15.c b/scd/app-p15.c
index 505073e..3def55b 100644
--- a/scd/app-p15.c
+++ b/scd/app-p15.c
@@ -2463,7 +2463,7 @@ send_keypairinfo (app_t app, ctrl_t ctrl, prkdf_object_t keyinfo)
       p = stpcpy (buf, "P15");
       if (app->app_local->home_df)
         {
-          snprintf (p, 6, "-%04hX",
+          snprintf (p, 6, "-%04X",
                     (unsigned int)(app->app_local->home_df & 0xffff));
           p += 5;
         }
@@ -2689,7 +2689,7 @@ do_getattr (app_t app, ctrl_t ctrl, const char *name)
           p = stpcpy (buf, "P15");
           if (app->app_local->home_df)
             {
-              snprintf (p, 6, "-%04hX",
+              snprintf (p, 6, "-%04X",
                         (unsigned int)(app->app_local->home_df & 0xffff));
               p += 5;
             }
diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index 300f63d..a25b513 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -1138,7 +1138,7 @@ gpg_agent_runtime_change (int killflag)
   gpg_error_t err = 0;
   const char *pgmname;
   const char *argv[5];
-  pid_t pid;
+  pid_t pid = (pid_t)(-1);
   char *abs_homedir = NULL;
   int i = 0;
 
@@ -1174,7 +1174,7 @@ scdaemon_runtime_change (int killflag)
   gpg_error_t err = 0;
   const char *pgmname;
   const char *argv[9];
-  pid_t pid;
+  pid_t pid = (pid_t)(-1);
   char *abs_homedir = NULL;
   int i = 0;
 
@@ -1221,7 +1221,7 @@ dirmngr_runtime_change (int killflag)
   gpg_error_t err = 0;
   const char *pgmname;
   const char *argv[6];
-  pid_t pid;
+  pid_t pid = (pid_t)(-1);
   char *abs_homedir = NULL;
 
   pgmname = gnupg_module_name (GNUPG_MODULE_NAME_CONNECT_AGENT);
diff --git a/tools/gpgconf.c b/tools/gpgconf.c
index c69b1c3..a5ee188 100644
--- a/tools/gpgconf.c
+++ b/tools/gpgconf.c
@@ -280,7 +280,7 @@ query_swdb (estream_t out, const char *name, const char *current_version)
   gnupg_isotime_t value_date = {0};
   char *value_size = NULL;
   char *value_sha2 = NULL;
-  unsigned long value_size_ul;
+  unsigned long value_size_ul = 0;
   int status, i;
 
 

-----------------------------------------------------------------------

Summary of changes:
 common/logging.c         | 2 +-
 dirmngr/dns-stuff.c      | 2 +-
 dirmngr/http.c           | 4 ++--
 dirmngr/ks-engine-hkp.c  | 2 +-
 dirmngr/ks-engine-http.c | 2 +-
 dirmngr/ks-engine-kdns.c | 2 +-
 dirmngr/ks-engine-ldap.c | 2 +-
 scd/app-p15.c            | 4 ++--
 tools/gpgconf-comp.c     | 6 +++---
 tools/gpgconf.c          | 2 +-
 10 files changed, 14 insertions(+), 14 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 19:44:12 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 23 Jan 2017 19:44:12 +0100
Subject: [git] GnuPG - branch, STABLE-BRANCH-2-2,
 updated. gnupg-2.1.17-106-gd393678
Message-ID: <E1cVjbC-0003AP-SG@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-2-2 has been updated
       via  d393678aaed165169b88b6f312f83d7e8d81d80d (commit)
       via  ee79e84914c140980e2275948e33d8d314ad2f81 (commit)
       via  707c47f5592d48fb39a97e65f142de3d70ef7a7d (commit)
       via  af5979a42b9468ffe0f3ac6de5a77d982c5cf8a0 (commit)
       via  3ca3da8fc4ef802b8cceec5fde398a07b4888848 (commit)
       via  d4c0187dd93163f12e9f953366adef81ecf526a6 (commit)
       via  9ae0b81e4ff08712da642456d0164f81924a91e4 (commit)
       via  88ade475c56ac3712d6bd6d41ae38e1421dcb320 (commit)
       via  b3e7a112e0c3536f12a9425a547d4a1c77db8b3c (commit)
       via  a85731ada2d361eacddc5ae92f80d34792dd4b5e (commit)
       via  65ed117ac0cc5f567eca78168d5931168c4880bc (commit)
       via  953d4ec6afd1b42feb7465ee57e48d72f033019a (commit)
       via  21c9ebb908c2ad2e322e7a13e59e5880494c4d67 (commit)
       via  e926f30a1cda75f6334b79c303b5134f0441a3dc (commit)
       via  e031b3c16cfec583c4322c84d299b355f0849c77 (commit)
       via  3daeef702b2e6a42f0f396b828f86ffc3f33fc88 (commit)
       via  55c9212a2338bf0b07c8cf3a69bcedaa28d48d43 (commit)
       via  367349b4dcc97718f8ae1163d1389d2a46fc3453 (commit)
       via  34fa2d79a07a079be472c3ff486debfdac8c6070 (commit)
       via  3d356d165aed7d76a3ea811b1d24ed0a05ac90d4 (commit)
       via  2312248b2e3adffa52d8a3ac4f24fe2c88f0f569 (commit)
       via  701f54eccf3da3319dd6d74f46b852c64d90bc52 (commit)
       via  79cea89774e6327b6785e22b7057f9e3e188ac2b (commit)
       via  8b1f24a29ebc7651437c01990215a55b1136dae0 (commit)
       via  a09f258b1412209763222e2e81bab79663e4d685 (commit)
       via  356323768a1a29138581d0aceed0336ab8be0d5c (commit)
       via  766c25018b288a7185c6da6adac0dec01a64e94a (commit)
       via  bae42e543799a428e59bad870aed9719dd6e6e45 (commit)
       via  adbfbf608e75cdd72ae7b3a538b91bc0e236a18f (commit)
       via  e6aebfe3d0f16c483296fd125b66a44017fe15f4 (commit)
       via  9850124c7bdf0a0e7c1866abc85f3437257d7095 (commit)
       via  daae97bc14742c75408c4eb05808a2102cfe2bcf (commit)
       via  82646bbf1a5a7d745da81b239a12667a51703dc1 (commit)
       via  8b1611a9605b636db3e07a9d81016a11b318724c (commit)
       via  0801f49b0dc7102943f0e9fa51061f50f5708ca6 (commit)
       via  2e6f1c99d4f66a23a752092397e20a84964edf48 (commit)
       via  3db76c9277d918dec9721a6439f4db3b3c06aba3 (commit)
       via  c99a09f111c5980ae034faaea61a00d9ad60463c (commit)
       via  5c0777e1ca02ff1767755c417b64d6f78e02f475 (commit)
       via  3c00b52f7cb0fbd756c0bbe5134b8f2d69c60dd1 (commit)
       via  97372b39cd9b4c84a083eadbf072fff77799617f (commit)
       via  0fadff9cdde47e42f7e428bc903b3626c67ba9c0 (commit)
       via  20dfcfe08c618d23134d5d6efef7676b090f30d3 (commit)
       via  76fb2febde10da8237bbe7613830b51af2a45139 (commit)
       via  09aeac41c97bc8ecb44a09886c7fdbd9a6ec5c7f (commit)
       via  915864e7f0315b0c96315d0bcd48b1b93592353a (commit)
       via  da894c48ec3393e7c815f575daa5a52ab37cc102 (commit)
       via  02ab4b0085f8b4cdfe163d25ddd0fc80753d7f4a (commit)
       via  088d71d3671e74eb088386026f0e439a7e3b5543 (commit)
       via  7249ab0f95d1f6cb8ee61eefedc79801bb56398f (commit)
       via  a20a450ac4ef10847fd59a5fd3acbbd2bfcaa6a2 (commit)
       via  7345c64b0887e51d8c8c6eaf49c9dbf5b0f45228 (commit)
       via  88e42ef08d65d4d1bc29c6cea48df19ca0d5e2bd (commit)
       via  1f5caf90bfaaaf7b9d8c06c12087aeeae3748032 (commit)
       via  c8cfc62125aceee0ca48aab5c8a9fea1ec1ef652 (commit)
       via  bfd6a490129ffc7c7ac8776bf5a5da3b1ddf6d42 (commit)
       via  0cc975d8a1cd54115938202432e43263b8893ea4 (commit)
       via  c2cbe2f87c480c62239dc4c2cbb352acd98cd267 (commit)
       via  2baba11fad6dd680a992260d161dffa1eeae0e42 (commit)
       via  88dc3af3d4ae1afe1d5e136bc4c38bc4e7d4cd10 (commit)
       via  714faea4fa7f30d42e9986358214a99aa8fa57b3 (commit)
       via  16078f3deea5b82ea26e2f01dbd3ef3a5ce25410 (commit)
       via  9fa94aa10778bbd680315e93b23175423e338c40 (commit)
       via  8d774904c8066d8c0f19cfffe2d568979bb8c470 (commit)
       via  e1f68337b979fe4b7c3bd095a83ea832e14efb74 (commit)
       via  858e14cd794e2a6125d51e652a754bbe26def997 (commit)
       via  62268a2732dddca7a05ca4cf45d0e4338c7dc3c4 (commit)
       via  8a41e73c31adb86d4a7dca4da695e5ad1347811f (commit)
       via  6170eb809033c9d144abf3b1f31f8b936878cdd4 (commit)
       via  353f6ff37646ad4c24d309a495e6c6f41e5235e3 (commit)
       via  168c8c9d79a817c1f08a9ef976dab377f8c4c69e (commit)
       via  4ded213698123a425393b89a800fda2a4ec5229d (commit)
       via  38671cfe5a2a40bb991619f4cb992c42b5f1e8cd (commit)
       via  588121c158384b05099388097053d8d1e8bdf143 (commit)
       via  28e149609da44fab600f6a11b385d1c8ca8e7eb9 (commit)
       via  293a55bacdacec4501af3a396b14fd32e404e39e (commit)
       via  969512401603639e4467ede7d892f1b02582c2c9 (commit)
       via  0004d52ba2f1245c84f95a151342ad99fd72ca3d (commit)
       via  a1e0d4a1e75fc6e6c3392a4e1d1d27005b38d6cc (commit)
       via  6d065198337b5242889723481bfa9ce81aa108bb (commit)
       via  5b6ebfb9244602d9de31d61c7eceb0c45ac8aa49 (commit)
       via  6b84ecbf312d98ac8cce9fe5facdc815bc742fa1 (commit)
       via  c52930d11fcc52515fcc09a1085bf118411566a8 (commit)
       via  b0e14bd6ff8401b12b2b39f75aef94d3ad28017f (commit)
       via  b79274a3b7e58f88e9a8c1dc1fb24dd3e983543c (commit)
       via  e8b843508dac96e9d0a3140954dd5a3618669cec (commit)
       via  5a4a109354d53cf3673d0636731c67021d3f367a (commit)
       via  b200e636ab20d2aa93d9f71f3789db5a04af0a56 (commit)
       via  337690441fcb19343fe56b139f5649bed7d25c83 (commit)
       via  f300e12a793d59deb1a369713384eaabfa39b3e6 (commit)
       via  cdc8d0bd933b958db878861587322bc541b580b3 (commit)
       via  c48cf7e32ffa02ebdf00265543344c611bef0431 (commit)
       via  4cc9fc5eb9bd91d943c185d59da4a2b4cb885ee6 (commit)
       via  f9882d8336feea96e3b5e250e9093f8cca01e08b (commit)
       via  c7ec9c42246033e14ebad679d11f3b1fbeed23b7 (commit)
       via  d26c51825e2255fe58305cbc1cd74fa43f80d93e (commit)
       via  1909e994cb87d6c6866a465f0c20a456d4df46cc (commit)
       via  e917dfcd973a3ebbf5eb584e819ffa89f932bfef (commit)
       via  8431f5a7e88e1f42d75c4a4b61f4aa9b35457204 (commit)
       via  6e96cdd41a0e55b672309431062f37c4a4a9f485 (commit)
       via  6204f8104fea42d706a68e77e2dc0bca4704bddc (commit)
       via  36c14139285982def6ad942d4b2d8bef7ed4ea76 (commit)
       via  c067a012c764218b94ce8de2914615a895a75f3e (commit)
       via  a30c0a6972cabde3858108e9020e900696094843 (commit)
       via  e2ed3c1597daf3188ddce049cc3c50113d56f1b9 (commit)
      from  bff47f6ec0825ca8b144ce66a5dd9849af719378 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d393678aaed165169b88b6f312f83d7e8d81d80d
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 19:26:12 2017 +0100

    po: Auto update
    
    --

diff --git a/po/ca.po b/po/ca.po
index 56c6d97..b00c346 100644
--- a/po/ca.po
+++ b/po/ca.po
@@ -1844,6 +1844,9 @@ msgstr "la clau secreta ?s inusable"
 msgid "remove as much as possible from key during export"
 msgstr ""
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2673,6 +2676,9 @@ msgstr ""
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "es descarta un bloc de tipus %d\n"
diff --git a/po/cs.po b/po/cs.po
index 47611b3..d14f88a 100644
--- a/po/cs.po
+++ b/po/cs.po
@@ -1698,6 +1698,9 @@ msgstr "odstranit nepou?iteln? ??sti z kl??e p?i exportu"
 msgid "remove as much as possible from key during export"
 msgstr "odstranit p?i exportu z?kl??e v?e, co lze"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 msgid " - skipped"
 msgstr "?? p?esko?eno"
 
@@ -2483,6 +2486,11 @@ msgstr "odstranit po importu z?kl??e v?e, co lze"
 msgid "run import filters and export key immediately"
 msgstr ""
 
+#, fuzzy
+#| msgid "assume input is in binary format"
+msgid "assume the GnuPG key backup format"
+msgstr "p?edpokl?dat vstup v?bin?rn?m form?tu"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "blok typu %d byl p?esko?en\n"
diff --git a/po/da.po b/po/da.po
index 5185534..0e10efb 100644
--- a/po/da.po
+++ b/po/da.po
@@ -1807,6 +1807,9 @@ msgstr "fjern n?gledele der ikke kan bruges under eksport"
 msgid "remove as much as possible from key during export"
 msgstr "fjern s? meget som muligt fra n?glen under eksport"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2624,6 +2627,11 @@ msgstr "fjern s? meget som muligt fra n?gle efter import"
 msgid "run import filters and export key immediately"
 msgstr ""
 
+#, fuzzy
+#| msgid "assume input is in binary format"
+msgid "assume the GnuPG key backup format"
+msgstr "antag inddata er i bin?rt format"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "     udelader bloktype %d\n"
diff --git a/po/el.po b/po/el.po
index 14613f6..7c413a2 100644
--- a/po/el.po
+++ b/po/el.po
@@ -1777,6 +1777,9 @@ msgstr "?? ??????????????? ??????? ??????"
 msgid "remove as much as possible from key during export"
 msgstr ""
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2594,6 +2597,9 @@ msgstr ""
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "????????? ???????? ??? ????? %d\n"
diff --git a/po/eo.po b/po/eo.po
index af5252e..4367a86 100644
--- a/po/eo.po
+++ b/po/eo.po
@@ -1765,6 +1765,9 @@ msgstr "neuzebla sekreta ?losilo"
 msgid "remove as much as possible from key during export"
 msgstr ""
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2578,6 +2581,9 @@ msgstr ""
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "ignoras blokon de speco %d\n"
diff --git a/po/es.po b/po/es.po
index 258c164..a8fcb0c 100644
--- a/po/es.po
+++ b/po/es.po
@@ -1826,6 +1826,9 @@ msgstr "borrar partes inutilizables de la clave al exportar"
 msgid "remove as much as possible from key during export"
 msgstr "borrar tanto como sea posible de la clave al exportar"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2653,6 +2656,11 @@ msgstr "borrar tanto como sea posible de la clave tras importar"
 msgid "run import filters and export key immediately"
 msgstr ""
 
+#, fuzzy
+#| msgid "assume input is in binary format"
+msgid "assume the GnuPG key backup format"
+msgstr "asumir entrada en formato binario"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "omitiendo bloque de tipo %d\n"
diff --git a/po/et.po b/po/et.po
index a7de525..4ee508b 100644
--- a/po/et.po
+++ b/po/et.po
@@ -1770,6 +1770,9 @@ msgstr "mittekasutatav salajane v?ti"
 msgid "remove as much as possible from key during export"
 msgstr ""
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2579,6 +2582,9 @@ msgstr ""
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "j?tan bloki t??biga %d vahele\n"
diff --git a/po/fi.po b/po/fi.po
index 108ce7a..1fa4e4c 100644
--- a/po/fi.po
+++ b/po/fi.po
@@ -1785,6 +1785,9 @@ msgstr "salaista avainta ei voi k?ytt??"
 msgid "remove as much as possible from key during export"
 msgstr ""
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2595,6 +2598,9 @@ msgstr ""
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "ohitetaan tyypin %d lohko\n"
diff --git a/po/fr.po b/po/fr.po
index d1a82ff..50da5ca 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -1726,6 +1726,9 @@ msgstr "supprimer les parties inutilisables de la clef pendant l'exportation"
 msgid "remove as much as possible from key during export"
 msgstr "supprimer autant que possible de la clef pendant l'exportation"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 msgid " - skipped"
 msgstr " ??ignor?"
 
@@ -2524,6 +2527,11 @@ msgstr "supprimer autant que possible de la clef apr?s l'importation"
 msgid "run import filters and export key immediately"
 msgstr ""
 
+#, fuzzy
+#| msgid "assume input is in binary format"
+msgid "assume the GnuPG key backup format"
+msgstr "entr?e suppos?e au format binaire"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "un bloc de type %d a ?t? ignor?\n"
diff --git a/po/gl.po b/po/gl.po
index ff7663a..4daa963 100644
--- a/po/gl.po
+++ b/po/gl.po
@@ -1779,6 +1779,9 @@ msgstr "chave secreta non utilizable"
 msgid "remove as much as possible from key during export"
 msgstr ""
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2589,6 +2592,9 @@ msgstr ""
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "pasando por alto un bloque de tipo %d\n"
diff --git a/po/hu.po b/po/hu.po
index f552b0e..3b3874d 100644
--- a/po/hu.po
+++ b/po/hu.po
@@ -1766,6 +1766,9 @@ msgstr "haszn?lhatatlan titkos kulcs"
 msgid "remove as much as possible from key during export"
 msgstr ""
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2577,6 +2580,9 @@ msgstr ""
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "%d t?pus? blokkot kihagyom.\n"
diff --git a/po/id.po b/po/id.po
index dbc4155..25d39ca 100644
--- a/po/id.po
+++ b/po/id.po
@@ -1771,6 +1771,9 @@ msgstr "kunci rahasia tidak dapat dipakai"
 msgid "remove as much as possible from key during export"
 msgstr ""
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2582,6 +2585,9 @@ msgstr ""
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "melewati blok tipe %d\n"
diff --git a/po/it.po b/po/it.po
index 1d8b580..c70ddc4 100644
--- a/po/it.po
+++ b/po/it.po
@@ -1778,6 +1778,9 @@ msgstr "chiave segreta inutilizzabile"
 msgid "remove as much as possible from key during export"
 msgstr ""
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2588,6 +2591,9 @@ msgstr ""
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "salto un blocco di tipo %d\n"
diff --git a/po/ja.po b/po/ja.po
index bd143bf..0a6b92d 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -1639,6 +1639,9 @@ msgstr "??????????????????????"
 msgid "remove as much as possible from key during export"
 msgstr "??????????????????"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 msgid " - skipped"
 msgstr " - ?????????"
 
@@ -2370,6 +2373,11 @@ msgstr "?????????????????"
 msgid "run import filters and export key immediately"
 msgstr "????????????????????????????"
 
+#, fuzzy
+#| msgid "assume input is in binary format"
+msgid "assume the GnuPG key backup format"
+msgstr "???????????????????"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "?%d?????????????\n"
diff --git a/po/nb.po b/po/nb.po
index ba27c10..c56fa57 100644
--- a/po/nb.po
+++ b/po/nb.po
@@ -1653,6 +1653,9 @@ msgstr "fjern ubrukelige deler fra n?kkelen under eksportering"
 msgid "remove as much as possible from key during export"
 msgstr "fjern s? mye som mulig fra n?kkelen under eksportering"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 msgid " - skipped"
 msgstr ". Hoppet over"
 
@@ -2400,6 +2403,11 @@ msgstr "fjern s? mye som mulig fra n?kkel etter importering"
 msgid "run import filters and export key immediately"
 msgstr "kj?r importeringsfiltre og eksporter n?kkel umiddelbart"
 
+#, fuzzy
+#| msgid "assume input is in binary format"
+msgid "assume the GnuPG key backup format"
+msgstr "forvent inndata i bin?rformat"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "hopper over blokk av typen %d\n"
diff --git a/po/pl.po b/po/pl.po
index 8b750f3..59b798b 100644
--- a/po/pl.po
+++ b/po/pl.po
@@ -1791,6 +1791,9 @@ msgstr "usuni?cie bezu?ytecznych cz??ci z klucza przy eksporcie"
 msgid "remove as much as possible from key during export"
 msgstr "usuni?cie jak najwi?kszej cz??ci klucza przy eksporcie"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2631,6 +2634,11 @@ msgstr "usuwanie jak najwi?kszej cz??ci kluczy po imporcie"
 msgid "run import filters and export key immediately"
 msgstr ""
 
+#, fuzzy
+#| msgid "assume input is in binary format"
+msgid "assume the GnuPG key backup format"
+msgstr "przyj?cie wej?cia w formacie binarnym"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "blok typu %d zostaje pomini?ty\n"
diff --git a/po/pt.po b/po/pt.po
index 733f8bf..8fab7f8 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -1770,6 +1770,9 @@ msgstr "chave secreta n?o utiliz?vel"
 msgid "remove as much as possible from key during export"
 msgstr ""
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2583,6 +2586,9 @@ msgstr ""
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "ignorando bloco do tipo %d\n"
diff --git a/po/ro.po b/po/ro.po
index 054978a..69ab0f3 100644
--- a/po/ro.po
+++ b/po/ro.po
@@ -1774,6 +1774,9 @@ msgstr "cheie secret? de nefolosit"
 msgid "remove as much as possible from key during export"
 msgstr ""
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2615,6 +2618,9 @@ msgstr ""
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "bloc de tip %d s?rit\n"
diff --git a/po/ru.po b/po/ru.po
index 60f584a..9386d59 100644
--- a/po/ru.po
+++ b/po/ru.po
@@ -1655,6 +1655,9 @@ msgstr "??????? ??? ???????? ??????????? ?????
 msgid "remove as much as possible from key during export"
 msgstr "??? ???????? ??????? ?? ????? ??? ????? ??????"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 msgid " - skipped"
 msgstr " - ?????????"
 
@@ -2415,6 +2418,11 @@ msgstr "??????? ????? ??????? ?? ????? ??? ????
 msgid "run import filters and export key immediately"
 msgstr "????????? ??????? ??????? ? ?????????? ?????????????? ????"
 
+#, fuzzy
+#| msgid "assume input is in binary format"
+msgid "assume the GnuPG key backup format"
+msgstr "???????????, ??? ??????? ?????? ? ???????? ???????"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "???????? ???? ???? %d\n"
diff --git a/po/sk.po b/po/sk.po
index 5a41f8a..8641d20 100644
--- a/po/sk.po
+++ b/po/sk.po
@@ -1774,6 +1774,9 @@ msgstr "nepou?ite?n? tajn? k???"
 msgid "remove as much as possible from key during export"
 msgstr ""
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2595,6 +2598,9 @@ msgstr ""
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "blok typu %d bol presko?en?\n"
diff --git a/po/sv.po b/po/sv.po
index a863d39..22e4932 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -1839,6 +1839,9 @@ msgstr "ta bort oanv?ndbara delar fr?n nyckeln under exportering"
 msgid "remove as much as possible from key during export"
 msgstr "ta bort s? mycket som m?jligt fr?n nyckeln under exportering"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2683,6 +2686,11 @@ msgstr "ta bort s? mycket som m?jligt fr?n nyckeln efter importering"
 msgid "run import filters and export key immediately"
 msgstr ""
 
+#, fuzzy
+#| msgid "assume input is in binary format"
+msgid "assume the GnuPG key backup format"
+msgstr "anta att inmatning ?r i bin?rformat"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "hoppar ?ver block av typen %d\n"
diff --git a/po/tr.po b/po/tr.po
index 9dac294..3cb5e2f 100644
--- a/po/tr.po
+++ b/po/tr.po
@@ -1785,6 +1785,9 @@ msgstr "ihra? s?ras?nda anahtardan kullan??s?z par?alar kald?r?l?r"
 msgid "remove as much as possible from key during export"
 msgstr "ihra? s?ras?nda anahtardan m?mk?n oldu?unca ?ok ?ey kald?r?l?r"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2612,6 +2615,11 @@ msgstr "ithalat sonras? anahtardan m?mk?n oldu?unca ?ok ?ey kald?r?r"
 msgid "run import filters and export key immediately"
 msgstr ""
 
+#, fuzzy
+#| msgid "assume input is in binary format"
+msgid "assume the GnuPG key backup format"
+msgstr "girdinin ikilik bi?imde oldu?u kabul edilir"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "%d t?r?ndeki blok atlan?yor\n"
diff --git a/po/uk.po b/po/uk.po
index d05706d..7044b85 100644
--- a/po/uk.po
+++ b/po/uk.po
@@ -1673,6 +1673,9 @@ msgstr "???????? ????????????????? ??????? ??
 msgid "remove as much as possible from key during export"
 msgstr "???????? ???????? ?????? ? ????? ??? ??? ?????????????"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 msgid " - skipped"
 msgstr " - ?????????"
 
@@ -2459,6 +2462,11 @@ msgstr "???????? ???????? ?????? ? ????? ?????
 msgid "run import filters and export key immediately"
 msgstr "????????? ??????? ???????????? ?? ???????????? ???? ???????"
 
+#, fuzzy
+#| msgid "assume input is in binary format"
+msgid "assume the GnuPG key backup format"
+msgstr "??????? ?????? ???? ?????? ? ?????????? ???????"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "??????????? ???? ???? %d\n"
diff --git a/po/zh_CN.po b/po/zh_CN.po
index 1417627..4566cbf 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -1743,6 +1743,9 @@ msgstr "??????????????"
 msgid "remove as much as possible from key during export"
 msgstr "????????????????"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 #, fuzzy
 #| msgid "%s: skipped: %s\n"
 msgid " - skipped"
@@ -2559,6 +2562,9 @@ msgstr "????????????????"
 msgid "run import filters and export key immediately"
 msgstr ""
 
+msgid "assume the GnuPG key backup format"
+msgstr ""
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "?? %d ?????\n"
diff --git a/po/zh_TW.po b/po/zh_TW.po
index 0151cec..a3df85e 100644
--- a/po/zh_TW.po
+++ b/po/zh_TW.po
@@ -1655,6 +1655,9 @@ msgstr "????????????????"
 msgid "remove as much as possible from key during export"
 msgstr "?????????????"
 
+msgid "use the GnuPG key backup format"
+msgstr ""
+
 msgid " - skipped"
 msgstr " - ???"
 
@@ -2416,6 +2419,11 @@ msgstr "?????????????"
 msgid "run import filters and export key immediately"
 msgstr ""
 
+#, fuzzy
+#| msgid "assume input is in binary format"
+msgid "assume the GnuPG key backup format"
+msgstr "???????????"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "???? %d ?????\n"

commit ee79e84914c140980e2275948e33d8d314ad2f81
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 19:24:48 2017 +0100

    po: Translate two new strings to German
    
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/po/de.po b/po/de.po
index 95485b3..36ba928 100644
--- a/po/de.po
+++ b/po/de.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg-2.1.0\n"
 "Report-Msgid-Bugs-To: translations at gnupg.org\n"
-"PO-Revision-Date: 2017-01-23 10:22+0100\n"
+"PO-Revision-Date: 2017-01-23 19:23+0100\n"
 "Last-Translator: Werner Koch <wk at gnupg.org>\n"
 "Language-Team: German <de at li.org>\n"
 "Language: de\n"
@@ -1694,6 +1694,9 @@ msgstr "Unbrauchbare Teile des Schl?ssel w?hrend des Exports entfernen"
 msgid "remove as much as possible from key during export"
 msgstr "W?hrend des Exports soviel wie m?glich vom Schl?ssel entfernen"
 
+msgid "use the GnuPG key backup format"
+msgstr "Das GnuPG Datensicherungsformat f?r Schl?ssel benutzen"
+
 msgid " - skipped"
 msgstr " - ?bersprungen"
 
@@ -2451,6 +2454,9 @@ msgstr "nach dem Import soviel wie m?glich aus dem Schl?ssel entfernen"
 msgid "run import filters and export key immediately"
 msgstr "Import-Filter anwenden und Schl?ssel direkt exportieren"
 
+msgid "assume the GnuPG key backup format"
+msgstr "Eingabedaten sind im GnuPG Datensicherungsformat f?r Schl?ssel"
+
 #, c-format
 msgid "skipping block of type %d\n"
 msgstr "?berspringe den Block vom Typ %d\n"

commit 707c47f5592d48fb39a97e65f142de3d70ef7a7d
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 19:16:55 2017 +0100

    Update copyright notices for 2017.
    
    --
    
    Also some http:// -> https:// fixes.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/AUTHORS b/AUTHORS
index 1054b89..8f1e27b 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -15,9 +15,9 @@ copyrightable year that would otherwise be listed individually.
 List of Copyright holders
 =========================
 
-  Copyright (C) 1997-2016 Werner Koch
-  Copyright (C) 1994-2016 Free Software Foundation, Inc.
-  Copyright (C) 2003-2013,2015-2016 g10 Code GmbH
+  Copyright (C) 1997-2017 Werner Koch
+  Copyright (C) 1994-2017 Free Software Foundation, Inc.
+  Copyright (C) 2003-2013,2015-2017 g10 Code GmbH
   Copyright (C) 2002 Klar?lvdalens Datakonsult AB
   Copyright (C) 1995-1997, 2000-2007 Ulrich Drepper <drepper at gnu.ai.mit.edu>
   Copyright (C) 1994 X Consortium
@@ -248,8 +248,8 @@ COPYING.CC0) which basically puts them into the public domain.
 
 =========
 
- Copyright 1998-2016 Free Software Foundation, Inc.
- Copyright 1997-2016 Werner Koch
+ Copyright 1998-2017 Free Software Foundation, Inc.
+ Copyright 1997-2017 Werner Koch
 
  This file is free software; as a special exception the author gives
  unlimited permission to copy and/or distribute it, with or without
diff --git a/README b/README
index 18cc316..4cb0b6c 100644
--- a/README
+++ b/README
@@ -2,8 +2,8 @@
                       =========================
                              Version 2.1
 
-          Copyright 1997-2016 Werner Koch
-          Copyright 1998-2016 Free Software Foundation, Inc.
+          Copyright 1997-2017 Werner Koch
+          Copyright 1998-2017 Free Software Foundation, Inc.
 
 
 * INTRODUCTION
diff --git a/agent/command-ssh.c b/agent/command-ssh.c
index 79cb057..f57bac3 100644
--- a/agent/command-ssh.c
+++ b/agent/command-ssh.c
@@ -1,4 +1,4 @@
-/* command-ssh.c - gpg-agent's ssh-agent emulation layer
+/* command-ssh.c - gpg-agent's implementation of the ssh-agent protocol.
  * Copyright (C) 2004-2006, 2009, 2012 Free Software Foundation, Inc.
  * Copyright (C) 2004-2006, 2009, 2012-2014 Werner Koch
  *
@@ -3216,7 +3216,7 @@ ssh_identities_remove_all (void)
   err = 0;
 
   /* FIXME: shall we remove _all_ cache entries or only those
-     registered through the ssh emulation?  */
+     registered through the ssh-agent protocol?  */
 
   return err;
 }
diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
index b203b07..c0208cc 100644
--- a/agent/gpg-agent.c
+++ b/agent/gpg-agent.c
@@ -346,7 +346,7 @@ static char *redir_socket_name_extra;
 static char *socket_name_browser;
 static char *redir_socket_name_browser;
 
-/* Name of the communication socket used for ssh-agent-emulation.  */
+/* Name of the communication socket used for ssh-agent protocol.  */
 static char *socket_name_ssh;
 static char *redir_socket_name_ssh;
 
diff --git a/common/argparse.c b/common/argparse.c
index d395229..b53efce 100644
--- a/common/argparse.c
+++ b/common/argparse.c
@@ -1,6 +1,6 @@
 /* [argparse.c wk 17.06.97] Argument Parser for option handling
  * Copyright (C) 1998-2001, 2006-2008, 2012 Free Software Foundation, Inc.
- * Copyright (C) 1997-2001, 2006-2008, 2013-2016 Werner Koch
+ * Copyright (C) 1997-2001, 2006-2008, 2013-2017 Werner Koch
  *
  * This file is part of GnuPG.
  *
@@ -71,7 +71,7 @@
 #else /* Used by GnuPG  */
 
 # define ARGPARSE_GPL_VERSION      3
-# define ARGPARSE_CRIGHT_STR "Copyright (C) 2016 Free Software Foundation, Inc."
+# define ARGPARSE_CRIGHT_STR "Copyright (C) 2017 Free Software Foundation, Inc."
 
 #endif /*GNUPG_MAJOR_VERSION*/
 
diff --git a/common/w32info-rc.h.in b/common/w32info-rc.h.in
index d7909dd..4e46b97 100644
--- a/common/w32info-rc.h.in
+++ b/common/w32info-rc.h.in
@@ -29,4 +29,4 @@ built on @BUILD_HOSTNAME@ at @BUILD_TIMESTAMP@\0"
 #define W32INFO_PRODUCTVERSION "@VERSION@\0"
 
 #define W32INFO_LEGALCOPYRIGHT "Copyright \xa9 \
-2015 Free Software Foundation, Inc.\0"
+2017 Free Software Foundation, Inc.\0"
diff --git a/g10/pubring.asc b/g10/pubring.asc
index 09b099b..5b4e9f1 100644
--- a/g10/pubring.asc
+++ b/g10/pubring.asc
@@ -1,6 +1,6 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 Version: GnuPG v1.0.0e (GNU/Linux)
-Comment: For info see http://www.gnupg.org
+Comment: For info see https://www.gnupg.org
 
 mQGiBDVBlNMRBADeX96LvyNiop30YPeeCBJZzeqQuQ3yQ+SK3AHoXLQ1qsGHrdoi
 HfHbVV2GfulRq+H/z97vUtA3APE2NZ7HuvBJzhXZCOE93wT59OZV8Pp5ir6TAEYm
diff --git a/g10/sqrtu32.c b/g10/sqrtu32.c
index 11513b0..1490b31 100644
--- a/g10/sqrtu32.c
+++ b/g10/sqrtu32.c
@@ -7,7 +7,7 @@
  * to this file.
  *
  * You should have received a copy of the CC0 legalcode along with this
- * work.  If not, see <http://creativecommons.org/publicdomain/zero/1.0/>.
+ * work.  If not, see <https://creativecommons.org/publicdomain/zero/1.0/>.
  */
 
 /* The R code to generate the following table.  */
diff --git a/tools/watchgnupg.c b/tools/watchgnupg.c
index 44ff43c..f8b6fdc 100644
--- a/tools/watchgnupg.c
+++ b/tools/watchgnupg.c
@@ -253,9 +253,9 @@ static void
 print_version (int with_help)
 {
   fputs (MYVERSION_LINE "\n"
-         "Copyright (C) 2010 Free Software Foundation, Inc.\n"
+         "Copyright (C) 2017 Free Software Foundation, Inc.\n"
          "License GPLv3+: "
-         "GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>\n"
+         "GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>\n"
          "This is free software: you are free to change and redistribute it.\n"
          "There is NO WARRANTY, to the extent permitted by law.\n",
          stdout);

-----------------------------------------------------------------------

Summary of changes:
 AUTHORS                                            |   14 +-
 NEWS                                               |  101 +-
 README                                             |    4 +-
 agent/agent.h                                      |    2 +-
 agent/call-scd.c                                   |   10 +-
 agent/command-ssh.c                                |    6 +-
 agent/divert-scd.c                                 |   10 +-
 agent/gpg-agent.c                                  |   22 +-
 agent/learncard.c                                  |    2 +-
 autogen.sh                                         |   36 +-
 build-aux/gitlog-to-changelog                      |    5 +-
 common/argparse.c                                  |    8 +-
 common/exechelp-w32.c                              |   13 +-
 common/exectool.c                                  |   60 +-
 common/gettime.c                                   |    2 +-
 common/logging.c                                   |  143 +-
 common/logging.h                                   |   20 +-
 common/t-exectool.c                                |   49 +-
 common/t-gettime.c                                 |   17 +-
 common/t-iobuf.c                                   |    6 +-
 common/tlv.c                                       |    4 +-
 common/ttyio.c                                     |  128 +-
 common/ttyio.h                                     |    1 -
 common/w32info-rc.h.in                             |    2 +-
 configure.ac                                       |   12 +-
 dirmngr/crlcache.c                                 |    2 +-
 dirmngr/dirmngr.c                                  |   12 +-
 dirmngr/dirmngr.h                                  |    1 +
 dirmngr/dns-stuff.c                                |  310 +-
 dirmngr/dns-stuff.h                                |    7 +-
 dirmngr/dns.c                                      |   27 +-
 dirmngr/http.c                                     |  247 +-
 dirmngr/http.h                                     |    3 +
 dirmngr/ks-engine-hkp.c                            |  215 +-
 dirmngr/ks-engine-http.c                           |    2 +-
 dirmngr/ks-engine-kdns.c                           |    2 +-
 dirmngr/ks-engine-ldap.c                           |    2 +-
 dirmngr/misc.c                                     |    8 +
 dirmngr/ocsp.c                                     |    2 +-
 dirmngr/server.c                                   |   59 +-
 dirmngr/t-dns-stuff.c                              |   18 +-
 doc/DETAILS                                        |   13 +
 doc/dirmngr.texi                                   |   39 +-
 doc/examples/systemd-user/dirmngr.service          |    1 +
 doc/examples/systemd-user/gpg-agent.service        |    1 +
 doc/gpg.texi                                       |   23 +
 doc/scdaemon.texi                                  |    7 +-
 doc/tools.texi                                     |   58 +-
 g10/export.c                                       |   22 +-
 g10/gpg.c                                          |   14 +-
 g10/gpgcompose.c                                   |   17 +-
 g10/import.c                                       |   21 +-
 g10/keydb.h                                        |   24 +-
 g10/keyedit.c                                      |    6 +-
 g10/keygen.c                                       |    8 +-
 g10/keylist.c                                      |   87 +-
 g10/options.h                                      |    2 +
 g10/pubring.asc                                    |    2 +-
 g10/sqrtu32.c                                      |    2 +-
 g10/t-stutter.c                                    |   17 +-
 g10/tofu.c                                         |    6 +-
 g10/trust.c                                        |   51 +-
 g10/trustdb.c                                      |    6 +-
 g13/g13tuple.c                                     |    2 +-
 po/ca.po                                           |    6 +
 po/cs.po                                           |    8 +
 po/da.po                                           |    8 +
 po/de.po                                           |   24 +-
 po/el.po                                           |    6 +
 po/eo.po                                           |    6 +
 po/es.po                                           |    8 +
 po/et.po                                           |    6 +
 po/fi.po                                           |    6 +
 po/fr.po                                           |    8 +
 po/gl.po                                           |    6 +
 po/hu.po                                           |    6 +
 po/id.po                                           |    6 +
 po/it.po                                           |    6 +
 po/ja.po                                           |    8 +
 po/nb.po                                           |    8 +
 po/pl.po                                           |    8 +
 po/pt.po                                           |    6 +
 po/ro.po                                           |    6 +
 po/ru.po                                           |    8 +
 po/sk.po                                           |    6 +
 po/sv.po                                           |    8 +
 po/tr.po                                           |    8 +
 po/uk.po                                           |    8 +
 po/zh_CN.po                                        |    6 +
 po/zh_TW.po                                        |    8 +
 scd/apdu.c                                         |  404 +-
 scd/apdu.h                                         |   15 +-
 scd/app-common.h                                   |   72 +-
 scd/app-openpgp.c                                  |   39 +-
 scd/app-p15.c                                      |    4 +-
 scd/app.c                                          |  659 +--
 scd/ccid-driver.c                                  |  782 ++--
 scd/ccid-driver.h                                  |   18 +-
 scd/command.c                                      |  801 +---
 scd/scdaemon.c                                     |    7 +-
 scd/scdaemon.h                                     |    3 +-
 tests/Makefile.am                                  |    2 +-
 tests/gpgme/gpgme-defs.scm                         |   25 -
 tests/gpgscm/init.scm                              |   17 +
 tests/gpgscm/scheme-private.h                      |    4 +-
 tests/gpgscm/scheme.c                              |  141 +-
 tests/gpgscm/tests.scm                             |  106 +-
 .../32100C27173EF6E9C4E9A25D3D69F86D37A4F939}      |    8 -
 tests/{gpgme => gpgsm}/Makefile.am                 |   22 +-
 tests/gpgsm/cert_dfn_pca01.der                     |  Bin 0 -> 1224 bytes
 tests/gpgsm/cert_dfn_pca15.der                     |  Bin 0 -> 1560 bytes
 tests/gpgsm/cert_g10code_test1.der                 |  Bin 0 -> 793 bytes
 tests/{openpgp => gpgsm}/decrypt.scm               |   10 +-
 .../{openpgp/compression.scm => gpgsm/encrypt.scm} |   25 +-
 tests/{openpgp/4gb-packet.scm => gpgsm/export.scm} |   20 +-
 tests/gpgsm/gpgsm-defs.scm                         |  103 +
 tests/gpgsm/import.scm                             |   53 +
 tests/gpgsm/plain-1.cms.asc                        |   33 +
 tests/gpgsm/plain-2.cms.asc                        |   43 +
 tests/gpgsm/plain-3.cms.asc                        |   11 +
 tests/gpgsm/plain-large.cms.asc                    | 4213 ++++++++++++++++++++
 tests/{openpgp => gpgsm}/run-tests.scm             |    3 -
 tests/{gpgme => gpgsm}/setup.scm                   |   13 +-
 tests/{openpgp => gpgsm}/shell.scm                 |    9 +-
 tests/{openpgp/compression.scm => gpgsm/sign.scm}  |   21 +-
 tests/gpgsm/verify.scm                             |   65 +
 tests/openpgp/Makefile.am                          |    4 +-
 ...onventional-mdc.scm => decrypt-session-key.scm} |   45 +-
 tests/openpgp/defs.scm                             |  105 +-
 tests/openpgp/gpgconf.scm                          |   51 +
 tests/openpgp/plain-large.asc                      | 1332 +++++++
 tests/openpgp/setup.scm                            |    4 +-
 tests/openpgp/ssh-import.scm                       |    6 +-
 tests/openpgp/tofu.scm                             |   13 +-
 tools/gpg-wks-client.c                             |   15 +-
 tools/gpgconf-comp.c                               |   80 +-
 tools/gpgconf.c                                    |   17 +-
 tools/gpgconf.h                                    |    4 +
 tools/gpgtar-create.c                              |    6 +-
 tools/watchgnupg.c                                 |    4 +-
 140 files changed, 9436 insertions(+), 2222 deletions(-)
 copy tests/{samplekeys/32100C27173EF6E9C4E9A25D3D69F86D37A4F939.key => gpgsm/32100C27173EF6E9C4E9A25D3D69F86D37A4F939} (99%)
 copy tests/{gpgme => gpgsm}/Makefile.am (81%)
 create mode 100644 tests/gpgsm/cert_dfn_pca01.der
 create mode 100644 tests/gpgsm/cert_dfn_pca15.der
 create mode 100644 tests/gpgsm/cert_g10code_test1.der
 copy tests/{openpgp => gpgsm}/decrypt.scm (80%)
 mode change 100755 => 100644
 copy tests/{openpgp/compression.scm => gpgsm/encrypt.scm} (63%)
 mode change 100755 => 100644
 copy tests/{openpgp/4gb-packet.scm => gpgsm/export.scm} (65%)
 mode change 100755 => 100644
 create mode 100644 tests/gpgsm/gpgsm-defs.scm
 create mode 100644 tests/gpgsm/import.scm
 create mode 100644 tests/gpgsm/plain-1.cms.asc
 create mode 100644 tests/gpgsm/plain-2.cms.asc
 create mode 100644 tests/gpgsm/plain-3.cms.asc
 create mode 100644 tests/gpgsm/plain-large.cms.asc
 copy tests/{openpgp => gpgsm}/run-tests.scm (92%)
 copy tests/{gpgme => gpgsm}/setup.scm (74%)
 copy tests/{openpgp => gpgsm}/shell.scm (79%)
 copy tests/{openpgp/compression.scm => gpgsm/sign.scm} (69%)
 mode change 100755 => 100644
 create mode 100644 tests/gpgsm/verify.scm
 copy tests/openpgp/{conventional-mdc.scm => decrypt-session-key.scm} (50%)
 create mode 100644 tests/openpgp/gpgconf.scm
 create mode 100644 tests/openpgp/plain-large.asc


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 22:00:18 2017
From: cvs at cvs.gnupg.org (by Jussi Kivilinna)
Date: Mon, 23 Jan 2017 22:00:18 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-57-g39b9302
Message-ID: <E1cVliu-0000iu-Dj@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  39b9302da5d08bd52688d20befe626fee0b6c41d (commit)
       via  bf9e0b79e620ca2324224893b07522462b125412 (commit)
      from  623aab8a940ea61afe3fef650ad485a755ed9fe7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 39b9302da5d08bd52688d20befe626fee0b6c41d
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Mon Jan 23 20:01:32 2017 +0200

    rijndael-ssse3-amd64: fix building on x32
    
    * cipher/rijndael-ssse3-amd64.c: Use 64-bit call instructions
    with 64-bit registers.
    --
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/rijndael-ssse3-amd64.c b/cipher/rijndael-ssse3-amd64.c
index 25d1849..78d8234 100644
--- a/cipher/rijndael-ssse3-amd64.c
+++ b/cipher/rijndael-ssse3-amd64.c
@@ -128,14 +128,14 @@ extern void _gcry_aes_ssse3_decrypt_core(void);
 
 #define vpaes_ssse3_prepare_enc() \
     vpaes_ssse3_prepare(); \
-    asm volatile ("call *%[core] \n\t" \
+    asm volatile ("callq *%q[core] \n\t" \
                   : \
                   : [core] "r" (_gcry_aes_ssse3_enc_preload) \
                   : "rax", "cc", "memory" )
 
 #define vpaes_ssse3_prepare_dec() \
     vpaes_ssse3_prepare(); \
-    asm volatile ("call *%[core] \n\t" \
+    asm volatile ("callq *%q[core] \n\t" \
                   : \
                   : [core] "r" (_gcry_aes_ssse3_dec_preload) \
                   : "rax", "cc", "memory" )
@@ -155,7 +155,7 @@ _gcry_aes_ssse3_do_setkey (RIJNDAEL_context *ctx, const byte *key)
                 "leaq %[buf], %%rdx"			"\n\t"
                 "movl %[dir], %%ecx"			"\n\t"
                 "movl %[rotoffs], %%r8d"		"\n\t"
-                "call *%[core]"				"\n\t"
+                "callq *%q[core]"			"\n\t"
                 :
                 : [core] "r" (&_gcry_aes_ssse3_schedule_core),
                   [key] "m" (*key),
@@ -208,7 +208,7 @@ _gcry_aes_ssse3_prepare_decryption (RIJNDAEL_context *ctx)
                 "leaq %[buf], %%rdx"			"\n\t"
                 "movl %[dir], %%ecx"			"\n\t"
                 "movl %[rotoffs], %%r8d"		"\n\t"
-                "call *%[core]"				"\n\t"
+                "callq *%q[core]"			"\n\t"
                 :
                 : [core] "r" (_gcry_aes_ssse3_schedule_core),
                   [key] "m" (ctx->keyschdec32[0][0]),
@@ -231,7 +231,7 @@ do_vpaes_ssse3_enc (const RIJNDAEL_context *ctx, unsigned int nrounds)
   unsigned int middle_rounds = nrounds - 1;
   const void *keysched = ctx->keyschenc32;
 
-  asm volatile ("call *%[core]"				"\n\t"
+  asm volatile ("callq *%q[core]"			"\n\t"
 		: "+a" (middle_rounds), "+d" (keysched)
 		: [core] "r" (_gcry_aes_ssse3_encrypt_core)
 		: "rcx", "rsi", "rdi", "cc", "memory");
@@ -246,7 +246,7 @@ do_vpaes_ssse3_dec (const RIJNDAEL_context *ctx, unsigned int nrounds)
   unsigned int middle_rounds = nrounds - 1;
   const void *keysched = ctx->keyschdec32;
 
-  asm volatile ("call *%[core]"				"\n\t"
+  asm volatile ("callq *%q[core]"			"\n\t"
                 : "+a" (middle_rounds), "+d" (keysched)
 		: [core] "r" (_gcry_aes_ssse3_decrypt_core)
                 : "rcx", "rsi", "cc", "memory");

commit bf9e0b79e620ca2324224893b07522462b125412
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Mon Jan 23 19:48:28 2017 +0200

    bufhelp: use 'may_alias' attribute unaligned pointer types
    
    * configure.ac (gcry_cv_gcc_attribute_may_alias)
    (HAVE_GCC_ATTRIBUTE_MAY_ALIAS): New check for 'may_alias' attribute.
    * cipher/bufhelp.h (BUFHELP_FAST_UNALIGNED_ACCESS): Enable only if
    HAVE_GCC_ATTRIBUTE_MAY_ALIAS is defined.
    [BUFHELP_FAST_UNALIGNED_ACCESS] (bufhelp_int_t, bufhelp_u32_t)
    (bufhelp_u64_t): Add 'may_alias' attribute.
    * src/g10lib.h (fast_wipememory_t): Add HAVE_GCC_ATTRIBUTE_MAY_ALIAS
    defined check; Add 'may_alias' attribute.
    --
    
    Attribute 'may_alias' was missing from bufhelp unaligned memory access
    pointer types, and was causing problems with newer GCC versions (with
    more aggressive optimization). This patch fixes broken Camellia-CFB
    with '-O3 -flto' flags with GCC-6 on x86-64 and generic GCM with
    default '-O2' on x32.
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/bufhelp.h b/cipher/bufhelp.h
index df35594..3616515 100644
--- a/cipher/bufhelp.h
+++ b/cipher/bufhelp.h
@@ -26,6 +26,7 @@
 #undef BUFHELP_FAST_UNALIGNED_ACCESS
 #if defined(HAVE_GCC_ATTRIBUTE_PACKED) && \
     defined(HAVE_GCC_ATTRIBUTE_ALIGNED) && \
+    defined(HAVE_GCC_ATTRIBUTE_MAY_ALIAS) && \
     (defined(__i386__) || defined(__x86_64__) || \
      (defined(__arm__) && defined(__ARM_FEATURE_UNALIGNED)) || \
      defined(__aarch64__))
@@ -43,7 +44,7 @@
 typedef struct bufhelp_int_s
 {
   uintptr_t a;
-} __attribute__((packed, aligned(1))) bufhelp_int_t;
+} __attribute__((packed, aligned(1), may_alias)) bufhelp_int_t;
 #else
 /* Define type with default alignment for other architectures (unaligned
    accessed handled in per byte loops).
@@ -370,7 +371,7 @@ static inline void buf_put_le64(void *_buf, u64 val)
 typedef struct bufhelp_u32_s
 {
   u32 a;
-} __attribute__((packed, aligned(1))) bufhelp_u32_t;
+} __attribute__((packed, aligned(1), may_alias)) bufhelp_u32_t;
 
 /* Functions for loading and storing unaligned u32 values of different
    endianness.  */
@@ -400,7 +401,7 @@ static inline void buf_put_le32(void *_buf, u32 val)
 typedef struct bufhelp_u64_s
 {
   u64 a;
-} __attribute__((packed, aligned(1))) bufhelp_u64_t;
+} __attribute__((packed, aligned(1), may_alias)) bufhelp_u64_t;
 
 /* Functions for loading and storing unaligned u64 values of different
    endianness.  */
diff --git a/configure.ac b/configure.ac
index 31c0d55..5dd27ca 100644
--- a/configure.ac
+++ b/configure.ac
@@ -994,6 +994,21 @@ fi
 
 
 #
+# Check whether the compiler supports the GCC style may_alias attribute
+#
+AC_CACHE_CHECK([whether the GCC style may_alias attribute is supported],
+       [gcry_cv_gcc_attribute_may_alias],
+       [gcry_cv_gcc_attribute_may_alias=no
+        AC_COMPILE_IFELSE([AC_LANG_SOURCE(
+          [[struct { int a; } foo __attribute__ ((may_alias));]])],
+          [gcry_cv_gcc_attribute_may_alias=yes])])
+if test "$gcry_cv_gcc_attribute_may_alias" = "yes" ; then
+   AC_DEFINE(HAVE_GCC_ATTRIBUTE_MAY_ALIAS,1,
+     [Defined if a GCC style "__attribute__ ((may_alias))" is supported])
+fi
+
+
+#
 # Check whether the compiler supports 'asm' or '__asm__' keyword for
 # assembler blocks.
 #
diff --git a/src/g10lib.h b/src/g10lib.h
index 1308cff..8ce84b8 100644
--- a/src/g10lib.h
+++ b/src/g10lib.h
@@ -334,6 +334,7 @@ void __gcry_burn_stack (unsigned int bytes);
 /* Following architectures can handle unaligned accesses fast.  */
 #if defined(HAVE_GCC_ATTRIBUTE_PACKED) && \
     defined(HAVE_GCC_ATTRIBUTE_ALIGNED) && \
+    defined(HAVE_GCC_ATTRIBUTE_MAY_ALIAS) && \
     (defined(__i386__) || defined(__x86_64__) || \
      defined(__powerpc__) || defined(__powerpc64__) || \
      (defined(__arm__) && defined(__ARM_FEATURE_UNALIGNED)) || \
@@ -342,7 +343,7 @@ void __gcry_burn_stack (unsigned int bytes);
 typedef struct fast_wipememory_s
 {
   FASTWIPE_T a;
-} __attribute__((packed, aligned(1))) fast_wipememory_t;
+} __attribute__((packed, aligned(1), may_alias)) fast_wipememory_t;
 #else
 #define fast_wipememory2_unaligned_head(_vptr,_vset,_vlen) do { \
               while((size_t)(_vptr)&(sizeof(FASTWIPE_T)-1) && _vlen) \

-----------------------------------------------------------------------

Summary of changes:
 cipher/bufhelp.h              |  7 ++++---
 cipher/rijndael-ssse3-amd64.c | 12 ++++++------
 configure.ac                  | 15 +++++++++++++++
 src/g10lib.h                  |  3 ++-
 4 files changed, 27 insertions(+), 10 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 22:31:14 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 23 Jan 2017 22:31:14 +0100
Subject: [git] GnuPG - branch, STABLE-BRANCH-2-2,
 updated. gnupg-2.1.17-109-g14bc2fa
Message-ID: <E1cVmCq-0002dc-PJ@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-2-2 has been updated
       via  14bc2fa43e9ee26a6940a7552e8f892a79223617 (commit)
       via  f8289b1d28f501d2f37bf9ccb5e42f7fb27b4688 (commit)
       via  25e029823813e190a18b601af60efcb1fb3b84af (commit)
      from  d393678aaed165169b88b6f312f83d7e8d81d80d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 14bc2fa43e9ee26a6940a7552e8f892a79223617
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 22:24:20 2017 +0100

    Post release updates
    
    --

diff --git a/NEWS b/NEWS
index 054ede9..82753b9 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,7 @@
+Noteworthy changes in version 2.1.19 (unreleased)
+-------------------------------------------------
+
+
 Noteworthy changes in version 2.1.18 (2017-01-23)
 -------------------------------------------------
 
diff --git a/configure.ac b/configure.ac
index f929cb6..75bed06 100644
--- a/configure.ac
+++ b/configure.ac
@@ -28,7 +28,7 @@ min_automake_version="1.14"
 m4_define([mym4_package],[gnupg])
 m4_define([mym4_major], [2])
 m4_define([mym4_minor], [1])
-m4_define([mym4_micro], [18])
+m4_define([mym4_micro], [19])
 
 # To start a new development series, i.e a new major or minor number
 # you need to mark an arbitrary commit before the first beta release

commit f8289b1d28f501d2f37bf9ccb5e42f7fb27b4688
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 19:26:37 2017 +0100

    Release 2.1.18
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index da0f0f7..054ede9 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,66 @@
-Noteworthy changes in version 2.1.18 (unreleased)
+Noteworthy changes in version 2.1.18 (2017-01-23)
 -------------------------------------------------
 
+  * gpg: Remove bogus subkey signature while cleaning a key (with
+    export-clean, import-clean, or --edit-key's sub-command clean)
+
+  * gpg: Allow freezing the clock with --faked-system-time.
+
+  * gpg: New --export-option flag "backup", new --import-option flag
+    "restore".
+
+  * gpg-agent: Fixed long delay due to a regression in the progress
+    callback code.
+
+  * scd: Lots of code cleanup and internal changes.
+
+  * scd: Improved the internal CCID driver.
+
+  * dirmngr: Fixed problem with the DNS glue code (removal of the
+    trailing dot in domain names).
+
+  * dirmngr: Make sure that Tor is actually enabled after changing the
+    conf file and sending SIGHUP or "gpgconf --reload dirmngr".
+
+  * dirmngr: Fixed Tor access to IPv6 addresses.  Note that current
+    versions of Tor may require that the flag "IPv6Traffic" is used
+    with the option "SocksPort" in torrc to actually allow IPv6
+    traffic.
+
+  * dirmngr: Fixed HKP for literally given IPv6 addresses.
+
+  * dirmngr: Enabled reverse DNS lookups via Tor.
+
+  * dirmngr: Added experimental SRV record lookup for WKD.
+    See commit 88dc3af3d4ae1afe1d5e136bc4c38bc4e7d4cd10 for details.
+
+  * dirmngr: For HKP use "pgpkey-hkps" and "pgpkey-hkp" in SRV record
+    lookups.  Avoid SRV record lookup when a port is explicitly
+    specified.  This fixes a regression from the 1.4 and 2.0 behavior.
+
+  * dirmngr: Gracefully handle a missing /etc/nsswitch.conf.  Ignore
+    negation terms (e.g. "[!UNAVAIL=return]" instead of bailing out.
+
+  * dirmngr: Better debug output for flags "dns" and "network".
+
+  * dirmngr: On reload mark all known HKP servers alive.
+
+  * gpgconf: Allow keyword "all" for --launch, --kill, and --reload.
+
+  * tools: gpg-wks-client now ignores a missing policy file on the
+    server.
+
+  * Avoid unnecessary ambiguity error message in the option parsing.
+
+  * Further improvements of the regression test suite.
+
+  * Fixed building with --disable-libdns configure option.
+
+  * Fixed a crash running the tests on 32 bit architectures.
+
+  * Fixed spurious failures on BSD system in the spawn functions.
+    This affected for example gpg-wks-client and gpgconf.
+
 
 Noteworthy changes in version 2.1.17 (2016-12-20)
 -------------------------------------------------

commit 25e029823813e190a18b601af60efcb1fb3b84af
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 21:14:32 2017 +0100

    build: Change make distcheck configure and temp. remove gpgconf.scm.
    
    * Makefile.am (DISTCHECK_CONFIGURE_FLAGS): Also test gpgtar and
    wks-tools.  Disable ntbtls.
    * tests/openpgp/Makefile.am (XTESTS): Temporary remove gpgconf.scm.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/Makefile.am b/Makefile.am
index 735c72b..e220f8b 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -20,7 +20,7 @@
 
 ACLOCAL_AMFLAGS = -I m4
 DISTCHECK_CONFIGURE_FLAGS = --enable-symcryptrun --enable-g13 \
-  --enable-gpg2-is-gpg
+  --enable-gpg2-is-gpg --enable-gpgtar --enable-wks-tools --disable-ntbtls
 
 GITLOG_TO_CHANGELOG=gitlog-to-changelog
 
diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index d1dd449..05341fb 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -92,12 +92,15 @@ XTESTS = \
 	quick-key-manipulation.scm \
 	key-selection.scm \
 	delete-keys.scm \
-	gpgconf.scm \
 	issue2015.scm \
 	issue2346.scm \
 	issue2417.scm \
 	issue2419.scm
 
+# Fixme: gpgconf.scm does not yet work with make distcheck.
+#	gpgconf.scm
+
+
 # XXX: Currently, one cannot override automake's 'check' target.  As a
 # workaround, we avoid defining 'TESTS', thus automake will not emit
 # the 'check' target.  For extra robustness, we merely define a

-----------------------------------------------------------------------

Summary of changes:
 Makefile.am               |  2 +-
 NEWS                      | 66 ++++++++++++++++++++++++++++++++++++++++++++++-
 configure.ac              |  2 +-
 tests/openpgp/Makefile.am |  5 +++-
 4 files changed, 71 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 22:32:07 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 23 Jan 2017 22:32:07 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-1-g14bc2fa
Message-ID: <E1cVmDh-0002g0-K8@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  14bc2fa43e9ee26a6940a7552e8f892a79223617 (commit)
       via  f8289b1d28f501d2f37bf9ccb5e42f7fb27b4688 (commit)
       via  25e029823813e190a18b601af60efcb1fb3b84af (commit)
       via  d393678aaed165169b88b6f312f83d7e8d81d80d (commit)
       via  ee79e84914c140980e2275948e33d8d314ad2f81 (commit)
       via  707c47f5592d48fb39a97e65f142de3d70ef7a7d (commit)
      from  af5979a42b9468ffe0f3ac6de5a77d982c5cf8a0 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
-----------------------------------------------------------------------

Summary of changes:
 AUTHORS                   | 10 +++----
 Makefile.am               |  2 +-
 NEWS                      | 66 ++++++++++++++++++++++++++++++++++++++++++++++-
 README                    |  4 +--
 agent/command-ssh.c       |  4 +--
 agent/gpg-agent.c         |  2 +-
 common/argparse.c         |  4 +--
 common/w32info-rc.h.in    |  2 +-
 configure.ac              |  2 +-
 g10/pubring.asc           |  2 +-
 g10/sqrtu32.c             |  2 +-
 po/ca.po                  |  6 +++++
 po/cs.po                  |  8 ++++++
 po/da.po                  |  8 ++++++
 po/de.po                  |  8 +++++-
 po/el.po                  |  6 +++++
 po/eo.po                  |  6 +++++
 po/es.po                  |  8 ++++++
 po/et.po                  |  6 +++++
 po/fi.po                  |  6 +++++
 po/fr.po                  |  8 ++++++
 po/gl.po                  |  6 +++++
 po/hu.po                  |  6 +++++
 po/id.po                  |  6 +++++
 po/it.po                  |  6 +++++
 po/ja.po                  |  8 ++++++
 po/nb.po                  |  8 ++++++
 po/pl.po                  |  8 ++++++
 po/pt.po                  |  6 +++++
 po/ro.po                  |  6 +++++
 po/ru.po                  |  8 ++++++
 po/sk.po                  |  6 +++++
 po/sv.po                  |  8 ++++++
 po/tr.po                  |  8 ++++++
 po/uk.po                  |  8 ++++++
 po/zh_CN.po               |  6 +++++
 po/zh_TW.po               |  8 ++++++
 tests/openpgp/Makefile.am |  5 +++-
 tools/watchgnupg.c        |  4 +--
 39 files changed, 269 insertions(+), 22 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 22:57:32 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 23 Jan 2017 22:57:32 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. d292eb51ffef71155aac900fd5fa1b6556e966eb
Message-ID: <E1cVmcI-0003VI-6l@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  d292eb51ffef71155aac900fd5fa1b6556e966eb (commit)
      from  9336aa31498081afa75da95e9d6794403c6dd151 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d292eb51ffef71155aac900fd5fa1b6556e966eb
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 22:49:16 2017 +0100

    swdb: Release info for GnuPG 2.1.18 and Libgcrypt 1.7.6

diff --git a/web/index.org b/web/index.org
index 8373104..640e3cb 100644
--- a/web/index.org
+++ b/web/index.org
@@ -66,6 +66,17 @@ The latest release news:\\
 # point or paste the [[news.en.rss][RSS file]] into your aggregator.
 
 
+** GnuPG 2.1.18 released (2017-01-23)
+
+A new version of GnuPG has been released.  Read the full [[https://lists.gnupg.org/pipermail/gnupg-announce/2017q1/000401.html][announcement
+mail]] for details.
+
+** Libgcrypt 1.7.6 released (2017-01-18)
+
+We are pleased to announce the availability of Libgcrypt version
+1.7.6.  This is a maintenance release for the stable version of
+[[file:related_software/libgcrypt/index.org][Libgcrypt]] with a few bug fixes.
+
 ** GnuPG 2.1.17 released (2016-12-20)
 
 A new version of GnuPG has been released.  Read the full [[https://lists.gnupg.org/pipermail/gnupg-announce/2016q4/000400.html][announcement
diff --git a/web/swdb.mac b/web/swdb.mac
index 39c6ce6..af010dc 100644
--- a/web/swdb.mac
+++ b/web/swdb.mac
@@ -21,17 +21,16 @@
 #
 # GnuPG-2.1
 #
-#+macro: gnupg21_ver  2.1.17
-#+macro: gnupg21_date 2016-12-20
-#+macro: gnupg21_size 5830k
-#+macro: gnupg21_sha1 d83ab893faab35f37ace772ca29b939e6a5aa6a7
-#+macro: gnupg21_sha2 c5dc54db432209fa8f9bdb071c8fb60a765ff28e363150e30bdd4543160243cb
-#
-#+macro: gnupg21_w32_ver  2.1.17_20161220
-#+macro: gnupg21_w32_date 2016-12-20
-#+macro: gnupg21_w32_size 3665k
-#+macro: gnupg21_w32_sha1 a95758912ed5354235ff9947a3c402108d5ec67e
-#+macro: gnupg21_w32_sha2 f727fd5126f98dc7a0473a01e2fb404bd1870473bf4f6d15e3a29f8b5fa5ad23
+#+macro: gnupg21_ver  2.1.18
+#+macro: gnupg21_date 2017-01-23
+#+macro: gnupg21_size 6160k
+#+macro: gnupg21_sha1 b698012cc2d77c2652afd168a15e679d1394fa89
+#+macro: gnupg21_sha2 d04c6fab7e5562ce4b915b22020e34d4c1a256847690cf149842264fc7cef994
+#+macro: gnupg21_w32_ver  2.1.18_20170123
+#+macro: gnupg21_w32_date 2017-01-23
+#+macro: gnupg21_w32_size 3670k
+#+macro: gnupg21_w32_sha1 8d068811acef74619ca435b8bb7e77135bc4277b
+#+macro: gnupg21_w32_sha2 1fd01e24f65465dfd075b8ad55a58eaee13e79c02c42096c325a7ccf5a1eb283
 
 
 #
@@ -82,11 +81,11 @@
 #
 # LIBGCRYPT
 #
-#+macro: libgcrypt_ver  1.7.5
-#+macro: libgcrypt_date 2016-12-15
-#+macro: libgcrypt_size 2816k
-#+macro: libgcrypt_sha1 fa485d854748fc06ea041b3057b2de2f12fbc17f
-#+macro: libgcrypt_sha2 d1fea4128beef2bb30a470af6bafabccc503ced350534fb9dd8f5a53ffbae800
+#+macro: libgcrypt_ver  1.7.6
+#+macro: libgcrypt_date 2017-01-18
+#+macro: libgcrypt_size 2829k
+#+macro: libgcrypt_sha1 d2b9e0f413064cfc67188f80d3cbda887c755a62
+#+macro: libgcrypt_sha2 626aafee84af9d2ce253d2c143dc1c0902dda045780cc241f39970fc60be05bc
 
 
 #

-----------------------------------------------------------------------

Summary of changes:
 web/index.org | 11 +++++++++++
 web/swdb.mac  | 31 +++++++++++++++----------------
 2 files changed, 26 insertions(+), 16 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 22:59:21 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 23 Jan 2017 22:59:21 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-2-g9d45a20
Message-ID: <E1cVme3-0003hx-Rk@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  9d45a20ece78ece3eede95e94f5cfbe1d4906dac (commit)
      from  14bc2fa43e9ee26a6940a7552e8f892a79223617 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9d45a20ece78ece3eede95e94f5cfbe1d4906dac
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 22:56:50 2017 +0100

    Update NEWS with link to release announcement.
    
    --

diff --git a/NEWS b/NEWS
index 82753b9..df45d8a 100644
--- a/NEWS
+++ b/NEWS
@@ -65,6 +65,8 @@ Noteworthy changes in version 2.1.18 (2017-01-23)
   * Fixed spurious failures on BSD system in the spawn functions.
     This affected for example gpg-wks-client and gpgconf.
 
+  See-also: gnupg-announce/2017q1/000401.html
+
 
 Noteworthy changes in version 2.1.17 (2016-12-20)
 -------------------------------------------------

-----------------------------------------------------------------------

Summary of changes:
 NEWS | 2 ++
 1 file changed, 2 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 23 23:06:05 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 23 Jan 2017 23:06:05 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-3-gc023446
Message-ID: <E1cVmka-0004S5-5h@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  c0234462dce17766e1844ad7f6219eb5b5372a05 (commit)
      from  9d45a20ece78ece3eede95e94f5cfbe1d4906dac (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c0234462dce17766e1844ad7f6219eb5b5372a05
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 23 23:03:36 2017 +0100

    speedo: Remove the unused ADNS package.
    
    --

diff --git a/build-aux/speedo.mk b/build-aux/speedo.mk
index 8a366e6..1adcabe 100644
--- a/build-aux/speedo.mk
+++ b/build-aux/speedo.mk
@@ -184,7 +184,7 @@ speedo_spkgs  = \
 
 ifeq ($(TARGETOS),w32)
 speedo_spkgs += \
-	zlib bzip2 adns sqlite
+	zlib bzip2 sqlite
 ifeq ($(WITH_GUI),1)
 speedo_spkgs += gettext libiconv
 endif
@@ -314,10 +314,6 @@ bzip2_ver  := $(shell awk '$$1=="bzip2_ver" {print $$2}' swdb.lst)
 bzip2_sha1 := $(shell awk '$$1=="bzip2_sha1_gz" {print $$2}' swdb.lst)
 bzip2_sha2 := $(shell awk '$$1=="bzip2_sha2_gz" {print $$2}' swdb.lst)
 
-adns_ver  := $(shell awk '$$1=="adns_ver" {print $$2}' swdb.lst)
-adns_sha1 := $(shell awk '$$1=="adns_sha1" {print $$2}' swdb.lst)
-adns_sha2 := $(shell awk '$$1=="adns_sha2" {print $$2}' swdb.lst)
-
 sqlite_ver  := $(shell awk '$$1=="sqlite_ver" {print $$2}' swdb.lst)
 sqlite_sha1 := $(shell awk '$$1=="sqlite_sha1_gz" {print $$2}' swdb.lst)
 sqlite_sha2 := $(shell awk '$$1=="sqlite_sha2_gz" {print $$2}' swdb.lst)
@@ -331,7 +327,6 @@ $(info Libgcrypt ......: $(libgcrypt_ver))
 $(info Libassuan ......: $(libassuan_ver))
 $(info Zlib ...........: $(zlib_ver))
 $(info Bzip2 ..........: $(bzip2_ver))
-$(info ADNS ...........: $(adns_ver))
 $(info SQLite .........: $(sqlite_ver))
 $(info GPGME ..........: $(gpgme_ver))
 $(info Pinentry .......: $(pinentry_ver))
@@ -431,7 +426,6 @@ speedo_pkg_pkg_config_tar = $(pkg2rep)/pkg-config-$(pkg_config_ver).tar.gz
 speedo_pkg_zlib_tar       = $(pkgrep)/zlib/zlib-$(zlib_ver).tar.gz
 speedo_pkg_bzip2_tar      = $(pkgrep)/bzip2/bzip2-$(bzip2_ver).tar.gz
 speedo_pkg_sqlite_tar     = $(pkgrep)/sqlite/sqlite-autoconf-$(sqlite_ver).tar.gz
-speedo_pkg_adns_tar       = $(pkg10rep)/adns/adns-$(adns_ver).tar.bz2
 speedo_pkg_libiconv_tar   = $(pkg2rep)/libiconv-$(libiconv_ver).tar.gz
 speedo_pkg_gettext_tar    = $(pkg2rep)/gettext-$(gettext_ver).tar.gz
 speedo_pkg_libffi_tar     = $(pkg2rep)/libffi-$(libffi_ver).tar.gz
diff --git a/build-aux/speedo/w32/inst.nsi b/build-aux/speedo/w32/inst.nsi
index 164e26b..d117495 100644
--- a/build-aux/speedo/w32/inst.nsi
+++ b/build-aux/speedo/w32/inst.nsi
@@ -735,15 +735,6 @@ Section "-zlib" SEC_zlib
   File bin/zlib1.dll
 SectionEnd
 
-Section "-adns" SEC_adns
-  SetOutPath "$INSTDIR\bin"
-  File bin/libadns-1.dll
-  SetOutPath "$INSTDIR\lib"
-  File /oname=libadns.imp lib/libadns.dll.a
-  SetOutPath "$INSTDIR\include"
-  File include/adns.h
-SectionEnd
-
 Section "-npth" SEC_npth
   SetOutPath "$INSTDIR\bin"
   File bin/libnpth-0.dll
@@ -1193,12 +1184,6 @@ Section "-un.npth"
   Delete "$INSTDIR\include\npth.h"
 SectionEnd
 
-Section "-un.adns"
-  Delete "$INSTDIR\bin\libadns-1.dll"
-  Delete "$INSTDIR\lib\libadns.imp"
-  Delete "$INSTDIR\include\adns.h"
-SectionEnd
-
 Section "-un.zlib"
   Delete "$INSTDIR\bin\zlib1.dll"
 SectionEnd

-----------------------------------------------------------------------

Summary of changes:
 build-aux/speedo.mk           |  8 +-------
 build-aux/speedo/w32/inst.nsi | 15 ---------------
 2 files changed, 1 insertion(+), 22 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 24 14:32:40 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 24 Jan 2017 14:32:40 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-5-g5aafa56
Message-ID: <E1cW1DI-00022H-9k@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  5aafa56dffefe3fac55b9d0555c7c86e8a07f072 (commit)
       via  628ff843466b42309f850b8d65b13cf5f586b81f (commit)
      from  c0234462dce17766e1844ad7f6219eb5b5372a05 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5aafa56dffefe3fac55b9d0555c7c86e8a07f072
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 24 14:28:36 2017 +0100

    tests: Add test demonstrating issue2929.
    
    * tests/openpgp/Makefile.am (XTESTS): Add new test.
    * tests/openpgp/issue2929.scm: New file.
    --
    This test demonstrates a problem with the TOFU trust model when a new
    key is created.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index d1dd449..5cab3d5 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -96,7 +96,8 @@ XTESTS = \
 	issue2015.scm \
 	issue2346.scm \
 	issue2417.scm \
-	issue2419.scm
+	issue2419.scm \
+	issue2929.scm
 
 # XXX: Currently, one cannot override automake's 'check' target.  As a
 # workaround, we avoid defining 'TESTS', thus automake will not emit
diff --git a/tests/openpgp/issue2929.scm b/tests/openpgp/issue2929.scm
new file mode 100644
index 0000000..44521bb
--- /dev/null
+++ b/tests/openpgp/issue2929.scm
@@ -0,0 +1,32 @@
+#!/usr/bin/env gpgscm
+
+;; Copyright (C) 2017 g10 Code GmbH
+;;
+;; This file is part of GnuPG.
+;;
+;; GnuPG is free software; you can redistribute it and/or modify
+;; it under the terms of the GNU General Public License as published by
+;; the Free Software Foundation; either version 3 of the License, or
+;; (at your option) any later version.
+;;
+;; GnuPG is distributed in the hope that it will be useful,
+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;; GNU General Public License for more details.
+;;
+;; You should have received a copy of the GNU General Public License
+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
+
+(load (with-path "defs.scm"))
+(setup-environment)
+
+(catch (skip "Tofu not supported")
+       (call-check `(, at gpg --trust-model=tofu --list-config)))
+
+;; Redefine GPG without --always-trust and TOFU trust model.
+(define gpg `(,(tool 'gpg) --no-permission-warning --trust-model=tofu))
+
+(info "Checking key creation with TOFU trust model (issue2929).")
+(call-check `(, at gpg --quick-generate-key frob at example.org))
+(call-check `(, at gpg --sign gpg.conf))
+(call-check `(, at gpg --verify gpg.conf.gpg))

commit 628ff843466b42309f850b8d65b13cf5f586b81f
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 24 14:20:36 2017 +0100

    tests: Enable gpgconf test.
    
    * tests/openpgp/Makefile.am (XTESTS): Re-add gpgconf.scm.
    --
    This partially reverts 25e029823813e190a18b601af60efcb1fb3b84af.
    
    That change was not sufficiently motivated, and our continuous
    integration server shows no recent distcheck failures.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index 05341fb..d1dd449 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -92,15 +92,12 @@ XTESTS = \
 	quick-key-manipulation.scm \
 	key-selection.scm \
 	delete-keys.scm \
+	gpgconf.scm \
 	issue2015.scm \
 	issue2346.scm \
 	issue2417.scm \
 	issue2419.scm
 
-# Fixme: gpgconf.scm does not yet work with make distcheck.
-#	gpgconf.scm
-
-
 # XXX: Currently, one cannot override automake's 'check' target.  As a
 # workaround, we avoid defining 'TESTS', thus automake will not emit
 # the 'check' target.  For extra robustness, we merely define a

-----------------------------------------------------------------------

Summary of changes:
 tests/openpgp/Makefile.am                      |  8 +++-----
 tests/openpgp/{issue2417.scm => issue2929.scm} | 18 +++++++++---------
 2 files changed, 12 insertions(+), 14 deletions(-)
 copy tests/openpgp/{issue2417.scm => issue2929.scm} (61%)
 mode change 100755 => 100644


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 24 15:47:37 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 24 Jan 2017 15:47:37 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-11-g73d6572
Message-ID: <E1cW2Np-0005Cq-W2@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  73d6572bd0f260c5aa1e191a1ba4859ec6fa262c (commit)
       via  77b8aff4e1bb641f497e63230a5006ab70e6c3a8 (commit)
       via  bfd75e9492fc4edd86f4049a62304943a7b2a29a (commit)
       via  82e309ad06884e54693f4856412984331febdda0 (commit)
       via  b0348fdb26637b0bcbd68a96c1746a1613b309af (commit)
       via  5b28f025085b386e0ec49535d4cd3f875a414eb0 (commit)
      from  5aafa56dffefe3fac55b9d0555c7c86e8a07f072 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 73d6572bd0f260c5aa1e191a1ba4859ec6fa262c
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 24 15:36:59 2017 +0100

    tools: Use platform abstraction for I/O.
    
    * tools/gpg-connect-agent.c (main): Use a gpgrt_stream_t for
    'script_fp'.  Adapt accordingly.
    --
    Werner asked me to make gpgconf use the platform abstractions that
    were introduced after gpgconf's inception.  After doing that, I
    realized that 'read_line' is only used in two more places, one of
    which this patch takes care of.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tools/gpg-connect-agent.c b/tools/gpg-connect-agent.c
index a5413cf..2d054f4 100644
--- a/tools/gpg-connect-agent.c
+++ b/tools/gpg-connect-agent.c
@@ -1155,7 +1155,7 @@ main (int argc, char **argv)
   int rc;
   int cmderr;
   const char *opt_run = NULL;
-  FILE *script_fp = NULL;
+  gpgrt_stream_t script_fp = NULL;
   int use_tty, keep_line;
   struct {
     int collecting;
@@ -1271,7 +1271,7 @@ main (int argc, char **argv)
                 "--tcp-socket", "--raw-socket");
     }
 
-  if (opt_run && !(script_fp = fopen (opt_run, "r")))
+  if (opt_run && !(script_fp = gpgrt_fopen (opt_run, "r")))
     {
       log_error ("cannot open run file '%s': %s\n",
                  opt_run, strerror (errno));
@@ -1425,15 +1425,15 @@ main (int argc, char **argv)
               linesize = 0;
               keep_line = 1;
             }
-          n = read_line (script_fp? script_fp:stdin,
-                         &line, &linesize, &maxlength);
+          n = gpgrt_read_line (script_fp ? script_fp : gpgrt_stdin,
+                               &line, &linesize, &maxlength);
         }
       if (n < 0)
         {
           log_error (_("error reading input: %s\n"), strerror (errno));
           if (script_fp)
             {
-              fclose (script_fp);
+              gpgrt_fclose (script_fp);
               script_fp = NULL;
               log_error ("stopping script execution\n");
               continue;
@@ -1445,7 +1445,7 @@ main (int argc, char **argv)
           /* EOF */
           if (script_fp)
             {
-              fclose (script_fp);
+              gpgrt_fclose (script_fp);
               script_fp = NULL;
               if (opt.verbose)
                 log_info ("end of script\n");
@@ -1683,17 +1683,17 @@ main (int argc, char **argv)
                   log_error ("syntax error in run command\n");
                   if (script_fp)
                     {
-                      fclose (script_fp);
+                      gpgrt_fclose (script_fp);
                       script_fp = NULL;
                     }
                 }
               else if (script_fp)
                 {
                   log_error ("cannot nest run commands - stop\n");
-                  fclose (script_fp);
+                  gpgrt_fclose (script_fp);
                   script_fp = NULL;
                 }
-              else if (!(script_fp = fopen (p, "r")))
+              else if (!(script_fp = gpgrt_fopen (p, "r")))
                 {
                   log_error ("cannot open run file '%s': %s\n",
                              p, strerror (errno));
@@ -1864,7 +1864,7 @@ main (int argc, char **argv)
       if ((rc || cmderr) && script_fp)
         {
           log_error ("stopping script execution\n");
-          fclose (script_fp);
+          gpgrt_fclose (script_fp);
           script_fp = NULL;
         }
 

commit 77b8aff4e1bb641f497e63230a5006ab70e6c3a8
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 24 15:06:43 2017 +0100

    tools: Use platform abstraction for I/O.
    
    * tools/gpgconf-comp.c (retrieve_options_from_file): Use a
    gpgrt_stream_t for 'list_file'.  Adapt accordingly.
    (copy_file): Likewise for 'src' and 'dst'.
    (change_options_file): Likewise for 'src_file' and 'dest_file'.
    (change_options_program): Likewise for 'src_file' and 'dest_file'.
    (gc_process_gpgconf_conf): Likewise for 'config'.
    --
    Werner asked me to make gpgconf use the platform abstractions that
    were introduced after gpgconf's inception.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index 4b0366d..20e8411 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -2266,7 +2266,7 @@ retrieve_options_from_file (gc_component_t component, gc_backend_t backend)
   gc_option_t *list_option;
   gc_option_t *config_option;
   char *list_filename;
-  FILE *list_file;
+  gpgrt_stream_t list_file;
   char *line = NULL;
   size_t line_len = 0;
   ssize_t length;
@@ -2278,13 +2278,13 @@ retrieve_options_from_file (gc_component_t component, gc_backend_t backend)
   assert (!list_option->active);
 
   list_filename = get_config_filename (component, backend);
-  list_file = fopen (list_filename, "r");
+  list_file = gpgrt_fopen (list_filename, "r");
   if (!list_file)
     gc_error (0, errno, "warning: can not open list file %s", list_filename);
   else
     {
 
-      while ((length = read_line (list_file, &line, &line_len, NULL)) > 0)
+      while ((length = gpgrt_read_line (list_file, &line, &line_len, NULL)) > 0)
 	{
 	  char *start;
 	  char *end;
@@ -2317,7 +2317,7 @@ retrieve_options_from_file (gc_component_t component, gc_backend_t backend)
 	  else
 	    list = xasprintf ("\"%s", gc_percent_escape (start));
 	}
-      if (length < 0 || ferror (list_file))
+      if (length < 0 || gpgrt_ferror (list_file))
 	gc_error (1, errno, "can not read list file %s", list_filename);
     }
 
@@ -2330,7 +2330,7 @@ retrieve_options_from_file (gc_component_t component, gc_backend_t backend)
   if (config_option->flags & GC_OPT_FLAG_NO_CHANGE)
     list_option->flags |= GC_OPT_FLAG_NO_CHANGE;
 
-  if (list_file && fclose (list_file))
+  if (list_file && gpgrt_fclose (list_file))
     gc_error (1, errno, "error closing %s", list_filename);
   xfree (line);
 }
@@ -2516,7 +2516,6 @@ option_check_validity (gc_option_t *option, unsigned long flags,
   while (arg && *arg);
 }
 
-
 #ifdef HAVE_W32_SYSTEM
 int
 copy_file (const char *src_name, const char *dst_name)
@@ -2524,18 +2523,18 @@ copy_file (const char *src_name, const char *dst_name)
 #define BUF_LEN 4096
   char buffer[BUF_LEN];
   int len;
-  FILE *src;
-  FILE *dst;
+  gpgrt_stream_t src;
+  gpgrt_stream_t dst;
 
-  src = fopen (src_name, "r");
+  src = gpgrt_fopen (src_name, "r");
   if (src == NULL)
     return -1;
 
-  dst = fopen (dst_name, "w");
+  dst = gpgrt_fopen (dst_name, "w");
   if (dst == NULL)
     {
       int saved_err = errno;
-      fclose (src);
+      gpgrt_fclose (src);
       gpg_err_set_errno (saved_err);
       return -1;
     }
@@ -2544,28 +2543,28 @@ copy_file (const char *src_name, const char *dst_name)
     {
       int written;
 
-      len = fread (buffer, 1, BUF_LEN, src);
+      len = gpgrt_fread (buffer, 1, BUF_LEN, src);
       if (len == 0)
 	break;
-      written = fwrite (buffer, 1, len, dst);
+      written = gpgrt_fwrite (buffer, 1, len, dst);
       if (written != len)
 	break;
     }
-  while (!feof (src) && !ferror (src) && !ferror (dst));
+  while (! gpgrt_feof (src) && ! gpgrt_ferror (src) && ! gpgrt_ferror (dst));
 
-  if (ferror (src) || ferror (dst) || !feof (src))
+  if (gpgrt_ferror (src) || gpgrt_ferror (dst) || ! gpgrt_feof (src))
     {
       int saved_errno = errno;
-      fclose (src);
-      fclose (dst);
+      gpgrt_fclose (src);
+      gpgrt_fclose (dst);
       unlink (dst_name);
       gpg_err_set_errno (saved_errno);
       return -1;
     }
 
-  if (fclose (dst))
+  if (gpgrt_fclose (dst))
     gc_error (1, errno, "error closing %s", dst_name);
-  if (fclose (src))
+  if (gpgrt_fclose (src))
     gc_error (1, errno, "error closing %s", src_name);
 
   return 0;
@@ -2602,8 +2601,8 @@ change_options_file (gc_component_t component, gc_backend_t backend,
   ssize_t length;
   int res;
   int fd;
-  FILE *src_file = NULL;
-  FILE *dest_file = NULL;
+  gpgrt_stream_t src_file = NULL;
+  gpgrt_stream_t dest_file = NULL;
   char *src_filename;
   char *dest_filename;
   char *orig_filename;
@@ -2675,7 +2674,7 @@ change_options_file (gc_component_t component, gc_backend_t backend,
   fd = open (src_filename, O_CREAT | O_EXCL | O_WRONLY, 0644);
   if (fd < 0)
     return -1;
-  src_file = fdopen (fd, "w");
+  src_file = gpgrt_fdopen (fd, "w");
   res = errno;
   if (!src_file)
     {
@@ -2689,11 +2688,11 @@ change_options_file (gc_component_t component, gc_backend_t backend,
      process.  */
   if (orig_filename)
     {
-      dest_file = fopen (dest_filename, "r");
+      dest_file = gpgrt_fopen (dest_filename, "r");
       if (!dest_file)
 	goto change_file_one_err;
 
-      while ((length = read_line (dest_file, &line, &line_len, NULL)) > 0)
+      while ((length = gpgrt_read_line (dest_file, &line, &line_len, NULL)) > 0)
 	{
 	  int disable = 0;
 	  char *start;
@@ -2764,24 +2763,24 @@ change_options_file (gc_component_t component, gc_backend_t backend,
 	    {
 	      if (!in_marker)
 		{
-		  fprintf (src_file,
+		  gpgrt_fprintf (src_file,
 			   "# %s disabled this option here at %s\n",
 			   GPGCONF_DISP_NAME, asctimestamp (gnupg_get_time ()));
-		  if (ferror (src_file))
+		  if (gpgrt_ferror (src_file))
 		    goto change_file_one_err;
-		  fprintf (src_file, "# %s", line);
-		  if (ferror (src_file))
+		  gpgrt_fprintf (src_file, "# %s", line);
+		  if (gpgrt_ferror (src_file))
 		    goto change_file_one_err;
 		}
 	    }
 	  else
 	    {
-	      fprintf (src_file, "%s", line);
-	      if (ferror (src_file))
+	      gpgrt_fprintf (src_file, "%s", line);
+	      if (gpgrt_ferror (src_file))
 		goto change_file_one_err;
 	    }
 	}
-      if (length < 0 || ferror (dest_file))
+      if (length < 0 || gpgrt_ferror (dest_file))
 	goto change_file_one_err;
     }
 
@@ -2792,8 +2791,8 @@ change_options_file (gc_component_t component, gc_backend_t backend,
 	 proceed.  Note that we first write a newline, this guards us
 	 against files which lack the newline at the end of the last
 	 line, while it doesn't hurt us in all other cases.  */
-      fprintf (src_file, "\n%s\n", marker);
-      if (ferror (src_file))
+      gpgrt_fprintf (src_file, "\n%s\n", marker);
+      if (gpgrt_ferror (src_file))
 	goto change_file_one_err;
     }
 
@@ -2803,7 +2802,7 @@ change_options_file (gc_component_t component, gc_backend_t backend,
      followed by the rest of the original file.  */
   while (cur_arg)
     {
-      fprintf (src_file, "%s\n", cur_arg);
+      gpgrt_fprintf (src_file, "%s\n", cur_arg);
 
       /* Find next argument.  */
       if (arg)
@@ -2828,52 +2827,52 @@ change_options_file (gc_component_t component, gc_backend_t backend,
 	cur_arg = NULL;
     }
 
-  fprintf (src_file, "%s %s\n", marker, asctimestamp (gnupg_get_time ()));
-  if (ferror (src_file))
+  gpgrt_fprintf (src_file, "%s %s\n", marker, asctimestamp (gnupg_get_time ()));
+  if (gpgrt_ferror (src_file))
     goto change_file_one_err;
 
   if (!in_marker)
     {
-      fprintf (src_file, "# %s edited this configuration file.\n",
+      gpgrt_fprintf (src_file, "# %s edited this configuration file.\n",
                GPGCONF_DISP_NAME);
-      if (ferror (src_file))
+      if (gpgrt_ferror (src_file))
 	goto change_file_one_err;
-      fprintf (src_file, "# It will disable options before this marked "
+      gpgrt_fprintf (src_file, "# It will disable options before this marked "
 	       "block, but it will\n");
-      if (ferror (src_file))
+      if (gpgrt_ferror (src_file))
 	goto change_file_one_err;
-      fprintf (src_file, "# never change anything below these lines.\n");
-      if (ferror (src_file))
+      gpgrt_fprintf (src_file, "# never change anything below these lines.\n");
+      if (gpgrt_ferror (src_file))
 	goto change_file_one_err;
     }
   if (dest_file)
     {
-      while ((length = read_line (dest_file, &line, &line_len, NULL)) > 0)
+      while ((length = gpgrt_read_line (dest_file, &line, &line_len, NULL)) > 0)
 	{
-	  fprintf (src_file, "%s", line);
-	  if (ferror (src_file))
+	  gpgrt_fprintf (src_file, "%s", line);
+	  if (gpgrt_ferror (src_file))
 	    goto change_file_one_err;
 	}
-      if (length < 0 || ferror (dest_file))
+      if (length < 0 || gpgrt_ferror (dest_file))
 	goto change_file_one_err;
     }
   xfree (line);
   line = NULL;
 
-  res = fclose (src_file);
+  res = gpgrt_fclose (src_file);
   if (res)
     {
       res = errno;
       close (fd);
       if (dest_file)
-	fclose (dest_file);
+	gpgrt_fclose (dest_file);
       gpg_err_set_errno (res);
       return -1;
     }
   close (fd);
   if (dest_file)
     {
-      res = fclose (dest_file);
+      res = gpgrt_fclose (dest_file);
       if (res)
 	return -1;
     }
@@ -2884,11 +2883,11 @@ change_options_file (gc_component_t component, gc_backend_t backend,
   res = errno;
   if (src_file)
     {
-      fclose (src_file);
+      gpgrt_fclose (src_file);
       close (fd);
     }
   if (dest_file)
-    fclose (dest_file);
+    gpgrt_fclose (dest_file);
   gpg_err_set_errno (res);
   return -1;
 }
@@ -2924,8 +2923,8 @@ change_options_program (gc_component_t component, gc_backend_t backend,
   ssize_t length;
   int res;
   int fd;
-  FILE *src_file = NULL;
-  FILE *dest_file = NULL;
+  gpgrt_stream_t src_file = NULL;
+  gpgrt_stream_t dest_file = NULL;
   char *src_filename;
   char *dest_filename;
   char *orig_filename;
@@ -2967,7 +2966,7 @@ change_options_program (gc_component_t component, gc_backend_t backend,
   fd = open (src_filename, O_CREAT | O_EXCL | O_WRONLY, 0644);
   if (fd < 0)
     return -1;
-  src_file = fdopen (fd, "w");
+  src_file = gpgrt_fdopen (fd, "w");
   res = errno;
   if (!src_file)
     {
@@ -2981,11 +2980,11 @@ change_options_program (gc_component_t component, gc_backend_t backend,
      process.  */
   if (orig_filename)
     {
-      dest_file = fopen (dest_filename, "r");
+      dest_file = gpgrt_fopen (dest_filename, "r");
       if (!dest_file)
 	goto change_one_err;
 
-      while ((length = read_line (dest_file, &line, &line_len, NULL)) > 0)
+      while ((length = gpgrt_read_line (dest_file, &line, &line_len, NULL)) > 0)
 	{
 	  int disable = 0;
 	  char *start;
@@ -3032,24 +3031,24 @@ change_options_program (gc_component_t component, gc_backend_t backend,
 	    {
 	      if (!in_marker)
 		{
-		  fprintf (src_file,
+		  gpgrt_fprintf (src_file,
 			   "# %s disabled this option here at %s\n",
 			   GPGCONF_DISP_NAME, asctimestamp (gnupg_get_time ()));
-		  if (ferror (src_file))
+		  if (gpgrt_ferror (src_file))
 		    goto change_one_err;
-		  fprintf (src_file, "# %s", line);
-		  if (ferror (src_file))
+		  gpgrt_fprintf (src_file, "# %s", line);
+		  if (gpgrt_ferror (src_file))
 		    goto change_one_err;
 		}
 	    }
 	  else
 	    {
-	      fprintf (src_file, "%s", line);
-	      if (ferror (src_file))
+	      gpgrt_fprintf (src_file, "%s", line);
+	      if (gpgrt_ferror (src_file))
 		goto change_one_err;
 	    }
 	}
-      if (length < 0 || ferror (dest_file))
+      if (length < 0 || gpgrt_ferror (dest_file))
 	goto change_one_err;
     }
 
@@ -3060,8 +3059,8 @@ change_options_program (gc_component_t component, gc_backend_t backend,
 	 proceed.  Note that we first write a newline, this guards us
 	 against files which lack the newline at the end of the last
 	 line, while it doesn't hurt us in all other cases.  */
-      fprintf (src_file, "\n%s\n", marker);
-      if (ferror (src_file))
+      gpgrt_fprintf (src_file, "\n%s\n", marker);
+      if (gpgrt_ferror (src_file))
 	goto change_one_err;
     }
   /* At this point, we have copied everything up to the end marker
@@ -3072,7 +3071,7 @@ change_options_program (gc_component_t component, gc_backend_t backend,
 
   /* We have to turn on UTF8 strings for GnuPG.  */
   if (backend == GC_BACKEND_GPG && ! utf8strings_seen)
-    fprintf (src_file, "utf8-strings\n");
+    gpgrt_fprintf (src_file, "utf8-strings\n");
 
   option = gc_component[component].options;
   while (option->name)
@@ -3087,16 +3086,16 @@ change_options_program (gc_component_t component, gc_backend_t backend,
 	    {
 	      if (*arg == '\0' || *arg == ',')
 		{
-		  fprintf (src_file, "%s\n", option->name);
-		  if (ferror (src_file))
+		  gpgrt_fprintf (src_file, "%s\n", option->name);
+		  if (gpgrt_ferror (src_file))
 		    goto change_one_err;
 		}
 	      else if (gc_arg_type[option->arg_type].fallback
 		       == GC_ARG_TYPE_NONE)
 		{
 		  assert (*arg == '1');
-		  fprintf (src_file, "%s\n", option->name);
-		  if (ferror (src_file))
+		  gpgrt_fprintf (src_file, "%s\n", option->name);
+		  if (gpgrt_ferror (src_file))
 		    goto change_one_err;
 
 		  arg++;
@@ -3118,9 +3117,9 @@ change_options_program (gc_component_t component, gc_backend_t backend,
                   else
                     end = NULL;
 
-		  fprintf (src_file, "%s %s\n", option->name,
+		  gpgrt_fprintf (src_file, "%s %s\n", option->name,
 			   verbatim? arg : percent_deescape (arg));
-		  if (ferror (src_file))
+		  if (gpgrt_ferror (src_file))
 		    goto change_one_err;
 
 		  if (end)
@@ -3135,8 +3134,8 @@ change_options_program (gc_component_t component, gc_backend_t backend,
 		  if (end)
 		    *end = '\0';
 
-		  fprintf (src_file, "%s %s\n", option->name, arg);
-		  if (ferror (src_file))
+		  gpgrt_fprintf (src_file, "%s %s\n", option->name, arg);
+		  if (gpgrt_ferror (src_file))
 		    goto change_one_err;
 
 		  if (end)
@@ -3153,52 +3152,52 @@ change_options_program (gc_component_t component, gc_backend_t backend,
       option++;
     }
 
-  fprintf (src_file, "%s %s\n", marker, asctimestamp (gnupg_get_time ()));
-  if (ferror (src_file))
+  gpgrt_fprintf (src_file, "%s %s\n", marker, asctimestamp (gnupg_get_time ()));
+  if (gpgrt_ferror (src_file))
     goto change_one_err;
 
   if (!in_marker)
     {
-      fprintf (src_file, "# %s edited this configuration file.\n",
+      gpgrt_fprintf (src_file, "# %s edited this configuration file.\n",
                GPGCONF_DISP_NAME);
-      if (ferror (src_file))
+      if (gpgrt_ferror (src_file))
 	goto change_one_err;
-      fprintf (src_file, "# It will disable options before this marked "
+      gpgrt_fprintf (src_file, "# It will disable options before this marked "
 	       "block, but it will\n");
-      if (ferror (src_file))
+      if (gpgrt_ferror (src_file))
 	goto change_one_err;
-      fprintf (src_file, "# never change anything below these lines.\n");
-      if (ferror (src_file))
+      gpgrt_fprintf (src_file, "# never change anything below these lines.\n");
+      if (gpgrt_ferror (src_file))
 	goto change_one_err;
     }
   if (dest_file)
     {
-      while ((length = read_line (dest_file, &line, &line_len, NULL)) > 0)
+      while ((length = gpgrt_read_line (dest_file, &line, &line_len, NULL)) > 0)
 	{
-	  fprintf (src_file, "%s", line);
-	  if (ferror (src_file))
+	  gpgrt_fprintf (src_file, "%s", line);
+	  if (gpgrt_ferror (src_file))
 	    goto change_one_err;
 	}
-      if (length < 0 || ferror (dest_file))
+      if (length < 0 || gpgrt_ferror (dest_file))
 	goto change_one_err;
     }
   xfree (line);
   line = NULL;
 
-  res = fclose (src_file);
+  res = gpgrt_fclose (src_file);
   if (res)
     {
       res = errno;
       close (fd);
       if (dest_file)
-	fclose (dest_file);
+	gpgrt_fclose (dest_file);
       gpg_err_set_errno (res);
       return -1;
     }
   close (fd);
   if (dest_file)
     {
-      res = fclose (dest_file);
+      res = gpgrt_fclose (dest_file);
       if (res)
 	return -1;
     }
@@ -3209,11 +3208,11 @@ change_options_program (gc_component_t component, gc_backend_t backend,
   res = errno;
   if (src_file)
     {
-      fclose (src_file);
+      gpgrt_fclose (src_file);
       close (fd);
     }
   if (dest_file)
-    fclose (dest_file);
+    gpgrt_fclose (dest_file);
   gpg_err_set_errno (res);
   return -1;
 }
@@ -3646,7 +3645,7 @@ gc_process_gpgconf_conf (const char *fname_arg, int update, int defaults,
   char *line = NULL;
   size_t line_len = 0;
   ssize_t length;
-  FILE *config;
+  gpgrt_stream_t config;
   int lineno = 0;
   int in_rule = 0;
   int got_match = 0;
@@ -3663,7 +3662,7 @@ gc_process_gpgconf_conf (const char *fname_arg, int update, int defaults,
   for (backend_id = 0; backend_id < GC_BACKEND_NR; backend_id++)
     runtime[backend_id] = 0;
 
-  config = fopen (fname, "r");
+  config = gpgrt_fopen (fname, "r");
   if (!config)
     {
       /* Do not print an error if the file is not available, except
@@ -3677,7 +3676,7 @@ gc_process_gpgconf_conf (const char *fname_arg, int update, int defaults,
       return result;
     }
 
-  while ((length = read_line (config, &line, &line_len, NULL)) > 0)
+  while ((length = gpgrt_read_line (config, &line, &line_len, NULL)) > 0)
     {
       char *key, *component, *option, *flags, *value;
       char *empty;
@@ -3903,12 +3902,12 @@ gc_process_gpgconf_conf (const char *fname_arg, int update, int defaults,
         }
     }
 
-  if (length < 0 || ferror (config))
+  if (length < 0 || gpgrt_ferror (config))
     {
       gc_error (0, errno, "error reading from '%s'", fname);
       result = -1;
     }
-  if (fclose (config))
+  if (gpgrt_fclose (config))
     gc_error (0, errno, "error closing '%s'", fname);
 
   xfree (line);

commit bfd75e9492fc4edd86f4049a62304943a7b2a29a
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 23 14:26:00 2017 +0100

    tools: Use platform abstraction for renaming files.
    
    * tools/gpgconf-comp.c (gc_component_change_options): Use
    'gnupg_rename_file'.  Also, block signals across all renames in an
    attempt to make the whole process atomic.
    --
    Werner asked me to make gpgconf use the platform abstractions that
    were introduced after gpgconf's inception.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index 641738e..4b0366d 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -47,6 +47,7 @@
 #include "util.h"
 #include "i18n.h"
 #include "exechelp.h"
+#include "sysutils.h"
 
 #include "gc-opt-flags.h"
 #include "gpgconf.h"
@@ -3267,6 +3268,7 @@ gc_component_change_options (int component, estream_t in, estream_t out,
                              int verbatim)
 {
   int err = 0;
+  int block = 0;
   int runtime[GC_BACKEND_NR];
   char *src_filename[GC_BACKEND_NR];
   char *dest_filename[GC_BACKEND_NR];
@@ -3406,6 +3408,14 @@ gc_component_change_options (int component, estream_t in, estream_t out,
       option++;
     }
 
+  /* We are trying to atomically commit all changes.  Unfortunately,
+     we cannot rely on gnupg_rename_file to manage the signals for us,
+     doing so would require us to pass NULL as BLOCK to any subsequent
+     call to it.  Instead, we just manage the signal handling
+     manually.  */
+  block = 1;
+  gnupg_block_all_signals ();
+
   if (! err && ! opt.dry_run)
     {
       int i;
@@ -3419,20 +3429,13 @@ gc_component_change_options (int component, estream_t in, estream_t out,
 	      assert (dest_filename[i]);
 
 	      if (orig_filename[i])
-		{
-#ifdef HAVE_W32_SYSTEM
-		  /* There is no atomic update on W32.  */
-		  err = unlink (dest_filename[i]);
-#endif /* HAVE_W32_SYSTEM */
-		  if (!err)
-		    err = rename (src_filename[i], dest_filename[i]);
-		}
+		err = gnupg_rename_file (src_filename[i], dest_filename[i], NULL);
 	      else
 		{
 #ifdef HAVE_W32_SYSTEM
 		  /* We skip the unlink if we expect the file not to
 		     be there.  */
-                  err = rename (src_filename[i], dest_filename[i]);
+                  err = gnupg_rename_file (src_filename[i], dest_filename[i], NULL);
 #else /* HAVE_W32_SYSTEM */
 		  /* This is a bit safer than rename() because we
 		     expect DEST_FILENAME not to be there.  If it
@@ -3472,13 +3475,7 @@ gc_component_change_options (int component, estream_t in, estream_t out,
 		 a version of the file that is even newer than the one
 		 we just installed.  */
 	      if (orig_filename[i])
-		{
-#ifdef HAVE_W32_SYSTEM
-		  /* There is no atomic update on W32.  */
-		  unlink (dest_filename[i]);
-#endif /* HAVE_W32_SYSTEM */
-		  rename (orig_filename[i], dest_filename[i]);
-		}
+		gnupg_rename_file (orig_filename[i], dest_filename[i], NULL);
 	      else
 		unlink (dest_filename[i]);
 	    }
@@ -3508,16 +3505,13 @@ gc_component_change_options (int component, estream_t in, estream_t out,
 
 	backup_filename = xasprintf ("%s.%s.bak",
                                      dest_filename[backend], GPGCONF_NAME);
-
-#ifdef HAVE_W32_SYSTEM
-	/* There is no atomic update on W32.  */
-	unlink (backup_filename);
-#endif /* HAVE_W32_SYSTEM */
-	rename (orig_filename[backend], backup_filename);
+	gnupg_rename_file (orig_filename[backend], backup_filename, NULL);
 	xfree (backup_filename);
       }
 
  leave:
+  if (block)
+    gnupg_unblock_all_signals ();
   xfree (line);
   for (backend = 0; backend < GC_BACKEND_NR; backend++)
     {

commit 82e309ad06884e54693f4856412984331febdda0
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 24 12:57:43 2017 +0100

    tools: Add comments explaining the functions parameters.
    
    * tools/gpgconf-comp.c (change_options_file): Add comments explaining
    the functions parameters.
    (change_options_program): Likewise.
    --
    From reading those two functions it is not clear why we write the new
    configuration to the source file, and read the current configuration
    from the destination file.  The identifiers are named for the benefit
    of the callee.
    
    Note that identifiers that require that much explanation are poorly
    chosen.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index 180fd65..641738e 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -2573,7 +2573,20 @@ copy_file (const char *src_name, const char *dst_name)
 
 
 /* Create and verify the new configuration file for the specified
-   backend and component.  Returns 0 on success and -1 on error.  */
+ * backend and component.  Returns 0 on success and -1 on error.  This
+ * function may store pointers to malloced strings in SRC_FILENAMEP,
+ * DEST_FILENAMEP, and ORIG_FILENAMEP.  Those must be freed by the
+ * caller.  The strings refer to three versions of the configuration
+ * file:
+ *
+ * SRC_FILENAME:  The updated configuration is written to this file.
+ * DEST_FILENAME: Name of the configuration file read by the
+ *                component.
+ * ORIG_FILENAME: A backup of the previous configuration file.
+ *
+ * To apply the configuration change, rename SRC_FILENAME to
+ * DEST_FILENAME.  To revert to the previous configuration, rename
+ * ORIG_FILENAME to DEST_FILENAME.  */
 static int
 change_options_file (gc_component_t component, gc_backend_t backend,
 		     char **src_filenamep, char **dest_filenamep,
@@ -2882,7 +2895,19 @@ change_options_file (gc_component_t component, gc_backend_t backend,
 
 /* Create and verify the new configuration file for the specified
  * backend and component.  Returns 0 on success and -1 on error.  If
- * VERBATIM is set the profile mode is used. */
+ * VERBATIM is set the profile mode is used.  This function may store
+ * pointers to malloced strings in SRC_FILENAMEP, DEST_FILENAMEP, and
+ * ORIG_FILENAMEP.  Those must be freed by the caller.  The strings
+ * refer to three versions of the configuration file:
+ *
+ * SRC_FILENAME:  The updated configuration is written to this file.
+ * DEST_FILENAME: Name of the configuration file read by the
+ *                component.
+ * ORIG_FILENAME: A backup of the previous configuration file.
+ *
+ * To apply the configuration change, rename SRC_FILENAME to
+ * DEST_FILENAME.  To revert to the previous configuration, rename
+ * ORIG_FILENAME to DEST_FILENAME.  */
 static int
 change_options_program (gc_component_t component, gc_backend_t backend,
 			char **src_filenamep, char **dest_filenamep,

commit b0348fdb26637b0bcbd68a96c1746a1613b309af
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 23 14:24:22 2017 +0100

    tools: Improve error handling.
    
    * tools/gpgconf-comp.c (gp_component_change_options): Improve error
    handling when reading from stdin.
    --
    Previously, errors encountered while reading the configuration changes
    were ignored.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index 85eb80a..180fd65 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -3328,6 +3328,8 @@ gc_component_change_options (int component, estream_t in, estream_t out,
 
           change_one_value (option, runtime, flags, new_value, 0);
         }
+      if (length < 0 || gpgrt_ferror (in))
+	gc_error (1, errno, "error reading stream 'in'");
     }
 
   /* Now that we have collected and locally verified the changes,

commit 5b28f025085b386e0ec49535d4cd3f875a414eb0
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 23 11:52:30 2017 +0100

    tools: Fix memory leak.
    
    * tools/gpgconf-comp.c (change_options_file): Fix leak.
    --
    Previously, 'src_filename' and 'orig_filename' leaked if creating the
    backup file failed.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index a25b513..85eb80a 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -2641,6 +2641,8 @@ change_options_file (gc_component_t component, gc_backend_t backend,
   if (res < 0 && errno != ENOENT)
     {
       xfree (dest_filename);
+      xfree (src_filename);
+      xfree (orig_filename);
       return -1;
     }
   if (res < 0)

-----------------------------------------------------------------------

Summary of changes:
 tools/gpg-connect-agent.c |  20 ++--
 tools/gpgconf-comp.c      | 262 +++++++++++++++++++++++++---------------------
 2 files changed, 152 insertions(+), 130 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 24 20:55:10 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 24 Jan 2017 20:55:10 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-14-g770b75a
Message-ID: <E1cW7BR-000186-NG@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  770b75a746836773909af25ccb9b480e61cea677 (commit)
       via  51e5a5e5a46279809848b4ab4419f35045336010 (commit)
       via  72736af86a501592d974d46ff754a63959e183bd (commit)
      from  73d6572bd0f260c5aa1e191a1ba4859ec6fa262c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 770b75a746836773909af25ccb9b480e61cea677
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 24 20:45:31 2017 +0100

    gpg: Print a warning on Tor problems.
    
    * dirmngr/ks-engine-hkp.c (tor_not_running_p): New.
    (map_host): Call that to print a warning.
    (handle_send_request_error): Ditto and avoid marking the host dead.
    Also print a tor_config_problem warning.  Add arg CTRL; adjust callers
    to pass that new arg.
    * g10/call-dirmngr.c (ks_status_cb): Detect and print the new
    warnings.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 4a6b4ec..c787bc6 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -258,6 +258,31 @@ arecords_is_pool (dns_addrinfo_t aibuf)
 }
 
 
+/* Print a warninng iff Tor is not running but Tor has been requested.
+ * Also return true if it is not running.  */
+static int
+tor_not_running_p (ctrl_t ctrl)
+{
+  assuan_fd_t sock;
+
+  if (!opt.use_tor)
+    return 0;
+
+  sock = assuan_sock_connect_byname (NULL, 0, 0, NULL, ASSUAN_SOCK_TOR);
+  if (sock != ASSUAN_INVALID_FD)
+    {
+      assuan_sock_close (sock);
+      return 0;
+    }
+
+  log_info ("(it seems Tor is not running)\n");
+  dirmngr_status (ctrl, "WARNING", "tor_not_running 0",
+                  "Tor is enabled but the local Tor daemon"
+                  " seems to be down", NULL);
+  return 1;
+}
+
+
 /* Add the host AI under the NAME into the HOSTTABLE.  If PORT is not
    zero, it specifies which port to use to talk to the host.  If NAME
    specifies a pool (as indicated by IS_POOL), update the given
@@ -454,6 +479,8 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
           if (err)
             {
               xfree (reftbl);
+              if (gpg_err_code (err) == GPG_ERR_ECONNREFUSED)
+                tor_not_running_p (ctrl);
               return err;
             }
 
@@ -1182,13 +1209,13 @@ send_request (ctrl_t ctrl, const char *request, const char *hostportstr,
 }
 
 
-/* Helper to evaluate the error code ERR form a send_request() call
+/* Helper to evaluate the error code ERR from a send_request() call
    with REQUEST.  The function returns true if the caller shall try
    again.  TRIES_LEFT points to a variable to track the number of
    retries; this function decrements it and won't return true if it is
    down to zero. */
 static int
-handle_send_request_error (gpg_error_t err, const char *request,
+handle_send_request_error (ctrl_t ctrl, gpg_error_t err, const char *request,
                            unsigned int *tries_left)
 {
   int retry = 0;
@@ -1199,16 +1226,9 @@ handle_send_request_error (gpg_error_t err, const char *request,
   switch (gpg_err_code (err))
     {
     case GPG_ERR_ECONNREFUSED:
-      if (opt.use_tor)
-        {
-          assuan_fd_t sock;
-
-          sock = assuan_sock_connect_byname (NULL, 0, 0, NULL, ASSUAN_SOCK_TOR);
-          if (sock == ASSUAN_INVALID_FD)
-            log_info ("(it seems Tor is not running)\n");
-          else
-            assuan_sock_close (sock);
-        }
+      if (tor_not_running_p (ctrl))
+        break; /* A retry does not make sense.  */
+      /* Okay: Tor is up or --use-tor is not used.  */
       /*FALLTHRU*/
     case GPG_ERR_ENETUNREACH:
     case GPG_ERR_ENETDOWN:
@@ -1226,6 +1246,16 @@ handle_send_request_error (gpg_error_t err, const char *request,
         }
       break;
 
+    case GPG_ERR_EACCES:
+      if (opt.use_tor)
+        {
+          log_info ("(Tor configuration problem)\n");
+          dirmngr_status (ctrl, "WARNING", "tor_config_problem 0",
+                          "Please check that the \"SocksPort\" flag "
+                          "\"IPv6Traffic\" is set in torrc", NULL);
+        }
+      break;
+
     default:
       break;
     }
@@ -1336,7 +1366,7 @@ ks_hkp_search (ctrl_t ctrl, parsed_uri_t uri, const char *pattern,
   /* Send the request.  */
   err = send_request (ctrl, request, hostport, httphost, httpflags,
                       NULL, NULL, &fp, r_http_status);
-  if (handle_send_request_error (err, request, &tries))
+  if (handle_send_request_error (ctrl, err, request, &tries))
     {
       reselect = 1;
       goto again;
@@ -1470,7 +1500,7 @@ ks_hkp_get (ctrl_t ctrl, parsed_uri_t uri, const char *keyspec, estream_t *r_fp)
   /* Send the request.  */
   err = send_request (ctrl, request, hostport, httphost, httpflags,
                       NULL, NULL, &fp, NULL);
-  if (handle_send_request_error (err, request, &tries))
+  if (handle_send_request_error (ctrl, err, request, &tries))
     {
       reselect = 1;
       goto again;
@@ -1579,7 +1609,7 @@ ks_hkp_put (ctrl_t ctrl, parsed_uri_t uri, const void *data, size_t datalen)
   /* Send the request.  */
   err = send_request (ctrl, request, hostport, httphost, 0,
                       put_post_cb, &parm, &fp, NULL);
-  if (handle_send_request_error (err, request, &tries))
+  if (handle_send_request_error (ctrl, err, request, &tries))
     {
       reselect = 1;
       goto again;
diff --git a/g10/call-dirmngr.c b/g10/call-dirmngr.c
index 4be9da1..2f2ba98 100644
--- a/g10/call-dirmngr.c
+++ b/g10/call-dirmngr.c
@@ -374,7 +374,8 @@ ks_status_cb (void *opaque, const char *line)
 {
   struct ks_status_parm_s *parm = opaque;
   gpg_error_t err = 0;
-  const char *s;
+  const char *s, *s2;
+  const char *warn;
 
   if ((s = has_leading_keyword (line, parm->keyword? parm->keyword : "SOURCE")))
     {
@@ -385,6 +386,29 @@ ks_status_cb (void *opaque, const char *line)
             err = gpg_error_from_syserror ();
         }
     }
+  else if ((s = has_leading_keyword (line, "WARNING")))
+    {
+      if ((s2 = has_leading_keyword (s, "tor_not_running")))
+        warn = _("Tor is not running");
+      else if ((s2 = has_leading_keyword (s, "tor_config_problem")))
+        warn = _("Tor is not properly configured");
+      else
+        warn = NULL;
+
+      if (warn)
+        {
+          log_info (_("WARNING: %s\n"), warn);
+          if (s2)
+            {
+              while (*s2 && !spacep (s2))
+                s2++;
+              while (*s2 && spacep (s2))
+                s2++;
+              if (*s2)
+                print_further_info ("%s", s2);
+            }
+        }
+    }
 
   return err;
 }

commit 51e5a5e5a46279809848b4ab4419f35045336010
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 24 18:41:43 2017 +0100

    dirmngr: Simplify error returning inside http.c.
    
    * dirmngr/http.c (connect_server): Change to return an gpg_error_t
    and to store socket at the passed address.
    (http_raw_connect, send_request): Adjust accordingly.
    --
    
    This change removes cruft from the code and allows to return the error
    code from the name lookup.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 35877d2..fe9c3c7 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -155,9 +155,9 @@ static gpg_error_t send_request (http_t hd, const char *httphost,
 static char *build_rel_path (parsed_uri_t uri);
 static gpg_error_t parse_response (http_t hd);
 
-static assuan_fd_t connect_server (const char *server, unsigned short port,
+static gpg_error_t connect_server (const char *server, unsigned short port,
                                    unsigned int flags, const char *srvtag,
-                                   int *r_host_not_found);
+                                   assuan_fd_t *r_sock);
 static gpg_error_t write_server (int sock, const char *data, size_t length);
 
 static gpgrt_ssize_t cookie_read (void *cookie, void *buffer, size_t size);
@@ -924,7 +924,6 @@ http_raw_connect (http_t *r_hd, const char *server, unsigned short port,
   gpg_error_t err = 0;
   http_t hd;
   cookie_t cookie;
-  int hnf;
 
   *r_hd = NULL;
 
@@ -950,12 +949,9 @@ http_raw_connect (http_t *r_hd, const char *server, unsigned short port,
   {
     assuan_fd_t sock;
 
-    sock = connect_server (server, port, hd->flags, srvtag, &hnf);
-    if (sock == ASSUAN_INVALID_FD)
+    err = connect_server (server, port, hd->flags, srvtag, &sock);
+    if (err)
       {
-        err = gpg_err_make (default_errsource,
-                            (hnf? GPG_ERR_UNKNOWN_HOST
-                             : gpg_err_code_from_syserror ()));
         xfree (hd);
         return err;
       }
@@ -1643,7 +1639,6 @@ send_request (http_t hd, const char *httphost, const char *auth,
   char *proxy_authstr = NULL;
   char *authstr = NULL;
   int sock;
-  int hnf;
 
   if (hd->uri->use_tls && !hd->session)
     {
@@ -1713,7 +1708,6 @@ send_request (http_t hd, const char *httphost, const char *auth,
             && *http_proxy ))
     {
       parsed_uri_t uri;
-      int save_errno;
 
       if (proxy)
 	http_proxy = proxy;
@@ -1760,25 +1754,20 @@ send_request (http_t hd, const char *httphost, const char *auth,
             }
         }
 
-      sock = connect_server (*uri->host ? uri->host : "localhost",
-                             uri->port ? uri->port : 80,
-                             hd->flags, srvtag, &hnf);
-      save_errno = errno;
+      err = connect_server (*uri->host ? uri->host : "localhost",
+                            uri->port ? uri->port : 80,
+                            hd->flags, srvtag, &sock);
       http_release_parsed_uri (uri);
-      if (sock == ASSUAN_INVALID_FD)
-        gpg_err_set_errno (save_errno);
     }
   else
     {
-      sock = connect_server (server, port, hd->flags, srvtag, &hnf);
+      err = connect_server (server, port, hd->flags, srvtag, &sock);
     }
 
-  if (sock == ASSUAN_INVALID_FD)
+  if (err)
     {
       xfree (proxy_authstr);
-      return gpg_err_make (default_errsource,
-                           (hnf? GPG_ERR_UNKNOWN_HOST
-                               : gpg_err_code_from_syserror ()));
+      return err;
     }
   hd->sock = my_socket_new (sock);
   if (!hd->sock)
@@ -1788,7 +1777,6 @@ send_request (http_t hd, const char *httphost, const char *auth,
     }
 
 
-
 #if HTTP_USE_NTBTLS
   if (hd->uri->use_tls)
     {
@@ -2476,11 +2464,13 @@ my_sock_new_for_addr (struct sockaddr *addr, int type, int proto)
 }
 
 
-/* Actually connect to a server.  Returns the file descriptor or -1 on
-   error.  ERRNO is set on error. */
-static assuan_fd_t
+/* Actually connect to a server.  On success 0 is returned and the
+ * file descriptor for the socket is stored at R_SOCK; on error an
+ * error code is returned and ASSUAN_INVALID_FD is stored at
+ * R_SOCK.  */
+static gpg_error_t
 connect_server (const char *server, unsigned short port,
-                unsigned int flags, const char *srvtag, int *r_host_not_found)
+                unsigned int flags, const char *srvtag, assuan_fd_t *r_sock)
 {
   gpg_error_t err;
   assuan_fd_t sock = ASSUAN_INVALID_FD;
@@ -2488,11 +2478,11 @@ connect_server (const char *server, unsigned short port,
   int hostfound = 0;
   int anyhostaddr = 0;
   int srv, connected;
-  int last_errno = 0;
+  gpg_error_t last_err = 0;
   struct srventry *serverlist = NULL;
-  int ret;
 
-  *r_host_not_found = 0;
+  *r_sock = ASSUAN_INVALID_FD;
+
 #if defined(HAVE_W32_SYSTEM) && !defined(HTTP_NO_WSASTARTUP)
   init_sockets ();
 #endif /*Windows*/
@@ -2509,18 +2499,21 @@ connect_server (const char *server, unsigned short port,
                                          ASSUAN_SOCK_TOR);
       if (sock == ASSUAN_INVALID_FD)
         {
-          if (errno == EHOSTUNREACH)
-            *r_host_not_found = 1;
-          log_error ("can't connect to '%s': %s\n", server, strerror (errno));
+          err = gpg_err_make (default_errsource,
+                              (errno == EHOSTUNREACH)? GPG_ERR_UNKNOWN_HOST
+                              : gpg_err_code_from_syserror ());
+          log_error ("can't connect to '%s': %s\n", server, gpg_strerror (err));
+          return err;
         }
-      else
-        notify_netactivity ();
-      return sock;
+
+      notify_netactivity ();
+      *r_sock = sock;
+      return 0;
 
 #else /*!ASSUAN_SOCK_TOR*/
 
-      gpg_err_set_errno (ENETUNREACH);
-      return -1; /* Out of core.  */
+      err = gpg_err_make (default_errsource, GPG_ERR_ENETUNREACH);
+      return ASSUAN_INVALID_FD;
 
 #endif /*!HASSUAN_SOCK_TOR*/
     }
@@ -2533,6 +2526,7 @@ connect_server (const char *server, unsigned short port,
         log_info ("getting '%s' SRV for '%s' failed: %s\n",
                   srvtag, server, gpg_strerror (err));
       /* Note that on error SRVCOUNT is zero.  */
+      err = 0;
     }
 
   if (!serverlist)
@@ -2541,7 +2535,8 @@ connect_server (const char *server, unsigned short port,
 	 up a fake SRV record. */
       serverlist = xtrycalloc (1, sizeof *serverlist);
       if (!serverlist)
-        return -1; /* Out of core.  */
+        return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
+
       serverlist->port = port;
       strncpy (serverlist->target, server, DIMof (struct srventry, target));
       serverlist->target[DIMof (struct srventry, target)-1] = '\0';
@@ -2562,6 +2557,7 @@ connect_server (const char *server, unsigned short port,
         {
           log_info ("resolving '%s' failed: %s\n",
                     serverlist[srv].target, gpg_strerror (err));
+          last_err = err;
           continue; /* Not found - try next one. */
         }
       hostfound = 1;
@@ -2578,18 +2574,20 @@ connect_server (const char *server, unsigned short port,
           sock = my_sock_new_for_addr (ai->addr, ai->socktype, ai->protocol);
           if (sock == ASSUAN_INVALID_FD)
             {
-              int save_errno = errno;
-              log_error ("error creating socket: %s\n", strerror (errno));
+              err = gpg_err_make (default_errsource,
+                                  gpg_err_code_from_syserror ());
+              log_error ("error creating socket: %s\n", gpg_strerror (err));
               free_dns_addrinfo (aibuf);
               xfree (serverlist);
-              errno = save_errno;
-              return ASSUAN_INVALID_FD;
+              return err;
             }
 
           anyhostaddr = 1;
-          ret = assuan_sock_connect (sock, ai->addr, ai->addrlen);
-          if (ret)
-            last_errno = errno;
+          if (assuan_sock_connect (sock, ai->addr, ai->addrlen))
+            {
+              last_err = gpg_err_make (default_errsource,
+                                       gpg_err_code_from_syserror ());
+            }
           else
             {
               connected = 1;
@@ -2616,17 +2614,18 @@ connect_server (const char *server, unsigned short port,
                    server, (int)WSAGetLastError());
 #else
         log_error ("can't connect to '%s': %s\n",
-                   server, strerror (last_errno));
+                   server, gpg_strerror (last_err));
 #endif
         }
-      if (!hostfound || (hostfound && !anyhostaddr))
-        *r_host_not_found = 1;
+      err = last_err? last_err : gpg_err_make (default_errsource,
+                                               GPG_ERR_UNKNOWN_HOST);
       if (sock != ASSUAN_INVALID_FD)
 	assuan_sock_close (sock);
-      gpg_err_set_errno (last_errno);
-      return ASSUAN_INVALID_FD;
+      return err;
     }
-  return sock;
+
+  *r_sock = sock;
+  return 0;
 }
 
 

commit 72736af86a501592d974d46ff754a63959e183bd
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 24 16:36:28 2017 +0100

    dirmngr: New option --disable-ipv4.
    
    * dirmngr/dirmngr.c (oDisableIPv4): New const.
    (opts): New option --disable-ipv4.
    (parse_rereadable_options): Set that option.
    * dirmngr/dirmngr.h (opt): New field 'disable_ipv4'.
    * dirmngr/dns-stuff.c (opt_disable_ipv4): bew var.
    (set_dns_disable_ipv4): New.
    (resolve_name_standard): Skip v4 addresses when OPT_DISABLE_IPV4 is
    set.
    * dirmngr/ks-engine-hkp.c (map_host): Ditto.
    (send_request): Pass HTTP_FLAG_IGNORE_IPv4 if opt.disable_v4 is set.
    * dirmngr/crlfetch.c (crl_fetch): Ditto.
    * dirmngr/ks-engine-finger.c (ks_finger_fetch): Ditto.
    * dirmngr/ks-engine-http.c (ks_http_fetch): Ditto.
    * dirmngr/ocsp.c (do_ocsp_request): Ditto.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/crlfetch.c b/dirmngr/crlfetch.c
index 8fe6e0b..aa82137 100644
--- a/dirmngr/crlfetch.c
+++ b/dirmngr/crlfetch.c
@@ -198,7 +198,9 @@ crl_fetch (ctrl_t ctrl, const char *url, ksba_reader_t *reader)
         err = http_open_document (&hd, url, NULL,
                                   ((opt.honor_http_proxy? HTTP_FLAG_TRY_PROXY:0)
                                    |(DBG_LOOKUP? HTTP_FLAG_LOG_RESP:0)
-                                   |(opt.use_tor? HTTP_FLAG_FORCE_TOR:0)),
+                                   |(opt.use_tor? HTTP_FLAG_FORCE_TOR:0)
+                                   |(opt.disable_ipv4? HTTP_FLAG_IGNORE_IPv4:0)
+                                   ),
                                   ctrl->http_proxy, NULL, NULL, NULL);
 
       switch ( err? 99999 : http_get_status_code (hd) )
diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 061cfc3..15ba33b 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -111,6 +111,7 @@ enum cmd_and_opt_values {
   oBatch,
   oDisableHTTP,
   oDisableLDAP,
+  oDisableIPv4,
   oIgnoreLDAPDP,
   oIgnoreHTTPDP,
   oIgnoreOCSPSvcUrl,
@@ -224,6 +225,8 @@ static ARGPARSE_OPTS opts[] = {
 
   ARGPARSE_s_n (oUseTor, "use-tor", N_("route all network traffic via Tor")),
 
+  ARGPARSE_s_n (oDisableIPv4, "disable-ipv4", "@"),
+
   ARGPARSE_s_s (oSocketName, "socket-name", "@"),  /* Only for debugging.  */
 
   ARGPARSE_s_u (oFakedSystemTime, "faked-system-time", "@"), /*(epoch time)*/
@@ -593,6 +596,7 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread)
 
     case oDisableHTTP: opt.disable_http = 1; break;
     case oDisableLDAP: opt.disable_ldap = 1; break;
+    case oDisableIPv4: opt.disable_ipv4 = 1; break;
     case oHonorHTTPProxy: opt.honor_http_proxy = 1; break;
     case oHTTPProxy: opt.http_proxy = pargs->r.ret_str; break;
     case oLDAPProxy: opt.ldap_proxy = pargs->r.ret_str; break;
@@ -652,6 +656,7 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread)
 
   set_dns_verbose (opt.verbose, !!DBG_DNS);
   http_set_verbose (opt.verbose, !!DBG_NETWORK);
+  set_dns_disable_ipv4 (opt.disable_ipv4);
 
   return 1; /* Handled. */
 }
diff --git a/dirmngr/dirmngr.h b/dirmngr/dirmngr.h
index 35bc000..ca07e78 100644
--- a/dirmngr/dirmngr.h
+++ b/dirmngr/dirmngr.h
@@ -98,6 +98,7 @@ struct
 
   int disable_http;       /* Do not use HTTP at all.  */
   int disable_ldap;       /* Do not use LDAP at all.  */
+  int disable_ipv4;       /* Do not use leagacy IP addresses.  */
   int honor_http_proxy;   /* Honor the http_proxy env variable. */
   const char *http_proxy; /* The default HTTP proxy.  */
   const char *ldap_proxy; /* Use given LDAP proxy.  */
diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 9347196..ad19fc2 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -119,6 +119,10 @@ static int opt_debug;
 /* The timeout in seconds for libdns requests.  */
 static int opt_timeout;
 
+/* The flag to disable IPv4 access - right now this only skips
+ * returned A records.  */
+static int opt_disable_ipv4;
+
 /* If set force the use of the standard resolver.  */
 static int standard_resolver;
 
@@ -227,6 +231,15 @@ set_dns_verbose (int verbose, int debug)
 }
 
 
+/* Set the Disable-IPv4 flag so that the name resolver does not return
+ * A addresses.  */
+void
+set_dns_disable_ipv4 (int yes)
+{
+  opt_disable_ipv4 = !!yes;
+}
+
+
 /* Set the timeout for libdns requests to SECONDS.  A value of 0 sets
  * the default timeout and values are capped at 10 minutes.  */
 void
@@ -873,6 +886,8 @@ resolve_name_standard (const char *name, unsigned short port,
     {
       if (ai->ai_family != AF_INET6 && ai->ai_family != AF_INET)
         continue;
+      if (opt_disable_ipv4 && ai->ai_family == AF_INET)
+        continue;
 
       dai = xtrymalloc (sizeof *dai + ai->ai_addrlen - 1);
       dai->family = ai->ai_family;
diff --git a/dirmngr/dns-stuff.h b/dirmngr/dns-stuff.h
index d68dd17..9eb97fd 100644
--- a/dirmngr/dns-stuff.h
+++ b/dirmngr/dns-stuff.h
@@ -95,6 +95,10 @@ struct srventry
 /* Set verbosity and debug mode for this module. */
 void set_dns_verbose (int verbose, int debug);
 
+/* Set the Disable-IPv4 flag so that the name resolver does not return
+ * A addresses.  */
+void set_dns_disable_ipv4 (int yes);
+
 /* Set the timeout for libdns requests to SECONDS.  */
 void set_dns_timeout (int seconds);
 
diff --git a/dirmngr/ks-engine-finger.c b/dirmngr/ks-engine-finger.c
index b1f02ad..114f2e9 100644
--- a/dirmngr/ks-engine-finger.c
+++ b/dirmngr/ks-engine-finger.c
@@ -83,7 +83,9 @@ ks_finger_fetch (ctrl_t ctrl, parsed_uri_t uri, estream_t *r_fp)
   *server++ = 0;
 
   err = http_raw_connect (&http, server, 79,
-                          (opt.use_tor? HTTP_FLAG_FORCE_TOR : 0), NULL);
+                          ((opt.use_tor? HTTP_FLAG_FORCE_TOR : 0)
+                           | (opt.disable_ipv4? HTTP_FLAG_IGNORE_IPv4 : 0)),
+                          NULL);
   if (err)
     {
       xfree (name);
diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index 45965ce..4a6b4ec 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -505,6 +505,8 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
             {
               if (ai->family != AF_INET && ai->family != AF_INET6)
                 continue;
+              if (opt.disable_ipv4 && ai->family == AF_INET)
+                continue;
               dirmngr_tick (ctrl);
 
               add_host (name, is_pool, ai, 0, reftbl, reftblsize, &refidx);
@@ -585,7 +587,8 @@ map_host (ctrl_t ctrl, const char *name, const char *srvtag, int force_reselect,
         {
           for (ai = aibuf; ai; ai = ai->next)
             {
-              if (ai->family == AF_INET6 || ai->family == AF_INET)
+              if (ai->family == AF_INET6
+                  || (!opt.disable_ipv4 && ai->family == AF_INET))
                 {
                   err = resolve_dns_addr (ai->addr, ai->addrlen, 0, &host);
                   if (!err)
@@ -1060,7 +1063,8 @@ send_request (ctrl_t ctrl, const char *request, const char *hostportstr,
                    /* fixme: AUTH */ NULL,
                    (httpflags
                     |(opt.honor_http_proxy? HTTP_FLAG_TRY_PROXY:0)
-                    |(opt.use_tor? HTTP_FLAG_FORCE_TOR:0)),
+                    |(opt.use_tor? HTTP_FLAG_FORCE_TOR:0)
+                    |(opt.disable_ipv4? HTTP_FLAG_IGNORE_IPv4 : 0)),
                    ctrl->http_proxy,
                    session,
                    NULL,
diff --git a/dirmngr/ks-engine-http.c b/dirmngr/ks-engine-http.c
index 858c943..dbbf4bb 100644
--- a/dirmngr/ks-engine-http.c
+++ b/dirmngr/ks-engine-http.c
@@ -88,7 +88,8 @@ ks_http_fetch (ctrl_t ctrl, const char *url, estream_t *r_fp)
                    /* httphost */ NULL,
                    /* fixme: AUTH */ NULL,
                    ((opt.honor_http_proxy? HTTP_FLAG_TRY_PROXY:0)
-                    | (opt.use_tor? HTTP_FLAG_FORCE_TOR:0)),
+                    | (opt.use_tor? HTTP_FLAG_FORCE_TOR:0)
+                    | (opt.disable_ipv4? HTTP_FLAG_IGNORE_IPv4 : 0)),
                    ctrl->http_proxy,
                    session,
                    NULL,
diff --git a/dirmngr/ocsp.c b/dirmngr/ocsp.c
index 9127cf7..b46c785 100644
--- a/dirmngr/ocsp.c
+++ b/dirmngr/ocsp.c
@@ -174,7 +174,8 @@ do_ocsp_request (ctrl_t ctrl, ksba_ocsp_t ocsp, gcry_md_hd_t md,
  once_more:
   err = http_open (&http, HTTP_REQ_POST, url, NULL, NULL,
                    ((opt.honor_http_proxy? HTTP_FLAG_TRY_PROXY:0)
-                    | (opt.use_tor? HTTP_FLAG_FORCE_TOR:0)),
+                    | (opt.use_tor? HTTP_FLAG_FORCE_TOR:0)
+                    | (opt.disable_ipv4? HTTP_FLAG_IGNORE_IPv4 : 0)),
                    ctrl->http_proxy, NULL, NULL, NULL);
   if (err)
     {
diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
index e27157c..fcc174f 100644
--- a/doc/dirmngr.texi
+++ b/doc/dirmngr.texi
@@ -313,6 +313,11 @@ not be used a different one can be given using this option.  Note that
 a numerical IP address must be given (IPv6 or IPv4) and that no error
 checking is done for @var{ipaddr}.
 
+ at item --disable-ipv4
+ at opindex disable-ipv4
+Disable the use of all IPv4 addresses.  This option is mainly useful
+for debugging.
+
 @item --disable-ldap
 @opindex disable-ldap
 Entirely disables the use of LDAP.

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/crlfetch.c         |   4 +-
 dirmngr/dirmngr.c          |   5 +++
 dirmngr/dirmngr.h          |   1 +
 dirmngr/dns-stuff.c        |  15 +++++++
 dirmngr/dns-stuff.h        |   4 ++
 dirmngr/http.c             | 101 ++++++++++++++++++++++-----------------------
 dirmngr/ks-engine-finger.c |   4 +-
 dirmngr/ks-engine-hkp.c    |  68 ++++++++++++++++++++++--------
 dirmngr/ks-engine-http.c   |   3 +-
 dirmngr/ocsp.c             |   3 +-
 doc/dirmngr.texi           |   5 +++
 g10/call-dirmngr.c         |  26 +++++++++++-
 12 files changed, 166 insertions(+), 73 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 25 11:21:50 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 25 Jan 2017 11:21:50 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-16-g5f2da5d
Message-ID: <E1cWKiA-0002m9-Q5@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  5f2da5d439debf44615a97de788d8f720b517972 (commit)
       via  6ecd8b3e71632bbcca524ad735c83bdc2a4c4a4a (commit)
      from  770b75a746836773909af25ccb9b480e61cea677 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5f2da5d439debf44615a97de788d8f720b517972
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 25 11:18:23 2017 +0100

    tests: Skip GPGME tests that are not built.
    
    * tests/gpgme/wrap.scm: Skip tests that are not built.
    --
    Previously, all tests from GPGME's test suite that were not built
    (e.g. because GPGME was not configured with QT) were marked as
    failures.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgme/wrap.scm b/tests/gpgme/wrap.scm
index 4f3ae7d..e8f2b1f 100644
--- a/tests/gpgme/wrap.scm
+++ b/tests/gpgme/wrap.scm
@@ -56,5 +56,8 @@
     (log "Importing extra key...")
     (call-check `(, at GPG --yes --import ,(in-srcdir "pubkey-1.asc"))))))
 
-(log "Running" (car executable))
-(exit (run executable))
+(if (file-exists? (car executable))
+    (begin
+      (log "Running" (car executable))
+      (exit (run executable)))
+    (skip (car executable) "is not built"))

commit 6ecd8b3e71632bbcca524ad735c83bdc2a4c4a4a
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 25 11:16:23 2017 +0100

    tests,w32: Fix locating GPGME's tests on Windows.
    
    * tests/gpgme/run-tests.scm: Qualify the test with the executable
    extension.
    --
    Previously, the test suite could not locate the test executables on
    Windows because the Windows-specific file extension was missing.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgme/run-tests.scm b/tests/gpgme/run-tests.scm
index bce5584..cb17977 100644
--- a/tests/gpgme/run-tests.scm
+++ b/tests/gpgme/run-tests.scm
@@ -54,7 +54,7 @@
 	     (apply path-join
 		    `(,(if (compiled? name)
 			   gpgme-builddir
-			   gpgme-srcdir) ,@(:path cmpnts),name)))
+			   gpgme-srcdir) ,@(:path cmpnts) ,(qualify name))))
 	   (let ((makefile (apply path-join `(,gpgme-srcdir ,@(:path cmpnts)
 							    "Makefile.am"))))
 	     (map (lambda (name)

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgme/run-tests.scm | 2 +-
 tests/gpgme/wrap.scm      | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 25 13:56:57 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 25 Jan 2017 13:56:57 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-17-ge175152
Message-ID: <E1cWN8G-0001GV-8Z@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e175152ef7515921635bf1e00383e812668d13fc (commit)
      from  5f2da5d439debf44615a97de788d8f720b517972 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e175152ef7515921635bf1e00383e812668d13fc
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 25 13:51:57 2017 +0100

    agent: Fix double free.
    
    * agent/cache.c (agent_store_cache_hit): Make sure the update is
    atomic.
    --
    Previously, the function freed the last key, and duplicated the new
    key after doing that.  There is a chance, however, that calling the
    allocator surrenders control to a different thread, causing a double
    free if a different thread also calls this function.
    
    To make sure the update is atomic under the non-preemptive thread
    model, we must make sure not to surrender control to a different
    thread.  Therefore, we avoid calling the allocator during the
    update.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/agent/cache.c b/agent/cache.c
index f58eaea..2483682 100644
--- a/agent/cache.c
+++ b/agent/cache.c
@@ -475,6 +475,19 @@ agent_get_cache (const char *key, cache_mode_t cache_mode)
 void
 agent_store_cache_hit (const char *key)
 {
-  xfree (last_stored_cache_key);
-  last_stored_cache_key = key? xtrystrdup (key) : NULL;
+  char *new;
+  char *old;
+
+  /* To make sure the update is atomic under the non-preemptive thread
+   * model, we must make sure not to surrender control to a different
+   * thread.  Therefore, we avoid calling the allocator during the
+   * update.  */
+  new = key ? xtrystrdup (key) : NULL;
+
+  /* Atomic update.  */
+  old = last_stored_cache_key;
+  last_stored_cache_key = new;
+  /* Done.  */
+
+  xfree (old);
 }

-----------------------------------------------------------------------

Summary of changes:
 agent/cache.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 25 14:16:29 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Wed, 25 Jan 2017 14:16:29 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-37-ga98951a
Message-ID: <E1cWNR9-0002Yz-Ay@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  a98951a30a6ae603ffac4ec8c5168aa6d1019933 (commit)
      from  6f02133bb07726afa6950e5b4685e75621276e60 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a98951a30a6ae603ffac4ec8c5168aa6d1019933
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Jan 25 14:10:18 2017 +0100

    tests: Use --debug-quick-random for tests
    
    * tests/start-stop-agent: Don't autostart agent on --stop and
    running check. Use --debug-quick-random when starting.
    
    --
    This should speed up the tests especially on low entropy systems.
    Possibly fixing a hang on pythons op_genkey test in the Launchpad
    build enviorment (see launchpad issue 1655298)

diff --git a/tests/start-stop-agent b/tests/start-stop-agent
index ab47d8d..e843ce5 100755
--- a/tests/start-stop-agent
+++ b/tests/start-stop-agent
@@ -15,11 +15,12 @@ fi
 
 GPG_AGENT_INFO=
 export GPG_AGENT_INFO
+GPG_AGENT=$(which gpg-agent)
 
 token=$(echo "gpgme-$(pwd)" | tr ' ' '_')
 
 if [ "$1" = "--stop" ]; then
-  if [ "$(gpg-connect-agent getval\ $token /bye 2>/dev/null | head -1)" \
+  if [ "$(gpg-connect-agent --no-autostart getval\ $token /bye 2>/dev/null | head -1)" \
         != "D set" ]; then
     echo "gpg-agent not running" >&2
     exit 0
@@ -29,15 +30,16 @@ if [ "$1" = "--stop" ]; then
   exit 0
 fi
 
-if [ "$(gpg-connect-agent getval\ $token /bye 2>/dev/null | head -1)" \
+if [ "$(gpg-connect-agent --no-autostart getval\ $token /bye 2>/dev/null | head -1)" \
       = "D set" ]; then
   echo "gpg-agent already running" >&2
   exit 0
 fi
 
-echo "starting gpg-agent " >&2
-gpg-connect-agent putval\ $token\ set /bye >/dev/null 2>&1
-if [ "$(gpg-connect-agent getval\ $token /bye 2>/dev/null | head -1)" \
+echo "starting gpg-agent.." >&2
+
+gpg-connect-agent --agent-program="${GPG_AGENT}|--debug-quick-random" putval\ $token\ set /bye
+if [ $? -ne 0 -o "$(gpg-connect-agent getval\ $token /bye 2>/dev/null | head -1)" \
       != "D set" ]; then
   echo "error starting gpg-agent" >&2
   exit 1

-----------------------------------------------------------------------

Summary of changes:
 tests/start-stop-agent | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 25 17:00:02 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 25 Jan 2017 17:00:02 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-20-g3f4f20e
Message-ID: <E1cWPzS-0000ym-5D@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  3f4f20ee6eff052c88647b820d9ecfdbd8df0f40 (commit)
       via  02a39f0d1ed717f6fc33392e6ce4ab421c3bcbba (commit)
       via  7d5a0ed792133d875fcedb6e23a9a3682f1a23f9 (commit)
      from  e175152ef7515921635bf1e00383e812668d13fc (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3f4f20ee6eff052c88647b820d9ecfdbd8df0f40
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 25 16:33:20 2017 +0100

    gpg: Fix searching for mail addresses in keyrings.
    
    * g10/keyring.c (compare_name): Fix KEYDB_SEARCH_MODE_MAIL* searches
    in keyrings when the UID is a plain addr-spec.
    --
    Previously, 'gpg --list-key "<foo at example.org>"' failed if 1/ the
    keyring format is used and 2/ the key's UID is a plain addr-spec
    (cf. RFC2822 section 4.3), e.g. 'foo at example.org'.
    
    GnuPG-bug-id: 2930
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/g10/keyring.c b/g10/keyring.c
index f1281e9..328290e 100644
--- a/g10/keyring.c
+++ b/g10/keyring.c
@@ -928,13 +928,27 @@ compare_name (int mode, const char *name, const char *uid, size_t uidlen)
     else if (   mode == KEYDB_SEARCH_MODE_MAIL
              || mode == KEYDB_SEARCH_MODE_MAILSUB
              || mode == KEYDB_SEARCH_MODE_MAILEND) {
+        int have_angles = 1;
 	for (i=0, s= uid; i < uidlen && *s != '<'; s++, i++)
 	    ;
+	if (i == uidlen)
+	  {
+	    /* The UID is a plain addr-spec (cf. RFC2822 section 4.3).  */
+	    have_angles = 0;
+	    s = uid;
+	    i = 0;
+	  }
 	if (i < uidlen)  {
-	    /* skip opening delim and one char and look for the closing one*/
-	    s++; i++;
-	    for (se=s+1, i++; i < uidlen && *se != '>'; se++, i++)
-		;
+	    if (have_angles)
+	      {
+		/* skip opening delim and one char and look for the closing one*/
+		s++; i++;
+		for (se=s+1, i++; i < uidlen && *se != '>'; se++, i++)
+		  ;
+	      }
+	    else
+	      se = s + uidlen;
+
 	    if (i < uidlen) {
 		i = se - s;
 		if (mode == KEYDB_SEARCH_MODE_MAIL) {

commit 02a39f0d1ed717f6fc33392e6ce4ab421c3bcbba
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 25 16:53:40 2017 +0100

    tests,w32: Fix GPGME tests requiring a pinentry.
    
    * tests/gpgme/gpgme-defs.scm: Use our fake pinentry, and configure it
    to supply the correct passphrase.
    --
    Previously, the GPGME tests used the fake pinentry distributed with
    GPGME which is a Bourne shell script.  Use the fake pinentry from
    GnuPG instead.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgme/gpgme-defs.scm b/tests/gpgme/gpgme-defs.scm
index 6e35285..c102c93 100644
--- a/tests/gpgme/gpgme-defs.scm
+++ b/tests/gpgme/gpgme-defs.scm
@@ -42,6 +42,9 @@
 (setenv "PATH" (string-append (path-join (getenv "GNUPG_BUILDDIR") "tools")
 			      (string *pathsep*) (getenv "PATH")) #t)
 
+;; The tests expect the pinentry to return the passphrase "abc".
+(setenv "PINENTRY_USER_DATA" "abc" #t)
+
 (define (create-file name content)
   (letfd ((fd (open name (logior O_WRONLY O_CREAT O_BINARY) #o600)))
     (display content (fdopen fd "wb"))))
@@ -50,8 +53,7 @@
   (create-file "gpg.conf" "no-force-v3-sigs\n")
   (create-file
    "gpg-agent.conf"
-   (string-append "pinentry-program "
-		  (in-gpgme-srcdir "tests" "gpg" "pinentry") "\n"))
+   (string-append "pinentry-program " (tool 'pinentry)))
   (mkdir "private-keys-v1.d" "-rwx")
 
   (log "Storing private keys")

commit 7d5a0ed792133d875fcedb6e23a9a3682f1a23f9
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jan 25 15:39:30 2017 +0100

    tests,w32: Fix gpgsm signature verification test.
    
    * tests/gpgsm/verify.scm: Use 'call-with-binary-output-file' to avoid
    automatic line-ending conversion.
    --
    Previously, Windows' automatic line-ending conversion turned '\n' into
    '\r\n' when writing the sample to a file, making the signature
    invalid.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgsm/verify.scm b/tests/gpgsm/verify.scm
index 894c827..28210a9 100644
--- a/tests/gpgsm/verify.scm
+++ b/tests/gpgsm/verify.scm
@@ -54,12 +54,12 @@ MYdRclgjObCcoilA8fZ13VR4DiMJVFCxJL4qVWI=
 ;;
 (info "Checking that a valid signature is verified as such.")
 (lettmp (sig body)
-  (with-output-to-file sig (lambda () (display test-sig1)))
-  (with-output-to-file body (lambda () (display test-text1)))
+  (call-with-binary-output-file sig (lambda (port) (display test-sig1 port)))
+  (call-with-binary-output-file body (lambda (port) (display test-text1 port)))
   (call-check `(, at gpgsm --verify ,sig ,body)))
 
 (info "Checking that an invalid signature is verified as such.")
 (lettmp (sig body)
-  (with-output-to-file sig (lambda () (display test-sig1)))
-  (with-output-to-file body (lambda () (display test-text1f)))
+  (call-with-binary-output-file sig (lambda (port) (display test-sig1 port)))
+  (call-with-binary-output-file body (lambda (port) (display test-text1f port)))
   (assert (not (zero? (call `(, at gpgsm --verify ,sig ,body))))))

-----------------------------------------------------------------------

Summary of changes:
 g10/keyring.c              | 22 ++++++++++++++++++----
 tests/gpgme/gpgme-defs.scm |  6 ++++--
 tests/gpgsm/verify.scm     |  8 ++++----
 3 files changed, 26 insertions(+), 10 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jan 25 18:51:49 2017
From: cvs at cvs.gnupg.org (by Tobias Mueller)
Date: Wed, 25 Jan 2017 18:51:49 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-38-g9291eba
Message-ID: <E1cWRjb-0005zS-0P@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  9291ebaa4151a1f6c8c0601095ec45809b963383 (commit)
      from  a98951a30a6ae603ffac4ec8c5168aa6d1019933 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9291ebaa4151a1f6c8c0601095ec45809b963383
Author: Tobias Mueller <muelli at cryptobitch.de>
Date:   Sat Dec 3 23:12:37 2016 +0100

    python: default op_keylist_start parameters.
    
    * lang/python/gpgme.i: Added gpgme_op_keylist_start with defaults
    * lang/python/tests/t-keylist.py: Added tests for default parameters
    --
    
    To increase the ease of use, op_keylist_start
    parameters default to sensible values.
    The empty string matches all keys.
    We assume that the user wants to retrieve public keys most of the time,
    so we default to public keys rather than secret keys.
    
    Signed-off-by: Tobias Mueller <muelli at cryptobitch.de>

diff --git a/lang/python/gpgme.i b/lang/python/gpgme.i
index 73533d0..c7d89db 100644
--- a/lang/python/gpgme.i
+++ b/lang/python/gpgme.i
@@ -541,6 +541,15 @@ wrapresult(gpgme_vfs_mount_result_t, "VFSMountResult")
     }
 }
 
+
+/* With SWIG, you can define default arguments for parameters.
+ * While it's legal in C++ it is not in C, so we cannot change the
+ * already existing gpgme.h. We need, however, to declare the function
+ * *before* SWIG loads it from gpgme.h. Hence, we define it here.     */
+gpgme_error_t gpgme_op_keylist_start (gpgme_ctx_t ctx,
+                      const char *pattern="",
+                      int secret_only=0);
+
 /* Include the unmodified <gpgme.h> for cc, and the cleaned-up local
    version for SWIG.  We do, however, want to hide certain fields on
    some structs, which we provide prior to including the version for
diff --git a/lang/python/tests/t-keylist.py b/lang/python/tests/t-keylist.py
index ea2a724..5077ca6 100755
--- a/lang/python/tests/t-keylist.py
+++ b/lang/python/tests/t-keylist.py
@@ -219,6 +219,18 @@ result = c.op_keylist_result()
 assert not result.truncated, "Key listing unexpectedly truncated"
 
 
+# We test for a parameter-less keylist
+keyring_length = len(list(c.op_keylist_all()))
+assert keyring_length > 1,\
+                "Expected to find some keys, but got %r" % keyring_length
+
+# Then we do want to call with a pattern, only
+# i.e. without giving secret=0
+alpha_keys = list(c.op_keylist_all(b"Alpha"))
+assert len(alpha_keys) == 1, "Expected only one key for 'Alpha', got %r" % len(alpha_keys)
+
+
+
 for i, key in enumerate(c.keylist()):
     try:
         if len(keys[i]) == 4:

-----------------------------------------------------------------------

Summary of changes:
 lang/python/gpgme.i            |  9 +++++++++
 lang/python/tests/t-keylist.py | 12 ++++++++++++
 2 files changed, 21 insertions(+)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 26 08:59:04 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 26 Jan 2017 08:59:04 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-21-gbb5ceb7
Message-ID: <E1cWexW-0001hQ-Oe@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  bb5ceb78c333129a44c0144f2cf49b17ede898f1 (commit)
      from  3f4f20ee6eff052c88647b820d9ecfdbd8df0f40 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit bb5ceb78c333129a44c0144f2cf49b17ede898f1
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Thu Jan 26 16:54:40 2017 +0900

    scd: Add INTERRUPT endp support to CCID driver.
    
    * scd/app.c (scd_update_reader_status_file): Fix releas of APP.
    * scd/ccid-driver.c (struct ccid_driver_s): Add INTR_BUF.
    (intr_cb, ccid_setup_intr): New.
    (ccid_open_usb_reader): Call ccid_setup_intr.
    (ccid_slot_status): Return CCID_DRIVER_ERR_NO_READER when removed.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app.c b/scd/app.c
index b10a452..88a3801 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -1049,6 +1049,7 @@ scd_update_reader_status_file (void)
                 {
                   log_debug ("Removal of a card: %d\n", a->slot);
                   apdu_close_reader (a->slot);
+                  release_application_internal (a);
                   deallocate_app (a);
                 }
               else
diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index b7f97ed..ce55393 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -272,6 +272,8 @@ struct ccid_driver_s
      ccid_set_progress_cb.  */
   void (*progress_cb)(void *, const char *, int, int, int);
   void *progress_cb_arg;
+
+  unsigned char intr_buf[64];
 };
 
 
@@ -1753,6 +1755,64 @@ ccid_compare_BAI (ccid_driver_t handle, unsigned int bai)
   return handle->bai == bai;
 }
 
+
+static void
+intr_cb (struct libusb_transfer *transfer)
+{
+  ccid_driver_t handle = transfer->user_data;
+
+  DEBUGOUT ("CCID: interrupt callback\n");
+
+  if (transfer->status == LIBUSB_TRANSFER_NO_DEVICE)
+    {
+    device_removed:
+      DEBUGOUT ("CCID: device removed\n");
+      handle->powered_off = 1;
+      libusb_free_transfer (transfer);
+    }
+  else if (transfer->status == LIBUSB_TRANSFER_COMPLETED)
+    {
+      if (transfer->actual_length == 2
+          && transfer->buffer[0] == 0x50
+          && (transfer->buffer[1] & 1) == 0)
+        {
+          DEBUGOUT ("CCID: card removed\n");
+          handle->powered_off = 1;
+          libusb_free_transfer (transfer);
+        }
+      else
+        {
+          int err;
+
+          /* Submit the URB again to keep watching the INTERRUPT transfer.  */
+          err = libusb_submit_transfer (transfer);
+          if (err == LIBUSB_ERROR_NO_DEVICE)
+            goto device_removed;
+
+          DEBUGOUT_1 ("CCID submit transfer again %d", err);
+        }
+    }
+  else
+    {
+      ;
+    }
+}
+
+static void
+ccid_setup_intr  (ccid_driver_t handle)
+{
+  struct libusb_transfer *transfer;
+  int err;
+
+  transfer = libusb_alloc_transfer (0);
+  libusb_fill_interrupt_transfer (transfer, handle->idev, handle->ep_intr,
+                                  handle->intr_buf, sizeof (handle->intr_buf),
+                                  intr_cb, handle, 0);
+  err = libusb_submit_transfer (transfer);
+  DEBUGOUT_2 ("CCID submit transfer (%x): %d", handle->ep_intr, err);
+}
+
+
 static int
 ccid_open_usb_reader (const char *spec_reader_name,
                       int idx, struct ccid_dev_table *ccid_table,
@@ -1847,6 +1907,9 @@ ccid_open_usb_reader (const char *spec_reader_name,
         }
     }
 
+  if ((*handle)->ep_intr)
+    ccid_setup_intr (*handle);
+
   rc = ccid_vendor_specific_init (*handle);
 
  leave:
@@ -1871,8 +1934,8 @@ ccid_open_usb_reader (const char *spec_reader_name,
 /* Open the reader with the internal number READERNO and return a
    pointer to be used as handle in HANDLE.  Returns 0 on success. */
 int
-ccid_open_reader (const char *spec_reader_name,
-                  int idx, struct ccid_dev_table *ccid_table,
+ccid_open_reader (const char *spec_reader_name, int idx,
+                  struct ccid_dev_table *ccid_table,
                   ccid_driver_t *handle, char **rdrname_p)
 {
   int n;
@@ -2516,6 +2579,9 @@ ccid_slot_status (ccid_driver_t handle, int *statusbits)
   unsigned char seqno;
   int retries = 0;
 
+  if (handle->powered_off)
+    return CCID_DRIVER_ERR_NO_READER;
+
  retry:
   msg[0] = PC_to_RDR_GetSlotStatus;
   msg[5] = 0; /* slot */
@@ -2546,8 +2612,7 @@ ccid_slot_status (ccid_driver_t handle, int *statusbits)
       retries++;
       goto retry;
     }
-  if (rc && rc != CCID_DRIVER_ERR_NO_CARD
-      && rc != CCID_DRIVER_ERR_CARD_INACTIVE)
+  if (rc && rc != CCID_DRIVER_ERR_NO_CARD && rc != CCID_DRIVER_ERR_CARD_INACTIVE)
     return rc;
   *statusbits = (msg[7] & 3);
 

-----------------------------------------------------------------------

Summary of changes:
 scd/app.c         |  1 +
 scd/ccid-driver.c | 73 ++++++++++++++++++++++++++++++++++++++++++++++++++++---
 2 files changed, 70 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 26 10:58:21 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 26 Jan 2017 10:58:21 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 86789ad7aee784995ba57e8c965a9c26052222db
Message-ID: <E1cWgox-0006b6-DI@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  86789ad7aee784995ba57e8c965a9c26052222db (commit)
       via  f94fbbca622ebb28d97b258d7687ba17327b994d (commit)
      from  d292eb51ffef71155aac900fd5fa1b6556e966eb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 86789ad7aee784995ba57e8c965a9c26052222db
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jan 26 10:58:01 2017 +0100

    jenkins: make communicating test failures more robust

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index dc31e11..47dfdb4 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -148,9 +148,10 @@ case "$XTARGET" in
 	           CXXFLAGS="$CXXFLAGS -std=c++11"
         $MAKE $MAKEFLAGS
 
-        env $test_environment $MAKE -k check verbose=2 || true
-        # Jenkins looks for "tests? failed" to mark a build unstable,
-        # hence || true here
+        env $test_environment $MAKE -k check verbose=2 \
+	    || echo "FAIL: make check failed with status $?"
+        # Jenkins looks for "FAIL:" to mark a build unstable,
+        # hence || ... here
 
         $MAKE install
         ;;
@@ -165,9 +166,10 @@ case "$XTARGET" in
 	           CXXFLAGS="$CXXFLAGS $SANFLAGS -fPIC -std=c++11"
         $SCANBUILD $MAKE $MAKEFLAGS
 
-        env $test_environment $MAKE -k check verbose=2 || true
-        # Jenkins looks for "tests? failed" to mark a build unstable,
-        # hence || true here
+        env $test_environment $MAKE -k check verbose=2 \
+	    || echo "FAIL: make check failed with status $?"
+        # Jenkins looks for "FAIL:" to mark a build unstable,
+        # hence || ... here
 
         $MAKE install
         ;;
@@ -223,7 +225,10 @@ case "$XTARGET" in
 	  cd "$WORKDIR"
           $abs_configure --prefix=$PREFIX --enable-maintainer-mode \
                    $CONFIGUREFLAGS
-          env $test_environment $MAKE $MAKEFLAGS distcheck
+          env $test_environment $MAKE $MAKEFLAGS distcheck \
+	    || echo "FAIL: make distcheck failed with status $?"
+        # Jenkins looks for "FAIL:" to mark a build unstable,
+        # hence || ... here
 
           # Extract the tarname from the package
           tarname=$(awk <config.h '

commit f94fbbca622ebb28d97b258d7687ba17327b994d
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jan 26 10:49:08 2017 +0100

    jenkins: run more tests on windows

diff --git a/misc/jenkins/README.org b/misc/jenkins/README.org
index 4862601..5d0e8ef 100644
--- a/misc/jenkins/README.org
+++ b/misc/jenkins/README.org
@@ -9,6 +9,10 @@ and a build tree at
 
   $HOME/src/gpgme-for-gnupgs-tests/obj
 
+and a w32 build tree at
+
+  $HOME/src/gpgme-for-gnupgs-tests/obj.w32
+
 The tests from there are executed in GnuPG's test suite.
 * Virtual machines
 ** openbsd60
diff --git a/misc/jenkins/bin/make-windows-cd.sh b/misc/jenkins/bin/make-windows-cd.sh
index a66c38a..835f798 100644
--- a/misc/jenkins/bin/make-windows-cd.sh
+++ b/misc/jenkins/bin/make-windows-cd.sh
@@ -9,6 +9,8 @@ fi
 [ -z "$w32root" ] && w32root="$HOME/w32root"
 ADDITIONAL_FILES=
 IMAGE=gnupg-test.iso
+XTEST_GPGME_SRCDIR=$HOME/src/gpgme-for-gnupgs-tests
+XTEST_GPGME_BUILDDIR=$HOME/src/gpgme-for-gnupgs-tests/obj.w32
 
 [ -f make-windows-cd.rc ] && . make-windows-cd.rc
 
@@ -27,7 +29,18 @@ cp -v tests/gpgscm/*.exe $TARGET
 cp -v tools/mk-tdata.exe $TARGET || true
 cp -v agent/gpg-preset-passphrase.exe $TARGET
 cp -v -a ../tests $TARGET
+if [ -e "$XTEST_GPGME_SRCDIR" ] && [ -e "$XTEST_GPGME_BUILDDIR" ]; then
+    cp -a "$XTEST_GPGME_SRCDIR" $TARGET/gpgme
+    cp -v "$XTEST_GPGME_BUILDDIR"/src/.libs/*.exe $TARGET
+    cp -v "$XTEST_GPGME_BUILDDIR"/src/.libs/*.dll $TARGET
+    # Strip .git.
+    rm -rf -- $TARGET/gpgme/.git
+    # Remove native build if it exists.
+    rm -rf -- $TARGET/gpgme/obj
+fi
+cp -v -a ../tests $TARGET
 cp -v tests/openpgp/fake-pinentry.exe $TARGET
 cp -v /home/jenkins/bin/run-tests.bat $WORKDIR
+[ -f "$IMAGE" ] && rm -f "$IMAGE"
 genisoimage --output "$IMAGE" -J "$WORKDIR"
 [ "${WORKDIR}" ] && rm -rf -- "${WORKDIR}"
diff --git a/misc/jenkins/bin/run-tests-w32.bash b/misc/jenkins/bin/run-tests-w32.bash
index 44e303d..799f7fa 100755
--- a/misc/jenkins/bin/run-tests-w32.bash
+++ b/misc/jenkins/bin/run-tests-w32.bash
@@ -40,7 +40,7 @@ function vwait() {
 }
 
 # Revert to current snapshot and start the machine.
-vdo snapshot-revert --current --force --running "$GUEST"
+vdo snapshot-revert --snapshotname tests --force --running "$GUEST"
 
 # Insert the CD.
 vdo change-media --update "$GUEST" "$GUEST_CDROM" "$1"
@@ -53,13 +53,13 @@ set -x
 
 if [ "$2" ]; then
     scp "$2" "$SSH:"
-    sleep 1 # XXX: openssh on windows is a bit fragile...
+    sleep 5 # XXX: openssh on windows is a bit fragile...
     time vssh "cmd /c $(basename $2)"
 else
     time vssh "cmd /c d:/run-tests.bat"
 fi
 
-sleep 1 # XXX: openssh on windows is a bit fragile...
+sleep 5 # XXX: openssh on windows is a bit fragile...
 
 # The scp server is a bit fragile as well, and I believe globbing does
 # not work.  Simply use gpgtar.
diff --git a/misc/jenkins/bin/run-tests.bat b/misc/jenkins/bin/run-tests.bat
index adef960..996809f 100644
--- a/misc/jenkins/bin/run-tests.bat
+++ b/misc/jenkins/bin/run-tests.bat
@@ -1,21 +1,46 @@
 @echo off
 
 set BIN_PREFIX=d:\gnupg
+set PATH=%BIN_PREFIX%;%PATH%
 set GPGSCM_PATH=%BIN_PREFIX%/tests/gpgscm;%BIN_PREFIX%/tests/openpgp
 set EXEEXT=.exe
-set srcdir=%BIN_PREFIX%/tests/openpgp
 set TMP=c:\temp
 set WD=c:\temp\logs
 mkdir %TMP%
 mkdir %WD%
 
 cd /d %BIN_PREFIX%
+echo Running self tests...
 %BIN_PREFIX%\gpgscm.exe --verbose tests/gpgscm/t-child.scm
 
-cd /d %WD%
-
 rem the gpgtar.scm is acting up (looping), and we don't deal with that
 rem well atm, so we simply omit it
 
-echo Running tests...
-%BIN_PREFIX%\gpgscm.exe %srcdir%/run-tests.scm --parallel version.scm enarmor.scm mds.scm decrypt.scm decrypt-multifile.scm decrypt-dsa.scm decrypt-session-key.scm sigs.scm sigs-dsa.scm encrypt.scm encrypt-multifile.scm encrypt-dsa.scm compression.scm seat.scm clearsig.scm encryptp.scm detach.scm detachm.scm armsigs.scm armencrypt.scm armencryptp.scm signencrypt.scm signencrypt-dsa.scm armsignencrypt.scm armdetach.scm armdetachm.scm genkey1024.scm conventional.scm conventional-mdc.scm multisig.scm verify.scm verify-multifile.scm gpgv-forged-keyring.scm armor.scm import.scm import-revocation-certificate.scm ecc.scm 4gb-packet.scm tofu.scm use-exact-key.scm default-key.scm export.scm ssh-import.scm ssh-export.scm quick-key-manipulation.scm key-selection.scm delete-keys.scm gpgconf.scm issue2015.scm issue2346.scm issue2417.scm issue2419.scm
+echo Running OpenPGP tests...
+cd /d %WD%
+mkdir openpgp
+cd openpgp
+
+set srcdir=%BIN_PREFIX%/tests/openpgp
+%BIN_PREFIX%\gpgscm.exe %srcdir%/run-tests.scm --parallel version.scm enarmor.scm mds.scm decrypt.scm decrypt-multifile.scm decrypt-dsa.scm decrypt-session-key.scm sigs.scm sigs-dsa.scm encrypt.scm encrypt-multifile.scm encrypt-dsa.scm compression.scm seat.scm clearsig.scm encryptp.scm detach.scm detachm.scm armsigs.scm armencrypt.scm armencryptp.scm signencrypt.scm signencrypt-dsa.scm armsignencrypt.scm armdetach.scm armdetachm.scm genkey1024.scm conventional.scm conventional-mdc.scm multisig.scm verify.scm verify-multifile.scm gpgv-forged-keyring.scm armor.scm import.scm import-revocation-certificate.scm ecc.scm 4gb-packet.scm tofu.scm use-exact-key.scm default-key.scm export.scm ssh-import.scm ssh-export.scm quick-key-manipulation.scm key-selection.scm delete-keys.scm gpgconf.scm issue2015.scm issue2346.scm issue2417.scm issue2419.scm issue2929.scm
+
+echo Running gpgsm tests...
+cd /d %WD%
+mkdir gpgsm
+cd gpgsm
+
+set GPGSCM_PATH=%BIN_PREFIX%/tests/gpgscm;%BIN_PREFIX%/tests/openpgp;%BIN_PREFIX%/tests/gpgsm
+set srcdir=%BIN_PREFIX%/tests/gpgsm
+%BIN_PREFIX%\gpgscm.exe %srcdir%/run-tests.scm --parallel import.scm encrypt.scm verify.scm decrypt.scm sign.scm export.scm
+
+echo Running GPGME tests...
+cd /d %WD%
+mkdir gpgme
+cd gpgme
+
+rem set verbose=3
+set GPGSCM_PATH=%BIN_PREFIX%/tests/gpgscm;%BIN_PREFIX%/tests/openpgp;%BIN_PREFIX%/tests/gpgme
+set srcdir=%BIN_PREFIX%/tests/gpgme
+set XTEST_GPGME_SRCDIR=%BIN_PREFIX%/gpgme
+set XTEST_GPGME_BUILDDIR=%BIN_PREFIX%/gpgme/obj.w32
+%BIN_PREFIX%\gpgscm.exe %srcdir%/run-tests.scm --parallel

-----------------------------------------------------------------------

Summary of changes:
 misc/jenkins/README.org             |  4 ++++
 misc/jenkins/bin/build.bash         | 19 ++++++++++++-------
 misc/jenkins/bin/make-windows-cd.sh | 13 +++++++++++++
 misc/jenkins/bin/run-tests-w32.bash |  6 +++---
 misc/jenkins/bin/run-tests.bat      | 35 ++++++++++++++++++++++++++++++-----
 5 files changed, 62 insertions(+), 15 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 26 11:22:52 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 26 Jan 2017 11:22:52 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-39-gf3ca2c9
Message-ID: <E1cWhCg-0007vJ-3s@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  f3ca2c9ce9fd4a03e293065f10b92589a7e642d6 (commit)
      from  9291ebaa4151a1f6c8c0601095ec45809b963383 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f3ca2c9ce9fd4a03e293065f10b92589a7e642d6
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Jan 26 10:44:02 2017 +0100

    python: Ensure quick-random is used if gpg is gpg2
    
    * lang/python/tests/Makefile.am (gpg.conf): Configure
    agent-program accordingly.

diff --git a/lang/python/tests/Makefile.am b/lang/python/tests/Makefile.am
index f9366dd..d7f2e58 100644
--- a/lang/python/tests/Makefile.am
+++ b/lang/python/tests/Makefile.am
@@ -107,6 +107,8 @@ clean-local:
 ./gpg.conf:
 # This is required for t-sig-notations.
 	echo no-force-v3-sigs > ./gpg.conf
+	echo ignore-invalid-option agent-program >> ./gpg.conf
+	echo "agent-program `which $(GPG_AGENT)`|--debug-quick-random" >> ./gpg.conf
 
 ./gpg-agent.conf:
 # This is required for gpg2, which does not support command fd.

-----------------------------------------------------------------------

Summary of changes:
 lang/python/tests/Makefile.am | 2 ++
 1 file changed, 2 insertions(+)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 26 11:34:56 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 26 Jan 2017 11:34:56 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-22-g9b06633
Message-ID: <E1cWhON-0000O8-CO@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  9b06633c811e8815c07d744f20b45405cb082367 (commit)
      from  bb5ceb78c333129a44c0144f2cf49b17ede898f1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9b06633c811e8815c07d744f20b45405cb082367
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Thu Jan 26 19:32:51 2017 +0900

    scd: Fix APP reference counting.
    
    * scd/app.c (scd_update_reader_status_file): Don't call another
    release_application_internal.
    * scd/command.c (open_card_with_request): Don't require APPTYPE !=
    NULL.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app.c b/scd/app.c
index 88a3801..b10a452 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -1049,7 +1049,6 @@ scd_update_reader_status_file (void)
                 {
                   log_debug ("Removal of a card: %d\n", a->slot);
                   apdu_close_reader (a->slot);
-                  release_application_internal (a);
                   deallocate_app (a);
                 }
               else
diff --git a/scd/command.c b/scd/command.c
index 8c7ca20..26f8630 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -221,7 +221,7 @@ open_card_with_request (ctrl_t ctrl, const char *apptype, const char *serialno)
   /* If we are already initialized for one specific application we
      need to check that the client didn't requested a specific
      application different from the one in use before we continue. */
-  if (apptype && ctrl->app_ctx)
+  if (ctrl->app_ctx)
     return check_application_conflict (apptype, ctrl->app_ctx);
 
   if (serialno)

-----------------------------------------------------------------------

Summary of changes:
 scd/app.c     | 1 -
 scd/command.c | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jan 26 14:13:54 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 26 Jan 2017 14:13:54 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-23-g881dcdf
Message-ID: <E1cWjsC-0006pp-GW@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  881dcdfd84ebad36bff20c895e629025bed9d94e (commit)
      from  9b06633c811e8815c07d744f20b45405cb082367 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 881dcdfd84ebad36bff20c895e629025bed9d94e
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Thu Jan 26 22:02:41 2017 +0900

    scd: Only submit apdu_get_status when needed.
    
    * scd/apdu.c (apdu_dev_list_finish): Return Boolean value if
    all device support INTERRUPT transfer.
    * scd/ccid-driver.c (ccid_dev_scan_finish): Likewise.
    * scd/app.c (app_new_register): Fix initial value of card_status.
    (select_application): Call update_fdset_for_usb.
    (scd_update_reader_status_file): Ditto.
    * scd/scdaemon.c (update_fdset_for_usb, need_tick): New.
    (handle_connections): Call handle_tick when select returns.
    Let select watch USB file descriptors, too.
    Call libusb_handle_events_timeout_completed for INTERRUPT transfer.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/apdu.c b/scd/apdu.c
index 38ebd2b..f88d970 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -2970,15 +2970,22 @@ apdu_dev_list_start (const char *portstr, struct dev_list **l_p)
   return 0;
 }
 
-void
+int
 apdu_dev_list_finish (struct dev_list *dl)
 {
+  int all_have_intr_endp;
+
 #ifdef HAVE_LIBUSB
   if (dl->ccid_table)
-    ccid_dev_scan_finish (dl->ccid_table, dl->idx_max);
+    all_have_intr_endp = ccid_dev_scan_finish (dl->ccid_table, dl->idx_max);
+  else
+    all_have_intr_endp = 0;
+#else
+  all_have_intr_endp = 0;
 #endif
   xfree (dl);
   npth_mutex_unlock (&reader_table_lock);
+  return all_have_intr_endp;
 }
 
 
diff --git a/scd/apdu.h b/scd/apdu.h
index 473def5..d71c8dd 100644
--- a/scd/apdu.h
+++ b/scd/apdu.h
@@ -88,7 +88,7 @@ struct dev_list;
 gpg_error_t apdu_init (void);
 
 gpg_error_t apdu_dev_list_start (const char *portstr, struct dev_list **l_p);
-void apdu_dev_list_finish (struct dev_list *l);
+int apdu_dev_list_finish (struct dev_list *l);
 
 /* Note, that apdu_open_reader returns no status word but -1 on error. */
 int apdu_open_reader (struct dev_list *l);
diff --git a/scd/app.c b/scd/app.c
index b10a452..daff0b7 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -192,6 +192,7 @@ app_new_register (int slot, ctrl_t ctrl, const char *name)
     }
 
   app->slot = slot;
+  app->card_status = (unsigned int)-1;
 
   if (npth_mutex_init (&app->lock, NULL))
     {
@@ -329,6 +330,7 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app,
   if (scan || !app_top)
     {
       struct dev_list *l;
+      int all_have_intr_endp;
 
       err = apdu_dev_list_start (opt.reader_port, &l);
       if (err)
@@ -368,7 +370,8 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app,
             }
         }
 
-      apdu_dev_list_finish (l);
+      all_have_intr_endp = apdu_dev_list_finish (l);
+      update_fdset_for_usb (1, all_have_intr_endp);
     }
 
   npth_mutex_lock (&app_list_lock);
@@ -1050,6 +1053,7 @@ scd_update_reader_status_file (void)
                   log_debug ("Removal of a card: %d\n", a->slot);
                   apdu_close_reader (a->slot);
                   deallocate_app (a);
+                  update_fdset_for_usb (0, 0);
                 }
               else
                 a->card_status = status;
diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index ce55393..8ca8e96 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -1699,13 +1699,17 @@ ccid_dev_scan (int *idx_max_p, struct ccid_dev_table **t_p)
   return err;
 }
 
-void
+int
 ccid_dev_scan_finish (struct ccid_dev_table *tbl, int max)
 {
+  int all_have_intr_endp = 1;
   int i;
 
   for (i = 0; i < max; i++)
     {
+      if (tbl[i].ep_intr == -1)
+        all_have_intr_endp = 0;
+
       free (tbl[i].ifcdesc_extra);
       tbl[i].transport = 0;
       tbl[i].n = 0;
@@ -1719,6 +1723,8 @@ ccid_dev_scan_finish (struct ccid_dev_table *tbl, int max)
     }
   libusb_free_device_list (ccid_usb_dev_list, 1);
   ccid_usb_dev_list = NULL;
+
+  return all_have_intr_endp;
 }
 
 unsigned int
diff --git a/scd/ccid-driver.h b/scd/ccid-driver.h
index 9e71f5e..8e9f9e2 100644
--- a/scd/ccid-driver.h
+++ b/scd/ccid-driver.h
@@ -115,7 +115,7 @@ int ccid_set_debug_level (int level);
 char *ccid_get_reader_list (void);
 
 gpg_error_t ccid_dev_scan (int *idx_max, struct ccid_dev_table **t_p);
-void ccid_dev_scan_finish (struct ccid_dev_table *tbl, int max);
+int ccid_dev_scan_finish (struct ccid_dev_table *tbl, int max);
 unsigned int ccid_get_BAI (int, struct ccid_dev_table *tbl);
 int ccid_compare_BAI (ccid_driver_t handle, unsigned int);
 int ccid_open_reader (const char *spec_reader_name,
diff --git a/scd/scdaemon.c b/scd/scdaemon.c
index 74fed44..8e1f698 100644
--- a/scd/scdaemon.c
+++ b/scd/scdaemon.c
@@ -44,6 +44,10 @@
 
 #include <assuan.h> /* malloc hooks */
 
+#ifdef HAVE_LIBUSB
+#include <libusb.h>
+#endif
+
 #include "i18n.h"
 #include "sysutils.h"
 #include "app-common.h"
@@ -224,7 +228,17 @@ static assuan_sock_nonce_t socket_nonce;
    disabled but it won't perform any ticker specific actions. */
 static int ticker_disabled;
 
+/* Set of FD to select.  */
+static fd_set fdset;
+
+/* Max FD to select.  */
+static int nfd;
 
+/* Set if all usb devices have INTERRUPT endpoints.  */
+static int usb_all_have_intr_endp;
+
+/* FD to listen incomming connections.  */
+static int listen_fd;
 

 static char *create_socket_name (char *standard_name);
 static gnupg_fd_t create_server_socket (const char *name,
@@ -232,7 +246,7 @@ static gnupg_fd_t create_server_socket (const char *name,
                                         assuan_sock_nonce_t *nonce);
 
 static void *start_connection_thread (void *arg);
-static void handle_connections (int listen_fd);
+static void handle_connections (void);
 
 /* Pth wrapper function definitions. */
 ASSUAN_SYSTEM_NPTH_IMPL;
@@ -780,7 +794,8 @@ main (int argc, char **argv )
 
       /* We run handle_connection to wait for the shutdown signal and
          to run the ticker stuff.  */
-      handle_connections (fd);
+      listen_fd = fd;
+      handle_connections ();
       if (fd != -1)
         close (fd);
     }
@@ -912,7 +927,8 @@ main (int argc, char **argv )
 
 #endif /*!HAVE_W32_SYSTEM*/
 
-      handle_connections (fd);
+      listen_fd = fd;
+      handle_connections ();
 
       close (fd);
     }
@@ -1181,23 +1197,76 @@ start_connection_thread (void *arg)
 }
 
 
+void
+update_fdset_for_usb (int scanned, int all_have_intr_endp)
+{
+#ifdef HAVE_LIBUSB
+  const struct libusb_pollfd **pfd_array = libusb_get_pollfds (NULL);
+  const struct libusb_pollfd **p;
+#endif
+
+  if (scanned)
+    usb_all_have_intr_endp = all_have_intr_endp;
+
+  FD_ZERO (&fdset);
+  nfd = 0;
+
+  if (listen_fd != -1)
+    {
+      FD_SET (listen_fd, &fdset);
+      nfd = listen_fd;
+    }
+
+#ifdef HAVE_LIBUSB
+  for (p = pfd_array; *p; p++)
+    {
+      int fd = (*p)->fd;
+
+      FD_SET (fd, &fdset);
+      if (nfd < fd)
+        nfd = fd;
+      p++;
+    }
+
+  libusb_free_pollfds (pfd_array);
+#endif
+
+  log_debug ("update_fdset_for_usb (%d, %d): %d\n",
+             scanned, all_have_intr_endp, nfd);
+}
+
+static int
+need_tick (void)
+{
+  if (shutdown_pending)
+    return 1;
+
+  if (listen_fd != -1 && nfd == listen_fd)
+    return 1;
+
+  if (usb_all_have_intr_endp)
+    return 0;
+
+  return 1;
+}
+
 /* Connection handler loop.  Wait for connection requests and spawn a
    thread after accepting a connection.  LISTEN_FD is allowed to be -1
    in which case this code will only do regular timeouts and handle
    signals. */
 static void
-handle_connections (int listen_fd)
+handle_connections (void)
 {
   npth_attr_t tattr;
   struct sockaddr_un paddr;
   socklen_t plen;
-  fd_set fdset, read_fdset;
+  fd_set read_fdset;
   int ret;
   int fd;
-  int nfd;
   struct timespec abstime;
   struct timespec curtime;
   struct timespec timeout;
+  struct timespec *t;
   int saved_errno;
 #ifndef HAVE_W32_SYSTEM
   int signo;
@@ -1244,56 +1313,63 @@ handle_connections (int listen_fd)
              used to just wait on a signal or timeout event. */
           FD_ZERO (&fdset);
           listen_fd = -1;
-	}
+        }
 
-      npth_clock_gettime (&curtime);
-      if (!(npth_timercmp (&curtime, &abstime, <)))
-	{
-	  /* Timeout.  */
-	  handle_tick ();
-	  timeout.tv_sec = TIMERTICK_INTERVAL_SEC;
-	  timeout.tv_nsec = TIMERTICK_INTERVAL_USEC * 1000;
-	  npth_timeradd (&curtime, &timeout, &abstime);
-	}
-      npth_timersub (&abstime, &curtime, &timeout);
+      if (need_tick ())
+        {
+          npth_clock_gettime (&curtime);
+          if (!(npth_timercmp (&curtime, &abstime, <)))
+            {
+              /* Timeout.  */
+              timeout.tv_sec = TIMERTICK_INTERVAL_SEC;
+              timeout.tv_nsec = TIMERTICK_INTERVAL_USEC * 1000;
+              npth_timeradd (&curtime, &timeout, &abstime);
+            }
+          npth_timersub (&abstime, &curtime, &timeout);
+          t = &timeout;
+        }
+      else
+        t = NULL;
+
+      handle_tick ();
 
       /* POSIX says that fd_set should be implemented as a structure,
          thus a simple assignment is fine to copy the entire set.  */
       read_fdset = fdset;
 
 #ifndef HAVE_W32_SYSTEM
-      ret = npth_pselect (nfd+1, &read_fdset, NULL, NULL, &timeout, npth_sigev_sigmask());
+      ret = npth_pselect (nfd+1, &read_fdset, NULL, NULL, t, npth_sigev_sigmask());
       saved_errno = errno;
 
       while (npth_sigev_get_pending(&signo))
-	handle_signal (signo);
+        handle_signal (signo);
 #else
-      ret = npth_eselect (nfd+1, &read_fdset, NULL, NULL, &timeout, NULL, NULL);
+      ret = npth_eselect (nfd+1, &read_fdset, NULL, NULL, t, NULL, NULL);
       saved_errno = errno;
 #endif
 
       if (ret == -1 && saved_errno != EINTR)
-	{
+        {
           log_error (_("npth_pselect failed: %s - waiting 1s\n"),
                      strerror (saved_errno));
           npth_sleep (1);
-	  continue;
-	}
+          continue;
+        }
 
       if (ret <= 0)
-	/* Timeout.  Will be handled when calculating the next timeout.  */
-	continue;
+        /* Timeout.  Will be handled when calculating the next timeout.  */
+        continue;
 
       if (listen_fd != -1 && FD_ISSET (listen_fd, &read_fdset))
-	{
+        {
           ctrl_t ctrl;
 
           plen = sizeof paddr;
-	  fd = npth_accept (listen_fd, (struct sockaddr *)&paddr, &plen);
-	  if (fd == -1)
-	    {
-	      log_error ("accept failed: %s\n", strerror (errno));
-	    }
+          fd = npth_accept (listen_fd, (struct sockaddr *)&paddr, &plen);
+          if (fd == -1)
+            {
+              log_error ("accept failed: %s\n", strerror (errno));
+            }
           else if ( !(ctrl = xtrycalloc (1, sizeof *ctrl)) )
             {
               log_error ("error allocating connection control data: %s\n",
@@ -1303,12 +1379,12 @@ handle_connections (int listen_fd)
           else
             {
               char threadname[50];
-	      npth_t thread;
+              npth_t thread;
 
               snprintf (threadname, sizeof threadname, "conn fd=%d", fd);
               ctrl->thread_startup.fd = INT2FD (fd);
               ret = npth_create (&thread, &tattr, start_connection_thread, ctrl);
-	      if (ret)
+              if (ret)
                 {
                   log_error ("error spawning connection handler: %s\n",
                              strerror (ret));
@@ -1316,10 +1392,19 @@ handle_connections (int listen_fd)
                   close (fd);
                 }
               else
-		npth_setname_np (thread, threadname);
+                npth_setname_np (thread, threadname);
             }
-          fd = -1;
-	}
+
+          ret--;
+        }
+
+#ifdef HAVE_LIBUSB
+      if (ret)
+        {
+          struct timeval tv = {0, 0};
+          libusb_handle_events_timeout_completed (NULL, &tv, NULL);
+        }
+#endif
     }
 
   cleanup ();
diff --git a/scd/scdaemon.h b/scd/scdaemon.h
index d0bc98e..9d92ff2 100644
--- a/scd/scdaemon.h
+++ b/scd/scdaemon.h
@@ -125,6 +125,7 @@ void send_status_info (ctrl_t ctrl, const char *keyword, ...)
 void send_status_direct (ctrl_t ctrl, const char *keyword, const char *args);
 void scd_update_reader_status_file (void);
 void send_client_notifications (app_t app, int removal);
+void update_fdset_for_usb (int scanned, int all_have_intr_endp);
 
 
 #endif /*SCDAEMON_H*/

-----------------------------------------------------------------------

Summary of changes:
 scd/apdu.c        |  11 +++-
 scd/apdu.h        |   2 +-
 scd/app.c         |   6 ++-
 scd/ccid-driver.c |   8 ++-
 scd/ccid-driver.h |   2 +-
 scd/scdaemon.c    | 157 +++++++++++++++++++++++++++++++++++++++++-------------
 scd/scdaemon.h    |   1 +
 7 files changed, 145 insertions(+), 42 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 27 09:28:30 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 27 Jan 2017 09:28:30 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-59-ga351fbd
Message-ID: <E1cX1tY-0005IM-VN@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  a351fbde8548ce3f57298c618426f043844fbc78 (commit)
       via  8bbefa2ab283dd1443cb7453749aa0b51aec6ec4 (commit)
      from  39b9302da5d08bd52688d20befe626fee0b6c41d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a351fbde8548ce3f57298c618426f043844fbc78
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jan 27 09:16:31 2017 +0100

    w32: New envvar GCRYPT_RNDW32_DBG.
    
    * random/rndw32.c (_gcry_rndw32_gather_random): Use getenv to set
    DEBUG_ME.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/gcrypt.texi b/doc/gcrypt.texi
index 80c369b..a905d0f 100644
--- a/doc/gcrypt.texi
+++ b/doc/gcrypt.texi
@@ -5388,6 +5388,13 @@ for entropy.  On some older Windows systems this could help to speed
 up the creation of random numbers but also decreases the amount of
 data used to init the random number generator.
 
+ at item GCRYPT_RNDW32_DBG
+ at cindex GCRYPT_RNDW32_DBG
+Setting the value of this variable to a positive integer logs
+information about the Windows entropy gatherer using the standard log
+interface.
+
+
 @item HOME
 @cindex HOME
 This is used to locate the socket to connect to the EGD random
diff --git a/random/rndw32.c b/random/rndw32.c
index de6e783..8c507ac 100644
--- a/random/rndw32.c
+++ b/random/rndw32.c
@@ -245,12 +245,13 @@ static RTLGENRANDOM        pRtlGenRandom;
 static int system_rng_available; /* Whether a system RNG is available.  */
 static HCRYPTPROV hRNGProv;      /* Handle to Intel RNG CSP. */
 
-static int debug_me;  /* Debug flag.  */
+/* The debug flag.  Debugging is enabled if the value of the envvar
+ * GCRY_RNDW32_DBG is a postive number.*/
+static int debug_me;
 
 static int system_is_w2000;     /* True if running on W2000.  */
 
 
-
 

 /* Try and connect to the system RNG if there's one present. */
 static void
@@ -787,11 +788,16 @@ _gcry_rndw32_gather_random (void (*add)(const void*, size_t,
   if (!is_initialized)
     {
       OSVERSIONINFO osvi = { sizeof( osvi ) };
+      const char *s;
+
+      if ((s = getenv ("GCRYPT_RNDW32_DBG")) && atoi (s) > 0)
+        debug_me = 1;
 
       GetVersionEx( &osvi );
       if (osvi.dwPlatformId != VER_PLATFORM_WIN32_NT)
         log_fatal ("can only run on a Windows NT platform\n" );
       system_is_w2000 = (osvi.dwMajorVersion == 5 && osvi.dwMinorVersion == 0);
+
       init_system_rng ();
       is_initialized = 1;
     }

commit 8bbefa2ab283dd1443cb7453749aa0b51aec6ec4
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jan 27 09:13:07 2017 +0100

    Update NEWS with release info from 1.7.4 to 1.7.6.
    
    --

diff --git a/NEWS b/NEWS
index 179b18d..995aac3 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,22 @@ Noteworthy changes in version 1.8.0 (unreleased)  [C21/A1/R_]
    - GCRYCTL_PRINT_CONFIG does now also print build information for
      libgpg-error and the used compiler version.
 
+ * Performance:
+
+   - More ARMv8/AArch32 improvements for AES, GCM, SHA-256, and SHA-1.
+     [also in 1.7.4]
+
+   - Add ARMv8/AArch32 assembly implementation for Twofish and
+     Camellia.  [also in 1.7.4]
+
+   - Add bulk processing implementation for ARMv8/AArch32.
+     [also in 1.7.4]
+
+   - Add Stribog OIDs.  [also in 1.7.4]
+
+   - Improve the DRBG performance and sync the code with the Linux
+     version.  [also in 1.7.4]
+
  * Internal changes:
 
    - Libgpg-error 1.25 is now required.  This avoids stalling of nPth
@@ -26,54 +42,33 @@ Noteworthy changes in version 1.8.0 (unreleased)  [C21/A1/R_]
      allocated as needed.  These new pools are not protected against
      being swapped out (mlock can't be used).  However, these days
      this is considered a minor issue and can easily be mitigated by
-     using encrypted swap space.
-
-
- * Interface changes relative to the 1.7.0 release:
-   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-   GCRYCTL_REINIT_SYSCALL_CLAMP    NEW macro.
-
-
-Noteworthy changes in version 1.7.5 (2016-12-15)  [C21/A1/R5]
-------------------------------------------------
+     using encrypted swap space.  [also in 1.7.4]
 
  * Bug fixes:
 
-   - Fix regression in mlock detection [bug#2870].
+   - Fix AES CTR self-check detected failure in the SSSE3 based
+     implementation.  [also in 1.7.6]
 
+   - Remove gratuitous select before the getrandom syscall.
+     [also in 1.7.6]
 
-Noteworthy changes in version 1.7.4 (2016-12-09)  [C21/A1/R4]
-------------------------------------------------
+   - Fix regression in mlock detection.  [bug#2870] [also in 1.7.5]
 
- * Performance:
+   - Fix GOST 28147 CryptoPro-B S-box.   [also in 1.7.4]
 
-   - More ARMv8/AArch32 improvements for AES, GCM, SHA-256, and SHA-1.
-
-   - Add ARMv8/AArch32 assembly implementation for Twofish and
-     Camellia.
-
-   - Add bulk processing implementation for ARMv8/AArch32.
-
-   - Add Stribog OIDs.
-
-   - Improve the DRBG performance and sync the code with the Linux
-     version.
-
- * Internal changes:
+   - Fix error code handling of mlock calls.  [also in 1.7.4]
 
-   - When secure memory is requested by the MPI functions or by
-     gcry_xmalloc_secure, they do not anymore lead to a fatal error if
-     the secure memory pool is used up.  Instead new pools are
-     allocated as needed.  These new pools are not protected against
-     being swapped out (mlock can't be used).  However, these days
-     this is considered a minor issue and can easily be mitigated by
-     using encrypted swap space.
 
- * Bug fixes:
+ * Interface changes relative to the 1.7.0 release:
+   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+   GCRYCTL_REINIT_SYSCALL_CLAMP    NEW macro.
 
-   - Fix GOST 28147 CryptoPro-B S-box.
 
-   - Fix error code handling of mlock calls.
+ * Release dates of 1.7.x versions:
+   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+   Version 1.7.6 (2017-01-18)  [C21/A1/R6]
+   Version 1.7.5 (2016-12-15)  [C21/A1/R5]
+   Version 1.7.4 (2016-12-09)  [C21/A1/R4]
 
 
 Noteworthy changes in version 1.7.3 (2016-08-17)  [C21/A1/R3]

-----------------------------------------------------------------------

Summary of changes:
 NEWS            | 69 ++++++++++++++++++++++++++-------------------------------
 doc/gcrypt.texi |  7 ++++++
 random/rndw32.c | 10 +++++++--
 3 files changed, 47 insertions(+), 39 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 27 10:14:08 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 27 Jan 2017 10:14:08 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-25-g25cc857
Message-ID: <E1cX2bj-000796-Tp@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  25cc8575da9a9b8bf60c64c8059cb5f73cc52e1d (commit)
       via  031e3fa7b9a6770a4de1a184555250feeba0d26f (commit)
      from  881dcdfd84ebad36bff20c895e629025bed9d94e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 25cc8575da9a9b8bf60c64c8059cb5f73cc52e1d
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 27 18:01:52 2017 +0900

    scd: Improve watching USB device removal.
    
    * scd/apdu.c(struct reader_table_s): Add require_get_status.
    (apdu_connect): Change return value meaning.  Call apdu_reset here.
    * scd/app.c (app_new_register): Add require_get_status.
    (select_application): Use the return value of apdu_connect.
    (scd_update_reader_status_file): Call update_fdset_for_usb with
    checking all_have_intr_endp.
    (app_list_start, app_list_finish): Remove.
    * scd/ccid-driver.c (struct ccid_driver_s): Add transfer.
    (intr_cb): Don't call libusb_transfer in this callback.
    (ccid_require_get_status): New.
    (do_close_reader): Call libusb_transfer here.
    * scd/scdaemon.c (update_fdset_for_usb): Remove the first argument.
    
    --
    
    With Gnuk Token, it works fine as expected.  With Gemalto reader,
    intr_cb is not called when card is removed.  So, the macro
    LIBUSB_WORKS_EXPECTED_FOR_INTERRUPT_ENDP is not defined yet.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/apdu.c b/scd/apdu.c
index f88d970..0037c47 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -141,11 +141,12 @@ struct reader_table_s {
   } rapdu;
 #endif /*USE_G10CODE_RAPDU*/
   char *rdrname;     /* Name of the connected reader or NULL if unknown. */
-  int is_t0;         /* True if we know that we are running T=0. */
-  int is_spr532;     /* True if we know that the reader is a SPR532.  */
-  int pinpad_varlen_supported;  /* True if we know that the reader
-                                   supports variable length pinpad
-                                   input.  */
+  unsigned int is_t0:1;     /* True if we know that we are running T=0. */
+  unsigned int is_spr532:1; /* True if we know that the reader is a SPR532.  */
+  unsigned int pinpad_varlen_supported:1;  /* True if we know that the reader
+                                              supports variable length pinpad
+                                              input.  */
+  unsigned int require_get_status:1;
   unsigned char atr[33];
   size_t atrlen;           /* A zero length indicates that the ATR has
                               not yet been read; i.e. the card is not
@@ -470,6 +471,7 @@ new_reader_slot (void)
   reader_table[reader].is_t0 = 1;
   reader_table[reader].is_spr532 = 0;
   reader_table[reader].pinpad_varlen_supported = 0;
+  reader_table[reader].require_get_status = 1;
 #ifdef NEED_PCSC_WRAPPER
   reader_table[reader].pcsc.req_fd = -1;
   reader_table[reader].pcsc.rsp_fd = -1;
@@ -2572,6 +2574,7 @@ open_ccid_reader (struct dev_list *dl)
 {
   int err;
   int slot;
+  int require_get_status;
   reader_table_t slotp;
 
   slot = new_reader_slot ();
@@ -2596,6 +2599,8 @@ open_ccid_reader (struct dev_list *dl)
       err = 0;
     }
 
+  require_get_status = ccid_require_get_status (slotp->ccid.handle);
+
   reader_table[slot].close_reader = close_ccid_reader;
   reader_table[slot].reset_reader = reset_ccid_reader;
   reader_table[slot].get_status_reader = get_status_ccid;
@@ -2608,6 +2613,7 @@ open_ccid_reader (struct dev_list *dl)
   /* Our CCID reader code does not support T=0 at all, thus reset the
      flag.  */
   reader_table[slot].is_t0 = 0;
+  reader_table[slot].require_get_status = require_get_status;
 
   dump_reader_status (slot);
   unlock_slot (slot);
@@ -2970,22 +2976,15 @@ apdu_dev_list_start (const char *portstr, struct dev_list **l_p)
   return 0;
 }
 
-int
+void
 apdu_dev_list_finish (struct dev_list *dl)
 {
-  int all_have_intr_endp;
-
 #ifdef HAVE_LIBUSB
   if (dl->ccid_table)
-    all_have_intr_endp = ccid_dev_scan_finish (dl->ccid_table, dl->idx_max);
-  else
-    all_have_intr_endp = 0;
-#else
-  all_have_intr_endp = 0;
+    ccid_dev_scan_finish (dl->ccid_table, dl->idx_max);
 #endif
   xfree (dl);
   npth_mutex_unlock (&reader_table_lock);
-  return all_have_intr_endp;
 }
 
 
@@ -3347,8 +3346,11 @@ apdu_enum_reader (int slot, int *used)
 
 /* Connect a card.  This is used to power up the card and make sure
    that an ATR is available.  Depending on the reader backend it may
-   return an error for an inactive card or if no card is
-   available.  */
+   return an error for an inactive card or if no card is available.
+   Return -1 on error.  Return 1 if reader requires get_status to
+   watch card removal.  Return 0 if it's a token (always with a card),
+   or it supports INTERRUPT endpoint to watch card removal.
+  */
 int
 apdu_connect (int slot)
 {
@@ -3362,7 +3364,7 @@ apdu_connect (int slot)
     {
       if (DBG_READER)
         log_debug ("leave: apdu_connect => SW_HOST_NO_DRIVER\n");
-      return SW_HOST_NO_DRIVER;
+      return -1;
     }
 
   /* Only if the access method provides a connect function we use it.
@@ -3393,10 +3395,19 @@ apdu_connect (int slot)
   else if ((status & APDU_CARD_PRESENT) && !(status & APDU_CARD_ACTIVE))
     sw = SW_HOST_CARD_INACTIVE;
 
+  if (sw == SW_HOST_CARD_INACTIVE)
+    {
+      /* Try power it up again.  */
+      sw = apdu_reset (slot);
+    }
+
   if (DBG_READER)
     log_debug ("leave: apdu_connect => sw=0x%x\n", sw);
 
-  return sw;
+  if (sw)
+    return -1;
+
+  return reader_table[slot].require_get_status;
 }
 
 
diff --git a/scd/apdu.h b/scd/apdu.h
index d71c8dd..473def5 100644
--- a/scd/apdu.h
+++ b/scd/apdu.h
@@ -88,7 +88,7 @@ struct dev_list;
 gpg_error_t apdu_init (void);
 
 gpg_error_t apdu_dev_list_start (const char *portstr, struct dev_list **l_p);
-int apdu_dev_list_finish (struct dev_list *l);
+void apdu_dev_list_finish (struct dev_list *l);
 
 /* Note, that apdu_open_reader returns no status word but -1 on error. */
 int apdu_open_reader (struct dev_list *l);
diff --git a/scd/app-common.h b/scd/app-common.h
index b979f54..521fcf3 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -121,8 +121,6 @@ size_t app_help_read_length_of_cert (int slot, int fid, size_t *r_certoff);
 
 
 /*-- app.c --*/
-app_t app_list_start (void);
-void app_list_finish (void);
 void app_send_card_list (ctrl_t ctrl);
 char *app_get_serialno (app_t app);
 
diff --git a/scd/app.c b/scd/app.c
index daff0b7..3cf219c 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -174,7 +174,8 @@ app_reset (app_t app, ctrl_t ctrl, int send_reset)
 }
 
 static gpg_error_t
-app_new_register (int slot, ctrl_t ctrl, const char *name)
+app_new_register (int slot, ctrl_t ctrl, const char *name,
+                  int require_get_status)
 {
   gpg_error_t err = 0;
   app_t app = NULL;
@@ -303,7 +304,7 @@ app_new_register (int slot, ctrl_t ctrl, const char *name)
       return err;
     }
 
-  app->require_get_status = 1;   /* For token, this can be 0.  */
+  app->require_get_status = require_get_status;
 
   npth_mutex_lock (&app_list_lock);
   app->next = app_top;
@@ -330,7 +331,7 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app,
   if (scan || !app_top)
     {
       struct dev_list *l;
-      int all_have_intr_endp;
+      int all_have_intr_endp = 1;
 
       err = apdu_dev_list_start (opt.reader_port, &l);
       if (err)
@@ -339,39 +340,31 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app,
       while (1)
         {
           int slot;
-          int sw;
+          int require_get_status;
 
           slot = apdu_open_reader (l);
           if (slot < 0)
             break;
 
-          err = 0;
-          sw = apdu_connect (slot);
-
-          if (sw == SW_HOST_CARD_INACTIVE)
+          require_get_status = apdu_connect (slot);
+          if (require_get_status < 0)
             {
-              /* Try again.  */
-              sw = apdu_reset (slot);
+              /* We close a reader with no card.  */
+              err = gpg_error (GPG_ERR_ENODEV);
             }
-
-          if (!sw || sw == SW_HOST_ALREADY_CONNECTED)
-            err = 0;
-          else if (sw == SW_HOST_NO_CARD)
-            err = gpg_error (GPG_ERR_CARD_NOT_PRESENT);
-          else
-            err = gpg_error (GPG_ERR_ENODEV);
-
-          if (!err)
-            err = app_new_register (slot, ctrl, name);
           else
             {
-              /* We close a reader with no card.  */
-              apdu_close_reader (slot);
+              err = app_new_register (slot, ctrl, name, require_get_status);
+              if (require_get_status)
+                all_have_intr_endp = 0;
             }
+
+          if (err)
+            apdu_close_reader (slot);
         }
 
-      all_have_intr_endp = apdu_dev_list_finish (l);
-      update_fdset_for_usb (1, all_have_intr_endp);
+      apdu_dev_list_finish (l);
+      update_fdset_for_usb (all_have_intr_endp);
     }
 
   npth_mutex_lock (&app_list_lock);
@@ -1021,46 +1014,60 @@ void
 scd_update_reader_status_file (void)
 {
   app_t a, app_next;
+  int all_have_intr_endp = 1;
+  int removal_detected = 0;
 
   npth_mutex_lock (&app_list_lock);
   for (a = app_top; a; a = app_next)
     {
+      int sw;
+      unsigned int status;
+
+      sw = apdu_get_status (a->slot, 0, &status);
       app_next = a->next;
-      if (a->require_get_status)
+
+      if (sw == SW_HOST_NO_READER)
+        {
+          /* Most likely the _reader_ has been unplugged.  */
+          status = 0;
+        }
+      else if (sw)
+        {
+          /* Get status failed.  Ignore that.  */
+          if (a->require_get_status)
+            all_have_intr_endp = 0;
+          continue;
+        }
+
+      if (a->card_status != status)
         {
-          int sw;
-          unsigned int status;
-          sw = apdu_get_status (a->slot, 0, &status);
+          report_change (a->slot, a->card_status, status);
+          send_client_notifications (a, status == 0);
 
-          if (sw == SW_HOST_NO_READER)
-            {
-              /* Most likely the _reader_ has been unplugged.  */
-              status = 0;
-            }
-          else if (sw)
+          if (status == 0)
             {
-              /* Get status failed.  Ignore that.  */
-              continue;
+              log_debug ("Removal of a card: %d\n", a->slot);
+              apdu_close_reader (a->slot);
+              deallocate_app (a);
+              removal_detected = 1;
             }
-
-          if (a->card_status != status)
+          else
             {
-              report_change (a->slot, a->card_status, status);
-              send_client_notifications (a, status == 0);
-
-              if (status == 0)
-                {
-                  log_debug ("Removal of a card: %d\n", a->slot);
-                  apdu_close_reader (a->slot);
-                  deallocate_app (a);
-                  update_fdset_for_usb (0, 0);
-                }
-              else
-                a->card_status = status;
+              a->card_status = status;
+              if (a->require_get_status)
+                all_have_intr_endp = 0;
             }
         }
+      else
+        {
+          if (a->require_get_status)
+            all_have_intr_endp = 0;
+        }
     }
   npth_mutex_unlock (&app_list_lock);
+
+  if (removal_detected)
+    update_fdset_for_usb (all_have_intr_endp);
 }
 
 /* This function must be called once to initialize this module.  This
@@ -1082,19 +1089,6 @@ initialize_module_command (void)
   return apdu_init ();
 }
 
-app_t
-app_list_start (void)
-{
-  npth_mutex_lock (&app_list_lock);
-  return app_top;
-}
-
-void
-app_list_finish (void)
-{
-  npth_mutex_unlock (&app_list_lock);
-}
-
 void
 app_send_card_list (ctrl_t ctrl)
 {
diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index 8ca8e96..1bb0fb2 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -274,6 +274,7 @@ struct ccid_driver_s
   void *progress_cb_arg;
 
   unsigned char intr_buf[64];
+  struct libusb_transfer *transfer;
 };
 
 
@@ -1699,17 +1700,13 @@ ccid_dev_scan (int *idx_max_p, struct ccid_dev_table **t_p)
   return err;
 }
 
-int
+void
 ccid_dev_scan_finish (struct ccid_dev_table *tbl, int max)
 {
-  int all_have_intr_endp = 1;
   int i;
 
   for (i = 0; i < max; i++)
     {
-      if (tbl[i].ep_intr == -1)
-        all_have_intr_endp = 0;
-
       free (tbl[i].ifcdesc_extra);
       tbl[i].transport = 0;
       tbl[i].n = 0;
@@ -1723,8 +1720,6 @@ ccid_dev_scan_finish (struct ccid_dev_table *tbl, int max)
     }
   libusb_free_device_list (ccid_usb_dev_list, 1);
   ccid_usb_dev_list = NULL;
-
-  return all_have_intr_endp;
 }
 
 unsigned int
@@ -1767,14 +1762,14 @@ intr_cb (struct libusb_transfer *transfer)
 {
   ccid_driver_t handle = transfer->user_data;
 
-  DEBUGOUT ("CCID: interrupt callback\n");
+  DEBUGOUT_1 ("CCID: interrupt callback %d\n", transfer->status);
 
-  if (transfer->status == LIBUSB_TRANSFER_NO_DEVICE)
+  if (transfer->status == LIBUSB_TRANSFER_NO_DEVICE
+      || transfer->status == LIBUSB_TRANSFER_ERROR)
     {
     device_removed:
       DEBUGOUT ("CCID: device removed\n");
       handle->powered_off = 1;
-      libusb_free_transfer (transfer);
     }
   else if (transfer->status == LIBUSB_TRANSFER_COMPLETED)
     {
@@ -1784,7 +1779,6 @@ intr_cb (struct libusb_transfer *transfer)
         {
           DEBUGOUT ("CCID: card removed\n");
           handle->powered_off = 1;
-          libusb_free_transfer (transfer);
         }
       else
         {
@@ -1795,12 +1789,12 @@ intr_cb (struct libusb_transfer *transfer)
           if (err == LIBUSB_ERROR_NO_DEVICE)
             goto device_removed;
 
-          DEBUGOUT_1 ("CCID submit transfer again %d", err);
+          DEBUGOUT_1 ("CCID submit transfer again %d\n", err);
         }
     }
   else
     {
-      ;
+      DEBUGOUT_1 ("CCID intr_cb: %d\n", transfer->status);
     }
 }
 
@@ -1811,6 +1805,7 @@ ccid_setup_intr  (ccid_driver_t handle)
   int err;
 
   transfer = libusb_alloc_transfer (0);
+  handle->transfer = transfer;
   libusb_fill_interrupt_transfer (transfer, handle->idev, handle->ep_intr,
                                   handle->intr_buf, sizeof (handle->intr_buf),
                                   intr_cb, handle, 0);
@@ -1913,7 +1908,7 @@ ccid_open_usb_reader (const char *spec_reader_name,
         }
     }
 
-  if ((*handle)->ep_intr)
+  if ((*handle)->ep_intr >= 0)
     ccid_setup_intr (*handle);
 
   rc = ccid_vendor_specific_init (*handle);
@@ -2010,6 +2005,26 @@ ccid_open_reader (const char *spec_reader_name, int idx,
 }
 
 
+int
+ccid_require_get_status (ccid_driver_t handle)
+{
+#ifdef LIBUSB_WORKS_EXPECTED_FOR_INTERRUPT_ENDP
+  if (handle->ep_intr >= 0)
+    return 0;
+#endif
+
+  /* Here comes products check for tokens which
+     always have card inserted.  */
+  switch (handle->id_vendor)
+    {
+    case VENDOR_FSIJ:
+      return 0;
+    }
+
+  return 1;
+}
+
+
 static void
 do_close_reader (ccid_driver_t handle)
 {
@@ -2037,6 +2052,7 @@ do_close_reader (ccid_driver_t handle)
     }
   if (handle->idev)
     {
+      libusb_free_transfer (handle->transfer);
       libusb_release_interface (handle->idev, handle->ifc_no);
       libusb_close (handle->idev);
       handle->idev = NULL;
diff --git a/scd/ccid-driver.h b/scd/ccid-driver.h
index 8e9f9e2..cff3f19 100644
--- a/scd/ccid-driver.h
+++ b/scd/ccid-driver.h
@@ -115,7 +115,7 @@ int ccid_set_debug_level (int level);
 char *ccid_get_reader_list (void);
 
 gpg_error_t ccid_dev_scan (int *idx_max, struct ccid_dev_table **t_p);
-int ccid_dev_scan_finish (struct ccid_dev_table *tbl, int max);
+void ccid_dev_scan_finish (struct ccid_dev_table *tbl, int max);
 unsigned int ccid_get_BAI (int, struct ccid_dev_table *tbl);
 int ccid_compare_BAI (ccid_driver_t handle, unsigned int);
 int ccid_open_reader (const char *spec_reader_name,
@@ -140,7 +140,7 @@ int ccid_transceive_escape (ccid_driver_t handle,
                             const unsigned char *data, size_t datalen,
                             unsigned char *resp, size_t maxresplen,
                             size_t *nresp);
-
+int ccid_require_get_status (ccid_driver_t handle);
 
 
 #endif /*CCID_DRIVER_H*/
diff --git a/scd/scdaemon.c b/scd/scdaemon.c
index 14e0b05..4ab0fcf 100644
--- a/scd/scdaemon.c
+++ b/scd/scdaemon.c
@@ -1202,15 +1202,14 @@ start_connection_thread (void *arg)
 
 
 void
-update_fdset_for_usb (int scanned, int all_have_intr_endp)
+update_fdset_for_usb (int all_have_intr_endp)
 {
 #ifdef HAVE_LIBUSB
   const struct libusb_pollfd **pfd_array = libusb_get_pollfds (NULL);
   const struct libusb_pollfd **p;
 #endif
 
-  if (scanned)
-    usb_all_have_intr_endp = all_have_intr_endp;
+  usb_all_have_intr_endp = all_have_intr_endp;
 
   FD_ZERO (&fdset);
   nfd = 0;
@@ -1230,6 +1229,7 @@ update_fdset_for_usb (int scanned, int all_have_intr_endp)
       if (nfd < fd)
         nfd = fd;
       p++;
+      log_debug ("USB: add %d to fdset\n", fd);
     }
 
   libusb_free_pollfds (pfd_array);
@@ -1238,8 +1238,7 @@ update_fdset_for_usb (int scanned, int all_have_intr_endp)
   /* Kick the select loop.  */
   write (notify_fd, "", 1);
 
-  log_debug ("update_fdset_for_usb (%d, %d): %d %lx\n",
-             scanned, all_have_intr_endp, nfd, fdset.fds_bits[0]);
+  log_debug ("update_fdset_for_usb (%d): %d\n", all_have_intr_endp, nfd);
 }
 
 static int
@@ -1395,6 +1394,7 @@ handle_connections (void)
           char buf[256];
 
           read (pipe_fd[0], buf, sizeof buf);
+          ret--;
         }
 
       if (listen_fd != -1 && FD_ISSET (listen_fd, &read_fdset))
@@ -1439,6 +1439,8 @@ handle_connections (void)
       if (ret)
         {
           struct timeval tv = {0, 0};
+
+          log_debug ("scd main: USB handle events\n");
           libusb_handle_events_timeout_completed (NULL, &tv, NULL);
         }
 #endif
diff --git a/scd/scdaemon.h b/scd/scdaemon.h
index 9d92ff2..9e616f4 100644
--- a/scd/scdaemon.h
+++ b/scd/scdaemon.h
@@ -125,7 +125,7 @@ void send_status_info (ctrl_t ctrl, const char *keyword, ...)
 void send_status_direct (ctrl_t ctrl, const char *keyword, const char *args);
 void scd_update_reader_status_file (void);
 void send_client_notifications (app_t app, int removal);
-void update_fdset_for_usb (int scanned, int all_have_intr_endp);
+void update_fdset_for_usb (int all_have_intr_endp);
 
 
 #endif /*SCDAEMON_H*/

commit 031e3fa7b9a6770a4de1a184555250feeba0d26f
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 27 14:34:21 2017 +0900

    scd: Wake up the select when new USB scan.
    
    * scd/scdaemon.c (update_fdset_for_usb): Wake up the select(2).
    (handle_connections): Use a kind of "self-pipe" technique.
    
    --
    
    Use pipe to wake up select(2).  If UNIX-only, signal could be used.  For
    portability, "self-pipe" is better, here.  Setup for non-blocking for
    pipe fds are not needed, because speed of USB device insertion is
    limited by human physical interaction;  No one can do hundreds of
    device insertion/removal-s per second.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/scdaemon.c b/scd/scdaemon.c
index 8e1f698..14e0b05 100644
--- a/scd/scdaemon.c
+++ b/scd/scdaemon.c
@@ -56,6 +56,7 @@
 #include "ccid-driver.h"
 #include "gc-opt-flags.h"
 #include "asshelp.h"
+#include "exechelp.h"
 #include "../common/init.h"
 
 #ifndef ENAMETOOLONG
@@ -239,6 +240,9 @@ static int usb_all_have_intr_endp;
 
 /* FD to listen incomming connections.  */
 static int listen_fd;
+
+/* FD to notify update of usb devices.  */
+static int notify_fd;
 

 static char *create_socket_name (char *standard_name);
 static gnupg_fd_t create_server_socket (const char *name,
@@ -766,7 +770,7 @@ main (int argc, char **argv )
 
       res = npth_attr_init (&tattr);
       if (res)
-	{
+        {
           log_error ("error allocating thread attributes: %s\n",
                      strerror (res));
           scd_exit (2);
@@ -1231,8 +1235,11 @@ update_fdset_for_usb (int scanned, int all_have_intr_endp)
   libusb_free_pollfds (pfd_array);
 #endif
 
-  log_debug ("update_fdset_for_usb (%d, %d): %d\n",
-             scanned, all_have_intr_endp, nfd);
+  /* Kick the select loop.  */
+  write (notify_fd, "", 1);
+
+  log_debug ("update_fdset_for_usb (%d, %d): %d %lx\n",
+             scanned, all_have_intr_endp, nfd, fdset.fds_bits[0]);
 }
 
 static int
@@ -1271,9 +1278,23 @@ handle_connections (void)
 #ifndef HAVE_W32_SYSTEM
   int signo;
 #endif
+  int pipe_fd[2];
+
+  ret = gnupg_create_pipe (pipe_fd);
+  if (ret)
+    {
+      log_error ("pipe creation failed: %s\n", gpg_strerror (ret));
+      return;
+    }
+  notify_fd = pipe_fd[1];
 
   ret = npth_attr_init(&tattr);
-  /* FIXME: Check error.  */
+  if (ret)
+    {
+      log_error ("npth_attr_init failed: %s\n", strerror (ret));
+      return;
+    }
+
   npth_attr_setdetachstate (&tattr, NPTH_CREATE_DETACHED);
 
 #ifndef HAVE_W32_SYSTEM
@@ -1302,6 +1323,8 @@ handle_connections (void)
 
   for (;;)
     {
+      int max_fd;
+
       if (shutdown_pending)
         {
           if (active_connections == 0)
@@ -1337,14 +1360,21 @@ handle_connections (void)
          thus a simple assignment is fine to copy the entire set.  */
       read_fdset = fdset;
 
+      FD_SET (pipe_fd[0], &read_fdset);
+      if (nfd < pipe_fd[0])
+        max_fd = pipe_fd[0];
+      else
+        max_fd = nfd;
+
 #ifndef HAVE_W32_SYSTEM
-      ret = npth_pselect (nfd+1, &read_fdset, NULL, NULL, t, npth_sigev_sigmask());
+      ret = npth_pselect (max_fd+1, &read_fdset, NULL, NULL, t,
+                          npth_sigev_sigmask ());
       saved_errno = errno;
 
       while (npth_sigev_get_pending(&signo))
         handle_signal (signo);
 #else
-      ret = npth_eselect (nfd+1, &read_fdset, NULL, NULL, t, NULL, NULL);
+      ret = npth_eselect (max_fd+1, &read_fdset, NULL, NULL, t, NULL, NULL);
       saved_errno = errno;
 #endif
 
@@ -1360,6 +1390,13 @@ handle_connections (void)
         /* Timeout.  Will be handled when calculating the next timeout.  */
         continue;
 
+      if (FD_ISSET (pipe_fd[0], &read_fdset))
+        {
+          char buf[256];
+
+          read (pipe_fd[0], buf, sizeof buf);
+        }
+
       if (listen_fd != -1 && FD_ISSET (listen_fd, &read_fdset))
         {
           ctrl_t ctrl;
@@ -1407,6 +1444,8 @@ handle_connections (void)
 #endif
     }
 
+  close (pipe_fd[0]);
+  close (pipe_fd[1]);
   cleanup ();
   log_info (_("%s %s stopped\n"), strusage(11), strusage(13));
   npth_attr_destroy (&tattr);

-----------------------------------------------------------------------

Summary of changes:
 scd/apdu.c        |  47 +++++++++++++--------
 scd/apdu.h        |   2 +-
 scd/app-common.h  |   2 -
 scd/app.c         | 120 ++++++++++++++++++++++++++----------------------------
 scd/ccid-driver.c |  44 +++++++++++++-------
 scd/ccid-driver.h |   4 +-
 scd/scdaemon.c    |  59 +++++++++++++++++++++++----
 scd/scdaemon.h    |   2 +-
 8 files changed, 170 insertions(+), 110 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 27 16:36:41 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 27 Jan 2017 16:36:41 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-27-gf3d9b25
Message-ID: <E1cX8Zw-0006aV-FZ@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  f3d9b2582bcaa1936b4fed5ec42a889b02df2f42 (commit)
       via  f92fe33f11c44f14fd31682259fcd231e8fa9e75 (commit)
      from  25cc8575da9a9b8bf60c64c8059cb5f73cc52e1d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f3d9b2582bcaa1936b4fed5ec42a889b02df2f42
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Sat Jan 28 00:18:11 2017 +0900

    scd: More changes on watching removal of card/reader.
    
    * scd/app-common.h (struct app_ctx_s): Rename field to
    periodical_check_needed.
    * scd/scdaemon.c (update_usb): Rename from update_fdset_for_usb.
    Don't use libusb_get_pollfds any more.
    (scd_kick_the_loop): New.
    (need_tick): Follow the rename.
    (handle_connections): No libusb event handling here.
    * scd/app.c (app_new_register): Follow the change of rename.
    (select_application, scd_update_reader_status_file): Likewise.
    * scd/ccid-driver.c (ccid_usb_thread_is_alive): New.
    (intr_cb): Call scd_kick_the_loop.
    (ccid_usb_thread): New.  Thread to invoke INTERRUPT callback.
    (ccid_open_usb_reader): Add thread invocation.
    (ccid_require_get_status): Remove
    LIBUSB_WORKS_EXPECTED_FOR_INTERRUPT_ENDP.
    (do_close_reader): Carefully handle handle->transfer.
    (get_escaped_usb_string): Insert npth_unprotect/npth_protect.
    (do_close_reader, bulk_out, bulk_in, abort_cmd, ccid_slot_status)
    (ccid_transceive, ccid_transceive_secure): Likewise.
    
    --
    
    It found that libusb_get_pollfds is not supported on Windows.
    Besides, it's a bit difficult to use for the select loop.
    Thus, we use the thread named ccid_usb_thread, instead.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app-common.h b/scd/app-common.h
index 521fcf3..c79e36b 100644
--- a/scd/app-common.h
+++ b/scd/app-common.h
@@ -54,7 +54,7 @@ struct app_ctx_s {
   const char *apptype;
   unsigned int card_version;
   unsigned int card_status;
-  unsigned int require_get_status:1;
+  unsigned int periodical_check_needed:1;
   unsigned int did_chv1:1;
   unsigned int force_chv1:1;   /* True if the card does not cache CHV1. */
   unsigned int did_chv2:1;
diff --git a/scd/app.c b/scd/app.c
index 3cf219c..2cf7d11 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -175,7 +175,7 @@ app_reset (app_t app, ctrl_t ctrl, int send_reset)
 
 static gpg_error_t
 app_new_register (int slot, ctrl_t ctrl, const char *name,
-                  int require_get_status)
+                  int periodical_check_needed)
 {
   gpg_error_t err = 0;
   app_t app = NULL;
@@ -304,7 +304,7 @@ app_new_register (int slot, ctrl_t ctrl, const char *name,
       return err;
     }
 
-  app->require_get_status = require_get_status;
+  app->periodical_check_needed = periodical_check_needed;
 
   npth_mutex_lock (&app_list_lock);
   app->next = app_top;
@@ -331,7 +331,7 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app,
   if (scan || !app_top)
     {
       struct dev_list *l;
-      int all_have_intr_endp = 1;
+      int periodical_check_needed = 0;
 
       err = apdu_dev_list_start (opt.reader_port, &l);
       if (err)
@@ -340,23 +340,24 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app,
       while (1)
         {
           int slot;
-          int require_get_status;
+          int periodical_check_needed;
 
           slot = apdu_open_reader (l);
           if (slot < 0)
             break;
 
-          require_get_status = apdu_connect (slot);
-          if (require_get_status < 0)
+          periodical_check_needed = apdu_connect (slot);
+          if (periodical_check_needed < 0)
             {
               /* We close a reader with no card.  */
               err = gpg_error (GPG_ERR_ENODEV);
             }
           else
             {
-              err = app_new_register (slot, ctrl, name, require_get_status);
-              if (require_get_status)
-                all_have_intr_endp = 0;
+              err = app_new_register (slot, ctrl, name,
+                                      periodical_check_needed);
+              if (periodical_check_needed)
+                periodical_check_needed = 1;
             }
 
           if (err)
@@ -364,7 +365,7 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app,
         }
 
       apdu_dev_list_finish (l);
-      update_fdset_for_usb (all_have_intr_endp);
+      update_usb (periodical_check_needed);
     }
 
   npth_mutex_lock (&app_list_lock);
@@ -1014,7 +1015,7 @@ void
 scd_update_reader_status_file (void)
 {
   app_t a, app_next;
-  int all_have_intr_endp = 1;
+  int periodical_check_needed = 0;
   int removal_detected = 0;
 
   npth_mutex_lock (&app_list_lock);
@@ -1034,8 +1035,8 @@ scd_update_reader_status_file (void)
       else if (sw)
         {
           /* Get status failed.  Ignore that.  */
-          if (a->require_get_status)
-            all_have_intr_endp = 0;
+          if (a->periodical_check_needed)
+            periodical_check_needed = 1;
           continue;
         }
 
@@ -1054,20 +1055,20 @@ scd_update_reader_status_file (void)
           else
             {
               a->card_status = status;
-              if (a->require_get_status)
-                all_have_intr_endp = 0;
+              if (a->periodical_check_needed)
+                periodical_check_needed = 1;
             }
         }
       else
         {
-          if (a->require_get_status)
-            all_have_intr_endp = 0;
+          if (a->periodical_check_needed)
+            periodical_check_needed = 1;
         }
     }
   npth_mutex_unlock (&app_list_lock);
 
   if (removal_detected)
-    update_fdset_for_usb (all_have_intr_endp);
+    update_usb (periodical_check_needed);
 }
 
 /* This function must be called once to initialize this module.  This
diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index cb4b4e6..bbdd697 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -285,6 +285,7 @@ static int debug_level;     /* Flag to control the debug output.
                                2 = Level 1 + T=1 protocol tracing
                                3 = Level 2 + USB/I/O tracing of SlotStatus.
                               */
+static int ccid_usb_thread_is_alive;
 
 
 static unsigned int compute_edc (const unsigned char *data, size_t datalen,
@@ -1007,19 +1008,31 @@ get_escaped_usb_string (libusb_device_handle *idev, int idx,
   /* First get the list of supported languages and use the first one.
      If we do don't find it we try to use English.  Note that this is
      all in a 2 bute Unicode encoding using little endian. */
+#ifdef USE_NPTH
+  npth_unprotect ();
+#endif
   rc = libusb_control_transfer (idev, LIBUSB_ENDPOINT_IN,
                                 LIBUSB_REQUEST_GET_DESCRIPTOR,
                                 (LIBUSB_DT_STRING << 8), 0,
                                 (char*)buf, sizeof buf, 1000 /* ms timeout */);
+#ifdef USE_NPTH
+  npth_protect ();
+#endif
   if (rc < 4)
     langid = 0x0409; /* English.  */
   else
     langid = (buf[3] << 8) | buf[2];
 
+#ifdef USE_NPTH
+  npth_unprotect ();
+#endif
   rc = libusb_control_transfer (idev, LIBUSB_ENDPOINT_IN,
                                 LIBUSB_REQUEST_GET_DESCRIPTOR,
                                 (LIBUSB_DT_STRING << 8) + idx, langid,
                                 (char*)buf, sizeof buf, 1000 /* ms timeout */);
+#ifdef USE_NPTH
+  npth_protect ();
+#endif
   if (rc < 2 || buf[1] != LIBUSB_DT_STRING)
     return NULL; /* Error or not a string. */
   len = buf[0];
@@ -1799,6 +1812,8 @@ intr_cb (struct libusb_transfer *transfer)
       DEBUGOUT ("CCID: device removed\n");
       handle->powered_off = 1;
     }
+
+  scd_kick_the_loop ();
 }
 
 static void
@@ -1817,6 +1832,26 @@ ccid_setup_intr  (ccid_driver_t handle)
 }
 
 
+static void *
+ccid_usb_thread (void *arg)
+{
+  libusb_context *ctx = arg;
+
+  while (ccid_usb_thread_is_alive)
+    {
+#ifdef USE_NPTH
+      npth_unprotect ();
+#endif
+      libusb_handle_events_completed (ctx, NULL);
+#ifdef USE_NPTH
+      npth_protect ();
+#endif
+    }
+
+  return NULL;
+}
+
+
 static int
 ccid_open_usb_reader (const char *spec_reader_name,
                       int idx, struct ccid_dev_table *ccid_table,
@@ -1824,7 +1859,7 @@ ccid_open_usb_reader (const char *spec_reader_name,
 {
   libusb_device *dev;
   libusb_device_handle *idev = NULL;
-  char *rid;
+  char *rid = NULL;
   int rc = 0;
   int ifc_no, set_no;
   struct libusb_device_descriptor desc;
@@ -1850,13 +1885,39 @@ ccid_open_usb_reader (const char *spec_reader_name,
       return rc;
     }
 
+  if (ccid_usb_thread_is_alive++ == 0)
+    {
+      npth_t thread;
+      npth_attr_t tattr;
+      int err;
+
+      err = npth_attr_init (&tattr);
+      if (err)
+        {
+          DEBUGOUT_1 ("npth_attr_init failed: %s\n", strerror (err));
+          free (*handle);
+          *handle = NULL;
+          return err;
+        }
+
+      npth_attr_setdetachstate (&tattr, NPTH_CREATE_DETACHED);
+      err = npth_create (&thread, &tattr, ccid_usb_thread, NULL);
+      if (err)
+        {
+          DEBUGOUT_1 ("npth_create failed: %s\n", strerror (err));
+          free (*handle);
+          *handle = NULL;
+          return err;
+        }
+
+      npth_attr_destroy (&tattr);
+    }
+
   rc = libusb_get_device_descriptor (dev, &desc);
   if (rc)
     {
-      libusb_close (idev);
-      free (*handle);
-      *handle = NULL;
-      return rc;
+      DEBUGOUT ("get_device_descripor failed\n");
+      goto leave;
     }
 
   rid = make_reader_id (idev, desc.idVendor, desc.idProduct,
@@ -1919,6 +1980,7 @@ ccid_open_usb_reader (const char *spec_reader_name,
  leave:
   if (rc)
     {
+      --ccid_usb_thread_is_alive;
       free (rid);
       libusb_close (idev);
       free (*handle);
@@ -2011,10 +2073,8 @@ ccid_open_reader (const char *spec_reader_name, int idx,
 int
 ccid_require_get_status (ccid_driver_t handle)
 {
-#ifdef LIBUSB_WORKS_EXPECTED_FOR_INTERRUPT_ENDP
   if (handle->ep_intr >= 0)
     return 0;
-#endif
 
   /* Here comes products check for tokens which
      always have card inserted.  */
@@ -2056,15 +2116,38 @@ do_close_reader (ccid_driver_t handle)
     {
       if (handle->transfer)
         {
+          /* By locking libusb events, make sure handle->transfer is
+             canceled properly;  Don't cancel completed transfer.  */
+#ifdef USE_NPTH
+          npth_unprotect ();
+#endif
+          libusb_lock_events (NULL);
+#ifdef USE_NPTH
+          npth_protect ();
+#endif
           if (!handle->powered_off)
             {
               libusb_cancel_transfer (handle->transfer);
+              libusb_unlock_events (NULL);
+
               while (!handle->powered_off)
-                libusb_handle_events_completed (NULL, &handle->powered_off);
+                {
+#ifdef USE_NPTH
+                  npth_unprotect ();
+#endif
+                  libusb_handle_events_completed (NULL, &handle->powered_off);
+#ifdef USE_NPTH
+                  npth_protect ();
+#endif
+                }
             }
+          else
+            libusb_unlock_events (NULL);
+
           libusb_free_transfer (handle->transfer);
         }
       libusb_release_interface (handle->idev, handle->ifc_no);
+      --ccid_usb_thread_is_alive;
       libusb_close (handle->idev);
       handle->idev = NULL;
     }
@@ -2206,9 +2289,15 @@ bulk_out (ccid_driver_t handle, unsigned char *msg, size_t msglen,
     {
       int transferred;
 
+#ifdef USE_NPTH
+      npth_unprotect ();
+#endif
       rc = libusb_bulk_transfer (handle->idev, handle->ep_bulk_out,
                                  (char*)msg, msglen, &transferred,
                                  5000 /* ms timeout */);
+#ifdef USE_NPTH
+      npth_protect ();
+#endif
       if (rc == 0 && transferred == msglen)
         return 0;
 
@@ -2257,8 +2346,14 @@ bulk_in (ccid_driver_t handle, unsigned char *buffer, size_t length,
  retry:
   if (handle->idev)
     {
+#ifdef USE_NPTH
+      npth_unprotect ();
+#endif
       rc = libusb_bulk_transfer (handle->idev, handle->ep_bulk_in,
                                  (char*)buffer, length, &msglen, timeout);
+#ifdef USE_NPTH
+      npth_protect ();
+#endif
       if (rc)
         {
           DEBUGOUT_1 ("usb_bulk_read error: %s\n", libusb_error_name (rc));
@@ -2393,6 +2488,9 @@ abort_cmd (ccid_driver_t handle, int seqno)
   /* Send the abort command to the control pipe.  Note that we don't
      need to keep track of sent abort commands because there should
      never be another thread using the same slot concurrently.  */
+#ifdef USE_NPTH
+  npth_unprotect ();
+#endif
   rc = libusb_control_transfer (handle->idev,
                                 0x21,/* bmRequestType: host-to-device,
                                         class specific, to interface.  */
@@ -2401,6 +2499,9 @@ abort_cmd (ccid_driver_t handle, int seqno)
                                 handle->ifc_no,
                                 dummybuf, 0,
                                 1000 /* ms timeout */);
+#ifdef USE_NPTH
+  npth_protect ();
+#endif
   if (rc)
     {
       DEBUGOUT_1 ("usb_control_msg error: %s\n", libusb_error_name (rc));
@@ -2425,9 +2526,15 @@ abort_cmd (ccid_driver_t handle, int seqno)
       msglen = 10;
       set_msg_len (msg, 0);
 
+#ifdef USE_NPTH
+      npth_unprotect ();
+#endif
       rc = libusb_bulk_transfer (handle->idev, handle->ep_bulk_out,
                                  (char*)msg, msglen, &transferred,
                                  5000 /* ms timeout */);
+#ifdef USE_NPTH
+      npth_protect ();
+#endif
       if (rc == 0 && transferred == msglen)
         rc = 0;
       else if (rc)
@@ -2437,9 +2544,15 @@ abort_cmd (ccid_driver_t handle, int seqno)
       if (rc)
         return rc;
 
+#ifdef USE_NPTH
+      npth_unprotect ();
+#endif
       rc = libusb_bulk_transfer (handle->idev, handle->ep_bulk_in,
                                  (char*)msg, sizeof msg, &msglen,
                                  5000 /*ms timeout*/);
+#ifdef USE_NPTH
+      npth_protect ();
+#endif
       if (rc)
         {
           DEBUGOUT_1 ("usb_bulk_read error in abort_cmd: %s\n",
@@ -2637,8 +2750,14 @@ ccid_slot_status (ccid_driver_t handle, int *statusbits)
       if (!retries)
         {
           DEBUGOUT ("USB: CALLING USB_CLEAR_HALT\n");
+#ifdef USE_NPTH
+          npth_unprotect ();
+#endif
           libusb_clear_halt (handle->idev, handle->ep_bulk_in);
           libusb_clear_halt (handle->idev, handle->ep_bulk_out);
+#ifdef USE_NPTH
+          npth_protect ();
+#endif
         }
       else
           DEBUGOUT ("USB: RETRYING bulk_in AGAIN\n");
@@ -3383,7 +3502,13 @@ ccid_transceive (ccid_driver_t handle,
 
       if (tpdulen < 4)
         {
+#ifdef USE_NPTH
+          npth_unprotect ();
+#endif
           libusb_clear_halt (handle->idev, handle->ep_bulk_in);
+#ifdef USE_NPTH
+          npth_protect ();
+#endif
           return CCID_DRIVER_ERR_ABORTED;
         }
 
@@ -3817,7 +3942,13 @@ ccid_transceive_secure (ccid_driver_t handle,
 
   if (tpdulen < 4)
     {
+#ifdef USE_NPTH
+      npth_unprotect ();
+#endif
       libusb_clear_halt (handle->idev, handle->ep_bulk_in);
+#ifdef USE_NPTH
+      npth_protect ();
+#endif
       return CCID_DRIVER_ERR_ABORTED;
     }
   if (debug_level > 1)
diff --git a/scd/scdaemon.c b/scd/scdaemon.c
index 4ab0fcf..e2a6ba8 100644
--- a/scd/scdaemon.c
+++ b/scd/scdaemon.c
@@ -44,10 +44,6 @@
 
 #include <assuan.h> /* malloc hooks */
 
-#ifdef HAVE_LIBUSB
-#include <libusb.h>
-#endif
-
 #include "i18n.h"
 #include "sysutils.h"
 #include "app-common.h"
@@ -229,17 +225,8 @@ static assuan_sock_nonce_t socket_nonce;
    disabled but it won't perform any ticker specific actions. */
 static int ticker_disabled;
 
-/* Set of FD to select.  */
-static fd_set fdset;
-
-/* Max FD to select.  */
-static int nfd;
-
-/* Set if all usb devices have INTERRUPT endpoints.  */
-static int usb_all_have_intr_endp;
-
-/* FD to listen incomming connections.  */
-static int listen_fd;
+/* Set if usb devices require periodical check.  */
+static int usb_periodical_check;
 
 /* FD to notify update of usb devices.  */
 static int notify_fd;
@@ -250,7 +237,7 @@ static gnupg_fd_t create_server_socket (const char *name,
                                         assuan_sock_nonce_t *nonce);
 
 static void *start_connection_thread (void *arg);
-static void handle_connections (void);
+static void handle_connections (int listen_fd);
 
 /* Pth wrapper function definitions. */
 ASSUAN_SYSTEM_NPTH_IMPL;
@@ -798,8 +785,7 @@ main (int argc, char **argv )
 
       /* We run handle_connection to wait for the shutdown signal and
          to run the ticker stuff.  */
-      listen_fd = fd;
-      handle_connections ();
+      handle_connections (fd);
       if (fd != -1)
         close (fd);
     }
@@ -931,8 +917,7 @@ main (int argc, char **argv )
 
 #endif /*!HAVE_W32_SYSTEM*/
 
-      listen_fd = fd;
-      handle_connections ();
+      handle_connections (fd);
 
       close (fd);
     }
@@ -1029,7 +1014,7 @@ handle_signal (int signo)
           log_info ("%s %s stopped\n", strusage(11), strusage(13) );
           cleanup ();
           scd_exit (0);
-	}
+        }
       break;
 
     case SIGINT:
@@ -1136,7 +1121,7 @@ create_server_socket (const char *name, char **r_redir_name,
  if (rc == -1)
     {
       log_error (_("error binding socket to '%s': %s\n"),
-		 unaddr->sun_path,
+                 unaddr->sun_path,
                  gpg_strerror (gpg_error_from_syserror ()));
       assuan_sock_close (fd);
       scd_exit (2);
@@ -1202,43 +1187,17 @@ start_connection_thread (void *arg)
 
 
 void
-update_fdset_for_usb (int all_have_intr_endp)
+update_usb (int periodical_check_needed)
 {
-#ifdef HAVE_LIBUSB
-  const struct libusb_pollfd **pfd_array = libusb_get_pollfds (NULL);
-  const struct libusb_pollfd **p;
-#endif
-
-  usb_all_have_intr_endp = all_have_intr_endp;
-
-  FD_ZERO (&fdset);
-  nfd = 0;
-
-  if (listen_fd != -1)
-    {
-      FD_SET (listen_fd, &fdset);
-      nfd = listen_fd;
-    }
-
-#ifdef HAVE_LIBUSB
-  for (p = pfd_array; *p; p++)
-    {
-      int fd = (*p)->fd;
-
-      FD_SET (fd, &fdset);
-      if (nfd < fd)
-        nfd = fd;
-      p++;
-      log_debug ("USB: add %d to fdset\n", fd);
-    }
-
-  libusb_free_pollfds (pfd_array);
-#endif
+  usb_periodical_check = periodical_check_needed;
+  log_debug ("update_usb (%d)\n", periodical_check_needed);
+}
 
+void
+scd_kick_the_loop (void)
+{
   /* Kick the select loop.  */
   write (notify_fd, "", 1);
-
-  log_debug ("update_fdset_for_usb (%d): %d\n", all_have_intr_endp, nfd);
 }
 
 static int
@@ -1247,10 +1206,7 @@ need_tick (void)
   if (shutdown_pending)
     return 1;
 
-  if (listen_fd != -1 && nfd == listen_fd)
-    return 1;
-
-  if (usb_all_have_intr_endp)
+  if (!usb_periodical_check)
     return 0;
 
   return 1;
@@ -1261,12 +1217,13 @@ need_tick (void)
    in which case this code will only do regular timeouts and handle
    signals. */
 static void
-handle_connections (void)
+handle_connections (int listen_fd)
 {
   npth_attr_t tattr;
   struct sockaddr_un paddr;
   socklen_t plen;
-  fd_set read_fdset;
+  fd_set fdset, read_fdset;
+  int nfd;
   int ret;
   int fd;
   struct timespec abstime;
@@ -1314,6 +1271,10 @@ handle_connections (void)
       nfd = listen_fd;
     }
 
+  FD_SET (pipe_fd[0], &fdset);
+  if (nfd < pipe_fd[0])
+    nfd = pipe_fd[0];
+
   npth_clock_gettime (&curtime);
   timeout.tv_sec = TIMERTICK_INTERVAL_SEC;
   timeout.tv_nsec = TIMERTICK_INTERVAL_USEC * 1000;
@@ -1322,8 +1283,6 @@ handle_connections (void)
 
   for (;;)
     {
-      int max_fd;
-
       if (shutdown_pending)
         {
           if (active_connections == 0)
@@ -1334,10 +1293,13 @@ handle_connections (void)
              file descriptors to wait for, so that the select will be
              used to just wait on a signal or timeout event. */
           FD_ZERO (&fdset);
+          FD_SET (pipe_fd[0], &fdset);
+          nfd = pipe_fd[0];
           listen_fd = -1;
         }
 
-      if (need_tick ())
+      if ((listen_fd != -1 && nfd == listen_fd)
+          || need_tick ())
         {
           npth_clock_gettime (&curtime);
           if (!(npth_timercmp (&curtime, &abstime, <)))
@@ -1359,21 +1321,15 @@ handle_connections (void)
          thus a simple assignment is fine to copy the entire set.  */
       read_fdset = fdset;
 
-      FD_SET (pipe_fd[0], &read_fdset);
-      if (nfd < pipe_fd[0])
-        max_fd = pipe_fd[0];
-      else
-        max_fd = nfd;
-
 #ifndef HAVE_W32_SYSTEM
-      ret = npth_pselect (max_fd+1, &read_fdset, NULL, NULL, t,
+      ret = npth_pselect (nfd+1, &read_fdset, NULL, NULL, t,
                           npth_sigev_sigmask ());
       saved_errno = errno;
 
       while (npth_sigev_get_pending(&signo))
         handle_signal (signo);
 #else
-      ret = npth_eselect (max_fd+1, &read_fdset, NULL, NULL, t, NULL, NULL);
+      ret = npth_eselect (nfd+1, &read_fdset, NULL, NULL, t, NULL, NULL);
       saved_errno = errno;
 #endif
 
@@ -1431,19 +1387,7 @@ handle_connections (void)
               else
                 npth_setname_np (thread, threadname);
             }
-
-          ret--;
         }
-
-#ifdef HAVE_LIBUSB
-      if (ret)
-        {
-          struct timeval tv = {0, 0};
-
-          log_debug ("scd main: USB handle events\n");
-          libusb_handle_events_timeout_completed (NULL, &tv, NULL);
-        }
-#endif
     }
 
   close (pipe_fd[0]);
diff --git a/scd/scdaemon.h b/scd/scdaemon.h
index 9e616f4..6d950b5 100644
--- a/scd/scdaemon.h
+++ b/scd/scdaemon.h
@@ -125,7 +125,7 @@ void send_status_info (ctrl_t ctrl, const char *keyword, ...)
 void send_status_direct (ctrl_t ctrl, const char *keyword, const char *args);
 void scd_update_reader_status_file (void);
 void send_client_notifications (app_t app, int removal);
-void update_fdset_for_usb (int all_have_intr_endp);
-
+void update_usb (int periodical_check_needed);
+void scd_kick_the_loop (void);
 
 #endif /*SCDAEMON_H*/

commit f92fe33f11c44f14fd31682259fcd231e8fa9e75
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jan 27 20:43:29 2017 +0900

    scd: Fix release of transfer object.
    
    * scd/ccid-driver.c (intr_cb): Handle LIBUSB_TRANSFER_CANCELLED.
    (do_close_reader): When callback is active, call
    libusb_cancel_transfer and wait callback is fired off.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index 1bb0fb2..cb4b4e6 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -262,9 +262,9 @@ struct ccid_driver_s
   unsigned int auto_param:1;
   unsigned int auto_pps:1;
   unsigned int auto_ifsd:1;
-  unsigned int powered_off:1;
   unsigned int has_pinpad:2;
   unsigned int enodev_seen:1;
+  int powered_off;
 
   time_t last_progress; /* Last time we sent progress line.  */
 
@@ -1764,12 +1764,17 @@ intr_cb (struct libusb_transfer *transfer)
 
   DEBUGOUT_1 ("CCID: interrupt callback %d\n", transfer->status);
 
-  if (transfer->status == LIBUSB_TRANSFER_NO_DEVICE
-      || transfer->status == LIBUSB_TRANSFER_ERROR)
+  if (transfer->status == LIBUSB_TRANSFER_TIMED_OUT)
     {
-    device_removed:
-      DEBUGOUT ("CCID: device removed\n");
-      handle->powered_off = 1;
+      int err;
+
+    submit_again:
+      /* Submit the URB again to keep watching the INTERRUPT transfer.  */
+      err = libusb_submit_transfer (transfer);
+      if (err == LIBUSB_ERROR_NO_DEVICE)
+        goto device_removed;
+
+      DEBUGOUT_1 ("CCID submit transfer again %d\n", err);
     }
   else if (transfer->status == LIBUSB_TRANSFER_COMPLETED)
     {
@@ -1782,19 +1787,17 @@ intr_cb (struct libusb_transfer *transfer)
         }
       else
         {
-          int err;
-
-          /* Submit the URB again to keep watching the INTERRUPT transfer.  */
-          err = libusb_submit_transfer (transfer);
-          if (err == LIBUSB_ERROR_NO_DEVICE)
-            goto device_removed;
-
-          DEBUGOUT_1 ("CCID submit transfer again %d\n", err);
+          /* Event other than card removal.  */
+          goto submit_again;
         }
     }
+  else if (transfer->status == LIBUSB_TRANSFER_CANCELLED)
+    handle->powered_off = 1;
   else
     {
-      DEBUGOUT_1 ("CCID intr_cb: %d\n", transfer->status);
+    device_removed:
+      DEBUGOUT ("CCID: device removed\n");
+      handle->powered_off = 1;
     }
 }
 
@@ -2048,11 +2051,19 @@ do_close_reader (ccid_driver_t handle)
       if (!rc)
         bulk_in (handle, msg, sizeof msg, &msglen, RDR_to_PC_SlotStatus,
                  seqno, 2000, 0);
-      handle->powered_off = 1;
     }
   if (handle->idev)
     {
-      libusb_free_transfer (handle->transfer);
+      if (handle->transfer)
+        {
+          if (!handle->powered_off)
+            {
+              libusb_cancel_transfer (handle->transfer);
+              while (!handle->powered_off)
+                libusb_handle_events_completed (NULL, &handle->powered_off);
+            }
+          libusb_free_transfer (handle->transfer);
+        }
       libusb_release_interface (handle->idev, handle->ifc_no);
       libusb_close (handle->idev);
       handle->idev = NULL;

-----------------------------------------------------------------------

Summary of changes:
 scd/app-common.h  |   2 +-
 scd/app.c         |  37 +++++------
 scd/ccid-driver.c | 190 +++++++++++++++++++++++++++++++++++++++++++++++-------
 scd/scdaemon.c    | 112 ++++++++------------------------
 scd/scdaemon.h    |   4 +-
 5 files changed, 216 insertions(+), 129 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jan 27 17:09:05 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 27 Jan 2017 17:09:05 +0100
Subject: [git] NTBTLS - branch, master,
 updated. b5cbe683800f431737fa47d96edd9e5bdbeb374b
Message-ID: <E1cX95H-0007mX-W0@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Not Too Bad TLS".

The branch, master has been updated
       via  b5cbe683800f431737fa47d96edd9e5bdbeb374b (commit)
      from  af472e2554bf8b8ed0c3387a7625a65792e85ffb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b5cbe683800f431737fa47d96edd9e5bdbeb374b
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jan 27 17:06:29 2017 +0100

    In debug mode write some infos about the certificates.
    
    * src/debug.c (_ntbtls_debug_msg): Add hack to not print the final LF.
    (_ntbtls_debug_crt): New.
    * src/util.h (debug_crt): New macro.
    * src/x509.c (x509_log_serial, x509_log_time): New.
    (_ntbtls_x509_log_cert): New.
    * src/protocol-cli.c (read_server_hello): Tweak debug levels.
    * src/protocol.c (_ntbtls_read_certificate): Call debug_crt.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/debug.c b/src/debug.c
index e5fc2b0..7772eda 100644
--- a/src/debug.c
+++ b/src/debug.c
@@ -50,24 +50,32 @@ _ntbtls_set_debug (int level, const char *prefix, gpgrt_stream_t stream)
 
 
 
-/* FIXME: For now we print to stderr.  */
+/* FIXME: For now we print to stderr.  Note that a LEVEL of -1 will
+ * always print even when debugging has not been enabled.  */
 void
 _ntbtls_debug_msg (int level, const char *format, ...)
 {
   va_list arg_ptr;
   int saved_errno;
+  int no_lf;
 
-  if (!debug_level || level > debug_level)
+  if (level != -1 && (!debug_level || level > debug_level))
     return;
 
+  if ((no_lf = (*format == '\b')))
+    format++;
+
   saved_errno = errno;
   va_start (arg_ptr, format);
   gpgrt_fputs ("ntbtls: ", es_stderr);
   gpgrt_vfprintf (es_stderr, format, arg_ptr);
-  if (*format && format[strlen(format)-1] != '\n')
+  if (no_lf)
+    gpgrt_fflush (es_stderr); /* To sync with stderr.  */
+  else if (*format && format[strlen(format)-1] != '\n')
     gpgrt_fputc ('\n', es_stderr);
   va_end (arg_ptr);
   gpg_err_set_errno (saved_errno);
+
 }
 
 
@@ -128,3 +136,13 @@ _ntbtls_debug_sxp (int level, const char *text, gcry_sexp_t a)
 
   gcry_log_debugsxp (text, a);
 }
+
+
+void
+_ntbtls_debug_crt (int level, const char *text, x509_cert_t chain)
+{
+  if (!debug_level || level > debug_level)
+    return;
+
+  _ntbtls_x509_log_cert (text, chain, (debug_level > 1));
+}
diff --git a/src/ntbtls-int.h b/src/ntbtls-int.h
index 246294d..cfc5e72 100644
--- a/src/ntbtls-int.h
+++ b/src/ntbtls-int.h
@@ -372,6 +372,7 @@ gpg_error_t _ntbtls_x509_cert_new (x509_cert_t *r_cert);
 void _ntbtls_x509_cert_release (x509_cert_t crt);
 gpg_error_t _ntbtls_x509_append_cert (x509_cert_t cert,
                                       const void *der, size_t derlen);
+void _ntbtls_x509_log_cert (const char *text, x509_cert_t chain, int full);
 const unsigned char *_ntbtls_x509_get_cert (x509_cert_t cert, int idx,
                                             size_t *r_derlen);
 gpg_error_t _ntbtls_x509_get_pk (x509_cert_t cert, int idx, gcry_sexp_t *r_pk);
diff --git a/src/protocol-cli.c b/src/protocol-cli.c
index 787f11f..d341833 100644
--- a/src/protocol-cli.c
+++ b/src/protocol-cli.c
@@ -794,7 +794,7 @@ read_server_hello (ntbtls_t tls)
       return gpg_error (GPG_ERR_UNEXPECTED_MSG);
     }
 
-  debug_msg (3, "server_hello, chosen version: [%d:%d]",  buf[4], buf[5]);
+  debug_msg (1, "server_hello, chosen version: [%d:%d]",  buf[4], buf[5]);
 
   if (tls->in_hslen < 42
       || buf[0] != TLS_HS_SERVER_HELLO
@@ -910,7 +910,8 @@ read_server_hello (ntbtls_t tls)
   debug_msg (3, "%s session has been resumed",
              tls->handshake->resume ? "a" : "no");
 
-  debug_msg (3, "server_hello, chosen ciphersuite: %d", suite_id);
+  debug_msg (1, "server_hello, chosen ciphersuite: %d (%s)",
+             suite_id, _ntbtls_ciphersuite_get_name (suite_id));
   debug_msg (3, "server_hello, compress alg.: %d", buf[41 + n]);
 
   /* Check that we support the cipher suite.  */
@@ -953,7 +954,7 @@ read_server_hello (ntbtls_t tls)
       switch (ext_id)
         {
         case TLS_EXT_RENEGOTIATION_INFO:
-          debug_msg (3, "found renegotiation extension");
+          debug_msg (2, "found renegotiation extension");
           renegotiation_info_seen = 1;
           err = parse_renegotiation_info (tls, ext + 4, ext_size);
           if (err)
@@ -961,42 +962,42 @@ read_server_hello (ntbtls_t tls)
           break;
 
         case TLS_EXT_MAX_FRAGMENT_LENGTH:
-          debug_msg (3, "found max_fragment_length extension");
+          debug_msg (2, "found max_fragment_length extension");
           err = parse_max_fragment_length_ext (tls, ext + 4, ext_size);
           if (err)
             return err;
           break;
 
         case TLS_EXT_TRUNCATED_HMAC:
-          debug_msg (3, "found truncated_hmac extension");
+          debug_msg (2, "found truncated_hmac extension");
           err = parse_truncated_hmac_ext (tls, ext + 4, ext_size);
           if (err)
             return err;
           break;
 
         case TLS_EXT_SESSION_TICKET:
-          debug_msg (3, "found session_ticket extension");
+          debug_msg (2, "found session_ticket extension");
           err = parse_session_ticket_ext (tls, ext + 4, ext_size);
           if (err)
             return err;
           break;
 
         case TLS_EXT_SUPPORTED_POINT_FORMATS:
-          debug_msg (3, "found supported_point_formats extension");
+          debug_msg (2, "found supported_point_formats extension");
           err = parse_supported_point_formats_ext (tls, ext + 4, ext_size);
           if (err)
             return err;
           break;
 
         case TLS_EXT_ALPN:
-          debug_msg (3, "found alpn extension");
+          debug_msg (2, "found alpn extension");
           err = parse_alpn_ext (tls, ext + 4, ext_size);
           if (err)
             return err;
           break;
 
         default:
-          debug_msg (3, "unknown extension found: %d (ignoring)", ext_id);
+          debug_msg (2, "unknown extension found: %d (ignoring)", ext_id);
           break;
         }
 
diff --git a/src/protocol.c b/src/protocol.c
index f616bca..d46238d 100644
--- a/src/protocol.c
+++ b/src/protocol.c
@@ -1874,7 +1874,7 @@ _ntbtls_read_certificate (ntbtls_t tls)
       return 0;
     }
 
-  debug_msg (2, "read certificate");
+  debug_msg (3, "read certificate");
 
   err = _ntbtls_read_record (tls);
   if (err)
@@ -1966,7 +1966,7 @@ _ntbtls_read_certificate (ntbtls_t tls)
       i += n;
     }
 
-  //FIXME: debug_crt (3, "peer certificate", tls->session_negotiate->peer_chain);
+  debug_crt (1, "peer certificate", tls->session_negotiate->peer_chain);
 
   /*
    * On client, make sure the server cert doesn't change during renego to
diff --git a/src/util.h b/src/util.h
index 1c470b0..9e49111 100644
--- a/src/util.h
+++ b/src/util.h
@@ -103,6 +103,7 @@ void _ntbtls_debug_bug (const char *file, int line);
 void _ntbtls_debug_ret (int level, const char *name, gpg_error_t err);
 void _ntbtls_debug_mpi (int level, const char *text, gcry_mpi_t a);
 void _ntbtls_debug_sxp (int level, const char *text, gcry_sexp_t a);
+void _ntbtls_debug_crt (int level, const char *text, x509_cert_t chain);
 
 #define debug_msg          _ntbtls_debug_msg
 #define debug_buf(a,b,c,d) _ntbtls_debug_buf ((a),(b),(c),(d))
@@ -110,6 +111,7 @@ void _ntbtls_debug_sxp (int level, const char *text, gcry_sexp_t a);
 #define debug_ret(l,n,e)   _ntbtls_debug_ret ((l),(n),(e))
 #define debug_mpi(l,t,a)   _ntbtls_debug_mpi ((l),(t),(a))
 #define debug_sxp(l,t,a)   _ntbtls_debug_sxp ((l),(t),(a))
+#define debug_crt(l,t,a)   _ntbtls_debug_crt ((l),(t),(a))
 
 
 
diff --git a/src/x509.c b/src/x509.c
index 595839d..6cf8f57 100644
--- a/src/x509.c
+++ b/src/x509.c
@@ -126,6 +126,98 @@ _ntbtls_x509_append_cert (x509_cert_t cert, const void *der, size_t derlen)
 }
 
 
+static void
+x509_log_serial (const char *text, ksba_sexp_t sn)
+{
+  const char *p = (const char *)sn;
+  unsigned long n;
+  char *endp;
+
+  if (!p)
+    _ntbtls_debug_msg (-1, "%s: none", text);
+  else if (*p != '(')
+    _ntbtls_debug_msg (-1, "%s: [Internal error - not an S-expression]", text);
+  else
+    {
+      p++;
+      n = strtoul (p, &endp, 10);
+      p = endp;
+      if (*p++ != ':')
+        _ntbtls_debug_msg (-1, "%s: [Internal error - invalid S-expression]",
+                           text);
+      else
+        {
+          _ntbtls_debug_msg (-1, "\b%s: ", text);
+          gcry_log_debughex ("", p, n);
+        }
+    }
+}
+
+
+static void
+x509_log_time (const char *text, ksba_isotime_t t)
+{
+  if (!t || !*t)
+    _ntbtls_debug_msg (-1, "%s: none", text);
+  else
+    _ntbtls_debug_msg (-1, "%s: %.4s-%.2s-%.2s %.2s:%.2s:%s",
+                       text, t, t+4, t+6, t+9, t+11, t+13);
+}
+
+
+void
+_ntbtls_x509_log_cert (const char *text, x509_cert_t chain_arg, int full)
+{
+  gpg_error_t err;
+  x509_cert_t chain;
+  ksba_cert_t cert;
+  ksba_sexp_t sexp;
+  int idx;
+  char *dn;
+  ksba_isotime_t t;
+  const char *oid;
+
+  for (idx=0, chain= chain_arg; chain && (cert = chain->crt);
+       chain = chain->next)
+    idx++;
+
+  _ntbtls_debug_msg (-1, "%s: chain length=%d", text, idx);
+  for (chain = chain_arg; full && chain && (cert = chain->crt);
+       chain = chain->next)
+    {
+      sexp = ksba_cert_get_serial (cert);
+      x509_log_serial ("     serial", sexp);
+      ksba_free (sexp);
+
+      for (idx = 0; (dn = ksba_cert_get_issuer (cert, idx)); idx++)
+        {
+          if (!idx)
+            _ntbtls_debug_msg (-1, "     issuer: %s\n", dn);
+          else
+            _ntbtls_debug_msg (-1, "        aka: %s\n", dn);
+          ksba_free (dn);
+        }
+
+      for (idx = 0; (dn = ksba_cert_get_subject (cert, idx)); idx++)
+        {
+          if (!idx)
+            _ntbtls_debug_msg (-1, "    subject: %s\n", dn);
+          else
+            _ntbtls_debug_msg (-1, "        aka: %s\n", dn);
+          ksba_free (dn);
+        }
+
+      ksba_cert_get_validity (cert, 0, t);
+      x509_log_time ("  notBefore", t);
+      ksba_cert_get_validity (cert, 1, t);
+      x509_log_time ("   notAfter", t);
+
+      oid = ksba_cert_get_digest_algo (cert);
+      _ntbtls_debug_msg (-1, "  hashAlgo: %s", oid);
+    }
+}
+
+
 /* Return a pointer to the DER encoding of the certificate and store
    its length at R_DERLEN.  IDX is the requested number of the
    certificate; ie.  IDX of 0 return the first certificate stored

-----------------------------------------------------------------------

Summary of changes:
 src/debug.c        | 24 ++++++++++++--
 src/ntbtls-int.h   |  1 +
 src/protocol-cli.c | 19 +++++------
 src/protocol.c     |  4 +--
 src/util.h         |  2 ++
 src/x509.c         | 92 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 6 files changed, 128 insertions(+), 14 deletions(-)


hooks/post-receive
-- 
Not Too Bad TLS
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sat Jan 28 10:34:27 2017
From: cvs at cvs.gnupg.org (by Jussi Kivilinna)
Date: Sat, 28 Jan 2017 10:34:27 +0100
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-66-ge7b941c
Message-ID: <E1cXPOv-0008Ri-W9@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  e7b941c3de9c9b6319298c02f844cc0cadbf8562 (commit)
       via  92b4a29d2453712192ced2d7226abc49679dcb1e (commit)
       via  4f31d816dcc1e95dc647651e92acbdfed53f5c14 (commit)
       via  55cf1b5588705cab5f45e2817c4aa1d204dc0042 (commit)
       via  b29b1b9f576f501d4b993be0a751567045274a1a (commit)
       via  136c8416ea540dd126be3997d94d7063b3aaf577 (commit)
       via  d1ae52a0e23308f33b78cffeba56005b687f23c0 (commit)
      from  a351fbde8548ce3f57298c618426f043844fbc78 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e7b941c3de9c9b6319298c02f844cc0cadbf8562
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Jan 28 11:26:02 2017 +0200

    bufhelp: use unaligned dword and qword types for endianess helpers
    
    * cipher/bufhelp.h (BUFHELP_UNALIGNED_ACCESS): New, defined
    if attributes 'packed', 'aligned' and 'may_alias' are supported.
    (BUFHELP_FAST_UNALIGNED_ACCESS): Define if have
    BUFHELP_UNALIGNED_ACCESS.
    --
    
    Now that compiler is properly told that reads from these types
    may do not follow strict-aliasing and may be unaligned, we
    enable use of these for all architectures and compiler will
    emit more optimized, yet correct, code (for example, use
    special unaligned read/write instructions instead of accessing
    byte-by-byte).
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/bufhelp.h b/cipher/bufhelp.h
index 1c52db5..3110a1d 100644
--- a/cipher/bufhelp.h
+++ b/cipher/bufhelp.h
@@ -23,10 +23,19 @@
 #include "bithelp.h"
 
 
-#undef BUFHELP_FAST_UNALIGNED_ACCESS
+#undef BUFHELP_UNALIGNED_ACCESS
 #if defined(HAVE_GCC_ATTRIBUTE_PACKED) && \
     defined(HAVE_GCC_ATTRIBUTE_ALIGNED) && \
-    defined(HAVE_GCC_ATTRIBUTE_MAY_ALIAS) && \
+    defined(HAVE_GCC_ATTRIBUTE_MAY_ALIAS)
+/* Compiler is supports attributes needed for automatically issuing unaligned
+   memory access instructions.
+ */
+# define BUFHELP_UNALIGNED_ACCESS 1
+#endif
+
+
+#undef BUFHELP_FAST_UNALIGNED_ACCESS
+#if defined(BUFHELP_UNALIGNED_ACCESS) && \
     (defined(__i386__) || defined(__x86_64__) || \
      (defined(__arm__) && defined(__ARM_FEATURE_UNALIGNED)) || \
      defined(__aarch64__))
@@ -290,7 +299,7 @@ buf_eq_const(const void *_a, const void *_b, size_t len)
 }
 
 
-#ifndef BUFHELP_FAST_UNALIGNED_ACCESS
+#ifndef BUFHELP_UNALIGNED_ACCESS
 
 /* Functions for loading and storing unaligned u32 values of different
    endianness.  */
@@ -373,7 +382,7 @@ static inline void buf_put_le64(void *_buf, u64 val)
   out[0] = val;
 }
 
-#else /*BUFHELP_FAST_UNALIGNED_ACCESS*/
+#else /*BUFHELP_UNALIGNED_ACCESS*/
 
 typedef struct bufhelp_u32_s
 {
@@ -435,6 +444,6 @@ static inline void buf_put_le64(void *_buf, u64 val)
 }
 
 
-#endif /*BUFHELP_FAST_UNALIGNED_ACCESS*/
+#endif /*BUFHELP_UNALIGNED_ACCESS*/
 
 #endif /*GCRYPT_BUFHELP_H*/

commit 92b4a29d2453712192ced2d7226abc49679dcb1e
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Jan 28 11:26:02 2017 +0200

    rijndael-aesni: fix u128_t strict-aliasing rule breaking
    
    * cipher/rijndael-aesni.c (u128_t): Add attributes to tell GCC and clang
    that casting from 'char *' to 'u128_t *' is ok.
    --
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/rijndael-aesni.c b/cipher/rijndael-aesni.c
index 7852e19..735e5cd 100644
--- a/cipher/rijndael-aesni.c
+++ b/cipher/rijndael-aesni.c
@@ -41,7 +41,10 @@
 #endif
 
 
-typedef struct u128_s { u32 a, b, c, d; } u128_t;
+typedef struct u128_s
+{
+  u32 a, b, c, d;
+} __attribute__((packed, aligned(1), may_alias)) u128_t;
 
 
 /* Two macros to be called prior and after the use of AESNI

commit 4f31d816dcc1e95dc647651e92acbdfed53f5c14
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Jan 28 11:26:02 2017 +0200

    cipher-xts: fix pointer casting to wrong alignment and aliasing
    
    * cipher/cipher-xts.c (xts_gfmul_byA, xts_inc128): Use buf_get_le64
    and buf_put_le64 for accessing data; Change parameter pointers to
    'unsigned char *' type.
    (_gcry_cipher_xts_crypt): Do not cast buffer pointers to 'u64 *'
    for helper functions.
    --
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/cipher-xts.c b/cipher/cipher-xts.c
index 7a7181b..4da89e5 100644
--- a/cipher/cipher-xts.c
+++ b/cipher/cipher-xts.c
@@ -29,29 +29,29 @@
 #include "./cipher-internal.h"
 
 
-static inline void xts_gfmul_byA (u64 *out, const u64 *in)
+static inline void xts_gfmul_byA (unsigned char *out, const unsigned char *in)
 {
-  u64 hi = le_bswap64 (in[1]);
-  u64 lo = le_bswap64 (in[0]);
+  u64 hi = buf_get_le64 (in + 8);
+  u64 lo = buf_get_le64 (in + 0);
   u64 carry = -(hi >> 63) & 0x87;
 
   hi = (hi << 1) + (lo >> 63);
   lo = (lo << 1) ^ carry;
 
-  out[1] = le_bswap64 (hi);
-  out[0] = le_bswap64 (lo);
+  buf_put_le64 (out + 8, hi);
+  buf_put_le64 (out + 0, lo);
 }
 
 
-static inline void xts_inc128 (u64 *seqno)
+static inline void xts_inc128 (unsigned char *seqno)
 {
-  u64 lo = le_bswap64 (seqno[0]);
-  u64 hi = le_bswap64 (seqno[1]);
+  u64 lo = buf_get_le64 (seqno + 0);
+  u64 hi = buf_get_le64 (seqno + 8);
 
   hi += !(++lo);
 
-  seqno[0] = le_bswap64 (lo);
-  seqno[1] = le_bswap64 (hi);
+  buf_put_le64 (seqno + 0, lo);
+  buf_put_le64 (seqno + 8, hi);
 }
 
 
@@ -117,7 +117,7 @@ _gcry_cipher_xts_crypt (gcry_cipher_hd_t c,
       nblocks--;
 
       /* Generate next tweak. */
-      xts_gfmul_byA ((u64 *)c->u_ctr.ctr, (u64 *)c->u_ctr.ctr);
+      xts_gfmul_byA (c->u_ctr.ctr, c->u_ctr.ctr);
     }
 
   /* Handle remaining data with ciphertext stealing. */
@@ -129,7 +129,7 @@ _gcry_cipher_xts_crypt (gcry_cipher_hd_t c,
 	  gcry_assert (inbuflen < GCRY_XTS_BLOCK_LEN * 2);
 
 	  /* Generate last tweak. */
-	  xts_gfmul_byA (tmp.x64, (u64 *)c->u_ctr.ctr);
+	  xts_gfmul_byA (tmp.x1, c->u_ctr.ctr);
 
 	  /* Decrypt last block first. */
 	  buf_xor (outbuf, inbuf, tmp.x64, GCRY_XTS_BLOCK_LEN);
@@ -158,7 +158,7 @@ _gcry_cipher_xts_crypt (gcry_cipher_hd_t c,
     }
 
   /* Auto-increment data-unit sequence number */
-  xts_inc128 ((u64 *)c->u_iv.iv);
+  xts_inc128 (c->u_iv.iv);
 
   wipememory (&tmp, sizeof(tmp));
   wipememory (c->u_ctr.ctr, sizeof(c->u_ctr.ctr));

commit 55cf1b5588705cab5f45e2817c4aa1d204dc0042
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Jan 28 11:26:02 2017 +0200

    crc-intel-pclmul: fix undefined behavior with unaligned access
    
    * cipher/crc-intel-pclmul.c (u16_unaligned_s): New.
    (crc32_reflected_less_than_16, crc32_less_than_16): Use
    'u16_unaligned_s' for unaligned memory access.
    --
    
    GnuPG-bug-id: 2292
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/crc-intel-pclmul.c b/cipher/crc-intel-pclmul.c
index 7a344e2..8ff08ec 100644
--- a/cipher/crc-intel-pclmul.c
+++ b/cipher/crc-intel-pclmul.c
@@ -44,6 +44,12 @@
 #define ALIGNED_16 __attribute__ ((aligned (16)))
 
 
+struct u16_unaligned_s
+{
+  u16 a;
+} __attribute__((packed, aligned (1), may_alias));
+
+
 /* Constants structure for generic reflected/non-reflected CRC32 CLMUL
  * functions. */
 struct crc32_consts_s
@@ -345,14 +351,14 @@ crc32_reflected_less_than_16 (u32 *pcrc, const byte *inbuf, size_t inlen,
 	}
       else if (inlen == 2)
 	{
-	  data = *((const u16 *)inbuf);
+	  data = ((const struct u16_unaligned_s *)inbuf)->a;
 	  data ^= crc;
 	  data <<= 16;
 	  crc >>= 16;
 	}
       else
 	{
-	  data = *((const u16 *)inbuf);
+	  data = ((const struct u16_unaligned_s *)inbuf)->a;
 	  data |= inbuf[2] << 16;
 	  data ^= crc;
 	  data <<= 8;
@@ -709,14 +715,14 @@ crc32_less_than_16 (u32 *pcrc, const byte *inbuf, size_t inlen,
 	}
       else if (inlen == 2)
 	{
-	  data = *((const u16 *)inbuf);
+	  data = ((const struct u16_unaligned_s *)inbuf)->a;
 	  data ^= crc;
 	  data = _gcry_bswap32(data << 16);
 	  crc = _gcry_bswap32(crc >> 16);
 	}
       else
 	{
-	  data = *((const u16 *)inbuf);
+	  data = ((const struct u16_unaligned_s *)inbuf)->a;
 	  data |= inbuf[2] << 16;
 	  data ^= crc;
 	  data = _gcry_bswap32(data << 8);

commit b29b1b9f576f501d4b993be0a751567045274a1a
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Jan 28 11:26:02 2017 +0200

    configure.ac: fix attribute checks
    
    * configure.ac: Add -Werror flag for attribute checks.
    --
    
    Compilter ignores unknown attributes and just shows warning. Therefore
    attribute checks need to be run with -Werror.
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/configure.ac b/configure.ac
index d2b863c..bc5bed4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -958,6 +958,12 @@ if test "$gcry_cv_visibility_attribute" = "yes" \
 fi
 
 
+# Following attribute tests depend on warnings to cause compile to fail,
+# so set -Werror temporarily.
+_gcc_cflags_save=$CFLAGS
+CFLAGS="$CFLAGS -Werror"
+
+
 #
 # Check whether the compiler supports the GCC style aligned attribute
 #
@@ -1009,6 +1015,10 @@ if test "$gcry_cv_gcc_attribute_may_alias" = "yes" ; then
 fi
 
 
+# Restore flags.
+CFLAGS=$_gcc_cflags_save;
+
+
 #
 # Check whether the compiler supports 'asm' or '__asm__' keyword for
 # assembler blocks.

commit 136c8416ea540dd126be3997d94d7063b3aaf577
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Jan 28 11:26:02 2017 +0200

    configure.ac: fix may_alias attribute check
    
    * configure.ac: Test may_alias attribute on type, not on variable.
    --
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/configure.ac b/configure.ac
index 5dd27ca..d2b863c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1000,7 +1000,8 @@ AC_CACHE_CHECK([whether the GCC style may_alias attribute is supported],
        [gcry_cv_gcc_attribute_may_alias],
        [gcry_cv_gcc_attribute_may_alias=no
         AC_COMPILE_IFELSE([AC_LANG_SOURCE(
-          [[struct { int a; } foo __attribute__ ((may_alias));]])],
+          [[typedef struct foo_s { int a; }
+            __attribute__ ((may_alias)) foo_t;]])],
           [gcry_cv_gcc_attribute_may_alias=yes])])
 if test "$gcry_cv_gcc_attribute_may_alias" = "yes" ; then
    AC_DEFINE(HAVE_GCC_ATTRIBUTE_MAY_ALIAS,1,

commit d1ae52a0e23308f33b78cffeba56005b687f23c0
Author: Jussi Kivilinna <jussi.kivilinna at iki.fi>
Date:   Sat Jan 28 11:26:02 2017 +0200

    bufhelp: add 'may_alias' attribute for properly aligned 'bufhelp_int_t'
    
    * cipher/bufhelp.h [!BUFHELP_FAST_UNALIGNED_ACCESS]
    (bufhelp_int_t): Add 'may_alias' attribute.
    --
    
    Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>

diff --git a/cipher/bufhelp.h b/cipher/bufhelp.h
index 3616515..1c52db5 100644
--- a/cipher/bufhelp.h
+++ b/cipher/bufhelp.h
@@ -49,11 +49,18 @@ typedef struct bufhelp_int_s
 /* Define type with default alignment for other architectures (unaligned
    accessed handled in per byte loops).
  */
+#ifdef HAVE_GCC_ATTRIBUTE_MAY_ALIAS
+typedef struct bufhelp_int_s
+{
+  uintptr_t a;
+} __attribute__((may_alias)) bufhelp_int_t;
+#else
 typedef struct bufhelp_int_s
 {
   uintptr_t a;
 } bufhelp_int_t;
 #endif
+#endif
 
 
 /* Optimized function for small buffer copying */

-----------------------------------------------------------------------

Summary of changes:
 cipher/bufhelp.h          | 26 +++++++++++++++++++++-----
 cipher/cipher-xts.c       | 26 +++++++++++++-------------
 cipher/crc-intel-pclmul.c | 14 ++++++++++----
 cipher/rijndael-aesni.c   |  5 ++++-
 configure.ac              | 13 ++++++++++++-
 5 files changed, 60 insertions(+), 24 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 30 01:08:10 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Mon, 30 Jan 2017 01:08:10 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-29-g7c8eee4
Message-ID: <E1cXzW2-0001fd-2l@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  7c8eee4d396a751d41fd1ee1e1b87b851fca172a (commit)
       via  216afba0d99582d0fbae1d6e925f4ddb349d9de3 (commit)
      from  f3d9b2582bcaa1936b4fed5ec42a889b02df2f42 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 7c8eee4d396a751d41fd1ee1e1b87b851fca172a
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jan 30 09:05:37 2017 +0900

    scd: Don't send GET_STATUS packet if not needed.
    
    * scd/apdu.c (apdu_get_status_internal): Add ON_WIRE arg.
    (apdu_connect): Call apdu_get_status_internal with ON_WIRE enabled.
    (apdu_get_status): For periodical check, call apdu_get_status_internal
    with ON_WIRE disabled.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/apdu.c b/scd/apdu.c
index 0037c47..f752284 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -367,8 +367,8 @@ long (* DLSTDCALL pcsc_control) (long card,
 static int pcsc_vendor_specific_init (int slot);
 static int pcsc_get_status (int slot, unsigned int *status);
 static int reset_pcsc_reader (int slot);
-static int apdu_get_status_internal (int slot, int hang, int no_atr_reset,
-                                     unsigned int *status);
+static int apdu_get_status_internal (int slot, int hang, unsigned int *status,
+                                     int on_wire);
 static int check_pcsc_pinpad (int slot, int command, pininfo_t *pininfo);
 static int pcsc_pinpad_verify (int slot, int class, int ins, int p0, int p1,
                                pininfo_t *pininfo);
@@ -3386,7 +3386,7 @@ apdu_connect (int slot)
      Without that we would force a reset of the card with the next
      call to apdu_get_status.  */
   if (!sw)
-    sw = apdu_get_status_internal (slot, 1, 1, &status);
+    sw = apdu_get_status_internal (slot, 1, &status, 1);
 
   if (sw)
     ;
@@ -3551,11 +3551,10 @@ apdu_get_atr (int slot, size_t *atrlen)
      APDU_CARD_ACTIVE  (bit 2) = card active
                        (bit 3) = card access locked [not yet implemented]
 
-   For must applications, testing bit 0 is sufficient.
+   For most applications, testing bit 0 is sufficient.
 */
 static int
-apdu_get_status_internal (int slot, int hang, int no_atr_reset,
-                          unsigned int *status)
+apdu_get_status_internal (int slot, int hang, unsigned int *status, int on_wire)
 {
   int sw;
   unsigned int s;
@@ -3566,6 +3565,18 @@ apdu_get_status_internal (int slot, int hang, int no_atr_reset,
   if ((sw = hang? lock_slot (slot) : trylock_slot (slot)))
     return sw;
 
+  /* If the card (with its lower-level driver) doesn't require
+     GET_STATUS on wire (because it supports INTERRUPT transfer for
+     status change, or it's a token which has a card always inserted),
+     no need to send on wire.  */
+  if (!on_wire && !reader_table[slot].require_get_status)
+    {
+      unlock_slot (slot);
+      if (status)
+        *status = (APDU_CARD_USABLE|APDU_CARD_ACTIVE);
+      return 0;
+    }
+
   if (reader_table[slot].get_status_reader)
     sw = reader_table[slot].get_status_reader (slot, &s);
 
@@ -3573,7 +3584,7 @@ apdu_get_status_internal (int slot, int hang, int no_atr_reset,
 
   if (sw)
     {
-      if (!no_atr_reset)
+      if (on_wire)
         reader_table[slot].atrlen = 0;
       s = 0;
     }
@@ -3592,7 +3603,7 @@ apdu_get_status (int slot, int hang, unsigned int *status)
 
   if (DBG_READER)
     log_debug ("enter: apdu_get_status: slot=%d hang=%d\n", slot, hang);
-  sw = apdu_get_status_internal (slot, hang, 0, status);
+  sw = apdu_get_status_internal (slot, hang, status, 0);
   if (DBG_READER)
     {
       if (status)

commit 216afba0d99582d0fbae1d6e925f4ddb349d9de3
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jan 30 08:19:32 2017 +0900

    scd: Fix cancel INTERRUPT transfer.
    
    * scd/ccid-driver.c (do_close_reader): Don't lock events, but check the
    return value of libusb_cancel_transfer.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index bbdd697..305c9d2 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -2116,33 +2116,24 @@ do_close_reader (ccid_driver_t handle)
     {
       if (handle->transfer)
         {
-          /* By locking libusb events, make sure handle->transfer is
-             canceled properly;  Don't cancel completed transfer.  */
-#ifdef USE_NPTH
-          npth_unprotect ();
-#endif
-          libusb_lock_events (NULL);
-#ifdef USE_NPTH
-          npth_protect ();
-#endif
           if (!handle->powered_off)
             {
-              libusb_cancel_transfer (handle->transfer);
-              libusb_unlock_events (NULL);
+              DEBUGOUT ("libusb_cancel_transfer\n");
 
-              while (!handle->powered_off)
-                {
+              rc = libusb_cancel_transfer (handle->transfer);
+              if (rc != LIBUSB_ERROR_NOT_FOUND)
+                while (!handle->powered_off)
+                  {
+                    DEBUGOUT ("libusb_handle_events_completed\n");
 #ifdef USE_NPTH
-                  npth_unprotect ();
+                    npth_unprotect ();
 #endif
-                  libusb_handle_events_completed (NULL, &handle->powered_off);
+                    libusb_handle_events_completed (NULL, &handle->powered_off);
 #ifdef USE_NPTH
-                  npth_protect ();
+                    npth_protect ();
 #endif
-                }
+                  }
             }
-          else
-            libusb_unlock_events (NULL);
 
           libusb_free_transfer (handle->transfer);
         }

-----------------------------------------------------------------------

Summary of changes:
 scd/apdu.c        | 27 +++++++++++++++++++--------
 scd/ccid-driver.c | 29 ++++++++++-------------------
 2 files changed, 29 insertions(+), 27 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 30 01:38:27 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Mon, 30 Jan 2017 01:38:27 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-30-g2a02503
Message-ID: <E1cXzzJ-0002sF-ES@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  2a025039c1817c7f75c35a898884849a8e5dc926 (commit)
      from  7c8eee4d396a751d41fd1ee1e1b87b851fca172a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2a025039c1817c7f75c35a898884849a8e5dc926
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jan 30 09:30:32 2017 +0900

    scd: Fix GetSlotStatus.
    
    * scd/apdu.c (get_status_reader): Add ON_WIRE arg, here.
    (ct_get_status, pcsc_get_status_direct, pcsc_get_status_wrapped)
    (pcsc_get_status, get_status_ccid, my_rapdu_get_status): Likewise.
    (reset_pcsc_reader_wrapped, open_pcsc_reader_wrapped): Follow the
    change.
    (apdu_get_status_internal): It's lower-level driver which judge
    it's not needed.  Otherwise, it can't detect the removal.
    * scd/ccid-driver.c (ccid_slot_status): After the POWERED_OFF check,
    we can skip sending GetSlotStatus packet on wire, when no need.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>
    Fixes-commit: c8eee4d396a751d41fd1ee1e1b87b851fca172a

diff --git a/scd/apdu.c b/scd/apdu.c
index f752284..6fc62aa 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -109,7 +109,7 @@ struct reader_table_s {
   int (*disconnect_card)(int);
   int (*close_reader)(int);
   int (*reset_reader)(int);
-  int (*get_status_reader)(int, unsigned int *);
+  int (*get_status_reader)(int, unsigned int *, int);
   int (*send_apdu_reader)(int,unsigned char *,size_t,
                           unsigned char *, size_t *, pininfo_t *);
   int (*check_pinpad)(int, int, pininfo_t *);
@@ -365,7 +365,7 @@ long (* DLSTDCALL pcsc_control) (long card,
 
 /*  Prototypes.  */
 static int pcsc_vendor_specific_init (int slot);
-static int pcsc_get_status (int slot, unsigned int *status);
+static int pcsc_get_status (int slot, unsigned int *status, int on_wire);
 static int reset_pcsc_reader (int slot);
 static int apdu_get_status_internal (int slot, int hang, unsigned int *status,
                                      int on_wire);
@@ -665,9 +665,10 @@ reset_ct_reader (int slot)
 
 
 static int
-ct_get_status (int slot, unsigned int *status)
+ct_get_status (int slot, unsigned int *status, int on_wire)
 {
   (void)slot;
+  (void)on_wire;
   /* The status we returned is wrong but we don't care because ctAPI
      is not anymore required.  */
   *status = APDU_CARD_USABLE|APDU_CARD_PRESENT|APDU_CARD_ACTIVE;
@@ -929,11 +930,12 @@ dump_pcsc_reader_status (int slot)
 
 #ifndef NEED_PCSC_WRAPPER
 static int
-pcsc_get_status_direct (int slot, unsigned int *status)
+pcsc_get_status_direct (int slot, unsigned int *status, int on_wire)
 {
   long err;
   struct pcsc_readerstate_s rdrstates[1];
 
+  (void)on_wire;
   memset (rdrstates, 0, sizeof *rdrstates);
   rdrstates[0].reader = reader_table[slot].rdrname;
   rdrstates[0].current_state = PCSC_STATE_UNAWARE;
@@ -992,7 +994,7 @@ pcsc_get_status_direct (int slot, unsigned int *status)
 
 #ifdef NEED_PCSC_WRAPPER
 static int
-pcsc_get_status_wrapped (int slot, unsigned int *status)
+pcsc_get_status_wrapped (int slot, unsigned int *status, int on_wire)
 {
   long err;
   reader_table_t slotp;
@@ -1002,6 +1004,7 @@ pcsc_get_status_wrapped (int slot, unsigned int *status)
   unsigned char buffer[16];
   int sw = SW_HOST_CARD_IO_ERROR;
 
+  (void)on_wire;
   slotp = reader_table + slot;
 
   if (slotp->pcsc.req_fd == -1
@@ -1101,12 +1104,12 @@ pcsc_get_status_wrapped (int slot, unsigned int *status)
 
 
 static int
-pcsc_get_status (int slot, unsigned int *status)
+pcsc_get_status (int slot, unsigned int *status, int on_wire)
 {
 #ifdef NEED_PCSC_WRAPPER
-  return pcsc_get_status_wrapped (slot, status);
+  return pcsc_get_status_wrapped (slot, status, on_wire);
 #else
-  return pcsc_get_status_direct (slot, status);
+  return pcsc_get_status_direct (slot, status, on_wire);
 #endif
 }
 
@@ -1705,7 +1708,7 @@ reset_pcsc_reader_wrapped (int slot)
   slotp->atrlen = len;
 
   /* Read the status so that IS_T0 will be set. */
-  pcsc_get_status (slot, &dummy_status);
+  pcsc_get_status (slot, &dummy_status, 1);
 
   return 0;
 
@@ -2184,7 +2187,7 @@ open_pcsc_reader_wrapped (const char *portstr)
   pcsc_vendor_specific_init (slot);
 
   /* Read the status so that IS_T0 will be set. */
-  pcsc_get_status (slot, &dummy_status);
+  pcsc_get_status (slot, &dummy_status, 1);
 
   dump_reader_status (slot);
   unlock_slot (slot);
@@ -2471,12 +2474,12 @@ set_progress_cb_ccid_reader (int slot, gcry_handler_progress_t cb, void *cb_arg)
 
 
 static int
-get_status_ccid (int slot, unsigned int *status)
+get_status_ccid (int slot, unsigned int *status, int on_wire)
 {
   int rc;
   int bits;
 
-  rc = ccid_slot_status (reader_table[slot].ccid.handle, &bits);
+  rc = ccid_slot_status (reader_table[slot].ccid.handle, &bits, on_wire);
   if (rc)
     return rc;
 
@@ -2718,13 +2721,14 @@ reset_rapdu_reader (int slot)
 
 
 static int
-my_rapdu_get_status (int slot, unsigned int *status)
+my_rapdu_get_status (int slot, unsigned int *status, int on_wire)
 {
   int err;
   reader_table_t slotp;
   rapdu_msg_t msg = NULL;
   int oldslot;
 
+  (void)on_wire;
   slotp = reader_table + slot;
 
   oldslot = rapdu_set_reader (slotp->rapdu.handle, slot);
@@ -3565,20 +3569,8 @@ apdu_get_status_internal (int slot, int hang, unsigned int *status, int on_wire)
   if ((sw = hang? lock_slot (slot) : trylock_slot (slot)))
     return sw;
 
-  /* If the card (with its lower-level driver) doesn't require
-     GET_STATUS on wire (because it supports INTERRUPT transfer for
-     status change, or it's a token which has a card always inserted),
-     no need to send on wire.  */
-  if (!on_wire && !reader_table[slot].require_get_status)
-    {
-      unlock_slot (slot);
-      if (status)
-        *status = (APDU_CARD_USABLE|APDU_CARD_ACTIVE);
-      return 0;
-    }
-
   if (reader_table[slot].get_status_reader)
-    sw = reader_table[slot].get_status_reader (slot, &s);
+    sw = reader_table[slot].get_status_reader (slot, &s, on_wire);
 
   unlock_slot (slot);
 
diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index 305c9d2..7124c6e 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -2708,7 +2708,7 @@ ccid_poll (ccid_driver_t handle)
 /* Note that this function won't return the error codes NO_CARD or
    CARD_INACTIVE */
 int
-ccid_slot_status (ccid_driver_t handle, int *statusbits)
+ccid_slot_status (ccid_driver_t handle, int *statusbits, int on_wire)
 {
   int rc;
   unsigned char msg[100];
@@ -2719,6 +2719,16 @@ ccid_slot_status (ccid_driver_t handle, int *statusbits)
   if (handle->powered_off)
     return CCID_DRIVER_ERR_NO_READER;
 
+  /* If the card (with its lower-level driver) doesn't require
+     GET_STATUS on wire (because it supports INTERRUPT transfer for
+     status change, or it's a token which has a card always inserted),
+     no need to send on wire.  */
+  if (!on_wire && !ccid_require_get_status (handle))
+    {
+      *statusbits = 0;
+      return 0;
+    }
+
  retry:
   msg[0] = PC_to_RDR_GetSlotStatus;
   msg[5] = 0; /* slot */
@@ -2935,7 +2945,7 @@ ccid_get_atr (ccid_driver_t handle,
   };
 
   /* First check whether a card is available.  */
-  rc = ccid_slot_status (handle, &statusbits);
+  rc = ccid_slot_status (handle, &statusbits, 1);
   if (rc)
     return rc;
   if (statusbits == 2)
diff --git a/scd/ccid-driver.h b/scd/ccid-driver.h
index cff3f19..b6da30c 100644
--- a/scd/ccid-driver.h
+++ b/scd/ccid-driver.h
@@ -128,7 +128,7 @@ int ccid_shutdown_reader (ccid_driver_t handle);
 int ccid_close_reader (ccid_driver_t handle);
 int ccid_get_atr (ccid_driver_t handle,
                   unsigned char *atr, size_t maxatrlen, size_t *atrlen);
-int ccid_slot_status (ccid_driver_t handle, int *statusbits);
+int ccid_slot_status (ccid_driver_t handle, int *statusbits, int on_wire);
 int ccid_transceive (ccid_driver_t handle,
                      const unsigned char *apdu, size_t apdulen,
                      unsigned char *resp, size_t maxresplen, size_t *nresp);

-----------------------------------------------------------------------

Summary of changes:
 scd/apdu.c        | 44 ++++++++++++++++++--------------------------
 scd/ccid-driver.c | 14 ++++++++++++--
 scd/ccid-driver.h |  2 +-
 3 files changed, 31 insertions(+), 29 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 30 04:31:55 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Mon, 30 Jan 2017 04:31:55 +0100
Subject: [git] Scute - branch, master, updated. scute-1.3.0-67-g10a1946
Message-ID: <E1cY2hB-00025T-L5@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PKCS#11 token on top of gpg-agent".

The branch, master has been updated
       via  10a19467bc2a95b4aa91176924a91be427d3157a (commit)
      from  e4bcc781fe2280626d602d0d02702d03a9c2601a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 10a19467bc2a95b4aa91176924a91be427d3157a
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jan 30 12:30:28 2017 +0900

    Add error handling.
    
    * src/slots.c (slots_update_slot): Ignore GPG_ERR_ENODEV too.
    
    --
    In GnuPG 2.1, scdamon can return GPG_ERR_ENODEV.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/src/slots.c b/src/slots.c
index 810be0b..fc69d15 100644
--- a/src/slots.c
+++ b/src/slots.c
@@ -439,7 +439,8 @@ slots_update_slot (slot_iterator_t id)
      here.  */
   if (gpg_err_code (err) == GPG_ERR_CARD_REMOVED
       || gpg_err_code (err) == GPG_ERR_CARD_NOT_PRESENT
-      || gpg_err_code (err) == GPG_ERR_CARD)
+      || gpg_err_code (err) == GPG_ERR_CARD
+      || gpg_err_code (err) == GPG_ERR_ENODEV)
     /* Nothing to do.  */
     err = 0;
   else if (err == 0)

-----------------------------------------------------------------------

Summary of changes:
 src/slots.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
PKCS#11 token on top of gpg-agent
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 30 12:16:09 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 30 Jan 2017 12:16:09 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-31-g1ec7dc4
Message-ID: <E1cY9wS-0005DQ-6n@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  1ec7dc4e55a9eb84161ce42797924c2f928e2a8e (commit)
      from  2a025039c1817c7f75c35a898884849a8e5dc926 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1ec7dc4e55a9eb84161ce42797924c2f928e2a8e
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jan 30 12:07:46 2017 +0100

    Explain commit e175152ef7515921635bf1e00383e812668d13fc.
    
    --

diff --git a/agent/cache.c b/agent/cache.c
index 2483682..4cb158c 100644
--- a/agent/cache.c
+++ b/agent/cache.c
@@ -481,7 +481,15 @@ agent_store_cache_hit (const char *key)
   /* To make sure the update is atomic under the non-preemptive thread
    * model, we must make sure not to surrender control to a different
    * thread.  Therefore, we avoid calling the allocator during the
-   * update.  */
+   * update.
+   *
+   * Background: xtrystrdup uses gcry_strdup which may use the secure
+   * memory allocator of Libgcrypt.  That allocator takes locks and
+   * since version 1.14 libgpg-error is nPth aware and thus talking a
+   * lock may now lead to thread switch.  Note that this only happens
+   * when secure memory is allocated, the standard allocator uses
+   * malloc which is not nPth aware.
+   */
   new = key ? xtrystrdup (key) : NULL;
 
   /* Atomic update.  */

-----------------------------------------------------------------------

Summary of changes:
 agent/cache.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 30 13:26:32 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 30 Jan 2017 13:26:32 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-32-g59048b0
Message-ID: <E1cYB2Y-0007l4-OH@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  59048b0f1aa77313573a1004cd3a9f02692a7521 (commit)
      from  1ec7dc4e55a9eb84161ce42797924c2f928e2a8e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 59048b0f1aa77313573a1004cd3a9f02692a7521
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 30 13:25:32 2017 +0100

    Revert "tests: Add test demonstrating issue2929."
    
    This reverts commit 5aafa56dffefe3fac55b9d0555c7c86e8a07f072.

diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
index 5cab3d5..d1dd449 100644
--- a/tests/openpgp/Makefile.am
+++ b/tests/openpgp/Makefile.am
@@ -96,8 +96,7 @@ XTESTS = \
 	issue2015.scm \
 	issue2346.scm \
 	issue2417.scm \
-	issue2419.scm \
-	issue2929.scm
+	issue2419.scm
 
 # XXX: Currently, one cannot override automake's 'check' target.  As a
 # workaround, we avoid defining 'TESTS', thus automake will not emit
diff --git a/tests/openpgp/issue2929.scm b/tests/openpgp/issue2929.scm
deleted file mode 100644
index 44521bb..0000000
--- a/tests/openpgp/issue2929.scm
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/usr/bin/env gpgscm
-
-;; Copyright (C) 2017 g10 Code GmbH
-;;
-;; This file is part of GnuPG.
-;;
-;; GnuPG is free software; you can redistribute it and/or modify
-;; it under the terms of the GNU General Public License as published by
-;; the Free Software Foundation; either version 3 of the License, or
-;; (at your option) any later version.
-;;
-;; GnuPG is distributed in the hope that it will be useful,
-;; but WITHOUT ANY WARRANTY; without even the implied warranty of
-;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-;; GNU General Public License for more details.
-;;
-;; You should have received a copy of the GNU General Public License
-;; along with this program; if not, see <http://www.gnu.org/licenses/>.
-
-(load (with-path "defs.scm"))
-(setup-environment)
-
-(catch (skip "Tofu not supported")
-       (call-check `(, at gpg --trust-model=tofu --list-config)))
-
-;; Redefine GPG without --always-trust and TOFU trust model.
-(define gpg `(,(tool 'gpg) --no-permission-warning --trust-model=tofu))
-
-(info "Checking key creation with TOFU trust model (issue2929).")
-(call-check `(, at gpg --quick-generate-key frob at example.org))
-(call-check `(, at gpg --sign gpg.conf))
-(call-check `(, at gpg --verify gpg.conf.gpg))

-----------------------------------------------------------------------

Summary of changes:
 tests/openpgp/Makefile.am   |  3 +--
 tests/openpgp/issue2929.scm | 32 --------------------------------
 2 files changed, 1 insertion(+), 34 deletions(-)
 delete mode 100644 tests/openpgp/issue2929.scm


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 30 14:23:26 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 30 Jan 2017 14:23:26 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-40-g7bd6ab4
Message-ID: <E1cYBvc-0001jv-Cv@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  7bd6ab4a91d43d7cbf5d347c0c12e0e4f9f7e3bf (commit)
      from  f3ca2c9ce9fd4a03e293065f10b92589a7e642d6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 7bd6ab4a91d43d7cbf5d347c0c12e0e4f9f7e3bf
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jan 30 14:19:52 2017 +0100

    tests: Reduce iterations / threads
    
    * tests/gpg/t-gpgconf.c (main): Reduce iterations to 10.
    * tests/gpg/t-thread-keylist-verify.c,
    tests/gpg/t-thread-keylist.c (THREAD_COUNT): Reduce to 10.
    
    --
    While these tests tested for race conditions a smaller number
    of iteration should still show problems if they are run on
    multiple systems and regulary. While the 100 Thread count in
    the t-thread tests could lead to resource problems.

diff --git a/tests/gpg/t-gpgconf.c b/tests/gpg/t-gpgconf.c
index 52f0f8b..67bb886 100644
--- a/tests/gpg/t-gpgconf.c
+++ b/tests/gpg/t-gpgconf.c
@@ -256,7 +256,7 @@ main (void)
   gpgme_conf_comp_t conf;
   gpgme_conf_comp_t comp;
   int first;
-  int i, N = 100;
+  int i, N = 10;
 
   init_gpgme (GPGME_PROTOCOL_GPGCONF);
 
diff --git a/tests/gpg/t-thread-keylist-verify.c b/tests/gpg/t-thread-keylist-verify.c
index 6f747a6..b327a1f 100644
--- a/tests/gpg/t-thread-keylist-verify.c
+++ b/tests/gpg/t-thread-keylist-verify.c
@@ -32,7 +32,7 @@
 
 #include "t-support.h"
 
-#define THREAD_COUNT 100
+#define THREAD_COUNT 10
 
 static const char test_text1[] = "Just GNU it!\n";
 static const char test_sig1[] =
diff --git a/tests/gpg/t-thread-keylist.c b/tests/gpg/t-thread-keylist.c
index c03f1ca..b9feeda 100644
--- a/tests/gpg/t-thread-keylist.c
+++ b/tests/gpg/t-thread-keylist.c
@@ -32,7 +32,7 @@
 
 #include "t-support.h"
 
-#define THREAD_COUNT 100
+#define THREAD_COUNT 10
 
 void *
 start_keylist (void *arg)

-----------------------------------------------------------------------

Summary of changes:
 tests/gpg/t-gpgconf.c               | 2 +-
 tests/gpg/t-thread-keylist-verify.c | 2 +-
 tests/gpg/t-thread-keylist.c        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jan 30 18:25:00 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Mon, 30 Jan 2017 18:25:00 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-36-g49e2ae6
Message-ID: <E1cYFhQ-00062H-FO@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  49e2ae65e892f93be7f87cfaae3392b50a99e4b1 (commit)
       via  e343984fc50e87830905614dc87f83f810551ad1 (commit)
       via  d27a4435bd8c0f0971d51ddf454422fc77d48271 (commit)
       via  489edf84c9a9c2122cef1b4e678154521525b54a (commit)
      from  59048b0f1aa77313573a1004cd3a9f02692a7521 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 49e2ae65e892f93be7f87cfaae3392b50a99e4b1
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 30 15:51:19 2017 +0100

    gpgscm: Use a compact vector representation.
    
    * tests/gpgscm/scheme-private.h (struct cell): Add a compact vector
    representation.
    * tests/gpgscm/scheme.c (vector_length): Use new representation.
    (vector_size): New macro.
    (get_vector_object): Use the new representation.
    (fill_vector): Likewise.
    (vector_elem): Likewise.
    (set_vector_elem): Likewise.
    (mark): Likewise.
    (gc): Likewise.  Be careful not to confuse immediate values for type
    flags.
    (finalize_cell): Vectors now require finalization.
    --
    
    Previously, vectors were represented using consecutive cons cells,
    wasting one word per cell for the type information.  Fix that by using
    a flat array.
    
    Previously, a vector of size N required 1 + (n + 1) / 2 cells.  Now it
    uses 1 + (n - 1 + 2) / 3 cells.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme-private.h b/tests/gpgscm/scheme-private.h
index aba2319..ad8f571 100644
--- a/tests/gpgscm/scheme-private.h
+++ b/tests/gpgscm/scheme-private.h
@@ -56,6 +56,10 @@ struct cell {
       struct cell *_cdr;
     } _cons;
     struct {
+      size_t _length;
+      pointer _elements[0];
+    } _vector;
+    struct {
          char *_data;
          const foreign_object_vtable *_vtable;
     } _foreign_object;
diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index 32d8032..86df851 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -226,7 +226,11 @@ INTERFACE INLINE int is_string(pointer p)     { return (type(p)==T_STRING); }
 
 INTERFACE static int is_list(scheme *sc, pointer p);
 INTERFACE INLINE int is_vector(pointer p)    { return (type(p)==T_VECTOR); }
-#define vector_length(v)	ivalue_unchecked(v)
+/* Given a vector, return it's length.  */
+#define vector_length(v)	(v)->_object._vector._length
+/* Given a vector length, compute the amount of cells required to
+ * represent it.  */
+#define vector_size(len)	(1 + ((len) - 1 + 2) / 3)
 INTERFACE static void fill_vector(pointer vec, pointer obj);
 INTERFACE static pointer vector_elem(pointer vec, int ielem);
 INTERFACE static pointer set_vector_elem(pointer vec, int ielem, pointer a);
@@ -1035,12 +1039,11 @@ static pointer get_cell(scheme *sc, pointer a, pointer b)
 
 static pointer get_vector_object(scheme *sc, int len, pointer init)
 {
-  pointer cells = get_consecutive_cells(sc,len/2+len%2+1);
+  pointer cells = get_consecutive_cells(sc, vector_size(len));
   if(sc->no_memory) { return sc->sink; }
   /* Record it as a vector so that gc understands it. */
-  typeflag(cells) = (T_VECTOR | T_ATOM);
+  typeflag(cells) = (T_VECTOR | T_ATOM | T_FINALIZE);
   vector_length(cells) = len;
-  set_num_integer(cells);
   fill_vector(cells,init);
   if (gc_enabled (sc))
     push_recent_alloc(sc, cells, sc->NIL);
@@ -1340,32 +1343,24 @@ INTERFACE static pointer mk_vector(scheme *sc, int len)
 { return get_vector_object(sc,len,sc->NIL); }
 
 INTERFACE static void fill_vector(pointer vec, pointer obj) {
-     int i;
-     int n = vector_length(vec) / 2 + vector_length(vec) % 2;
-     for(i=0; i < n; i++) {
-          typeflag(vec+1+i) = T_PAIR;
-          setimmutable(vec+1+i);
-          car(vec+1+i)=obj;
-          cdr(vec+1+i)=obj;
+     size_t i;
+     assert (is_vector (vec));
+     for(i = 0; i < vector_length(vec); i++) {
+          vec->_object._vector._elements[i] = set_immediate(obj);
      }
 }
 
 INTERFACE static pointer vector_elem(pointer vec, int ielem) {
-     int n=ielem/2;
-     if(ielem%2==0) {
-          return car(vec+1+n);
-     } else {
-          return cdr(vec+1+n);
-     }
+     assert (is_vector (vec));
+     assert (ielem < vector_length(vec));
+     return clr_immediate(vec->_object._vector._elements[ielem]);
 }
 
 INTERFACE static pointer set_vector_elem(pointer vec, int ielem, pointer a) {
-     int n=ielem/2;
-     if(ielem%2==0) {
-          return car(vec+1+n)=a;
-     } else {
-          return cdr(vec+1+n)=a;
-     }
+     assert (is_vector (vec));
+     assert (ielem < vector_length(vec));
+     vec->_object._vector._elements[ielem] = set_immediate(a);
+     return a;
 }
 
 /* get new symbol */
@@ -1563,10 +1558,8 @@ static void mark(pointer a) {
 E2:  setmark(p);
      if(is_vector(p)) {
           int i;
-          int n = vector_length(p) / 2 + vector_length(p) % 2;
-          for(i=0; i < n; i++) {
-               /* Vector cells will be treated like ordinary cells */
-               mark(p+1+i);
+          for (i = 0; i < vector_length(p); i++) {
+               mark(clr_immediate(p->_object._vector._elements[i]));
           }
      }
 #if SHOW_ERROR_LINE
@@ -1672,6 +1665,8 @@ static void gc(scheme *sc, pointer a, pointer b) {
   for (i = sc->last_cell_seg; i >= 0; i--) {
     p = sc->cell_seg[i] + CELL_SEGSIZE;
     while (--p >= sc->cell_seg[i]) {
+      if (typeflag(p) & IMMEDIATE_TAG)
+        continue;
       if (is_mark(p)) {
     clrmark(p);
       } else {
@@ -1708,6 +1703,16 @@ static void finalize_cell(scheme *sc, pointer a) {
     sc->free(a->_object._port);
   } else if(is_foreign_object(a)) {
     a->_object._foreign_object._vtable->finalize(sc, a->_object._foreign_object._data);
+  } else if (is_vector(a)) {
+    int i;
+    for (i = vector_size(vector_length(a)) - 1; i > 0; i--) {
+      pointer p = a + i;
+      typeflag(p) = 0;
+      car(p) = sc->NIL;
+      cdr(p) = sc->free_cell;
+      sc->free_cell = p;
+      sc->fcells += 1;
+    }
   }
 }
 

commit e343984fc50e87830905614dc87f83f810551ad1
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 30 15:45:13 2017 +0100

    gpgscm: Provide framework for immediate values.
    
    * tests/gpgscm/scheme.c (IMMEDIATE_TAG): New macro.
    ({is,set,clr}_immediate): Likewise.
    (enum scheme_types): Make type tags disjoint from immediate values.
    (TYPE_BITS): We need one more bit now.
    (ADJ,T_MASKTYPE): Compute values.
    --
    Immediate values are disjoint from all type tags and pointers,
    allowing us to store immediate values in all memory locations.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index 311f606..32d8032 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -111,27 +111,43 @@ static const char *strlwr(char *s) {
 # define FIRST_CELLSEGS 3
 #endif
 
+

+
+/* Support for immediate values.
+ *
+ * Immediate values are tagged with IMMEDIATE_TAG, which is neither
+ * used in types, nor in pointer values.
+ *
+ * XXX: Currently, we only use this to tag pointers in vectors.  */
+#define IMMEDIATE_TAG		1
+#define is_immediate(p)		((pointer) ((uintptr_t) (p) &  IMMEDIATE_TAG))
+#define set_immediate(p)	((pointer) ((uintptr_t) (p) |  IMMEDIATE_TAG))
+#define clr_immediate(p)	((pointer) ((uintptr_t) (p) & ~IMMEDIATE_TAG))
+
+

+
 enum scheme_types {
-  T_STRING=1,
-  T_NUMBER=2,
-  T_SYMBOL=3,
-  T_PROC=4,
-  T_PAIR=5,
-  T_CLOSURE=6,
-  T_CONTINUATION=7,
-  T_FOREIGN=8,
-  T_CHARACTER=9,
-  T_PORT=10,
-  T_VECTOR=11,
-  T_MACRO=12,
-  T_PROMISE=13,
-  T_ENVIRONMENT=14,
-  T_FOREIGN_OBJECT=15,
-  T_BOOLEAN=16,
-  T_NIL=17,
-  T_EOF_OBJ=18,
-  T_SINK=19,
-  T_LAST_SYSTEM_TYPE=19
+  T_STRING=1 << 1,	/* Do not use the lsb, it is used for
+			 * immediate values.  */
+  T_NUMBER=2 << 1,
+  T_SYMBOL=3 << 1,
+  T_PROC=4 << 1,
+  T_PAIR=5 << 1,
+  T_CLOSURE=6 << 1,
+  T_CONTINUATION=7 << 1,
+  T_FOREIGN=8 << 1,
+  T_CHARACTER=9 << 1,
+  T_PORT=10 << 1,
+  T_VECTOR=11 << 1,
+  T_MACRO=12 << 1,
+  T_PROMISE=13 << 1,
+  T_ENVIRONMENT=14 << 1,
+  T_FOREIGN_OBJECT=15 << 1,
+  T_BOOLEAN=16 << 1,
+  T_NIL=17 << 1,
+  T_EOF_OBJ=18 << 1,
+  T_SINK=19 << 1,
+  T_LAST_SYSTEM_TYPE=19 << 1
 };
 
 static const char *
@@ -163,9 +179,9 @@ type_to_string (enum scheme_types typ)
 }
 
 /* ADJ is enough slack to align cells in a TYPE_BITS-bit boundary */
-#define ADJ 32
-#define TYPE_BITS 5
-#define T_MASKTYPE      31    /* 0000000000011111 */
+#define TYPE_BITS	6
+#define ADJ		(1 << TYPE_BITS)
+#define T_MASKTYPE      (ADJ - 1)
 #define T_TAGGED      1024    /* 0000010000000000 */
 #define T_FINALIZE    2048    /* 0000100000000000 */
 #define T_SYNTAX      4096    /* 0001000000000000 */

commit d27a4435bd8c0f0971d51ddf454422fc77d48271
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 30 17:08:27 2017 +0100

    gpgscm: Fix setting the line of the first gc reservation.
    
    * tests/gpgscm/scheme.c (_gc_disable): Negate guard.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index 7bb03e8..311f606 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -794,7 +794,7 @@ _gc_disable(struct scheme *sc, size_t reserve, int lineno)
   if (sc->inhibit_gc == 0) {
     reserve_cells(sc, (reserve));
     sc->reserved_cells = (reserve);
-#ifndef NDEBUG
+#ifdef NDEBUG
     (void) lineno;
 #else
     sc->reserved_lineno = lineno;

commit 489edf84c9a9c2122cef1b4e678154521525b54a
Author: Justus Winter <justus at g10code.com>
Date:   Mon Jan 30 15:39:57 2017 +0100

    gpgscm: Introduce macro for the vector length.
    
    * tests/gpgscm/scheme.c (vector_length): New macro.
    (get_vector_object): Use the new macro.
    (oblist_add_by_name): Likewise.
    (oblist_find_by_name): Likewise.
    (oblist_all_symbols): Likewise.
    (mk_vector): Likewise.
    (mark): Likewise.
    (new_slot_spec_in_env): Likewise.
    (find_slot_spec_in_env): Likewise.
    (opexe_2): Likewise.
    (opexe_5): Likewise.
    --
    
    Introducing an abstraction reduces the coupling between code using
    vectors and the implementation of vectors.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index c4725db..7bb03e8 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -210,6 +210,7 @@ INTERFACE INLINE int is_string(pointer p)     { return (type(p)==T_STRING); }
 
 INTERFACE static int is_list(scheme *sc, pointer p);
 INTERFACE INLINE int is_vector(pointer p)    { return (type(p)==T_VECTOR); }
+#define vector_length(v)	ivalue_unchecked(v)
 INTERFACE static void fill_vector(pointer vec, pointer obj);
 INTERFACE static pointer vector_elem(pointer vec, int ielem);
 INTERFACE static pointer set_vector_elem(pointer vec, int ielem, pointer a);
@@ -1022,7 +1023,7 @@ static pointer get_vector_object(scheme *sc, int len, pointer init)
   if(sc->no_memory) { return sc->sink; }
   /* Record it as a vector so that gc understands it. */
   typeflag(cells) = (T_VECTOR | T_ATOM);
-  ivalue_unchecked(cells)=len;
+  vector_length(cells) = len;
   set_num_integer(cells);
   fill_vector(cells,init);
   if (gc_enabled (sc))
@@ -1092,7 +1093,7 @@ static pointer oblist_add_by_name(scheme *sc, const char *name)
   typeflag(x) = T_SYMBOL;
   setimmutable(car(x));
 
-  location = hash_fn(name, ivalue_unchecked(sc->oblist));
+  location = hash_fn(name, vector_length(sc->oblist));
   set_vector_elem(sc->oblist, location,
                   immutable_cons(sc, x, vector_elem(sc->oblist, location)));
   gc_enable(sc);
@@ -1105,7 +1106,7 @@ static INLINE pointer oblist_find_by_name(scheme *sc, const char *name)
   pointer x;
   char *s;
 
-  location = hash_fn(name, ivalue_unchecked(sc->oblist));
+  location = hash_fn(name, vector_length(sc->oblist));
   for (x = vector_elem(sc->oblist, location); x != sc->NIL; x = cdr(x)) {
     s = symname(car(x));
     /* case-insensitive, per R5RS section 2. */
@@ -1122,7 +1123,7 @@ static pointer oblist_all_symbols(scheme *sc)
   pointer x;
   pointer ob_list = sc->NIL;
 
-  for (i = 0; i < ivalue_unchecked(sc->oblist); i++) {
+  for (i = 0; i < vector_length(sc->oblist); i++) {
     for (x  = vector_elem(sc->oblist, i); x != sc->NIL; x = cdr(x)) {
       ob_list = cons(sc, x, ob_list);
     }
@@ -1324,7 +1325,7 @@ INTERFACE static pointer mk_vector(scheme *sc, int len)
 
 INTERFACE static void fill_vector(pointer vec, pointer obj) {
      int i;
-     int n = ivalue(vec)/2+ivalue(vec)%2;
+     int n = vector_length(vec) / 2 + vector_length(vec) % 2;
      for(i=0; i < n; i++) {
           typeflag(vec+1+i) = T_PAIR;
           setimmutable(vec+1+i);
@@ -1546,7 +1547,7 @@ static void mark(pointer a) {
 E2:  setmark(p);
      if(is_vector(p)) {
           int i;
-          int n = ivalue_unchecked(p)/2+ivalue_unchecked(p)%2;
+          int n = vector_length(p) / 2 + vector_length(p) % 2;
           for(i=0; i < n; i++) {
                /* Vector cells will be treated like ordinary cells */
                mark(p+1+i);
@@ -2615,7 +2616,7 @@ static INLINE void new_slot_spec_in_env(scheme *sc, pointer env,
   slot = immutable_cons(sc, variable, value);
 
   if (is_vector(car(env))) {
-    int location = hash_fn(symname(variable), ivalue_unchecked(car(env)));
+    int location = hash_fn(symname(variable), vector_length(car(env)));
 
     set_vector_elem(car(env), location,
                     immutable_cons(sc, slot, vector_elem(car(env), location)));
@@ -2632,7 +2633,7 @@ static pointer find_slot_in_env(scheme *sc, pointer env, pointer hdl, int all)
 
   for (x = env; x != sc->NIL; x = cdr(x)) {
     if (is_vector(car(x))) {
-      location = hash_fn(symname(hdl), ivalue_unchecked(car(x)));
+      location = hash_fn(symname(hdl), vector_length(car(x)));
       y = vector_elem(car(x), location);
     } else {
       y = car(x);
@@ -4366,14 +4367,14 @@ static pointer opexe_2(scheme *sc, enum scheme_opcodes op) {
 
      CASE(OP_VECLEN):  /* vector-length */
 	  gc_disable(sc, 1);
-          s_return_enable_gc(sc, mk_integer(sc, ivalue(car(sc->args))));
+          s_return_enable_gc(sc, mk_integer(sc, vector_length(car(sc->args))));
 
      CASE(OP_VECREF): { /* vector-ref */
           int index;
 
           index=ivalue(cadr(sc->args));
 
-          if(index>=ivalue(car(sc->args))) {
+          if(index >= vector_length(car(sc->args))) {
                Error_1(sc,"vector-ref: out of bounds:",cadr(sc->args));
           }
 
@@ -4388,7 +4389,7 @@ static pointer opexe_2(scheme *sc, enum scheme_opcodes op) {
           }
 
           index=ivalue(cadr(sc->args));
-          if(index>=ivalue(car(sc->args))) {
+          if(index >= vector_length(car(sc->args))) {
                Error_1(sc,"vector-set!: out of bounds:",cadr(sc->args));
           }
 
@@ -5082,7 +5083,7 @@ static pointer opexe_5(scheme *sc, enum scheme_opcodes op) {
      CASE(OP_PVECFROM): {
           int i=ivalue_unchecked(cdr(sc->args));
           pointer vec=car(sc->args);
-          int len=ivalue_unchecked(vec);
+          int len = vector_length(vec);
           if(i==len) {
                putstr(sc,")");
                s_return(sc,sc->T);

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgscm/scheme-private.h |   4 ++
 tests/gpgscm/scheme.c         | 142 ++++++++++++++++++++++++------------------
 2 files changed, 86 insertions(+), 60 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 31 05:05:42 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 31 Jan 2017 05:05:42 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-37-gf08d37a
Message-ID: <E1cYPhR-0000VP-7N@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  f08d37af049bf1718b301644020658dd2bb07638 (commit)
      from  49e2ae65e892f93be7f87cfaae3392b50a99e4b1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f08d37af049bf1718b301644020658dd2bb07638
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jan 31 12:56:11 2017 +0900

    scd: Fix SERIALNO for multiple devices.
    
    * scd/app.c (select_application): Fix the logic if periodical check is
    needed.  If it is needed for newly found device(s), kick the loop.
    (scd_update_reader_status_file): Return value if select(2) should be
    called with timeout.
    * scd/ccid-driver.c (ccid_require_get_status): Don't return 0 for
    token with no interrupt transfer for now.
    * scd/command.c (open_card_with_request): Fix scan by SERIALNO.
    * scd/scdaemon.c (update_usb): Remove.
    (handle_connections): Evaluate need_tick after handle_tick.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app.c b/scd/app.c
index 2cf7d11..5b8da1c 100644
--- a/scd/app.c
+++ b/scd/app.c
@@ -333,6 +333,7 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app,
       struct dev_list *l;
       int periodical_check_needed = 0;
 
+      /* Scan the devices to find new device(s).  */
       err = apdu_dev_list_start (opt.reader_port, &l);
       if (err)
         return err;
@@ -340,14 +341,14 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app,
       while (1)
         {
           int slot;
-          int periodical_check_needed;
+          int periodical_check_needed_this;
 
           slot = apdu_open_reader (l);
           if (slot < 0)
             break;
 
-          periodical_check_needed = apdu_connect (slot);
-          if (periodical_check_needed < 0)
+          periodical_check_needed_this = apdu_connect (slot);
+          if (periodical_check_needed_this < 0)
             {
               /* We close a reader with no card.  */
               err = gpg_error (GPG_ERR_ENODEV);
@@ -355,8 +356,8 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app,
           else
             {
               err = app_new_register (slot, ctrl, name,
-                                      periodical_check_needed);
-              if (periodical_check_needed)
+                                      periodical_check_needed_this);
+              if (periodical_check_needed_this)
                 periodical_check_needed = 1;
             }
 
@@ -365,7 +366,11 @@ select_application (ctrl_t ctrl, const char *name, app_t *r_app,
         }
 
       apdu_dev_list_finish (l);
-      update_usb (periodical_check_needed);
+
+      /* If periodical check is needed for new device(s), kick the
+       scdaemon loop.  */
+      if (periodical_check_needed)
+        scd_kick_the_loop ();
     }
 
   npth_mutex_lock (&app_list_lock);
@@ -1011,12 +1016,11 @@ report_change (int slot, int old_status, int cur_status)
   xfree (homestr);
 }
 
-void
+int
 scd_update_reader_status_file (void)
 {
   app_t a, app_next;
   int periodical_check_needed = 0;
-  int removal_detected = 0;
 
   npth_mutex_lock (&app_list_lock);
   for (a = app_top; a; a = app_next)
@@ -1050,7 +1054,6 @@ scd_update_reader_status_file (void)
               log_debug ("Removal of a card: %d\n", a->slot);
               apdu_close_reader (a->slot);
               deallocate_app (a);
-              removal_detected = 1;
             }
           else
             {
@@ -1067,8 +1070,7 @@ scd_update_reader_status_file (void)
     }
   npth_mutex_unlock (&app_list_lock);
 
-  if (removal_detected)
-    update_usb (periodical_check_needed);
+  return periodical_check_needed;
 }
 
 /* This function must be called once to initialize this module.  This
diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index 7124c6e..1a01ff0 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -2073,17 +2073,28 @@ ccid_open_reader (const char *spec_reader_name, int idx,
 int
 ccid_require_get_status (ccid_driver_t handle)
 {
+  /* When a card reader supports interrupt transfer to check the
+     status of card, it is possible to submit only an interrupt
+     transfer, and no check is required by application layer.  USB can
+     detect removal of a card and can detect removal of a reader.
+  */
   if (handle->ep_intr >= 0)
     return 0;
 
-  /* Here comes products check for tokens which
-     always have card inserted.  */
-  switch (handle->id_vendor)
-    {
-    case VENDOR_FSIJ:
-      return 0;
-    }
+  /* Libusb actually detects the removal of USB device in use.
+     However, there is no good API to handle the removal (yet),
+     cleanly and with good portability.
+
+     There is libusb_set_pollfd_notifiers function, but it doesn't
+     offer libusb_device_handle* data to its callback.  So, when it
+     watches multiple devices, there is no way to know which device is
+     removed.
 
+     Once, we will have a good programming interface of libusb, we can
+     list tokens (with no interrupt transfer support, but always with
+     card inserted) here to return 0, so that scdaemon can submit
+     minimum packet on wire.
+  */
   return 1;
 }
 
diff --git a/scd/command.c b/scd/command.c
index 26f8630..0ae6d29 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -217,13 +217,18 @@ open_card_with_request (ctrl_t ctrl, const char *apptype, const char *serialno)
   gpg_error_t err;
   unsigned char *serialno_bin = NULL;
   size_t serialno_bin_len = 0;
+  app_t app = ctrl->app_ctx;
 
   /* If we are already initialized for one specific application we
      need to check that the client didn't requested a specific
      application different from the one in use before we continue. */
-  if (ctrl->app_ctx)
+  if (apptype && ctrl->app_ctx)
     return check_application_conflict (apptype, ctrl->app_ctx);
 
+  /* Re-scan USB devices.  Release APP, before the scan.  */
+  ctrl->app_ctx = NULL;
+  release_application (app);
+
   if (serialno)
     serialno_bin = hex_to_buffer (serialno, &serialno_bin_len);
 
diff --git a/scd/scdaemon.c b/scd/scdaemon.c
index e2a6ba8..3cc3507 100644
--- a/scd/scdaemon.c
+++ b/scd/scdaemon.c
@@ -61,10 +61,10 @@
 
 enum cmd_and_opt_values
 { aNull = 0,
-  oCsh		  = 'c',
-  oQuiet	  = 'q',
-  oSh		  = 's',
-  oVerbose	  = 'v',
+  oCsh            = 'c',
+  oQuiet          = 'q',
+  oSh             = 's',
+  oVerbose        = 'v',
 
   oNoVerbose = 500,
   aGPGConfList,
@@ -115,11 +115,11 @@ static ARGPARSE_OPTS opts[] = {
                 N_("run in multi server mode (foreground)")),
   ARGPARSE_s_n (oDaemon, "daemon", N_("run in daemon mode (background)")),
   ARGPARSE_s_n (oVerbose, "verbose", N_("verbose")),
-  ARGPARSE_s_n (oQuiet,	"quiet", N_("be somewhat more quiet")),
-  ARGPARSE_s_n (oSh,	"sh", N_("sh-style command output")),
-  ARGPARSE_s_n (oCsh,	"csh", N_("csh-style command output")),
+  ARGPARSE_s_n (oQuiet, "quiet", N_("be somewhat more quiet")),
+  ARGPARSE_s_n (oSh,    "sh", N_("sh-style command output")),
+  ARGPARSE_s_n (oCsh,   "csh", N_("csh-style command output")),
   ARGPARSE_s_s (oOptions, "options", N_("|FILE|read options from FILE")),
-  ARGPARSE_s_s (oDebug,	"debug", "@"),
+  ARGPARSE_s_s (oDebug, "debug", "@"),
   ARGPARSE_s_n (oDebugAll, "debug-all", "@"),
   ARGPARSE_s_s (oDebugLevel, "debug-level" ,
                 N_("|LEVEL|set the debugging level to LEVEL")),
@@ -461,13 +461,13 @@ main (int argc, char **argv )
         parse_debug++;
       else if (pargs.r_opt == oOptions)
         { /* yes there is one, so we do not try the default one, but
-	     read the option file when it is encountered at the
-	     commandline */
+             read the option file when it is encountered at the
+             commandline */
           default_config = 0;
-	}
-	else if (pargs.r_opt == oNoOptions)
+        }
+        else if (pargs.r_opt == oNoOptions)
           default_config = 0; /* --no-options */
-	else if (pargs.r_opt == oHomedir)
+        else if (pargs.r_opt == oHomedir)
           gnupg_set_homedir (pargs.r.ret_str);
     }
 
@@ -502,16 +502,16 @@ main (int argc, char **argv )
               if( parse_debug )
                 log_info (_("Note: no default option file '%s'\n"),
                           configname );
-	    }
+            }
           else
             {
               log_error (_("option file '%s': %s\n"),
                          configname, strerror(errno) );
               exit(2);
-	    }
+            }
           xfree (configname);
           configname = NULL;
-	}
+        }
       if (parse_debug && configname )
         log_info (_("reading options from '%s'\n"), configname );
       default_config = 0;
@@ -558,10 +558,10 @@ main (int argc, char **argv )
           /* config files may not be nested (silently ignore them) */
           if (!configfp)
             {
-		xfree(configname);
-		configname = xstrdup(pargs.r.ret_str);
-		goto next_pass;
-	    }
+                xfree(configname);
+                configname = xstrdup(pargs.r.ret_str);
+                goto next_pass;
+            }
           break;
         case oNoGreeting: nogreeting = 1; break;
         case oNoVerbose: opt.verbose = 0; break;
@@ -593,12 +593,12 @@ main (int argc, char **argv )
           add_to_strlist (&opt.disabled_applications, pargs.r.ret_str);
           break;
 
-	case oEnablePinpadVarlen: opt.enable_pinpad_varlen = 1; break;
+        case oEnablePinpadVarlen: opt.enable_pinpad_varlen = 1; break;
 
         default:
           pargs.err = configfp? ARGPARSE_PRINT_WARNING:ARGPARSE_PRINT_ERROR;
           break;
-	}
+        }
     }
   if (configfp)
     {
@@ -661,7 +661,7 @@ main (int argc, char **argv )
       char *filename_esc;
 
       if (config_filename)
-	filename = xstrdup (config_filename);
+        filename = xstrdup (config_filename);
       else
         filename = make_filename (gnupg_homedir (),
                                   SCDAEMON_NAME EXTSEP_S "conf", NULL);
@@ -1035,7 +1035,7 @@ static void
 handle_tick (void)
 {
   if (!ticker_disabled)
-    scd_update_reader_status_file ();
+    usb_periodical_check = scd_update_reader_status_file ();
 }
 
 
@@ -1187,13 +1187,6 @@ start_connection_thread (void *arg)
 
 
 void
-update_usb (int periodical_check_needed)
-{
-  usb_periodical_check = periodical_check_needed;
-  log_debug ("update_usb (%d)\n", periodical_check_needed);
-}
-
-void
 scd_kick_the_loop (void)
 {
   /* Kick the select loop.  */
@@ -1226,8 +1219,6 @@ handle_connections (int listen_fd)
   int nfd;
   int ret;
   int fd;
-  struct timespec abstime;
-  struct timespec curtime;
   struct timespec timeout;
   struct timespec *t;
   int saved_errno;
@@ -1275,12 +1266,6 @@ handle_connections (int listen_fd)
   if (nfd < pipe_fd[0])
     nfd = pipe_fd[0];
 
-  npth_clock_gettime (&curtime);
-  timeout.tv_sec = TIMERTICK_INTERVAL_SEC;
-  timeout.tv_nsec = TIMERTICK_INTERVAL_USEC * 1000;
-  npth_timeradd (&curtime, &timeout, &abstime);
-  /* We only require abstime here.  The others will be reused.  */
-
   for (;;)
     {
       if (shutdown_pending)
@@ -1298,25 +1283,16 @@ handle_connections (int listen_fd)
           listen_fd = -1;
         }
 
-      if ((listen_fd != -1 && nfd == listen_fd)
-          || need_tick ())
-        {
-          npth_clock_gettime (&curtime);
-          if (!(npth_timercmp (&curtime, &abstime, <)))
-            {
-              /* Timeout.  */
-              timeout.tv_sec = TIMERTICK_INTERVAL_SEC;
-              timeout.tv_nsec = TIMERTICK_INTERVAL_USEC * 1000;
-              npth_timeradd (&curtime, &timeout, &abstime);
-            }
-          npth_timersub (&abstime, &curtime, &timeout);
-          t = &timeout;
-        }
+      handle_tick ();
+
+      timeout.tv_sec = TIMERTICK_INTERVAL_SEC;
+      timeout.tv_nsec = TIMERTICK_INTERVAL_USEC * 1000;
+
+      if (need_tick ())
+        t = &timeout;
       else
         t = NULL;
 
-      handle_tick ();
-
       /* POSIX says that fd_set should be implemented as a structure,
          thus a simple assignment is fine to copy the entire set.  */
       read_fdset = fdset;
diff --git a/scd/scdaemon.h b/scd/scdaemon.h
index 6d950b5..37590b6 100644
--- a/scd/scdaemon.h
+++ b/scd/scdaemon.h
@@ -123,9 +123,10 @@ int  scd_command_handler (ctrl_t, int);
 void send_status_info (ctrl_t ctrl, const char *keyword, ...)
      GPGRT_ATTR_SENTINEL(1);
 void send_status_direct (ctrl_t ctrl, const char *keyword, const char *args);
-void scd_update_reader_status_file (void);
 void send_client_notifications (app_t app, int removal);
-void update_usb (int periodical_check_needed);
 void scd_kick_the_loop (void);
 
+/*-- app.c --*/
+int scd_update_reader_status_file (void);
+
 #endif /*SCDAEMON_H*/

-----------------------------------------------------------------------

Summary of changes:
 scd/app.c         | 24 +++++++++-------
 scd/ccid-driver.c | 25 +++++++++++-----
 scd/command.c     |  7 ++++-
 scd/scdaemon.c    | 86 ++++++++++++++++++++-----------------------------------
 scd/scdaemon.h    |  5 ++--
 5 files changed, 71 insertions(+), 76 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 31 07:32:18 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 31 Jan 2017 07:32:18 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-38-ge17fa5c
Message-ID: <E1cYRzI-0006YM-VM@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e17fa5c75d76af4d4684ee810cb446ecd5110560 (commit)
      from  f08d37af049bf1718b301644020658dd2bb07638 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e17fa5c75d76af4d4684ee810cb446ecd5110560
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jan 31 15:29:08 2017 +0900

    scd: Remove --debug-disable-ticker option.
    
    * scd/scdaemon.c (ticker_disabled): Remove.
    (handle_tick, need_tick): Remove.
    (handle_connections): Don't check ticker_disabled.
    
    --
    
    Now, removal of device/card is only done by the function
    scd_update_reader_status_file, it should be called if needed.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/NEWS b/NEWS
index df45d8a..67b1cad 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,9 @@
 Noteworthy changes in version 2.1.19 (unreleased)
 -------------------------------------------------
 
+  * scd: Removed option --debug-disable-ticker.  Ticker is used
+    only when it is required to watch removal of device/card.
+
 
 Noteworthy changes in version 2.1.18 (2017-01-23)
 -------------------------------------------------
diff --git a/scd/scdaemon.c b/scd/scdaemon.c
index 3cc3507..7972abd 100644
--- a/scd/scdaemon.c
+++ b/scd/scdaemon.c
@@ -99,7 +99,6 @@ enum cmd_and_opt_values
   oDenyAdmin,
   oDisableApplication,
   oEnablePinpadVarlen,
-  oDebugDisableTicker
 };
 
 
@@ -126,7 +125,6 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_s_i (oDebugWait, "debug-wait", "@"),
   ARGPARSE_s_n (oDebugAllowCoreDump, "debug-allow-core-dump", "@"),
   ARGPARSE_s_n (oDebugCCIDDriver, "debug-ccid-driver", "@"),
-  ARGPARSE_s_n (oDebugDisableTicker, "debug-disable-ticker", "@"),
   ARGPARSE_s_n (oDebugLogTid, "debug-log-tid", "@"),
   ARGPARSE_p_u (oDebugAssuanLogCats, "debug-assuan-log-cats", "@"),
   ARGPARSE_s_n (oNoDetach, "no-detach", N_("do not detach from the console")),
@@ -190,8 +188,13 @@ static struct debug_flags_s debug_flags [] =
 #define DEFAULT_PCSC_DRIVER "libpcsclite.so"
 #endif
 
-/* The timer tick used for housekeeping stuff.  We poll every 500ms to
-   let the user immediately know a status change.
+/* The timer tick used to check card removal.
+
+   We poll every 500ms to let the user immediately know a status
+   change.
+
+   For a card reader with an interrupt endpoint, this timer is not
+   used with the internal CCID driver.
 
    This is not too good for power saving but given that there is no
    easy way to block on card status changes it is the best we can do.
@@ -221,13 +224,6 @@ static char *redir_socket_name;
    POSIX systems). */
 static assuan_sock_nonce_t socket_nonce;
 
-/* Debug flag to disable the ticker.  The ticker is in fact not
-   disabled but it won't perform any ticker specific actions. */
-static int ticker_disabled;
-
-/* Set if usb devices require periodical check.  */
-static int usb_periodical_check;
-
 /* FD to notify update of usb devices.  */
 static int notify_fd;
 

@@ -546,7 +542,6 @@ main (int argc, char **argv )
           ccid_set_debug_level (ccid_set_debug_level (-1)+1);
 #endif /*HAVE_LIBUSB*/
           break;
-        case oDebugDisableTicker: ticker_disabled = 1; break;
         case oDebugLogTid:
           log_set_pid_suffix_cb (tid_log_callback);
           break;
@@ -1031,14 +1026,6 @@ handle_signal (int signo)
 #endif /*!HAVE_W32_SYSTEM*/
 
 
-static void
-handle_tick (void)
-{
-  if (!ticker_disabled)
-    usb_periodical_check = scd_update_reader_status_file ();
-}
-
-
 /* Create a name for the socket.  We check for valid characters as
    well as against a maximum allowed length for a unix domain socket
    is done.  The function terminates the process in case of an error.
@@ -1193,18 +1180,6 @@ scd_kick_the_loop (void)
   write (notify_fd, "", 1);
 }
 
-static int
-need_tick (void)
-{
-  if (shutdown_pending)
-    return 1;
-
-  if (!usb_periodical_check)
-    return 0;
-
-  return 1;
-}
-
 /* Connection handler loop.  Wait for connection requests and spawn a
    thread after accepting a connection.  LISTEN_FD is allowed to be -1
    in which case this code will only do regular timeouts and handle
@@ -1268,6 +1243,8 @@ handle_connections (int listen_fd)
 
   for (;;)
     {
+      int periodical_check;
+
       if (shutdown_pending)
         {
           if (active_connections == 0)
@@ -1283,12 +1260,12 @@ handle_connections (int listen_fd)
           listen_fd = -1;
         }
 
-      handle_tick ();
+      periodical_check = scd_update_reader_status_file ();
 
       timeout.tv_sec = TIMERTICK_INTERVAL_SEC;
       timeout.tv_nsec = TIMERTICK_INTERVAL_USEC * 1000;
 
-      if (need_tick ())
+      if (shutdown_pending || periodical_check)
         t = &timeout;
       else
         t = NULL;

-----------------------------------------------------------------------

Summary of changes:
 NEWS           |  3 +++
 scd/scdaemon.c | 45 +++++++++++----------------------------------
 2 files changed, 14 insertions(+), 34 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 31 09:46:53 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 31 Jan 2017 09:46:53 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-41-g752d359
Message-ID: <E1cYU5Y-00041b-25@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  752d3597ef02a95efd693373132bf1e246f0edb0 (commit)
      from  7bd6ab4a91d43d7cbf5d347c0c12e0e4f9f7e3bf (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 752d3597ef02a95efd693373132bf1e246f0edb0
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 31 09:44:29 2017 +0100

    core: Add new context flag "redraw".
    
    * src/context.h (struct gpgme_context): New field 'redraw_suggested'.
    * src/op-support.c (_gpgme_op_reset): Clear REDRAW_SUGGESTED.
    * src/progress.c (_gpgme_progress_status_handler): Set REDRAW_SUGGESTED.
    * src/gpgme.c (gpgme_set_ctx_flag, gpgme_get_ctx_flag): Add "redraw".
    * tests/run-sign.c (main): Use it.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/gpgme.texi b/doc/gpgme.texi
index 511384f..99627c4 100644
--- a/doc/gpgme.texi
+++ b/doc/gpgme.texi
@@ -2888,6 +2888,29 @@ by this function.  The properties are identified by the following
 values for @var{name}:
 
 @table @code
+ at item "redraw"
+This flag is normally not changed by the caller because GPGME sets and
+clears it automatically: The flag is cleared before an operation and
+set if an operation noticed that the engine has launched a Pinentry.
+A Curses based application may use this information to redraw the
+screen; for example:
+
+ at example
+    err = gpgme_op_keylist_start (ctx, "foo@@example.org", 0);
+    while (!err)
+      @{
+        err = gpgme_op_keylist_next (ctx, &key);
+        if (err)
+          break;
+        show_key (key);
+        gpgme_key_release (key);
+      @}
+    if ((s = gpgme_get_ctx_flag (ctx, "redraw")) && *s)
+      redraw_screen ();
+    gpgme_release (ctx);
+ at end example
+
+
 @item "full-status"
 Using a @var{value} of "1" the status callback set by
 gpgme_set_status_cb returns all status lines with the exception of
diff --git a/src/context.h b/src/context.h
index 1a8698c..d0542d9 100644
--- a/src/context.h
+++ b/src/context.h
@@ -114,10 +114,14 @@ struct gpgme_context
   /* True if session keys should be exported upon decryption.  */
   unsigned int export_session_keys : 1;
 
+  /* True if a Pinentry was launched during the last operation.  This
+   * flag is cleared with each operation.  */
+  unsigned int redraw_suggested : 1;
+
   /* Flags for keylist mode.  */
   gpgme_keylist_mode_t keylist_mode;
 
-  /* The current pinnetry mode.  */
+  /* The current pinentry mode.  */
   gpgme_pinentry_mode_t pinentry_mode;
 
   /* Number of certs to be included.  */
diff --git a/src/gpgme.c b/src/gpgme.c
index cf767c7..2b196a2 100644
--- a/src/gpgme.c
+++ b/src/gpgme.c
@@ -508,6 +508,10 @@ gpgme_set_ctx_flag (gpgme_ctx_t ctx, const char *name, const char *value)
 
   if (!ctx || !name || !value)
     err = gpg_error (GPG_ERR_INV_VALUE);
+  else if (!strcmp (name, "redraw"))
+    {
+      ctx->redraw_suggested = abool;
+    }
   else if (!strcmp (name, "full-status"))
     {
       ctx->full_status = abool;
@@ -544,6 +548,10 @@ gpgme_get_ctx_flag (gpgme_ctx_t ctx, const char *name)
 {
   if (!ctx || !name)
     return NULL;
+  else if (!strcmp (name, "redraw"))
+    {
+      return ctx->redraw_suggested? "1":"";
+    }
   else if (!strcmp (name, "full-status"))
     {
       return ctx->full_status? "1":"";
diff --git a/src/op-support.c b/src/op-support.c
index d9217ec..817c569 100644
--- a/src/op-support.c
+++ b/src/op-support.c
@@ -94,6 +94,7 @@ _gpgme_op_reset (gpgme_ctx_t ctx, int type)
   _gpgme_release_result (ctx);
   LOCK (ctx->lock);
   ctx->canceled = 0;
+  ctx->redraw_suggested = 0;
   UNLOCK (ctx->lock);
 
   if (ctx->engine && no_reset)
diff --git a/src/progress.c b/src/progress.c
index c10ccaa..066a7f5 100644
--- a/src/progress.c
+++ b/src/progress.c
@@ -31,6 +31,8 @@
 #include "debug.h"
 
 
+/* The status handler for progress status lines which also monitors
+ * the PINENTRY_LAUNCHED status.  */
 gpgme_error_t
 _gpgme_progress_status_handler (void *priv, gpgme_status_code_t code,
 				char *args)
@@ -42,6 +44,12 @@ _gpgme_progress_status_handler (void *priv, gpgme_status_code_t code,
   int current = 0;
   int total = 0;
 
+  if (code == GPGME_STATUS_PINENTRY_LAUNCHED)
+    {
+      ctx->redraw_suggested = 1;
+      return 0;
+    }
+
   if (code != GPGME_STATUS_PROGRESS || !*args || !ctx->progress_cb)
     return 0;
 
diff --git a/tests/run-sign.c b/tests/run-sign.c
index 9f2e175..1daf173 100644
--- a/tests/run-sign.c
+++ b/tests/run-sign.c
@@ -103,6 +103,7 @@ main (int argc, char **argv)
   int print_status = 0;
   int use_loopback = 0;
   const char *sender = NULL;
+  const char *s;
 
   if (argc)
     { argc--; argv++; }
@@ -229,6 +230,9 @@ main (int argc, char **argv)
       exit (1);
     }
 
+  if ((s = gpgme_get_ctx_flag (ctx, "redraw")) && *s)
+    fputs ("Screen redraw suggested\n", stdout);
+
   fputs ("Begin Output:\n", stdout);
   print_data (out);
   fputs ("End Output.\n", stdout);

-----------------------------------------------------------------------

Summary of changes:
 doc/gpgme.texi   | 23 +++++++++++++++++++++++
 src/context.h    |  6 +++++-
 src/gpgme.c      |  8 ++++++++
 src/op-support.c |  1 +
 src/progress.c   |  8 ++++++++
 tests/run-sign.c |  4 ++++
 6 files changed, 49 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 31 12:02:47 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 31 Jan 2017 12:02:47 +0100
Subject: [git] GPGME - branch, master, updated. gpgme-1.8.0-42-gba594d8
Message-ID: <E1cYWD3-0001c6-S1@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  ba594d85e35e63301755977234d3af88a167a215 (commit)
      from  752d3597ef02a95efd693373132bf1e246f0edb0 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ba594d85e35e63301755977234d3af88a167a215
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 31 10:47:00 2017 +0100

    qt: Increase timeout when waiting for signals.
    
    * lang/qt/tests/t-support.h (QSIGNALSPY_TIMEOUT): New macro.
    * lang/qt/tests/t-encrypt.cpp: Use the new macro as timeout when
    waiting for signals.
    * lang/qt/tests/t-keylist.cpp: Likewise.
    * lang/qt/tests/t-keylocate.cpp: Likewise.
    * lang/qt/tests/t-ownertrust.cpp: Likewise.
    * lang/qt/tests/t-wkspublish.cpp: Likewise.
    --
    Increase the timeout when waiting for signals from 5 seconds to 60.
    This addresses intermittent test failures on slow machines.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/lang/qt/tests/t-encrypt.cpp b/lang/qt/tests/t-encrypt.cpp
index 57b586d..ba4a1c5 100644
--- a/lang/qt/tests/t-encrypt.cpp
+++ b/lang/qt/tests/t-encrypt.cpp
@@ -165,7 +165,7 @@ private Q_SLOTS:
 
         job->start(keys, inptr, outptr, Context::AlwaysTrust);
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
     }
 
     void testSymmetricEncryptDecrypt()
diff --git a/lang/qt/tests/t-keylist.cpp b/lang/qt/tests/t-keylist.cpp
index 5e88a5e..a140236 100644
--- a/lang/qt/tests/t-keylist.cpp
+++ b/lang/qt/tests/t-keylist.cpp
@@ -102,7 +102,7 @@ private Q_SLOTS:
         });
         job->start(QStringList() << "alfa at example.net");
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
     }
 };
 
diff --git a/lang/qt/tests/t-keylocate.cpp b/lang/qt/tests/t-keylocate.cpp
index 550305c..8c99c8b 100644
--- a/lang/qt/tests/t-keylocate.cpp
+++ b/lang/qt/tests/t-keylocate.cpp
@@ -88,7 +88,7 @@ private Q_SLOTS:
         });
         job->start(QStringList() << mTestpattern);
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
         qputenv("GNUPGHOME", oldHome.toUtf8());
     }
 #endif
@@ -122,7 +122,7 @@ private Q_SLOTS:
         });
         job->start(QStringList() << mTestpattern);
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
     }
 
 private:
diff --git a/lang/qt/tests/t-ownertrust.cpp b/lang/qt/tests/t-ownertrust.cpp
index f2fa3c8..e9a4378 100644
--- a/lang/qt/tests/t-ownertrust.cpp
+++ b/lang/qt/tests/t-ownertrust.cpp
@@ -78,7 +78,7 @@ private Q_SLOTS:
         });
         job2->start(key, Key::Ultimate);
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
 
         job = openpgp()->keyListJob(false, true, true);
         result = job->exec(QStringList() << QStringLiteral("alfa at example.net"),
@@ -94,7 +94,7 @@ private Q_SLOTS:
             Q_EMIT asyncDone();
         });
         job3->start(key, Key::Unknown);
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
 
         job = openpgp()->keyListJob(false, true, true);
         result = job->exec(QStringList() << QStringLiteral("alfa at example.net"),
diff --git a/lang/qt/tests/t-support.h b/lang/qt/tests/t-support.h
index e3f0e78..b03b05d 100644
--- a/lang/qt/tests/t-support.h
+++ b/lang/qt/tests/t-support.h
@@ -64,4 +64,8 @@ public Q_SLOTS:
     void cleanupTestCase();
 };
 
+/* Timeout, in milliseconds, for use with QSignalSpy to wait on
+   signals.  */
+#define QSIGNALSPY_TIMEOUT	60000
+
 #endif // T_SUPPORT_H
diff --git a/lang/qt/tests/t-wkspublish.cpp b/lang/qt/tests/t-wkspublish.cpp
index 64f101e..c51e8f9 100644
--- a/lang/qt/tests/t-wkspublish.cpp
+++ b/lang/qt/tests/t-wkspublish.cpp
@@ -132,7 +132,7 @@ private Q_SLOTS:
         });
         job->startCheck ("testuser1 at localhost");
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
     }
 #ifdef DO_ONLINE_TESTS
 private Q_SLOTS:
@@ -155,7 +155,7 @@ private:
         });
         job->startCheck ("testuser1 at test.gnupg.org");
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
     }
 
     void testWKSPublishErrors() {
@@ -172,7 +172,7 @@ private:
         job->startCreate("AB874F24E98EBB8487EE7B170F8E3D97FE7011B7",
                          QStringLiteral("Foo at bar.baz"));
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
     }
 
     void testWKSPublishCreate() {
@@ -206,7 +206,7 @@ private:
         });
         keygenjob->start(args);
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
 
         /* Then try to create a request. */
         auto job = openpgp()->wksPublishJob();
@@ -223,7 +223,7 @@ private:
                      QStringLiteral("From: " TEST_ADDRESS)));
         });
         job->startCreate(fpr.constData(), QLatin1String(TEST_ADDRESS));
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
     }
 
     void testWKSPublishReceive() {
@@ -242,7 +242,7 @@ private:
         });
         importjob->start(QByteArray(testSecKey));
         QSignalSpy spy (this, SIGNAL(asyncDone()));
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
 
         /* Get a response. */
         auto job = openpgp()->wksPublishJob();
@@ -259,7 +259,7 @@ private:
                      QStringLiteral("From: " TEST_ADDRESS)));
         });
         job->startReceive(QByteArray(testResponse));
-        QVERIFY(spy.wait());
+        QVERIFY(spy.wait(QSIGNALSPY_TIMEOUT));
     }
 
     void initTestCase()

-----------------------------------------------------------------------

Summary of changes:
 lang/qt/tests/t-encrypt.cpp    |  2 +-
 lang/qt/tests/t-keylist.cpp    |  2 +-
 lang/qt/tests/t-keylocate.cpp  |  4 ++--
 lang/qt/tests/t-ownertrust.cpp |  4 ++--
 lang/qt/tests/t-support.h      |  4 ++++
 lang/qt/tests/t-wkspublish.cpp | 14 +++++++-------
 6 files changed, 17 insertions(+), 13 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 31 12:09:45 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 31 Jan 2017 12:09:45 +0100
Subject: [git] gnupg-doc - branch, master,
 updated. 706f736fdbc9ef00d6606a45e73bf5169e9ce4ea
Message-ID: <E1cYWJn-0001ea-My@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  706f736fdbc9ef00d6606a45e73bf5169e9ce4ea (commit)
       via  64ef954ef4f510631e40868341bab8132d1ec45b (commit)
       via  eef1640bf8edee36e7c6415d02277ea2faa42a7a (commit)
       via  d44b8be4a96cf662c53cdc79067bdaad4715e11a (commit)
      from  f3e5af9fb68b7f499ce76b0a05a8eeb0f14aab78 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 706f736fdbc9ef00d6606a45e73bf5169e9ce4ea
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 31 12:07:13 2017 +0100

    drafts,openpgp-webkey-service: Published -03

diff --git a/misc/id/openpgp-webkey-service/draft-koch-openpgp-webkey-service-03.txt b/misc/id/openpgp-webkey-service/draft-koch-openpgp-webkey-service-03.txt
new file mode 100644
index 0000000..12a1c90
--- /dev/null
+++ b/misc/id/openpgp-webkey-service/draft-koch-openpgp-webkey-service-03.txt
@@ -0,0 +1,952 @@
+
+
+
+
+Network Working Group                                            W. Koch
+Internet-Draft                                             GnuPG Project
+Intended status: Informational                          January 31, 2017
+Expires: August 4, 2017
+
+
+                        OpenPGP Web Key Service
+                  draft-koch-openpgp-webkey-service-03
+
+Abstract
+
+   This specification describes a service to locate OpenPGP keys by mail
+   address using a Web service and the HTTPS protocol.  It also provides
+   a method for secure communication between the key owner and the mail
+   provider to publish and revoke the public key.
+
+Status of This Memo
+
+   This Internet-Draft is submitted in full conformance with the
+   provisions of BCP 78 and BCP 79.
+
+   Internet-Drafts are working documents of the Internet Engineering
+   Task Force (IETF).  Note that other groups may also distribute
+   working documents as Internet-Drafts.  The list of current Internet-
+   Drafts is at http://datatracker.ietf.org/drafts/current/.
+
+   Internet-Drafts are draft documents valid for a maximum of six months
+   and may be updated, replaced, or obsoleted by other documents at any
+   time.  It is inappropriate to use Internet-Drafts as reference
+   material or to cite them other than as "work in progress."
+
+   This Internet-Draft will expire on August 4, 2017.
+
+Copyright Notice
+
+   Copyright (c) 2017 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents
+   (http://trustee.ietf.org/license-info) in effect on the date of
+   publication of this document.  Please review these documents
+   carefully, as they describe your rights and restrictions with respect
+   to this document.  Code Components extracted from this document must
+   include Simplified BSD License text as described in Section 4.e of
+   the Trust Legal Provisions and are provided without warranty as
+   described in the Simplified BSD License.
+
+
+
+
+Koch                     Expires August 4, 2017                 [Page 1]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+Table of Contents
+
+   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
+   2.  Notational Conventions  . . . . . . . . . . . . . . . . . . .   2
+   3.  Web Key Directory . . . . . . . . . . . . . . . . . . . . . .   2
+     3.1.  Key Discovery . . . . . . . . . . . . . . . . . . . . . .   3
+   4.  Web Key Directory Update Protocol . . . . . . . . . . . . . .   5
+     4.1.  The Submission Address  . . . . . . . . . . . . . . . . .   6
+     4.2.  The Submission Mail . . . . . . . . . . . . . . . . . . .   6
+     4.3.  The Confirmation Request  . . . . . . . . . . . . . . . .   6
+     4.4.  The Confirmation Response . . . . . . . . . . . . . . . .   8
+     4.5.  Policy Flags  . . . . . . . . . . . . . . . . . . . . . .   9
+   5.  Security Considerations . . . . . . . . . . . . . . . . . . .   9
+   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  10
+     6.1.  Well-Known URI  . . . . . . . . . . . . . . . . . . . . .  10
+   7.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .  10
+   8.  Normative References  . . . . . . . . . . . . . . . . . . . .  10
+   Appendix A.  Sample Protocol Run  . . . . . . . . . . . . . . . .  11
+     A.1.  Sample Keys . . . . . . . . . . . . . . . . . . . . . . .  11
+     A.2.  Sample Messages . . . . . . . . . . . . . . . . . . . . .  12
+   Appendix B.  Changes Since -02  . . . . . . . . . . . . . . . . .  16
+   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  17
+
+1.  Introduction
+
+   This memo describes a method to associate OpenPGP keys with a mail
+   address and how to look them up using a web service with a well-known
+   URI.  In addition a mail based protocol is given to allow a client to
+   setup such an association and to maintain it.
+
+2.  Notational Conventions
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+   document are to be interpreted as described in [RFC2119].
+
+3.  Web Key Directory
+
+   A major use case for OpenPGP is the encryption of mail.  A common
+   difficulty of sending encrypted mails to a new communication partner
+   is to find the appropriate public key of the recipient.  Unless an
+   off-channel key exchange has been done, there are no easy ways to
+   discover the required key.  The common practice is to search the
+   network of public key servers for a key matching the recipient's mail
+   address.  This practise bears the problem that the keyservers are not
+   able to give a positive confirmation that a key actually belongs to
+   the mail addresses given in the key.  Further, there are often
+   several keys matching a mail address and thus one needs to pick a key
+
+
+
+Koch                     Expires August 4, 2017                 [Page 2]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+   on good luck.  This is clearly not a secure way to setup an end-to-
+   end encryption.  Even if the need for a trusted key for an initial
+   mail message is relinquished, a non-authenticated key may be a wrong
+   one and the actual recipient would receive a mail which she can't
+   decrypt, due to the use of a wrong key.
+
+   Methods to overcome this problem are
+
+   o  sending an initial unencrypted message with the public key
+      attached,
+
+   o  using the OpenPGP DANE protocol to lookup the recipients key via
+      the DNS.
+
+   The first method has the obvious problems of not even trying to
+   encrypt the initial mail, an extra mail round-trip, and problems with
+   unattended key discovery.
+
+   The latter method works fine but requires that mail providers need to
+   set up a separate DNS resolver to provide the key.  The
+   administration of a DNS zone is often not in the hands of small mail
+   installations.  Thus an update of the DNS resource records needs to
+   be delegated to the ISP running the DNS service.  Further, DNS
+   lookups are not encrypted and missing all confidentially.  Even if
+   the participating MUAs are using STARTTLS to encrypt the mail
+   exchange, a DNS lookup for the key unnecessarily identifies the
+   local-part of the recipients mail address to any passive
+   eavesdroppers.
+
+   This memo specified a new method for key discovery using an encrypted
+   https connection.
+
+3.1.  Key Discovery
+
+   Although URIs are able to encode all kind of characters,
+   straightforward implementations of a key directory may want to store
+   the local-part of a mail address directly in the file system.  This
+   forbids the use of certain characters in the local-part.  To allow
+   for such an implementation method the URI uses an encoded form of the
+   local-part which can be directly mapped to a file name.
+
+   OpenPGP defines its User IDs, and thus the mail address, as UTF-8
+   strings.  To help with the common pattern of using capitalized names
+   (e.g.  "Joe.Doe at example.org") for mail addresses, and under the
+   premise that almost all MTAs treat the local-part case-insensitive
+   and that the domain-part is required to be compared case-insensitive
+   anyway, all upper-case ASCII characters in a User ID are mapped to
+   lowercase.  Non-ASCII characters are not changed.
+
+
+
+Koch                     Expires August 4, 2017                 [Page 3]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+   The so mapped local-part is hashed using the SHA-1 algorithm.  The
+   resulting 160 bit digest is encoded using the Z-Base-32 method as
+   described in [RFC6189], section 5.1.6.  The resulting string has a
+   fixed length of 32 octets.  To form the URI, the following parts are
+   concatenated:
+
+   o  The scheme "https://",
+
+   o  the domain-part,
+
+   o  the string "/.well-known/openpgpkey/hu/",
+
+   o  and the above constructed 32 octet string.
+
+   For example the URI to lookup the key for Joe.Doe at Example.ORG is:
+
+     https://example.org/.well-known/openpgpkey/
+     hu/iy9q119eutrkn8s1mk4r39qejnbu3n5q
+
+   (line has been wrapped for rendering purposes)
+
+   DNS SRV resource records ([RFC2782]) may be used to query a different
+   host or a port other than 443.  For example:
+
+     _openpgpkey._tcp.example.org.  IN  SRV 0 0 8443 wkd.example.org.
+
+   changes the above to query the host "wkd.example.org" at port 8443
+   instead of the host "gnupg.org" at port 443.  The target (in the
+   example "wkd.example.org") MUST be a sub-domain of the domain-part
+   (here "example.org").  If the target is not a sub-domain, the SRV RR
+   MUST be be ignored.  The recommended name for the sub-domain is
+   "wkd".
+
+   The HTTP GET method MUST return the binary representation of the
+   OpenPGP key for the given mail address.  The key needs to carry a
+   User ID packet ([RFC4880]) with that mail address.  Note that the key
+   may be revoked or expired - it is up to the client to handle such
+   conditions.  To ease distribution of revoked keys, a server may
+   return revoked keys in addition to a new key.  The keys are returned
+   by a single request as concatenated key blocks.
+
+   The server MUST accept the HTTP HEAD method to allow a client to
+   check for the existence of a key.
+
+   The server SHOULD use "application/octet-string" as the Content-Type
+   for the data but clients SHOULD also accept any other Content-Type.
+   The server MUST NOT return an ASCII armored version of the key.
+
+
+
+
+Koch                     Expires August 4, 2017                 [Page 4]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+4.  Web Key Directory Update Protocol
+
+   To put keys into the key directory a protocol to automate the task is
+   desirable.  The protocol defined here is entirely based on mail and
+   the assumption that a mail provider can securely deliver mail to the
+   INBOX of a user (e.g. an IMAP folder).  Note that the same protocol
+   may also be used for submitting keys for use with OpenPGP DANE.
+
+   We assume that the user already created a key for her mail account
+   alice at example.org.  To install the key at her provider's Web Key
+   Directory, she performs the following steps:
+
+   1.  She retrieves a file which contains one line with the mail
+       address used to submit the key to the mail provider.  The DNS SRV
+       rules described for the Web Key Directory apply here as well.
+       See below for the syntax of that file.  For a mail address at the
+       domain "example.org" the URI of the file is
+
+       https://example.org/.well-known/openpgpkey/submission-address
+
+   2.  She sends her key using SMTP (or any other transport mechanism)
+       to the provider using the submission address and key format as
+       specified by PGP/MIME.
+
+   3.  The provider checks that the received key has a User ID which
+       matches an account name of the provider.
+
+   4.  The provider sends an encrypted message containing a nonce and
+       the fingerprint of the key to the mail account of the user.  Note
+       that a similar scheme is used by the well known caff(1) tool to
+       help with key signing parties.
+
+   5.  A legitimate user will be able to decrypt the message because she
+       created the key and is in charge of the private key.  This step
+       verifies that the submitted key has actually been created by the
+       owner of the account.
+
+   6.  The user sends the decrypted nonce back to the submission address
+       as a confirmation that the private key is owned by her and that
+       the provider may now publish the key.  Although technically not
+       required, it is suggested that the mail to the provider is
+       encrypted.  The public key for this is retrieved using the key
+       lookup protocol described above.
+
+   7.  The provider receives the nonce, matches it with its database of
+       pending confirmations and then publishes the key.  Finally the
+       provider sends a mail back to the user to notify her of the
+       publication of her key.
+
+
+
+Koch                     Expires August 4, 2017                 [Page 5]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+   The message data structures used for the above protocol are specified
+   in detail below.  In the following sections the string "WELLKNOWN"
+   denotes the first part of an URI specific for a domain.  In the
+   examples the domain "example.org" is assumed, thus
+
+     WELLKNOWN := https://example.org/.well-known/openpgpkey
+
+   The term "target key" denotes the to be published key, the term
+   "submission key" the key associated with the submission-address of
+   the mail provider.
+
+4.1.  The Submission Address
+
+   The address of the submission file is
+
+     WELLKNOWN/submission-address
+
+   The file consists of exactly one line, terminated by a LF, or the
+   sequence of CR and LF, with the full mail address to be used for
+   submission of a key to the mail provider.  For example the content of
+   the file may be
+
+     key-submission-example.org at directory.example.org
+
+4.2.  The Submission Mail
+
+   The mail used to submit a key to the mail provider MUST comply to the
+   PGP/MIME specification ([RFC3156], section 7), which states that the
+   Content-Type must be "application/pgp-keys", there are no required or
+   optional parameters, and the body part contains the ASCII-armored
+   transferable Public Key Packets as defined in [RFC4880], section
+   11.1.
+
+   The mail provider MUST publish a key capable of signing and
+   encryption for the submission-address in the Web Key Directory or via
+   DANE.  The key to be published MUST be submitted using a PGP/MIME
+   encrypted message ([RFC3156], section 4).  The message MUST NOT be
+   signed (because the authenticity of the signing key has not yet been
+   confirmed).  After decryption of the message at the mail provider a
+   single "application/pgp-keys" part, as specified above, is expected.
+
+4.3.  The Confirmation Request
+
+   The mail provider sends a confirmation mail in response to a received
+   key publication request.  The message MUST be sent from the
+   submission-address of the mail provider to the mail address extracted
+   from the target key.  The message needs to be a PGP/MIME signed
+
+
+
+
+Koch                     Expires August 4, 2017                 [Page 6]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+   message using the submission key of the provider for the signature.
+   The signed message MUST have two parts:
+
+   The first part MUST have "text" as its Content-Type and can be used
+   to explain the purpose of the mail.  For example it may point to this
+   RFC and explain on how to manually perform the protocol.
+
+   The second part MUST have "application/vnd.gnupg.wkd" as its Content-
+   Type and carry an OpenPGP encrypted message in ASCII Armor format.
+   The message MUST be encrypted to the target key and MUST NOT be
+   signed.  After decryption a text file in the Web Key data format must
+   be yielded.
+
+   That data format consists of name-value pairs with one name-value
+   pair per LF or CR+LF terminated line.  Empty lines are allowed and
+   will be ignored by the receiver.  A colon is used to terminate a
+   name.
+
+   In a confirmation request the following names MUST be send in the
+   specified order:
+
+   o  "type": The value must be "confirmation-request".
+
+   o  "sender": This is the mailbox the user is expected to sent the
+      confirmation response to.  The value must match the mailbox part
+      of the "From:" address of this request.  Exactly one address MUST
+      be given.
+
+   o  "address": The value is the addr-spec part of the target key's
+      mail address.  The value SHOULD match the addr-spec part of the
+      recipient's address.  The value MUST be UTF-8 encoded as required
+      for an OpenPGP User ID.
+
+   o  "fingerprint": The value is the fingerprint of the target key.
+      The fingerprint is given in uppercase hex encoding without any
+      interleaving spaces.
+
+   o  "nonce": The value is a string with a minimum length of 16 octets
+      and a maximum length of 64 octets.  The string must entirely be
+      made up of random ASCII letters or digits.  This nonce will be
+      sent back to the mail provider as proof that the recipient is the
+      legitimate owner of the target-key.
+
+   The receiver of that message is expected to verify the outer
+   signature and disregard the entire message if it can't be verified or
+   has not been signed by the key associated with the submission
+   address.
+
+
+
+
+Koch                     Expires August 4, 2017                 [Page 7]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+   After the message as been verified the receiver decrypts the second
+   part of the message, checks that the "fingerprint" matches the target
+   key, checks that the "address" matches a User ID of the target key,
+   and checks the other constrains of the request format.  If any
+   constraint is not asserted, or the fingerprint or User ID do not
+   match the target key, or there is no pending publication requests
+   (i.e. a mail recently sent o the submission address), the user MAY be
+   notified about this fake confirmation attempt.
+
+   In other cases the confirmation request is legitimate and the MUA
+   shall silently send a response as described in the next section.
+
+   The rationale for the outer signature used with this request is to
+   allow early detection of spam mails.  This can be done prior to the
+   decryption step and avoids asking the user to enter a passphrase to
+   perform the decryption for a non-legitimate message.  The use of a
+   simple encrypted attachment, instead of using PGP/MIME encryption, is
+   to convey the Content-Type of that attachment in the clear and also
+   to prevent automatic decryption of that attachment by PGP/MIME aware
+   clients.  The MUA may in fact detect this confirmation request and
+   present a customized dialog for confirming that request.
+
+4.4.  The Confirmation Response
+
+   A response to a confirmation request MUST only be send in the
+   positive case; there is no negative confirmation response.  A mail
+   service provider is expected to cancel a pending key submission after
+   a suitable time without a confirmation.  The mail service provider
+   SHOULD NOT retry the sending of a confirmation request after the
+   first request has been send successfully.
+
+   The user MUST send the confirmation response from her target mail
+   address to the "from" address of the confirmation request.  The
+   message MUST be signed and encrypted using the PGP/MIME Combined
+   format ([RFC3156], section 6.2).  The signing key is the target key
+   and the encryption key is the key associated with the provider's
+   submission address.
+
+   The Content-Type used for the plaintext message MUST also be
+   "application/vnd.gnupg.wkd".  The format is the same as described
+   above for the Confirmation Request.  The body must contain three
+   name-value pairs in this order:
+
+   o  "type": The value must be "confirmation-response".
+
+   o  "sender": The value must match the mailbox part of the "From:"
+      address of this response.  Exactly one address MUST be given.
+
+
+
+
+Koch                     Expires August 4, 2017                 [Page 8]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+   o  "nonce": The value is the value of the "nonce" parameter from the
+      confirmation request.
+
+4.5.  Policy Flags
+
+   For key generation and submission it is sometimes useful to tell the
+   client about certain properties of the mail provider in advance.
+   This can be done with a file at the URL
+
+     WELLKNOWN/policy
+
+   The file contains keywords and optioanlly values, one per line with
+   each line terminated by a LF or the sequence of CR and LF.  Empty
+   lines and lines starting with a '#' character are considered comment
+   lines.  A keyword is made up of lowercase letters, digits, hyphens,
+   or dots.  An underscore is allowed as a name space delimiters; see
+   below.  The first character must be a letter.  Keywords which are
+   defined to require a value are directly followed by a colon and then
+   after optional white space the value.  Clients MUST use case-
+   insensitive matching for the keyword.
+
+   Currently defined keywords are:
+
+   o  "mailbox-only": The mail server provider does only accept keys
+      with only a mailbox in the User ID.  In particular User IDs with a
+      real name in addition to the mailbox will be rejected as invalid.
+
+   o  "dane-only": The mail server provider does not run a Web Key
+      Directory but only an OpenPGP DANE service.  The Web Key Directory
+      Update protocol is used to update the keys for the DANE service.
+
+   o  "auth-submit": The submission of the mail to the server is done
+      using an authenticated connection.  Thus the submitted key will be
+      published immediately without any confirmation request.
+
+   More keywords will be defined in updates to this I-D.  There is no
+   registry except for this document.  For experimental use of new
+   features or for provider specific settings, keywords MUST be prefixed
+   with a domain name and an underscore.
+
+5.  Security Considerations
+
+   The use of SHA-1 for the mapping of the local-part to a fixed string
+   is not a security feature but merely used to map the local-part to a
+   fixed-sized string made from a well defined set of characters.  It is
+   not intended to conceal information about a mail address.
+
+
+
+
+
+Koch                     Expires August 4, 2017                 [Page 9]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+   The domain name part of the mail address is not part of the hash to
+   avoid problems with internationalized domain names.  Instead a
+   separate URL is required for each domain name.
+
+   The use of DNS SRV records reduces the certainty that a mail address
+   belongs to a domain.  For example an attacker may change the target
+   to a host in a sub-domain under their control and thus gain full
+   control over all keys.  An implementation may want to weight the
+   certainty of a mapping different if it has been retrieved via a sub-
+   domain and in particular if a non-recommended name is used for the
+   sub-domain.
+
+6.  IANA Considerations
+
+6.1.  Well-Known URI
+
+   IANA is requested to assign a well-known URI in the "Well-Known URIs"
+   registry as defined by [RFC5785]:
+
+   URI suffix: openpgpkey
+
+   Change controller: IETF
+
+   Specification document: This
+
+7.  Acknowledgments
+
+   The author would like to acknowledge the help of the individuals who
+   kindly voiced their opinions on the GnuPG mailing lists, in
+   particular, the help of Bernhard Reiter and Guilhem Moulin.
+
+8.  Normative References
+
+   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
+              Requirement Levels", BCP 14, RFC 2119, March 1997.
+
+   [RFC2782]  Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR for
+              specifying the location of services (DNS SRV)", RFC 2782,
+              DOI 10.17487/RFC2782, February 2000,
+              <http://www.rfc-editor.org/info/rfc2782>.
+
+   [RFC3156]  Elkins, M., Del Torto, D., Levien, R., and T. Roessler,
+              "MIME Security with OpenPGP", RFC 3156, August 2001.
+
+   [RFC4880]  Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R.
+              Thayer, "OpenPGP Message Format", RFC 4880, November 2007.
+
+
+
+
+
+Koch                     Expires August 4, 2017                [Page 10]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+   [RFC5785]  Nottingham, M. and E. Hammer-Lahav, "Defining Well-Known
+              Uniform Resource Identifiers (URIs)", RFC 5785, DOI
+              10.17487/RFC5785, April 2010,
+              <http://www.rfc-editor.org/info/rfc5785>.
+
+   [RFC6189]  Zimmermann, P., Johnston, A., Ed., and J. Callas, "ZRTP:
+              Media Path Key Agreement for Unicast Secure RTP", RFC
+              6189, DOI 10.17487/RFC6189, April 2011,
+              <http://www.rfc-editor.org/info/rfc6189>.
+
+Appendix A.  Sample Protocol Run
+
+   The following non-normative example can be used by implementors as
+   guidance.
+
+   Note that GnuPG version 2.1.12 supports the key discovery described
+   in version -00 of this document (auto-key-locate method "wkd").
+   Version 2.1.16 can run the protocol decribed in this document but is
+   also able to run the protocol version specified by -01.
+
+A.1.  Sample Keys
+
+   This is the provider's submission key:
+
+     -----BEGIN PGP PRIVATE KEY BLOCK-----
+
+     lFgEV/TAohYJKwYBBAHaRw8BAQdAB/k9YQfSTI8qQqqK1KimH/BsvzsowWItSQPT
+     FP+fOC4AAP46uJ3Snno3Vy+kORye3rf0VvWvuz82voEQLxG6WpfHhREEtBprZXkt
+     c3VibWlzc2lvbkBleGFtcGxlLm5ldIh5BBMWCAAhBQJX9MCiAhsDBQsJCAcCBhUI
+     CQoLAgQWAgMBAh4BAheAAAoJEKhtNooW0cqEWMUA/0e9XaeptszWC9ZvPg8INL6a
+     BvRqPBYGU7PGmuXsxBovAQDyckOykG0UAfHVyN1w4gSK/biMcnqVr857i8/HuvjW
+     C5xdBFf0wKISCisGAQQBl1UBBQEBB0Apvaoe4MtSEJ1fpds/4DFl2kXXBpnVji/s
+     Wg9btdthNQMBCAcAAP9FJX99T1LEJzBnvBBnc6bimnT6/1OKM9RdO4R0/uVP6BFL
+     iGEEGBYIAAkFAlf0wKICGwwACgkQqG02ihbRyoTlGwD9FBr92osjL7HkhhZZ7Z2D
+     My3b9zpoZeMjvPg5YPqpdKMA/jhZoHuZCRMBYf7YRFb8aXtuyetDFZYrkjnum+OG
+     HFAD
+     =Hnwd
+     -----END PGP PRIVATE KEY BLOCK-----
+
+   This is the target key to be published:
+
+
+
+
+
+
+
+
+
+
+
+Koch                     Expires August 4, 2017                [Page 11]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+     -----BEGIN PGP PRIVATE KEY BLOCK-----
+
+     lFgEV2o9XRYJKwYBBAHaRw8BAQdAZ8zkuQDL9x7rcvvoo6s3iEF1j88Dknd9nZhL
+     nTEoBRkAAP94nCZMM4WY2IORXfM6phLGSz3RsHvs/vA1Opaus4+R3BKJtBtwYXRy
+     aWNlLmx1bXVtYmFAZXhhbXBsZS5uZXSIeQQTFggAIQUCV2o9XQIbAwULCQgHAgYV
+     CAkKCwIEFgIDAQIeAQIXgAAKCRATlWNoKgINCpkNAQDFDcwJUzsxu7aJUiPdpYXj
+     4uVarrXakxEE8mGFotWhLAD9GH4rqLDYIE3NKEU0s+Okt4tEIwJaV8H1NNPPPMiK
+     3g2cXQRXaj2NEgorBgEEAZdVAQUBAQdAFnnmZc99TuKk5iCq9wmYZUVF2RcXN2Cs
+     qAl8iGQQUWsDAQgHAAD/VN/VGmlcwGBPcLTya2hfU4t37nMcFCKdNSXjJ5DFA0AP
+     PohhBBgWCAAJBQJXaj2NAhsMAAoJEBOVY2gqAg0Ky4UA/0GmVaXzXemLvv1Xw4yx
+     Eaz/KfKKGc4RJ+38fyqUzw8NAQCohQ+ki3I5f84EXLZEiUiLsnVtOn1HNxvND/gW
+     TiFZBA==
+     =GHi7
+     -----END PGP PRIVATE KEY BLOCK-----
+
+A.2.  Sample Messages
+
+   The first message triggeres the publication requests.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Koch                     Expires August 4, 2017                [Page 12]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+     From: patrice.lumumba at example.net
+     To: key-submission at example.net
+     Subject: Key publishing request
+     MIME-Version: 1.0
+     Content-Type: multipart/encrypted;
+             protocol="application/pgp-encrypted";
+             boundary="=-=01-e8k41e11ob31eefa36wo=-="
+     Date: Wed, 05 Oct 2016 10:15:51 +0000
+
+
+     --=-=01-e8k41e11ob31eefa36wo=-=
+     Content-Type: application/pgp-encrypted
+
+     Version: 1
+
+     --=-=01-e8k41e11ob31eefa36wo=-=
+     Content-Type: application/octet-stream
+
+     -----BEGIN PGP MESSAGE-----
+
+     hF4DUgLY5tvmW2sSAQdAR1AcqvFpQe/fHRZbf0xcnl9Tb+AtwaX2yZnZXGELGHsw
+     1/e3E0JptwM5tpRAVe71ooF8Zq4jl76ZgQKfj/SyjpLJxyoEDy2N5wTQaqW4JtML
+     0ukB1vh7dIRDxBJX/LQIJC0wz8o1Q3vjcLJKFFvDb7YrerABpPIzwOAupcgIbQHj
+     5m1+2WU5CL8ffyJy2h1jV2X4OnvWF1Sn6J6SVD6DfZpOPRt9TxSemJrN1LJ3lG0N
+     ts8AuYmCOeC1H2r5TYyxqkC98JF8+Nvyxd/fwne8IOjK9uixkNMC5H9/ZOH0YWCb
+     wBnNB4iXuym4OIPxiLkDymsVF0ww/XrODE9Y259EGmO45VFNrJAX3HFs9/PcMCVk
+     n2qMyEkr8LHiXeEPun6Z54RHUPYv2cUkEZ0hhSJ+rtBxkc/5D/cAScCEXRKFSKEF
+     jLJAvLK/u/ga5DAzVai+vh6b6Bq+YVPaD9GWMhWj4CgR90p9LULi6S/Hzwhv9Wzf
+     8fJoJOaDjyvRDgr09jYLWamxkS9NWxqwy6MXJvxwbNdd5XtqiW4Y4o0Ll1hDJhxR
+     ljn/XvotXKwhKN+4QGhIXDVt4Dl4XxS5ptWfVTau8W8DYqDsU2obEcfsirZv53M1
+     Q9FCD8CD9+dkBt8VAJekCWVhEltcRHxlrznbk2jxm93xSD2o6gZ5X0VSaSUXyEhm
+     J+8F3gyTHGgbq/TgyjFoockWh5EtGgAFuWvmPJCF5PO/UaNeoKwgwSJBu6oTXkHx
+     R4nvvMRcj5UgTsKpZ79NiDQukbjG5ScNT5TCUiiZsBXBqBx3fD61EH6cAuh4P3Kr
+     iM7PY4fwAHo890Dx+Qlt
+     =WIhx
+     -----END PGP MESSAGE-----
+
+     --=-=01-e8k41e11ob31eefa36wo=-=--
+
+   The server decrypts this message to
+
+
+
+
+
+
+
+
+
+
+
+Koch                     Expires August 4, 2017                [Page 13]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+     Content-Type: application/pgp-keys
+
+     -----BEGIN PGP PUBLIC KEY BLOCK-----
+
+     mDMEV2o9XRYJKwYBBAHaRw8BAQdAZ8zkuQDL9x7rcvvoo6s3iEF1j88Dknd9nZhL
+     nTEoBRm0G3BhdHJpY2UubHVtdW1iYUBleGFtcGxlLm5ldIh5BBMWCAAhBQJXaj1d
+     AhsDBQsJCAcCBhUICQoLAgQWAgMBAh4BAheAAAoJEBOVY2gqAg0KmQ0BAMUNzAlT
+     OzG7tolSI92lhePi5VqutdqTEQTyYYWi1aEsAP0YfiuosNggTc0oRTSz46S3i0Qj
+     AlpXwfU00888yIreDbg4BFdqPY0SCisGAQQBl1UBBQEBB0AWeeZlz31O4qTmIKr3
+     CZhlRUXZFxc3YKyoCXyIZBBRawMBCAeIYQQYFggACQUCV2o9jQIbDAAKCRATlWNo
+     KgINCsuFAP9BplWl813pi779V8OMsRGs/ynyihnOESft/H8qlM8PDQEAqIUPpIty
+     OX/OBFy2RIlIi7J1bTp9RzcbzQ/4Fk4hWQQ=
+     =qRfF
+     -----END PGP PUBLIC KEY BLOCK-----
+
+   and returns this confirmation request
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Koch                     Expires August 4, 2017                [Page 14]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+     From: key-submission at example.net
+     To: patrice.lumumba at example.net
+     Subject: Confirm your key publication
+     MIME-Version: 1.0
+     Content-Type: multipart/encrypted;
+             protocol="application/pgp-encrypted";
+             boundary="=-=01-wrzqued738dfx4x97u7y=-="
+     Date: Wed, 05 Oct 2016 10:16:57 +0000
+
+
+     --=-=01-wrzqued738dfx4x97u7y=-=
+     Content-Type: application/pgp-encrypted
+
+     Version: 1
+
+     --=-=01-wrzqued738dfx4x97u7y=-=
+     Content-Type: application/octet-stream
+
+     -----BEGIN PGP MESSAGE-----
+
+     hF4DkYWHjk/NdMASAQdAluQeqhECpU2T0zEyBAEbFzhLkpubN160wjkFCrtUc0Mw
+     FwYgM2fp9cvTMdJ/xjkvmAcIEOT4AY/hn1yFQ4z0KG0gCkSac+8mkDylnPdxlXYw
+     0sBSAXlbqpVA7eUpFuU2Zs10zbIXxlwe6osR5wUIJut/RCOsYQmfvxC55x8mUX5/
+     zgTnNzlMzye5ws4pTgAeQm2x0Yv018L8IZgY5KxwJLBzlss0wLZ45ZcS80hR11Fx
+     NCow1fKF8lMnOJxagTEOih807nctz8vT5bR1gx0d7N3LM+th8nAg9/6Ghf1XTpLo
+     MzwGW0FtOG7Dg1Uxbw2bjaOuRBeh6IIpmNAw1pmIfnNu7PpoRydU5w1K/R8MT06z
+     MKdJ7IW5mVGes9EGnG3e4mjuILvNaZhfYy+a73IhDSaPm3oqdl1Qx7tbNg6lGjn6
+     KStCYAcPGPp3m7aWkfsPGThOVRhEXqaFFywfwSVEj1pdIRjDFA==
+     =Cdjh
+     -----END PGP MESSAGE-----
+
+     --=-=01-wrzqued738dfx4x97u7y=-=--
+
+   The client decrypts the attachment as
+
+     Content-Type: application/vnd.gnupg.wks
+     Content-Transfer-Encoding: 8bit
+
+     type: confirmation-request
+     sender: key-submission at example.net
+     address: patrice.lumumba at example.net
+     fingerprint: B21DEAB4F875FB3DA42F1D1D139563682A020D0A
+     nonce: f5pscz57zj6fk11wekk8gx4cmrb659a7
+
+   creates this response
+
+
+
+
+
+
+Koch                     Expires August 4, 2017                [Page 15]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+     Content-Type: application/vnd.gnupg.wks
+     Content-Transfer-Encoding: 8bit
+
+     type: confirmation-response
+     sender: key-submission at example.net
+     address: patrice.lumumba at example.net
+     nonce: f5pscz57zj6fk11wekk8gx4cmrb659a7
+
+   and sends it encrypted to the server
+
+     From: patrice.lumumba at example.net
+     To: key-submission at example.net
+     Subject: Key publication confirmation
+     MIME-Version: 1.0
+     Content-Type: multipart/encrypted;
+             protocol="application/pgp-encrypted";
+             boundary="=-=01-iacqg4og4pqz11a5cg1o=-="
+     Date: Wed, 05 Oct 2016 10:18:52 +0000
+
+
+     --=-=01-iacqg4og4pqz11a5cg1o=-=
+     Content-Type: application/pgp-encrypted
+
+     Version: 1
+
+     --=-=01-iacqg4og4pqz11a5cg1o=-=
+     Content-Type: application/octet-stream
+
+     -----BEGIN PGP MESSAGE-----
+
+     hF4DUgLY5tvmW2sSAQdAnB1C3PMjS4AsGU0qaCqBdWQO5i6blWEyZrEsY+JZY1Qw
+     ooNq7zdVWOHhL9LPGAALAgoL3Qfz+dN2u5QamSQ/LJ2c8M0XipNs3lqlNH63yQN1
+     0sAmAc3W8xkwul+rf6OLK/gMi6WzM4fnUhd4D1LJGIJoNUN0l3636C7ecOt2lkMl
+     5bVAYg/SyMT3ymyfQnvtiem2T5DSnPsS1g6n6QNXWvkqvX9yGxNsNDJEHTuGJB8k
+     OJoRlfWQTEo6pgA89febWl1EdeM1pPLstQ2uZE8NPjXoY1nMxAlu+iPYsR41/4sg
+     dqwOv5BPLh/GIat8hh9SPWCA9iKlgSQ/EIv5DpjQogEzpriT55dkgfvSVYIAcOdO
+     ShZ91YKkcZffevdY72omqTk10a1SUXehPooIlRFmroDsi3VDaRKrUIo=
+     =7uve
+     -----END PGP MESSAGE-----
+
+     --=-=01-iacqg4og4pqz11a5cg1o=-=--
+
+Appendix B.  Changes Since -02
+
+   o  Specified the use of DNS SRV.
+
+
+
+
+
+
+Koch                     Expires August 4, 2017                [Page 16]
+

+Internet-Draft           OpenPGP Web Key Service            January 2017
+
+
+Author's Address
+
+   Werner Koch
+   GnuPG Project
+
+   Email: wk at gnupg.org
+   URI:   https://gnupg.org
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Koch                     Expires August 4, 2017                [Page 17]
diff --git a/misc/id/openpgp-webkey-service/draft.org b/misc/id/openpgp-webkey-service/draft.org
index 3b90470..1239442 100644
--- a/misc/id/openpgp-webkey-service/draft.org
+++ b/misc/id/openpgp-webkey-service/draft.org
@@ -20,7 +20,7 @@
 ]>
 
 <rfc ipr="trust200902" category="info"
-     docName="draft-koch-openpgp-webkey-service-03">
+     docName="draft-koch-openpgp-webkey-service-04">
 
 <?rfc toc="yes"?>
 <?rfc symrefs="yes"?>
@@ -40,7 +40,7 @@
       </address>
     </author>
 
-    <date month="January" year="2017" />
+    <date month="MONTH" year="2017" />
     <area>Security</area>
 
     <abstract>

commit 64ef954ef4f510631e40868341bab8132d1ec45b
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 31 11:27:47 2017 +0100

    drafts,openpgp-webkey-service: Prepare -03 for publication.

diff --git a/misc/id/openpgp-webkey-service/draft.org b/misc/id/openpgp-webkey-service/draft.org
index b5339cf..3b90470 100644
--- a/misc/id/openpgp-webkey-service/draft.org
+++ b/misc/id/openpgp-webkey-service/draft.org
@@ -40,7 +40,7 @@
       </address>
     </author>
 
-    <date month="MONTH" year="2016" />
+    <date month="January" year="2017" />
     <area>Security</area>
 
     <abstract>
@@ -149,11 +149,14 @@ Non-ASCII characters are not changed.
 
 The so mapped local-part is hashed using the SHA-1 algorithm.  The
 resulting 160 bit digest is encoded using the Z-Base-32 method as
-described in {{{RFC(6189)}}}, section 5.1.6.  The resulting string has a
-fixed length of 32 octets.  To form the URI, the scheme
-{{{https_scheme}}} is concatenated with the domain-part, the
-fixed string ~/.well-known/openpgpkey/hu/~, and the above constructed
-32 octet string.
+described in {{{RFC(6189)}}}, section 5.1.6.  The resulting string has
+a fixed length of 32 octets.  To form the URI, the following parts are
+concatenated:
+
+- The scheme {{{https_scheme}}},
+- the domain-part,
+- the string ~/.well-known/openpgpkey/hu/~,
+- and the above constructed 32 octet string.
 
 For example the URI to lookup the key for Joe.Doe at Example.ORG is:
 
@@ -171,7 +174,7 @@ different host or a port other than 443.  For example:
 _openpgpkey._tcp.example.org.  IN  SRV 0 0 8443 wkd.example.org.
 #+END_EXAMPLE
 
-changes the above query to query the host "wkd.example.org" at port
+changes the above to query the host "wkd.example.org" at port
 8443 instead of the host "gnupg.org" at port 443.  The target (in the
 example "wkd.example.org") MUST be a sub-domain of the domain-part
 (here "example.org").  If the target is not a sub-domain, the SRV RR
@@ -207,14 +210,13 @@ alice at example.org.  To install the key at her provider's Web Key
 Directory, she performs the following steps:
 
 1. She retrieves a file which contains one line with the mail address
-   used to submit the key to the mail provider.  See below for the syntax
-   of that file.  For a mail address at the domain "example.org" the URI
-   of the file is
+   used to submit the key to the mail provider. The DNS SRV rules
+   described for the Web Key Directory apply here as well.  See below
+   for the syntax of that file.  For a mail address at the domain
+   "example.org" the URI of the file is
 #+begin_example
      https://example.org/.well-known/openpgpkey/submission-address
 #+end_example
-   The DNS SRV RR rules described for the Web Key Directory apply here
-   as well.
 
 2. She sends her key using SMTP (or any other transport mechanism) to
    the provider using the submission address and key format as specified

commit eef1640bf8edee36e7c6415d02277ea2faa42a7a
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 31 11:26:37 2017 +0100

    drafts: Update readme and Makefile.

diff --git a/misc/id/common/README b/misc/id/common/README
index 5afef41..4b6302d 100644
--- a/misc/id/common/README
+++ b/misc/id/common/README
@@ -1,2 +1,3 @@
 Online references can be found at:
-     http://xml.resource.org/public/rfc/bibxml3/
+    http://xml.resource.org/public/rfc/bibxml-rfcs/
+    http://xml.resource.org/public/rfc/bibxml3/
diff --git a/misc/id/openpgp-webkey-service/Makefile b/misc/id/openpgp-webkey-service/Makefile
index 9023455..c1d2ce8 100644
--- a/misc/id/openpgp-webkey-service/Makefile
+++ b/misc/id/openpgp-webkey-service/Makefile
@@ -8,7 +8,7 @@ MD_EXAMPLE_FIX = '(defun org-md-example-block (example-block contents info) \
 
 
 draft.txt, draft.xml: draft.org
-	emacs --batch \
+	emacs23 --batch \
            --eval "(require 'org)" \
            --eval "(require 'ox-md)" \
            --eval $(MD_EXAMPLE_FIX)  \

commit d44b8be4a96cf662c53cdc79067bdaad4715e11a
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 31 11:17:42 2017 +0100

    drafts,openpgp-webkey-service: Specify DNS SRV

diff --git a/misc/id/openpgp-webkey-service/draft.org b/misc/id/openpgp-webkey-service/draft.org
index 25a661f..b5339cf 100644
--- a/misc/id/openpgp-webkey-service/draft.org
+++ b/misc/id/openpgp-webkey-service/draft.org
@@ -11,6 +11,7 @@
   <!ENTITY pandocMiddle   PUBLIC '' 'tmp-middle.xml'>
   <!ENTITY pandocBack     PUBLIC '' 'tmp-back.xml'>
   <!ENTITY rfc.2119       PUBLIC '' '../common/reference.RFC.2119.xml'>
+  <!ENTITY rfc.2782       PUBLIC '' '../common/reference.RFC.2782.xml'>
   <!ENTITY rfc.3156       PUBLIC '' '../common/reference.RFC.3156.xml'>
   <!ENTITY rfc.4880       PUBLIC '' '../common/reference.RFC.4880.xml'>
   <!ENTITY rfc.5226       PUBLIC '' '../common/reference.RFC.5226.xml'>
@@ -54,6 +55,7 @@
   <back>
     <references title="Normative References">
       &rfc.2119;
+      &rfc.2782;
       &rfc.3156;
       &rfc.4880;
       &rfc.5785;
@@ -131,25 +133,25 @@ https connection.
 ** Key Discovery
 
 Although URIs are able to encode all kind of characters, straightforward
-implementations of a key directory may want to store the "local-part" of
+implementations of a key directory may want to store the local-part of
 a mail address directly in the file system.  This forbids the use of
-certain characters in the "local-part".  To allow for such an
-implementation method the URI uses an encoded form of the "local-part"
+certain characters in the local-part.  To allow for such an
+implementation method the URI uses an encoded form of the local-part
 which can be directly mapped to a file name.
 
 OpenPGP defines its User IDs, and thus the mail address, as UTF-8
 strings.  To help with the common pattern of using capitalized names
 (e.g. "Joe.Doe at example.org") for mail addresses, and under the premise
-that almost all MTAs treat the "local-part" case-insensitive and that
-the "domain-part" is required to be compared case-insensitive anyway,
+that almost all MTAs treat the local-part case-insensitive and that
+the domain-part is required to be compared case-insensitive anyway,
 all upper-case ASCII characters in a User ID are mapped to lowercase.
 Non-ASCII characters are not changed.
 
-The so mapped "local-part" is hashed using the SHA-1 algorithm.  The
+The so mapped local-part is hashed using the SHA-1 algorithm.  The
 resulting 160 bit digest is encoded using the Z-Base-32 method as
 described in {{{RFC(6189)}}}, section 5.1.6.  The resulting string has a
 fixed length of 32 octets.  To form the URI, the scheme
-{{{https_scheme}}} is concatenated with the mapped "domain-part", the
+{{{https_scheme}}} is concatenated with the domain-part, the
 fixed string ~/.well-known/openpgpkey/hu/~, and the above constructed
 32 octet string.
 
@@ -162,6 +164,19 @@ For example the URI to lookup the key for Joe.Doe at Example.ORG is:
 
 (line has been wrapped for rendering purposes)
 
+DNS SRV resource records ({{{RFC(2782)}}}) may be used to query a
+different host or a port other than 443.  For example:
+
+#+BEGIN_EXAMPLE
+_openpgpkey._tcp.example.org.  IN  SRV 0 0 8443 wkd.example.org.
+#+END_EXAMPLE
+
+changes the above query to query the host "wkd.example.org" at port
+8443 instead of the host "gnupg.org" at port 443.  The target (in the
+example "wkd.example.org") MUST be a sub-domain of the domain-part
+(here "example.org").  If the target is not a sub-domain, the SRV RR
+MUST be be ignored.  The recommended name for the sub-domain is "wkd".
+
 The HTTP GET method MUST return the binary representation of the
 OpenPGP key for the given mail address.  The key needs to carry a User
 ID packet ({{{RFC(4880)}}}) with that mail address.  Note that the key
@@ -173,11 +188,12 @@ single request as concatenated key blocks.
 The server MUST accept the HTTP HEAD method to allow a client to
 check for the existence of a key.
 
-The server SHOULD return "application/octet-string" as the
+The server SHOULD use "application/octet-string" as the
 Content-Type for the data but clients SHOULD also accept any other
 Content-Type.  The server MUST NOT return an ASCII armored version of
 the key.
 
+
 * Web Key Directory Update Protocol
 
 To put keys into the key directory a protocol to automate the task is
@@ -197,6 +213,8 @@ Directory, she performs the following steps:
 #+begin_example
      https://example.org/.well-known/openpgpkey/submission-address
 #+end_example
+   The DNS SRV RR rules described for the Web Key Directory apply here
+   as well.
 
 2. She sends her key using SMTP (or any other transport mechanism) to
    the provider using the submission address and key format as specified
@@ -425,14 +443,22 @@ with a domain name and an underscore.
 
 * Security Considerations
 
-The use of SHA-1 for the mapping of the "local-part" to a fixed string
+The use of SHA-1 for the mapping of the local-part to a fixed string
 is not a security feature but merely used to map the local-part to a
 fixed-sized string made from a well defined set of characters.  It is not
 intended to conceal information about a mail address.
 
 The domain name part of the mail address is not part of the hash to
-avoid problems with internationalized domain names.  Instead a separate
-URL is required for each domain name.
+avoid problems with internationalized domain names.  Instead a
+separate URL is required for each domain name.
+
+The use of DNS SRV records reduces the certainty that a mail address
+belongs to a domain.  For example an attacker may change the target to
+a host in a sub-domain under their control and thus gain full control
+over all keys.  An implementation may want to weight the certainty of
+a mapping different if it has been retrieved via a sub-domain and in
+particular if a non-recommended name is used for the sub-domain.
+
 
 * IANA Considerations
 
@@ -660,7 +686,6 @@ ShZ91YKkcZffevdY72omqTk10a1SUXehPooIlRFmroDsi3VDaRKrUIo=
 #+end_example
 
 
-* Changes Since -01
+* Changes Since -02
 
-- Changed the format of the confirmation request.
-- Added sample messages.
+- Specified the use of DNS SRV.

-----------------------------------------------------------------------

Summary of changes:
 misc/id/common/README                              |   3 +-
 misc/id/openpgp-webkey-service/Makefile            |   2 +-
 ...xt => draft-koch-openpgp-webkey-service-03.txt} | 314 ++++++++++++---------
 misc/id/openpgp-webkey-service/draft.org           |  73 +++--
 4 files changed, 238 insertions(+), 154 deletions(-)
 copy misc/id/openpgp-webkey-service/{draft-koch-openpgp-webkey-service-02.txt => draft-koch-openpgp-webkey-service-03.txt} (82%)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 31 13:26:55 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 31 Jan 2017 13:26:55 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-39-gb0e8376
Message-ID: <E1cYXWU-0004qm-9Q@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  b0e8376e19072ec3c590273c69ab3e8e5edfdaca (commit)
      from  e17fa5c75d76af4d4684ee810cb446ecd5110560 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b0e8376e19072ec3c590273c69ab3e8e5edfdaca
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jan 31 13:22:52 2017 +0100

    dirmngr: Require --allow-version-check even if --use-tor is used.
    
    * dirmngr/dirmngr.c (housekeeping_thread): Load swdb only if the
    option is set.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 15ba33b..7e640d4 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -1798,7 +1798,7 @@ housekeeping_thread (void *arg)
   if (network_activity_seen)
     {
       network_activity_seen = 0;
-      if (opt.use_tor || opt.allow_version_check)
+      if (opt.allow_version_check)
         dirmngr_load_swdb (&ctrlbuf, 0);
     }
 
diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
index fcc174f..7fc11a2 100644
--- a/doc/dirmngr.texi
+++ b/doc/dirmngr.texi
@@ -266,8 +266,8 @@ seconds.
 @item --allow-version-check
 @opindex allow-version-check
 Allow Dirmngr to connect to @code{https://versions.gnupg.org} to get
-the list of current software versions.  If this option is enabled, or
-if @option{use-tor} is active, the list is retrieved when the local
+the list of current software versions.  If this option is enabled
+the list is retrieved in case the local
 copy does not exist or is older than 5 to 7 days.  See the option
 @option{--query-swdb} of the command @command{gpgconf} for more
 details.  Note, that regardless of this option a version check can

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dirmngr.c | 2 +-
 doc/dirmngr.texi  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jan 31 18:51:12 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 31 Jan 2017 18:51:12 +0100
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.18-45-g2e78aa6
Message-ID: <E1cYcaL-000264-71@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  2e78aa6ff770849415f8eb71ca70c8886e9564c8 (commit)
       via  b85d509a8f5c2e6200b8051ca1593c019abce90b (commit)
       via  874424ee3cc795eae9972b6259a2cc4dcdbb868e (commit)
       via  cea6d114b60deaecfbc2eb1aedbdfb7e6700922f (commit)
       via  8f0ecb16cbb3798ad18be5f05b826db2aa1aaa00 (commit)
       via  2076cdaf6b93bc73223819895cc7a67323d8cee7 (commit)
      from  b0e8376e19072ec3c590273c69ab3e8e5edfdaca (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2e78aa6ff770849415f8eb71ca70c8886e9564c8
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 31 18:45:57 2017 +0100

    gpgscm: Tune the hash tables.
    
    * tests/gpgscm/scheme.c (oblist_initial_value): Increase the size of
    the hash table based on the number of symbols used after initializing
    the interpreter.
    (new_frame_in_env): Increase the size of the hash table based on the
    number of variables in the global environement.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index c4af94d..1265c62 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -1073,7 +1073,9 @@ static int hash_fn(const char *key, int table_size);
 
 static pointer oblist_initial_value(scheme *sc)
 {
-  return mk_vector(sc, 461); /* probably should be bigger */
+  /* There are about 768 symbols used after loading the
+   * interpreter.  */
+  return mk_vector(sc, 1009);
 }
 
 /* Add a new symbol NAME at SLOT.  SLOT must be obtained using
@@ -2642,9 +2644,9 @@ static void new_frame_in_env(scheme *sc, pointer old_env)
 {
   pointer new_frame;
 
-  /* The interaction-environment has about 300 variables in it. */
+  /* The interaction-environment has about 480 variables in it. */
   if (old_env == sc->NIL) {
-    new_frame = mk_vector(sc, 461);
+    new_frame = mk_vector(sc, 751);
   } else {
     new_frame = sc->NIL;
   }

commit b85d509a8f5c2e6200b8051ca1593c019abce90b
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 31 18:16:46 2017 +0100

    gpgscm: Optimize environment lookups and insertions.
    
    * tests/gpgscm/scheme.c (pointercmp): New function.
    (new_slot_spec_in_env): Add and use slot for insertions.
    (find_slot_spec_in_env): New variant of 'find_slot_in_env' that
    returns the slot on failures.
    (find_slot_in_env): Express using the new function.
    (new_slot_in_env): Update callsite.
    (opexe_0): Optimize lookup-or-insert.
    (opexe_1): Likewise.
    (scheme_define): Likewise.
    --
    Optimize environment lookups by keeping the lists in the hash table or
    the list sorted.  Optimize the insertions by passing the slot computed
    by the lookup to the insertion.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index d2c3dfc..c4af94d 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -2612,6 +2612,22 @@ static int hash_fn(const char *key, int table_size)
 }
 #endif
 
+/* Compares A and B.  Returns an integer less than, equal to, or
+ * greater than zero if A is stored at a memory location that is
+ * numerical less than, equal to, or greater than that of B.  */
+static int
+pointercmp(pointer a, pointer b)
+{
+  uintptr_t a_n = (uintptr_t) a;
+  uintptr_t b_n = (uintptr_t) b;
+
+  if (a_n < b_n)
+    return -1;
+  if (a_n > b_n)
+    return 1;
+  return 0;
+}
+
 #ifndef USE_ALIST_ENV
 
 /*
@@ -2639,53 +2655,75 @@ static void new_frame_in_env(scheme *sc, pointer old_env)
   setenvironment(sc->envir);
 }
 
+/* Insert (VARIABLE, VALUE) at SSLOT.  SSLOT must be obtained using
+ * find_slot_spec_in_env, and no insertion must be done between
+ * obtaining SSLOT and the call to this function.
+ *
+ * If SSLOT is NULL, the new slot is put into the appropriate place in
+ * the environment vector.  */
 static INLINE void new_slot_spec_in_env(scheme *sc, pointer env,
-                                        pointer variable, pointer value)
+                                        pointer variable, pointer value,
+					pointer *sslot)
 {
 #define new_slot_spec_in_env_allocates	2
   pointer slot;
   gc_disable(sc, gc_reservations (new_slot_spec_in_env));
   slot = immutable_cons(sc, variable, value);
 
-  if (is_vector(car(env))) {
-    int location = hash_fn(symname(variable), vector_length(car(env)));
+  if (sslot == NULL) {
+    int location;
+    assert(is_vector(car(env)));
+    location = hash_fn(symname(variable), vector_length(car(env)));
 
     set_vector_elem(car(env), location,
                     immutable_cons(sc, slot, vector_elem(car(env), location)));
   } else {
-    car(env) = immutable_cons(sc, slot, car(env));
+    *sslot = immutable_cons(sc, slot, *sslot);
   }
   gc_enable(sc);
 }
 
-static pointer find_slot_in_env(scheme *sc, pointer env, pointer hdl, int all)
+/* Find the slot in ENV under the key HDL.  If ALL is given, look in
+ * all environments enclosing ENV.  If the lookup fails, and SSLOT is
+ * given, the position where the new slot has to be inserted is stored
+ * at SSLOT.
+ *
+ * SSLOT may be set to NULL if the new symbol should be placed at the
+ * appropriate place in the vector.  */
+static pointer
+find_slot_spec_in_env(scheme *sc, pointer env, pointer hdl, int all, pointer **sslot)
 {
   pointer x,y;
   int location;
+  pointer *sl;
+  int d;
+  assert(is_symbol(hdl));
 
   for (x = env; x != sc->NIL; x = cdr(x)) {
     if (is_vector(car(x))) {
       location = hash_fn(symname(hdl), vector_length(car(x)));
+      sl = NULL;
       y = vector_elem(car(x), location);
     } else {
-      y = car(x);
-    }
-    for ( ; y != sc->NIL; y = cdr(y)) {
-              if (caar(y) == hdl) {
-                   break;
-              }
-         }
-         if (y != sc->NIL) {
-              break;
-         }
-         if(!all) {
-           return sc->NIL;
-         }
+      sl = &car(x);
+      y = *sl;
     }
-    if (x != sc->NIL) {
-          return car(y);
+    for ( ; y != sc->NIL; sl = &cdr(y), y = *sl) {
+      d = pointercmp(caar(y), hdl);
+      if (d == 0)
+	return car(y);		/* Hit.  */
+      else if (d > 0)
+	break;			/* Miss.  */
     }
-    return sc->NIL;
+
+    if (x == env && sslot)
+      *sslot = sl;		/* Insert here.  */
+
+    if (!all)
+      return sc->NIL;		/* Miss, and stop looking.  */
+  }
+
+  return sc->NIL;		/* Not found in any environment.  */
 }
 
 #else /* USE_ALIST_ENV */
@@ -2696,41 +2734,66 @@ static INLINE void new_frame_in_env(scheme *sc, pointer old_env)
   setenvironment(sc->envir);
 }
 
+/* Insert (VARIABLE, VALUE) at SSLOT.  SSLOT must be obtained using
+ * find_slot_spec_in_env, and no insertion must be done between
+ * obtaining SSLOT and the call to this function.  */
 static INLINE void new_slot_spec_in_env(scheme *sc, pointer env,
-                                        pointer variable, pointer value)
+                                        pointer variable, pointer value,
+					pointer *sslot)
 {
 #define new_slot_spec_in_env_allocates	2
-  car(env) = immutable_cons(sc, immutable_cons(sc, variable, value), car(env));
+  (void) env;
+  assert(is_symbol(variable));
+  *sslot = immutable_cons(sc, immutable_cons(sc, variable, value), *sslot);
 }
 
-static pointer find_slot_in_env(scheme *sc, pointer env, pointer hdl, int all)
+/* Find the slot in ENV under the key HDL.  If ALL is given, look in
+ * all environments enclosing ENV.  If the lookup fails, and SSLOT is
+ * given, the position where the new slot has to be inserted is stored
+ * at SSLOT.  */
+static pointer
+find_slot_spec_in_env(scheme *sc, pointer env, pointer hdl, int all, pointer **sslot)
 {
     pointer x,y;
+    pointer *sl;
+    int d;
+    assert(is_symbol(hdl));
+
     for (x = env; x != sc->NIL; x = cdr(x)) {
-         for (y = car(x); y != sc->NIL; y = cdr(y)) {
-              if (caar(y) == hdl) {
-                   break;
-              }
-         }
-         if (y != sc->NIL) {
-              break;
-         }
-         if(!all) {
-           return sc->NIL;
-         }
-    }
-    if (x != sc->NIL) {
-          return car(y);
+      for (sl = &car(x), y = *sl; y != sc->NIL; sl = &cdr(y), y = *sl) {
+	d = pointercmp(caar(y), hdl);
+	if (d == 0)
+	  return car(y);	/* Hit.  */
+	else if (d > 0)
+	  break;		/* Miss.  */
+      }
+
+      if (x == env && sslot)
+	*sslot = sl;		/* Insert here.  */
+
+      if (!all)
+	return sc->NIL;		/* Miss, and stop looking.  */
     }
-    return sc->NIL;
+
+    return sc->NIL;		/* Not found in any environment.  */
 }
 
 #endif /* USE_ALIST_ENV else */
 
+static pointer find_slot_in_env(scheme *sc, pointer env, pointer hdl, int all)
+{
+  return find_slot_spec_in_env(sc, env, hdl, all, NULL);
+}
+
 static INLINE void new_slot_in_env(scheme *sc, pointer variable, pointer value)
 {
 #define new_slot_in_env_allocates	new_slot_spec_in_env_allocates
-  new_slot_spec_in_env(sc, sc->envir, variable, value);
+  pointer slot;
+  pointer *sslot;
+  assert(is_symbol(variable));
+  slot = find_slot_spec_in_env(sc, sc->envir, variable, 0, &sslot);
+  assert(slot == sc->NIL);
+  new_slot_spec_in_env(sc, sc->envir, variable, value, sslot);
 }
 
 static INLINE void set_slot_in_env(scheme *sc, pointer slot, pointer value)
@@ -3486,15 +3549,16 @@ static pointer opexe_0(scheme *sc, enum scheme_opcodes op) {
           s_save(sc,OP_DEF1, sc->NIL, x);
           s_thread_to(sc,OP_EVAL);
 
-     CASE(OP_DEF1):  /* define */
-          x=find_slot_in_env(sc,sc->envir,sc->code,0);
+     CASE(OP_DEF1): { /* define */
+	  pointer *sslot;
+          x = find_slot_spec_in_env(sc, sc->envir, sc->code, 0, &sslot);
           if (x != sc->NIL) {
                set_slot_in_env(sc, x, sc->value);
           } else {
-               new_slot_in_env(sc, sc->code, sc->value);
+	       new_slot_spec_in_env(sc, sc->envir, sc->code, sc->value, sslot);
           }
           s_return(sc,sc->code);
-
+     }
 
      CASE(OP_DEFP):  /* defined? */
           x=sc->envir;
@@ -3806,15 +3870,17 @@ static pointer opexe_1(scheme *sc, enum scheme_opcodes op) {
           s_save(sc,OP_MACRO1, sc->NIL, x);
           s_goto(sc,OP_EVAL);
 
-     CASE(OP_MACRO1):     /* macro */
+     CASE(OP_MACRO1): {   /* macro */
+	  pointer *sslot;
           typeflag(sc->value) = T_MACRO;
-          x = find_slot_in_env(sc, sc->envir, sc->code, 0);
+          x = find_slot_spec_in_env(sc, sc->envir, sc->code, 0, &sslot);
           if (x != sc->NIL) {
                set_slot_in_env(sc, x, sc->value);
           } else {
-               new_slot_in_env(sc, sc->code, sc->value);
+	       new_slot_spec_in_env(sc, sc->envir, sc->code, sc->value, sslot);
           }
           s_return(sc,sc->code);
+     }
 
      CASE(OP_CASE0):      /* case */
           s_save(sc,OP_CASE1, sc->NIL, cdr(sc->code));
@@ -5769,12 +5835,12 @@ void scheme_load_string(scheme *sc, const char *cmd) {
 
 void scheme_define(scheme *sc, pointer envir, pointer symbol, pointer value) {
      pointer x;
-
-     x=find_slot_in_env(sc,envir,symbol,0);
+     pointer *sslot;
+     x = find_slot_spec_in_env(sc, envir, symbol, 0, &sslot);
      if (x != sc->NIL) {
           set_slot_in_env(sc, x, value);
      } else {
-          new_slot_spec_in_env(sc, envir, symbol, value);
+          new_slot_spec_in_env(sc, envir, symbol, value, sslot);
      }
 }
 

commit 874424ee3cc795eae9972b6259a2cc4dcdbb868e
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 31 13:53:28 2017 +0100

    gpgscm: Fix build with list environments.
    
    * tests/gpgscm/scheme.c (new_slot_spec_in_env): Provide preallocation
    inforomation if USE_ALIST_ENV.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index fe16d48..d2c3dfc 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -2699,6 +2699,7 @@ static INLINE void new_frame_in_env(scheme *sc, pointer old_env)
 static INLINE void new_slot_spec_in_env(scheme *sc, pointer env,
                                         pointer variable, pointer value)
 {
+#define new_slot_spec_in_env_allocates	2
   car(env) = immutable_cons(sc, immutable_cons(sc, variable, value), car(env));
 }
 

commit cea6d114b60deaecfbc2eb1aedbdfb7e6700922f
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 31 13:22:40 2017 +0100

    gpgscm: Optimize symbol lookups and insertions.
    
    * tests/gpgscm/scheme.c (oblist_find_by_name): Keep the list of
    symbols sorted, return the slot where a new symbol must be inserted on
    lookup failures.
    (oblist_add_by_name): Add the new symbol at the given slot.
    (mk_symbol): Adjust callsite.
    (gensym): Likewise.
    (assign_syntax): Likewise.
    --
    Optimize symbol lookups by keeping the lists in the hash table (or the
    list if compiled with USE_OBJECT_LIST) sorted by the symbol names.
    Optimize the insertions by passing the slot computed by the lookup to
    the insertion.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index 1801ffc..fe16d48 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -1076,8 +1076,14 @@ static pointer oblist_initial_value(scheme *sc)
   return mk_vector(sc, 461); /* probably should be bigger */
 }
 
-/* returns the new symbol */
-static pointer oblist_add_by_name(scheme *sc, const char *name)
+/* Add a new symbol NAME at SLOT.  SLOT must be obtained using
+ * oblist_find_by_name, and no insertion must be done between
+ * obtaining the SLOT and calling this function.  Returns the new
+ * symbol.
+ *
+ * If SLOT is NULL, the new symbol is be placed at the appropriate
+ * place in the vector.  */
+static pointer oblist_add_by_name(scheme *sc, const char *name, pointer *slot)
 {
 #define oblist_add_by_name_allocates	3
   pointer x;
@@ -1088,26 +1094,42 @@ static pointer oblist_add_by_name(scheme *sc, const char *name)
   typeflag(x) = T_SYMBOL;
   setimmutable(car(x));
 
-  location = hash_fn(name, vector_length(sc->oblist));
-  set_vector_elem(sc->oblist, location,
-                  immutable_cons(sc, x, vector_elem(sc->oblist, location)));
+  if (slot == NULL) {
+    location = hash_fn(name, vector_length(sc->oblist));
+    set_vector_elem(sc->oblist, location,
+		    immutable_cons(sc, x, vector_elem(sc->oblist, location)));
+  } else {
+    *slot = immutable_cons(sc, x, *slot);
+  }
+
   gc_enable(sc);
   return x;
 }
 
-static INLINE pointer oblist_find_by_name(scheme *sc, const char *name)
+/* Lookup the symbol NAME.  Returns the symbol, or NIL if it does not
+ * exist.  In that case, SLOT points to the point where the new symbol
+ * is to be inserted.
+ *
+ * SLOT may be set to NULL if the new symbol should be placed at the
+ * appropriate place in the vector.  */
+static INLINE pointer
+oblist_find_by_name(scheme *sc, const char *name, pointer **slot)
 {
   int location;
   pointer x;
   char *s;
+  int d;
 
   location = hash_fn(name, vector_length(sc->oblist));
-  for (x = vector_elem(sc->oblist, location); x != sc->NIL; x = cdr(x)) {
+  for (*slot = NULL, x = vector_elem(sc->oblist, location);
+       x != sc->NIL; *slot = &cdr(x), x = **slot) {
     s = symname(car(x));
     /* case-insensitive, per R5RS section 2. */
-    if(stricmp(name, s) == 0) {
-      return car(x);
-    }
+    d = stricmp(name, s);
+    if (d == 0)
+      return car(x);		/* Hit.  */
+    else if (d > 0)
+      break;			/* Miss.  */
   }
   return sc->NIL;
 }
@@ -1133,23 +1155,33 @@ static pointer oblist_initial_value(scheme *sc)
   return sc->NIL;
 }
 
-static INLINE pointer oblist_find_by_name(scheme *sc, const char *name)
+/* Lookup the symbol NAME.  Returns the symbol, or NIL if it does not
+ * exist.  In that case, SLOT points to the point where the new symbol
+ * is to be inserted.  */
+static INLINE pointer
+oblist_find_by_name(scheme *sc, const char *name, pointer **slot)
 {
      pointer x;
      char    *s;
+     int     d;
 
-     for (x = sc->oblist; x != sc->NIL; x = cdr(x)) {
+     for (*slot = &sc->oblist, x = **slot; x != sc->NIL; *slot = &cdr(x), x = **slot) {
         s = symname(car(x));
         /* case-insensitive, per R5RS section 2. */
-        if(stricmp(name, s) == 0) {
-          return car(x);
-        }
+	d = stricmp(name, s);
+        if (d == 0)
+          return car(x);	/* Hit.  */
+        else if (d > 0)
+	  break;		/* Miss.  */
      }
      return sc->NIL;
 }
 
-/* returns the new symbol */
-static pointer oblist_add_by_name(scheme *sc, const char *name)
+/* Add a new symbol NAME at SLOT.  SLOT must be obtained using
+ * oblist_find_by_name, and no insertion must be done between
+ * obtaining the SLOT and calling this function.  Returns the new
+ * symbol.  */
+static pointer oblist_add_by_name(scheme *sc, const char *name, pointer *slot)
 {
 #define oblist_add_by_name_allocates	3
   pointer x;
@@ -1157,7 +1189,7 @@ static pointer oblist_add_by_name(scheme *sc, const char *name)
   x = immutable_cons(sc, mk_string(sc, name), sc->NIL);
   typeflag(x) = T_SYMBOL;
   setimmutable(car(x));
-  sc->oblist = immutable_cons(sc, x, sc->oblist);
+  *slot = immutable_cons(sc, x, *slot);
   return x;
 }
 static pointer oblist_all_symbols(scheme *sc)
@@ -1344,31 +1376,33 @@ INTERFACE static pointer set_vector_elem(pointer vec, int ielem, pointer a) {
 INTERFACE pointer mk_symbol(scheme *sc, const char *name) {
 #define mk_symbol_allocates	oblist_add_by_name_allocates
      pointer x;
+     pointer *slot;
 
      /* first check oblist */
-     x = oblist_find_by_name(sc, name);
+     x = oblist_find_by_name(sc, name, &slot);
      if (x != sc->NIL) {
           return (x);
      } else {
-          x = oblist_add_by_name(sc, name);
+          x = oblist_add_by_name(sc, name, slot);
           return (x);
      }
 }
 
 INTERFACE pointer gensym(scheme *sc) {
      pointer x;
+     pointer *slot;
      char name[40];
 
      for(; sc->gensym_cnt<LONG_MAX; sc->gensym_cnt++) {
           snprintf(name,40,"gensym-%ld",sc->gensym_cnt);
 
           /* first check oblist */
-          x = oblist_find_by_name(sc, name);
+          x = oblist_find_by_name(sc, name, &slot);
 
           if (x != sc->NIL) {
                continue;
           } else {
-               x = oblist_add_by_name(sc, name);
+	       x = oblist_add_by_name(sc, name, slot);
                return (x);
           }
      }
@@ -5319,8 +5353,12 @@ static void Eval_Cycle(scheme *sc, enum scheme_opcodes op) {
 
 static void assign_syntax(scheme *sc, char *name) {
      pointer x;
+     pointer *slot;
+
+     x = oblist_find_by_name(sc, name, &slot);
+     assert (x == sc->NIL);
 
-     x = oblist_add_by_name(sc, name);
+     x = oblist_add_by_name(sc, name, slot);
      typeflag(x) |= T_SYNTAX;
 }
 

commit 8f0ecb16cbb3798ad18be5f05b826db2aa1aaa00
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 31 12:43:00 2017 +0100

    gpgscm: Fix build with object list.
    
    * tests/gpgscm/scheme.c (oblist_add_by_name): Provide preallocation
    information if USE_OBJECT_LIST.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index 27beb3a..1801ffc 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -1151,6 +1151,7 @@ static INLINE pointer oblist_find_by_name(scheme *sc, const char *name)
 /* returns the new symbol */
 static pointer oblist_add_by_name(scheme *sc, const char *name)
 {
+#define oblist_add_by_name_allocates	3
   pointer x;
 
   x = immutable_cons(sc, mk_string(sc, name), sc->NIL);

commit 2076cdaf6b93bc73223819895cc7a67323d8cee7
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jan 31 12:09:42 2017 +0100

    gpgscm: Remove unused functions.
    
    * tests/gpgscm/scheme.c (check_cell_alloced): Remove function.
    (check_range_alloced): Likewise.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/scheme.c b/tests/gpgscm/scheme.c
index 86df851..27beb3a 100644
--- a/tests/gpgscm/scheme.c
+++ b/tests/gpgscm/scheme.c
@@ -1050,30 +1050,6 @@ static pointer get_vector_object(scheme *sc, int len, pointer init)
   return cells;
 }
 
-#if defined TSGRIND
-static void check_cell_alloced(pointer p, int expect_alloced)
-{
-  /* Can't use putstr(sc,str) because callers have no access to
-     sc.  */
-  if(typeflag(p) & !expect_alloced)
-    {
-      fprintf(stderr,"Cell is already allocated!\n");
-    }
-  if(!(typeflag(p)) & expect_alloced)
-    {
-      fprintf(stderr,"Cell is not allocated!\n");
-    }
-
-}
-static void check_range_alloced(pointer p, int n, int expect_alloced)
-{
-  int i;
-  for(i = 0;i<n;i++)
-    { (void)check_cell_alloced(p+i,expect_alloced); }
-}
-
-#endif
-
 /* Medium level cell allocation */
 
 /* get new cons cell */

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgscm/scheme.c | 284 ++++++++++++++++++++++++++++++++------------------
 1 file changed, 184 insertions(+), 100 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org