From cvs at cvs.gnupg.org  Sat Jul  1 14:30:11 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Sat, 01 Jul 2017 14:30:11 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-79-g7fb724c
Message-ID: <E1dRHXQ-0007fn-AV@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  7fb724c61655c6f75c61572d65a46e21ae112574 (commit)
      from  ecd6c0160f49ae83001dfd150df6b1238fc479d5 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 7fb724c61655c6f75c61572d65a46e21ae112574
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Sat Jul 1 14:28:08 2017 +0200

    doc: Document obsolete option in gpgsm.  Closes T2231.
    
    * doc/gpgsm.texi: Mark --prefer-system-dirmngr as obsolete.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2231

diff --git a/doc/gpgsm.texi b/doc/gpgsm.texi
index 79db177..5d79ce5 100644
--- a/doc/gpgsm.texi
+++ b/doc/gpgsm.texi
@@ -365,10 +365,7 @@ default value is @file{@value{BINDIR}/dirmngr}.
 
 @item --prefer-system-dirmngr
 @opindex prefer-system-dirmngr
-If a system wide @command{dirmngr} is running in daemon mode, first try
-to connect to this one.  Fallback to a pipe based server if this does
-not work.  Under Windows this option is ignored because the system dirmngr is
-always used.
+This option is obsolete and ignored.
 
 @item --disable-dirmngr
 Entirely disable the use of the Dirmngr.

-----------------------------------------------------------------------

Summary of changes:
 doc/gpgsm.texi | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul  3 10:17:57 2017
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Mon, 03 Jul 2017 10:17:57 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 8f26c705b1e424c606a55f02852148a1ba4bf0e4
Message-ID: <E1dRwYP-00061d-Ep@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  8f26c705b1e424c606a55f02852148a1ba4bf0e4 (commit)
      from  300ed7ad084ca45cc780a1b1b51d86c5951943a5 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8f26c705b1e424c606a55f02852148a1ba4bf0e4
Author: Neal H. Walfield <neal at gnu.org>
Date:   Mon Jul 3 10:15:40 2017 +0200

    campaign: Change video of the day to Sheera Frenkel (BuzzFeed)

diff --git a/web/donate/index.de.org b/web/donate/index.de.org
index 2fa1579..3ec48cf 100644
--- a/web/donate/index.de.org
+++ b/web/donate/index.de.org
@@ -222,8 +222,10 @@ href="/cgi-bin/procdonate.cgi?mode=preset&lang=de"
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Video des Tages: Meik Michalke
-            <small><a href="https://www.c3s.cc">Cultural Commons Collecting Society</a></small>
+	  <h2>Video des Tages: Sheera Frenkel
+            <small><a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
+              (Now with <a href="https://www.nytimes.com/">The New York Times</a>)
+            </small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.fr.org b/web/donate/index.fr.org
index 0545db6..e0e29c7 100644
--- a/web/donate/index.fr.org
+++ b/web/donate/index.fr.org
@@ -215,8 +215,10 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Clip du jour?: Meik Michalke
-            <small><a href="https://www.c3s.cc">Cultural Commons Collecting Society</a></small>
+	  <h2>Clip du jour?: Sheera Frenkel
+            <small><a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
+              (Now with <a href="https://www.nytimes.com/">The New York Times</a>)
+            </small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.ja.org b/web/donate/index.ja.org
index 822a259..5c01d1a 100644
--- a/web/donate/index.ja.org
+++ b/web/donate/index.ja.org
@@ -202,8 +202,10 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>?????: Meik Michalke
-            <small><a href="https://www.c3s.cc">Cultural Commons Collecting Society</a></small>
+	  <h2>?????: Sheera Frenkel
+            <small><a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
+              (Now with <a href="https://www.nytimes.com/">The New York Times</a>)
+            </small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.org b/web/donate/index.org
index 7341888..ad5be56 100644
--- a/web/donate/index.org
+++ b/web/donate/index.org
@@ -217,8 +217,10 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Video of the Day: Meik Michalke
-            <small><a href="https://www.c3s.cc">Cultural Commons Collecting Society</a></small>
+	  <h2>Video of the Day: Sheera Frenkel
+            <small><a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
+              (Now with <a href="https://www.nytimes.com/">The New York Times</a>)
+            </small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/share/campaign/campaign.js b/web/share/campaign/campaign.js
index 160900d..48ed06d 100644
--- a/web/share/campaign/campaign.js
+++ b/web/share/campaign/campaign.js
@@ -89,12 +89,11 @@ function get_param_from_url(name) {
 $(document).ready(function() {
 
     // VOTD: Update VOTD here.
-    let VIDLIST = "meik,seamus,andrew,geoffrey,hernani,leez,noah,c5,jochim,john,jason,sze,rysiek,ksenia,cindy,matt,thenmozhi,alex,andre,benjamin";
+    let VIDLIST = "sheera,meik,seamus,andrew,geoffrey,hernani,leez,noah,c5,jochim,john,jason,sze,rysiek,ksenia,cindy,matt,thenmozhi,alex,andre,benjamin";
 
     let YTID = { "main": "wNHhkntqklg",
 		 "thenmozhi": "sQMj332dgIE",
 		 "sze": "OpeFuKRYGVA",
-		 "sheera": "zwPaVA4vhDM",
 		 "noah": "xB6AvoeCWro",
 		 "michael": "w4PY1ihLm0w",
 		 "matt": "5MCGTd8pOG4",
@@ -115,7 +114,8 @@ $(document).ready(function() {
 		 "geoffrey": "K8-pmUyegYk",
 		 "andrew": "l1ByJCSvQKk",
 		 "seamus": "6dreAkVxmpg",
-		 "meik": "j0Zd0wZyLP8"
+		 "meik": "j0Zd0wZyLP8",
+		 "sheera": "mak22hXcslg"
 	       };
 
     /* For the video preview, we use this for devices without hover events.  */

-----------------------------------------------------------------------

Summary of changes:
 web/donate/index.de.org        | 6 ++++--
 web/donate/index.fr.org        | 6 ++++--
 web/donate/index.ja.org        | 6 ++++--
 web/donate/index.org           | 6 ++++--
 web/share/campaign/campaign.js | 6 +++---
 5 files changed, 19 insertions(+), 11 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul  3 11:03:48 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Mon, 03 Jul 2017 11:03:48 +0200
Subject: [git] GnuPG - branch, STABLE-BRANCH-1-4,
 updated. gnupg-1.4.21-7-g7b045f5
Message-ID: <E1dRxGm-0004In-Mk@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-1-4 has been updated
       via  7b045f539e5f67c937c18157c26fb3a767c1c7e6 (commit)
      from  2c2121ff3c2b90f21b75dd56c981b4d9e6d1c0e2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 7b045f539e5f67c937c18157c26fb3a767c1c7e6
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Mon Jul 3 11:02:42 2017 +0200

    doc: Fix typo.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 3243

diff --git a/doc/gpg.texi b/doc/gpg.texi
index e9935c3..00ed828 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -204,7 +204,7 @@ read from STDIN.  If only a one argument is given, it is expected to
 be a complete signature.
 
 With more than 1 argument, the first should be a detached signature
-and the remaining files ake up the the signed data. To read the signed
+and the remaining files make up the the signed data. To read the signed
 data from STDIN, use @samp{-} as the second filename.  For security
 reasons a detached signature cannot read the signed material from
 STDIN without denoting it in the above way.

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul  3 14:16:16 2017
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Mon, 03 Jul 2017 14:16:16 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 2780f8908b7b58f9590ed1f544610916b11c06b1
Message-ID: <E1dS0H2-00055m-Jh@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  2780f8908b7b58f9590ed1f544610916b11c06b1 (commit)
      from  8f26c705b1e424c606a55f02852148a1ba4bf0e4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2780f8908b7b58f9590ed1f544610916b11c06b1
Author: Neal H. Walfield <neal at gnu.org>
Date:   Mon Jul 3 13:40:19 2017 +0200

    campaign: Update image for Sheera Frenkel.

diff --git a/web/share/campaign/img/thumbs/sheera.jpg b/web/share/campaign/img/thumbs/sheera.jpg
index 79eaedb..e397303 100644
Binary files a/web/share/campaign/img/thumbs/sheera.jpg and b/web/share/campaign/img/thumbs/sheera.jpg differ

-----------------------------------------------------------------------

Summary of changes:
 web/share/campaign/img/thumbs/sheera.jpg | Bin 62228 -> 110396 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul  4 02:43:57 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 04 Jul 2017 02:43:57 +0200
Subject: [git] GCRYPT - branch, LIBGCRYPT-1-7-BRANCH,
 updated. libgcrypt-1.7.8-2-ga195d73
Message-ID: <E1dSBwc-0007n9-30@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, LIBGCRYPT-1-7-BRANCH has been updated
       via  a195d7346a8006f3b6fb77ccd6df8e91833d2b5a (commit)
      from  e57ce62112a017706a38b86ad2d079b59ec2130a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a195d7346a8006f3b6fb77ccd6df8e91833d2b5a
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jul 4 09:33:46 2017 +0900

    mpi: Fix mpi_set_secure.
    
    * mpi/mpiutil.c (mpi_set_secure): Allocate by ->alloced.
    
    --
    
    The code was simply wrong.  The question is if (1) it allocates
    (possibly) more or (2) modifi ->alloced.  The choice is (1).
    
    Because we have routines of mpi_set_cond and mpi_swap_cond which
    assume no change for the allocated length of limbs, no surprise is
    better.  See _gcry_mpi_ec_mul_point for concrete example for those
    routines.  That's for constant-time computation.
    
    Debian-bug-id: 866964
    Suggested-by: Mark Wooding <mdw at distorted.org.uk>
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>
    
    (backport from master commit:
    5feaf1cc8f22c1f8d19a34850d86fe190f1432e2)

diff --git a/mpi/mpiutil.c b/mpi/mpiutil.c
index 6dee0b9..3ae84c3 100644
--- a/mpi/mpiutil.c
+++ b/mpi/mpiutil.c
@@ -256,7 +256,7 @@ mpi_set_secure( gcry_mpi_t a )
       gcry_assert (!ap);
       return;
     }
-  bp = mpi_alloc_limb_space (a->nlimbs, 1);
+  bp = mpi_alloc_limb_space (a->alloced, 1);
   MPN_COPY( bp, ap, a->nlimbs );
   a->d = bp;
   _gcry_mpi_free_limb_space (ap, a->alloced);

-----------------------------------------------------------------------

Summary of changes:
 mpi/mpiutil.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul  4 02:44:10 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 04 Jul 2017 02:44:10 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-112-g5feaf1c
Message-ID: <E1dSBwo-0007nw-Tw@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  5feaf1cc8f22c1f8d19a34850d86fe190f1432e2 (commit)
      from  8725c99ffa41778f382ca97233183bcd687bb0ce (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5feaf1cc8f22c1f8d19a34850d86fe190f1432e2
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jul 4 09:33:46 2017 +0900

    mpi: Fix mpi_set_secure.
    
    * mpi/mpiutil.c (mpi_set_secure): Allocate by ->alloced.
    
    --
    
    The code was simply wrong.  The question is if (1) it allocates
    (possibly) more or (2) modifi ->alloced.  The choice is (1).
    
    Because we have routines of mpi_set_cond and mpi_swap_cond which
    assume no change for the allocated length of limbs, no surprise is
    better.  See _gcry_mpi_ec_mul_point for concrete example for those
    routines.  That's for constant-time computation.
    
    Debian-bug-id: 866964
    Suggested-by: Mark Wooding <mdw at distorted.org.uk>
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/mpi/mpiutil.c b/mpi/mpiutil.c
index 6dee0b9..3ae84c3 100644
--- a/mpi/mpiutil.c
+++ b/mpi/mpiutil.c
@@ -256,7 +256,7 @@ mpi_set_secure( gcry_mpi_t a )
       gcry_assert (!ap);
       return;
     }
-  bp = mpi_alloc_limb_space (a->nlimbs, 1);
+  bp = mpi_alloc_limb_space (a->alloced, 1);
   MPN_COPY( bp, ap, a->nlimbs );
   a->d = bp;
   _gcry_mpi_free_limb_space (ap, a->alloced);

-----------------------------------------------------------------------

Summary of changes:
 mpi/mpiutil.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul  4 14:27:23 2017
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Tue, 04 Jul 2017 14:27:23 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 5b13524415476be7351190c1ea5be403f361d0ff
Message-ID: <E1dSMvL-0002EX-DB@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  5b13524415476be7351190c1ea5be403f361d0ff (commit)
      from  2780f8908b7b58f9590ed1f544610916b11c06b1 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5b13524415476be7351190c1ea5be403f361d0ff
Author: Neal H. Walfield <neal at gnu.org>
Date:   Tue Jul 4 14:26:26 2017 +0200

    campaign: Change video of the day to Michael Stehmann.

diff --git a/web/donate/index.de.org b/web/donate/index.de.org
index 3ec48cf..3823fd1 100644
--- a/web/donate/index.de.org
+++ b/web/donate/index.de.org
@@ -222,10 +222,8 @@ href="/cgi-bin/procdonate.cgi?mode=preset&lang=de"
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Video des Tages: Sheera Frenkel
-            <small><a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
-              (Now with <a href="https://www.nytimes.com/">The New York Times</a>)
-            </small>
+	  <h2>Video des Tages: <a href="http://www.rechtsanwalt-stehmann.de/">Michael Stehmann</a>
+            <small>Lawyer</small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.fr.org b/web/donate/index.fr.org
index e0e29c7..a3a1e96 100644
--- a/web/donate/index.fr.org
+++ b/web/donate/index.fr.org
@@ -215,10 +215,8 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Clip du jour?: Sheera Frenkel
-            <small><a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
-              (Now with <a href="https://www.nytimes.com/">The New York Times</a>)
-            </small>
+	  <h2>Clip du jour?: <a href="http://www.rechtsanwalt-stehmann.de/">Michael Stehmann</a>
+            <small>Lawyer</small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.ja.org b/web/donate/index.ja.org
index 5c01d1a..5a185ef 100644
--- a/web/donate/index.ja.org
+++ b/web/donate/index.ja.org
@@ -202,10 +202,8 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>?????: Sheera Frenkel
-            <small><a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
-              (Now with <a href="https://www.nytimes.com/">The New York Times</a>)
-            </small>
+	  <h2>?????: <a href="http://www.rechtsanwalt-stehmann.de/">Michael Stehmann</a>
+            <small>Lawyer</small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.org b/web/donate/index.org
index ad5be56..92518f8 100644
--- a/web/donate/index.org
+++ b/web/donate/index.org
@@ -217,10 +217,8 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Video of the Day: Sheera Frenkel
-            <small><a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
-              (Now with <a href="https://www.nytimes.com/">The New York Times</a>)
-            </small>
+	  <h2>Video of the Day: <a href="http://www.rechtsanwalt-stehmann.de/">Michael Stehmann</a>
+            <small>Lawyer</small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/share/campaign/campaign.js b/web/share/campaign/campaign.js
index 48ed06d..4f852d2 100644
--- a/web/share/campaign/campaign.js
+++ b/web/share/campaign/campaign.js
@@ -89,13 +89,12 @@ function get_param_from_url(name) {
 $(document).ready(function() {
 
     // VOTD: Update VOTD here.
-    let VIDLIST = "sheera,meik,seamus,andrew,geoffrey,hernani,leez,noah,c5,jochim,john,jason,sze,rysiek,ksenia,cindy,matt,thenmozhi,alex,andre,benjamin";
+    let VIDLIST = "michael,sheera,meik,seamus,andrew,geoffrey,hernani,leez,noah,c5,jochim,john,jason,sze,rysiek,ksenia,cindy,matt,thenmozhi,alex,andre,benjamin";
 
     let YTID = { "main": "wNHhkntqklg",
 		 "thenmozhi": "sQMj332dgIE",
 		 "sze": "OpeFuKRYGVA",
 		 "noah": "xB6AvoeCWro",
-		 "michael": "w4PY1ihLm0w",
 		 "matt": "5MCGTd8pOG4",
 		 "john": "iRuo57Hzask",
 		 "jason": "oQvP9SXm-ek",
@@ -115,7 +114,8 @@ $(document).ready(function() {
 		 "andrew": "l1ByJCSvQKk",
 		 "seamus": "6dreAkVxmpg",
 		 "meik": "j0Zd0wZyLP8",
-		 "sheera": "mak22hXcslg"
+		 "sheera": "mak22hXcslg",
+                 "michael": "MSu_FF49MtU"
 	       };
 
     /* For the video preview, we use this for devices without hover events.  */

-----------------------------------------------------------------------

Summary of changes:
 web/donate/index.de.org        | 6 ++----
 web/donate/index.fr.org        | 6 ++----
 web/donate/index.ja.org        | 6 ++----
 web/donate/index.org           | 6 ++----
 web/share/campaign/campaign.js | 6 +++---
 5 files changed, 11 insertions(+), 19 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul  4 19:00:10 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Tue, 04 Jul 2017 19:00:10 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 54da0b03d0bd95519bf123392483916e89dfdd8a
Message-ID: <E1dSRBL-00088a-2M@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  54da0b03d0bd95519bf123392483916e89dfdd8a (commit)
      from  5b13524415476be7351190c1ea5be403f361d0ff (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 54da0b03d0bd95519bf123392483916e89dfdd8a
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Tue Jul 4 18:59:10 2017 +0200

    web: Restore obsolete manpage with out-of-date notice.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 1337

diff --git a/web/documentation/manpage.org b/web/documentation/manpage.org
new file mode 100644
index 0000000..de5dcab
--- /dev/null
+++ b/web/documentation/manpage.org
@@ -0,0 +1,795 @@
+#+TITLE: GnuPG - gpg man page
+#+STARTUP: showall
+#+SETUPFILE: "../share/setup.inc"
+#+OPTIONS: -:nil
+
+* Old Man Page
+
+This is a very old version of the gpg man page.  Please see the latest
+release or software package for your operating system to find an up to
+date version ("man gpg2").
+
+* gpg
+
+** Name
+
+gpg?--?encryption and signing tool
+
+** Synopsis
+
+#+BEGIN_EXAMPLE
+    gpg
+     [--homedir name]
+     [--options file]
+     [options]
+     command
+     [args]
+
+#+END_EXAMPLE
+
+** DESCRIPTION
+
+*gpg* is the main program for the GnuPG system.
+
+This man page does only list the commands and options available. For a
+more verbose documentation get the GNU Privacy Handbook (GPH), which is
+available at https://www.gnupg.org/gph/ . You will find a list of HOWTO
+documents at https://www.gnupg.org/docs.html .
+
+** COMMANDS
+
+*gpg* recognizes these commands:
+
+-  -s, --sign :: Make a signature. This command may be combined with
+   --encrypt.
+
+-  --clearsign :: Make a clear text signature.
+
+-  -b, --detach-sign :: Make a detached signature.
+
+-  -e, --encrypt :: Encrypt data. This option may be combined with
+   --sign.
+
+-  -c, --symmetric :: Encrypt with symmetric cipher only This command
+   asks for a passphrase.
+
+-  --store :: Store only (make a simple RFC1991 packet).
+
+-  --decrypt [ =file= ] :: Decrypt =file= (or stdin if no file is
+   specified) and write it to stdout (or the file specified with
+   --output). If the decrypted file is signed, the signature is also
+   verified. This command differs from the default operation, as it
+   never writes to the filename which is included in the file and it
+   rejects files which don't begin with an encrypted message.
+
+-  --verify [[ =sigfile= ] [ =signed-files= ]] :: Assume that =sigfile= is a
+   signature and verify it without generating any output. With no
+   arguments, the signature packet is read from stdin (it may be a
+   detached signature when not used in batch mode). If only a sigfile is
+   given, it may be a complete signature or a detached signature, in
+   which case the signed stuff is expected in a file without the ".sig"
+   or ".asc" extension (if such a file does not exist it is expected at
+   stdin; use a single dash ("-") as filename to force a read from
+   stdin). With more than 1 argument, the first should be a detached
+   signature and the remaining files are the signed stuff.
+
+-  --verify-files [ =files= ] :: This is a special version of the --verify
+   command which does not work with detached signatures. The command
+   expects the files to bee verified either on the commandline or reads
+   the filenames from stdin; each anem muts be on separate line. The
+   command is intended for quick checking of many files.
+
+-  --list-keys [ =names= ], --list-public-keys [ =names= ] :: List all keys
+   from the public keyrings, or just the ones given on the command line.
+
+-  --list-secret-keys [ =names= ] :: List all keys from the secret
+   keyrings, or just the ones given on the command line.
+
+-  --list-sigs [ =names= ] :: Same as --list-keys, but the signatures are
+   listed too.
+
+-  --check-sigs [ =names= ] :: Same as --list-sigs, but the signatures are
+   verified.
+
+-  --fingerprint [ =names= ] :: List all keys with their fingerprints.
+   This is the same output as --list-keys but with the additional output
+   of a line with the fingerprint. May also be combined with --list-sigs
+   or --check-sigs. If this command is given twice, the fingerprints of
+   all secondary keys are listed too.
+
+-  --list-packets :: List only the sequence of packets. This is mainly
+   useful for debugging.
+
+-  --gen-key :: Generate a new key pair. This command is normally only
+   used interactive.
+
+   There is an experimental feature which allows to create keys in batch
+   mode. See the file =doc/DETAILS= in the source distribution on how to
+   use this.
+
+-  --edit-key =name= :: Present a menu which enables you to do all key
+   related tasks:
+
+   -  sign :: Make a signature on key of user =name= If the key is not
+      yet signed by the default user (or the users given with -u), the
+      program displays the information of the key again, together with
+      its fingerprint and asks whether it should be signed. This
+      question is repeated for all users specified with -u.
+
+   -  lsign :: Same as --sign but the signature is marked as
+      non-exportable and will therefore never be used by others. This
+      may be used to make keys valid only in the local environment.
+
+   -  revsig :: Revoke a signature. GnuPG asks for every signature which
+      has been done by one of the secret keys, whether a revocation
+      certificate should be generated.
+
+   -  trust :: Change the owner trust value. This updates the trust-db
+      immediately and no save is required.
+
+   -  disable, enable :: Disable or enable an entire key. A disabled key
+      can normally not be used for encryption.
+
+   -  adduid :: Create an alternate user id.
+
+   -  deluid :: Delete an user id.
+
+   -  addkey :: Add a subkey to this key.
+
+   -  delkey :: Remove a subkey.
+
+   -  revkey :: Revoke a subkey.
+
+   -  expire :: Change the key expiration time. If a key is selected,
+      the time of this key will be changed. With no selection the key
+      expiration of the primary key is changed.
+
+   -  passwd :: Change the passphrase of the secret key.
+
+   -  uid =n= :: Toggle selection of user id with index =n=. Use 0 to
+      deselect all.
+
+   -  key =n= :: Toggle selection of subkey with index =n=. Use 0 to
+      deselect all.
+
+   -  check :: Check all selected user ids.
+
+   -  pref :: List preferences.
+
+   -  toggle :: Toggle between public and secret key listing.
+
+   -  save :: Save all changes to the key rings and quit.
+
+   -  quit :: Quit the program without updating the key rings.
+
+   The listing shows you the key with its secondary keys and all user
+   ids. Selected keys or user ids are indicated by an asterisk. The
+   trust value is displayed with the primary key: the first is the
+   assigned owner trust and the second is the calculated trust value.
+   Letters are used for the values:
+
+   -  - :: No ownertrust assigned / not yet calculated.
+
+   -  e :: Trust calculation has failed.
+
+   -  q :: Not enough information for calculation.
+
+   -  n :: Never trust this key.
+
+   -  m :: Marginally trusted.
+
+   -  f :: Fully trusted.
+
+   -  u :: Ultimately trusted.
+
+-  --sign-key =name= :: Sign a public key with you secret key. This is a
+   shortcut version of the subcommand "sign" from --edit.
+
+-  --lsign-key =name= :: Sign a public key with you secret key but mark
+   it as non-exportable. This is a shortcut version of the subcommand
+   "lsign" from --edit.
+
+-  --trusted-key =long key ID= :: Assume that the specified key (which
+   must be given as a full 8 byte key ID) is as trustworthy as one of
+   your own secret keys. This option is useful if you don't want to keep
+   your secret keys (or one of them) online but still be able to check
+   the validity of a given recipient's or signator's key.
+
+-  --delete-key =name= :: Remove key from the public keyring
+
+-  --delete-secret-key =name= :: Remove key from the secret and public
+   keyring
+
+-  --gen-revoke :: Generate a revocation certificate for the complete
+   key. To revoke a subkey or a signature, use the --edit command.
+
+-  --export [ =names= ] :: Either export all keys from all keyrings
+   (default keyrings and those registered via option --keyring), or if
+   at least one name is given, those of the given name. The new keyring
+   is written to stdout or to the file given with option "output". Use
+   together with --armor to mail those keys.
+
+-  --send-keys [ =names= ] :: Same as --export but sends the keys to a
+   keyserver. Option --keyserver must be used to give the name of this
+   keyserver. Don't send your complete keyring to a keyserver - select
+   only those keys which are new or changed by you.
+
+-  --export-all [ =names= ] :: Same as --export, but does also export keys
+   which are not compatible to OpenPGP.
+
+-  --export-secret-keys [ =names= ], --export-secret-subkeys
+   [ =names= ] :: Same as --export, but does export the secret keys. This
+   is normally not very useful and a security risk. the second form of
+   the command has the special property to render the secret part of the
+   primary key useless; this is a GNU extension to OpenPGP and other
+   implementations can not be expected to successful import such a key.
+
+-  --import [ =files= ], --fast-import [ =files= ] :: Import/merge keys.
+   This adds the given keys to the keyring. The fast version does not
+   build the trustdb; this can be done at any time with the command
+   --update-trustdb.
+
+   There are a few other options which control how this command works.
+   Most notable here is the --merge-only options which does not insert
+   new keys but does only the merging of new signatures, user-IDs and
+   subkeys.
+
+-  --recv-keys =key IDs= :: Import the keys with the given key IDs from
+   a HKP keyserver. Option --keyserver must be used to give the name of
+   this keyserver.
+
+-  --export-ownertrust :: List the assigned ownertrust values in ASCII
+   format for backup purposes
+
+-  --import-ownertrust [ =files= ] :: Update the trustdb with the
+   ownertrust values stored in =files= (or stdin if not given); existing
+   values will be overwritten.
+
+-  --print-md =algo= [ =files= ] :: Print message digest of algorithm ALGO
+   for all given files of stdin. If "*" is used for the algorithm,
+   digests for all available algorithms are printed.
+
+-  --gen-random =0|1|2= [ =count= ] :: Emit COUNT random bytes of the
+   given quality level. If count is not given or zero, an endless
+   sequence of random bytes will be emitted. PLEASE, don't use this
+   command unless you know what you are doing, it may remove precious
+   entropy from the system!
+
+-  --gen-prime =mode= =bits= [ =qbits= ] :: Use the source, Luke :-). The
+   output format is still subject to change.
+
+-  --version :: Print version information along with a list of supported
+   algorithms.
+
+-  --warranty :: Print warranty information.
+
+-  -h, --help :: Print usage information. This is a really long list
+   even it does list not all options.
+
+** OPTIONS
+
+Long options can be put in an options file (default "~/.gnupg/options").
+Do not write the 2 dashes, but simply the name of the option and any
+required arguments. Lines with a hash as the first non-white-space
+character are ignored. Commands may be put in this file too, but that
+does not make sense.
+
+*gpg* recognizes these options:
+
+-  -a, --armor :: Create ASCII armored output.
+
+-  -o, --output =file= :: Write output to =file=.
+
+-  -u, --local-user =name= :: Use =name= as the user ID to sign. This
+   option is silently ignored for the list commands, so that it can be
+   used in an options file.
+
+-  --default-key =name= :: Use =name= as default user ID for signatures.
+   If this is not used the default user ID is the first user ID found in
+   the secret keyring.
+
+-  -r, --recipient =name=,  :: Encrypt for user id =name=. If this
+   option is not specified, GnuPG asks for the user-id unless
+   --default-recipient is given
+
+-  --default-recipient =name= :: Use =name= as default recipient if
+   option --recipient is not used and don't ask if this is a valid one.
+   =name= must be a non empty.
+
+-  --default-recipient-self :: Use the default key as default recipient
+   if option --recipient is not used and don't ask if this is a valid
+   one. The default key is the first one from the secret keyring or the
+   one set with --default-key.
+
+-  --no-default-recipient :: Reset --default-recipient and
+   --default-recipient-self.
+
+-  --encrypt-to =name= :: Same as --recipient but this one is intended
+   for in the options file and may be used together with an own user-id
+   as an "encrypt-to-self". These keys are only used when there are
+   other recipients given either by use of --recipient or by the asked
+   user id. No trust checking is performed for these user ids and even
+   disabled keys can be used.
+
+-  --no-encrypt-to :: Disable the use of all --encrypt-to keys.
+
+-  -v, --verbose :: Give more information during processing. If used
+   twice, the input data is listed in detail.
+
+-  -q, --quiet :: Try to be as quiet as possible.
+
+-  -z =n= :: Set compression level to =n=. A value of 0 for =n= disables
+   compression. Default is to use the default compression level of zlib
+   (normally 6).
+
+-  -t, --textmode :: Use canonical text mode. If -t (but not --textmode)
+   is used together with armoring and signing, this enables clearsigned
+   messages. This kludge is needed for PGP compatibility; normally you
+   would use --sign or --clearsign to selected the type of the
+   signature.
+
+-  -n, --dry-run :: Don't make any changes (this is not completely
+   implemented).
+
+-  -i, --interactive :: Prompt before overwriting any files.
+
+-  --batch :: Use batch mode. Never ask, do not allow interactive
+   commands.
+
+-  --no-tty :: Make sure that the TTY (terminal) is never used for any
+   output. This option is needed in some cases because GnuPG sometimes
+   prints warnings to the TTY if if --batch is used.
+
+-  --no-batch :: Disable batch mode. This may be of use if --batch is
+   enabled from an options file.
+
+-  --yes :: Assume "yes" on most questions.
+
+-  --no :: Assume "no" on most questions.
+
+-  --always-trust :: Skip key validation and assume that used keys are
+   always fully trusted. You won't use this unless you have installed
+   some external validation scheme.
+
+-  --keyserver =name= :: Use =name= to lookup keys which are not yet in
+   your keyring. This is only done while verifying messages with
+   signatures. The option is also required for the command --send-keys
+   to specify the keyserver to where the keys should be send. All
+   keyservers synchronize with each other - so there is no need to send
+   keys to more than one server. Using the command "host -l pgp.net |
+   grep wwwkeys" gives you a list of keyservers. Because there is load
+   balancing using round-robin DNS you may notice that you get different
+   key servers.
+
+-  --no-auto-key-retrieve :: This option disables the automatic
+   retrieving of keys from a keyserver while verifying signatures. This
+   option allows to keep a keyserver in the options file or the
+   --send-keys and --recv-keys commands.
+
+-  --honor-http-proxy :: Try to access the keyserver over the proxy set
+   with the variable "http\_proxy".
+
+-  --keyring =file= :: Add =file= to the list of keyrings. If =file=
+   begins with a tilde and a slash, these are replaced by the HOME
+   directory. If the filename does not contain a slash, it is assumed to
+   be in the home-directory ("~/.gnupg" if --homedir is not used). The
+   filename may be prefixed with a scheme:
+
+   "gnupg-ring:" is the default one.
+
+   "gnupg-gdbm:" may be used for a GDBM ring. Note that GDBM is
+   experimental and likely to be removed in future versions.
+
+   It might make sense to use it together with --no-default-keyring.
+
+-  --secret-keyring =file= :: Same as --keyring but for the secret
+   keyrings.
+
+-  --homedir =directory= :: Set the name of the home directory to
+   =directory= If this option is not used it defaults to "~/.gnupg". It
+   does not make sense to use this in a options file. This also
+   overrides the environment variable "GNUPGHOME".
+
+-  --charset =name= :: Set the name of the native character set. This is
+   used to convert some strings to proper UTF-8 encoding. Valid values
+   for =name= are:
+
+   -  iso-8859-1 :: This is the default Latin 1 set.
+
+   -  iso-8859-2 :: The Latin 2 set.
+
+   -  koi8-r :: The usual Russian set (rfc1489).
+
+-  --utf8-strings, --no-utf8-strings :: Assume that the arguments are
+   already given as UTF8 strings. The default (--no-utf8-strings) is to
+   assume that arguments are encoded in the character set as specified
+   by --charset. These options effects all following arguments. Both
+   options may used multiple times.
+
+-  --options =file= :: Read options from =file= and do not try to read
+   them from the default options file in the homedir (see --homedir).
+   This option is ignored if used in an options file.
+
+-  --no-options :: Shortcut for "--options /dev/null". This option is
+   detected before an attempt to open an option file.
+
+-  --load-extension =name= :: Load an extension module. If =name= does
+   not contain a slash it is searched in "/usr/local/lib/gnupg" See the
+   manual for more information about extensions.
+
+-  --debug =flags= :: Set debugging flags. All flags are or-ed and
+   =flags= may be given in C syntax (e.g. 0x0042).
+
+-  --debug-all :: Set all useful debugging flags.
+
+-  --status-fd =n= :: Write special status strings to the file
+   descriptor =n=. See the file DETAILS in the documentation for a
+   listing of them.
+
+-  --logger-fd =n= :: Write log output to file descriptor =n= and not to
+   stderr.
+
+-  --no-comment :: Do not write comment packets. This option affects
+   only the generation of secret keys. Please note, that this has
+   nothing to do with the comments in clear text signatures.
+
+-  --comment =string= :: Use =string= as comment string in clear text
+   signatures. To suppress those comment strings entirely, use an empty
+   string here.
+
+-  --default-comment :: Force to write the standard comment string in
+   clear text signatures. Use this to overwrite a --comment from a
+   config file.
+
+-  --no-version :: Omit the version string in clear text signatures.
+
+-  --emit-version :: Force to write the version string in clear text
+   signatures. Use this to overwrite a previous --no-version from a
+   config file.
+
+-  -N, --notation-data =name=value= :: Put the name value pair into the
+   signature as notation data. =name= must consists only of alphanumeric
+   characters, digits or the underscore; the first character must not be
+   a digit. =value= may be any printable string; it will encoded in
+   UTF8, so sou should have check that your --charset is set right. If
+   you prefix =name= with an exclamation mark, the notation data will be
+   flagged as critical (rfc2440:5.2.3.15).
+
+-  --set-policy-url =string= :: Use =string= as Policy URL for
+   signatures (rfc2440:5.2.3.19). If you prefix it with an exclamation
+   mark, the policy URL packet will be flagged as critical.
+
+-  --set-filename =string= :: Use =string= as the name of file which is
+   stored in messages.
+
+-  --use-embedded-filename :: Try to create a file with a name as
+   embedded in the data. This can be a dangerous option as it allows to
+   overwrite files.
+
+-  --completes-needed =n= :: Number of completely trusted users to
+   introduce a new key signer (defaults to 1).
+
+-  --marginals-needed =n= :: Number of marginally trusted users to
+   introduce a new key signer (defaults to 3)
+
+-  --max-cert-depth =n= :: Maximum depth of a certification chain
+   (default is 5).
+
+-  --cipher-algo =name= :: Use =name= as cipher algorithm. Running the
+   program with the command --version yields a list of supported
+   algorithms. If this is not used the cipher algorithm is selected from
+   the preferences stored with the key.
+
+-  --digest-algo =name= :: Use =name= as message digest algorithm.
+   Running the program with the command --version yields a list of
+   supported algorithms. Please note that using this option may violate
+   the OpenPGP requirement, that a 160 bit hash is to be used for DSA.
+
+-  --s2k-cipher-algo =name= :: Use =name= as the cipher algorithm used
+   to protect secret keys. The default cipher is BLOWFISH. This cipher
+   is also used for conventional encryption if --cipher-algo is not
+   given.
+
+-  --s2k-digest-algo =name= :: Use =name= as the digest algorithm used
+   to mangle the passphrases. The default algorithm is RIPE-MD-160. This
+   digest algorithm is also used for conventional encryption if
+   --digest-algo is not given.
+
+-  --s2k-mode =n= :: Selects how passphrases are mangled. If =n= is 0 a
+   plain passphrase (which is not recommended) will be used, a 1
+   (default) adds a salt to the passphrase and a 3 iterates the whole
+   process a couple of times. Unless --rfc1991 is used, this mode is
+   also used for conventional encryption.
+
+-  --compress-algo =n= :: Use compress algorithm =n=. Default is 2 which
+   is RFC1950 compression. You may use 1 to use the old zlib version
+   (RFC1951) which is used by PGP. The default algorithm may give better
+   results because the window size is not limited to 8K. If this is not
+   used the OpenPGP behavior is used, i.e. the compression algorithm is
+   selected from the preferences; note, that this can't be done if you
+   do not encrypt the data.
+
+-  --disable-cipher-algo =name= :: Never allow the use of =name= as
+   cipher algorithm. The given name will not be checked so that a later
+   loaded algorithm will still get disabled.
+
+-  --disable-pubkey-algo =name= :: Never allow the use of =name= as
+   public key algorithm. The given name will not be checked so that a
+   later loaded algorithm will still get disabled.
+
+-  --throw-keyid :: Do not put the keyid into encrypted packets. This
+   option hides the receiver of the message and is a countermeasure
+   against traffic analysis. It may slow down the decryption process
+   because all available secret keys are tried.
+
+-  --not-dash-escaped :: This option changes the behavior of cleartext
+   signatures so that they can be used for patch files. You should not
+   send such an armored file via email because all spaces and line
+   endings are hashed too. You can not use this option for data which
+   has 5 dashes at the beginning of a line, patch files don't have this.
+   A special armor header line tells GnuPG about this cleartext
+   signature option.
+
+-  --escape-from-lines :: Because some mailers change lines starting
+   with "From " to "<From " it is good to handle such lines in a special
+   way when creating cleartext signatures. All other PGP versions do it
+   this way too. This option is not enabled by default because it would
+   violate rfc2440.
+
+-  --passphrase-fd =n= :: Read the passphrase from file descriptor =n=.
+   If you use 0 for =n=, the passphrase will be read from stdin. This
+   can only be used if only one passphrase is supplied. Don't use this
+   option if you can avoid it.
+
+-  --command-fd =n= :: This is a replacement for the depreciated
+   shared-memory IPC mode. If this option is enabled, user input on
+   questions is not expected from the TTY but from the given file
+   descriptor. It should be used together with --status-fd. See the file
+   doc/DETAILS in the source distribution for details on how to use it.
+
+-  --rfc1991 :: Try to be more RFC1991 (PGP 2.x) compliant.
+
+-  --openpgp :: Reset all packet, cipher and digest options to OpenPGP
+   behavior. Use this option to reset all previous options like
+   --rfc1991, --force-v3-sigs, --s2k-*, --cipher-algo, --digest-algo and
+   --compress-algo to OpenPGP compliant values. All PGP workarounds are
+   also disabled.
+
+-  --force-v3-sigs :: OpenPGP states that an implementation should
+   generate v4 signatures but PGP 5.x recognizes v4 signatures only on
+   key material. This options forces v3 signatures for signatures on
+   data.
+
+-  --force-mdc :: Force the use of encryption with appended manipulation
+   code. This is always used with the newer cipher (those with a
+   blocksize greater than 64 bit). This option might not be implemented
+   yet.
+
+-  --allow-non-selfsigned-uid :: Allow the import of keys with user IDs
+   which are not self-signed. This is only allows the import - key
+   validation will fail and you have to check the validity of the key my
+   other means. This hack is needed for some German keys generated with
+   pgp 2.6.3in. You should really avoid using it, because OpenPGP has
+   better mechanics to do separate signing and encryption keys.
+
+-  --allow-freeform-uid :: Disable all checks on the form of the user ID
+   while generating a new one. This option should only be used in very
+   special environments as it does not ensure the de-facto standard
+   format of user IDs.
+
+-  --ignore-time-conflict :: GnuPG normally checks that the timestamps
+   associated with keys and signatures have plausible values. However,
+   sometimes a signature seems to be older than the key due to clock
+   problems. This option makes these checks just a warning.
+
+-  --lock-once :: Lock the databases the first time a lock is requested
+   and do not release the lock until the process terminates.
+
+-  --lock-multiple :: Release the locks every time a lock is no longer
+   needed. Use this to override a previous --lock-once from a config
+   file.
+
+-  --lock-never :: Disable locking entirely. This option should be used
+   only in very special environments, where it can be assured that only
+   one process is accessing those files. A bootable floppy with a
+   standalone encryption system will probably use this. Improper usage
+   of this option may lead to data and key corruption.
+
+-  --no-random-seed-file :: GnuPG uses a file to store it's internal
+   random pool over invocations. This makes random generation faster;
+   however sometimes write operations are not desired. This option can
+   be used to achive that with the cost of slower random generation.
+
+-  --no-verbose :: Reset verbose level to 0.
+
+-  --no-greeting :: Suppress the initial copyright message but do not
+   enter batch mode.
+
+-  --no-secmem-warning :: Suppress the warning about "using insecure
+   memory".
+
+-  --no-armor :: Assume the input data is not in ASCII armored format.
+
+-  --no-default-keyring :: Do not add the default keyrings to the list
+   of keyrings.
+
+-  --skip-verify :: Skip the signature verification step. This may be
+   used to make the decryption faster if the signature verification is
+   not needed.
+
+-  --with-colons :: Print key listings delimited by colons.
+
+-  --with-key-data :: Print key listings delimited by colons and print
+   the public key data.
+
+-  --with-fingerprint :: Same as the command --fingerprint but changes
+   only the format of the output and may be used together with another
+   command.
+
+-  --fast-list-mode :: Changes the output of the list commands to work
+   faster; this is achieved by leaving some parts empty. Some
+   applications don't need the user ID and the trust information given
+   in the listings. By using this options they can get a faster listing.
+   The excact behaviour of this option may change in future versions.
+
+-  --list-only :: Changes the behaviour of some commands. This is like
+   --dry-run but different in some cases. The semantic of this command
+   may be extended in the future. Currently it does only skip the actual
+   decryption pass and therefore enables a fast listing of the
+   encryption keys.
+
+-  --no-literal :: This is not for normal use. Use the source to see for
+   what it might be useful.
+
+-  --set-filesize :: This is not for normal use. Use the source to see
+   for what it might be useful.
+
+-  --emulate-md-encode-bug :: GnuPG versions prior to 1.0.2 had a bug in
+   the way a signature was encode. This options enables a workaround by
+   checking faulty signatures again with the encoding used in old
+   versions. This may only happen for ElGamal signatures which are not
+   widely used.
+
+-  --show-session-key :: Display the session key used for one message.
+   See --override-session-key for the counterpart of this option.
+
+   We think that Key-Escrow is a Bad Thing; however the user should have
+   the freedom to decide whether to go to prison or to reveal the
+   content of one specific message without compromising all messages
+   ever encrypted for one secret key. DON'T USE IT UNLESS YOU ARE REALLY
+   FORCED TO DO SO.
+
+-  --override-session-key =string= :: Don't use the public key but the
+   session key =string=. The format of this string is the same as the
+   one printed by --show-session-key. This option is normally not used
+   but comes handy in case someone forces you to reveal the content of
+   an encrypted message; using this option you can do this without
+   handing out the secret key.
+
+-  --merge-only :: Don't insert new keys into the keyrings while doing
+   an import.
+
+-  --try-all-secrets :: Don't look at the key ID as stored in the
+   message but try all secret keys in turn to find the right decryption
+   key. This option forces the behaviour as used by anonymous recipients
+   (created by using --throw-keyid) and might come handy in case where
+   an encrypted message contains a bogus key ID.
+
+** How to specify a user ID
+
+There are different ways on how to specify a user ID to GnuPG; here are
+some examples:
+
+-   :: Used to locate the default home directory.
+
+-  234567C4, 0F34E556E, 01347A56A, 0xAB123456 :: Here the key ID is
+   given in the usual short form.
+
+-  234AABBCC34567C4, 0F323456784E56EAB, 01AB3FED1347A5612,
+   0x234AABBCC34567C4 :: Here the key ID is given in the long form as
+   used by OpenPGP.
+
+-  1234343434343434C434343434343434,
+   123434343434343C3434343434343734349A3434,
+   0E12343434343434343434EAB3484343434343434,
+   0xE12343434343434343434EAB3484343434343434 :: The best way to specify
+   a key ID is by using the fingerprint of the key. This avoids any
+   ambiguities in case that there are duplicated key IDs (which are
+   really rare for the long key IDs).
+
+-  =Heinrich Heine <heinrichh at uni-duesseldorf.de> :: Using an exact to
+   match string. The equal sign indicates this.
+
+-  <heinrichh at uni-duesseldorf.de> :: Using the email address part which
+   must match exactly. The left angle bracket indicates this email
+   address mode.
+
+-  +Heinrich Heine duesseldorf :: All words must match exactly (not case
+   sensitive) but can appear in any order in the user ID. Words are any
+   sequences of letters, digits, the underscore and all characters with
+   bit 7 set.
+
+-  #34 :: Using the Local ID. This is a very low level method and should
+   only be used by applications which really need it. The hash character
+   indicates this method. An application should not assume that this is
+   only a number.
+
+-  Heine, *Heine :: By case insensitive substring matching. This is the
+   default mode but applications may want to explicitely indicate this
+   by putting the asterisk in front.
+
+** RETURN VALUE
+
+The program returns 0 if everything was fine, 1 if at least a signature
+was bad, and other error codes for fatal errors.
+
+** EXAMPLES
+
+-  gpg -se -r =Bob= =file= :: sign and encrypt for user Bob
+
+-  gpg --clearsign =file= :: make a clear text signature
+
+-  gpg -sb =file= :: make a detached signature
+
+-  gpg --list-keys =user_ID= :: show keys
+
+-  gpg --fingerprint =user_ID= :: show fingerprint
+
+-  gpg --verify =pgpfile=, gpg --verify =sigfile= [ =files= ] :: Verify
+   the signature of the file but do not output the data. The second form
+   is used for detached signatures, where =sigfile= is the detached
+   signature (either ASCII armored of binary) and [ =files= ] are the
+   signed data; if this is not given the name of the file holding the
+   signed data is constructed by cutting off the extension (".asc" or
+   ".sig") of =sigfile= or by asking the user for the filename.
+
+** ENVIRONMENT
+
+-  HOME :: Used to locate the default home directory.
+
+-  GNUPGHOME :: If set directory used instead of "~/.gnupg".
+
+-  http\_proxy :: Only honored when the option --honor-http-proxy is
+   set.
+
+** FILES
+
+-  ~/.gnupg/secring.gpg :: The secret keyring
+
+-  ~/.gnupg/secring.gpg.lock :: and the lock file
+
+-  ~/.gnupg/pubring.gpg :: The public keyring
+
+-  ~/.gnupg/pubring.gpg.lock :: and the lock file
+
+-  ~/.gnupg/trustdb.gpg :: The trust database
+
+-  ~/.gnupg/trustdb.gpg.lock :: and the lock file
+
+-  ~/.gnupg/random\_seed :: used to preserve the internal random pool
+
+-  ~/.gnupg/options :: May contain options
+
+-  /usr[/local]/share/gnupg/options.skel :: Skeleton options file
+
+-  /usr[/local]/lib/gnupg/ :: Default location for extensions
+
+** WARNINGS
+
+Use a *good* password for your user account and a *good* passphrase to
+protect your secret key. This passphrase is the weakest part of the
+whole system. Programs to do dictionary attacks on your secret keyring
+are very easy to write and so you should protect your "~/.gnupg/"
+directory very well.
+
+Keep in mind that, if this program is used over a network (telnet), it
+is *very* easy to spy out your passphrase!
+
+** BUGS
+
+On many systems this program should be installed as setuid(root). This
+is necessary to lock memory pages. Locking memory pages prevents the
+operating system from writing memory pages to disk. If you get no
+warning message about insecure memory 3our operating system supports
+locking without being root. The program drops root privileges as soon as
+locked memory is allocated.

-----------------------------------------------------------------------

Summary of changes:
 web/documentation/manpage.org | 795 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 795 insertions(+)
 create mode 100644 web/documentation/manpage.org


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul  4 23:23:06 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Tue, 04 Jul 2017 23:23:06 +0200
Subject: [git] GnuPG - branch, STABLE-BRANCH-1-4,
 updated. gnupg-1.4.21-8-g782f804
Message-ID: <E1dSVHm-0003M9-R7@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-1-4 has been updated
       via  782f804765b6f4226fd77843e59f57dcca61b6fb (commit)
      from  7b045f539e5f67c937c18157c26fb3a767c1c7e6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 782f804765b6f4226fd77843e59f57dcca61b6fb
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Tue Jul 4 23:19:51 2017 +0200

    mpi: Fix ARM assembler in longlong.h.
    
    * mpi/longlong.h [__arm__] (add_ssaaaa, sub_ddmmss): Add __CLOBBER_CC.
    [__arm__][__ARM_ARCH <= 3] (umul_ppmm): Add __AND_CLOBBER_CC.
    
    --
    This is a backport of libgcrypt 8aa4f2161 and 3b1cc9e6c.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 3182

diff --git a/mpi/longlong.h b/mpi/longlong.h
index 4905268..0a28c67 100644
--- a/mpi/longlong.h
+++ b/mpi/longlong.h
@@ -189,7 +189,7 @@ extern UDItype __udiv_qrnnd ();
 	   : "%r" ((USItype)(ah)),                                      \
 	     "rI" ((USItype)(bh)),                                      \
 	     "%r" ((USItype)(al)),                                      \
-	     "rI" ((USItype)(bl)))
+	     "rI" ((USItype)(bl)) __CLOBBER_CC)
 #define sub_ddmmss(sh, sl, ah, al, bh, bl) \
   __asm__ ("subs %1, %4, %5\n"                                          \
 	   "sbc  %0, %2, %3"                                            \
@@ -198,7 +198,7 @@ extern UDItype __udiv_qrnnd ();
 	   : "r" ((USItype)(ah)),                                       \
 	     "rI" ((USItype)(bh)),                                      \
 	     "r" ((USItype)(al)),                                       \
-	     "rI" ((USItype)(bl)))
+	     "rI" ((USItype)(bl)) __CLOBBER_CC)
 #if defined __ARM_ARCH_2__ || defined __ARM_ARCH_3__
 #define umul_ppmm(xh, xl, a, b) \
   __asm__ ("%@ Inlined umul_ppmm\n"                                     \
@@ -218,7 +218,7 @@ extern UDItype __udiv_qrnnd ();
 	     "=r" ((USItype)(xl))                                       \
 	   : "r" ((USItype)(a)),                                        \
 	     "r" ((USItype)(b))                                         \
-	   : "r0", "r1", "r2")
+	   : "r0", "r1", "r2" __AND_CLOBBER_CC)
 #else
 #define umul_ppmm(xh, xl, a, b)                                         \
   __asm__ ("%@ Inlined umul_ppmm\n"                                     \

-----------------------------------------------------------------------

Summary of changes:
 mpi/longlong.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul  4 23:40:08 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Tue, 04 Jul 2017 23:40:08 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 1143a81c46915184313775cde2b46ba59f2a518a
Message-ID: <E1dSVYG-00068Z-7E@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  1143a81c46915184313775cde2b46ba59f2a518a (commit)
      from  54da0b03d0bd95519bf123392483916e89dfdd8a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1143a81c46915184313775cde2b46ba59f2a518a
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Tue Jul 4 23:39:39 2017 +0200

    web: Fix link to vn howto.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 1004

diff --git a/web/documentation/howtos.org b/web/documentation/howtos.org
index f79425c..5be52f8 100644
--- a/web/documentation/howtos.org
+++ b/web/documentation/howtos.org
@@ -20,7 +20,7 @@
    [[../howtos/fr/index.html][fr]] ?
    [[../howtos/it/GPGMiniHowto.html][it]] ?
    [[../howtos/tr/GPGMinikNasil.html][tr]] ?
-   [[../howtos/vn/index.html][vn]] .
+   [[../howtos/vn/index.htm][vn]] ?
    [[../howtos/zh/index.html][zh]] )
 -  as one big HTML file (
    [[../howtos/ca/GPGMiniHowto_big.html][ca]] ?

-----------------------------------------------------------------------

Summary of changes:
 web/documentation/howtos.org | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul  5 10:19:21 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 05 Jul 2017 10:19:21 +0200
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.27-14-g0148ea8
Message-ID: <E1dSfWr-0001Px-Rd@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  0148ea8d5acde2ad5d0376fb7eaa2221e88f258a (commit)
       via  d81b1379edbc6007a89c3b2fff1b51c8dfe2e868 (commit)
       via  5494a5728418938d2e42158bb646b07124184e64 (commit)
       via  d2aa2204cc7fc6b481412ed8ba9f65dfc64c6627 (commit)
       via  187e2ad24fb92210587beb779a1cc746821a169c (commit)
       via  55d560358f7ee4a8b68f98e051021a05d4c0bb1f (commit)
      from  4a9857a2b6d8a8e847638416d35398508b3291fd (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0148ea8d5acde2ad5d0376fb7eaa2221e88f258a
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 10:14:00 2017 +0200

    yat2m: Use version from libgpg-error.
    
    * doc/yat2m.c (VERSION): Define as PACKAGE_VERSION.
    * doc/Makefile.am (yat2m): Pass PACKAGE_VERSION with -D.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/Makefile.am b/doc/Makefile.am
index 849c661..d052283 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -35,7 +35,8 @@ myman_pages   = gpg-error-config.1
 man_MANS = $(myman_pages)
 
 yat2m: yat2m.c
-	$(CC_FOR_BUILD) -o $@ $(srcdir)/yat2m.c
+	$(CC_FOR_BUILD) -DPACKAGE_VERSION="\"$(PACKAGE_VERSION)\"" \
+                -o $@ $(srcdir)/yat2m.c
 
 
 yat2m-stamp: $(myman_sources)
diff --git a/doc/yat2m.c b/doc/yat2m.c
index 184d27b..27db491 100644
--- a/doc/yat2m.c
+++ b/doc/yat2m.c
@@ -128,7 +128,11 @@
 
 
 #define PGM "yat2m"
-#define VERSION "1.0"
+#ifdef PACKAGE_VERSION
+# define VERSION PACKAGE_VERSION
+#else
+# define VERSION "1.0"
+#endif
 
 /* The maximum length of a line including the linefeed and one extra
    character. */

commit d81b1379edbc6007a89c3b2fff1b51c8dfe2e868
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 10:08:13 2017 +0200

    build: Install yat2m.
    
    * doc/Makefile.am (install-exec-hook): New.
    (uninstall-local): Uninstall yat2m.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index bfea6e0..687e185 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,9 @@
 Noteworthy changes in version 1.28 (unreleased) [C22/A22/R_]
 -----------------------------------------------
 
+ * The formerly internal yat2m tool is now installed during a native
+   build.
+
  * Interface changes relative to the 1.27 release:
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
diff --git a/doc/Makefile.am b/doc/Makefile.am
index 565bb09..849c661 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -71,9 +71,22 @@ errorref.txt.x : errorref.txt
 	sed '/^##/ d' $< >$@
 	echo "# Installed by $(PACKAGE_NAME) $(PACKAGE_VERSION)" >>$@
 
+install-exec-hook:
+if CROSS_COMPILING
+	@echo "not install yat2m while cross-compiling"
+else
+	@echo "installing yat2m on the build system"; \
+         $(MKDIR_P) "$(DESTDIR)$(bindir)"; \
+	 $(INSTALL_PROGRAM_ENV) $(INSTALL_PROGRAM) \
+	         yat2m "$(DESTDIR)$(bindir)/yat2m"
+endif
+
 install-data-local: errorref.txt.x
 	$(mkinstalldirs) $(DESTDIR)$(pkgdatadir)
 	$(INSTALL_DATA) errorref.txt.x $(DESTDIR)$(pkgdatadir)/errorref.txt
 
 uninstall-local:
 	- at rm $(DESTDIR)$(pkgdatadir)/errorref.txt
+if !CROSS_COMPILING
+	- at rm $(DESTDIR)$(bindir)/yat2m
+endif

commit 5494a5728418938d2e42158bb646b07124184e64
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 09:14:38 2017 +0200

    yat2m: Take care of SOURCE_DATE_EPOCH.
    
    * doc/yat2m.c (main): Set a default for OPT_DATE.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/yat2m.c b/doc/yat2m.c
index 23fc6ba..184d27b 100644
--- a/doc/yat2m.c
+++ b/doc/yat2m.c
@@ -1,5 +1,5 @@
 /* yat2m.c - Yet Another Texi 2 Man converter
- *	Copyright (C) 2005, 2013, 2015, 2016 g10 Code GmbH
+ *	Copyright (C) 2005, 2013, 2015, 2016, 2017 g10 Code GmbH
  *      Copyright (C) 2006, 2008, 2011 Free Software Foundation, Inc.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -1478,6 +1478,7 @@ int
 main (int argc, char **argv)
 {
   int last_argc = -1;
+  const char *s;
 
   opt_source = "GNU";
   opt_release = "";
@@ -1611,6 +1612,11 @@ main (int argc, char **argv)
   if (argc > 1)
     die ("usage: " PGM " [OPTION] [FILE] (try --help for more information)\n");
 
+  /* Take care of supplied timestamp for reproducible builds.  See
+   * https://reproducible-builds.org/specs/source-date-epoch/  */
+  if (!opt_date && (s = getenv ("SOURCE_DATE_EPOCH")) && *s)
+    opt_date = s;
+
   /* Start processing. */
   if (argc && strcmp (*argv, "-"))
     {

commit d2aa2204cc7fc6b481412ed8ba9f65dfc64c6627
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 09:01:59 2017 +0200

    doc: Typo fix
    
    --

diff --git a/src/init.c b/src/init.c
index a1ee505..b01e089 100644
--- a/src/init.c
+++ b/src/init.c
@@ -214,7 +214,7 @@ _gpg_err_set_errno (int err)
 
 
 

-/* Internal tracing functions.  Except for TARCE_FP we use flockfile
+/* Internal tracing functions.  Except for TRACE_FP we use flockfile
  * and funlockfile to protect their use. */
 static FILE *trace_fp;
 static int trace_save_errno;

commit 187e2ad24fb92210587beb779a1cc746821a169c
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Sep 20 15:41:36 2016 +0900

    doc: minor fix for @xref.
    
    * doc/yat2m.c (proc_texi_cmd): Captalize "see" for xref.

diff --git a/doc/yat2m.c b/doc/yat2m.c
index a63260b..23fc6ba 100644
--- a/doc/yat2m.c
+++ b/doc/yat2m.c
@@ -730,7 +730,7 @@ proc_texi_cmd (FILE *fp, const char *command, const char *rest, size_t len,
     { "anchor",  7 },
     { "cartouche", 1 },
     { "ref",     0, "[", "]" },
-    { "xref",    0, "see: [", "]" },
+    { "xref",    0, "See: [", "]" },
     { "pxref",   0, "see: [", "]" },
     { "uref",    0, "(\\fB", "\\fR)" },
     { "footnote",0, " ([", "])" },

commit 55d560358f7ee4a8b68f98e051021a05d4c0bb1f
Author: Justus Winter <justus at g10code.com>
Date:   Mon Sep 19 15:25:01 2016 +0200

    doc: Implement simple '@ref'erences.
    
    * doc/yat2m.c (proc_texi_cmd): Handle '@ref'.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/yat2m.c b/doc/yat2m.c
index 9b76f19..a63260b 100644
--- a/doc/yat2m.c
+++ b/doc/yat2m.c
@@ -729,6 +729,7 @@ proc_texi_cmd (FILE *fp, const char *command, const char *rest, size_t len,
     { "asis",    7 },
     { "anchor",  7 },
     { "cartouche", 1 },
+    { "ref",     0, "[", "]" },
     { "xref",    0, "see: [", "]" },
     { "pxref",   0, "see: [", "]" },
     { "uref",    0, "(\\fB", "\\fR)" },

-----------------------------------------------------------------------

Summary of changes:
 NEWS            |  3 +++
 doc/Makefile.am | 16 +++++++++++++++-
 doc/yat2m.c     | 17 ++++++++++++++---
 src/init.c      |  2 +-
 4 files changed, 33 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul  5 11:06:05 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 05 Jul 2017 11:06:05 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-81-g139de02
Message-ID: <E1dSgG7-0007Co-5A@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  139de02b93773615bdd95e04a7f0c1ad73b4f6fb (commit)
       via  f6faa058749846de18cb34f1cc79867bb0029922 (commit)
      from  7fb724c61655c6f75c61572d65a46e21ae112574 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 139de02b93773615bdd95e04a7f0c1ad73b4f6fb
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 09:14:38 2017 +0200

    doc: Update yat2m to take care of SOURCE_DATE_EPOCH.
    
    * doc/yat2m.c (main): Set a default for OPT_DATE.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/yat2m.c b/doc/yat2m.c
index 23fc6ba..c7bec33 100644
--- a/doc/yat2m.c
+++ b/doc/yat2m.c
@@ -1,5 +1,5 @@
 /* yat2m.c - Yet Another Texi 2 Man converter
- *	Copyright (C) 2005, 2013, 2015, 2016 g10 Code GmbH
+ *	Copyright (C) 2005, 2013, 2015, 2016, 2017 g10 Code GmbH
  *      Copyright (C) 2006, 2008, 2011 Free Software Foundation, Inc.
  *
  * This program is free software; you can redistribute it and/or modify
@@ -16,6 +16,12 @@
  * along with this program; if not, see <https://www.gnu.org/licenses/>.
  */
 
+/**********************************************
+ * Note: The canonical source of this tool   **
+ *       is part of libgpg-error and it      **
+ *       installs yat2m on the build system. **
+ **********************************************/
+
 /*
     This is a simple texinfo to man page converter.  It needs some
     special markup in th e texinfo and tries best to get a create man
@@ -1478,6 +1484,7 @@ int
 main (int argc, char **argv)
 {
   int last_argc = -1;
+  const char *s;
 
   opt_source = "GNU";
   opt_release = "";
@@ -1611,6 +1618,11 @@ main (int argc, char **argv)
   if (argc > 1)
     die ("usage: " PGM " [OPTION] [FILE] (try --help for more information)\n");
 
+  /* Take care of supplied timestamp for reproducible builds.  See
+   * https://reproducible-builds.org/specs/source-date-epoch/  */
+  if (!opt_date && (s = getenv ("SOURCE_DATE_EPOCH")) && *s)
+    opt_date = s;
+
   /* Start processing. */
   if (argc && strcmp (*argv, "-"))
     {

commit f6faa058749846de18cb34f1cc79867bb0029922
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 10:49:13 2017 +0200

    doc: Prefer an installed version of yat2m
    
    * configure.ac (YAT2M): Check for tool.
    * doc/Makefile.am (yat2m-stamp): Use installed tool if possible.
    --

diff --git a/configure.ac b/configure.ac
index 5ab8a53..56cb78e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -605,6 +605,8 @@ AC_PROG_RANLIB
 AC_CHECK_TOOL(AR, ar, :)
 AC_PATH_PROG(PERL,"perl")
 AC_CHECK_TOOL(WINDRES, windres, :)
+AC_PATH_PROG(YAT2M, "yat2m", "./yat2m" )
+AC_ARG_VAR(YAT2M, [tool to convert texi to man pages])
 AC_ISC_POSIX
 AC_SYS_LARGEFILE
 GNUPG_CHECK_USTAR
diff --git a/doc/Makefile.am b/doc/Makefile.am
index 0c78284..1fa04b4 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -146,12 +146,12 @@ yat2m-stamp: $(myman_sources) defs.inc
 	@touch yat2m-stamp.tmp
 	incd="`test -f defsincdate || echo '$(srcdir)/'`defsincdate"; \
 	for file in $(myman_sources) ; do \
-              ./yat2m $(YAT2M_OPTIONS) --store \
+              $(YAT2M) $(YAT2M_OPTIONS) --store \
                   --date "`cat $$incd 2>/dev/null`" \
 	          `test -f '$$file' || echo '$(srcdir)/'`$$file ; done
 	@mv -f yat2m-stamp.tmp $@
 
-yat2m-stamp: yat2m
+yat2m-stamp: $(YAT2M)
 
 $(myman_pages) gnupg.7 : yat2m-stamp defs.inc
 	@if test -f $@; then :; else \

-----------------------------------------------------------------------

Summary of changes:
 configure.ac    |  2 ++
 doc/Makefile.am |  4 ++--
 doc/yat2m.c     | 14 +++++++++++++-
 3 files changed, 17 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul  5 11:59:34 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 05 Jul 2017 11:59:34 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-82-g3681ee7
Message-ID: <E1dSh5r-0006JG-Cn@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  3681ee7dc1e9d8c94fdb046d7be0bbcfeba1cfe9 (commit)
      from  139de02b93773615bdd95e04a7f0c1ad73b4f6fb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 3681ee7dc1e9d8c94fdb046d7be0bbcfeba1cfe9
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 11:54:45 2017 +0200

    agent: Use MAX_PASSPHRASE_LEN (255) also for the loopback.
    
    * agent/call-pinentry.c (agent_get_passphrase): Reduce maximum
    passphrase length as conveyed to the loopback to MAX_PASSPHRASE_LEN.
    * agent/genkey.c (agent_ask_new_passphrase): Extend the maximum
    passphrase as conveyed to the loopback to MAX_PASSPHRASE_LEN.
    --
    
    Note that in genkey() max_length is set to MAX_PASSPHRASE_LEN + 1
    because in agent_askpin() decrements that value before conveying it to
    the loopback.
    
    GnuPG-bug-id: 3254
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/call-pinentry.c b/agent/call-pinentry.c
index 9d8e7f6..cb7997f 100644
--- a/agent/call-pinentry.c
+++ b/agent/call-pinentry.c
@@ -964,8 +964,8 @@ agent_askpin (ctrl_t ctrl,
 	  size_t size;
 
 	  *pininfo->pin = 0; /* Reset the PIN. */
-	  rc = pinentry_loopback(ctrl, "PASSPHRASE", &passphrase, &size,
-		  pininfo->max_length - 1);
+	  rc = pinentry_loopback (ctrl, "PASSPHRASE", &passphrase, &size,
+                                  pininfo->max_length - 1);
 	  if (rc)
 	    return rc;
 
@@ -1192,10 +1192,10 @@ agent_get_passphrase (ctrl_t ctrl,
       if (ctrl->pinentry_mode == PINENTRY_MODE_LOOPBACK)
         {
 	  size_t size;
-	  size_t len = ASSUAN_LINELENGTH/2;
 
 	  return pinentry_loopback (ctrl, "PASSPHRASE",
-				    (unsigned char **)retpass, &size, len);
+				    (unsigned char **)retpass, &size,
+                                    MAX_PASSPHRASE_LEN);
         }
       return gpg_error (GPG_ERR_NO_PIN_ENTRY);
     }
diff --git a/agent/genkey.c b/agent/genkey.c
index 31742a1..a3e37ee 100644
--- a/agent/genkey.c
+++ b/agent/genkey.c
@@ -357,10 +357,10 @@ agent_ask_new_passphrase (ctrl_t ctrl, const char *prompt,
   if (ctrl->pinentry_mode == PINENTRY_MODE_LOOPBACK)
     {
 	size_t size;
-	size_t len = 100;
 	unsigned char *buffer;
 
-	err = pinentry_loopback(ctrl, "NEW_PASSPHRASE", &buffer, &size, len);
+	err = pinentry_loopback (ctrl, "NEW_PASSPHRASE", &buffer, &size,
+                                 MAX_PASSPHRASE_LEN);
 	if (!err)
 	  {
 	    if (size)

-----------------------------------------------------------------------

Summary of changes:
 agent/call-pinentry.c | 8 ++++----
 agent/genkey.c        | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul  5 12:14:30 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 05 Jul 2017 12:14:30 +0200
Subject: [git] GPG-ERROR - branch, master,
 updated. libgpg-error-1.27-16-g0f5c3f6
Message-ID: <E1dShKI-0000Zp-7u@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "Error codes used by GnuPG et al.".

The branch, master has been updated
       via  0f5c3f67946fb5389df5b9963e6976b462bf5726 (commit)
       via  9de27cbabed8062bfb4eafffba9ff38108f5377e (commit)
      from  0148ea8d5acde2ad5d0376fb7eaa2221e88f258a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0f5c3f67946fb5389df5b9963e6976b462bf5726
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 12:08:26 2017 +0200

    syscfg: Add lock-obj-pub file for ia64-unknown-linux-gnu.
    
    * src/syscfg/lock-obj-pub.ia64-unknown-linux-gnu.h: new.
    * src/Makefile.am (lock_obj_pub): Add it.
    --
    
    GnuPG-bug-id: 3242
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/Makefile.am b/src/Makefile.am
index 398ec5e..e4ebb6a 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -73,6 +73,7 @@ lock_obj_pub = \
         syscfg/lock-obj-pub.x86_64-pc-linux-gnux32.h        \
         syscfg/lock-obj-pub.x86_64-pc-linux-musl.h          \
 	syscfg/lock-obj-pub.tilegx-unknown-linux-gnu.h      \
+	syscfg/lock-obj-pub.ia64-unknown-linux-gnu.h        \
 	syscfg/lock-obj-pub.mingw32.h
 
 
diff --git a/src/syscfg/lock-obj-pub.ia64-unknown-linux-gnu.h b/src/syscfg/lock-obj-pub.ia64-unknown-linux-gnu.h
new file mode 100644
index 0000000..7cf980a
--- /dev/null
+++ b/src/syscfg/lock-obj-pub.ia64-unknown-linux-gnu.h
@@ -0,0 +1,25 @@
+## lock-obj-pub.ia64-unknown-linux-gnu.h
+## File created by gen-posix-lock-obj - DO NOT EDIT
+## To be included by mkheader into gpg-error.h
+
+typedef struct
+{
+  long _vers;
+  union {
+    volatile char _priv[40];
+    long _x_align;
+    long *_xp_align;
+  } u;
+} gpgrt_lock_t;
+
+#define GPGRT_LOCK_INITIALIZER {1,{{0,0,0,0,0,0,0,0, \
+                                    0,0,0,0,0,0,0,0, \
+                                    0,0,0,0,0,0,0,0, \
+                                    0,0,0,0,0,0,0,0, \
+                                    0,0,0,0,0,0,0,0}}}
+##
+## Local Variables:
+## mode: c
+## buffer-read-only: t
+## End:
+##

commit 9de27cbabed8062bfb4eafffba9ff38108f5377e
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 10:18:53 2017 +0200

    yat2m: Change bug report address.
    
    --

diff --git a/doc/yat2m.c b/doc/yat2m.c
index 27db491..8c6319c 100644
--- a/doc/yat2m.c
+++ b/doc/yat2m.c
@@ -1521,13 +1521,13 @@ main (int argc, char **argv)
                 "  -I DIR           also search in include DIR\n"
                 "  -D gpgone        the only usable define\n\n"
                 "With no FILE, or when FILE is -, read standard input.\n\n"
-                "Report bugs to <bugs at g10code.com>.");
+                "Report bugs to <https://bugs.gnupg.org>.");
           exit (0);
         }
       else if (!strcmp (*argv, "--version"))
         {
           puts (PGM " " VERSION "\n"
-               "Copyright (C) 2005 g10 Code GmbH\n"
+               "Copyright (C) 2005, 2017 g10 Code GmbH\n"
                "This program comes with ABSOLUTELY NO WARRANTY.\n"
                "This is free software, and you are welcome to redistribute it\n"
                 "under certain conditions. See the file COPYING for details.");

-----------------------------------------------------------------------

Summary of changes:
 doc/yat2m.c                                                           | 4 ++--
 src/Makefile.am                                                       | 1 +
 ...ub.s390x-ibm-linux-gnu.h => lock-obj-pub.ia64-unknown-linux-gnu.h} | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)
 copy src/syscfg/{lock-obj-pub.s390x-ibm-linux-gnu.h => lock-obj-pub.ia64-unknown-linux-gnu.h} (93%)


hooks/post-receive
-- 
Error codes used by GnuPG et al.
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul  5 15:20:18 2017
From: cvs at cvs.gnupg.org (by Damien Goutte-Gattat)
Date: Wed, 05 Jul 2017 15:20:18 +0200
Subject: [git] Pinentry - branch, master, updated. pinentry-1.0.0-22-gf69dadc
Message-ID: <E1dSkE6-0000pL-GA@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The standard pinentry collection".

The branch, master has been updated
       via  f69dadc6ccea7672869436291ab5c1f58d545466 (commit)
       via  8fbdf99d3a4f72d59b7cda7149793044635a1655 (commit)
      from  4101806bf73caf25c8ce4e455b154901da1fe788 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f69dadc6ccea7672869436291ab5c1f58d545466
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Wed Jul 5 11:22:46 2017 +0200

    gtk: Always set the window as transient.
    
    * gtk+-2/pinentry-gtk-2.c (create_window): Setup the make_transient
    callback whether we ask for a passphrase or not.
    --
    
    Making the window transient seems necessary for (at least some)
    tiling window managers to make sure the dialog is floating.
    
    GnuPG-bug-id: 3253
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/gtk+-2/pinentry-gtk-2.c b/gtk+-2/pinentry-gtk-2.c
index dee0360..d467ec5 100644
--- a/gtk+-2/pinentry-gtk-2.c
+++ b/gtk+-2/pinentry-gtk-2.c
@@ -113,9 +113,9 @@ constrain_size (GtkWidget *win, GtkRequisition *req, gpointer data)
 }
 
 
-/* Realize the window as transient if we grab the keyboard.  This
-   makes the window a modal dialog to the root window, which helps the
-   window manager.  See the following quote from:
+/* Realize the window as transient.  This makes the window a modal
+   dialog to the root window, which helps the window manager.
+   See the following quote from:
    https://standards.freedesktop.org/wm-spec/wm-spec-1.4.html#id2512420
 
    Implementing enhanced support for application transient windows
@@ -586,12 +586,12 @@ create_window (pinentry_t ctx)
 #endif
   g_signal_connect (G_OBJECT (win), "size-request",
 		    G_CALLBACK (constrain_size), NULL);
+
+  g_signal_connect (G_OBJECT (win),
+		    "realize", G_CALLBACK (make_transient), NULL);
+
   if (!confirm_mode)
     {
-      if (pinentry->grab)
-	g_signal_connect (G_OBJECT (win),
-			  "realize", G_CALLBACK (make_transient), NULL);
-
       /* We need to grab the keyboard when its visible! not when its
          mapped (there is a difference)  */
       g_object_set (G_OBJECT(win), "events",

commit 8fbdf99d3a4f72d59b7cda7149793044635a1655
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Feb 22 18:43:50 2017 +0100

    core: Add example on how to print a FEATURES line.
    
    --

diff --git a/pinentry/pinentry.c b/pinentry/pinentry.c
index 517a033..0d889a6 100644
--- a/pinentry/pinentry.c
+++ b/pinentry/pinentry.c
@@ -1624,6 +1624,8 @@ cmd_getinfo (assuan_context_t ctx, char *line)
                 flavor_flag? flavor_flag : "");
       buffer[sizeof buffer -1] = 0;
       rc = assuan_send_data (ctx, buffer, strlen (buffer));
+      /* if (!rc) */
+      /*   rc = assuan_write_status (ctx, "FEATURES", "tabbing foo bar"); */
     }
   else if (!strcmp (line, "ttyinfo"))
     {

-----------------------------------------------------------------------

Summary of changes:
 gtk+-2/pinentry-gtk-2.c | 14 +++++++-------
 pinentry/pinentry.c     |  2 ++
 2 files changed, 9 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
The standard pinentry collection
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul  5 20:16:38 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 05 Jul 2017 20:16:38 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-114-g85a9a91
Message-ID: <E1dSoqs-0008Br-IH@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  85a9a913da9ecc6b2cd6f743e90e49983251d706 (commit)
       via  0d30a4a9791d20c8881b5b12bd44611d9f4274cd (commit)
      from  5feaf1cc8f22c1f8d19a34850d86fe190f1432e2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 85a9a913da9ecc6b2cd6f743e90e49983251d706
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 20:10:56 2017 +0200

    build: Minor API fixes to fix build problems on AIX.
    
    * src/gcrypt.h.in (gcry_error_from_errno): Fix return type.
    * src/visibility.c (gcry_md_extract): Change return type to match the
    prototype.
    --
    
    IBM compiler optimize enums and thus enums may be shorter than an
    unsigned int.  Thus an
    
      assert (sizeof (gpg_error_t) == sizeof (gpg_err_code_t)
    
    would fail.  The deatils seem to depend on the passed compiler options
    which explains that it has been only reported now.
    
    GnuPG-bug-id: 3256
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/gcrypt.h.in b/src/gcrypt.h.in
index 8d20c83..9a9acc4 100644
--- a/src/gcrypt.h.in
+++ b/src/gcrypt.h.in
@@ -189,7 +189,7 @@ int gcry_err_code_to_errno (gcry_err_code_t code);
 gcry_error_t gcry_err_make_from_errno (gcry_err_source_t source, int err);
 
 /* Return an error value with the system error ERR.  */
-gcry_err_code_t gcry_error_from_errno (int err);
+gcry_error_t gcry_error_from_errno (int err);
 
 

 /* NOTE: Since Libgcrypt 1.6 the thread callbacks are not anymore
diff --git a/src/visibility.c b/src/visibility.c
index 7bf3d57..fe46c82 100644
--- a/src/visibility.c
+++ b/src/visibility.c
@@ -1174,10 +1174,10 @@ gcry_md_read (gcry_md_hd_t hd, int algo)
   return _gcry_md_read (hd, algo);
 }
 
-gcry_err_code_t
+gcry_error_t
 gcry_md_extract (gcry_md_hd_t hd, int algo, void *buffer, size_t length)
 {
-  return _gcry_md_extract(hd, algo, buffer, length);
+  return gpg_error (_gcry_md_extract(hd, algo, buffer, length));
 }
 
 void

commit 0d30a4a9791d20c8881b5b12bd44611d9f4274cd
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 20:05:41 2017 +0200

    tools: Add left shift to mpicalc.
    
    * src/mpicalc.c (do_lshift): New.
    (main): Handle '<'.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/mpicalc.c b/src/mpicalc.c
index ebd1bbb..11246f3 100644
--- a/src/mpicalc.c
+++ b/src/mpicalc.c
@@ -232,6 +232,17 @@ do_gcd (void)
 }
 
 static void
+do_lshift (void)
+{
+  if (stackidx < 1)
+    {
+      fputs ("stack underflow\n", stderr);
+      return;
+    }
+  mpi_lshift (stack[stackidx - 1], stack[stackidx - 1], 1);
+}
+
+static void
 do_rshift (void)
 {
   if (stackidx < 1)
@@ -242,7 +253,6 @@ do_rshift (void)
   mpi_rshift (stack[stackidx - 1], stack[stackidx - 1], 1);
 }
 
-
 static void
 do_nbits (void)
 {
@@ -305,6 +315,7 @@ print_help (void)
          "*   multiply      [0] := [1] * [0]          {-1}\n"
          "/   divide        [0] := [1] - [0]          {-1}\n"
          "%   modulo        [0] := [1] % [0]          {-1}\n"
+         "<   left shift    [0] := [0] << 1           {0}\n"
          ">   right shift   [0] := [0] >> 1           {0}\n"
          "++  increment     [0] := [0]++              {0}\n"
          "--  decrement     [0] := [0]--              {0}\n"
@@ -487,6 +498,9 @@ main (int argc, char **argv)
 		case '^':
 		  do_powm ();
 		  break;
+		case '<':
+		  do_lshift ();
+		  break;
 		case '>':
 		  do_rshift ();
 		  break;

-----------------------------------------------------------------------

Summary of changes:
 src/gcrypt.h.in  |  2 +-
 src/mpicalc.c    | 16 +++++++++++++++-
 src/visibility.c |  4 ++--
 3 files changed, 18 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul  5 20:18:03 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 05 Jul 2017 20:18:03 +0200
Subject: [git] GCRYPT - branch, LIBGCRYPT-1-7-BRANCH,
 updated. libgcrypt-1.7.8-4-g23f473d
Message-ID: <E1dSosF-0008G0-6j@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, LIBGCRYPT-1-7-BRANCH has been updated
       via  23f473d04d16a2ec8dbd2537719c782ae233e7d8 (commit)
       via  a9091d7f72cd9fec1d0f9ac6a56565d9cb3fc518 (commit)
      from  a195d7346a8006f3b6fb77ccd6df8e91833d2b5a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 23f473d04d16a2ec8dbd2537719c782ae233e7d8
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 20:10:56 2017 +0200

    build: Minor API fixes to fix build problems on AIX.
    
    * src/gcrypt.h.in (gcry_error_from_errno): Fix return type.
    * src/visibility.c (gcry_md_extract): Change return type to match the
    prototype.
    --
    
    IBM compiler optimize enums and thus enums may be shorter than an
    unsigned int.  Thus an
    
      assert (sizeof (gpg_error_t) == sizeof (gpg_err_code_t)
    
    would fail.  The deatils seem to depend on the passed compiler options
    which explains that it has been only reported now.
    
    GnuPG-bug-id: 3256
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/gcrypt.h.in b/src/gcrypt.h.in
index 34a3cb7..f71e362 100644
--- a/src/gcrypt.h.in
+++ b/src/gcrypt.h.in
@@ -189,7 +189,7 @@ int gcry_err_code_to_errno (gcry_err_code_t code);
 gcry_error_t gcry_err_make_from_errno (gcry_err_source_t source, int err);
 
 /* Return an error value with the system error ERR.  */
-gcry_err_code_t gcry_error_from_errno (int err);
+gcry_error_t gcry_error_from_errno (int err);
 
 

 /* NOTE: Since Libgcrypt 1.6 the thread callbacks are not anymore
diff --git a/src/visibility.c b/src/visibility.c
index 3abbd37..28edaf7 100644
--- a/src/visibility.c
+++ b/src/visibility.c
@@ -1174,10 +1174,10 @@ gcry_md_read (gcry_md_hd_t hd, int algo)
   return _gcry_md_read (hd, algo);
 }
 
-gcry_err_code_t
+gcry_error_t
 gcry_md_extract (gcry_md_hd_t hd, int algo, void *buffer, size_t length)
 {
-  return _gcry_md_extract(hd, algo, buffer, length);
+  return gpg_error (_gcry_md_extract(hd, algo, buffer, length));
 }
 
 void

commit a9091d7f72cd9fec1d0f9ac6a56565d9cb3fc518
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 5 20:05:41 2017 +0200

    tools: Add left shift to mpicalc.
    
    * src/mpicalc.c (do_lshift): New.
    (main): Handle '<'.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/mpicalc.c b/src/mpicalc.c
index ebd1bbb..11246f3 100644
--- a/src/mpicalc.c
+++ b/src/mpicalc.c
@@ -232,6 +232,17 @@ do_gcd (void)
 }
 
 static void
+do_lshift (void)
+{
+  if (stackidx < 1)
+    {
+      fputs ("stack underflow\n", stderr);
+      return;
+    }
+  mpi_lshift (stack[stackidx - 1], stack[stackidx - 1], 1);
+}
+
+static void
 do_rshift (void)
 {
   if (stackidx < 1)
@@ -242,7 +253,6 @@ do_rshift (void)
   mpi_rshift (stack[stackidx - 1], stack[stackidx - 1], 1);
 }
 
-
 static void
 do_nbits (void)
 {
@@ -305,6 +315,7 @@ print_help (void)
          "*   multiply      [0] := [1] * [0]          {-1}\n"
          "/   divide        [0] := [1] - [0]          {-1}\n"
          "%   modulo        [0] := [1] % [0]          {-1}\n"
+         "<   left shift    [0] := [0] << 1           {0}\n"
          ">   right shift   [0] := [0] >> 1           {0}\n"
          "++  increment     [0] := [0]++              {0}\n"
          "--  decrement     [0] := [0]--              {0}\n"
@@ -487,6 +498,9 @@ main (int argc, char **argv)
 		case '^':
 		  do_powm ();
 		  break;
+		case '<':
+		  do_lshift ();
+		  break;
 		case '>':
 		  do_rshift ();
 		  break;

-----------------------------------------------------------------------

Summary of changes:
 src/gcrypt.h.in  |  2 +-
 src/mpicalc.c    | 16 +++++++++++++++-
 src/visibility.c |  4 ++--
 3 files changed, 18 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul  5 22:58:35 2017
From: cvs at cvs.gnupg.org (by Daniel Shahaf)
Date: Wed, 05 Jul 2017 22:58:35 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-83-g4538f3c
Message-ID: <E1dSrNc-0004ys-3l@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  4538f3cf8d7a0a7477b3e0258de5b743830ae20c (commit)
      from  3681ee7dc1e9d8c94fdb046d7be0bbcfeba1cfe9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4538f3cf8d7a0a7477b3e0258de5b743830ae20c
Author: Daniel Shahaf <danielsh at apache.org>
Date:   Wed Jul 5 16:55:53 2017 -0400

    doc: minor clarification
    
    ---
    Signed-off-by: Daniel Kahn Gillmor <dkg at fifthhorseman.net>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 1933ad8..7a40f5a 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -1224,7 +1224,7 @@ do not want to feed data via STDIN, you should connect STDIN to
 g at file{/dev/null}.
 
 It is highly recommended to use this option along with the options
- at option{--status-fd} and @option{--with-colons} for any unattended of
+ at option{--status-fd} and @option{--with-colons} for any unattended use of
 @command{gpg}.
 
 @item --no-tty

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul  6 10:31:13 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 06 Jul 2017 10:31:13 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-116-ge235f6a
Message-ID: <E1dT2Bt-0000gx-9x@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  e235f6a62f6268538c784154c2d1470ff073b6a8 (commit)
       via  208aba6f9a0475ba049f5a66fe02cf9a6214a887 (commit)
      from  85a9a913da9ecc6b2cd6f743e90e49983251d706 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e235f6a62f6268538c784154c2d1470ff073b6a8
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 6 10:26:24 2017 +0200

    Update NEWS
    
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index c97f425..b29bb89 100644
--- a/NEWS
+++ b/NEWS
@@ -63,6 +63,10 @@ Noteworthy changes in version 1.8.0 (unreleased)  [C21/A1/R_]
    - Fix long standing bug in secure memory implementation which could
      lead to a segv on free. [bug#3027] [also in 1.7.7]
 
+   - Mitigate a flush+reload side-channel attack on RSA secret keys
+     dubbed "Sliding right into disaster".  For details see
+     <https://eprint.iacr.org/2017/627>.  [CVE-2017-7526] [also in 1.7.8]
+
 
  * Interface changes relative to the 1.7.0 release:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -73,6 +77,7 @@ Noteworthy changes in version 1.8.0 (unreleased)  [C21/A1/R_]
 
  * Release dates of 1.7.x versions:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+   Version 1.7.8 (2017-06-29)  [C21/A1/R8]
    Version 1.7.7 (2017-06-02)  [C21/A1/R7]
    Version 1.7.6 (2017-01-18)  [C21/A1/R6]
    Version 1.7.5 (2016-12-15)  [C21/A1/R5]

commit 208aba6f9a0475ba049f5a66fe02cf9a6214a887
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jun 29 08:31:27 2017 +0200

    rsa: Use modern MPI allocation function.
    
    * cipher/rsa.c (secret_core_crt): Use modern function _gcry_mpi_snew.
    --
    
    Eventually we want to get rid of the notion of limb sizes in mpi using
    code.  Thus it is better to use the modern function/macro.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/cipher/rsa.c b/cipher/rsa.c
index ce73f10..575ea94 100644
--- a/cipher/rsa.c
+++ b/cipher/rsa.c
@@ -1026,7 +1026,7 @@ secret_core_crt (gcry_mpi_t M, gcry_mpi_t C,
   r_nbits = mpi_get_nbits (P) / 4;
   if (r_nbits < 96)
     r_nbits = 96;
-  r = mpi_alloc_secure ( (r_nbits + BITS_PER_MPI_LIMB-1)/BITS_PER_MPI_LIMB );
+  r = mpi_secure_new (r_nbits);
 
   /* d_blind = (d mod (p-1)) + (p-1) * r            */
   /* m1 = c ^ d_blind mod p */

-----------------------------------------------------------------------

Summary of changes:
 NEWS         | 5 +++++
 cipher/rsa.c | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul  6 10:34:12 2017
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Thu, 06 Jul 2017 10:34:12 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. a69e5c0c1415829c5fa082e2951565ad2e1afb98
Message-ID: <E1dT2En-0000nj-KW@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  a69e5c0c1415829c5fa082e2951565ad2e1afb98 (commit)
      from  1143a81c46915184313775cde2b46ba59f2a518a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a69e5c0c1415829c5fa082e2951565ad2e1afb98
Author: Neal H. Walfield <neal at gnu.org>
Date:   Thu Jul 6 10:33:14 2017 +0200

    campaign: Change video of the day to Cedric Laurant (SonTusDatos)

diff --git a/web/donate/index.de.org b/web/donate/index.de.org
index 3823fd1..7b624e4 100644
--- a/web/donate/index.de.org
+++ b/web/donate/index.de.org
@@ -222,8 +222,8 @@ href="/cgi-bin/procdonate.cgi?mode=preset&lang=de"
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Video des Tages: <a href="http://www.rechtsanwalt-stehmann.de/">Michael Stehmann</a>
-            <small>Lawyer</small>
+	  <h2>Video des Tages: C?dric Laurant
+            <small><a href="https://sontusdatos.org/">SonTusDatos</a></small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.fr.org b/web/donate/index.fr.org
index a3a1e96..cf93053 100644
--- a/web/donate/index.fr.org
+++ b/web/donate/index.fr.org
@@ -215,8 +215,8 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Clip du jour?: <a href="http://www.rechtsanwalt-stehmann.de/">Michael Stehmann</a>
-            <small>Lawyer</small>
+	  <h2>Clip du jour?: C?dric Laurant
+            <small><a href="https://sontusdatos.org/">SonTusDatos</a></small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.ja.org b/web/donate/index.ja.org
index 5a185ef..cd9ddd0 100644
--- a/web/donate/index.ja.org
+++ b/web/donate/index.ja.org
@@ -202,8 +202,8 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>?????: <a href="http://www.rechtsanwalt-stehmann.de/">Michael Stehmann</a>
-            <small>Lawyer</small>
+	  <h2>?????: C?dric Laurant
+            <small><a href="https://sontusdatos.org/">SonTusDatos</a></small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.org b/web/donate/index.org
index 92518f8..8e498e7 100644
--- a/web/donate/index.org
+++ b/web/donate/index.org
@@ -217,8 +217,8 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Video of the Day: <a href="http://www.rechtsanwalt-stehmann.de/">Michael Stehmann</a>
-            <small>Lawyer</small>
+	  <h2>Video of the Day: C?dric Laurant
+            <small><a href="https://sontusdatos.org/">SonTusDatos</a></small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/share/campaign/campaign.js b/web/share/campaign/campaign.js
index 4f852d2..28453ca 100644
--- a/web/share/campaign/campaign.js
+++ b/web/share/campaign/campaign.js
@@ -89,7 +89,7 @@ function get_param_from_url(name) {
 $(document).ready(function() {
 
     // VOTD: Update VOTD here.
-    let VIDLIST = "michael,sheera,meik,seamus,andrew,geoffrey,hernani,leez,noah,c5,jochim,john,jason,sze,rysiek,ksenia,cindy,matt,thenmozhi,alex,andre,benjamin";
+    let VIDLIST = "cedric,michael,sheera,meik,seamus,andrew,geoffrey,hernani,leez,noah,c5,jochim,john,jason,sze,rysiek,ksenia,cindy,matt,thenmozhi,alex,andre,benjamin";
 
     let YTID = { "main": "wNHhkntqklg",
 		 "thenmozhi": "sQMj332dgIE",
@@ -115,7 +115,8 @@ $(document).ready(function() {
 		 "seamus": "6dreAkVxmpg",
 		 "meik": "j0Zd0wZyLP8",
 		 "sheera": "mak22hXcslg",
-                 "michael": "MSu_FF49MtU"
+                 "michael": "MSu_FF49MtU",
+                 "cedric": "-Rkrf9GIw8M"
 	       };
 
     /* For the video preview, we use this for devices without hover events.  */
diff --git a/web/share/campaign/img/thumbs/cedric.jpg b/web/share/campaign/img/thumbs/cedric.jpg
new file mode 100644
index 0000000..b4816ae
Binary files /dev/null and b/web/share/campaign/img/thumbs/cedric.jpg differ

-----------------------------------------------------------------------

Summary of changes:
 web/donate/index.de.org                  |   4 ++--
 web/donate/index.fr.org                  |   4 ++--
 web/donate/index.ja.org                  |   4 ++--
 web/donate/index.org                     |   4 ++--
 web/share/campaign/campaign.js           |   5 +++--
 web/share/campaign/img/thumbs/cedric.jpg | Bin 0 -> 113184 bytes
 6 files changed, 11 insertions(+), 10 deletions(-)
 create mode 100644 web/share/campaign/img/thumbs/cedric.jpg


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul  6 12:58:53 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 06 Jul 2017 12:58:53 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-84-g4c3a59e
Message-ID: <E1dT4Uo-0004k4-1Z@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  4c3a59e9c0a4902f96b9f199b9821573ffb7c628 (commit)
      from  4538f3cf8d7a0a7477b3e0258de5b743830ae20c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4c3a59e9c0a4902f96b9f199b9821573ffb7c628
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jul 6 12:56:06 2017 +0200

    doc: Fix typo.
    
    --
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 7a40f5a..9dceed9 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -3865,7 +3865,7 @@ follows:
   @item Text only, line length is limited to about 1000 characters.
   @item UTF-8 encoding must be used to specify non-ASCII characters.
   @item Empty lines are ignored.
-  @item Leading and trailing while space is ignored.
+  @item Leading and trailing white space is ignored.
   @item A hash sign as the first non white space character indicates
   a comment line.
   @item Control statements are indicated by a leading percent sign, the

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul  6 20:52:59 2017
From: cvs at cvs.gnupg.org (by Damien Goutte-Gattat)
Date: Thu, 06 Jul 2017 20:52:59 +0200
Subject: [git] Scute - branch, master, updated. scute-1.3.0-71-g5ef976c
Message-ID: <E1dTBtb-0006bI-Rn@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PKCS#11 token on top of gpg-agent".

The branch, master has been updated
       via  5ef976c40007ba2b062e9bd63e35bca894c3d9a0 (commit)
       via  ab5025ab91db937b80427bf7385b4c689e7fa9a6 (commit)
       via  1be7674fea72aff49eb13ef96089c766a09239cb (commit)
       via  a8bfa6306a0114d1e4c3eeaecd15fb07439cb648 (commit)
      from  10a19467bc2a95b4aa91176924a91be427d3157a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5ef976c40007ba2b062e9bd63e35bca894c3d9a0
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Wed Jul 5 21:52:25 2017 +0200

    Update documentation files.
    
    * AUTHORS: Update bug report submission URL.
    * doc/website/contact.xhtml: Likewise.
    * NEWS: Update for upcoming release.
    * README: Replace libscute.so by scute.so. Indicate that GnuPG 2.1
    is required for some features.
    * doc/manual/scute.texi: Likewise.
    
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/AUTHORS b/AUTHORS
index 39ab03a..1eba0f1 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -1,6 +1,6 @@
 Package: scute
 Maintainer: Marcus Brinkmann <marcus at g10code.com>
-Bug reports: bug-scute at g10code.com
+Bug reports: https://dev.gnupg.org/
 Security related bug reports: security at gnupg.org
 License: GPLv2+ with exception for Mozilla
 
diff --git a/NEWS b/NEWS
index dc84747..e6608bb 100644
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,16 @@
-Noteworthy changes in version 1.3.0 (2010-04-21)
+Noteworthy changes in version 1.5.0 (unreleased)
+------------------------------------------------
+
+ * Support for TLS 1.2 client authentication and S/MIME signing.
+
+ * Support for 4096 bit keys.
+
+ * Support for GnuPG 2.1.
+
+ * C_GenerateRandom is implemented.
+
+
+Noteworthy changes in version 1.4.0 (2010-04-21)
 ------------------------------------------------
 
  * Update to libassuan 2.0.0 interface.
diff --git a/README b/README
index 7064b29..4cd9a12 100644
--- a/README
+++ b/README
@@ -42,6 +42,9 @@ At runtime:
 * GnuPG 2.0, in particular: gpg-agent, scdaemon
 * Pinentry
 
+Note that client authentication with TLS 1.2 and S/MIME signing
+require GnuPG 2.1.
+
 
 Installation
 ============
@@ -52,7 +55,7 @@ instructions in the file INSTALL that accompanies this software.
 After installation, you can configure Mozilla to use Scute by
 visiting the preferences dialog in the "advanced" category, under
 "Security Devices".  There you can "load" the module from its
-installed path, e.g. "/usr/lib/libscute.so".
+installed path, e.g. "/usr/lib/scute.so".
 
 
 Client Authentication
@@ -161,7 +164,7 @@ ask when establishing the initial connection).
 
 To actually perform the client authentication, the client needs to set
 up the web browser for use with Scute.  The Scute PKCS #11 module,
-installed under /usr/lib/libscute.so by default, needs to be loaded as
+installed under /usr/lib/scute.so by default, needs to be loaded as
 a security device in Firefox under
 Preferences->Advanced->Security->Certificates->Security Devices->Load
 When the security device is loaded, card insertion should cause the
diff --git a/doc/manual/scute.texi b/doc/manual/scute.texi
index 7199edf..392cc98 100644
--- a/doc/manual/scute.texi
+++ b/doc/manual/scute.texi
@@ -262,7 +262,9 @@ configured:
 @table @asis
 @item GnuPG
 Scute uses the GnuPG 2.0 framework to access the OpenPGP card and for
-certificate management.  The minimum version required is 2.0.0.
+certificate management.  The minimum version required is 2.0.0 for
+client authentication with TLS 1.0 and 1.1.  Client authentication
+with TLS 1.2, email and document signing require GnuPG 2.1.0.
 
 @item Pinentry
 Pinentry is a dependency of GnuPG 2.0, so it also needs to be installed
diff --git a/doc/website/contact.xhtml b/doc/website/contact.xhtml
index 2e070d7..7fbe731 100644
--- a/doc/website/contact.xhtml
+++ b/doc/website/contact.xhtml
@@ -61,7 +61,7 @@
 	<h2>Bug Reports</h2>
 	<p>
 	  All bug reports should be submitted to our <a
-	  href="http://bugs.g10code.com/">bug tracking system</a> or
+	  href="https://dev.gnupg.org/">bug tracking system</a> or
 	  sent via e-mail to the <a
 	  href="http://lists.gnupg.org/mailman/listinfo/gnupg-devel">GnuPG
 	  development mailing list.</a> Sensitive information can also

commit ab5025ab91db937b80427bf7385b4c689e7fa9a6
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Tue Jun 6 12:39:08 2017 +0200

    Add safety check against bad card certificate.
    
    * src/agent.c (scute_agent_get_cert): Reject card certificate if
    it does not start with an ASN.1 sequence tag.
    
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/src/agent.c b/src/agent.c
index cecf570..cfc9a56 100644
--- a/src/agent.c
+++ b/src/agent.c
@@ -1043,7 +1043,7 @@ scute_agent_get_cert (int no, struct cert *cert)
   err = assuan_transact (agent_ctx, cmd, get_cert_data_cb, &cert_s,
 			 NULL, NULL, NULL, NULL);
   /* Just to be safe... */
-  if (!err && cert_s.cert_der_len <= 16)
+  if (!err && (cert_s.cert_der_len <= 16 || cert_s.cert_der[0] != 0x30))
     {
       DEBUG (DBG_INFO, "bad card certificate rejected");
       err = gpg_error (GPG_ERR_BAD_CERT);

commit 1be7674fea72aff49eb13ef96089c766a09239cb
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Mon Jan 16 11:32:45 2017 +0100

    Cleanup now unused code.
    
    * src/agent.c (build_w32_commandline_copy): Removed.
    (build_w32_commandline): Removed.
    (spawn_process_detached): Removed.
    * src/get-path.c (get_gpg_agent_path): Removed.
    (standard_homedir): Removed.
    (default_homedir): Removed.
    (make_filename): Removed.
    * src/support.h: Removed corresponding prototypes.
    * configure.ac: Removed --with-gpg-agent option.
    --
    
    This patch removes functions that were only used to find the
    socket for GnuPG Agent and that are not needed anymore.
    
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/configure.ac b/configure.ac
index 8567a3a..d05785e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -231,14 +231,12 @@ esac
 AM_CONDITIONAL(HAVE_LD_VERSION_SCRIPT, test "$have_ld_version_script" = "yes")
 
 GPGSM_DEFAULT=no
-GPG_AGENT_DEFAULT=no
 GPG_CONNECT_AGENT_DEFAULT=no
 have_w32_system=no
 case "${host}" in
     *-mingw32*)
         # special stuff for Windoze NT
 	GPGSM_DEFAULT='c:\\gnupg\\gpgsm.exe'
-        GPG_AGENT_DEFAULT='c:\\gnupg\\gpg-agent.exe'
         GPG_CONNECT_AGENT_DEFAULT='c:\\gnupg\\gpg-connect-agent.exe'
 	have_w32_system=yes
         ;;
@@ -373,41 +371,6 @@ if test "$ok" = "maybe"; then
 fi
 gpgsm_ok="$ok"
 
-# GPG_AGENT
-NO_OVERRIDE=no
-AC_ARG_WITH(gpg-agent,
-	    AC_HELP_STRING([--with-gpg-agent=PATH], [use GPG Agent binary at PATH]),
-	    GPG_AGENT=$withval, NO_OVERRIDE=yes)
-if test "$NO_OVERRIDE" = "yes" || test "$GPG_AGENT" = "yes"; then
-  GPG_AGENT=
-  NO_OVERRIDE=yes
-  if test "$cross_compiling" != "yes"; then
-    AC_PATH_PROG(GPG_AGENT, gpg-agent)
-  fi
-  if test -z "$GPG_AGENT"; then
-    GPG_AGENT="$GPG_AGENT_DEFAULT"
-  fi
-fi
-if test "$GPG_AGENT" = no; then
-  if test "$NO_OVERRIDE" = "yes"; then
-    if test "$cross_compiling" != "yes"; then
-      AC_MSG_WARN([
-***
-*** Could not find GPG Agent, install GPG Agent or use --with-gpg-agent=PATH to enable it
-***])
-    else
-      AC_MSG_ERROR([
-***
-*** Can not determine path to GPG Agent when cross-compiling, use --with-gpg-agent=PATH
-***])
-    fi
-  fi
-else
-  AC_DEFINE_UNQUOTED(GPG_AGENT_PATH, "$GPG_AGENT", [Path to the GPG_AGENT binary.])
-  AC_DEFINE(ENABLE_GPG_AGENT,1, [Whether GPG Agent support is enabled])
-fi
-AM_CONDITIONAL(HAVE_GPG_AGENT, test "$GPG_AGENT" != "no")
-
 # GPG_CONNECT_AGENT
 NO_OVERRIDE=no
 AC_ARG_WITH(gpg-connect-agent,
diff --git a/src/agent.c b/src/agent.c
index 6ee106c..cecf570 100644
--- a/src/agent.c
+++ b/src/agent.c
@@ -79,155 +79,6 @@ gnupg_allow_set_foregound_window (pid_t pid)
 }
 
 
-#ifdef HAVE_W32_SYSTEM
-/* Helper function to build_w32_commandline. */
-static char *
-build_w32_commandline_copy (char *buffer, const char *string)
-{
-  char *p = buffer;
-  const char *s;
-
-  if (!*string) /* Empty string. */
-    p = stpcpy (p, "\"\"");
-  else if (strpbrk (string, " \t\n\v\f\""))
-    {
-      /* Need top do some kind of quoting.  */
-      p = stpcpy (p, "\"");
-      for (s=string; *s; s++)
-        {
-          *p++ = *s;
-          if (*s == '\"')
-            *p++ = *s;
-        }
-      *p++ = '\"';
-      *p = 0;
-    }
-  else
-    p = stpcpy (p, string);
-
-  return p;
-}
-
-
-/* Build a command line for use with W32's CreateProcess.  On success
-   CMDLINE gets the address of a newly allocated string.  */
-static gpg_error_t
-build_w32_commandline (const char *pgmname, const char * const *argv,
-                       char **cmdline)
-{
-  int i, n;
-  const char *s;
-  char *buf, *p;
-
-  *cmdline = NULL;
-  n = 0;
-  s = pgmname;
-  n += strlen (s) + 1 + 2;  /* (1 space, 2 quoting */
-  for (; *s; s++)
-    if (*s == '\"')
-      n++;  /* Need to double inner quotes.  */
-  for (i=0; (s=argv[i]); i++)
-    {
-      n += strlen (s) + 1 + 2;  /* (1 space, 2 quoting */
-      for (; *s; s++)
-        if (*s == '\"')
-          n++;  /* Need to double inner quotes.  */
-    }
-  n++;
-
-  buf = p = malloc (n);
-  if (!buf)
-    return gpg_error_from_syserror ();
-
-  p = build_w32_commandline_copy (p, pgmname);
-  for (i=0; argv[i]; i++)
-    {
-      *p++ = ' ';
-      p = build_w32_commandline_copy (p, argv[i]);
-    }
-
-  *cmdline= buf;
-  return 0;
-}
-
-
-/* Spawn a new process and immediately detach from it.  The name of
-   the program to exec is PGMNAME and its arguments are in ARGV (the
-   programname is automatically passed as first argument).  An error
-   is returned if pgmname is not executable; to make this work it is
-   necessary to provide an absolute file name.  All standard file
-   descriptors are connected to /dev/null.  */
-static gpg_error_t
-spawn_process_detached (const char *pgmname, const char *argv[])
-{
-  gpg_error_t err;
-  SECURITY_ATTRIBUTES sec_attr;
-  PROCESS_INFORMATION pi =
-    {
-      NULL,      /* Returns process handle.  */
-      0,         /* Returns primary thread handle.  */
-      0,         /* Returns pid.  */
-      0          /* Returns tid.  */
-    };
-  STARTUPINFO si;
-  int cr_flags;
-  char *cmdline;
-
-  if (access (pgmname, X_OK))
-    return gpg_error_from_syserror ();
-
-  /* Prepare security attributes.  */
-  memset (&sec_attr, 0, sizeof sec_attr );
-  sec_attr.nLength = sizeof sec_attr;
-  sec_attr.bInheritHandle = FALSE;
-
-  /* Build the command line.  */
-  err = build_w32_commandline (pgmname, argv, &cmdline);
-  if (err)
-    return err;
-
-  /* Start the process.  */
-  memset (&si, 0, sizeof si);
-  si.cb = sizeof (si);
-  si.dwFlags = STARTF_USESHOWWINDOW;
-  si.wShowWindow = SW_MINIMIZE;
-
-  cr_flags = (CREATE_DEFAULT_ERROR_MODE
-              | GetPriorityClass (GetCurrentProcess ())
-              | CREATE_NEW_PROCESS_GROUP
-              | DETACHED_PROCESS);
-  DEBUG (DBG_INFO, "CreateProcess(detached), path=`%s' cmdline=`%s'\n",
-	 pgmname, cmdline);
-  if (!CreateProcess (pgmname,       /* Program to start.  */
-                      cmdline,       /* Command line arguments.  */
-                      &sec_attr,     /* Process security attributes.  */
-                      &sec_attr,     /* Thread security attributes.  */
-                      FALSE,         /* Inherit handles.  */
-                      cr_flags,      /* Creation flags.  */
-                      NULL,          /* Environment.  */
-                      NULL,          /* Use current drive/directory.  */
-                      &si,           /* Startup information. */
-                      &pi            /* Returns process information.  */
-                      ))
-    {
-      DEBUG (DBG_CRIT, "CreateProcess(detached) failed: %i\n",
-	     GetLastError ());
-      free (cmdline);
-      return gpg_error (GPG_ERR_GENERAL);
-    }
-  free (cmdline);
-  cmdline = NULL;
-
-  DEBUG (DBG_INFO, "CreateProcess(detached) ready: hProcess=%p hThread=%p"
-	 " dwProcessID=%d dwThreadId=%d\n", pi.hProcess, pi.hThread,
-	 (int) pi.dwProcessId, (int) pi.dwThreadId);
-
-  CloseHandle (pi.hThread);
-
-  return 0;
-}
-#endif
-
 

 /* Establish a connection to a running GPG agent.  */
 static gpg_error_t
diff --git a/src/get-path.c b/src/get-path.c
index cb0a136..bb24b12 100644
--- a/src/get-path.c
+++ b/src/get-path.c
@@ -33,13 +33,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <assert.h>
-#include <errno.h>
-#include <sys/time.h>
-#include <sys/types.h>
-#include <signal.h>
-#include <fcntl.h>
-#include <stdarg.h>
 #ifdef HAVE_W32_SYSTEM
 #include <windows.h>
 #include <shlobj.h>
@@ -49,23 +42,6 @@
 #include "support.h"
 
 #ifdef HAVE_W32_SYSTEM
-#define GNUPG_DEFAULT_HOMEDIR "c:/gnupg"
-#elif defined(__VMS)
-#define GNUPG_DEFAULT_HOMEDIR "/SYS\$LOGIN/gnupg" 
-#else
-#define GNUPG_DEFAULT_HOMEDIR "~/.gnupg"
-#endif 
-
-#ifdef HAVE_DOSISH_SYSTEM
-#define DIRSEP_C '\\'
-#define DIRSEP_S "\\"
-#else
-#define DIRSEP_C '/'
-#define DIRSEP_S "/"
-#endif
-
-

-#ifdef HAVE_W32_SYSTEM
 #define RTLD_LAZY 0
 
 static __inline__ void *
@@ -319,23 +295,6 @@ get_gpgsm_path (void)
 
 
 const char *
-get_gpg_agent_path (void)
-{
-  static const char *pgmname;
-
-#ifdef HAVE_W32_SYSTEM
-  if (!pgmname)
-    pgmname = find_program_in_inst_dir ("gpg-agent.exe");
-  if (!pgmname)
-    pgmname = find_program_at_standard_place ("GNU\\GnuPG\\gpg-agent.exe");
-#endif
-  if (!pgmname)
-    pgmname = GPG_AGENT_PATH;
-  return pgmname;
-}
-
-
-const char *
 get_gpg_connect_agent_path (void)
 {
   static const char *pgmname;
@@ -350,161 +309,3 @@ get_gpg_connect_agent_path (void)
     pgmname = GPG_CONNECT_AGENT_PATH;
   return pgmname;
 }
-
-
-

-/* Home directory.  */
-
-#ifdef HAVE_W32_SYSTEM
-#ifndef CSIDL_APPDATA
-#define CSIDL_APPDATA 0x001a
-#endif
-#ifndef CSIDL_LOCAL_APPDATA
-#define CSIDL_LOCAL_APPDATA 0x001c
-#endif
-#ifndef CSIDL_COMMON_APPDATA
-#define CSIDL_COMMON_APPDATA 0x0023
-#endif
-#ifndef CSIDL_FLAG_CREATE
-#define CSIDL_FLAG_CREATE 0x8000
-#endif
-#endif /*HAVE_W32_SYSTEM*/
-
-/* Get the standard home directory.  In general this function should
-   not be used as it does not consider a registry value (under W32) or
-   the GNUPGHOME environment variable.  It is better to use
-   default_homedir(). */
-const char *
-standard_homedir (void)
-{
-#ifdef HAVE_W32_SYSTEM
-  static const char *dir;
-
-  if (!dir)
-    {
-      char path[MAX_PATH];
-      
-      /* It might be better to use LOCAL_APPDATA because this is
-         defined as "non roaming" and thus more likely to be kept
-         locally.  For private keys this is desired.  However, given
-         that many users copy private keys anyway forth and back,
-         using a system roaming services might be better than to let
-         them do it manually.  A security conscious user will anyway
-         use the registry entry to have better control.  */
-      if (w32_shgetfolderpath (NULL, CSIDL_APPDATA|CSIDL_FLAG_CREATE, 
-                               NULL, 0, path) >= 0) 
-        {
-          char *tmp = malloc (strlen (path) + 6 +1);
-	  if (tmp)
-	    {
-	      strcpy (stpcpy (tmp, path), "\\gnupg");
-	      dir = tmp;
-          
-	      /* Try to create the directory if it does not yet exists.  */
-	      if (access (dir, F_OK))
-		CreateDirectory (dir, NULL);
-	    }
-        }
-
-      if (!dir)
-        dir = GNUPG_DEFAULT_HOMEDIR;
-    }
-  return dir;
-#else/*!HAVE_W32_SYSTEM*/
-  return GNUPG_DEFAULT_HOMEDIR;
-#endif /*!HAVE_W32_SYSTEM*/
-}
-
-/* Set up the default home directory.  The usual --homedir option
-   should be parsed later. */
-const char *
-default_homedir (void)
-{
-  const char *dir;
-
-  dir = getenv ("GNUPGHOME");
-#ifdef HAVE_W32_SYSTEM
-  if (!dir || !*dir)
-    {
-      static const char *saved_dir;
-      
-      if (!saved_dir)
-        {
-          if (!dir || !*dir)
-            {
-              char *tmp;
-
-              tmp = read_w32_registry_string (NULL, "Software\\GNU\\GnuPG",
-                                              "HomeDir");
-              if (tmp && *tmp)
-                {
-                  free (tmp);
-                  tmp = NULL;
-                }
-               if (tmp)
-                saved_dir = tmp;
-            }
-          
-          if (!saved_dir)
-            saved_dir = standard_homedir ();
-        }
-      dir = saved_dir;
-    }
-#endif /*HAVE_W32_SYSTEM*/
-  if (!dir || !*dir)
-    dir = GNUPG_DEFAULT_HOMEDIR;
-
-  return dir;
-}
-
-
-/* Construct a filename from the NULL terminated list of parts.  Tilde
-   expansion is done here.  */
-char *
-make_filename (const char *first_part, ...)
-{
-  va_list arg_ptr;
-  size_t n;
-  const char *s;
-  char *name;
-  char *home;
-  char *p;
-  
-  va_start (arg_ptr, first_part);
-  n = strlen (first_part) + 1;
-  while ((s = va_arg (arg_ptr, const char *)))
-    n += strlen (s) + 1;
-  va_end (arg_ptr);
-  
-  home = NULL;
-  if (*first_part == '~' && first_part[1] == '/'
-      && (home = getenv("HOME")) && *home)
-    n += strlen (home);
-
-  name = malloc (n);
-  if (! name)
-    return NULL;
-  p = (home 
-       ? stpcpy (stpcpy (name,home), first_part + 1)
-       : stpcpy (name, first_part));
-
-  va_start (arg_ptr, first_part);
-  while ((s = va_arg(arg_ptr, const char *)))
-    p = stpcpy (stpcpy (p,"/"), s);
-  va_end (arg_ptr);
-
-#ifdef HAVE_W32_SYSTEM
-  /* We better avoid mixing slashes and backslashes and prefer
-     backslashes.  There is usual no problem with mixing them, however
-     a very few W32 API calls can't grok plain slashes.  Printing
-     filenames with mixed slashes also looks a bit strange. */
-  if (strchr (name, '\\'))
-    {
-      for (p = name; *p; p++)
-        if (*p == '/')
-          *p = '\\';
-    }
-#endif
-
-  return name;
-}
diff --git a/src/support.h b/src/support.h
index 739d124..38149ad 100644
--- a/src/support.h
+++ b/src/support.h
@@ -84,17 +84,8 @@ stpcpy (char *a, const char *b)
 
 
 const char *get_gpgsm_path (void);
-const char *get_gpg_agent_path (void);
 const char *get_gpg_connect_agent_path (void);
 
-/* Set up the default home directory.  The usual --homedir option
-   should be parsed later. */
-const char *default_homedir (void);
-
-/* Construct a filename from the NULL terminated list of parts.  Tilde
-   expansion is done here.  */
-char *make_filename (const char *first_part, ...);
-
 
     
 #endif	/* !SUPPORT_H */

commit a8bfa6306a0114d1e4c3eeaecd15fb07439cb648
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Mon Jan 16 11:49:18 2017 +0100

    Get GPG Agent's socket directly from the agent.
    
    * src/agent.c (agent_connect): Call gpg-connect-agent to get
    the socket for a running agent.
    * src/get-path.c (get_gpg_connect_agent_path): New function.
    * src/support.h (get_gpg_connect_agent_path): New prototype.
    * configure.ac: New option --with-gpg-connect-agent-path.
    --
    
    This patch replaces all the logic needed to find the socket for
    a running GnuPG Agent by a single call to gpg-connect-agent.
    This will ensure we will always be able to find the agent,
    without having to duplicate the logic already implemented in
    GnuPG. Gpg-connect-agent will also take care of starting the
    agent if it's not already running.
    
    GnuPG-bug-id: 3195
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/configure.ac b/configure.ac
index 1e4137d..8567a3a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -232,12 +232,14 @@ AM_CONDITIONAL(HAVE_LD_VERSION_SCRIPT, test "$have_ld_version_script" = "yes")
 
 GPGSM_DEFAULT=no
 GPG_AGENT_DEFAULT=no
+GPG_CONNECT_AGENT_DEFAULT=no
 have_w32_system=no
 case "${host}" in
     *-mingw32*)
         # special stuff for Windoze NT
 	GPGSM_DEFAULT='c:\\gnupg\\gpgsm.exe'
         GPG_AGENT_DEFAULT='c:\\gnupg\\gpg-agent.exe'
+        GPG_CONNECT_AGENT_DEFAULT='c:\\gnupg\\gpg-connect-agent.exe'
 	have_w32_system=yes
         ;;
     *)
@@ -406,6 +408,41 @@ else
 fi
 AM_CONDITIONAL(HAVE_GPG_AGENT, test "$GPG_AGENT" != "no")
 
+# GPG_CONNECT_AGENT
+NO_OVERRIDE=no
+AC_ARG_WITH(gpg-connect-agent,
+            AC_HELP_STRING([--with-gpg-connect-agent=PATH],
+                           [use gpg-connect-agent binary at PATH]),
+            GPG_CONNECT_AGENT=$withval, NO_OVERRIDE=yes)
+if test "$NO_OVERRIDE" = "yes" || test "$GPG_CONNECT_AGENT" = "yes"; then
+  GPG_CONNECT_AGENT=
+  NO_OVERRIDE=yes
+  if test "$cross_compiling" != "yes"; then
+    AC_PATH_PROG(GPG_CONNECT_AGENT, gpg-connect-agent)
+  fi
+  if test -z "$GPG_CONNECT_AGENT"; then
+    GPG_CONNECT_AGENT="$GPG_CONNECT_AGENT_DEFAULT"
+  fi
+fi
+if test "$GPG_CONNECT_AGENT" = no; then
+  if test "$NO_OVERRIDE" = "yes"; then
+    if test "$cross_compiling" != "yes"; then
+      AC_MSG_WARN([
+***
+*** Could not find gpg-connect-agent, use --with-gpg-connect-agent=PATH to enable it
+***])
+    else
+      AC_MSG_WARN([
+***
+*** Can not determine path to gpg-connect-agent when cross-compiling, use --with-gpg-connect-agent=PATH
+***])
+    fi
+  fi
+else
+  AC_DEFINE_UNQUOTED(GPG_CONNECT_AGENT_PATH, "$GPG_CONNECT_AGENT",
+                     [Path to the GPG_CONNECT_AGENT binary.])
+fi
+
 
 # Checks for header files.
 AC_HEADER_STDC
diff --git a/src/agent.c b/src/agent.c
index 75d4933..6ee106c 100644
--- a/src/agent.c
+++ b/src/agent.c
@@ -233,151 +233,59 @@ spawn_process_detached (const char *pgmname, const char *argv[])
 static gpg_error_t
 agent_connect (assuan_context_t *ctx_r)
 {
-  /* If we ever failed to connect via a socket we will force the use
-     of the pipe based server for the lifetime of the process.  */
-  static int force_pipe_server = 0;
-
   gpg_error_t err = 0;
-  char *infostr;
-  char *ptr;
   assuan_context_t ctx = NULL;
+  char buffer[255];
+  FILE *p;
 
-  err = assuan_new (&ctx);
-  if (err)
-    return err;
-
- restart:
-
-  infostr = force_pipe_server ? NULL : getenv ("GPG_AGENT_INFO");
-  if (!infostr || !*infostr)
-    {
-      char *sockname;
-
-      /* First check whether we can connect at the standard
-         socket.  */
-      sockname = make_filename (default_homedir (), "S.gpg-agent", NULL);
-      if (! sockname)
-	return gpg_error_from_errno (errno);
-
-      err = assuan_socket_connect (ctx, sockname, 0, 0);
-      if (err)
-        {
-	  const char *agent_program;
-
-          /* With no success start a new server.  */
-	  DEBUG (DBG_INFO, "no running GPG agent at %s, starting one\n",
-		 sockname);
-
-          agent_program = get_gpg_agent_path ();
-
+  /* Use gpg-connect-agent to obtain the socket name
+   * directly from the agent itself. */
+  snprintf (buffer, sizeof buffer, "%s 'GETINFO socket_name' /bye",
+            get_gpg_connect_agent_path ());
 #ifdef HAVE_W32_SYSTEM
-          {
-            /* Under Windows we start the server in daemon mode.  This
-               is because the default is to use the standard socket
-               and thus there is no need for the GPG_AGENT_INFO
-               envvar.  This is possible as we don't have a real unix
-               domain socket but use a plain file and thus there is no
-               need to care about non-local file systems. */
-            const char *argv[3];
-
-            argv[0] = "--daemon";
-            argv[1] = "--use-standard-socket";
-            argv[2] = NULL;
-
-            err = spawn_process_detached (agent_program, argv);
-            if (err)
-              DEBUG (DBG_CRIT, "failed to start agent `%s': %s\n",
-		     agent_program, gpg_strerror (err));
-            else
-              {
-                /* Give the agent some time to prepare itself. */
-                Sleep (3 * 1000);
-                /* Now try again to connect the agent.  */
-                err = assuan_socket_connect (ctx_r, sockname, 0, 0);
-              }
-          }
-#else /*!HAVE_W32_SYSTEM*/
-          {
-            const char *pgmname;
-            const char *argv[3];
-            int no_close_list[3];
-            int i;
-
-            if ( !(pgmname = strrchr (agent_program, '/')))
-              pgmname = agent_program;
-            else
-              pgmname++;
-
-            argv[0] = pgmname;
-            argv[1] = "--server";
-            argv[2] = NULL;
-
-            i=0;
-            no_close_list[i++] = assuan_fd_from_posix_fd (fileno (stderr));
-            no_close_list[i] = -1;
-
-            /* Connect to the agent and perform initial handshaking. */
-            err = assuan_pipe_connect (ctx, agent_program, argv,
-				       no_close_list, NULL, NULL, 0);
-          }
-#endif /*!HAVE_W32_SYSTEM*/
-        }
-      free (sockname);
-    }
-  else
+  p = _popen (buffer, "r");
+#else
+  p = popen (buffer, "r");
+#endif
+  if (p)
     {
-      int pid;
-      int protocol_version;
+      int ret;
 
-      infostr = strdup (infostr);
-      if (!infostr)
-	return gpg_error_from_errno (errno);
-
-      if (!(ptr = strchr (infostr, PATHSEP_C)) || ptr == infostr)
-	{
-	  DEBUG (DBG_CRIT, "malformed GPG_AGENT_INFO environment variable");
-	  free (infostr);
-	  force_pipe_server = 1;
-	  goto restart;
-	}
-
-      *(ptr++) = 0;
-      pid = atoi (ptr);
-      while (*ptr && *ptr != PATHSEP_C)
-	ptr++;
-      protocol_version = *ptr ? atoi (ptr + 1) : 0;
-      if (protocol_version != 1)
-	{
-	  DEBUG (DBG_CRIT, "GPG agent protocol version '%d' not supported",
-		 protocol_version);
-	  free (infostr);
-	  force_pipe_server = 1;
-	  goto restart;
-	}
+      ret = fscanf (p, "D %254s\nOK\n", buffer);
+      if (ret == EOF)       /* I/O error? */
+        err = gpg_error_from_errno (errno);
+      else if (ret != 1)    /* Unexpected reply */
+        err = gpg_error (GPG_ERR_NO_AGENT);
 
-      err = assuan_socket_connect (ctx, infostr, pid, 0);
-      free (infostr);
-      if (err)
-	{
-	  DEBUG (DBG_CRIT, "cannot connect to GPG agent: %s", gpg_strerror (err));
-	  force_pipe_server = 1;
-	  goto restart;
-	}
+      pclose (p);
     }
+  else
+    err = gpg_error_from_errno (errno);
 
-  if (err)
+  /* Then connect to the socket we got. */
+  if (!err)
     {
-      assuan_release (ctx);
-      DEBUG (DBG_CRIT, "cannot connect to GPG agent: %s", gpg_strerror (err));
-      return gpg_error (GPG_ERR_NO_AGENT);
+      err = assuan_new (&ctx);
+      if (!err)
+        {
+          err = assuan_socket_connect (ctx, buffer, 0, 0);
+          if (!err)
+            {
+              *ctx_r = ctx;
+              if (_scute_debug_flags & DBG_ASSUAN)
+                assuan_set_log_stream (*ctx_r, _scute_debug_stream);
+            }
+          else
+            assuan_release (ctx);
+        }
     }
 
-  if (_scute_debug_flags & DBG_ASSUAN)
-    assuan_set_log_stream (*ctx_r, _scute_debug_stream);
-
-  *ctx_r = ctx;
+  /* We do not try any harder. If gpg-connect-agent somehow failed
+   * to give us a suitable socket, we probably cannot do better. */
+  if (err)
+    DEBUG (DBG_CRIT, "cannot connect to GPG agent: %s", gpg_strerror (err));
 
-  return 0;
+  return err;
 }
 
 
diff --git a/src/get-path.c b/src/get-path.c
index 0abd863..cb0a136 100644
--- a/src/get-path.c
+++ b/src/get-path.c
@@ -335,6 +335,23 @@ get_gpg_agent_path (void)
 }
 
 
+const char *
+get_gpg_connect_agent_path (void)
+{
+  static const char *pgmname;
+
+#ifdef HAVE_W32_SYSTEM
+  if (!pgmname)
+    pgmname = find_program_in_inst_dir ("gpg-connect-agent.exe");
+  if (!pgmname)
+    pgmname = find_program_at_standard_place ("GNU\\GnuPG\\gpg-connect-agent.exe");
+#endif
+  if (!pgmname)
+    pgmname = GPG_CONNECT_AGENT_PATH;
+  return pgmname;
+}
+
+
 

 /* Home directory.  */
 
diff --git a/src/support.h b/src/support.h
index 3356224..739d124 100644
--- a/src/support.h
+++ b/src/support.h
@@ -85,6 +85,7 @@ stpcpy (char *a, const char *b)
 
 const char *get_gpgsm_path (void);
 const char *get_gpg_agent_path (void);
+const char *get_gpg_connect_agent_path (void);
 
 /* Set up the default home directory.  The usual --homedir option
    should be parsed later. */

-----------------------------------------------------------------------

Summary of changes:
 AUTHORS                   |   2 +-
 NEWS                      |  14 +-
 README                    |   7 +-
 configure.ac              |  36 +++---
 doc/manual/scute.texi     |   4 +-
 doc/website/contact.xhtml |   2 +-
 src/agent.c               | 323 ++++++----------------------------------------
 src/get-path.c            | 190 +--------------------------
 src/support.h             |  10 +-
 9 files changed, 87 insertions(+), 501 deletions(-)


hooks/post-receive
-- 
PKCS#11 token on top of gpg-agent
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul  6 21:18:31 2017
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Thu, 06 Jul 2017 21:18:31 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-85-g243b2a5
Message-ID: <E1dTCIK-0001T8-9w@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  243b2a570c30586e19b8c88e43b282d62d8eb77c (commit)
      from  4c3a59e9c0a4902f96b9f199b9821573ffb7c628 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 243b2a570c30586e19b8c88e43b282d62d8eb77c
Author: Neal H. Walfield <neal at g10code.com>
Date:   Thu Jul 6 21:15:45 2017 +0200

    doc: Improve TOFU documentation.
    
    * doc/gpg.texi: Improve TOFU documentation.
    
    Signed-off-by: Neal H. Walfield <neal at g10code.com>
    Suggested-by: Teemu Likonen <tlikonen at iki.fi>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 9dceed9..bc83eff 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -1633,10 +1633,14 @@ Set what trust model GnuPG should follow. The models are:
   @opindex trust-model:tofu
   @anchor{trust-model-tofu}
   TOFU stands for Trust On First Use.  In this trust model, the first
-  time a key is seen, it is memorized.  If later another key is seen
-  with a user id with the same email address, a warning is displayed
-  indicating that there is a conflict and that the key might be a
-  forgery and an attempt at a man-in-the-middle attack.
+  time a key is seen, it is memorized.  If later another key with a
+  user id with the same email address is seen, both keys are marked as
+  suspect.  In that case, the next time either is used, a warning is
+  displayed describing the conflict, why it might have occured
+  (either the user generated a new key and failed to cross sign the
+  old and new keys, the key is forgery, or a man-in-the-middle attack
+  is being attempted), and the user is prompted to manually confirm
+  the validity of the key in question.
 
   Because a potential attacker is able to control the email address
   and thereby circumvent the conflict detection algorithm by using an

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul  7 05:02:46 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 07 Jul 2017 05:02:46 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-118-g66ed4d5
Message-ID: <E1dTJXa-00062P-JH@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  66ed4d53789892def7b237756d8a0ab28df9d222 (commit)
       via  619ebae9847831f43314a95cc3180f4b329b4d3b (commit)
      from  e235f6a62f6268538c784154c2d1470ff073b6a8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 66ed4d53789892def7b237756d8a0ab28df9d222
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jul 7 12:00:03 2017 +0900

    mpi: Fix mpi_pow alternative implementation.
    
    * mpi/mpi-pow.c
      [USE_ALGORITHM_SIMPLE_EXPONENTIATION] (_gcry_mpi_powm): Use
      mpi_set_cond.
    
    --
    
    Limbs of RES may be allocated more before the call of mpi_pow,
    but it only uses the space of SIZE.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/mpi/mpi-pow.c b/mpi/mpi-pow.c
index 3d6d68c..54f477b 100644
--- a/mpi/mpi-pow.c
+++ b/mpi/mpi-pow.c
@@ -188,10 +188,16 @@ _gcry_mpi_powm (gcry_mpi_t res,
     mpi_limb_t e;
     mpi_limb_t carry_limb;
     struct karatsuba_ctx karactx;
+    struct gcry_mpi w, u;
 
     xp_nlimbs = msec? size:0;
     xp = xp_marker = mpi_alloc_limb_space( size, msec );
 
+    w.sign = u.sign = 0;
+    w.flags = u.flags = 0;
+    w.alloced = w.nlimbs = size; /* RES->alloc may be longer.  */
+    u.alloced = u.nlimbs = size;
+
     memset( &karactx, 0, sizeof karactx );
     negative_result = (ep[0] & 1) && bsign;
 
@@ -267,11 +273,11 @@ _gcry_mpi_powm (gcry_mpi_t res,
                     xsize = msize;
                   }
               }
-            if ( (mpi_limb_signed_t)e < 0 )
-              {
-                tp = rp; rp = xp; xp = tp;
-                rsize = xsize;
-              }
+
+            w.d = rp;
+            u.d = xp;
+            mpi_set_cond (&w, &u, ((mpi_limb_signed_t)e < 0));
+
             e <<= 1;
             c--;
           }

commit 619ebae9847831f43314a95cc3180f4b329b4d3b
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jul 7 11:39:09 2017 +0900

    Fix mpi_pow alternative implementation.
    
    * mpi/mpi-pow.c [USE_ALGORITHM_SIMPLE_EXPONENTIATION] (_gcry_mpi_powm):
    Allocate size fix.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/mpi/mpi-pow.c b/mpi/mpi-pow.c
index 3cba690..3d6d68c 100644
--- a/mpi/mpi-pow.c
+++ b/mpi/mpi-pow.c
@@ -189,8 +189,8 @@ _gcry_mpi_powm (gcry_mpi_t res,
     mpi_limb_t carry_limb;
     struct karatsuba_ctx karactx;
 
-    xp_nlimbs = msec? (2 * (msize + 1)):0;
-    xp = xp_marker = mpi_alloc_limb_space( 2 * (msize + 1), msec );
+    xp_nlimbs = msec? size:0;
+    xp = xp_marker = mpi_alloc_limb_space( size, msec );
 
     memset( &karactx, 0, sizeof karactx );
     negative_result = (ep[0] & 1) && bsign;

-----------------------------------------------------------------------

Summary of changes:
 mpi/mpi-pow.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul  7 07:57:42 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 07 Jul 2017 07:57:42 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-119-g61b0f52
Message-ID: <E1dTMGs-0004ph-4v@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  61b0f52c1cc85bf8c3cac9aba40e28682e4e1b8b (commit)
      from  66ed4d53789892def7b237756d8a0ab28df9d222 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 61b0f52c1cc85bf8c3cac9aba40e28682e4e1b8b
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jul 7 14:48:17 2017 +0900

    mpi: Minor fix of mpi_pow.
    
    * mpi/mpi-pow.c (_gcry_mpi_powm): Allocate size fix.
    
    --
    
    Same thing of 619ebae9847831f43314a95cc3180f4b329b4d3b applied.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/mpi/mpi-pow.c b/mpi/mpi-pow.c
index 54f477b..62b4a80 100644
--- a/mpi/mpi-pow.c
+++ b/mpi/mpi-pow.c
@@ -552,8 +552,8 @@ _gcry_mpi_powm (gcry_mpi_t res,
     struct karatsuba_ctx karactx;
     mpi_ptr_t tp;
 
-    xp_nlimbs = msec? (2 * (msize + 1)):0;
-    xp = xp_marker = mpi_alloc_limb_space( 2 * (msize + 1), msec );
+    xp_nlimbs = msec? size:0;
+    xp = xp_marker = mpi_alloc_limb_space( size, msec );
 
     memset( &karactx, 0, sizeof karactx );
     negative_result = (ep[0] & 1) && bsign;

-----------------------------------------------------------------------

Summary of changes:
 mpi/mpi-pow.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul  7 08:13:15 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 07 Jul 2017 08:13:15 +0200
Subject: [git] GnuPG - branch, STABLE-BRANCH-1-4,
 updated. gnupg-1.4.21-11-g554ded4
Message-ID: <E1dTMVv-0007MO-PK@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-1-4 has been updated
       via  554ded4854758bf6ca268432fa087f946932a409 (commit)
       via  12029f83fd0ab3e8ad524f6c9135854662fddfd1 (commit)
       via  b38f4489f75e6e435886aa885807738a22c7ff60 (commit)
      from  782f804765b6f4226fd77843e59f57dcca61b6fb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 554ded4854758bf6ca268432fa087f946932a409
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jul 7 15:12:00 2017 +0900

    mpi: Minor fix for mpi_pow.
    
    * mpi/mpi-pow.c (mpi_powm): Fix allocation size.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/mpi/mpi-pow.c b/mpi/mpi-pow.c
index acddca9..0078b84 100644
--- a/mpi/mpi-pow.c
+++ b/mpi/mpi-pow.c
@@ -162,7 +162,7 @@ mpi_powm( MPI res, MPI base, MPI exponent, MPI mod)
 
     {
 	mpi_size_t i;
-	mpi_ptr_t xp = xp_marker = mpi_alloc_limb_space( 2 * (msize + 1), msec );
+	mpi_ptr_t xp = xp_marker = mpi_alloc_limb_space( size, msec );
 	int c;
 	mpi_limb_t e;
 	mpi_limb_t carry_limb;
@@ -499,7 +499,7 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
     struct karatsuba_ctx karactx;
     mpi_ptr_t tp;
 
-    xp = xp_marker = mpi_alloc_limb_space( 2 * (msize + 1), msec );
+    xp = xp_marker = mpi_alloc_limb_space( size, msec );
 
     memset( &karactx, 0, sizeof karactx );
     negative_result = (ep[0] & 1) && bsign;

commit 12029f83fd0ab3e8ad524f6c9135854662fddfd1
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jul 7 14:38:19 2017 +0900

    mpi: Same computation for square and multiply for mpi_pow.
    
    * mpi/mpi-pow.c (_gcry_mpi_powm): Compare msize for max_u_size.  Move
    the assignment to base_u into the loop.  Copy content refered by RP to
    BASE_U except the last of the loop.
    
    --
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>
    
    (backport commit of libgcrypt master:
    78130828e9a140a9de4dafadbc844dbb64cb709a)

diff --git a/mpi/mpi-pow.c b/mpi/mpi-pow.c
index 76ddf95..acddca9 100644
--- a/mpi/mpi-pow.c
+++ b/mpi/mpi-pow.c
@@ -387,6 +387,9 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
   size = 2 * msize;
   msign = mod->sign;
 
+  ep = expo->d;
+  MPN_NORMALIZE(ep, esize);
+
   if (esize * BITS_PER_MPI_LIMB > 512)
     W = 5;
   else if (esize * BITS_PER_MPI_LIMB > 256)
@@ -403,10 +406,9 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
   bsec = mpi_is_secure(base);
 
   rp = res->d;
-  ep = expo->d;
 
   if (!msize)
-     msize = 1 / msize;	    /* provoke a signal */
+    msize = 1 / msize;	    /* provoke a signal */
 
   if (!esize)
     {
@@ -463,7 +465,8 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
     }
 
 
-  /* Make BASE, EXPO and MOD not overlap with RES.  */
+  /* Make BASE, EXPO not overlap with RES.  We don't need to check MOD
+     because that has already been copied to the MP var.  */
   if ( rp == bp )
     {
       /* RES and BASE are identical.  Allocate temp. space for BASE.  */
@@ -477,13 +480,6 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
       ep = ep_marker = mpi_alloc_limb_space( esize, esec );
       MPN_COPY(ep, rp, esize);
     }
-  if ( rp == mp )
-    {
-      /* RES and MOD are identical.  Allocate temporary space for MOD.*/
-      assert (!mp_marker);
-      mp = mp_marker = mpi_alloc_limb_space( msize, msec );
-      MPN_COPY(mp, rp, msize);
-    }
 
   /* Copy base to the result.  */
   if (res->alloced < size)
@@ -529,7 +525,10 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
         MPN_COPY (precomp[i], rp, rsize);
       }
 
+    if (msize > max_u_size)
+      max_u_size = msize;
     base_u = mpi_alloc_limb_space (max_u_size, esec);
+    MPN_ZERO (base_u, max_u_size);
 
     i = esize - 1;
 
@@ -574,6 +573,10 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
         {
           int c0;
           mpi_limb_t e0;
+          struct gcry_mpi w, u;
+          w.sign = u.sign = 0;
+          w.flags = u.flags = 0;
+          w.d = base_u;
 
           count_leading_zeros (c0, e);
           e = (e << c0);
@@ -582,7 +585,7 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
 
           e0 = (e >> (BITS_PER_MPI_LIMB - W));
           if (c >= W)
-            c0 =0;
+            c0 = 0;
           else
             {
               if ( --i < 0 )
@@ -597,7 +600,7 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
                   e = ep[i];
                   c = BITS_PER_MPI_LIMB;
                   e0 |= (e >> (BITS_PER_MPI_LIMB - (W - c0)));
-               }
+		}
             }
 
           e = e << (W - c0);
@@ -607,30 +610,31 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
           count_trailing_zeros (c0, e0);
           e0 = (e0 >> c0) >> 1;
 
-          /*
-           *  base_u <= precomp[e0]
-           *  base_u_size <= precomp_size[e0];
-           */
-          base_u_size = 0;
-          for (k = 0; k < (1<< (W - 1)); k++)
-            {
-              struct gcry_mpi w, u;
-              w.alloced = w.nlimbs = precomp_size[k];
-              u.alloced = u.nlimbs = precomp_size[k];
-              w.nbits = w.nlimbs * BITS_PER_MPI_LIMB;
-              u.nbits = u.nlimbs * BITS_PER_MPI_LIMB;
-              w.sign = u.sign = 0;
-              w.flags = u.flags = 0;
-              w.d = base_u;
-              u.d = precomp[k];
-
-              mpi_set_cond (&w, &u, k == e0);
-              base_u_size |= ( precomp_size[k] & ((mpi_size_t)0 - (k == e0)) );
-            }
           for (j += W - c0; j >= 0; j--)
             {
-              mul_mod (xp, &xsize, rp, rsize,
-                       j == 0 ? base_u : rp, j == 0 ? base_u_size : rsize,
+
+              /*
+               *  base_u <= precomp[e0]
+               *  base_u_size <= precomp_size[e0]
+               */
+              base_u_size = 0;
+              for (k = 0; k < (1<< (W - 1)); k++)
+                {
+                  w.alloced = w.nlimbs = precomp_size[k];
+                  u.alloced = u.nlimbs = precomp_size[k];
+                  u.d = precomp[k];
+
+                  mpi_set_cond (&w, &u, k == e0);
+                  base_u_size |= ( precomp_size[k] & (0UL - (k == e0)) );
+                }
+
+              w.alloced = w.nlimbs = rsize;
+              u.alloced = u.nlimbs = rsize;
+              u.d = rp;
+              mpi_set_cond (&w, &u, j != 0);
+              base_u_size ^= ((base_u_size ^ rsize)  & (0UL - (j != 0)));
+
+              mul_mod (xp, &xsize, rp, rsize, base_u, base_u_size,
                        mp, msize, &karactx);
               tp = rp; rp = xp; xp = tp;
               rsize = xsize;

commit b38f4489f75e6e435886aa885807738a22c7ff60
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jul 7 14:26:39 2017 +0900

    mpi: Simplify mpi_powm.
    
    * mpi/mpi-pow.c (_gcry_mpi_powm): Simplify the loop.
    
    --
    
    (backport of libgcrypt master commit:
     719468e53133d3bdf12156c5bfdea2bf15f9f6f1)
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/mpi/mpi-pow.c b/mpi/mpi-pow.c
index 7f23a5a..76ddf95 100644
--- a/mpi/mpi-pow.c
+++ b/mpi/mpi-pow.c
@@ -564,12 +564,8 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
       if (e == 0)
         {
           j += c;
-          i--;
-          if ( i < 0 )
-            {
-              c = 0;
-              break;
-            }
+          if ( --i < 0 )
+            break;
 
           e = ep[i];
           c = BITS_PER_MPI_LIMB;
@@ -584,38 +580,33 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
           c -= c0;
           j += c0;
 
+          e0 = (e >> (BITS_PER_MPI_LIMB - W));
           if (c >= W)
-            {
-              e0 = (e >> (BITS_PER_MPI_LIMB - W));
-              e = (e << W);
-              c -= W;
-            }
+            c0 =0;
           else
             {
-              i--;
-              if ( i < 0 )
+              if ( --i < 0 )
                 {
-                  e = (e >> (BITS_PER_MPI_LIMB - c));
-                  break;
+                  e0 = (e >> (BITS_PER_MPI_LIMB - c));
+                  j += c - W;
+                  goto last_step;
                 }
-
-              c0 = c;
-              e0 = (e >> (BITS_PER_MPI_LIMB - W))
-                | (ep[i] >> (BITS_PER_MPI_LIMB - W + c0));
-              e = (ep[i] << (W - c0));
-              c = BITS_PER_MPI_LIMB - W + c0;
+              else
+                {
+                  c0 = c;
+                  e = ep[i];
+                  c = BITS_PER_MPI_LIMB;
+                  e0 |= (e >> (BITS_PER_MPI_LIMB - (W - c0)));
+               }
             }
 
+          e = e << (W - c0);
+          c -= (W - c0);
+
+        last_step:
           count_trailing_zeros (c0, e0);
           e0 = (e0 >> c0) >> 1;
 
-          for (j += W - c0; j; j--)
-            {
-              mul_mod (xp, &xsize, rp, rsize, rp, rsize, mp, msize, &karactx);
-              tp = rp; rp = xp; xp = tp;
-              rsize = xsize;
-            }
-
           /*
            *  base_u <= precomp[e0]
            *  base_u_size <= precomp_size[e0];
@@ -634,24 +625,22 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
               u.d = precomp[k];
 
               mpi_set_cond (&w, &u, k == e0);
-              base_u_size |= (precomp_size[k] & ((mpi_size_t)0 - (k == e0)) );
+              base_u_size |= ( precomp_size[k] & ((mpi_size_t)0 - (k == e0)) );
+            }
+          for (j += W - c0; j >= 0; j--)
+            {
+              mul_mod (xp, &xsize, rp, rsize,
+                       j == 0 ? base_u : rp, j == 0 ? base_u_size : rsize,
+                       mp, msize, &karactx);
+              tp = rp; rp = xp; xp = tp;
+              rsize = xsize;
             }
-          mul_mod (xp, &xsize, rp, rsize, base_u, base_u_size,
-                   mp, msize, &karactx);
-          tp = rp; rp = xp; xp = tp;
-          rsize = xsize;
 
           j = c0;
+          if ( i < 0 )
+            break;
         }
 
-    if (c != 0)
-      {
-        j += c;
-        count_trailing_zeros (c, e);
-        e = (e >> c);
-        j -= c;
-      }
-
     while (j--)
       {
         mul_mod (xp, &xsize, rp, rsize, rp, rsize, mp, msize, &karactx);
@@ -659,38 +648,6 @@ mpi_powm (MPI res, MPI base, MPI expo, MPI mod)
         rsize = xsize;
       }
 
-    if (e != 0)
-      {
-        base_u_size = 0;
-        for (k = 0; k < (1<< (W - 1)); k++)
-          {
-            struct gcry_mpi w, u;
-            w.alloced = w.nlimbs = precomp_size[k];
-            u.alloced = u.nlimbs = precomp_size[k];
-            w.nbits = w.nlimbs * BITS_PER_MPI_LIMB;
-            u.nbits = u.nlimbs * BITS_PER_MPI_LIMB;
-            w.sign = u.sign = 0;
-            w.flags = u.flags = 0;
-            w.d = base_u;
-            u.d = precomp[k];
-
-            mpi_set_cond (&w, &u, k == (e>>1));
-            base_u_size |= (precomp_size[k] & ((mpi_size_t)0 - (k == (e>>1))) );
-          }
-
-        mul_mod (xp, &xsize, rp, rsize, base_u, base_u_size,
-                 mp, msize, &karactx);
-        tp = rp; rp = xp; xp = tp;
-        rsize = xsize;
-
-        for (; c; c--)
-          {
-            mul_mod (xp, &xsize, rp, rsize, rp, rsize, mp, msize, &karactx);
-            tp = rp; rp = xp; xp = tp;
-            rsize = xsize;
-          }
-      }
-
     /* We shifted MOD, the modulo reduction argument, left
        MOD_SHIFT_CNT steps.  Adjust the result by reducing it with the
        original MOD.

-----------------------------------------------------------------------

Summary of changes:
 mpi/mpi-pow.c | 161 ++++++++++++++++++++++------------------------------------
 1 file changed, 61 insertions(+), 100 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul  7 10:04:46 2017
From: cvs at cvs.gnupg.org (by Nicole Faerber)
Date: Fri, 07 Jul 2017 10:04:46 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. d83aebe0b394e1da677976fe0e92094e58f50900
Message-ID: <E1dTOFq-0005oK-W0@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  d83aebe0b394e1da677976fe0e92094e58f50900 (commit)
      from  a69e5c0c1415829c5fa082e2951565ad2e1afb98 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d83aebe0b394e1da677976fe0e92094e58f50900
Author: Nicole Faerber <nicole.faerber at id3p.com>
Date:   Wed Jun 28 16:54:31 2017 +0200

    Updated links and contact info for ordering OpenPGP smartcards and readers
    
    Signed-off-by: Nicole Faerber <nicole.faerber at id3p.com>

diff --git a/misc/howtos.gnupg.org/card-howto/en/apa.html b/misc/howtos.gnupg.org/card-howto/en/apa.html
index c6ada87..fa4b0fe 100644
--- a/misc/howtos.gnupg.org/card-howto/en/apa.html
+++ b/misc/howtos.gnupg.org/card-howto/en/apa.html
@@ -108,15 +108,15 @@
                 </td>
                 <td align="left" valign="top">
                   <p>Currently we know that you may order card
-                    readers from <a href="http://www.kernelconcepts.de/products/security.shtml" target="_top">kernelconcepts</a>. The
+                    readers from <a href="https://www.floss-shop.de/en/security-privacy/" target="_top">FLOSS-Shop</a>. The
                     website is only in German, but you can order the
                     "USB Chip-Karten Lesegeraet SCM SCR-335" for 29,00
                     EUR from all over Europe; either by prepayment via
                     bank transfer or paypal. You have to sent your
                     orders via email to
-                    <code class="email">&lt;<a href="mailto:order at kernelconcepts.de">order at kernelconcepts.de</a>&gt;</code>. If you
+                    <code class="email">&lt;<a href="mailto:order at floss-shop.de">order at floss-shop.de</a>&gt;</code>. If you
                     have questions considering the order you can
-                    contact <code class="email">&lt;<a href="mailto:info at kernelconcepts.de">info at kernelconcepts.de</a>&gt;</code> in
+                    contact <code class="email">&lt;<a href="mailto:info at floss-shop.de">info at floss-shop.de</a>&gt;</code> in
                     English or German.</p>
                   <p>In the UK, SCM card readers can be purchased online from
                         <a href="" target="_top">http://www.crownhill.co.uk/</a>.
diff --git a/misc/howtos.gnupg.org/card-howto/en/ch02s02.html b/misc/howtos.gnupg.org/card-howto/en/ch02s02.html
index b340c94..8250b9b 100644
--- a/misc/howtos.gnupg.org/card-howto/en/ch02s02.html
+++ b/misc/howtos.gnupg.org/card-howto/en/ch02s02.html
@@ -34,7 +34,7 @@
         </div>
       </div>
       <p>First you need an OpenPGP compatible smart card which can, for example, be obtained by <a href="https://www.fsfe.org/join_us/" target="_top">becoming a fellow</a> of the <a href="http://www.fsfeurope.org" target="_top">Free Software Foundation Europe</a>.</p>
-      <p>Card readers (NOT those used for flash memory cards) can be obtained from computer stores (e.g. <a href="http://www.kernelconcepts.de/products/security-en.shtml" target="_top">http://www.kernelconcepts.de/products/security-en.shtml</a>).</p>
+      <p>Card readers (NOT those used for flash memory cards) can be obtained from computer stores (e.g. <a href="https://www.floss-shop.de/en/security-privacy/" target="_top">https://www.floss-shop.de/en/security-privacy/</a>).</p>
       <div class="section" lang="en" xml:lang="en">
         <div class="titlepage">
           <div>
diff --git a/misc/howtos.gnupg.org/card-howto/en/smartcard-howto-single.html b/misc/howtos.gnupg.org/card-howto/en/smartcard-howto-single.html
index dea3cde..1065d90 100644
--- a/misc/howtos.gnupg.org/card-howto/en/smartcard-howto-single.html
+++ b/misc/howtos.gnupg.org/card-howto/en/smartcard-howto-single.html
@@ -9,7 +9,7 @@
         </p><div class="itemizedlist"><ul type="disc"><li><p>3 independent 1024 bit RSA keys (signing,encryption,authentication).</p></li><li><p>Key generation on card or import of existing keys.</p></li><li><p>Signature counter.</p></li><li><p>Data object to store an URL to access the full OpenPGP public key.</p></li><li><p>Data objects for card holder name etc.</p></li><li><p>Data object for login specific data.</p></li><li><p>Length of PIN between 6 and 254 characters; not restricted to numbers.</p></li><li><p>T=1 protocol; compatible with most readers.</p></li><li><p>Specification freely available and usable without any constraints.</p></li><li><p>Reasonably priced. </p></li></ul></div><p>
         </p></div></div><div class="chapter" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title"><a id="id2456320"></a>Chapter?2.?Installation for GNU/Linux</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="section"><a href="#id2456329">2.1. Prerequisites</a></span></dt><dd><dl><dt><span class="section"><a href="#id2456428">2.1.1. Installation of GnuPG</a></span></dt></dl></dd><dt><span class="section"><a href="#id2503306">2.2. Required Hardware</a></span></dt><dd><dl><dt><span class="section"><a href="#id2503342">2.2.1. A List of tested Readers</a></span></dt></dl></dd><dt><span class="section"><a href="#id2503642">2.3. Installation of Card Reader</a></span></dt><dd><dl><dt><span class="section"><a href="#id2503652">2.3.1. CCID (Chip Card Interface Description)</a></span></dt><dt><span class="section"><a href="#id2504251">2.3.2. PC/SC (Personal computer/Smart Card)</a></span></dt></dl></dd></dl></div><p>Since version 1.3.90 GnuPG supports smart cards by default.</p><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2456329"></a>2.1.?Prerequisites</h2></div></div></div><p>Please make sure that libusb is available prior to building GnuPG.  It can be obtained from <a href="http://prdownloads.sourceforge.net/libusb" target="_top">http://prdownloads.sourceforge.net/libusb</a>.  On Debian GNU/Linux a simple <strong class="userinput"><code>apt-get install libusb-dev</code></strong> should be sufficient.</p><p>If you are not using an USB reader please also install libpcsclite and libpcsclite-dev.  On Debian GNU/Linux a simple <strong class="userinput"><code>apt-get install libpcsclite libpcsclite-dev</code></strong> should be sufficient.</p><p>If your reader is a native USB device and supports the CCID (Chip Card Interface Description) specification it is directly supported by GnuPG.</p><p>Most USB readers today still behave like serial readers.  In this case you need the kernel module pl2303 to access the reader.  This module is a "USB Serial Driver" which can be found under
               <span class="guimenu">Device Drivers</span>-&gt;<span class="guimenuitem">USB-Support</span>-&gt;<span class="guimenuitem">USB Serial Converter Support</span>-&gt;<span class="guimenuitem">USB Prolitic 2303</span>
-              in the 2.6 kernel configuration.  This module makes sure that the proprietary reader protocol is translated to a standard protocol.</p><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2456428"></a>2.1.1.?Installation of GnuPG</h3></div></div></div><p>Without an installation of GnuPG the OpenPGP card will be of little use.  So, please, go ahead and install it.</p><p>GnuPG can be downloaded from <a href="http://www.gnupg.org/download/index.html" target="_top">http://www.gnupg.org/download/index.html</a>. Please use the recent stable version.</p><p>After downloading and patching the sources GnuPG is installed with the usual <strong class="userinput"><code>./configure</code></strong>, <strong class="userinput"><code>make</code></strong>, <strong class="userinput"><code>make install</code></strong>.  For further information please refer to the installation instructions shipped with GnuPG.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3>If you are running Debian GNU/Linux you can also build your own Debian package with <strong class="userinput"><code>dh_make</code></strong> and <strong class="userinput"><code>debuild</code></strong> in the source directory. After that you can install it the usual way with <strong class="userinput"><code>dpkg -i gnupg-version.deb</code></strong></div><p>If you are using the 1.9 branch of GnuPG and plan to use the PC/SC driver you should now install the software to make sure that the pcsc wrapper binary will be available at the right place.</p></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2503306"></a>2.2.?Required Hardware</h2></div></div></div><p>First you need an OpenPGP compatible smart card which can, for example, be obtained by <a href="https://www.fsfe.org/join_us/" target="_top">becoming a fellow</a> of the <a href="http://www.fsfeurope.org" target="_top">Free Software Foundation Europe</a>.</p><p>Card readers (NOT those used for flash memory cards) can be obtained from computer stores (e.g. <a href="http://www.kernelconcepts.de/products/security-en.shtml" target="_top">http://www.kernelconcepts.de/products/security-en.shtml</a>).</p><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2503342"></a>2.2.1.?A List of tested Readers</h3></div></div></div><p>Please note that the USB device class for USB readers is 11 (or 0x0B in hex).</p><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2503353"></a>SCM Microsystems SCR335</h4></div></div></div><span class="inlinemediaobject"><img src="scr335-small.jpg" /></span><p>This is a small USB reader (CCID; 65*45*8mm)
+              in the 2.6 kernel configuration.  This module makes sure that the proprietary reader protocol is translated to a standard protocol.</p><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2456428"></a>2.1.1.?Installation of GnuPG</h3></div></div></div><p>Without an installation of GnuPG the OpenPGP card will be of little use.  So, please, go ahead and install it.</p><p>GnuPG can be downloaded from <a href="http://www.gnupg.org/download/index.html" target="_top">http://www.gnupg.org/download/index.html</a>. Please use the recent stable version.</p><p>After downloading and patching the sources GnuPG is installed with the usual <strong class="userinput"><code>./configure</code></strong>, <strong class="userinput"><code>make</code></strong>, <strong class="userinput"><code>make install</code></strong>.  For further information please refer to the installation instructions shipped with GnuPG.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3>If you are running Debian GNU/Linux you can also build your own Debian package with <strong class="userinput"><code>dh_make</code></strong> and <strong class="userinput"><code>debuild</code></strong> in the source directory. After that you can install it the usual way with <strong class="userinput"><code>dpkg -i gnupg-version.deb</code></strong></div><p>If you are using the 1.9 branch of GnuPG and plan to use the PC/SC driver you should now install the software to make sure that the pcsc wrapper binary will be available at the right place.</p></div></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2503306"></a>2.2.?Required Hardware</h2></div></div></div><p>First you need an OpenPGP compatible smart card which can, for example, be obtained by <a href="https://www.fsfe.org/join_us/" target="_top">becoming a fellow</a> of the <a href="http://www.fsfeurope.org" target="_top">Free Software Foundation Europe</a>.</p><p>Card readers (NOT those used for flash memory cards) can be obtained from computer stores (e.g. <a href="https://www.floss-shop.de/en/security-privacy/" target="_top">https://www.floss-shop.de/en/security-privacy/</a>).</p><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="id2503342"></a>2.2.1.?A List of tested Readers</h3></div></div></div><p>Please note that the USB device class for USB readers is 11 (or 0x0B in hex).</p><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h4 class="title"><a id="id2503353"></a>SCM Microsystems SCR335</h4></div></div></div><span class="inlinemediaobject"><img src="scr335-small.jpg" /></span><p>This is a small USB reader (CCID; 65*45*8mm)
                 supported by GnuPG directly as well as by pcsclite.
                 This very device is actually the first reader
                 supported by GnuPG and the reason for the internal
@@ -389,15 +389,15 @@ sub  1024R/F6518D6B  created: 2005-03-05  expires: never       usage: E
 [ultimate] (1). Archibald Goodwin (The Tester) &lt;archi at foobar.example&gt;
                 </pre></div><p>First create a signing key.  If this kind of key already exists on the card, a security question has to be answered.  Run <strong class="userinput"><code>save</code></strong> to commit the changes to the card.  The key on the card will not be removed if you do not <strong class="userinput"><code>save</code></strong> the changes.  You can create another subkey by again calling <strong class="userinput"><code>addcardkey</code></strong>.  Choose the encryption key and proceed as explained.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>gpg will always use the latest created key of a given type.</p></div><p>There is no direct way to create a backup key of the card's decryption key like it is done with the <strong class="userinput"><code>generate</code></strong> command.</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>Make a copy of your secret key before running the following commands.  Otherwise the whole procedure will be pointless.</p></div><p>A few steps more will help you to achieve this goal. First create a regular RSA subkey of 1024 bit length using the <strong class="userinput"><code>addkey</code></strong> command.  Then select this new key and run <strong class="userinput"><code>keytocard</code></strong>.  gpg transfers the key to the card and replaces the existing secret key with a stub.</p></div></div></div><div class="appendix" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title"><a id="id2507278"></a>Appendix?A.?Appendix</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="section"><a href="#id2507283">A.1. A small OpenPGP card FAQ</a></span></dt><dt><span class="glossary"><a href="#id2508366">Glossary</a></span></dt><dt><span class="bibliography"><a href="#id2508441">Further resources</a></span></dt></dl></div><div class="section" lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="id2507283"></a>A.1.?A small OpenPGP card FAQ</h2></div></div></div><div class="qandaset"><dl><dt>A.1.1. <a href="#id2507296">If I'm correctly informed GnuPG and smartcards use 1024 Bit RSA. Some say the security level of RSA-1024 is comparable too about 80 Bit symmetric key and cannot be regarded as highly secure.</a></dt><dt>A.1.2. <a href="#id2507324">Where do I get a reader?</a></dt><dt>A.1.3. <a href="#id2508313">How do I use the cryptocard on MacOSX?</a></dt><dt>A.1.4. <a href="#id2508338">I am having problems, where do I get further
                 help?</a></dt></dl><table border="0" summary="Q and A Set"><col align="left" width="1%" /><tbody><tr class="question"><td align="left" valign="top"><a id="id2507296"></a><a id="id2507298"></a><b>A.1.1.</b></td><td align="left" valign="top"><p>If I'm correctly informed GnuPG and smartcards use 1024 Bit RSA. Some say the security level of RSA-1024 is comparable too about 80 Bit symmetric key and cannot be regarded as highly secure.</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>The quality and security of the implementation and the entire environment and not the length of the key protect the secret key against a compromise by any non-physical attack.</p><p>2048 bit RSA is possible but at the moment far too expensive.  The specification allows for 2048 Bit RSA cards.  Feel free to build one.</p></td></tr><tr class="question"><td align="left" valign="top"><a id="id2507324"></a><a id="id2507326"></a><b>A.1.2.</b></td><td align="left" valign="top"><p>Where do I get a reader?</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>Currently we know that you may order card
-                    readers from <a href="http://www.kernelconcepts.de/products/security.shtml" target="_top">kernelconcepts</a>. The
+                    readers from <a href="https://www.floss-shop.de/en/security-privacy/" target="_top">FLOSS-Shop</a>. The
                     website is only in German, but you can order the
                     "USB Chip-Karten Lesegeraet SCM SCR-335" for 29,00
                     EUR from all over Europe; either by prepayment via
                     bank transfer or paypal. You have to sent your
                     orders via email to
-                    <code class="email">&lt;<a href="mailto:order at kernelconcepts.de">order at kernelconcepts.de</a>&gt;</code>. If you
+                    <code class="email">&lt;<a href="mailto:order at floss-shop.de">order at floss-shop.de</a>&gt;</code>. If you
                     have questions considering the order you can
-                    contact <code class="email">&lt;<a href="mailto:info at kernelconcepts.de">info at kernelconcepts.de</a>&gt;</code> in
+                    contact <code class="email">&lt;<a href="mailto:info at floss-shop.de">info at floss-shop.de</a>&gt;</code> in
                     English or German.</p><p>In the UK, SCM card readers can be purchased online from
                         <a href="" target="_top">http://www.crownhill.co.uk/</a>.
                     </p></td></tr><tr class="question"><td align="left" valign="top"><a id="id2508313"></a><a id="id2508316"></a><b>A.1.3.</b></td><td align="left" valign="top"><p>How do I use the cryptocard on MacOSX?</p></td></tr><tr class="answer"><td align="left" valign="top"><b></b></td><td align="left" valign="top"><p>There is a description on <a href="http://www.py-soft.co.uk/~benjamin/download/mac-gpg/" target="_top">http://www.py-soft.co.uk/~benjamin/download/mac-gpg/</a>.</p></td></tr><tr class="question"><td align="left" valign="top"><a id="id2508338"></a><a id="id2508341"></a><b>A.1.4.</b></td><td align="left" valign="top"><p>I am having problems, where do I get further
diff --git a/misc/howtos.gnupg.org/card-howto/en/smartcard-howto.txt b/misc/howtos.gnupg.org/card-howto/en/smartcard-howto.txt
index fd62399..0723ea9 100644
--- a/misc/howtos.gnupg.org/card-howto/en/smartcard-howto.txt
+++ b/misc/howtos.gnupg.org/card-howto/en/smartcard-howto.txt
@@ -189,7 +189,7 @@ Note
 
    Card readers (NOT those used for flash memory cards) can be obtained
    from computer stores (e.g.
-   [47]http://www.kernelconcepts.de/products/security-en.shtml).
+   [47]https://www.floss-shop.de/en/security-privacy/).
 
 2.2.1. A List of tested Readers
 
@@ -1148,12 +1148,12 @@ A.1. A small OpenPGP card FAQ
    Where do I get a reader?
    
    Currently we know that you may order card readers from
-   [73]kernelconcepts. The website is only in German, but you can order
+   [73]FLOSS-Shop. The website is only in German, but you can order
    the "USB Chip-Karten Lesegeraet SCM SCR-335" for 29,00 EUR from all
    over Europe; either by prepayment via bank transfer or paypal. You
-   have to sent your orders via email to <[74]order at kernelconcepts.de>.
+   have to sent your orders via email to <[74]order at floss-shop.de>.
    If you have questions considering the order you can contact
-   <[75]info at kernelconcepts.de> in English or German.
+   <[75]info at floss-shop.de> in English or German.
 
    In the UK, SCM card readers can be purchased online from
    [76]http://www.crownhill.co.uk/.
@@ -1256,7 +1256,7 @@ References
   44. http://www.gnupg.org/download/index.html
   45. https://www.fsfe.org/join_us/
   46. http://www.fsfeurope.org/
-  47. http://www.kernelconcepts.de/products/security-en.shtml
+  47. https://www.floss-shop.de/en/security-privacy/
   48. http://www.fsfe.org/en/content/download/17665/125518/file/gnupg-ccid.rules
   49. file://localhost/home/wk/w/card-howto/build/smartcard-howto-single.html
   50. file://localhost/home/wk/w/card-howto/build/smartcard-howto-single.html#features
@@ -1282,9 +1282,9 @@ References
   70. file://localhost/home/wk/w/card-howto/build/smartcard-howto-single.html#id2507324
   71. file://localhost/home/wk/w/card-howto/build/smartcard-howto-single.html#id2508313
   72. file://localhost/home/wk/w/card-howto/build/smartcard-howto-single.html#id2508338
-  73. http://www.kernelconcepts.de/products/security.shtml
-  74. mailto:order at kernelconcepts.de
-  75. mailto:info at kernelconcepts.de
+  73. https://www.floss-shop.de/en/security-privacy/
+  74. mailto:order at floss-shop.de
+  75. mailto:info at floss-shop.de
   76. file://localhost/home/wk/w/card-howto/build/smartcard-howto-single.html
   77. http://www.py-soft.co.uk/~benjamin/download/mac-gpg/
   78. http://www.gnupg.org/documentation/mailing-lists.html

-----------------------------------------------------------------------

Summary of changes:
 misc/howtos.gnupg.org/card-howto/en/apa.html             |  6 +++---
 misc/howtos.gnupg.org/card-howto/en/ch02s02.html         |  2 +-
 .../card-howto/en/smartcard-howto-single.html            |  8 ++++----
 misc/howtos.gnupg.org/card-howto/en/smartcard-howto.txt  | 16 ++++++++--------
 4 files changed, 16 insertions(+), 16 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul  7 14:56:56 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 07 Jul 2017 14:56:56 +0200
Subject: [git] GnuPG - branch, STABLE-BRANCH-1-4,
 updated. gnupg-1.4.21-15-g6b4abf1
Message-ID: <E1dTSoa-0004Q3-Ei@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-1-4 has been updated
       via  6b4abf1d491d30a6bdaeb2c425c780cacd65bab4 (commit)
       via  1b1f44846b5f21a80ed101f2284ce5f6e8849ee7 (commit)
       via  994d5b707559a800a650dc7f273372f509d74780 (commit)
       via  8fd9f72e1b2e578e45c98c978cab4f6d47683d2c (commit)
      from  554ded4854758bf6ca268432fa087f946932a409 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6b4abf1d491d30a6bdaeb2c425c780cacd65bab4
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jul 7 21:53:12 2017 +0900

    gpg: Fix memory leak.
    
    * g10/textfilter.c (copy_clearsig_text): Free the buffer.
    
    --
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>
    
    (backport from master commit:
    6b9a89e4c7d6f19de62e0a908a8d80c98bf99819)

diff --git a/g10/textfilter.c b/g10/textfilter.c
index 79f2f67..a92a53d 100644
--- a/g10/textfilter.c
+++ b/g10/textfilter.c
@@ -245,5 +245,6 @@ copy_clearsig_text( IOBUF out, IOBUF inp, MD_HANDLE md,
     if( truncated )
 	log_info(_("input line longer than %d characters\n"), MAX_LINELEN );
 
+    xfree (buffer);
     return 0; /* okay */
 }

commit 1b1f44846b5f21a80ed101f2284ce5f6e8849ee7
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jul 7 21:51:42 2017 +0900

    rsa: Reduce secmem pressure.
    
    * cipher/rsa.c (secret): Don't keep secmem.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/cipher/rsa.c b/cipher/rsa.c
index 84a1af0..51b7640 100644
--- a/cipher/rsa.c
+++ b/cipher/rsa.c
@@ -341,22 +341,29 @@ secret(MPI output, MPI input, RSA_secret_key *skey )
     mpi_set_highbit (rr, rr_nbits - 1);
     mpi_sub_ui( h, skey->p, 1  );
     mpi_mul ( D_blind, h, rr );
+    mpi_free ( rr );
     mpi_fdiv_r( h, skey->d, h );
     mpi_add ( D_blind, D_blind, h );
+    mpi_free ( h );
     mpi_powm ( m1, input, D_blind, skey->p );
 
+    h = mpi_alloc_secure (nlimbs);
+    rr = mpi_alloc_secure ( (rr_nbits + BITS_PER_MPI_LIMB-1)/BITS_PER_MPI_LIMB );
+
     /* d_blind = (d mod (q-1)) + (q-1) * r            */
     /* m2 = c ^ d_blind mod q */
     randomize_mpi (rr, rr_nbits, 0);
     mpi_set_highbit (rr, rr_nbits - 1);
     mpi_sub_ui( h, skey->q, 1  );
     mpi_mul ( D_blind, h, rr );
+    mpi_free ( rr );
     mpi_fdiv_r( h, skey->d, h );
     mpi_add ( D_blind, D_blind, h );
+    mpi_free ( h );
     mpi_powm ( m2, input, D_blind, skey->q );
 
-    mpi_free ( rr );
     mpi_free ( D_blind );
+    h = mpi_alloc_secure (nlimbs);
 
     /* h = u * ( m2 - m1 ) mod q */
     mpi_sub( h, m2, m1 );

commit 994d5b707559a800a650dc7f273372f509d74780
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jul 7 21:20:56 2017 +0900

    rsa: Allow different build directory.
    
    * cipher/Makefile.am (AM_CPPFLAGS): Add mpi dirs.
    * cipher/rsa.c: Change include file.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/cipher/Makefile.am b/cipher/Makefile.am
index 6b923b2..bd79fbc 100644
--- a/cipher/Makefile.am
+++ b/cipher/Makefile.am
@@ -17,7 +17,7 @@
 # along with this program; if not, see <http://www.gnu.org/licenses/>.
 ## Process this file with automake to produce Makefile.in
 
-AM_CPPFLAGS = -I.. -I$(top_srcdir)/include -I$(top_srcdir)/intl
+AM_CPPFLAGS = -I.. -I$(top_srcdir)/include -I$(top_srcdir)/intl -I$(top_srcdir)/mpi -I../mpi
 
 if ! HAVE_DOSISH_SYSTEM
 AM_CPPFLAGS += -DGNUPG_LIBDIR="\"$(libdir)/@PACKAGE@\""
diff --git a/cipher/rsa.c b/cipher/rsa.c
index 5d7b4f7..84a1af0 100644
--- a/cipher/rsa.c
+++ b/cipher/rsa.c
@@ -29,7 +29,7 @@
 #include <string.h>
 #include "util.h"
 #include "mpi.h"
-#include "../mpi/mpi-internal.h"
+#include "mpi-internal.h"
 #include "cipher.h"
 #include "rsa.h"
 

commit 8fd9f72e1b2e578e45c98c978cab4f6d47683d2c
Author: Marcus Brinkmann <mb at g10code.com>
Date:   Fri Jul 7 21:03:10 2017 +0900

    rsa: Add exponent blinding.
    
    * cipher/rsa.c (secret_core_crt): Blind secret D with randomized
    nonce R for mpi_powm computation.
    
    --
    
    Backport of libgcrypt 8725c99ffa41778f382ca97233183bcd687bb0ce.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>

diff --git a/cipher/rsa.c b/cipher/rsa.c
index 5efab1d..5d7b4f7 100644
--- a/cipher/rsa.c
+++ b/cipher/rsa.c
@@ -29,6 +29,7 @@
 #include <string.h>
 #include "util.h"
 #include "mpi.h"
+#include "../mpi/mpi-internal.h"
 #include "cipher.h"
 #include "rsa.h"
 
@@ -325,14 +326,38 @@ secret(MPI output, MPI input, RSA_secret_key *skey )
 # endif /* USE_BLINDING */
 
     /* RSA secret operation:  */
-    /* m1 = c ^ (d mod (p-1)) mod p */
+    MPI D_blind = mpi_alloc_secure (nlimbs);
+    MPI rr;
+    unsigned int rr_nbits;
+
+    rr_nbits = mpi_get_nbits (skey->p) / 4;
+    if (rr_nbits < 96)
+      rr_nbits = 96;
+    rr = mpi_alloc_secure ( (rr_nbits + BITS_PER_MPI_LIMB-1)/BITS_PER_MPI_LIMB );
+
+    /* d_blind = (d mod (p-1)) + (p-1) * r            */
+    /* m1 = c ^ d_blind mod p */
+    randomize_mpi (rr, rr_nbits, 0);
+    mpi_set_highbit (rr, rr_nbits - 1);
     mpi_sub_ui( h, skey->p, 1  );
+    mpi_mul ( D_blind, h, rr );
     mpi_fdiv_r( h, skey->d, h );
-    mpi_powm( m1, input, h, skey->p );
-    /* m2 = c ^ (d mod (q-1)) mod q */
+    mpi_add ( D_blind, D_blind, h );
+    mpi_powm ( m1, input, D_blind, skey->p );
+
+    /* d_blind = (d mod (q-1)) + (q-1) * r            */
+    /* m2 = c ^ d_blind mod q */
+    randomize_mpi (rr, rr_nbits, 0);
+    mpi_set_highbit (rr, rr_nbits - 1);
     mpi_sub_ui( h, skey->q, 1  );
+    mpi_mul ( D_blind, h, rr );
     mpi_fdiv_r( h, skey->d, h );
-    mpi_powm( m2, input, h, skey->q );
+    mpi_add ( D_blind, D_blind, h );
+    mpi_powm ( m2, input, D_blind, skey->q );
+
+    mpi_free ( rr );
+    mpi_free ( D_blind );
+
     /* h = u * ( m2 - m1 ) mod q */
     mpi_sub( h, m2, m1 );
     if ( mpi_is_neg( h ) )

-----------------------------------------------------------------------

Summary of changes:
 cipher/Makefile.am |  2 +-
 cipher/rsa.c       | 40 ++++++++++++++++++++++++++++++++++++----
 g10/textfilter.c   |  1 +
 3 files changed, 38 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sat Jul  8 21:42:38 2017
From: cvs at cvs.gnupg.org (by Yuri Chornoivan)
Date: Sat, 08 Jul 2017 21:42:38 +0200
Subject: [git] Scute - branch, master, updated. scute-1.3.0-72-g4553ff2
Message-ID: <E1dTvck-00046m-Cv@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PKCS#11 token on top of gpg-agent".

The branch, master has been updated
       via  4553ff2027fdc494c56bb0fa6bdc1df0779ec13c (commit)
      from  5ef976c40007ba2b062e9bd63e35bca894c3d9a0 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4553ff2027fdc494c56bb0fa6bdc1df0779ec13c
Author: Yuri Chornoivan <yurchor at ukr.net>
Date:   Sat Jul 8 21:15:42 2017 +0200

    Fix minor typos in doc and comments.
    
    --
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/doc/manual/scute.texi b/doc/manual/scute.texi
index 392cc98..523a6da 100644
--- a/doc/manual/scute.texi
+++ b/doc/manual/scute.texi
@@ -201,7 +201,7 @@ of Scute into the application is seamless.
 
 Scute is a security device that implements the PKCS #11 interface for
 security tokens.  Applications which know how to use the PKCS #11
-interface to access security tokens for crytpographic operations can use
+interface to access security tokens for cryptographic operations can use
 Scute to access the OpenPGP smart card.  An important example of such an
 application is the Firefox web browser by the Mozilla project, which
 uses the Mozilla Network Security Services library (NSS).
diff --git a/src/agent.c b/src/agent.c
index cfc9a56..108e1ea 100644
--- a/src/agent.c
+++ b/src/agent.c
@@ -395,7 +395,7 @@ unescape_status_string (const unsigned char *src)
 }
 
 
-/* Take a 20 byte hexencoded string and put it into the the provided
+/* Take a 20 byte hexencoded string and put it into the provided
    20 byte buffer FPR in binary format.  Returns true if successful,
    and false otherwise.  */
 static int
diff --git a/src/sexp-parse.h b/src/sexp-parse.h
index f68c552..f2edafa 100644
--- a/src/sexp-parse.h
+++ b/src/sexp-parse.h
@@ -89,7 +89,7 @@ sskip (unsigned char const **buf, int *depth)
 }
 
 
-/* Check whether the the string at the address BUF points to matches
+/* Check whether the string at the address BUF points to matches
    the token.  Return true on match and update BUF to point behind the
    token.  Return false and do not update the buffer if it does not
    match. */

-----------------------------------------------------------------------

Summary of changes:
 doc/manual/scute.texi | 2 +-
 src/agent.c           | 2 +-
 src/sexp-parse.h      | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
PKCS#11 token on top of gpg-agent
http://git.gnupg.org



From cvs at cvs.gnupg.org  Sun Jul  9 22:46:39 2017
From: cvs at cvs.gnupg.org (by Damien Goutte-Gattat)
Date: Sun, 09 Jul 2017 22:46:39 +0200
Subject: [git] Scute - branch, master, updated. scute-1.3.0-73-g21baad8
Message-ID: <E1dUJ6F-0006Z9-NO@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PKCS#11 token on top of gpg-agent".

The branch, master has been updated
       via  21baad873862352833fc54eb85fb490522955e6f (commit)
      from  4553ff2027fdc494c56bb0fa6bdc1df0779ec13c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 21baad873862352833fc54eb85fb490522955e6f
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Sun Jul 9 22:40:51 2017 +0200

    Update manual.
    
    * doc/manual/scute.texi: Update some links. Refer to GnuPG 2
    instead of GnuPG 2.0.
    
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/doc/manual/scute.texi b/doc/manual/scute.texi
index 523a6da..705935c 100644
--- a/doc/manual/scute.texi
+++ b/doc/manual/scute.texi
@@ -191,7 +191,7 @@ in the future.
 
 @item it's easy
 Building and installing Scute is easy, and preparing smart cards for use
-with Scute is a snatch using the GnuPG 2.0 framework.  The integration
+with Scute is a snatch using the GnuPG 2 framework.  The integration
 of Scute into the application is seamless.
 @end table
 
@@ -207,9 +207,9 @@ application is the Firefox web browser by the Mozilla project, which
 uses the Mozilla Network Security Services library (NSS).
 
 Scute itself does not include a driver for the smart card itself.
-Instead, it uses the GnuPG 2.0 framework to access the smart cards and
+Instead, it uses the GnuPG 2 framework to access the smart cards and
 associated data like certificates.  Scute acts as the glue between the
-application and GnuPG 2.0.
+application and GnuPG 2.
 
 Currently supported usages are client authentication over HTTPS with
 Firefox (allowing users to authenticate themselves to a remote web
@@ -246,11 +246,11 @@ following packages at build time:
 
 @table @code
 @item libgpg-error
-Scute uses the GnuPG 2.0 framework for error handling, so it depends on
+Scute uses the GnuPG 2 framework for error handling, so it depends on
 the GPG error library.  The minimum version required is 1.14.
 
 @item libassuan
-Scute uses the GnuPG 2.0 framework for communication with the GPG Agent,
+Scute uses the GnuPG 2 framework for communication with the GPG Agent,
 so it depends on the Assuan library.  The minimum version required is
 2.0.0.
 @end table
@@ -261,13 +261,13 @@ configured:
 
 @table @asis
 @item GnuPG
-Scute uses the GnuPG 2.0 framework to access the OpenPGP card and for
+Scute uses the GnuPG 2 framework to access the OpenPGP card and for
 certificate management.  The minimum version required is 2.0.0 for
 client authentication with TLS 1.0 and 1.1.  Client authentication
 with TLS 1.2, email and document signing require GnuPG 2.1.0.
 
 @item Pinentry
-Pinentry is a dependency of GnuPG 2.0, so it also needs to be installed
+Pinentry is a dependency of GnuPG 2, so it also needs to be installed
 with it.
 
 @item Firefox et al.
@@ -617,8 +617,9 @@ prompted for your User PIN when you will click the @code{Export} button.
 device manager of Firefox fails with "Unable to load module".
 
 @strong{Solution:} Make sure that Scute is correctly installed, and that
-all libraries and executables are available.  Make sure that the GPG
-Agent is running and can be found via the environment variable
+all libraries and executables are available.  If you are using GnuPG
+2.0 (instead of 2.1), you may need to make sure that the GPG Agent is
+running and can be found via the environment variable
 @code{GPG_AGENT_INFO}.  @xref{Invoking GPG-AGENT, , , gnupg, Using the
 GNU Privacy Guard}, for details on how to run the GPG Agent.
 
@@ -661,7 +662,7 @@ its scope and potential compatibility issues with applications.
 @section Features and Limitations
 
 Scute implements version 2.20 of the
- at uref{http://www.rsasecurity.com/rsalabs/node.asp?id=2133, PKCS #11}
+ at uref{https://www.emc.com/emc-plus/rsa-labs/standards-initiatives/pkcs-11-cryptographic-token-interface-standard.htm, PKCS #11}
 specification.
 
 The @uref{http://www.g10code.com/p-card.html,OpenPGP smart card}
@@ -787,24 +788,19 @@ There is a different, probably more powerful way to debug Mozilla PKCS
 #11 libraries.  However, to be able to use it, you need to configure and
 compile the Mozilla NSS sources with @code{--enable-debug}.
 Instructions can be found at:
- at uref{http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn2.html}
+ at uref{https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/nss_tech_notes}
 
 Here are a couple of links to more information about implementing a
 PKCS #11 module for Mozilla:
 
 @table @uref
- at item http://docs.sun.com/source/816-6150-10/index.htm
- at itemx http://docs.sun.com/source/816-6150-10/pkcs.htm
-Implementing PKCS #11 for the Netscape Security Library (Caution: The
-content may be out of date)
+ at item https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/PKCS11_Implement
+Guidelines for implementors of PKCS #11 modules targeting Mozilla
 
- at item http://www.mozilla.org/projects/security/pki/pkcs11/netscape/problems.html
-Common PKCS #11 Implementation Problems
-
- at item http://www.mozilla.org/projects/security/pki/pkcs11/
+ at item http://www-archive.mozilla.org/projects/security/pki/pkcs11/
 PKCS #11 Conformance Testing
 
- at item http://www.mozilla.org/projects/security/pki/nss/
+ at item https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS
 The Mozilla NSS web page
 @end table
 

-----------------------------------------------------------------------

Summary of changes:
 doc/manual/scute.texi | 36 ++++++++++++++++--------------------
 1 file changed, 16 insertions(+), 20 deletions(-)


hooks/post-receive
-- 
PKCS#11 token on top of gpg-agent
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 10 09:08:00 2017
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Mon, 10 Jul 2017 09:08:00 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. eb1300cb8d13bee8df32e3856f37056cb50107e2
Message-ID: <E1dUSnZ-0007XV-42@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  eb1300cb8d13bee8df32e3856f37056cb50107e2 (commit)
      from  d83aebe0b394e1da677976fe0e92094e58f50900 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit eb1300cb8d13bee8df32e3856f37056cb50107e2
Author: Neal H. Walfield <neal at gnu.org>
Date:   Thu Jul 6 12:09:16 2017 +0200

    campaign: Change video of the day to DKG.

diff --git a/web/donate/index.de.org b/web/donate/index.de.org
index 7b624e4..fea3335 100644
--- a/web/donate/index.de.org
+++ b/web/donate/index.de.org
@@ -222,8 +222,9 @@ href="/cgi-bin/procdonate.cgi?mode=preset&lang=de"
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Video des Tages: C?dric Laurant
-            <small><a href="https://sontusdatos.org/">SonTusDatos</a></small>
+	  <h2>Video des Tages: Daniel Kahn Gillmor
+            <small><a href="https://debian.org/">Debian</a> and the
+            <a href="https://www.aclu.org/">American Civil Liberties Union</a></small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.fr.org b/web/donate/index.fr.org
index cf93053..4289738 100644
--- a/web/donate/index.fr.org
+++ b/web/donate/index.fr.org
@@ -215,8 +215,9 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Clip du jour?: C?dric Laurant
-            <small><a href="https://sontusdatos.org/">SonTusDatos</a></small>
+	  <h2>Clip du jour?: Daniel Kahn Gillmor
+            <small><a href="https://debian.org/">Debian</a> and the
+            <a href="https://www.aclu.org/">American Civil Liberties Union</a></small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.ja.org b/web/donate/index.ja.org
index cd9ddd0..45661a0 100644
--- a/web/donate/index.ja.org
+++ b/web/donate/index.ja.org
@@ -202,8 +202,9 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>?????: C?dric Laurant
-            <small><a href="https://sontusdatos.org/">SonTusDatos</a></small>
+	  <h2>?????: Daniel Kahn Gillmor
+            <small><a href="https://debian.org/">Debian</a> and the
+            <a href="https://www.aclu.org/">American Civil Liberties Union</a></small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.org b/web/donate/index.org
index 8e498e7..192052d 100644
--- a/web/donate/index.org
+++ b/web/donate/index.org
@@ -217,8 +217,9 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Video of the Day: C?dric Laurant
-            <small><a href="https://sontusdatos.org/">SonTusDatos</a></small>
+	  <h2>Video of the Day: Daniel Kahn Gillmor
+            <small><a href="https://debian.org/">Debian</a> and the
+            <a href="https://www.aclu.org/">American Civil Liberties Union</a></small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/share/campaign/campaign.js b/web/share/campaign/campaign.js
index 28453ca..ecde921 100644
--- a/web/share/campaign/campaign.js
+++ b/web/share/campaign/campaign.js
@@ -89,7 +89,7 @@ function get_param_from_url(name) {
 $(document).ready(function() {
 
     // VOTD: Update VOTD here.
-    let VIDLIST = "cedric,michael,sheera,meik,seamus,andrew,geoffrey,hernani,leez,noah,c5,jochim,john,jason,sze,rysiek,ksenia,cindy,matt,thenmozhi,alex,andre,benjamin";
+    let VIDLIST = "daniel,cedric,michael,sheera,meik,seamus,andrew,geoffrey,hernani,leez,noah,c5,jochim,john,jason,sze,rysiek,ksenia,cindy,matt,thenmozhi,alex,andre,benjamin";
 
     let YTID = { "main": "wNHhkntqklg",
 		 "thenmozhi": "sQMj332dgIE",
@@ -98,7 +98,6 @@ $(document).ready(function() {
 		 "matt": "5MCGTd8pOG4",
 		 "john": "iRuo57Hzask",
 		 "jason": "oQvP9SXm-ek",
-		 "daniel": "coFFCJlMRjk",
 		 "cindy": "IdCiJMc3q80",
 		 "benjamin": "atFz16nInIs",
 		 "arthur": "Js_OqRLm9F4",
@@ -116,7 +115,8 @@ $(document).ready(function() {
 		 "meik": "j0Zd0wZyLP8",
 		 "sheera": "mak22hXcslg",
                  "michael": "MSu_FF49MtU",
-                 "cedric": "-Rkrf9GIw8M"
+                 "cedric": "-Rkrf9GIw8M",
+		 "daniel": "SdlnauJ5XWM"
 	       };
 
     /* For the video preview, we use this for devices without hover events.  */
diff --git a/web/share/campaign/img/thumbs/daniel.jpg b/web/share/campaign/img/thumbs/daniel.jpg
index ae1fd09..4c2ce60 100644
Binary files a/web/share/campaign/img/thumbs/daniel.jpg and b/web/share/campaign/img/thumbs/daniel.jpg differ

-----------------------------------------------------------------------

Summary of changes:
 web/donate/index.de.org                  |   5 +++--
 web/donate/index.fr.org                  |   5 +++--
 web/donate/index.ja.org                  |   5 +++--
 web/donate/index.org                     |   5 +++--
 web/share/campaign/campaign.js           |   6 +++---
 web/share/campaign/img/thumbs/daniel.jpg | Bin 76314 -> 118827 bytes
 6 files changed, 15 insertions(+), 11 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 10 14:27:40 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Mon, 10 Jul 2017 14:27:40 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-86-g1455b40
Message-ID: <E1dUXmv-0001Ye-4Q@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  1455b406e63dd262938e49da5f83c05c17c60a8d (commit)
      from  243b2a570c30586e19b8c88e43b282d62d8eb77c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1455b406e63dd262938e49da5f83c05c17c60a8d
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Mon Jul 10 14:25:59 2017 +0200

    speedo: Provide a vagrantfile to test speedo in an isolated VM.
    
    * build-aux/Vagrantfile: New file.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>

diff --git a/build-aux/Vagrantfile b/build-aux/Vagrantfile
new file mode 100644
index 0000000..e4252aa
--- /dev/null
+++ b/build-aux/Vagrantfile
@@ -0,0 +1,36 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+# This Vagrantfile installs all build dependencies for speedo and runs it to compile all of gnupg.
+
+$script = <<SCRIPT
+echo I am provisioning...
+export DEBIAN_FRONTEND noninteractive
+apt-get update -q -q
+apt-get install --yes rsync build-essential git gpg automake autoconf gettext libtool
+apt-get install --yes libz-dev libbz2-dev libldap2-dev libsqlite3-dev libgnutls28-dev libcurl4-gnutls-dev libreadline-dev librsvg2-bin libusb-1.0-0-dev
+apt-get install --yes texinfo transfig fig2dev imagemagick file ghostscript swig doxygen graphviz
+apt-get install --yes pkg-config autopoint python-all-dev python3-all-dev qtbase5-dev
+(cd /tmp; rsync -rvazp /vagrant .)
+(cd /tmp/vagrant; autoreconf -f -i)
+(cd /tmp/vagrant/build-aux; make -f speedo.mk native INSTALL_PREFIX=/tmp/install SELFCHECK=0)
+(cd /tmp/vagrant/build-aux/PLAY/build/gnupg; make check-all)
+SCRIPT
+
+Vagrant.configure("2") do |config|
+  config.vm.box = "debian/stretch64"
+
+  # Use .. for mount.  Also, Force NFS vers=3 (instead vers=4) for Debian 8.
+  config.vm.synced_folder "..", "/vagrant", :mount_options => ['nolock,vers=3,tcp,noatime']
+
+  config.vm.provider "libvirt" do |libvirt|
+    libvirt.nested = true
+    libvirt.cpus = 1
+    libvirt.cpu_mode = "host-model"
+    libvirt.memory = 1024
+    libvirt.storage :file, :path => 'vms.qcow2', :size => '1G'
+  end
+
+  config.vm.provision "shell", inline: $script
+
+end

-----------------------------------------------------------------------

Summary of changes:
 build-aux/Vagrantfile | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 build-aux/Vagrantfile


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 10 17:26:23 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 10 Jul 2017 17:26:23 +0200
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-269-ga288530
Message-ID: <E1dUaZr-000128-RN@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  a288530385d9395c64d7fa2c92ecc67ad2d0d67d (commit)
       via  54414f0543cf350133b28dac2277ad4d2fd8e7d6 (commit)
      from  57bd43759afbf8609eaa8adf6fde801b367d2353 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a288530385d9395c64d7fa2c92ecc67ad2d0d67d
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jul 10 17:24:07 2017 +0200

    Add handling for de-vs compliant results
    
    * configure.ac: Bump required GPGME version to 1.9
    * src/mail.cpp (in_de_vs_mode): New helper.
    (Mail::get_crypto_details): Add texts about de-vs states.
    (Mail::get_signature_level): Only return 3 or 4 in vs-mode if
    the signature was actually de-vs compliant.

diff --git a/configure.ac b/configure.ac
index 4d547de..418fb62 100644
--- a/configure.ac
+++ b/configure.ac
@@ -40,7 +40,7 @@ GPGOL_FORMS_REVISION=335
 
 NEED_GPG_ERROR_VERSION=1.9
 NEED_GPGME_API=1
-NEED_GPGME_VERSION=1.7.0
+NEED_GPGME_VERSION=1.9.0
 NEED_LIBASSUAN_API=2
 NEED_LIBASSUAN_VERSION=2.0.0
 
diff --git a/src/mail.cpp b/src/mail.cpp
index 6d694b4..027d71e 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -36,6 +36,7 @@
 #include "windowmessages.h"
 #include "mlang-charset.h"
 
+#include <gpgme++/configuration.h>
 #include <gpgme++/tofuinfo.h>
 #include <gpgme++/verificationresult.h>
 #include <gpgme++/decryptionresult.h>
@@ -59,6 +60,58 @@ static std::map<LPDISPATCH, Mail*> g_mail_map;
 static std::map<std::string, Mail*> g_uid_map;
 static std::set<std::string> uids_searched;
 
+static bool
+in_de_vs_mode()
+{
+  /* We cache the values only once. A change requires restart.
+     This is because checking this is very expensive as gpgconf
+     spawns each process to query the settings. */
+  static bool checked;
+  static bool vs_mode;
+
+  if (checked)
+    {
+      return vs_mode;
+    }
+  Error err;
+  const auto components = Configuration::Component::load (err);
+  log_debug ("%s:%s: Checking for de-vs mode.",
+             SRCNAME, __func__);
+  if (err)
+    {
+      log_error ("%s:%s: Failed to get gpgconf components: %s",
+                 SRCNAME, __func__, err.asString ());
+      checked = true;
+      vs_mode = false;
+      return vs_mode;
+    }
+  for (const auto &component: components)
+    {
+      if (component.name () && !strcmp (component.name (), "gpg"))
+        {
+          for (const auto &option: component.options ())
+            {
+              if (option.name () && strcmp (option.name (), "compliance") &&
+                  option.currentValue ().stringValue () &&
+                  stricmp (option.currentValue ().stringValue (), "de-vs"))
+                {
+                  log_debug ("%s:%s: Detected de-vs mode",
+                             SRCNAME, __func__);
+                  checked = true;
+                  vs_mode = true;
+                  return vs_mode;
+                }
+            }
+          checked = true;
+          vs_mode = false;
+          return vs_mode;
+        }
+    }
+  checked = true;
+  vs_mode = false;
+  return false;
+}
+
 #define COPYBUFSIZE (8 * 1024)
 
 Mail::Mail (LPDISPATCH mailitem) :
@@ -1696,6 +1749,7 @@ Mail::get_crypto_one_line()
 std::string
 Mail::get_crypto_details()
 {
+  std::string message;
   /* Handle encrypt only */
   if (!is_encrypted () && !is_signed ())
     {
@@ -1704,12 +1758,22 @@ Mail::get_crypto_details()
     }
   else if (is_encrypted() && !is_signed ())
     {
-      return _("But you cannot be sure who sent the message because "
-               "it is not signed.");
+      if (in_de_vs_mode ())
+       {
+         if (m_sig.isDeVs())
+           {
+             message += _("The encryption was VS-compliant.");
+           }
+         else
+           {
+             message += _("The encryption was not VS-compliant.");
+           }
+        }
+      message += "\n";
+      message += _("You cannot be sure who sent the message because "
+                   "it is not signed.");
     }
 
-  std::string message;
-
   bool keyFound = true;
   bool isOpenPGP = m_sig.key().isNull() ? !is_smime() :
                    m_sig.key().protocol() == Protocol::OpenPGP;
@@ -1899,8 +1963,35 @@ Mail::get_crypto_details()
           message += _("is marked as not trustworthy.");
         }
     }
-  message += "\n\n";
-  if (hasConflict)
+   message += "\n\n";
+   if (in_de_vs_mode ())
+     {
+       if (is_signed ())
+         {
+           if (m_sig.isDeVs ())
+             {
+               message += _("The signature is VS-compliant.");
+             }
+           else
+             {
+               message += _("The signature is not VS-compliant.");
+             }
+           message += "\n";
+         }
+       if (is_encrypted ())
+         {
+           if (m_decrypt_result.isDeVs ())
+             {
+               message += _("The encryption is VS-compliant.");
+             }
+           else
+             {
+               message += _("The encryption is not VS-compliant.");
+             }
+           message += "\n\n";
+         }
+     }
+   if (hasConflict)
     {
       message += _("Click here to change the key used for this address.");
     }
@@ -1917,7 +2008,6 @@ Mail::get_crypto_details()
   return message;
 }
 
-
 int
 Mail::get_signature_level () const
 {
@@ -1931,13 +2021,15 @@ Mail::get_signature_level () const
       /* No m_uid matches our sender. */
       return 0;
     }
+
   if (m_is_valid && (m_uid.validity () == UserID::Validity::Ultimate ||
       (m_uid.validity () == UserID::Validity::Full &&
-      level_4_check (m_uid))))
+      level_4_check (m_uid))) && (!in_de_vs_mode () || m_sig.isDeVs()))
     {
       return 4;
     }
-  if (m_is_valid && m_uid.validity () == UserID::Validity::Full)
+  if (m_is_valid && m_uid.validity () == UserID::Validity::Full &&
+      (!in_de_vs_mode () || m_sig.isDeVs()))
     {
       return 3;
     }

commit 54414f0543cf350133b28dac2277ad4d2fd8e7d6
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Sun May 14 12:55:48 2017 +0200

    Add deprecation warning for OL2003/2007
    
    * src/common_indep.h (opt.deprecation_shown): New option.
    * src/main.c (write_options, read_options): Handle new option.
    * src/olflange.cpp: Show warning for old versions.
    
    --
    GnuPG-Bug-Id: T3153

diff --git a/src/common_indep.h b/src/common_indep.h
index 1934eac..124112a 100644
--- a/src/common_indep.h
+++ b/src/common_indep.h
@@ -199,6 +199,7 @@ struct
   int inline_pgp;            /* Only for Addin. Use Inline PGP by default. */
   int autoresolve;           /* Autresolve keys with --locate-keys. */
   int reply_crypt;           /* Only for Addin. Encrypt / Sign based on cryptostatus. */
+  int deprecation_shown;     /* Flag to save if deprecation warning was shown */
 
   /* The compatibility flags. */
   struct
diff --git a/src/main.c b/src/main.c
index 008b432..631d438 100644
--- a/src/main.c
+++ b/src/main.c
@@ -424,6 +424,9 @@ read_options (void)
   load_extension_value ("replyCrypt", &val);
   opt.reply_crypt = val == NULL || *val != '1'? 1 : 0;
   xfree (val); val = NULL;
+  load_extension_value ("deprecationShown", &val);
+  opt.deprecation_shown = val == NULL || *val != '1'? 0 : 1;
+  xfree (val); val = NULL;
   /* Note, that on purpose these flags are only Registry changeable.
      The format of the entry is a string of of "0" and "1" digits; see
      the switch below for a description. */
@@ -497,6 +500,7 @@ write_options (void)
     {"inlinePGP",                0, opt.inline_pgp, NULL},
     {"autoresolve",              0, opt.autoresolve, NULL},
     {"replyCrypt",               0, opt.reply_crypt, NULL},
+    {"deprecationShown",         0, opt.deprecation_shown, NULL},
     {NULL, 0, 0, NULL}
   };
   char buf[32];
diff --git a/src/olflange.cpp b/src/olflange.cpp
index af0eae9..36ea6da 100644
--- a/src/olflange.cpp
+++ b/src/olflange.cpp
@@ -803,6 +803,20 @@ GpgolExt::Install(LPEXCHEXTCALLBACK pEECB, ULONG lContext, ULONG lFlags)
         }
     }
 
+    if ( !opt.deprecation_shown && ((lBuildVersion & EECBGV_BUILDVERSION_MAJOR_MASK) < 13
+         || (lBuildVersion & EECBGV_BUILDVERSION_MINOR_MASK) < 1573
+         || (olversion && atoi (olversion) < 14)))
+      {
+        MessageBox (NULL,
+                  _("GpgOL for Outlook 2003 / 2007 is longer maintained.\n"
+                    "\n"
+                    "Please note that any support may be removed in a future version."),
+                    "GpgOL", MB_ICONINFORMATION|MB_OK);
+
+        opt.deprecation_shown = 1;
+        write_options ();
+      }
+
   /* If the version from the OOM is available we can assume that the
      OOM is ready for use and thus we can install the event sinks. */
   if (olversion)

-----------------------------------------------------------------------

Summary of changes:
 configure.ac       |   2 +-
 src/common_indep.h |   1 +
 src/mail.cpp       | 110 ++++++++++++++++++++++++++++++++++++++++++++++++-----
 src/main.c         |   4 ++
 src/olflange.cpp   |  14 +++++++
 5 files changed, 121 insertions(+), 10 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 10 17:28:36 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Mon, 10 Jul 2017 17:28:36 +0200
Subject: [git] GPGME - branch, master, updated. gpgme-1.9.0-45-gfe79eb8
Message-ID: <E1dUac0-000153-Kw@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  fe79eb8de3dc780eafb38a0a0a016748e764ff04 (commit)
       via  3b9123b4c64828acd2d2048f40d7631513aeab36 (commit)
      from  5c53c702605b8d4458a14e6303cdc13f3b106efa (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit fe79eb8de3dc780eafb38a0a0a016748e764ff04
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jul 10 17:27:24 2017 +0200

    Add isDeVs to ostream operator
    
    * lang/cpp/src/decryptionresult.cpp,
    lang/cpp/src/verificationresult.cpp: Extend ostream operator
    to include isDeVs.

diff --git a/lang/cpp/src/decryptionresult.cpp b/lang/cpp/src/decryptionresult.cpp
index d1c991b..1e815cb 100644
--- a/lang/cpp/src/decryptionresult.cpp
+++ b/lang/cpp/src/decryptionresult.cpp
@@ -230,6 +230,7 @@ std::ostream &GpgME::operator<<(std::ostream &os, const DecryptionResult &result
            << "\n fileName:             " << protect(result.fileName())
            << "\n unsupportedAlgorithm: " << protect(result.unsupportedAlgorithm())
            << "\n isWrongKeyUsage:      " << result.isWrongKeyUsage()
+           << "\n isDeVs                " << result.isDeVs()
            << "\n recipients:\n";
         const std::vector<DecryptionResult::Recipient> recipients = result.recipients();
         std::copy(recipients.begin(), recipients.end(),
diff --git a/lang/cpp/src/verificationresult.cpp b/lang/cpp/src/verificationresult.cpp
index 6dacd9f..2c42d07 100644
--- a/lang/cpp/src/verificationresult.cpp
+++ b/lang/cpp/src/verificationresult.cpp
@@ -590,6 +590,7 @@ std::ostream &GpgME::operator<<(std::ostream &os, const Signature &sig)
            << "\n publicKeyAlgorithm:        " << protect(sig.publicKeyAlgorithmAsString())
            << "\n hashAlgorithm:             " << protect(sig.hashAlgorithmAsString())
            << "\n policyURL:                 " << protect(sig.policyURL())
+           << "\n isDeVs                     " << sig.isDeVs()
            << "\n notations:\n";
         const std::vector<Notation> nota = sig.notations();
         std::copy(nota.begin(), nota.end(),

commit 3b9123b4c64828acd2d2048f40d7631513aeab36
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Mon Jul 10 17:26:46 2017 +0200

    Fix some shadow warnings
    
    --
    Warnings in headers hurt downstream.

diff --git a/lang/cpp/src/configuration.h b/lang/cpp/src/configuration.h
index 6717ea3..6993b6d 100644
--- a/lang/cpp/src/configuration.h
+++ b/lang/cpp/src/configuration.h
@@ -95,8 +95,8 @@ class GPGMEPP_EXPORT Component
 {
 public:
     Component() : comp() {}
-    explicit Component(const shared_gpgme_conf_comp_t &comp)
-        : comp(comp) {}
+    explicit Component(const shared_gpgme_conf_comp_t &gpgme_comp)
+        : comp(gpgme_comp) {}
 
     // copy ctor is ok
 
@@ -146,8 +146,8 @@ class GPGMEPP_EXPORT Option
 {
 public:
     Option() : comp(), opt(0) {}
-    Option(const shared_gpgme_conf_comp_t &comp, gpgme_conf_opt_t opt)
-        : comp(comp), opt(opt) {}
+    Option(const shared_gpgme_conf_comp_t &gpgme_comp, gpgme_conf_opt_t gpgme_opt)
+        : comp(gpgme_comp), opt(gpgme_opt) {}
 
     const Option &operator=(const Option &other)
     {

-----------------------------------------------------------------------

Summary of changes:
 lang/cpp/src/configuration.h        | 8 ++++----
 lang/cpp/src/decryptionresult.cpp   | 1 +
 lang/cpp/src/verificationresult.cpp | 1 +
 3 files changed, 6 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 10 18:11:28 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Mon, 10 Jul 2017 18:11:28 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-87-gd245949
Message-ID: <E1dUbHU-0006ov-PA@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  d24594976686983c7186cbe4e78153888a13b6e4 (commit)
      from  1455b406e63dd262938e49da5f83c05c17c60a8d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d24594976686983c7186cbe4e78153888a13b6e4
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Thu Jul 6 13:52:24 2017 +0200

    tofu: Compare squares instead of square roots.
    
    * g10/Makefile.am (tofu_source) [USE_TOFU]: Remove sqrtu32.h and
    sqrtu32.c.
    * g10/sqrtu32.h, g10/sqrtu32.c: Removed files.
    * g10/tofu.c: Compare squares instead of square roots.
    --
    The original code is a factor 11.5 slower than using libm's sqrt(),
    which in turn is a factor 3.5 slower than using one multiplication
    on the other side of the comparison.  Also, it's much simpler now.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>

diff --git a/g10/Makefile.am b/g10/Makefile.am
index d5c92f8..cc4ef5c 100644
--- a/g10/Makefile.am
+++ b/g10/Makefile.am
@@ -77,7 +77,7 @@ trust_source = trustdb.c trustdb.h tdbdump.c tdbio.c tdbio.h
 endif
 
 if USE_TOFU
-tofu_source = tofu.h tofu.c gpgsql.c gpgsql.h sqrtu32.c sqrtu32.h
+tofu_source = tofu.h tofu.c gpgsql.c gpgsql.h
 else
 tofu_source =
 endif
diff --git a/g10/sqrtu32.c b/g10/sqrtu32.c
deleted file mode 100644
index 1490b31..0000000
--- a/g10/sqrtu32.c
+++ /dev/null
@@ -1,244 +0,0 @@
-/* sqrtu32.c - Return the very approximate sqrt of an unsigned integer.
- *
- * This file by g10 Code GmbH
- *
- * To the extent possible under law, the person who associated CC0 with
- * g10 Code GmbH has waived all copyright and related or neighboring rights
- * to this file.
- *
- * You should have received a copy of the CC0 legalcode along with this
- * work.  If not, see <https://creativecommons.org/publicdomain/zero/1.0/>.
- */
-
-/* The R code to generate the following table.  */
-#if 0
-{
-  m = 2^32 - 1
-  last.i = 0
-  last.sqrt = 0
-  i = 0
-  while (i < m) {
-    if (sqrt(i) - last.sqrt > 0.05 * last.sqrt) {
-      cat(paste0("  if (i <= ", last.i, "u) return ", last.sqrt, ";\n"));
-      last.i = i
-      last.sqrt = sqrt(i)
-    }
-    i = i + max(1, floor(last.sqrt / 10))
-  }
-  cat(paste0("  return ", sqrt(m), ";\n"))
-}
-#endif
-
-float
-sqrtu32 (unsigned int i)
-{
-  if (i <= 0u) return 0;
-  if (i <= 1u) return 1;
-  if (i <= 2u) return 1.4142135623731;
-  if (i <= 3u) return 1.73205080756888;
-  if (i <= 4u) return 2;
-  if (i <= 5u) return 2.23606797749979;
-  if (i <= 6u) return 2.44948974278318;
-  if (i <= 7u) return 2.64575131106459;
-  if (i <= 8u) return 2.82842712474619;
-  if (i <= 9u) return 3;
-  if (i <= 10u) return 3.16227766016838;
-  if (i <= 12u) return 3.46410161513775;
-  if (i <= 14u) return 3.74165738677394;
-  if (i <= 16u) return 4;
-  if (i <= 18u) return 4.24264068711928;
-  if (i <= 20u) return 4.47213595499958;
-  if (i <= 23u) return 4.79583152331272;
-  if (i <= 26u) return 5.09901951359278;
-  if (i <= 29u) return 5.3851648071345;
-  if (i <= 32u) return 5.65685424949238;
-  if (i <= 36u) return 6;
-  if (i <= 40u) return 6.32455532033676;
-  if (i <= 45u) return 6.70820393249937;
-  if (i <= 50u) return 7.07106781186548;
-  if (i <= 56u) return 7.48331477354788;
-  if (i <= 62u) return 7.87400787401181;
-  if (i <= 69u) return 8.30662386291807;
-  if (i <= 77u) return 8.77496438739212;
-  if (i <= 85u) return 9.21954445729289;
-  if (i <= 94u) return 9.69535971483266;
-  if (i <= 104u) return 10.1980390271856;
-  if (i <= 115u) return 10.7238052947636;
-  if (i <= 127u) return 11.2694276695846;
-  if (i <= 141u) return 11.8743420870379;
-  if (i <= 156u) return 12.4899959967968;
-  if (i <= 172u) return 13.114877048604;
-  if (i <= 190u) return 13.7840487520902;
-  if (i <= 210u) return 14.4913767461894;
-  if (i <= 232u) return 15.2315462117278;
-  if (i <= 256u) return 16;
-  if (i <= 283u) return 16.8226038412607;
-  if (i <= 313u) return 17.6918060129541;
-  if (i <= 346u) return 18.6010752377383;
-  if (i <= 382u) return 19.5448202856921;
-  if (i <= 422u) return 20.5426385841741;
-  if (i <= 466u) return 21.5870331449229;
-  if (i <= 514u) return 22.6715680975093;
-  if (i <= 568u) return 23.832750575626;
-  if (i <= 628u) return 25.0599281722833;
-  if (i <= 694u) return 26.343879744639;
-  if (i <= 766u) return 27.6767050061961;
-  if (i <= 846u) return 29.086079144498;
-  if (i <= 934u) return 30.5614135798723;
-  if (i <= 1030u) return 32.0936130717624;
-  if (i <= 1138u) return 33.734255586866;
-  if (i <= 1255u) return 35.4259791678367;
-  if (i <= 1384u) return 37.2021504754766;
-  if (i <= 1528u) return 39.0896405713841;
-  if (i <= 1687u) return 41.0731055558257;
-  if (i <= 1863u) return 43.1624837098145;
-  if (i <= 2055u) return 45.3321078265725;
-  if (i <= 2267u) return 47.6130234284697;
-  if (i <= 2503u) return 50.029991005396;
-  if (i <= 2763u) return 52.5642464038057;
-  if (i <= 3048u) return 55.208694967369;
-  if (i <= 3363u) return 57.9913786695919;
-  if (i <= 3708u) return 60.8933493905533;
-  if (i <= 4092u) return 63.9687423668779;
-  if (i <= 4512u) return 67.1714224949867;
-  if (i <= 4980u) return 70.5691150575094;
-  if (i <= 5491u) return 74.1012820401914;
-  if (i <= 6058u) return 77.8331548891602;
-  if (i <= 6681u) return 81.7373843476778;
-  if (i <= 7369u) return 85.842879728024;
-  if (i <= 8129u) return 90.160967164289;
-  if (i <= 8966u) return 94.6889645101265;
-  if (i <= 9893u) return 99.4635611668917;
-  if (i <= 10910u) return 104.450945424156;
-  if (i <= 12030u) return 109.68135666557;
-  if (i <= 13270u) return 115.195486022674;
-  if (i <= 14634u) return 120.971070921936;
-  if (i <= 16134u) return 127.019683514013;
-  if (i <= 17790u) return 133.379158791769;
-  if (i <= 19623u) return 140.08211877324;
-  if (i <= 21639u) return 147.102005424807;
-  if (i <= 23865u) return 154.483008774428;
-  if (i <= 26325u) return 162.24980739588;
-  if (i <= 29029u) return 170.378989314997;
-  if (i <= 32021u) return 178.94412535761;
-  if (i <= 35319u) return 187.933498876597;
-  if (i <= 38955u) return 197.370210518204;
-  if (i <= 42964u) return 207.277591649459;
-  if (i <= 47384u) return 217.678662252413;
-  if (i <= 52256u) return 228.595712995673;
-  if (i <= 57624u) return 240.049994792751;
-  if (i <= 63552u) return 252.09522010542;
-  if (i <= 70077u) return 264.720607433573;
-  if (i <= 77279u) return 277.991007048789;
-  if (i <= 85217u) return 291.919509454233;
-  if (i <= 93975u) return 306.553421119387;
-  if (i <= 103635u) return 321.923904051874;
-  if (i <= 114259u) return 338.022188620806;
-  if (i <= 125974u) return 354.928161745444;
-  if (i <= 138889u) return 372.678145321134;
-  if (i <= 153134u) return 391.323395671662;
-  if (i <= 168851u) return 410.914833025044;
-  if (i <= 186194u) return 431.5020278052;
-  if (i <= 205286u) return 453.084980991425;
-  if (i <= 226346u) return 475.758342018298;
-  if (i <= 249564u) return 499.563809738055;
-  if (i <= 275191u) return 524.586503829445;
-  if (i <= 303427u) return 550.842082633489;
-  if (i <= 334557u) return 578.409024825858;
-  if (i <= 368871u) return 607.347511726195;
-  if (i <= 406731u) return 637.754655020251;
-  if (i <= 448437u) return 669.654388472143;
-  if (i <= 494439u) return 703.163565609027;
-  if (i <= 545119u) return 738.321745582507;
-  if (i <= 601037u) return 775.265760884614;
-  if (i <= 662714u) return 814.072478345755;
-  if (i <= 730673u) return 854.794127261062;
-  if (i <= 805643u) return 897.576180610872;
-  if (i <= 888235u) return 942.46220083354;
-  if (i <= 979321u) return 989.60648744842;
-  if (i <= 1079771u) return 1039.1203010239;
-  if (i <= 1190496u) return 1091.09852900643;
-  if (i <= 1312576u) return 1145.67709237813;
-  if (i <= 1447210u) return 1203.00041562753;
-  if (i <= 1595650u) return 1263.19040528338;
-  if (i <= 1759324u) return 1326.3951145869;
-  if (i <= 1939768u) return 1392.75554208195;
-  if (i <= 2138677u) return 1462.42162183141;
-  if (i <= 2357969u) return 1535.5679730966;
-  if (i <= 2599709u) return 1612.3613118653;
-  if (i <= 2866325u) return 1693.02244521448;
-  if (i <= 3160216u) return 1777.69963717159;
-  if (i <= 3484303u) return 1866.62877937741;
-  if (i <= 3841609u) return 1960.00229591702;
-  if (i <= 4235569u) return 2058.04980503388;
-  if (i <= 4669759u) return 2160.962517028;
-  if (i <= 5148415u) return 2269.011899484;
-  if (i <= 5676351u) return 2382.50939137708;
-  if (i <= 6258261u) return 2501.65165440754;
-  if (i <= 6899761u) return 2626.73961404628;
-  if (i <= 7607161u) return 2758.10822847835;
-  if (i <= 8387061u) return 2896.04229941484;
-  if (i <= 9246836u) return 3040.86106226509;
-  if (i <= 10194708u) return 3192.91528230863;
-  if (i <= 11239752u) return 3352.57393654487;
-  if (i <= 12392152u) return 3520.24885483967;
-  if (i <= 13662520u) return 3696.2846210756;
-  if (i <= 15063244u) return 3881.13952338743;
-  if (i <= 16607484u) return 4075.22809177597;
-  if (i <= 18309965u) return 4279.01448934214;
-  if (i <= 20187057u) return 4493.00089027367;
-  if (i <= 22256498u) return 4717.67930236891;
-  if (i <= 24538022u) return 4953.58678131311;
-  if (i <= 27053612u) return 5201.30868147623;
-  if (i <= 29826772u) return 5461.3892005606;
-  if (i <= 32884372u) return 5734.48968958878;
-  if (i <= 36255331u) return 6021.23998857378;
-  if (i <= 39972079u) return 6322.34758614235;
-  if (i <= 44069335u) return 6638.47384569677;
-  if (i <= 48587017u) return 6970.43879537006;
-  if (i <= 53567779u) return 7319.00122967608;
-  if (i <= 59059051u) return 7684.98867923694;
-  if (i <= 65113195u) return 8069.27475055844;
-  if (i <= 71787681u) return 8472.76112020161;
-  if (i <= 79146417u) return 8896.4272042208;
-  if (i <= 87259431u) return 9341.27566234934;
-  if (i <= 96204349u) return 9808.38156884203;
-  if (i <= 106066089u) return 10298.8392064349;
-  if (i <= 116938503u) return 10813.8107529215;
-  if (i <= 128925712u) return 11354.5458737899;
-  if (i <= 142141652u) return 11922.3173921851;
-  if (i <= 156711468u) return 12518.445111115;
-  if (i <= 172775559u) return 13144.4117023167;
-  if (i <= 190485651u) return 13801.6539226283;
-  if (i <= 210011271u) return 14491.7656274175;
-  if (i <= 231537615u) return 15216.360110092;
-  if (i <= 255271299u) return 15977.2118656542;
-  if (i <= 281438144u) return 16776.1182637701;
-  if (i <= 310285898u) return 17614.9339482156;
-  if (i <= 342091319u) return 18495.710827108;
-  if (i <= 377155755u) return 19420.4983200741;
-  if (i <= 415815149u) return 20391.5460178967;
-  if (i <= 458436366u) return 21411.1271538889;
-  if (i <= 505427034u) return 22481.7044282679;
-  if (i <= 557234442u) return 23605.8137330616;
-  if (i <= 614351162u) return 24786.1082463544;
-  if (i <= 677324576u) return 26025.4601496304;
-  if (i <= 746751140u) return 27326.7477025716;
-  if (i <= 823293584u) return 28693.0929667751;
-  if (i <= 907682350u) return 30127.7670928331;
-  if (i <= 1000720018u) return 31634.1590373444;
-  if (i <= 1103296108u) return 33215.9014328981;
-  if (i <= 1216386121u) return 34876.7274984337;
-  if (i <= 1341067293u) return 36620.5856452351;
-  if (i <= 1478527787u) return 38451.6291852504;
-  if (i <= 1630078462u) return 40374.2301722274;
-  if (i <= 1797161818u) return 42392.9453800983;
-  if (i <= 1981371802u) return 44512.60273226;
-  if (i <= 2184466481u) return 46738.2764016817;
-  if (i <= 2408377949u) return 49075.2274472569;
-  if (i <= 2655239305u) return 51529.014205591;
-  if (i <= 2927404009u) return 54105.4896382983;
-  if (i <= 3227464249u) return 56810.7758176211;
-  if (i <= 3558280241u) return 59651.3222066368;
-  return 65535.9999923706;
-}
diff --git a/g10/sqrtu32.h b/g10/sqrtu32.h
deleted file mode 100644
index 566784d..0000000
--- a/g10/sqrtu32.h
+++ /dev/null
@@ -1,14 +0,0 @@
-/* sqrtu32.h - Return the very approximate sqrt of an unsigned integer.
- *
- * This file by g10 Code GmbH
- *
- * To the extent possible under law, the person who associated CC0 with
- * g10 Code GmbH has waived all copyright and related or neighboring rights
- * to this file.
- *
- * You should have received a copy of the CC0 legalcode along with this
- * work.  If not, see <http://creativecommons.org/publicdomain/zero/1.0/>.
- */
-
-/* Return the very approximate square root of an unsigned integer.  */
-float sqrtu32 (unsigned int i);
diff --git a/g10/tofu.c b/g10/tofu.c
index ba46244..c183fc6 100644
--- a/g10/tofu.c
+++ b/g10/tofu.c
@@ -42,7 +42,6 @@
 #include "../common/mkdir_p.h"
 #include "gpgsql.h"
 #include "../common/status.h"
-#include "sqrtu32.h"
 
 #include "tofu.h"
 
@@ -2922,19 +2921,18 @@ write_stats_status (estream_t fp,
 {
   int summary;
   int validity;
-  unsigned long days;
+  unsigned long days_sq;
 
   /* Use the euclidean distance (m = sqrt(a^2 + b^2)) rather then the
      sum of the magnitudes (m = a + b) to ensure a balance between
      verified signatures and encrypted messages.  */
-  days = sqrtu32 (signature_days * signature_days
-                  + encryption_days * encryption_days);
+  days_sq = signature_days * signature_days + encryption_days * encryption_days;
 
-  if (days < 1)
+  if (days_sq < 1)
     validity = 1; /* Key without history.  */
-  else if (days < 2 * BASIC_TRUST_THRESHOLD)
+  else if (days_sq < (2 * BASIC_TRUST_THRESHOLD) * (2 * BASIC_TRUST_THRESHOLD))
     validity = 2; /* Key with too little history.  */
-  else if (days < 2 * FULL_TRUST_THRESHOLD)
+  else if (days_sq < (2 * FULL_TRUST_THRESHOLD) * (2 * FULL_TRUST_THRESHOLD))
     validity = 3; /* Key with enough history for basic trust.  */
   else
     validity = 4; /* Key with a lot of history.  */
@@ -3232,9 +3230,9 @@ show_statistics (tofu_dbs_t dbs,
                         " one message to this key!\n"));
 
           /* Cf. write_stats_status  */
-          if (sqrtu32 (encryption_count * encryption_count
-                       + signature_count * signature_count)
-              < 2 * BASIC_TRUST_THRESHOLD)
+          if ((encryption_count * encryption_count
+	       + signature_count * signature_count)
+	      < ((2 * BASIC_TRUST_THRESHOLD) * (2 * BASIC_TRUST_THRESHOLD)))
             show_warning = 1;
         }
     }

-----------------------------------------------------------------------

Summary of changes:
 g10/Makefile.am |   2 +-
 g10/sqrtu32.c   | 244 --------------------------------------------------------
 g10/sqrtu32.h   |  14 ----
 g10/tofu.c      |  18 ++---
 4 files changed, 9 insertions(+), 269 deletions(-)
 delete mode 100644 g10/sqrtu32.c
 delete mode 100644 g10/sqrtu32.h


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 11 12:29:33 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 11 Jul 2017 12:29:33 +0200
Subject: [git] GPGME - branch, master, updated. gpgme-1.9.0-46-g1e68f93
Message-ID: <E1dUsQ9-0007Ep-Ec@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  1e68f93dc547ae75b921e43db35e3599de92e2cb (commit)
      from  fe79eb8de3dc780eafb38a0a0a016748e764ff04 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1e68f93dc547ae75b921e43db35e3599de92e2cb
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jul 11 12:18:42 2017 +0200

    python: Improve error handling.
    
    * NEWS: Update.
    * lang/python/src/core.py (Context.__read__): New helper function.
    (Context.encrypt): Attach partial results to exceptions.
    (Context.decrypt): Likewise.
    (Context.sign): Likewise.
    (Context.verify): Likewise.
    * lang/python/src/errors.py (GpgError): Move the core of GPGMEError to
    this class, add a nicer interface for it.  This makes the errors
    thrown by this library more uniform, and allows us to track the
    underlying error in synthesized high-level errors.
    (GPGMEError): Simplify.
    (...): Make sure to call the parent classes' constructor in all other
    classes.
    --
    
    Attach partial results to errors.  Some operations return results even
    though they signal an error.  Of course this information must be taken
    with a grain of salt.  But often, this information is useful for
    diagnostic uses or to give the user feedback.  Since the normal
    control flow is disrupted by the exception, the callee can no longer
    return results, hence we attach them to the exception objects.
    
    GnuPG-bug-id: 3271
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/NEWS b/NEWS
index b4a0d88..e193e00 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,7 @@ Noteworthy changes in version 1.9.1 (unreleased)
  cpp: Signature::isDeVs        NEW.
  py: DecryptResult EXTENDED: New boolean field 'is_de_vs'.
  py: Signature     EXTENDED: New boolean field 'is_de_vs'.
+ py: GpgError      EXTENDED: Partial results in 'results'.
 
 Noteworthy changes in version 1.9.0 (2017-03-28)
 ------------------------------------------------
diff --git a/lang/python/src/core.py b/lang/python/src/core.py
index 632f4ca..bd95d23 100644
--- a/lang/python/src/core.py
+++ b/lang/python/src/core.py
@@ -132,7 +132,7 @@ class GpgmeWrapper(object):
                 result = func(slf.wrapped, *args)
                 if slf._callback_excinfo:
                     gpgme.gpg_raise_callback_exception(slf)
-                return errorcheck(result, "Invocation of " + name)
+                return errorcheck(result, name)
         else:
             def _funcwrap(slf, *args):
                 result = func(slf.wrapped, *args)
@@ -206,6 +206,17 @@ class Context(GpgmeWrapper):
         self.protocol = protocol
         self.home_dir = home_dir
 
+    def __read__(self, sink, data):
+        """Read helper
+
+        Helper function to retrieve the results of an operation, or
+        None if SINK is given.
+        """
+        if sink or data == None:
+            return None
+        data.seek(0, os.SEEK_SET)
+        return data.read()
+
     def __repr__(self):
         return (
             "Context(armor={0.armor}, "
@@ -270,15 +281,25 @@ class Context(GpgmeWrapper):
             else:
                 self.op_encrypt(recipients, flags, plaintext, ciphertext)
         except errors.GPGMEError as e:
+            result = self.op_encrypt_result()
+            sig_result = self.op_sign_result() if sign else None
+            results = (self.__read__(sink, ciphertext),
+                       result, sig_result)
             if e.getcode() == errors.UNUSABLE_PUBKEY:
-                result = self.op_encrypt_result()
                 if result.invalid_recipients:
-                    raise errors.InvalidRecipients(result.invalid_recipients)
+                    raise errors.InvalidRecipients(result.invalid_recipients,
+                                                   error=e.error,
+                                                   results=results)
             if e.getcode() == errors.UNUSABLE_SECKEY:
                 sig_result = self.op_sign_result()
                 if sig_result.invalid_signers:
-                    raise errors.InvalidSigners(sig_result.invalid_signers)
-            raise
+                    raise errors.InvalidSigners(sig_result.invalid_signers,
+                                                error=e.error,
+                                                results=results)
+            # Otherwise, just raise the error, but attach the results
+            # first.
+            e.results = results
+            raise e
         finally:
             if passphrase != None:
                 self.pinentry_mode = old_pinentry_mode
@@ -290,11 +311,7 @@ class Context(GpgmeWrapper):
         sig_result = self.op_sign_result() if sign else None
         assert not sig_result or not sig_result.invalid_signers
 
-        cipherbytes = None
-        if not sink:
-            ciphertext.seek(0, os.SEEK_SET)
-            cipherbytes = ciphertext.read()
-        return cipherbytes, result, sig_result
+        return self.__read__(sink, ciphertext), result, sig_result
 
     def decrypt(self, ciphertext, sink=None, passphrase=None, verify=True):
         """Decrypt data
@@ -340,6 +357,13 @@ class Context(GpgmeWrapper):
                 self.op_decrypt_verify(ciphertext, plaintext)
             else:
                 self.op_decrypt(ciphertext, plaintext)
+        except errors.GPGMEError as e:
+            result = self.op_decrypt_result()
+            verify_result = self.op_verify_result() if verify else None
+            # Just raise the error, but attach the results first.
+            e.results = (self.__read__(sink, plaintext),
+                         result, verify_result)
+            raise e
         finally:
             if passphrase != None:
                 self.pinentry_mode = old_pinentry_mode
@@ -348,13 +372,15 @@ class Context(GpgmeWrapper):
 
         result = self.op_decrypt_result()
         verify_result = self.op_verify_result() if verify else None
+        results = (self.__read__(sink, plaintext), result, verify_result)
         if result.unsupported_algorithm:
-            raise errors.UnsupportedAlgorithm(result.unsupported_algorithm)
+            raise errors.UnsupportedAlgorithm(result.unsupported_algorithm,
+                                              results=results)
 
         if verify:
             if any(s.status != errors.NO_ERROR
                    for s in verify_result.signatures):
-                raise errors.BadSignatures(verify_result)
+                raise errors.BadSignatures(verify_result, results=results)
 
         if verify and verify != True:
             missing = list()
@@ -372,13 +398,10 @@ class Context(GpgmeWrapper):
                 if not ok:
                     missing.append(key)
             if missing:
-                raise errors.MissingSignatures(verify_result, missing)
+                raise errors.MissingSignatures(verify_result, missing,
+                                               results=results)
 
-        plainbytes = None
-        if not sink:
-            plaintext.seek(0, os.SEEK_SET)
-            plainbytes = plaintext.read()
-        return plainbytes, result, verify_result
+        return results
 
     def sign(self, data, sink=None, mode=constants.SIG_MODE_NORMAL):
         """Sign data
@@ -408,20 +431,20 @@ class Context(GpgmeWrapper):
         try:
             self.op_sign(data, signeddata, mode)
         except errors.GPGMEError as e:
+            results = (self.__read__(sink, signeddata),
+                       self.op_sign_result())
             if e.getcode() == errors.UNUSABLE_SECKEY:
-                result = self.op_sign_result()
-                if result.invalid_signers:
-                    raise errors.InvalidSigners(result.invalid_signers)
-            raise
+                if results[1].invalid_signers:
+                    raise errors.InvalidSigners(results[1].invalid_signers,
+                                                error=e.error,
+                                                results=results)
+            e.results = results
+            raise e
 
         result = self.op_sign_result()
         assert not result.invalid_signers
 
-        signedbytes = None
-        if not sink:
-            signeddata.seek(0, os.SEEK_SET)
-            signedbytes = signeddata.read()
-        return signedbytes, result
+        return self.__read__(sink, signeddata), result
 
     def verify(self, signed_data, signature=None, sink=None, verify=[]):
         """Verify signatures
@@ -451,20 +474,26 @@ class Context(GpgmeWrapper):
         else:
             data = sink if sink else Data()
 
-        if signature:
-            self.op_verify(signature, signed_data, None)
-        else:
-            self.op_verify(signed_data, None, data)
+        try:
+            if signature:
+                self.op_verify(signature, signed_data, None)
+            else:
+                self.op_verify(signed_data, None, data)
+        except errors.GPGMEError as e:
+            # Just raise the error, but attach the results first.
+            e.results = (self.__read__(sink, data),
+                         self.op_verify_result())
+            raise e
 
-        result = self.op_verify_result()
-        if any(s.status != errors.NO_ERROR for s in result.signatures):
-            raise errors.BadSignatures(result)
+        results = (self.__read__(sink, data), self.op_verify_result())
+        if any(s.status != errors.NO_ERROR for s in results[1].signatures):
+            raise errors.BadSignatures(results[1], results=results)
 
         missing = list()
         for key in verify:
             ok = False
             for subkey in key.subkeys:
-                for sig in result.signatures:
+                for sig in results[1].signatures:
                     if sig.summary & constants.SIGSUM_VALID == 0:
                         continue
                     if subkey.can_sign and subkey.fpr == sig.fpr:
@@ -475,13 +504,10 @@ class Context(GpgmeWrapper):
             if not ok:
                 missing.append(key)
         if missing:
-            raise errors.MissingSignatures(result, missing)
+            raise errors.MissingSignatures(results[1], missing,
+                                           results=results)
 
-        plainbytes = None
-        if data and not sink:
-            data.seek(0, os.SEEK_SET)
-            plainbytes = data.read()
-        return plainbytes, result
+        return results
 
     def keylist(self, pattern=None, secret=False,
                 mode=constants.keylist.mode.LOCAL,
diff --git a/lang/python/src/errors.py b/lang/python/src/errors.py
index 1ce139e..c41ac69 100644
--- a/lang/python/src/errors.py
+++ b/lang/python/src/errors.py
@@ -1,3 +1,4 @@
+# Copyright (C) 2016-2017 g10 Code GmbH
 # Copyright (C) 2004 Igor Belyi <belyi at users.sourceforge.net>
 # Copyright (C) 2002 John Goerzen <jgoerzen at complete.org>
 #
@@ -30,32 +31,89 @@ util.process_constants('GPG_ERR_', globals())
 del util
 
 class GpgError(Exception):
-    pass
+    """A GPG Error
 
-class GPGMEError(GpgError):
-    def __init__(self, error = None, message = None):
+    This is the base of all errors thrown by this library.
+
+    If the error originated from GPGME, then additional information
+    can be found by looking at 'code' for the error code, and 'source'
+    for the errors origin.  Suitable constants for comparison are
+    defined in this module.  'code_str' and 'source_str' are
+    human-readable versions of the former two properties.
+
+    If 'context' is not None, then it contains a human-readable hint
+    as to where the error originated from.
+
+    If 'results' is not None, it is a tuple containing results of the
+    operation that failed.  The tuples elements are the results of the
+    function that raised the error.  Some operations return results
+    even though they signal an error.  Of course this information must
+    be taken with a grain of salt.  But often, this information is
+    useful for diagnostic uses or to give the user feedback.  Since
+    the normal control flow is disrupted by the exception, the callee
+    can no longer return results, hence we attach them to the
+    exception objects.
+
+    """
+    def __init__(self, error=None, context=None, results=None):
         self.error = error
-        self.message = message
+        self.context = context
+        self.results = results
+
+    @property
+    def code(self):
+        if self.error == None:
+            return None
+        return gpgme.gpgme_err_code(self.error)
+
+    @property
+    def code_str(self):
+        if self.error == None:
+            return None
+        return gpgme.gpgme_strerror(self.error)
+
+    @property
+    def source(self):
+        if self.error == None:
+            return None
+        return gpgme.gpgme_err_source(self.error)
+
+    @property
+    def source_str(self):
+        if self.error == None:
+            return None
+        return gpgme.gpgme_strsource(self.error)
+
+    def __str__(self):
+        msgs = []
+        if self.context != None:
+            msgs.append(self.context)
+        if self.error != None:
+            msgs.append(self.source_str)
+            msgs.append(self.code_str)
+        return ': '.join(msgs)
+
+class GPGMEError(GpgError):
+    '''Generic error
+
+    This is a generic error that wraps the underlying libraries native
+    error type.  It is thrown when the low-level API is invoked and
+    returns an error.  This is the error that was used in PyME.
 
+    '''
     @classmethod
     def fromSyserror(cls):
         return cls(gpgme.gpgme_err_code_from_syserror())
-
+    @property
+    def message(self):
+        return self.context
     def getstring(self):
-        message = "%s: %s" % (gpgme.gpgme_strsource(self.error),
-                              gpgme.gpgme_strerror(self.error))
-        if self.message != None:
-            message = "%s: %s" % (self.message, message)
-        return message
-
+        return str(self)
     def getcode(self):
-        return gpgme.gpgme_err_code(self.error)
-
+        return self.code
     def getsource(self):
-        return gpgme.gpgme_err_source(self.error)
+        return self.source
 
-    def __str__(self):
-        return self.getstring()
 
 def errorcheck(retval, extradata = None):
     if retval:
@@ -81,7 +139,8 @@ class EncryptionError(GpgError):
     pass
 
 class InvalidRecipients(EncryptionError):
-    def __init__(self, recipients):
+    def __init__(self, recipients, **kwargs):
+        EncryptionError.__init__(self, **kwargs)
         self.recipients = recipients
     def __str__(self):
         return ", ".join("{}: {}".format(r.fpr,
@@ -92,7 +151,8 @@ class DeryptionError(GpgError):
     pass
 
 class UnsupportedAlgorithm(DeryptionError):
-    def __init__(self, algorithm):
+    def __init__(self, algorithm, **kwargs):
+        DeryptionError.__init__(self, **kwargs)
         self.algorithm = algorithm
     def __str__(self):
         return self.algorithm
@@ -101,7 +161,8 @@ class SigningError(GpgError):
     pass
 
 class InvalidSigners(SigningError):
-    def __init__(self, signers):
+    def __init__(self, signers, **kwargs):
+        SigningError.__init__(self, **kwargs)
         self.signers = signers
     def __str__(self):
         return ", ".join("{}: {}".format(s.fpr,
@@ -109,11 +170,11 @@ class InvalidSigners(SigningError):
                          for s in self.signers)
 
 class VerificationError(GpgError):
-    pass
+    def __init__(self, result, **kwargs):
+        GpgError.__init__(self, **kwargs)
+        self.result = result
 
 class BadSignatures(VerificationError):
-    def __init__(self, result):
-        self.result = result
     def __str__(self):
         return ", ".join("{}: {}".format(s.fpr,
                                          gpgme.gpgme_strerror(s.status))
@@ -121,8 +182,8 @@ class BadSignatures(VerificationError):
                          if s.status != NO_ERROR)
 
 class MissingSignatures(VerificationError):
-    def __init__(self, result, missing):
-        self.result = result
+    def __init__(self, result, missing, **kwargs):
+        VerificationError.__init__(self, result, **kwargs)
         self.missing = missing
     def __str__(self):
         return ", ".join(k.subkeys[0].fpr for k in self.missing)

-----------------------------------------------------------------------

Summary of changes:
 NEWS                      |   1 +
 lang/python/src/core.py   | 108 ++++++++++++++++++++++++++++-----------------
 lang/python/src/errors.py | 109 ++++++++++++++++++++++++++++++++++++----------
 3 files changed, 153 insertions(+), 65 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 11 19:28:00 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Tue, 11 Jul 2017 19:28:00 +0200
Subject: [git] Pinentry - branch, master, updated. pinentry-1.0.0-23-g1dba96f
Message-ID: <E1dUyx7-0002oc-1S@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The standard pinentry collection".

The branch, master has been updated
       via  1dba96fafa123f3631c0a50bb01835306c23b903 (commit)
      from  f69dadc6ccea7672869436291ab5c1f58d545466 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1dba96fafa123f3631c0a50bb01835306c23b903
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Tue Jul 11 19:06:22 2017 +0200

    curses: Add option to beep or flash terminal on dialog.
    
    * pinentry/pinentry-curses.c (dialog_run): Beep or flash terminal.
    * pinentry/pinentry.c (pinentry_reset): Reset ttyalert option.
    (pinentry_parse_opts): Parse option ttyalert.
    (option_handler): Handle option ttyalert.
    * pinentry/pinentry.h (struct pinentry): New option ttyalert.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2013

diff --git a/pinentry/pinentry-curses.c b/pinentry/pinentry-curses.c
index 6fa4c72..7c82e0f 100644
--- a/pinentry/pinentry-curses.c
+++ b/pinentry/pinentry-curses.c
@@ -889,6 +889,14 @@ dialog_run (pinentry_t pinentry, const char *tty_name, const char *tty_type)
   cbreak ();		/* Take input chars one at a time, no wait for \n.  */
   noecho ();		/* Don't echo input - in color.  */
 
+  if (pinentry->ttyalert)
+    {
+      if (! strcmp(pinentry->ttyalert, "beep"))
+	beep ();
+      else if (! strcmp(pinentry->ttyalert, "flash"))
+	flash ();
+    }
+
   if (has_colors ())
     {
       start_color ();
diff --git a/pinentry/pinentry.c b/pinentry/pinentry.c
index 0d889a6..ed8fa6d 100644
--- a/pinentry/pinentry.c
+++ b/pinentry/pinentry.c
@@ -87,6 +87,7 @@ pinentry_reset (int use_defaults)
   int grab = pinentry.grab;
   char *ttyname = pinentry.ttyname;
   char *ttytype = pinentry.ttytype;
+  char *ttyalert = pinentry.ttyalert;
   char *lc_ctype = pinentry.lc_ctype;
   char *lc_messages = pinentry.lc_messages;
   int allow_external_password_cache = pinentry.allow_external_password_cache;
@@ -123,6 +124,7 @@ pinentry_reset (int use_defaults)
     {
       free (pinentry.ttyname);
       free (pinentry.ttytype);
+      free (pinentry.ttyalert);
       free (pinentry.lc_ctype);
       free (pinentry.lc_messages);
       free (pinentry.default_ok);
@@ -179,6 +181,7 @@ pinentry_reset (int use_defaults)
       pinentry.grab = grab;
       pinentry.ttyname = ttyname;
       pinentry.ttytype = ttytype;
+      pinentry.ttyalert = ttyalert;
       pinentry.lc_ctype = lc_ctype;
       pinentry.lc_messages = lc_messages;
       pinentry.allow_external_password_cache = allow_external_password_cache;
@@ -818,6 +821,7 @@ pinentry_parse_opts (int argc, char *argv[])
                  "Grab keyboard only while window is focused"),
     ARGPARSE_s_u('W', "parent-wid", "Parent window ID (for positioning)"),
     ARGPARSE_s_s('c', "colors", "|STRING|Set custom colors for ncurses"),
+    ARGPARSE_s_s('a', "ttyalert", "|STRING|Set the alert mode (none, beep or flash)"),
     ARGPARSE_end()
   };
   ARGPARSE_ARGS pargs = { &argc, &argv, 0 };
@@ -909,6 +913,17 @@ pinentry_parse_opts (int argc, char *argv[])
 	  pinentry.timeout = pargs.r.ret_int;
 	  break;
 
+	case 'a':
+	  pinentry.ttyalert = strdup (pargs.r.ret_str);
+	  if (!pinentry.ttyalert)
+	    {
+#ifndef HAVE_W32CE_SYSTEM
+	      fprintf (stderr, "%s: %s\n", this_pgmname, strerror (errno));
+#endif
+	      exit (EXIT_FAILURE);
+	    }
+	  break;
+
         default:
           pargs.err = ARGPARSE_PRINT_WARNING;
 	  break;
@@ -975,6 +990,14 @@ option_handler (assuan_context_t ctx, const char *key, const char *value)
       if (!pinentry.ttytype)
 	return gpg_error_from_syserror ();
     }
+  else if (!strcmp (key, "ttyalert"))
+    {
+      if (pinentry.ttyalert)
+	free (pinentry.ttyalert);
+      pinentry.ttyalert = strdup (value);
+      if (!pinentry.ttyalert)
+	return gpg_error_from_syserror ();
+    }
   else if (!strcmp (key, "lc-ctype"))
     {
       if (pinentry.lc_ctype)
diff --git a/pinentry/pinentry.h b/pinentry/pinentry.h
index 868b4d8..a4447a8 100644
--- a/pinentry/pinentry.h
+++ b/pinentry/pinentry.h
@@ -75,6 +75,8 @@ struct pinentry
   char *ttyname;
   /* The type of the terminal.  (Assuan: "OPTION ttytype TTYTYPE".)  */
   char *ttytype;
+  /* Set the alert mode (none, beep or flash).  */
+  char *ttyalert;
   /* The LC_CTYPE value for the terminal.  (Assuan: "OPTION lc-ctype
      LC_CTYPE".)  */
   char *lc_ctype;

-----------------------------------------------------------------------

Summary of changes:
 pinentry/pinentry-curses.c |  8 ++++++++
 pinentry/pinentry.c        | 23 +++++++++++++++++++++++
 pinentry/pinentry.h        |  2 ++
 3 files changed, 33 insertions(+)


hooks/post-receive
-- 
The standard pinentry collection
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 11 21:03:22 2017
From: cvs at cvs.gnupg.org (by Alon Bar-Lev)
Date: Tue, 11 Jul 2017 21:03:22 +0200
Subject: [git] Pinentry - branch, master, updated. pinentry-1.0.0-24-g6053cb4
Message-ID: <E1dV0RO-0001M0-Kw@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The standard pinentry collection".

The branch, master has been updated
       via  6053cb4f3873897acf5d899bc6f02046d0748a0f (commit)
      from  1dba96fafa123f3631c0a50bb01835306c23b903 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6053cb4f3873897acf5d899bc6f02046d0748a0f
Author: Alon Bar-Lev <alon.barlev at gmail.com>
Date:   Tue Jul 11 20:54:42 2017 +0200

    Use pkg-config consistently.
    
    * configure.ac: Invoke PKG_PROG_PKG_CONFIG. Consistently use
    PKG_CHECK_MODULES for GTK+2.0, Gnome 3 and libsecret.
    * gnome3/Makefile.am (AM_CPPFLAGS, LDADD): Adjust Gnome 3 flags.
    * gtk+-2/Makefile.am (AM_CPPFLAGS, LDADD): Adjust Gtk+2.0 flags.
    
    Proofread-by: Marcus Brinkmann <mb at g10code.com>
    Signed-off-by: Alon Bar-Lev <alon.barlev at gmail.com>
    GnuPG-bug-id: 2049

diff --git a/configure.ac b/configure.ac
index 8b38149..ea12d56 100644
--- a/configure.ac
+++ b/configure.ac
@@ -85,6 +85,7 @@ AC_PROG_RANLIB
 # for Qt and autoconf does does not allow that.
 AC_PROG_CXX
 AC_PROG_LN_S
+PKG_PROG_PKG_CONFIG
 AC_CHECK_TOOL(WINDRES, windres, :)
 AC_CHECK_PROGS(GITLOG_TO_CHANGELOG, gitlog-to-changelog,
                [build-aux/gitlog-to-changelog])
@@ -428,62 +429,36 @@ AC_ARG_ENABLE(pinentry-gnome3,
             AC_HELP_STRING([--enable-pinentry-gnome3], [build GNOME 3 pinentry]),
             pinentry_gnome_3=$enableval, pinentry_gnome_3=maybe)
 
-dnl check for pkg-config
-if test "$pinentry_gtk_2" != "no" -o "$pinentry_gnome_3" != "no"; then
-        AC_PATH_PROG(PKG_CONFIG, pkg-config, no)
-	if test x"${PKG_CONFIG}" = xno ; then
-		pinentry_gtk_2=no
-		pinentry_gnome_3=no
-	fi
-fi
-
 dnl check if the module gtk+-2.0 exists
 if test "$pinentry_gtk_2" != "no"; then
-	AC_MSG_CHECKING([for gtk+-2])
-	"${PKG_CONFIG}" --exists gtk+-2.0
-	if test $? -ne 0 ; then
-		AC_MSG_RESULT([no])
-		AC_MSG_WARN([pkg-config could not find the module gtk+-2.0])
-		pinentry_gtk_2=no
-	else
-		AC_MSG_RESULT([yes])
-		AC_MSG_CHECKING([gtk+-2 version >= 2.4.0])
-		modvers=`"${PKG_CONFIG}" --modversion gtk+-2.0`
-		AC_MSG_RESULT([$modvers])
-		"${PKG_CONFIG}" --atleast-version=2.4.0 gtk+-2.0
-		if test $? -ne 0 ; then
-			AC_MSG_WARN([building GTK+-2 pinentry disabled])
+	PKG_CHECK_MODULES(
+		GTK2,
+		[gtk+-2.0 >= 2.4.0],
+		[
+			test "$pinentry_gtk_2" != "no" && pinentry_gtk_2=yes
+			test "$pinentry_gnome_3" != "no" && pinentry_gnome_3=yes
+		],
+		[
+			AC_MSG_WARN([pkg-config could not find the module gtk+-2.0])
 			pinentry_gtk_2=no
-		else
-			GTK2CFLAGS=`"${PKG_CONFIG}" --cflags gtk+-2.0`
-			GTK2LIBS=`"${PKG_CONFIG}" --libs gtk+-2.0`
-			AC_SUBST(GTK2CFLAGS)
-			AC_SUBST(GTK2LIBS)
-			if test "$pinentry_gtk_2" != "no"
-			then
-			  pinentry_gtk_2=yes
-			fi
-		fi
-	fi
+		]
+	)
 fi
 AM_CONDITIONAL(BUILD_PINENTRY_GTK_2, test "$pinentry_gtk_2" = "yes")
 
 if test "$pinentry_gnome_3" != "no"; then
-	AC_MSG_CHECKING([for gcr])
-	"${PKG_CONFIG}" --exists gcr-base-3
-	if test $? -ne 0 ; then
-		AC_MSG_RESULT([no])
-		AC_MSG_WARN([pkg-config could not find the module gcr-base-3])
-		pinentry_gnome_3=no
-	else
-		AC_MSG_RESULT([yes])
-		GNOME3CFLAGS=`"${PKG_CONFIG}" --cflags gcr-base-3`
-		GNOME3LIBS=`"${PKG_CONFIG}" --libs gcr-base-3`
-		AC_SUBST(GNOME3CFLAGS)
-		AC_SUBST(GNOME3LIBS)
-		AC_DEFINE(GCR_API_SUBJECT_TO_CHANGE, 1, [Nod nod])
-		pinentry_gnome_3=yes
-	fi
+	PKG_CHECK_MODULES(
+		GNOME3,
+		[gcr-3,gcr-base-3],
+		[
+			pinentry_gnome_3=yes
+			AC_DEFINE(GCR_API_SUBJECT_TO_CHANGE, 1, [Nod nod])
+		],
+		[
+			AC_MSG_WARN([pkg-config could not find the module gcr-3,gcr-base-3])
+			pinentry_gnome_3=no
+		]
+	)
 fi
 
 AM_CONDITIONAL(BUILD_PINENTRY_GNOME_3, test "$pinentry_gnome_3" = "yes")
@@ -496,36 +471,17 @@ AC_ARG_ENABLE(libsecret,
 	    [optionally cache passphrases using libsecret]),
             libsecret=$enableval, libsecret=maybe)
 
-dnl check for pkg-config
-if test "$libsecret" != "no" -o "$pinentry-qt" != "no"; then
-        AC_PATH_PROG(PKG_CONFIG, pkg-config, no)
-  if test x"${PKG_CONFIG}" = xno ; then
-    if test "$pinentry_qt" = "yes"; then
-      AC_MSG_ERROR([[
-                    ***
-                    *** pkg-config is required to find the Qt libraries for pinentry-qt
-                    ***]])
-    else
-      pinentry_qt=no
-    fi
-    libsecret=no
-  fi
-fi
-
 dnl check if the module libsecret exists
 if test "$libsecret" != "no"; then
-	AC_MSG_CHECKING([for libsecret])
-	"${PKG_CONFIG}" --exists 'libsecret-1'
-	if test $? -ne 0 ; then
-		AC_MSG_RESULT([no])
-		AC_MSG_WARN([pkg-config could not find the modules libsecret-1])
-		libsecret=no
-	else
-		AC_MSG_RESULT([yes])
-		LIBSECRET_CFLAGS=`"${PKG_CONFIG}" --cflags 'libsecret-1'`
-		LIBSECRET_LIBS=`"${PKG_CONFIG}" --libs 'libsecret-1'`
-		libsecret=yes
-	fi
+	PKG_CHECK_MODULES(
+		LIBSECRET,
+		[libsecret-1],
+		[libsecret=yes],
+		[
+			AC_MSG_WARN([pkg-config could not find the module libsecret-1])
+			libsecret=no
+		]
+	)
 fi
 AM_CONDITIONAL(BUILD_WITH_LIBSECRET, test "$libsecret" = "yes")
 if test "$libsecret" = "yes"; then
diff --git a/gnome3/Makefile.am b/gnome3/Makefile.am
index 71c0732..9dc487a 100644
--- a/gnome3/Makefile.am
+++ b/gnome3/Makefile.am
@@ -29,9 +29,9 @@ ncurses_include =
 libcurses =
 endif
 
-AM_CPPFLAGS = $(COMMON_CFLAGS) $(GNOME3CFLAGS) \
+AM_CPPFLAGS = $(COMMON_CFLAGS) $(GNOME3_CFLAGS) \
 	$(ncurses_include) -I$(top_srcdir)/secmem -I$(top_srcdir)/pinentry
 LDADD = ../pinentry/libpinentry.a ../secmem/libsecmem.a \
-	$(COMMON_LIBS) $(LIBCAP) $(GNOME3LIBS) $(libcurses)
+	$(COMMON_LIBS) $(LIBCAP) $(GNOME3_LIBS) $(libcurses)
 
 pinentry_gnome3_SOURCES = pinentry-gnome3.c
diff --git a/gtk+-2/Makefile.am b/gtk+-2/Makefile.am
index 2037004..e9bff80 100644
--- a/gtk+-2/Makefile.am
+++ b/gtk+-2/Makefile.am
@@ -29,9 +29,9 @@ ncurses_include =
 libcurses =
 endif
 
-AM_CPPFLAGS = $(COMMON_CFLAGS) $(GTK2CFLAGS) $(ncurses_include) \
+AM_CPPFLAGS = $(COMMON_CFLAGS) $(GTK2_CFLAGS) $(ncurses_include) \
 	-I$(top_srcdir)/secmem -I$(top_srcdir)/pinentry
 LDADD = ../pinentry/libpinentry.a ../secmem/libsecmem.a \
-	$(COMMON_LIBS) $(LIBCAP) $(GTK2LIBS) $(libcurses)
+	$(COMMON_LIBS) $(LIBCAP) $(GTK2_LIBS) $(libcurses)
 
 pinentry_gtk_2_SOURCES = pinentry-gtk-2.c

-----------------------------------------------------------------------

Summary of changes:
 configure.ac       | 110 ++++++++++++++++-------------------------------------
 gnome3/Makefile.am |   4 +-
 gtk+-2/Makefile.am |   4 +-
 3 files changed, 37 insertions(+), 81 deletions(-)


hooks/post-receive
-- 
The standard pinentry collection
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 12 10:24:16 2017
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Wed, 12 Jul 2017 10:24:16 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. afb1a5011059410c937feb40ffae6c7292de22ab
Message-ID: <E1dVCwT-0000Lc-6D@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  afb1a5011059410c937feb40ffae6c7292de22ab (commit)
      from  eb1300cb8d13bee8df32e3856f37056cb50107e2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit afb1a5011059410c937feb40ffae6c7292de22ab
Author: Neal H. Walfield <neal at gnu.org>
Date:   Wed Jul 12 10:24:00 2017 +0200

    campaign: Change video of the day to Arthur Jordan (2U).

diff --git a/web/donate/index.de.org b/web/donate/index.de.org
index fea3335..ac02314 100644
--- a/web/donate/index.de.org
+++ b/web/donate/index.de.org
@@ -222,9 +222,8 @@ href="/cgi-bin/procdonate.cgi?mode=preset&lang=de"
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Video des Tages: Daniel Kahn Gillmor
-            <small><a href="https://debian.org/">Debian</a> and the
-            <a href="https://www.aclu.org/">American Civil Liberties Union</a></small>
+	  <h2>Video des Tages: Arthur Jordan
+            <small><a href="https://2u.com/">2U</a></small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.fr.org b/web/donate/index.fr.org
index 4289738..91db737 100644
--- a/web/donate/index.fr.org
+++ b/web/donate/index.fr.org
@@ -215,9 +215,8 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Clip du jour?: Daniel Kahn Gillmor
-            <small><a href="https://debian.org/">Debian</a> and the
-            <a href="https://www.aclu.org/">American Civil Liberties Union</a></small>
+	  <h2>Clip du jour?: Arthur Jordan
+            <small><a href="https://2u.com/">2U</a></small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.ja.org b/web/donate/index.ja.org
index 45661a0..b3323a6 100644
--- a/web/donate/index.ja.org
+++ b/web/donate/index.ja.org
@@ -202,9 +202,8 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>?????: Daniel Kahn Gillmor
-            <small><a href="https://debian.org/">Debian</a> and the
-            <a href="https://www.aclu.org/">American Civil Liberties Union</a></small>
+	  <h2>?????: Arthur Jordan
+            <small><a href="https://2u.com/">2U</a></small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/donate/index.org b/web/donate/index.org
index 192052d..777810c 100644
--- a/web/donate/index.org
+++ b/web/donate/index.org
@@ -217,9 +217,8 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Video of the Day: Daniel Kahn Gillmor
-            <small><a href="https://debian.org/">Debian</a> and the
-            <a href="https://www.aclu.org/">American Civil Liberties Union</a></small>
+	  <h2>Video of the Day: Arthur Jordan
+            <small><a href="https://2u.com/">2U</a></small>
           </h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
diff --git a/web/share/campaign/campaign.js b/web/share/campaign/campaign.js
index ecde921..653f80d 100644
--- a/web/share/campaign/campaign.js
+++ b/web/share/campaign/campaign.js
@@ -89,7 +89,7 @@ function get_param_from_url(name) {
 $(document).ready(function() {
 
     // VOTD: Update VOTD here.
-    let VIDLIST = "daniel,cedric,michael,sheera,meik,seamus,andrew,geoffrey,hernani,leez,noah,c5,jochim,john,jason,sze,rysiek,ksenia,cindy,matt,thenmozhi,alex,andre,benjamin";
+    let VIDLIST = "arthur,daniel,cedric,michael,sheera,meik,seamus,andrew,geoffrey,hernani,leez,noah,c5,jochim,john,jason,sze,rysiek,ksenia,cindy,matt,thenmozhi,alex,andre,benjamin";
 
     let YTID = { "main": "wNHhkntqklg",
 		 "thenmozhi": "sQMj332dgIE",
@@ -100,7 +100,6 @@ $(document).ready(function() {
 		 "jason": "oQvP9SXm-ek",
 		 "cindy": "IdCiJMc3q80",
 		 "benjamin": "atFz16nInIs",
-		 "arthur": "Js_OqRLm9F4",
 		 "andre": "bcNLlWqZ9d0",
 		 "alex": "1OMJWpdl0DA",
                  "ksenia": "Qqg3_a72aEw",
@@ -116,7 +115,8 @@ $(document).ready(function() {
 		 "sheera": "mak22hXcslg",
                  "michael": "MSu_FF49MtU",
                  "cedric": "-Rkrf9GIw8M",
-		 "daniel": "SdlnauJ5XWM"
+		 "daniel": "SdlnauJ5XWM",
+		 "arthur": "g9a_snLWRxE"
 	       };
 
     /* For the video preview, we use this for devices without hover events.  */

-----------------------------------------------------------------------

Summary of changes:
 web/donate/index.de.org        | 5 ++---
 web/donate/index.fr.org        | 5 ++---
 web/donate/index.ja.org        | 5 ++---
 web/donate/index.org           | 5 ++---
 web/share/campaign/campaign.js | 6 +++---
 5 files changed, 11 insertions(+), 15 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 12 10:24:33 2017
From: cvs at cvs.gnupg.org (by Damien Goutte-Gattat)
Date: Wed, 12 Jul 2017 10:24:33 +0200
Subject: [git] Scute - branch, master, updated. scute-1.3.0-76-ge6ca8e2
Message-ID: <E1dVCwk-0000MQ-0P@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PKCS#11 token on top of gpg-agent".

The branch, master has been updated
       via  e6ca8e2e6ae842e9e72c9287624a77e51fe2962f (commit)
       via  6a3b58fcaa00dc5f91d361e842e61e4dec0ae7f6 (commit)
       via  82ff06a600a22b5ab71be0ec451b24fcd8a55eae (commit)
      from  21baad873862352833fc54eb85fb490522955e6f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e6ca8e2e6ae842e9e72c9287624a77e51fe2962f
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Wed Jul 12 09:48:43 2017 +0200

    Search gpg-connect-agent in PATH at runtime.
    
    * configure.ac: Do not hard-code full path to gpg-connect-agent.
    --
    
    By default, Scute should use the gpg-connect-agent program
    present in PATH at runtime, unless the user chooses otherwise
    at configure-time.
    
    GnuPG-bug-id: 3274
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/configure.ac b/configure.ac
index d05785e..99003fd 100644
--- a/configure.ac
+++ b/configure.ac
@@ -296,7 +296,7 @@ fi
 if test "$GPGSM" = no; then
   if test "$NO_OVERRIDE" = "yes"; then
     if test "$cross_compiling" != "yes"; then
-      AC_MSG_WARN([
+      AC_MSG_ERROR([
 ***
 *** Could not find GpgSM, install GpgSM or use --with-gpgsm=PATH to enable it
 ***])
@@ -381,7 +381,7 @@ if test "$NO_OVERRIDE" = "yes" || test "$GPG_CONNECT_AGENT" = "yes"; then
   GPG_CONNECT_AGENT=
   NO_OVERRIDE=yes
   if test "$cross_compiling" != "yes"; then
-    AC_PATH_PROG(GPG_CONNECT_AGENT, gpg-connect-agent)
+    AC_CHECK_PROG(GPG_CONNECT_AGENT, gpg-connect-agent, gpg-connect-agent)
   fi
   if test -z "$GPG_CONNECT_AGENT"; then
     GPG_CONNECT_AGENT="$GPG_CONNECT_AGENT_DEFAULT"
@@ -390,12 +390,12 @@ fi
 if test "$GPG_CONNECT_AGENT" = no; then
   if test "$NO_OVERRIDE" = "yes"; then
     if test "$cross_compiling" != "yes"; then
-      AC_MSG_WARN([
+      AC_MSG_ERROR([
 ***
 *** Could not find gpg-connect-agent, use --with-gpg-connect-agent=PATH to enable it
 ***])
     else
-      AC_MSG_WARN([
+      AC_MSG_ERROR([
 ***
 *** Can not determine path to gpg-connect-agent when cross-compiling, use --with-gpg-connect-agent=PATH
 ***])
@@ -479,4 +479,8 @@ echo "
 
         Revision: mym4_revision  (mym4_revision_dec)
         Platform: $host
+
+        GpgSM:             ${GPGSM}
+        Gpg-connect-agent: ${GPG_CONNECT_AGENT}
+
 "

commit 6a3b58fcaa00dc5f91d361e842e61e4dec0ae7f6
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Wed Jul 12 09:48:19 2017 +0200

    Sanitize tests environment.
    
    * tests/Makefile.am (clean-local): New target.
    (TESTS_ENVIRONMENT): New variable.
    (EXTRA_DIST): New variable.
    * tests/clean-socketdir: New file.
    --
    
    We should avoid using the current user's GNUPGHOME directory
    (and any pre-existing agent) when running the tests.
    
    Then, since running the tests imply spawning an agent, we should
    wipe out the corresponding socket directory upon 'make clean'.
    This will also terminate the agent.
    
    GnuPG-bug-id: 3274
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/tests/Makefile.am b/tests/Makefile.am
index 6c19071..311303d 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -37,5 +37,12 @@ TESTS = t-link t-getfunctionlist t-initialize t-getinfo t-getslotlist \
 
 noinst_PROGRAMS = $(TESTS)
 
+EXTRA_DIST = clean-socketdir
+
+TESTS_ENVIRONMENT = GNUPGHOME=`/bin/pwd` GPG_AGENT_INFO= LC_ALL=C
+
 AM_CPPFLAGS = -I$(top_srcdir)/include -I$(top_srcdir)/src
 LDADD = ../src/scute.la
+
+clean-local:
+	$(TESTS_ENVIRONMENT) $(srcdir)/clean-socketdir
diff --git a/tests/clean-socketdir b/tests/clean-socketdir
new file mode 100755
index 0000000..32ffdc6
--- /dev/null
+++ b/tests/clean-socketdir
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+# We do the clean-up only when the tests are run with GNUPGHOME
+# set to the tests directory (which is the default). If the user
+# saw fit to override TESTS_ENVIRONMENT to use another home, we
+# must assume she knows what she is doing.
+if [ "$GNUPGHOME" = "`/bin/pwd`" ]; then
+    socketdir=`gpgconf --list-dirs socketdir`
+    if [ -d "$socketdir" ]; then
+        rm -f $socketdir/S.*
+        rmdir $socketdir || true
+    fi
+
+    if [ -d private-keys-v1.d ]; then
+        rmdir private-keys-v1.d
+    fi
+fi

commit 82ff06a600a22b5ab71be0ec451b24fcd8a55eae
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Mon Jul 10 14:27:36 2017 +0200

    Add a manual section for card-stored certificates.
    
    * doc/manual/scute.texi: Explain how to store the certificate
    directly on the card.
    
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/doc/manual/scute.texi b/doc/manual/scute.texi
index 705935c..70c1f35 100644
--- a/doc/manual/scute.texi
+++ b/doc/manual/scute.texi
@@ -305,9 +305,19 @@ create the certificate and send it back to you.  At last, the
 certificate has to be imported into GPGSM.  This section will explain
 all of these steps in detail.
 
+ at menu
+* Creating a CSR::                How to create a card-based CSR.
+* Signing the CSR::               Obtain a certificate from the CSR.
+* Importing the Certificate::     How to import the certificate into GPGSM.
+* On-card Certificate::           How to store the certificate on the card.
+ at end menu
+
+ at node Creating a CSR
+ at subsection Creating a CSR
+
 Before you start, make sure that the GPG Agent is running, see
- at ref{Prerequisites}.  There is no need to configure GPGSM, so you can
-create a CSR with the command:
+ at ref{Prerequisites} and that your card is in the reader.  There is no
+need to configure GPGSM, so you can create a CSR with the command:
 
 @example
 $ gpgsm --gen-key > floppy-head.csr
@@ -405,6 +415,9 @@ ZBYfQVeXAd7XlxI6d1wXDLwD/26lTU/rH2JU6H1+zSfZxqwVC4Iu+kiN4Y8=
 $
 @end example
 
+ at node Signing the CSR
+ at subsection Signing the CSR
+
 The next step is to submit this certificate request to the CA, which can
 then create a certificate and send it back to you.
 
@@ -422,7 +435,10 @@ snakeoil-ca-rsa.key -out floppy-head.crt}.  Please see the OpenSSL
 documentation for more details on how to set up and administrate a
 certificate authority infrastructure.
 
-In any way you should end up with a certificate file
+ at node Importing the Certificate
+ at subsection Importing the Certificate into GPGSM
+
+Once the CSR has been signed, you should end up with a certificate file
 @file{floppy-head.crt}, which you then have to import into GPGSM.  It is
 also recommended that you import the root certificate of the CA first in
 the same fashion.
@@ -455,6 +471,39 @@ The option ``@code{-K}'' is used above because this will only list
 certificates for which a private key is available.  To see more details,
 you may use ``@code{--dump-secret-keys}'' instead of ``@code{-K}''.
 
+ at node On-card Certificate
+ at subsection Loading the Certificate onto the Card
+
+This step is optional. You may choose to store the certificate directly
+into your OpenPGP card. The benefit of doing so is that Scute will then
+be able to fetch the certificate from the card without having to look
+into the GPGSM store.
+
+You need your certificate in the DER format. Export it from the GPGSM
+store with the following command:
+
+ at example
+$ gpgsm -o floppy-head.crt --export Floppy
+ at end example
+
+Then, fire up the GnuPG card editor to transfer the certificate to the
+card (note that the @code{writecert} command is not listed in the
+editor's online help):
+
+ at example
+$ gpg2 --card-edit
+
+Application ID ...: D27600012301020000005000012340000
+[...]
+
+gpg/card> admin
+Admin commands are allowed
+
+gpg/card> writecert 3 < floppy-head.crt
+
+gpg/card> quit
+ at end example
+
 
 @node Client Authentication
 @chapter Client Authentication

-----------------------------------------------------------------------

Summary of changes:
 configure.ac          | 12 +++++++----
 doc/manual/scute.texi | 55 ++++++++++++++++++++++++++++++++++++++++++++++++---
 tests/Makefile.am     |  7 +++++++
 tests/clean-socketdir | 17 ++++++++++++++++
 4 files changed, 84 insertions(+), 7 deletions(-)
 create mode 100755 tests/clean-socketdir


hooks/post-receive
-- 
PKCS#11 token on top of gpg-agent
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 12 12:41:58 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 12 Jul 2017 12:41:58 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-88-g957f8eb
Message-ID: <E1dVF5i-00064n-T3@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  957f8ebc89caadbf84320b60aeb18a100c314855 (commit)
      from  d24594976686983c7186cbe4e78153888a13b6e4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 957f8ebc89caadbf84320b60aeb18a100c314855
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 12 12:37:16 2017 +0200

    dirmngr: Fix license note in server.c
    
    --
    
    This double license note was accidentally added while only wanting to
    add another copyright line.
    
    Fixes-commit: 3419a339d9c4e800bf30e9021e05982d8c1021c1
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/server.c b/dirmngr/server.c
index 98d7315..788bebd 100644
--- a/dirmngr/server.c
+++ b/dirmngr/server.c
@@ -6,21 +6,6 @@
  *
  * This file is part of GnuPG.
  *
- * This file is free software; you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as
- * published by the Free Software Foundation; either version 2.1 of
- * the License, or (at your option) any later version.
- *
- * This file is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with this program; if not, see <https://www.gnu.org/licenses/>.
- *
- * This file is part of GnuPG.
- *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/server.c | 15 ---------------
 1 file changed, 15 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 12 15:01:04 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 12 Jul 2017 15:01:04 +0200
Subject: [git] GPGME - branch, master, updated. gpgme-1.9.0-47-g111cd56
Message-ID: <E1dVHGK-0002HA-FN@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  111cd562d8eb11546bbd2d3bd11da4e952d4e504 (commit)
      from  1e68f93dc547ae75b921e43db35e3599de92e2cb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 111cd562d8eb11546bbd2d3bd11da4e952d4e504
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 12 14:56:22 2017 +0200

    doc: Add list of copyright olders to AUTHORS.
    
    --

diff --git a/AUTHORS b/AUTHORS
index bbf1576..855284a 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -9,6 +9,29 @@ License (software): LGPLv2.1+
 License (manual+tools): GPLv3+
 
 
+GPGME is free software.  See the files COPYING for copying conditions.
+License copyright years may be listed using range notation, e.g.,
+2000-2013, indicating that every year in the range, inclusive, is a
+copyrightable year that would otherwise be listed individually.
+
+List of Copyright holders
+=========================
+
+  Copyright (C) 1991-2013 Free Software Foundation, Inc.
+  Copyright (C) 2000-2001 Werner Koch
+  Copyright (C) 2001-2017 g10 Code GmbH
+  Copyright (C) 2002 Klar?lvdalens Datakonsult AB
+  Copyright (C) 2004-2008 Igor Belyi
+  Copyright (C) 2002 John Goerzen
+  Copyright (C) 2014, 2015 Martin Albrecht
+  Copyright (C) 2015 Ben McGinnes
+  Copyright (C) 2015-2016 Bundesamt f?r Sicherheit in der Informationstechnik
+  Copyright (C) 2016 Intevation GmbH
+
+
+Authors info
+============
+
 FSF <gnu at gnu.org>
  - Code taken from GnuPG 1.0: src/w32-util.c.
  - Other from FSF projects: src/setenv.c, src/vasprintf.c,

-----------------------------------------------------------------------

Summary of changes:
 AUTHORS | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 12 18:38:26 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 12 Jul 2017 18:38:26 +0200
Subject: [git] GPGME - branch, master, updated. gpgme-1.9.0-51-g46d2e48
Message-ID: <E1dVKeh-0000ni-0M@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  46d2e48105e0929ec38dd4106004dd60d941df9a (commit)
       via  ad0c5ab4cd8d3a1b11b37dc137b75a67aa26da37 (commit)
       via  d37bc7e025cdc6228da45b2b527e9f3bfef71c71 (commit)
       via  87703dbb86ac8fd8abd23170f8038ea6e3dbde28 (commit)
      from  111cd562d8eb11546bbd2d3bd11da4e952d4e504 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 46d2e48105e0929ec38dd4106004dd60d941df9a
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 12 18:32:50 2017 +0200

    tests: Fix printf compiler warning for an error case.
    
    * tests/gpg/t-keylist.c (main): Cast DIM to int.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tests/gpg/t-keylist.c b/tests/gpg/t-keylist.c
index 8a32f9b..0417011 100644
--- a/tests/gpg/t-keylist.c
+++ b/tests/gpg/t-keylist.c
@@ -569,7 +569,7 @@ main (int argc, char **argv)
   if (keys[i].fpr)
     {
       fprintf (stderr, "Less keys (%d) returned than expected (%d)\n",
-	       i, DIM (keys) - 1);
+	       i, (int)(DIM (keys) - 1));
       exit (1);
     }
 

commit ad0c5ab4cd8d3a1b11b37dc137b75a67aa26da37
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 12 18:30:49 2017 +0200

    core: Return NO_SECKEY error code on decryption
    
    * src/decrypt.c (op_data_t): Add flag any_no_seckey.
    (_gpgme_decrypt_status_handler): Consult that flag.
    (_gpgme_decrypt_status_handler): Set that flag.
    --
    
    The NO_SECKEY is emitted instead of an "S ERROR pkdecrypt_failed" if
    gpg knowns that a key has been encrypted to that key (cf. "S ENC_TO").
    it is not fool proffof but in the majority of cases we can provide a
    better error message than just DECRYPTION_FAILED.
    
    GnuPG-bug-id: 3270
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/gpgme.texi b/doc/gpgme.texi
index bc40430..31929d3 100644
--- a/doc/gpgme.texi
+++ b/doc/gpgme.texi
@@ -4893,7 +4893,7 @@ if @var{ctx}, @var{cipher} or @var{plain} is not a valid pointer,
 @code{GPG_ERR_NO_DATA} if @var{cipher} does not contain any data to
 decrypt, @code{GPG_ERR_DECRYPT_FAILED} if @var{cipher} is not a valid
 cipher text, @code{GPG_ERR_BAD_PASSPHRASE} if the passphrase for the
-secret key could not be retrieved, and passes through any errors that
+secret key could not be retrieved, and passes through some errors that
 are reported by the crypto engine support routines.
 @end deftypefun
 
diff --git a/src/decrypt.c b/src/decrypt.c
index 1d8412a..aa17771 100644
--- a/src/decrypt.c
+++ b/src/decrypt.c
@@ -1,6 +1,6 @@
 /* decrypt.c - Decrypt function.
    Copyright (C) 2000 Werner Koch (dd9jn)
-   Copyright (C) 2001, 2002, 2003, 2004 g10 Code GmbH
+   Copyright (C) 2001, 2002, 2003, 2004, 2017 g10 Code GmbH
 
    This file is part of GPGME.
 
@@ -49,6 +49,13 @@ typedef struct
   int failed;
   gpg_error_t pkdecrypt_failed;
 
+  /* At least one secret key is not available.  gpg issues NO_SECKEY
+   * status lines for each key the message has been encrypted to but
+   * that secret key is not available.  This can't be done for hidden
+   * recipients, though.  We track it here to allow for a better error
+   * message that the general DECRYPTION_FAILED. */
+  int any_no_seckey;
+
   /* A pointer to the next pointer of the last recipient in the list.
      This makes appending new invalid signers painless while
      preserving the order.  */
@@ -273,6 +280,8 @@ _gpgme_decrypt_status_handler (void *priv, gpgme_status_code_t code,
 	 the underlying crypto engine (as error source).  */
       if (opd->failed && opd->pkdecrypt_failed)
         return opd->pkdecrypt_failed;
+      else if (opd->failed && opd->any_no_seckey)
+	return gpg_error (GPG_ERR_NO_SECKEY);
       else if (opd->failed)
 	return gpg_error (GPG_ERR_DECRYPT_FAILED);
       else if (!opd->okay)
@@ -319,7 +328,6 @@ _gpgme_decrypt_status_handler (void *priv, gpgme_status_code_t code,
     case GPGME_STATUS_NO_SECKEY:
       {
 	gpgme_recipient_t rec = opd->result.recipients;
-
 	while (rec)
 	  {
 	    if (!strcmp (rec->keyid, args))
@@ -332,6 +340,7 @@ _gpgme_decrypt_status_handler (void *priv, gpgme_status_code_t code,
 	/* FIXME: Is this ok?  */
 	if (!rec)
 	  return trace_gpg_error (GPG_ERR_INV_ENGINE);
+        opd->any_no_seckey = 1;
       }
       break;
 

commit d37bc7e025cdc6228da45b2b527e9f3bfef71c71
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 12 17:55:43 2017 +0200

    core: Return CANCELED and BAD_PASSPHRASE error code on decryption.
    
    * src/decrypt.c (op_data_t): Add field pkdecrypt_failed.
    (_gpgme_decrypt_status_handler): Consult new field.
    (parse_status_error): Handle some error codes.
    --
    
    The idea is to return only a limited set of error codes because a user
    won't be able to understand the more esoteric codes.
    
    GnuPG-bug-id: 3270
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/decrypt.c b/src/decrypt.c
index 91a32ae..1d8412a 100644
--- a/src/decrypt.c
+++ b/src/decrypt.c
@@ -43,7 +43,11 @@ typedef struct
   gpg_error_t failure_code;
 
   int okay;
+
+  /* A flag telling that the a decryption failed and an optional error
+   * code to further specify the failure.  */
   int failed;
+  gpg_error_t pkdecrypt_failed;
 
   /* A pointer to the next pointer of the last recipient in the list.
      This makes appending new invalid signers painless while
@@ -156,6 +160,31 @@ parse_status_error (char *args, op_data_t opd)
       if (gpg_err_code (err) == GPG_ERR_WRONG_KEY_USAGE)
         opd->result.wrong_key_usage = 1;
     }
+  else if (!strcmp (field[0], "pkdecrypt_failed"))
+    {
+      switch (gpg_err_code (err))
+        {
+        case GPG_ERR_CANCELED:
+        case GPG_ERR_FULLY_CANCELED:
+          /* It is better to return with a cancel error code than the
+           * general decryption failed error code.  */
+          opd->pkdecrypt_failed = gpg_err_make (gpg_err_source (err),
+                                                GPG_ERR_CANCELED);
+          break;
+
+        case GPG_ERR_BAD_PASSPHRASE:
+          /* A bad passphrase is severe enough that we return this
+           * error code.  */
+          opd->pkdecrypt_failed = err;
+          break;
+
+        default:
+          /* For now all other error codes are ignored and the
+           * standard DECRYPT_FAILED is returned.  */
+          break;
+        }
+    }
+
 
   return 0;
 }
@@ -242,7 +271,9 @@ _gpgme_decrypt_status_handler (void *priv, gpgme_status_code_t code,
     case GPGME_STATUS_EOF:
       /* FIXME: These error values should probably be attributed to
 	 the underlying crypto engine (as error source).  */
-      if (opd->failed)
+      if (opd->failed && opd->pkdecrypt_failed)
+        return opd->pkdecrypt_failed;
+      else if (opd->failed)
 	return gpg_error (GPG_ERR_DECRYPT_FAILED);
       else if (!opd->okay)
 	return gpg_error (GPG_ERR_NO_DATA);

commit 87703dbb86ac8fd8abd23170f8038ea6e3dbde28
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 12 15:59:12 2017 +0200

    core: Simplify parsing of STATUS_ERROR in decrypt.c
    
    * src/decrypt.c (_gpgme_decrypt_status_handler): Factor some code out
    to ...
    (parse_status_error): new.  Modernize parsing.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/src/conversion.c b/src/conversion.c
index 92dd214..5b84f67 100644
--- a/src/conversion.c
+++ b/src/conversion.c
@@ -374,7 +374,7 @@ _gpgme_encode_percent_string (const char *src, char **destp, size_t len)
 
 
 /* Split a string into space delimited fields and remove leading and
- * trailing spaces from each field.  A pointer to the each field is
+ * trailing spaces from each field.  A pointer to each field is
  * stored in ARRAY.  Stop splitting at ARRAYSIZE fields.  The function
  * modifies STRING.  The number of parsed fields is returned.
  */
diff --git a/src/decrypt.c b/src/decrypt.c
index 3b18909..91a32ae 100644
--- a/src/decrypt.c
+++ b/src/decrypt.c
@@ -124,7 +124,43 @@ gpgme_op_decrypt_result (gpgme_ctx_t ctx)
   return &opd->result;
 }
 
+
 

+/* Parse the ARGS of an error status line and record some error
+ * conditions at OPD.  Returns 0 on success.  */
+static gpgme_error_t
+parse_status_error (char *args, op_data_t opd)
+{
+  gpgme_error_t err;
+  char *field[3];
+  int nfields;
+
+  nfields = _gpgme_split_fields (args, field, DIM (field));
+  if (nfields < 1)
+    return trace_gpg_error (GPG_ERR_INV_ENGINE); /* Required arg missing.  */
+  err = nfields < 2 ? 0 : atoi (field[1]);
+
+  if (!strcmp (field[0], "decrypt.algorithm"))
+    {
+      if (gpg_err_code (err) == GPG_ERR_UNSUPPORTED_ALGORITHM
+          && nfields > 2
+          && strcmp (field[2], "?"))
+        {
+          opd->result.unsupported_algorithm = strdup (field[2]);
+          if (!opd->result.unsupported_algorithm)
+            return gpg_error_from_syserror ();
+        }
+    }
+  else if (!strcmp (field[0], "decrypt.keyusage"))
+    {
+      if (gpg_err_code (err) == GPG_ERR_WRONG_KEY_USAGE)
+        opd->result.wrong_key_usage = 1;
+    }
+
+  return 0;
+}
+
+
 static gpgme_error_t
 parse_enc_to (char *args, gpgme_recipient_t *recp, gpgme_protocol_t protocol)
 {
@@ -230,47 +266,9 @@ _gpgme_decrypt_status_handler (void *priv, gpgme_status_code_t code,
       /* Note that this is an informational status code which should
          not lead to an error return unless it is something not
          related to the backend.  */
-      {
-	const char d_alg[] = "decrypt.algorithm";
-	const char k_alg[] = "decrypt.keyusage";
-
-	if (!strncmp (args, d_alg, sizeof (d_alg) - 1))
-	  {
-	    args += sizeof (d_alg) - 1;
-	    while (*args == ' ')
-	      args++;
-
-	    if (gpg_err_code (atoi (args)) == GPG_ERR_UNSUPPORTED_ALGORITHM)
-	      {
-		char *end;
-
-		while (*args && *args != ' ')
-		  args++;
-		while (*args == ' ')
-		  args++;
-
-		end = strchr (args, ' ');
-		if (end)
-		  *end = '\0';
-
-		if (!(*args == '?' && *(args + 1) == '\0'))
-		  {
-		    opd->result.unsupported_algorithm = strdup (args);
-		    if (!opd->result.unsupported_algorithm)
-		      return gpg_error_from_syserror ();
-		  }
-	      }
-	  }
-	else if (!strncmp (args, k_alg, sizeof (k_alg) - 1))
-	  {
-	    args += sizeof (k_alg) - 1;
-	    while (*args == ' ')
-	      args++;
-
-	    if (gpg_err_code (atoi (args)) == GPG_ERR_WRONG_KEY_USAGE)
-	      opd->result.wrong_key_usage = 1;
-	  }
-      }
+      err = parse_status_error (args, opd);
+      if (err)
+        return err;
       break;
 
     case GPGME_STATUS_ENC_TO:

-----------------------------------------------------------------------

Summary of changes:
 doc/gpgme.texi        |   2 +-
 src/conversion.c      |   2 +-
 src/decrypt.c         | 126 ++++++++++++++++++++++++++++++++------------------
 tests/gpg/t-keylist.c |   2 +-
 4 files changed, 85 insertions(+), 47 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 12 18:50:19 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Wed, 12 Jul 2017 18:50:19 +0200
Subject: [git] Pinentry - branch, master, updated. pinentry-1.0.0-25-ge57bcb7
Message-ID: <E1dVKqB-0004Dc-JN@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The standard pinentry collection".

The branch, master has been updated
       via  e57bcb7a2acff3a61a342d24e6a55407bf736631 (commit)
      from  6053cb4f3873897acf5d899bc6f02046d0748a0f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e57bcb7a2acff3a61a342d24e6a55407bf736631
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Wed Jul 12 18:46:36 2017 +0200

    core: Disable "save passphrase" checkbox without secret service.
    
    * pinentry/password-cache.c (password_cache_lookup): New argument
    FATAL_ERROR.  Set it on fatal error.
    * pinentry/password-cache.h (password_cache_lookup): New argument
    FATAL_ERROR in declaration.
    * pinentry/pinentry.c (cmd_getpin): On fatal error, disallow
    external password store.
    * NEWS: Update.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2023

diff --git a/NEWS b/NEWS
index 107a65d..5534d4d 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,12 @@ Noteworthy changes in version 1.0.1 (unreleased)
 
  * A FLTK1.3-based pinentry has been contributed.
 
+ * New option --ttyalert for pinentry-curses to alert the user.
+
+ * Don't show "save passphrase" checkbox if secret service is
+   unavailable.
+
+
 Noteworthy changes in version 1.0.0 (2016-11-22)
 ------------------------------------------------
 
diff --git a/pinentry/password-cache.c b/pinentry/password-cache.c
index 903c013..6778386 100644
--- a/pinentry/password-cache.c
+++ b/pinentry/password-cache.c
@@ -96,7 +96,7 @@ password_cache_save (const char *keygrip, const char *password)
 }
 
 char *
-password_cache_lookup (const char *keygrip)
+password_cache_lookup (const char *keygrip, int *fatal_error)
 {
 #ifdef HAVE_LIBSECRET
   GError *error = NULL;
@@ -112,6 +112,9 @@ password_cache_lookup (const char *keygrip)
 
   if (error != NULL)
     {
+      if (fatal_error)
+	*fatal_error = 1;
+
       fprintf (stderr, "Failed to lookup password for key %s with secret service: %s\n",
 	     keygrip, error->message);
       g_error_free (error);
diff --git a/pinentry/password-cache.h b/pinentry/password-cache.h
index 77e82e1..34fd00b 100644
--- a/pinentry/password-cache.h
+++ b/pinentry/password-cache.h
@@ -22,7 +22,7 @@
 
 void password_cache_save (const char *key_grip, const char *password);
 
-char *password_cache_lookup (const char *key_grip);
+char *password_cache_lookup (const char *key_grip, int *fatal_error);
 
 int password_cache_clear (const char *keygrip);
 
diff --git a/pinentry/pinentry.c b/pinentry/pinentry.c
index ed8fa6d..5f7912a 100644
--- a/pinentry/pinentry.c
+++ b/pinentry/pinentry.c
@@ -1438,10 +1438,14 @@ cmd_getpin (assuan_context_t ctx, char *line)
       && ! pinentry.error)
     {
       char *password;
+      int give_up_on_password_store = 0;
 
       pinentry.tried_password_cache = 1;
 
-      password = password_cache_lookup (pinentry.keyinfo);
+      password = password_cache_lookup (pinentry.keyinfo, &give_up_on_password_store);
+      if (give_up_on_password_store)
+	pinentry.allow_external_password_cache = 0;
+
       if (password)
 	/* There is a cached password.  Try it.  */
 	{

-----------------------------------------------------------------------

Summary of changes:
 NEWS                      | 6 ++++++
 pinentry/password-cache.c | 5 ++++-
 pinentry/password-cache.h | 2 +-
 pinentry/pinentry.c       | 6 +++++-
 4 files changed, 16 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The standard pinentry collection
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 12 21:29:57 2017
From: cvs at cvs.gnupg.org (by Daiki Ueno)
Date: Wed, 12 Jul 2017 21:29:57 +0200
Subject: [git] Pinentry - branch, master, updated. pinentry-1.0.0-26-gebfa54e
Message-ID: <E1dVNKf-0003Pp-Fl@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The standard pinentry collection".

The branch, master has been updated
       via  ebfa54e6044420ae12a090cdef9df7e7b0d961d2 (commit)
      from  e57bcb7a2acff3a61a342d24e6a55407bf736631 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ebfa54e6044420ae12a090cdef9df7e7b0d961d2
Author: Daiki Ueno <ueno at gnu.org>
Date:   Wed Jul 12 21:28:58 2017 +0200

    doc: Make Emacs frontend description more accurate
    
    * doc/pinentry.texi (Front ends): Remove false assertions on
    insecurity of Emacs, and mention allow-emacs-pinentry option of
    gpg-agent.
    
    Proofread-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2034

diff --git a/doc/pinentry.texi b/doc/pinentry.texi
index 23c1c5e..44e2eb1 100644
--- a/doc/pinentry.texi
+++ b/doc/pinentry.texi
@@ -261,14 +261,12 @@ be explicitly disabled by passing @code{--disable-inside-emacs} to
 @code{configure} when building @pinentry{}.
 
 Having Emacs get the passphrase is convenient, however, it is a
-significant security risk.  Emacs keeps all key presses buffered.
-(You can see the recent key presses by typing @code{C-h l}
-(@code{view-lossage}) in emacs.)  Further, Emacs is a huge program,
-which doesn't provide any process isolation to speak of.  As such,
-having it handle the passphrase adds a huge chunk of code to the
-user's trusted computing base.  Because of this concern, Emacs doesn't
-enable this by default (the user has to run @code{(pinentry-start)},
-e.g., from his or her @code{.emacs} file, explicitly).
+significant security risk.  Emacs is a huge program, which doesn't
+provide any process isolation to speak of.  As such, having it handle
+the passphrase adds a huge chunk of code to the user's trusted computing
+base.  Because of this concern, Emacs doesn't enable this by default,
+unless the @code{allow-emacs-pinentry} option is explicitly set in his
+or her @code{.gnupg/gpg-agent.conf} file.
 
 Similar to the inside-emacs check, the @pinentry{} frontends check
 whether the @code{DISPLAY} variable is set and a working X server is

-----------------------------------------------------------------------

Summary of changes:
 doc/pinentry.texi | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)


hooks/post-receive
-- 
The standard pinentry collection
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 13 09:18:51 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 13 Jul 2017 09:18:51 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 4706bdd306010ed5a14e927f21446e661c166da2
Message-ID: <E1dVYOh-00009Y-Hh@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  4706bdd306010ed5a14e927f21446e661c166da2 (commit)
      from  afb1a5011059410c937feb40ffae6c7292de22ab (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4706bdd306010ed5a14e927f21446e661c166da2
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 13 09:12:28 2017 +0200

    campaign: Remove First Look Media note from the thanks mail.
    
    The limit has already been reached.

diff --git a/tools/append-to-donors.sh b/tools/append-to-donors.sh
index c49ffd2..53697d2 100755
--- a/tools/append-to-donors.sh
+++ b/tools/append-to-donors.sh
@@ -142,11 +142,6 @@ send_thanks () {
             1) recur_text="yearly"
                 ;;
         esac
-        xextratext="
-First Look Media, the parent organization of The Intercept and
-Laura Poitras' Field of Vision, will match the first 12 months
-of your gift.
-"
     fi
     case "$service" in
         1) service_text="Stripe"

-----------------------------------------------------------------------

Summary of changes:
 tools/append-to-donors.sh | 5 -----
 1 file changed, 5 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 13 12:02:22 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 13 Jul 2017 12:02:22 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-89-gbce02a8
Message-ID: <E1dVawx-00016F-Mk@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  bce02a8b0f0e51775a4ee5536ccf35efc1f15ca6 (commit)
      from  957f8ebc89caadbf84320b60aeb18a100c314855 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit bce02a8b0f0e51775a4ee5536ccf35efc1f15ca6
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jul 11 16:07:39 2017 +0200

    gpgscm: Make it impossible to catch '*interpreter-exit*'.
    
    * tests/gpgscm/init.scm (throw'): Make it impossible to catch
    '*interpreter-exit*'.  This fixes 'exit' (and with it 'fail') inside
    'catch' statements.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/init.scm b/tests/gpgscm/init.scm
index b78a59e..66bec0f 100644
--- a/tests/gpgscm/init.scm
+++ b/tests/gpgscm/init.scm
@@ -605,12 +605,12 @@
 ;; This is used by the vm to throw exceptions.
 (define (throw' message args history)
   (cond
-   ((more-handlers?)
-    ((pop-handler) message args history))
    ((and args (list? args) (= 2 (length args))
 	 (equal? *interpreter-exit* (car args)))
     (*run-atexit-handlers*)
     (quit (cadr args)))
+   ((more-handlers?)
+    ((pop-handler) message args history))
    (else
     (display message)
     (when (and args (not (null? args)))

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgscm/init.scm | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 13 15:44:52 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 13 Jul 2017 15:44:52 +0200
Subject: [git] GPGME - branch, master, updated. gpgme-1.9.0-53-g9cd2b58
Message-ID: <E1dVeQG-00021W-Kv@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  9cd2b58dfb2c21cce64520cf4c726859b583d14e (commit)
       via  2446138e3c8c45fd4bd64eba84edd32fcd009699 (commit)
      from  46d2e48105e0929ec38dd4106004dd60d941df9a (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9cd2b58dfb2c21cce64520cf4c726859b583d14e
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jul 13 15:41:11 2017 +0200

    tests: Make agent spawning more robust.
    
    * tests/gpgsm/Makefile.am (gpgsm.conf): Add agent-program directive.
    * tests/start-stop-agent: Update agent-program directive.
    --
    Update the 'agent-program' configuration directive to point to the
    same agent that we are starting.  Previously, it was possible that a
    different agent was started if 'make check' was run with a different
    PATH.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgsm/Makefile.am b/tests/gpgsm/Makefile.am
index c73faea..a5667a8 100644
--- a/tests/gpgsm/Makefile.am
+++ b/tests/gpgsm/Makefile.am
@@ -65,6 +65,7 @@ BUILT_SOURCES = gpgsm.conf trustlist.txt pubring-stamp \
 ./gpgsm.conf:
 	echo disable-crl-checks > ./gpgsm.conf
 	echo faked-system-time 1008241200 >> ./gpgsm.conf
+	echo "agent-program `which $(GPG_AGENT)`|--debug-quick-random" >> ./gpg.conf
 
 ./private-keys-v1.d/gpg-sample.stamp: $(srcdir)/$(key_id)
 	-gpgconf --kill all
diff --git a/tests/start-stop-agent b/tests/start-stop-agent
index 3ce6f22..9514e0a 100755
--- a/tests/start-stop-agent
+++ b/tests/start-stop-agent
@@ -30,6 +30,18 @@ if [ "$1" = "--stop" ]; then
   exit 0
 fi
 
+# Update 'agent-program' in the configuration files to make sure we
+# will always start exactly this agent again if we ever need to.
+for F in gpg.conf gpgsm.conf
+do
+  if test -f "$GNUPGHOME/$F"
+  then
+      mv "$GNUPGHOME/$F" "$GNUPGHOME/$F~"
+      sed -e "s#^agent-program.*#agent-program ${GPG_AGENT}|--debug-quick-random#" \
+          >"$GNUPGHOME/$F" <"$GNUPGHOME/$F~"
+  fi
+done
+
 if [ "$(gpg-connect-agent --no-autostart getval\ $token /bye 2>/dev/null | head -1)" \
       = "D set" ]; then
   echo "gpg-agent already running" >&2

commit 2446138e3c8c45fd4bd64eba84edd32fcd009699
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jul 13 15:30:38 2017 +0200

    Sync 'autogen.sh'.
    
    --
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/autogen.sh b/autogen.sh
index 91f35a6..e5ba5bf 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -1,6 +1,6 @@
 #! /bin/sh
 # autogen.sh
-# Copyright (C) 2003, 2014 g10 Code GmbH
+# Copyright (C) 2003, 2014, 2017 g10 Code GmbH
 #
 # This file is free software; as a special exception the author gives
 # unlimited permission to copy and/or distribute it, with or without
@@ -15,7 +15,7 @@
 # configure it for the respective package.  It is maintained as part of
 # GnuPG and source copied by other packages.
 #
-# Version: 2014-01-10
+# Version: 2017-01-17
 
 configure_ac="configure.ac"
 
@@ -41,7 +41,7 @@ fatal () {
 
 info () {
     if [ -z "${SILENT}" ]; then
-      echo "autogen.sh:" "$*"
+      echo "autogen.sh:" "$*" >&2
     fi
 }
 
@@ -70,14 +70,27 @@ MSGMERGE=${GETTEXT_PREFIX}${MSGMERGE:-msgmerge}${GETTEXT_SUFFIX}
 DIE=no
 FORCE=
 SILENT=
+PRINT_HOST=no
+PRINT_BUILD=no
 tmp=$(dirname "$0")
 tsdir=$(cd "${tmp}"; pwd)
+version_parts=3
 
 if [ -n "${AUTOGEN_SH_SILENT}" ]; then
   SILENT=" --silent"
 fi
 if test x"$1" = x"--help"; then
-  echo "usage: ./autogen.sh [--silent] [--force] [--build-TYPE] [ARGS]"
+  echo "usage: ./autogen.sh [OPTIONS] [ARGS]"
+  echo "  Options:"
+  echo "    --silent       Silent operation"
+  echo "    --force        Pass --force to autoconf"
+  echo "    --find-version Helper for configure.ac"
+  echo "    --build-TYPE   Configure to cross build for TYPE"
+  echo "    --print-host   Print only the host triplet"
+  echo "    --print-build  Print only the build platform triplet"
+  echo ""
+  echo "  ARGS are passed to configure in --build-TYPE mode."
+  echo "  Configuration for this script is expected in autogen.rc"
   exit 0
 fi
 if test x"$1" = x"--silent"; then
@@ -88,6 +101,14 @@ if test x"$1" = x"--force"; then
   FORCE=" --force"
   shift
 fi
+if test x"$1" = x"--print-host"; then
+  PRINT_HOST=yes
+  shift
+fi
+if test x"$1" = x"--print-build"; then
+  PRINT_BUILD=yes
+  shift
+fi
 
 
 # Reject unsafe characters in $HOME, $tsdir and cwd.  We consider spaces
@@ -133,6 +154,11 @@ amd64_toolprefixes=
 myhost=""
 myhostsub=""
 case "$1" in
+    --find-version)
+        myhost="find-version"
+        SILENT=" --silent"
+        shift
+        ;;
     --build-w32)
         myhost="w32"
         shift
@@ -172,16 +198,81 @@ if [ -f "$HOME/.gnupg-autogen.rc" ]; then
     . "$HOME/.gnupg-autogen.rc"
 fi
 
+
+# **** FIND VERSION ****
+# This is a helper for the configure.ac M4 magic
+# Called
+#   ./autogen.sh --find-version PACKAGE MAJOR MINOR [MICRO]
+# returns a complete version string with automatic beta numbering.
+if [ "$myhost" = "find-version" ]; then
+    package="$1"
+    major="$2"
+    minor="$3"
+    micro="$4"
+
+    if [ -z "$package" -o -z "$major" -o -z "$minor" ]; then
+      echo "usage: ./autogen.sh --find-version PACKAGE MAJOR MINOR [MICRO]" >&2
+      exit 1
+    fi
+
+    case "$version_parts" in
+      2)
+        matchstr1="$package-$major.[0-9]*"
+        matchstr2="$package-$major-base"
+        vers="$major.$minor"
+        ;;
+      *)
+        matchstr1="$package-$major.$minor.[0-9]*"
+        matchstr2="$package-$major.$minor-base"
+        vers="$major.$minor.$micro"
+        ;;
+    esac
+
+    beta=no
+    if [ -e .git ]; then
+      ingit=yes
+      tmp=$(git describe --match "${matchstr1}" --long 2>/dev/null)
+      tmp=$(echo "$tmp" | sed s/^"$package"//)
+      if [ -n "$tmp" ]; then
+          tmp=$(echo "$tmp" | sed s/^"$package"//  \
+                | awk -F- '$3!=0 && $3 !~ /^beta/ {print"-beta"$3}')
+      else
+          tmp=$(git describe --match "${matchstr2}" --long 2>/dev/null \
+                | awk -F- '$4!=0{print"-beta"$4}')
+      fi
+      [ -n "$tmp" ] && beta=yes
+      rev=$(git rev-parse --short HEAD | tr -d '\n\r')
+      rvd=$((0x$(echo ${rev} | dd bs=1 count=4 2>/dev/null)))
+    else
+      ingit=no
+      beta=yes
+      tmp="-unknown"
+      rev="0000000"
+      rvd="0"
+    fi
+
+    echo "$package-$vers$tmp:$beta:$ingit:$vers$tmp:$vers:$tmp:$rev:$rvd:"
+    exit 0
+fi
+# **** end FIND VERSION ****
+
+
+if [ ! -f "$tsdir/build-aux/config.guess" ]; then
+    fatal "$tsdir/build-aux/config.guess not found"
+    exit 1
+fi
+build=`$tsdir/build-aux/config.guess`
+if [ $PRINT_BUILD = yes ]; then
+    echo "$build"
+    exit 0
+fi
+
+
+
 # ******************
 #  W32 build script
 # ******************
 if [ "$myhost" = "w32" ]; then
-    if [ ! -f "$tsdir/build-aux/config.guess" ]; then
-        fatal "$tsdir/build-aux/config.guess not found"
-        exit 1
-    fi
-    build=`$tsdir/build-aux/config.guess`
-
     case $myhostsub in
         ce)
           w32root="$w32ce_root"
@@ -222,6 +313,10 @@ if [ "$myhost" = "w32" ]; then
         fi
         die_p
     fi
+    if [ $PRINT_HOST = yes ]; then
+        echo "$host"
+        exit 0
+    fi
 
     if [ -f "$tsdir/config.log" ]; then
         if ! head $tsdir/config.log | grep "$host" >/dev/null; then
@@ -232,7 +327,8 @@ if [ "$myhost" = "w32" ]; then
 
     $tsdir/configure --enable-maintainer-mode ${SILENT} \
              --prefix=${w32root}  \
-             --host=${host} --build=${build} \
+             --host=${host} --build=${build} SYSROOT=${w32root} \
+             PKG_CONFIG_LIBDIR=${w32root}/lib/pkgconfig \
              ${configure_opts} ${extraoptions} "$@"
     rc=$?
     exit $rc
@@ -242,13 +338,6 @@ fi
 # ***** AMD64 cross build script *******
 # Used to cross-compile for AMD64 (for testing)
 if [ "$myhost" = "amd64" ]; then
-    shift
-    if [ ! -f $tsdir/build-aux/config.guess ]; then
-        echo "$tsdir/build-aux/config.guess not found" >&2
-        exit 1
-    fi
-    build=`$tsdir/build-aux/config.guess`
-
     [ -z "$amd64root" ] && amd64root="$HOME/amd64root"
     info "Using $amd64root as standard install directory"
     replace_sysroot
@@ -269,6 +358,10 @@ if [ "$myhost" = "amd64" ]; then
         echo "Stop." >&2
         exit 1
     fi
+    if [ $PRINT_HOST = yes ]; then
+        echo "$host"
+        exit 0
+    fi
 
     if [ -f "$tsdir/config.log" ]; then
         if ! head $tsdir/config.log | grep "$host" >/dev/null; then
@@ -341,8 +434,11 @@ fi
 
 # Check the git setup.
 if [ -d .git ]; then
-  CP="cp -a"
-  [ -z "${SILENT}" ] && CP="$CP -v"
+  CP="cp -p"
+  # If we have a GNU cp we can add -v
+  if cp --version >/dev/null 2>/dev/null; then
+    [ -z "${SILENT}" ] && CP="$CP -v"
+  fi
   if [ -f .git/hooks/pre-commit.sample -a ! -f .git/hooks/pre-commit ] ; then
     [ -z "${SILENT}" ] && cat <<EOF
 *** Activating trailing whitespace git pre-commit hook. ***

-----------------------------------------------------------------------

Summary of changes:
 autogen.sh              | 136 +++++++++++++++++++++++++++++++++++++++++-------
 tests/gpgsm/Makefile.am |   1 +
 tests/start-stop-agent  |  12 +++++
 3 files changed, 129 insertions(+), 20 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 13 16:09:11 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 13 Jul 2017 16:09:11 +0200
Subject: [git] GPGME - branch, master, updated. gpgme-1.9.0-55-g7fde780
Message-ID: <E1dVenn-0005fl-9A@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  7fde780cc1773c6d3902d4f49a8d4aadbf3223d4 (commit)
       via  ceed4a74540cf2c316b65cf62a9926c65019bb81 (commit)
      from  9cd2b58dfb2c21cce64520cf4c726859b583d14e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 7fde780cc1773c6d3902d4f49a8d4aadbf3223d4
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jul 13 16:06:27 2017 +0200

    tests: Fix distcheck.
    
    * tests/start-stop-agent: Remove backup file.
    
    Fixes-commit: 9cd2b58dfb2c21cce64520cf4c726859b583d14e
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/start-stop-agent b/tests/start-stop-agent
index 9514e0a..7901374 100755
--- a/tests/start-stop-agent
+++ b/tests/start-stop-agent
@@ -39,6 +39,7 @@ do
       mv "$GNUPGHOME/$F" "$GNUPGHOME/$F~"
       sed -e "s#^agent-program.*#agent-program ${GPG_AGENT}|--debug-quick-random#" \
           >"$GNUPGHOME/$F" <"$GNUPGHOME/$F~"
+      rm "$GNUPGHOME/$F~"
   fi
 done
 

commit ceed4a74540cf2c316b65cf62a9926c65019bb81
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jul 13 16:04:07 2017 +0200

    tests: Fix blunder.
    
    --
    Fixes-commit: 9cd2b58dfb2c21cce64520cf4c726859b583d14e
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgsm/Makefile.am b/tests/gpgsm/Makefile.am
index a5667a8..274ba9d 100644
--- a/tests/gpgsm/Makefile.am
+++ b/tests/gpgsm/Makefile.am
@@ -65,7 +65,7 @@ BUILT_SOURCES = gpgsm.conf trustlist.txt pubring-stamp \
 ./gpgsm.conf:
 	echo disable-crl-checks > ./gpgsm.conf
 	echo faked-system-time 1008241200 >> ./gpgsm.conf
-	echo "agent-program `which $(GPG_AGENT)`|--debug-quick-random" >> ./gpg.conf
+	echo "agent-program `which $(GPG_AGENT)`|--debug-quick-random" >> ./gpgsm.conf
 
 ./private-keys-v1.d/gpg-sample.stamp: $(srcdir)/$(key_id)
 	-gpgconf --kill all

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgsm/Makefile.am | 2 +-
 tests/start-stop-agent  | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 13 16:10:28 2017
From: cvs at cvs.gnupg.org (by Zdeněk Hataš)
Date: Thu, 13 Jul 2017 16:10:28 +0200
Subject: [git] GPA - branch, master, updated. gpa-0.9.10-9-gf7de626
Message-ID: <E1dVep2-0005uE-QD@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Assistant".

The branch, master has been updated
       via  f7de6260936cafb5f56635956b55271baae72faf (commit)
      from  ee3ec98dba5a8c98e9ca9737da633d0767d54214 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f7de6260936cafb5f56635956b55271baae72faf
Author: Zden?k Hata? <zdenek.hatas at gmail.com>
Date:   Thu Jul 13 15:55:41 2017 +0200

    po: czech translation update

diff --git a/po/cs.po b/po/cs.po
index ad284f4..60038eb 100644
--- a/po/cs.po
+++ b/po/cs.po
@@ -1,11 +1,11 @@
 # translation of cs.po to czech
-# Written by Zdenek Hatas <zdenek.hatas at gmail.com>, 2007 - 2014
+# Written by Zdenek Hatas <zdenek.hatas at gmail.com>, 2007 - 2017
 #
 msgid ""
 msgstr ""
 "Project-Id-Version: cs\n"
-"Report-Msgid-Bugs-To: gpa-dev at gnupg.org\n"
-"PO-Revision-Date: 2016-11-21 12:44+0100\n"
+"Report-Msgid-Bugs-To: translations at gnupg.org\n"
+"PO-Revision-Date: 2017-04-04 09:38+0200\n"
 "Last-Translator: Zden?k Hata? <zdenek.hatas at gmail.com>\n"
 "Language-Team: czech <cs at li.org>\n"
 "Language: cs\n"
@@ -24,8 +24,8 @@ msgstr "Zpr?va GPA"
 #. TRANSLATORS: The arguments are the filename, the integer size
 #. and the unit (such as KB or MB).
 #, c-format
-msgid "The file %s is %lli%s large.  Do you really  want to open it?"
-msgstr "Soubor %s je %lli%s velk?. Opravdu jej chcete otev??t?"
+msgid "The file %s is %llu%s large.  Do you really  want to open it?"
+msgstr "Soubor %s je  %llu%s velk?. Opravdu jej chcete otev??t?"
 
 msgid "Save As..."
 msgstr "Ulo?it jako..."
@@ -96,9 +96,6 @@ msgstr "Soubory"
 msgid "Card"
 msgstr "Karta"
 
-msgid "GNU Privacy Assistant - Clipboard"
-msgstr "GNU Privacy Assistant - Schr?nka"
-
 msgid "<b>Main</b>"
 msgstr "<b>Hlavn?</b>"
 
@@ -148,6 +145,21 @@ msgstr "Pokro?il?"
 msgid "Expert"
 msgstr "Expert"
 
+msgid "A keyserver has not been configured."
+msgstr "Server kl??? nebyl nastaven."
+
+msgid "Configure backend to use a keyserver?"
+msgstr "Nastavit vyu?it? serveru kl??? backendem?"
+
+msgid "_Yes"
+msgstr "_Ano"
+
+msgid "_No"
+msgstr "_Ne"
+
+msgid "Configuring the backend to use a keyserver failed"
+msgstr "Nastaven? vyu?it? serveru kl??? backendem selhalo"
+
 msgid "days"
 msgstr "dny"
 
@@ -229,9 +241,6 @@ msgstr "Vybrat v?echny soubory"
 msgid "File"
 msgstr "Soubor"
 
-msgid "GNU Privacy Assistant - File Manager"
-msgstr "GNU Privacy Assistant - Spr?vce soubor?"
-
 msgid "File Manager"
 msgstr "Spr?vce soubor?"
 
@@ -274,8 +283,8 @@ msgstr "Otev??t schr?nku"
 msgid "Open the settings dialog"
 msgstr "Otev??t dialog nastaven?"
 
-msgid "Enable the UI server"
-msgstr "Povolit UI server"
+msgid "Only start the UI server"
+msgstr "Spustit pouze UI server"
 
 msgid "Disable support for X.509"
 msgstr "Vypnout podporu pro X.509"
@@ -283,6 +292,9 @@ msgstr "Vypnout podporu pro X.509"
 msgid "Read options from file"
 msgstr "??st mo?nosti ze souboru"
 
+msgid "Do not connect to a running instance"
+msgstr "Nep?ipojujte se k b???c? instanci"
+
 msgid "[FILE...]"
 msgstr "[SOUBOR...]"
 
@@ -320,14 +332,14 @@ msgid ""
 "\t\"%s\"\n"
 "\n"
 "This is sensitive information, and should be stored carefully\n"
-"(for example, in a floppy disk kept in a safe place)."
+"(for example, on a USB stick kept in a safe place)."
 msgstr ""
 "Kopie va?eho soukrom?ho kl??e byla ulo?ena v souboru:\n"
 "\n"
 "\t\"%s\"\n"
 "\n"
 "Toto je citliv? informace a m?la by b?t bezpe?n? ulo?ena\n"
-"(nap?. na disket? na bezpe?n?m m?st?)."
+"(nap?. na USB pam?ti ulo?en? na bezpe?n?m m?st?)."
 
 msgid "An error ocurred during the backup operation."
 msgstr "V pr?b?hu z?lohov?n? do?lo k chyb?."
@@ -336,8 +348,8 @@ msgid "Backup key to file"
 msgstr "Z?lohovat kl?? do souboru"
 
 #, c-format
-msgid "Generating backup of key: %s"
-msgstr "Vytv??? se z?loha kl??e: %s"
+msgid "Generating backup of key: 0x%s"
+msgstr "Vytv??? se z?loha kl??e: 0x%s"
 
 msgid "The keys have been copied to the clipboard."
 msgstr "Kl??e byly zkop?rov?ny do schr?nky."
@@ -352,21 +364,22 @@ msgstr "ASCII-z_ak?dovat"
 msgid "The keys have been exported to %s."
 msgstr "Kl??e byly exportov?ny do %s."
 
+msgid "Only keys of the same procotol may be exported as a collection."
+msgstr "Pouze kl??e stejn?ho protokolu sm?j? b?t exportov?ny jako kolekce."
+
 #, c-format
 msgid ""
-"The selected key will be sent to a public key\n"
-"server (\"%s\").\n"
-"Are you sure you want to distribute this key?"
+"The selected key(s) will be sent to a public key\n"
+"server (\"%s\")."
 msgstr ""
 "Vybran? kl?? bude odesl?n na server kl???\n"
-"(\"%s\").\n"
-"Ur?it? chcete ???it tento kl???"
+"(\"%s\")."
 
-msgid "_Yes"
-msgstr "_Ano"
+msgid "Are you sure you want to distribute this key?"
+msgstr "Jste si jist?, ?e chcete ???it tento kl???"
 
-msgid "_No"
-msgstr "_Ne"
+msgid "Error sending key(s) to the server."
+msgstr "Chyba odesl?n? kll?e(?) na server."
 
 msgid "The keys have been sent to the server."
 msgstr "Kl??e byly odesl?ny na server."
@@ -387,7 +400,7 @@ msgid "\"%s\" contained no valid encrypted data."
 msgstr "\"%s\" neobsahoval platn? ?ifrovan? data."
 
 #, c-format
-msgid "The file \"%s\" contained no validencrypted data."
+msgid "The file \"%s\" contained no valid encrypted data."
 msgstr "Soubor \"%s\" neobsahoval platn? ?ifrovan? data."
 
 msgid "Wrong passphrase!"
@@ -456,32 +469,27 @@ msgstr "Vytv??? se kl?? ..."
 msgid "Import keys from file"
 msgstr "Importovat kl??e ze souboru"
 
-msgid "No keys were found."
-msgstr "Nebyly nalezeny ??dn? kl??e."
-
 #, c-format
 msgid ""
-"%i public keys read\n"
-"%i public keys imported\n"
-"%i public keys unchanged\n"
-"%i secret keys read\n"
-"%i secret keys imported\n"
-"%i secret keys unchanged"
+"More than %d keys match your search pattern.\n"
+"Use the long keyid or a fingerprint for a better match"
 msgstr ""
-"%i p?e?teno ve?ejn?ch kl???\n"
-"%i z?sk?no ve?ejn?ch kl???\n"
-"%i nezm?n?n?ch ve?ejn?ch kl???\n"
-"%i p?e?teno soukrom?ch kl???\n"
-"%i z?sk?no soukrom?ch kl???\n"
-"%i nezm?n?n?ch soukrom?ch kl???"
+"Va?emu vyhled?vac?mu vzoru odpov?d? v?ce ne? %d kl???.\n"
+"Pro zp?esn?n? pou?ijte dlouh? id kl??e nebo otisk."
+
+msgid "No keys were found."
+msgstr "Nebyly nalezeny ??dn? kl??e."
 
 msgid ""
 "Invalid time given.\n"
 "(you may not set the expiration time to the past.)"
 msgstr "Neplatn? ?as.(nem??ete nastavit ?as vypr?en? do minulosti.)"
 
-msgid "Key ID"
-msgstr "ID kl??e"
+msgid "Created"
+msgstr "Vytvo?en"
+
+msgid "The Creation Date is the date the certificate was created."
+msgstr "Datum vytvo?en? je datum, kdy byl certifik?t vytvo?en."
 
 msgid "User Name"
 msgstr "Jm?no u?ivatele"
@@ -498,6 +506,9 @@ msgstr "Tento kl?? u? jste s?m podepsal!"
 msgid "You haven't selected a default key to sign with!"
 msgstr "Nebyl vybr?n v?choz? kl?? pro podepisov?n?!"
 
+msgid "Which key do you want to import?"
+msgstr "Kter? kl?? chcete importovat?"
+
 msgid "Which key do you want to import? (The key must be specified by key ID)."
 msgstr "Kter? kl?? chcete z?skat? (Mus?te zadat ID kl??e)."
 
@@ -531,41 +542,41 @@ msgstr "ID podkl??e"
 msgid "Status"
 msgstr "Stav"
 
-msgid "Algorithm"
+msgid "Algo"
 msgstr "Algoritmus"
 
 msgid "Size"
 msgstr "Velikost"
 
-msgid "Expiry Date"
-msgstr "Platnost do"
+msgid "Expires"
+msgstr "Vypr?? platnost"
 
-msgid "[S]"
-msgstr "[S]"
+msgid "S"
+msgstr "P"
 
 msgid "Can sign"
 msgstr "Sm? podepisovat"
 
-msgid "[C]"
-msgstr "[C]"
+msgid "C"
+msgstr "C"
 
 msgid "Can certify"
 msgstr "Sm? certifikovat"
 
-msgid "[E]"
-msgstr "[E]"
+msgid "E"
+msgstr "?"
 
 msgid "Can encrypt"
 msgstr "Sm? ?ifrovat"
 
-msgid "[A]"
-msgstr "[A]"
+msgid "A"
+msgstr "A"
 
 msgid "Can authenticate"
 msgstr "Sm? autentizovat"
 
-msgid "[T]"
-msgstr "[T]"
+msgid "T"
+msgstr "K"
 
 msgid "Secret key stored on a smartcard."
 msgstr "Soukrom? kl?? byl ulo?en na kart?."
@@ -600,6 +611,9 @@ msgstr "Jm?na u?ivatel?:"
 msgid "Key ID:"
 msgstr "ID kl??e:"
 
+msgid "Fingerprint:"
+msgstr "Otisk:"
+
 msgid "Expiration"
 msgstr "Platnost do"
 
@@ -648,20 +662,20 @@ msgstr ""
 #, c-format
 msgid ""
 "The GPGME library returned an unexpected\n"
-"error. The error was:\n"
+"error at %s:%d. The error was:\n"
 "\n"
 "\t%s\n"
 "\n"
-"This is probably a bug in GPA.\n"
-"GPA will now try to recover from this error."
+"This is either an installation problem or a bug in %s.\n"
+"%s will now try to recover from this error."
 msgstr ""
 "Knihovna GPGME vr?tila neo?ek?vanou\n"
-"chybu. Chyba je:\n"
+"chybu v %s:%d.. Chyba je:\n"
 "\n"
 "\t%s\n"
 "\n"
-"Toto je z?ejm? chyba v GPA.\n"
-"GPA se pokus? obnovit z chybov?ho stavu."
+"Toto je bu? probl?m v instalaci nebo chyba v %s.\n"
+"%s se nyn? pokus? obnovit z chybov?ho stavu."
 
 #, c-format
 msgid ""
@@ -671,6 +685,12 @@ msgstr ""
 "Soubor %s ji? existuje.\n"
 "Chcete jej p?epsat?"
 
+msgid "_Use a different filename"
+msgstr "Po_u?ijte jin? n?zev souboru"
+
+msgid "_Open"
+msgstr "_Otev??t"
+
 msgid ""
 "************************************************************************\n"
 "* WARNING: This file is a backup of your secret key. Please keep it in *\n"
@@ -837,6 +857,33 @@ msgstr "Tento kl?? sm? b?t pou?it pouze pro ?ifrov?n?."
 msgid "This key is useless."
 msgstr "Tento kl?? je nepou?iteln?."
 
+#, c-format
+msgid ""
+"%u file(s) read\n"
+"%u file(s) with errors"
+msgstr ""
+"%u soubor(?) p?e?ten(o)\n"
+"%u soubor(?) s chybami"
+
+#, c-format
+msgid ""
+"%i public keys read\n"
+"%i public keys imported\n"
+"%i public keys unchanged\n"
+"%i secret keys read\n"
+"%i secret keys imported\n"
+"%i secret keys unchanged"
+msgstr ""
+"%i p?e?teno ve?ejn?ch kl???\n"
+"%i z?sk?no ve?ejn?ch kl???\n"
+"%i nezm?n?n?ch ve?ejn?ch kl???\n"
+"%i p?e?teno soukrom?ch kl???\n"
+"%i z?sk?no soukrom?ch kl???\n"
+"%i nezm?n?n?ch soukrom?ch kl???"
+
+msgid "A required engine component is not installed."
+msgstr "Po?adovan? komponenta stroje nen? instalovan?."
+
 msgid "Calling the crypto engine program failed."
 msgstr "Vol?n? programu ?ifrovac?ho stroje selhalo."
 
@@ -858,9 +905,6 @@ msgstr "E-mailov? adresa nen? platn?."
 msgid "Invalid character in comments."
 msgstr "Neplatn? znak v koment???ch."
 
-msgid "GPA Error"
-msgstr "Chyba GPA"
-
 msgid "GPA is the GNU Privacy Assistant."
 msgstr "GPA je GNU Privacy Assistant"
 
@@ -949,6 +993,9 @@ msgstr "Upravit kl??"
 msgid "Change _passphrase"
 msgstr "Zm?nit _heslo"
 
+msgid "Expiry Date"
+msgstr "Platnost do"
+
 msgid "Change _expiration"
 msgstr "Zm?nit _dobu platnosti"
 
@@ -1081,9 +1128,6 @@ msgstr ""
 "Tento sloupec indikuje typ certifik?tu. P?smeno 'P' znamen? OpenPGP, 'X' znamen? X.509 (S/"
 "MIME)."
 
-msgid "The key ID is a short number to identify a certificate."
-msgstr "ID kl??e je kr?tk? ??slo k identifikaci certifik?tu."
-
 msgid "The Expiry Date is the date until the certificate is valid."
 msgstr "Datum vypr?en? je datum, do kter?ho je certifik?t platn?."
 
@@ -1198,6 +1242,12 @@ msgstr "_Z?skat kl??e..."
 msgid "Retrieve keys from server"
 msgstr "Z?skat kl??e ze serveru"
 
+msgid "Re_fresh Keys"
+msgstr "A_ktualizovat kl??e"
+
+msgid "Refresh keys from server"
+msgstr "Aktualizovat kl??e ze serveru"
+
 msgid "_Send Keys..."
 msgstr "Ode_slat kl??e..."
 
@@ -1231,9 +1281,6 @@ msgstr "Zvolen? v?choz? kl??:"
 msgid "No default key selected in the preferences."
 msgstr "V p?edvolb?ch nebyl zvolen ??dn? v?choz? kl??."
 
-msgid "GNU Privacy Assistant - Key Manager"
-msgstr "GNU Privacy Assistant - Spr?vce kl???"
-
 msgid "Key Manager"
 msgstr "Spr?vce kl???"
 
@@ -1263,9 +1310,6 @@ msgstr[2] "%d kl??? vybr?no"
 msgid "User name:"
 msgstr "U?ivatelsk? jm?no:"
 
-msgid "Fingerprint:"
-msgstr "Otisk:"
-
 msgid "Expires at:"
 msgstr "Vypr??:"
 
@@ -1302,6 +1346,9 @@ msgstr "Podkl??e"
 msgid "Key"
 msgstr "Kl??"
 
+msgid "Tofu"
+msgstr "Tofu"
+
 msgid "Sign Key"
 msgstr "Podepsat kl??"
 
@@ -1325,18 +1372,18 @@ msgid "Sign only _locally"
 msgstr "Podepsat pouze _lok?ln?"
 
 msgid ""
-"It seems that GPGSM is not installed.\n"
+"It seems that no CMS engine is installed.\n"
 "\n"
 "Temporary disabling support for X.509.\n"
 "\n"
-"Please install GPGSM or invoke this program\n"
+"Please install a CMS engine or invoke this program\n"
 "with the option --disable-x509 ."
 msgstr ""
-"GPGSM z?ejm? nen? nainstalov?n.\n"
+"CMS z?ejm? nen? nainstalov?n.\n"
 "\n"
 "Podpora X.509 bude do?asn? vypnuta.\n"
 "\n"
-"Nainstalujte pros?m GPGSM nebo spus?te tento program\n"
+"Nainstalujte pros?m CMS nebo spus?te tento program\n"
 "s parametrem --disable-x509 ."
 
 msgid ""
@@ -1455,6 +1502,9 @@ msgstr ""
 "Zkontrolujte zda byl nalezen alespo? jeden odpov?daj?c? X.509 certifik?t pro pou?it? s S/"
 "MIME."
 
+msgid "Key ID"
+msgstr "ID kl??e"
+
 msgid "Shows the key ID of the selected key or an indication that a key needs to be selected."
 msgstr "Zobraz? ID vybran?ho kl??e  nebo upozorn?n?, ?e kl?? mus? b?t vybr?n."
 
@@ -1699,8 +1749,8 @@ msgstr "Zadan? URL serveru kl??? nen? platn?."
 msgid "The data given for \"Auto key locate\" is not valid."
 msgstr "Data p?edan? pro \"Automatick? nalezen? kl??e\" nejsou platn?."
 
-msgid "GNU Privacy Assistant - Settings"
-msgstr "GNU Privacy Assistant - Nastaven?"
+msgid "Settings"
+msgstr "Nastaven?"
 
 msgid "Level"
 msgstr "?rove?"
@@ -1728,8 +1778,8 @@ msgstr "Podpis: %s"
 msgid "Signatures:"
 msgstr "Podpisy:"
 
-msgid "GNU Privacy Assistant - Card Manager"
-msgstr "GNU Privacy Assistant - Spr?vce karet"
+msgid "Card Manager"
+msgstr "Spr?vce karet"
 
 #, c-format
 msgid "%s card detected."
@@ -1777,9 +1827,6 @@ msgstr "Vytvo?it nov? kl?? na kart?"
 msgid "This card application is not yet supported."
 msgstr "Tato aplikace karty nen? zat?m podporov?na."
 
-msgid "Card Manager"
-msgstr "Spr?vce karet"
-
 msgid "Application selection:"
 msgstr "Volba aplikace: "
 
@@ -1894,7 +1941,7 @@ msgid ""
 "new value and repeat that value at another prompt.\n"
 "\n"
 "Entering a wrong value for the PIN decrements the retry counter.  If the retry counters of "
-"the PIN and of the Reset Code are both down to zero, the PIN can still be reseted by using "
+"the PIN and of the Reset Code are both down to zero, the PIN can still be reset by using "
 "the Admin-PIN.\n"
 "\n"
 "A fresh standard card has set the PIN to the value <i>123456</i>.  However, the issuer of "
@@ -1930,14 +1977,15 @@ msgstr ""
 "hodnotu Reset k?du a tu na dal??m ??dku zopakovali."
 
 msgid ""
-"<b>Reseting the PIN or the Reset Code</b>\n"
+"<b>Resetting the PIN or the Reset Code</b>\n"
 "\n"
 "If the retry counters of the PIN and of the Reset Code are both down to zero, it is only "
 "possible to reset them if you have access to the Admin-PIN.\n"
 "\n"
 "A fresh standard card has set the Admin-PIN to the value <i>12345678</i>.  However, the "
 "issuer of your card might have initialized the card with a different Admin-PIN and that "
-"Admin-PIN might only be nown to the issuer.  Please check the instructions of your issuer.\n"
+"Admin-PIN might only be known to the issuer.  Please check the instructions of your "
+"issuer.\n"
 "\n"
 "If you proceed you will be asked to enter the current value of the <b>Admin-PIN</b> and "
 "then to enter a new value for the PIN or the Reset Code and repeat that new value at "
@@ -2102,7 +2150,7 @@ msgid ""
 "\n"
 "Please check the documentation of your card to learn for what the NullPIN is good.\n"
 "\n"
-"If you proceeed you will be asked to enter a new PIN and later to repeat that PIN.  Make "
+"If you proceed you will be asked to enter a new PIN and later to repeat that PIN.  Make "
 "sure that you will remember that PIN - it will not be possible to recover the PIN if it has "
 "been entered wrongly more than %d times.\n"
 "\n"
@@ -2230,72 +2278,44 @@ msgstr ""
 "Pro kartu %s nen? mnoho informac? ke zobrazen?. Zkuste pou??t tla??tko pro volbu aplikace "
 "pro p?epnut? na jinou aplikaci, kter? je na kart? k dispozici."
 
-#, fuzzy
-#~ msgid "Configure backend to use a keyserver?"
-#~ msgstr "Nastavit programy backednu"
-
-#, fuzzy
-#~ msgid "Configuring the backend to use a keyserver failed"
-#~ msgstr "Nastavit programy backednu"
-
-#~ msgid "Do not connect to a running instance"
-#~ msgstr "Nep?ipojujte se k b???c? instanci"
-
-#~ msgid "Only keys of the same procotol may be exported as a collection."
-#~ msgstr "Pouze kl??e stejn?ho protokolu sm?j? b?t exportov?ny jako kolekce."
-
-#, fuzzy
-#~ msgid "Are you sure you want to distribute this key?"
-#~ msgstr "Jste si jist?, ?e chcete smazat tento kl???"
-
-#, fuzzy
-#~ msgid "Error sending key(s) to the server."
-#~ msgstr "Odeslat kl??e na server..."
-
-#~ msgid "Created"
-#~ msgstr "Vytvo?en"
-
-#~ msgid "The Creation Date is the date the certificate was created."
-#~ msgstr "Datum vytvo?en? je datum, kdy byl certifik?t vytvo?en."
+#~ msgid "GNU Privacy Assistant - Clipboard"
+#~ msgstr "GNU Privacy Assistant - Schr?nka"
 
-#, fuzzy
-#~ msgid "Which key do you want to import?"
-#~ msgstr "Kter? kl?? chcete z?skat? (Mus?te zadat ID kl??e)."
+#~ msgid "GNU Privacy Assistant - File Manager"
+#~ msgstr "GNU Privacy Assistant - Spr?vce soubor?"
 
-#~ msgid "Algo"
+#~ msgid "Algorithm"
 #~ msgstr "Algoritmus"
 
-#~ msgid "Expires"
-#~ msgstr "Vypr?? platnost"
+#~ msgid "[S]"
+#~ msgstr "[S]"
 
-#~ msgid "S"
-#~ msgstr "P"
+#~ msgid "[C]"
+#~ msgstr "[C]"
 
-#~ msgid "C"
-#~ msgstr "C"
+#~ msgid "[E]"
+#~ msgstr "[E]"
 
-#~ msgid "E"
-#~ msgstr "?"
+#~ msgid "[A]"
+#~ msgstr "[A]"
 
-#~ msgid "A"
-#~ msgstr "A"
+#~ msgid "[T]"
+#~ msgstr "[T]"
 
-#~ msgid "T"
-#~ msgstr "K"
+#~ msgid "GPA Error"
+#~ msgstr "Chyba GPA"
 
-#~ msgid "A required engine component is not installed."
-#~ msgstr "Po?adovan? komponenta stroje nen? instalovan?."
+#~ msgid "The key ID is a short number to identify a certificate."
+#~ msgstr "ID kl??e je kr?tk? ??slo k identifikaci certifik?tu."
 
-#, fuzzy
-#~ msgid "Re_fresh Keys"
-#~ msgstr "Aktualizovat keyring"
+#~ msgid "GNU Privacy Assistant - Key Manager"
+#~ msgstr "GNU Privacy Assistant - Spr?vce kl???"
 
-#, fuzzy
-#~ msgid "Refresh keys from server"
-#~ msgstr "Z?skat kl??e ze serveru"
+#~ msgid "GNU Privacy Assistant - Settings"
+#~ msgstr "GNU Privacy Assistant - Nastaven?"
 
-#~ msgid "Settings"
-#~ msgstr "Nastaven?"
+#~ msgid "GNU Privacy Assistant - Card Manager"
+#~ msgstr "GNU Privacy Assistant - Spr?vce karet"
 
 #~ msgid "Message"
 #~ msgstr "Zpr?va"

-----------------------------------------------------------------------

Summary of changes:
 po/cs.po | 306 ++++++++++++++++++++++++++++++++++-----------------------------
 1 file changed, 163 insertions(+), 143 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Assistant
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 13 16:25:39 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 13 Jul 2017 16:25:39 +0200
Subject: [git] GnuPG - branch, STABLE-BRANCH-2-0,
 updated. gnupg-2.0.30-30-g67cd81e
Message-ID: <E1dVf3j-0000IV-Aa@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-2-0 has been updated
       via  67cd81ed90ad88cbe607b7f7d1a0b1e08b8ac1f1 (commit)
      from  2975eee420007557a138445d0505f1d590d88d7e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 67cd81ed90ad88cbe607b7f7d1a0b1e08b8ac1f1
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jun 14 15:57:57 2016 +0200

    gpgsm: Allow ciphers AES192 and SERPENT256
    
    * sm/gpgsm.c (main): Add AES192 cipher.  Allow SERPENT256.
    --
    
    Note that currently released Libcgrypt versions miss OIDs for Serpent
    and thus Serpent can only be used with tye forthcoming Libgcrypt
    1.7.1.
    
    (backport of master commit 5f9bd7a9e1ed4edcbb6c4e908d4bea5cd7dc9e68)
    
    GnuPG-bug-id: 2273, 2934
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/sm/gpgsm.c b/sm/gpgsm.c
index ef01a5c..ebb7ed1 100644
--- a/sm/gpgsm.c
+++ b/sm/gpgsm.c
@@ -1489,6 +1489,8 @@ main ( int argc, char **argv)
   else if (!strcmp (opt.def_cipher_algoid, "AES")
            || !strcmp (opt.def_cipher_algoid, "AES128"))
     opt.def_cipher_algoid = "2.16.840.1.101.3.4.1.2";
+  else if (!strcmp (opt.def_cipher_algoid, "AES192") )
+    opt.def_cipher_algoid = "2.16.840.1.101.3.4.1.22";
   else if (!strcmp (opt.def_cipher_algoid, "AES256") )
     opt.def_cipher_algoid = "2.16.840.1.101.3.4.1.42";
   else if (!strcmp (opt.def_cipher_algoid, "SERPENT")
@@ -1496,7 +1498,7 @@ main ( int argc, char **argv)
     opt.def_cipher_algoid = "1.3.6.1.4.1.11591.13.2.2";
   else if (!strcmp (opt.def_cipher_algoid, "SERPENT192") )
     opt.def_cipher_algoid = "1.3.6.1.4.1.11591.13.2.22";
-  else if (!strcmp (opt.def_cipher_algoid, "SERPENT192") )
+  else if (!strcmp (opt.def_cipher_algoid, "SERPENT256") )
     opt.def_cipher_algoid = "1.3.6.1.4.1.11591.13.2.42";
   else if (!strcmp (opt.def_cipher_algoid, "SEED") )
     opt.def_cipher_algoid = "1.2.410.200004.1.4";

-----------------------------------------------------------------------

Summary of changes:
 sm/gpgsm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 13 16:30:42 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Thu, 13 Jul 2017 16:30:42 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-90-gf78fe1a
Message-ID: <E1dVf8c-0000pT-Pg@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  f78fe1a4ec9d343199e1f424dd09e2937c913412 (commit)
      from  bce02a8b0f0e51775a4ee5536ccf35efc1f15ca6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f78fe1a4ec9d343199e1f424dd09e2937c913412
Author: Justus Winter <justus at g10code.com>
Date:   Thu Jul 13 16:29:25 2017 +0200

    gpgscm: Make loading of modules less verbose.
    
    * tests/gpgscm/main.c (load): Increase logging threshold.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/main.c b/tests/gpgscm/main.c
index e4b535e..4dae365 100644
--- a/tests/gpgscm/main.c
+++ b/tests/gpgscm/main.c
@@ -182,7 +182,7 @@ load (scheme *sc, char *file_name,
                  "of the Scheme library.\n");
       goto leave;
     }
-  if (verbose > 1)
+  if (verbose > 2)
     fprintf (stderr, "Loading %s...\n", qualified_name);
 
 #if HAVE_MMAP

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgscm/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 13 17:13:16 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Thu, 13 Jul 2017 17:13:16 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-91-g877a321
Message-ID: <E1dVfnp-0008Ed-Cn@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  877a321d011deb3e8501aa9cc5e9f9cd0b19dddf (commit)
      from  f78fe1a4ec9d343199e1f424dd09e2937c913412 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 877a321d011deb3e8501aa9cc5e9f9cd0b19dddf
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Thu Jul 13 17:12:42 2017 +0200

    doc: Document gnupg version requirement for gpg-preset-passphrase.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2331

diff --git a/doc/tools.texi b/doc/tools.texi
index bdef6a2..d05018b 100644
--- a/doc/tools.texi
+++ b/doc/tools.texi
@@ -1160,6 +1160,8 @@ useful for unattended machines, where the usual @command{pinentry} tool
 may not be used and the passphrases for the to be used keys are given at
 machine startup.
 
+This program works with GnuPG 2 and later.  GnuPG 1.x is not supported.
+
 Passphrases set with this utility don't expire unless the
 @option{--forget} option is used to explicitly clear them from the
 cache --- or @command{gpg-agent} is either restarted or reloaded (by

-----------------------------------------------------------------------

Summary of changes:
 doc/tools.texi | 2 ++
 1 file changed, 2 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 13 18:35:10 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 13 Jul 2017 18:35:10 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-93-g330212e
Message-ID: <E1dVh55-0003Mr-Q5@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  330212efb927c119bb5135856f8582c0e4e2e6b7 (commit)
       via  fa1155e89ebb4b16ee95549b8ab72672df3a0c54 (commit)
      from  877a321d011deb3e8501aa9cc5e9f9cd0b19dddf (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 330212efb927c119bb5135856f8582c0e4e2e6b7
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 13 18:22:36 2017 +0200

    gpg: Pass key origin values to import functions.
    
    * g10/import.c (import_keys_stream): Remove this unused function.
    (import_keys_internal): Add arg origin.
    (import_keys): Ditto.
    (import_keys_es_stream): Ditto.
    (import): Ditto.
    (import_one): Ditto.
    (apply_meta_data): New stub.
    (import_secret_one): Pass 0 for ORIGIN.
    * g10/keyserver.c (keyserver_get_chunk): For now pass 0 for ORIGIN.
    (keyserver_fetch): Add arg origin.
    (keyserver_import_cert): Pass KEYORG_DANE for ORIGIN.
    (keyserver_import_wkd): Pass KEYORG_WKD for ORIGIN.
    * g10/gpg.c (main): Pass OPT.KEY_ORIGIN to import_keys and
    keyserver_fetch.
    * g10/card-util.c (fetch_url): Pass KEYORG_URL for ORIGIN.
    --
    
    This is just the framework; applying the meta data will be done in
    another commit.
    
    GnuPG-bug-id: 3252
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/card-util.c b/g10/card-util.c
index 78cd52b..f1795b8 100644
--- a/g10/card-util.c
+++ b/g10/card-util.c
@@ -818,7 +818,7 @@ fetch_url (ctrl_t ctrl)
           strlist_t sl = NULL;
 
           add_to_strlist (&sl, info.pubkey_url);
-          rc = keyserver_fetch (ctrl, sl);
+          rc = keyserver_fetch (ctrl, sl, KEYORG_URL);
           free_strlist (sl);
         }
       else if (info.fpr1valid)
diff --git a/g10/gpg.c b/g10/gpg.c
index 38eeddf..5c60e1d 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -4508,7 +4508,8 @@ main (int argc, char **argv)
       case aFastImport:
         opt.import_options |= IMPORT_FAST; /* fall through */
       case aImport:
-	import_keys (ctrl, argc? argv:NULL, argc, NULL, opt.import_options);
+	import_keys (ctrl, argc? argv:NULL, argc, NULL,
+                     opt.import_options, opt.key_origin);
 	break;
 
 	/* TODO: There are a number of command that use this same
@@ -4596,7 +4597,7 @@ main (int argc, char **argv)
 	sl = NULL;
 	for( ; argc; argc--, argv++ )
 	    append_to_strlist2( &sl, *argv, utf8_strings );
-	rc = keyserver_fetch (ctrl, sl);
+	rc = keyserver_fetch (ctrl, sl, opt.key_origin);
 	if(rc)
           {
             write_status_failure ("fetch-keys", rc);
diff --git a/g10/import.c b/g10/import.c
index 491609d..8010fa5 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -97,7 +97,7 @@ struct import_filter_s import_filter;
 static int import (ctrl_t ctrl,
                    IOBUF inp, const char* fname, struct import_stats_s *stats,
 		   unsigned char **fpr, size_t *fpr_len, unsigned int options,
-		   import_screener_t screener, void *screener_arg);
+		   import_screener_t screener, void *screener_arg, int origin);
 static int read_block (IOBUF a, int with_meta,
                        PACKET **pending_pkt, kbnode_t *ret_root, int *r_v3keys);
 static void revocation_present (ctrl_t ctrl, kbnode_t keyblock);
@@ -106,7 +106,8 @@ static int import_one (ctrl_t ctrl,
                        struct import_stats_s *stats,
                        unsigned char **fpr, size_t *fpr_len,
                        unsigned int options, int from_sk, int silent,
-                       import_screener_t screener, void *screener_arg);
+                       import_screener_t screener, void *screener_arg,
+                       int origin);
 static int import_secret_one (ctrl_t ctrl, kbnode_t keyblock,
                               struct import_stats_s *stats, int batch,
                               unsigned int options, int for_migration,
@@ -430,7 +431,8 @@ import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames,
 		      import_stats_t stats_handle,
                       unsigned char **fpr, size_t *fpr_len,
 		      unsigned int options,
-                      import_screener_t screener, void *screener_arg)
+                      import_screener_t screener, void *screener_arg,
+                      int origin)
 {
   int i;
   int rc = 0;
@@ -442,7 +444,7 @@ import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames,
   if (inp)
     {
       rc = import (ctrl, inp, "[stream]", stats, fpr, fpr_len, options,
-                   screener, screener_arg);
+                   screener, screener_arg, origin);
     }
   else
     {
@@ -467,7 +469,7 @@ import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames,
           else
             {
               rc = import (ctrl, inp2, fname, stats, fpr, fpr_len, options,
-                           screener, screener_arg);
+                           screener, screener_arg, origin);
               iobuf_close (inp2);
               /* Must invalidate that ugly cache to actually close it. */
               iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);
@@ -501,28 +503,20 @@ import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames,
 
 void
 import_keys (ctrl_t ctrl, char **fnames, int nnames,
-	     import_stats_t stats_handle, unsigned int options )
+	     import_stats_t stats_handle, unsigned int options, int origin)
 {
   import_keys_internal (ctrl, NULL, fnames, nnames, stats_handle,
-                        NULL, NULL, options, NULL, NULL);
-}
-
-int
-import_keys_stream (ctrl_t ctrl, IOBUF inp, import_stats_t stats_handle,
-		    unsigned char **fpr, size_t *fpr_len, unsigned int options)
-{
-  return import_keys_internal (ctrl, inp, NULL, 0, stats_handle,
-                               fpr, fpr_len, options, NULL, NULL);
+                        NULL, NULL, options, NULL, NULL, origin);
 }
 
 
-/* Variant of import_keys_stream reading from an estream_t.  */
 int
 import_keys_es_stream (ctrl_t ctrl, estream_t fp,
                        import_stats_t stats_handle,
                        unsigned char **fpr, size_t *fpr_len,
                        unsigned int options,
-                       import_screener_t screener, void *screener_arg)
+                       import_screener_t screener, void *screener_arg,
+                       int origin)
 {
   int rc;
   iobuf_t inp;
@@ -537,7 +531,7 @@ import_keys_es_stream (ctrl_t ctrl, estream_t fp,
 
   rc = import_keys_internal (ctrl, inp, NULL, 0, stats_handle,
                              fpr, fpr_len, options,
-                             screener, screener_arg);
+                             screener, screener_arg, origin);
 
   iobuf_close (inp);
   return rc;
@@ -547,7 +541,7 @@ import_keys_es_stream (ctrl_t ctrl, estream_t fp,
 static int
 import (ctrl_t ctrl, IOBUF inp, const char* fname,struct import_stats_s *stats,
 	unsigned char **fpr,size_t *fpr_len, unsigned int options,
-	import_screener_t screener, void *screener_arg)
+	import_screener_t screener, void *screener_arg, int origin)
 {
   PACKET *pending_pkt = NULL;
   kbnode_t keyblock = NULL;  /* Need to initialize because gcc can't
@@ -575,7 +569,7 @@ import (ctrl_t ctrl, IOBUF inp, const char* fname,struct import_stats_s *stats,
       if (keyblock->pkt->pkttype == PKT_PUBLIC_KEY)
         rc = import_one (ctrl, keyblock,
                          stats, fpr, fpr_len, options, 0, 0,
-                         screener, screener_arg);
+                         screener, screener_arg, origin);
       else if (keyblock->pkt->pkttype == PKT_SECRET_KEY)
         rc = import_secret_one (ctrl, keyblock, stats,
                                 opt.batch, options, 0,
@@ -1384,19 +1378,32 @@ apply_drop_sig_filter (ctrl_t ctrl, kbnode_t keyblock, recsel_expr_t selector)
 }
 
 
+/* Apply meta data to KEYBLOCK.  This sets the origin of the key to
+ * ORIGIN.  If MERGE is true KEYBLOCK has been updated and the meta
+ * data is merged and not simply inserted.  */
+static gpg_error_t
+apply_meta_data (kbnode_t keyblock, int merge, int origin)
+{
+
+  return 0;
+}
+
+
 /*
  * Try to import one keyblock. Return an error only in serious cases,
  * but never for an invalid keyblock.  It uses log_error to increase
  * the internal errorcount, so that invalid input can be detected by
  * programs which called gpg.  If SILENT is no messages are printed -
- * even most error messages are suppressed.
+ * even most error messages are suppressed.  ORIGIN is the origin of
+ * the key (0 for unknown).
  */
 static int
 import_one (ctrl_t ctrl,
             kbnode_t keyblock, struct import_stats_s *stats,
 	    unsigned char **fpr, size_t *fpr_len, unsigned int options,
 	    int from_sk, int silent,
-            import_screener_t screener, void *screener_arg)
+            import_screener_t screener, void *screener_arg,
+            int origin)
 {
   PKT_public_key *pk;
   PKT_public_key *pk_orig = NULL;
@@ -1614,6 +1621,17 @@ import_one (ctrl_t ctrl,
       if (opt.verbose > 1 )
         log_info (_("writing to '%s'\n"), keydb_get_resource_name (hd) );
 
+      /* Unless we are in restore mode apply meta data to the
+       * keyblock.  Note that this will never change the first packet
+       * and thus the address of KEYBLOCK won't change.  */
+      if ( !(options & IMPORT_RESTORE) )
+        {
+          rc = apply_meta_data (keyblock, 0, origin);
+          log_error ("apply_meta_data failed: %s\n", gpg_strerror (rc));
+          keydb_release (hd);
+          return GPG_ERR_GENERAL;
+        }
+
       rc = keydb_insert_keyblock (hd, keyblock );
       if (rc)
         log_error (_("error writing keyring '%s': %s\n"),
@@ -2286,7 +2304,7 @@ import_secret_one (ctrl_t ctrl, kbnode_t keyblock,
 	 the secret keys.  FIXME?  */
       import_one (ctrl, pub_keyblock, stats,
 		  NULL, NULL, options, 1, for_migration,
-                  screener, screener_arg);
+                  screener, screener_arg, 0);
 
       /* Fixme: We should check for an invalid keyblock and
 	 cancel the secret key import in this case.  */
diff --git a/g10/keyserver-internal.h b/g10/keyserver-internal.h
index 02452e8..46a1e1d 100644
--- a/g10/keyserver-internal.h
+++ b/g10/keyserver-internal.h
@@ -40,7 +40,7 @@ int keyserver_import_keyid (ctrl_t ctrl, u32 *keyid,
                             struct keyserver_spec *keyserver, int quick);
 gpg_error_t keyserver_refresh (ctrl_t ctrl, strlist_t users);
 gpg_error_t keyserver_search (ctrl_t ctrl, strlist_t tokens);
-int keyserver_fetch (ctrl_t ctrl, strlist_t urilist);
+int keyserver_fetch (ctrl_t ctrl, strlist_t urilist, int origin);
 int keyserver_import_cert (ctrl_t ctrl, const char *name, int dane_mode,
                            unsigned char **fpr,size_t *fpr_len);
 gpg_error_t keyserver_import_pka (ctrl_t ctrl, const char *name,
diff --git a/g10/keyserver.c b/g10/keyserver.c
index c9be1f0..bec30e3 100644
--- a/g10/keyserver.c
+++ b/g10/keyserver.c
@@ -1746,7 +1746,8 @@ keyserver_get_chunk (ctrl_t ctrl, KEYDB_SEARCH_DESC *desc, int ndesc,
                              r_fpr, r_fprlen,
                              (opt.keyserver_options.import_options
                               | IMPORT_NO_SECKEY),
-                             keyserver_retrieval_screener, &screenerarg);
+                             keyserver_retrieval_screener, &screenerarg,
+                             0 /* FIXME? */);
     }
   es_fclose (datastream);
   xfree (source);
@@ -1852,7 +1853,7 @@ keyserver_put (ctrl_t ctrl, strlist_t keyspecs)
    that the fetch operation ignores the configured keyservers and
    instead directly retrieves the keys.  */
 int
-keyserver_fetch (ctrl_t ctrl, strlist_t urilist)
+keyserver_fetch (ctrl_t ctrl, strlist_t urilist, int origin)
 {
   gpg_error_t err;
   strlist_t sl;
@@ -1877,7 +1878,7 @@ keyserver_fetch (ctrl_t ctrl, strlist_t urilist)
           stats_handle = import_new_stats_handle();
           import_keys_es_stream (ctrl, datastream, stats_handle, NULL, NULL,
                                  opt.keyserver_options.import_options,
-                                 NULL, NULL);
+                                 NULL, NULL, origin);
 
           import_print_stats (stats_handle);
           import_release_stats_handle (stats_handle);
@@ -1932,7 +1933,7 @@ keyserver_import_cert (ctrl_t ctrl, const char *name, int dane_mode,
       err = import_keys_es_stream (ctrl, key, NULL, fpr, fpr_len,
                                    (opt.keyserver_options.import_options
                                     | IMPORT_NO_SECKEY),
-                                   NULL, NULL);
+                                   NULL, NULL, KEYORG_DANE);
 
       opt.no_armor=armor_status;
 
@@ -2055,7 +2056,7 @@ keyserver_import_wkd (ctrl_t ctrl, const char *name, int quick,
           if (!err)
             err = import_keys_es_stream (ctrl, key, NULL, fpr, fpr_len,
                                          IMPORT_NO_SECKEY,
-                                         NULL, NULL);
+                                         NULL, NULL, KEYORG_WKD);
 
         }
 
diff --git a/g10/main.h b/g10/main.h
index dad0fe3..e69ed9d 100644
--- a/g10/main.h
+++ b/g10/main.h
@@ -352,15 +352,13 @@ void            restore_import_filter (import_filter_t filt);
 gpg_error_t read_key_from_file (ctrl_t ctrl, const char *fname,
                                 kbnode_t *r_keyblock);
 void import_keys (ctrl_t ctrl, char **fnames, int nnames,
-		  import_stats_t stats_hd, unsigned int options);
-int import_keys_stream (ctrl_t ctrl, iobuf_t inp, import_stats_t stats_hd,
-                        unsigned char **fpr,
-			size_t *fpr_len, unsigned int options);
+		  import_stats_t stats_hd, unsigned int options, int origin);
 int import_keys_es_stream (ctrl_t ctrl, estream_t fp,
                            import_stats_t stats_handle,
                            unsigned char **fpr, size_t *fpr_len,
                            unsigned int options,
-                           import_screener_t screener, void *screener_arg);
+                           import_screener_t screener, void *screener_arg,
+                           int origin);
 gpg_error_t import_old_secring (ctrl_t ctrl, const char *fname);
 import_stats_t import_new_stats_handle (void);
 void import_release_stats_handle (import_stats_t hd);

commit fa1155e89ebb4b16ee95549b8ab72672df3a0c54
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 13 17:28:32 2017 +0200

    gpg: New option --key-origin.
    
    * g10/keydb.h (KEYORG_): Rename to KEYORG_.
    * g10/packet.h (PKT_user_id): Rename field keysrc to keyorg.  Adjust
    users.
    (PKT_public_key): Ditto.
    (PKT_ring_trust): Ditto.
    * g10/options.h (struct opt): Add field key_origin.
    * g10/getkey.c (parse_key_origin): New.
    * g10/gpg.c (oKeyOrigin): New.
    (opts): Add "keys-origin".
    (main): Set option.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/DETAILS b/doc/DETAILS
index b915f06..cbeead7 100644
--- a/doc/DETAILS
+++ b/doc/DETAILS
@@ -1347,12 +1347,13 @@ CREATE TABLE signatures (
                - 2 :: Key source on a user id (UID)
   - 1 octet :: Key Source; i.e. the origin of the key:
                - 0 :: Unknown source.
-               - 1 :: Direct import from a file.
-               - 2 :: Public keyserver.
-               - 3 :: Preferred keysrver.
+               - 1 :: Public keyserver.
+               - 2 :: Preferred keysrver.
+               - 3 :: OpenPGP DANE.
                - 4 :: Web Key Directory.
-               - 5 :: Web Key Directory via sub-domain.
-               - 6 :: OpenPGP DANE.
+               - 5 :: Import from a trusted URL.
+               - 6 :: Import from a trusted file.
+               - 7 :: Self generated.
   - 4 octets :: Time of last update.  This is a a four-octet scalar
                 with the seconds since Epoch.
   - 1 octet  :: Scalar with the length of the following field.
diff --git a/doc/gpg.texi b/doc/gpg.texi
index bc83eff..64dd502 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -2254,6 +2254,13 @@ hint to optimize its buffer allocation strategy.  It is also used by
 the @option{--status-fd} line ``PROGRESS'' to provide a value for
 ``total'' if that is not available by other means.
 
+ at item --key-origin @var{string}
+ at opindex key-origin
+gpg can track the origin of a key. Certain origins are implicitly
+known (e.g. keyserver, web key directory) and set.  For a standard
+import the origin of the keys imported can be set with this optionb.
+To list the possible values use "help" for @var{string}.
+
 @item --import-options @code{parameters}
 @opindex import-options
 This is a space or comma delimited string that gives options for
diff --git a/g10/build-packet.c b/g10/build-packet.c
index fa2674b..6d00fc5 100644
--- a/g10/build-packet.c
+++ b/g10/build-packet.c
@@ -213,7 +213,7 @@ build_packet_and_meta (iobuf_t out, PACKET *pkt)
       PKT_user_id *uid = pkt->pkt.user_id;
 
       rt.subtype = RING_TRUST_UID;
-      rt.keysrc = uid->keysrc;
+      rt.keyorg = uid->keyorg;
       rt.keyupdate = uid->keyupdate;
       rt.url = uid->updateurl;
       err = do_ring_trust (out, &rt);
@@ -225,7 +225,7 @@ build_packet_and_meta (iobuf_t out, PACKET *pkt)
       PKT_public_key *pk = pkt->pkt.public_key;
 
       rt.subtype = RING_TRUST_KEY;
-      rt.keysrc = pk->keysrc;
+      rt.keyorg = pk->keyorg;
       rt.keyupdate = pk->keyupdate;
       rt.url = pk->updateurl;
       err = do_ring_trust (out, &rt);
@@ -395,7 +395,7 @@ do_ring_trust (iobuf_t out, PKT_ring_trust *rt)
   iobuf_put (out, rt->subtype);
   if (rt->subtype == RING_TRUST_KEY || rt->subtype == RING_TRUST_UID)
     {
-      iobuf_put (out, rt->keysrc);
+      iobuf_put (out, rt->keyorg);
       write_32 (out, rt->keyupdate);
       iobuf_put (out, namelen);
       if (namelen)
diff --git a/g10/call-dirmngr.c b/g10/call-dirmngr.c
index cb6c69c..76fa072 100644
--- a/g10/call-dirmngr.c
+++ b/g10/call-dirmngr.c
@@ -379,6 +379,7 @@ ks_status_cb (void *opaque, const char *line)
 
   if ((s = has_leading_keyword (line, parm->keyword? parm->keyword : "SOURCE")))
     {
+      /* Note that the arg for "S SOURCE" is the URL of a keyserver.  */
       if (!parm->source)
         {
           parm->source = xtrystrdup (s);
diff --git a/g10/getkey.c b/g10/getkey.c
index a3df857..285ea35 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -4294,6 +4294,41 @@ parse_auto_key_locate (char *options)
 }
 
 
+/* Parse the argument for --key-origin.  Return false on error. */
+int
+parse_key_origin (char *string)
+{
+  struct { const char *name; int origin; } list[] = {
+    { "self",    KEYORG_SELF    },
+    { "file",    KEYORG_FILE    },
+    { "url",     KEYORG_URL     },
+    { "wkd",     KEYORG_WKD     },
+    { "dane",    KEYORG_DANE    },
+    { "ks-pref", KEYORG_KS_PREF },
+    { "ks",      KEYORG_KS      },
+    { "unknown", KEYORG_UNKNOWN }
+  };
+  int i;
+
+  if (!ascii_strcasecmp (string, "help"))
+    {
+      log_info (_("valid values for option '%s':\n"), "--key-origin");
+      for (i=0; i < DIM (list); i++)
+        log_info ("  %s\n", list[i].name);
+      g10_exit (1);
+    }
+
+  for (i=0; i < DIM (list); i++)
+    if (!ascii_strcasecmp (string, list[i].name))
+      {
+        opt.key_origin = list[i].origin;
+        return 1;
+      }
+
+  return 0;
+}
+
+
 /* Returns true if a secret key is available for the public key with
    key id KEYID; returns false if not.  This function ignores legacy
    keys.  Note: this is just a fast check and does not tell us whether
diff --git a/g10/gpg.c b/g10/gpg.c
index 3e15373..38eeddf 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -419,6 +419,7 @@ enum cmd_and_opt_values
     oOnlySignTextIDs,
     oDisableSignerUID,
     oSender,
+    oKeyOrigin,
 
     oNoop
   };
@@ -615,6 +616,7 @@ static ARGPARSE_OPTS opts[] = {
 
   ARGPARSE_s_s (oKeyServer, "keyserver", "@"),
   ARGPARSE_s_s (oKeyServerOptions, "keyserver-options", "@"),
+  ARGPARSE_s_s (oKeyOrigin, "key-origin", "@"),
   ARGPARSE_s_s (oImportOptions, "import-options", "@"),
   ARGPARSE_s_s (oImportFilter,  "import-filter", "@"),
   ARGPARSE_s_s (oExportOptions, "export-options", "@"),
@@ -2845,10 +2847,10 @@ main (int argc, char **argv)
 
           case oCompliance:
 	    {
-	      int compliance = gnupg_parse_compliance_option (pargs.r.ret_str,
-							      compliance_options,
-							      DIM (compliance_options),
-							      opt.quiet);
+	      int compliance = gnupg_parse_compliance_option
+                (pargs.r.ret_str,
+                 compliance_options, DIM (compliance_options),
+                 opt.quiet);
 	      if (compliance < 0)
 		g10_exit (1);
 	      set_compliance_option (compliance);
@@ -3462,6 +3464,12 @@ main (int argc, char **argv)
 	    release_akl();
 	    break;
 
+	  case oKeyOrigin:
+	    if(!parse_key_origin (pargs.r.ret_str))
+              log_error (_("invalid argument for option \"%.50s\"\n"),
+                         "--key-origin");
+	    break;
+
 	  case oEnableLargeRSA:
 #if SECMEM_BUFFER_SIZE >= 65536
             opt.flags.large_rsa=1;
diff --git a/g10/keydb.h b/g10/keydb.h
index 4016723..bad3149 100644
--- a/g10/keydb.h
+++ b/g10/keydb.h
@@ -119,13 +119,14 @@ union pref_hint
 /* Constants to describe from where a key was fetched or updated.  */
 enum
   {
-    KEYSRC_UNKNOWN = 0,
-    KEYSRC_FILE    = 1, /* Direct import from a file.  */
-    KEYSRC_KS      = 2, /* Public keyserver.    */
-    KEYSRC_PREF_KS = 3, /* Preferred keysrver.  */
-    KEYSRC_WKD     = 4, /* Web Key Directory.   */
-    KEYSRC_WKD_SD  = 5, /* Web Key Directory but from a sub domain.  */
-    KEYSRC_DANE    = 6  /* OpenPGP DANE.  */
+    KEYORG_UNKNOWN = 0,
+    KEYORG_KS      = 1, /* Public keyserver.    */
+    KEYORG_KS_PREF = 2, /* Preferred keysrver.  */
+    KEYORG_DANE    = 3, /* OpenPGP DANE.        */
+    KEYORG_WKD     = 4, /* Web Key Directory.   */
+    KEYORG_URL     = 5, /* Trusted URL.         */
+    KEYORG_FILE    = 6, /* Trusted file.        */
+    KEYORG_SELF    = 7, /* We generated it.     */
   };
 
 
@@ -396,6 +397,7 @@ char *get_user_id_byfpr_native (ctrl_t ctrl, const byte *fpr);
 
 void release_akl(void);
 int parse_auto_key_locate(char *options);
+int parse_key_origin (char *string);
 
 /*-- keyid.c --*/
 int pubkey_letter( int algo );
diff --git a/g10/options.h b/g10/options.h
index 98417d7..5bb506e 100644
--- a/g10/options.h
+++ b/g10/options.h
@@ -263,6 +263,9 @@ struct
     struct akl *next;
   } *auto_key_locate;
 
+  /* The value of --key-origin.  See parse_key_origin().  */
+  int key_origin;
+
   int passphrase_repeat;
   int pinentry_mode;
 
diff --git a/g10/packet.h b/g10/packet.h
index cf2121c..56ac503 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -285,7 +285,7 @@ typedef struct
   u32 created;          /* according to the self-signature */
   u32 keyupdate;        /* From the ring trust packet.  */
   char *updateurl;      /* NULL or the URL of the last update origin.  */
-  byte keysrc;          /* From the ring trust packet.  */
+  byte keyorg;          /* From the ring trust packet.  */
   byte selfsigversion;
   struct
   {
@@ -407,7 +407,7 @@ typedef struct
   u32     trust_timestamp;
   byte    trust_depth;
   byte    trust_value;
-  byte    keysrc;         /* From the ring trust packet.  */
+  byte    keyorg;         /* From the ring trust packet.  */
   u32     keyupdate;      /* From the ring trust packet.  */
   char    *updateurl;     /* NULL or the URL of the last update origin.  */
   const byte *trust_regexp;
@@ -498,7 +498,7 @@ typedef struct {
   unsigned int trustval;
   unsigned int sigcache;
   unsigned char subtype; /* The subtype of this ring trust packet.   */
-  unsigned char keysrc;  /* The origin of the key (KEYSRC_*).        */
+  unsigned char keyorg;  /* The origin of the key (KEYSRC_*).        */
   u32 keyupdate;         /* The wall time the key was last updated.  */
   char *url;             /* NULL or the URL of the source.           */
 } PKT_ring_trust;
diff --git a/g10/parse-packet.c b/g10/parse-packet.c
index dbb7af8..0b6ee8b 100644
--- a/g10/parse-packet.c
+++ b/g10/parse-packet.c
@@ -2942,7 +2942,7 @@ parse_ring_trust (parse_packet_ctx_t ctx, unsigned long pktlen)
       int i;
       unsigned int namelen;
 
-      rt.keysrc = iobuf_get_noeof (inp);
+      rt.keyorg = iobuf_get_noeof (inp);
       pktlen--;
       rt.keyupdate = read_32 (inp);
       pktlen -= 4;
@@ -2974,7 +2974,7 @@ parse_ring_trust (parse_packet_ctx_t ctx, unsigned long pktlen)
           es_fprintf (listfp, ":trust packet: %s upd=%lu src=%d%s",
                       (rt.subtype == RING_TRUST_UID? "uid" : "key"),
                       (unsigned long)rt.keyupdate,
-                      rt.keysrc,
+                      rt.keyorg,
                       (rt.url? " url=":""));
           if (rt.url)
             {
@@ -3016,7 +3016,7 @@ parse_ring_trust (parse_packet_ctx_t ctx, unsigned long pktlen)
     {
       PKT_user_id *uid = ctx->last_pkt.pkt.user_id;
 
-      uid->keysrc = rt.keysrc;
+      uid->keyorg = rt.keyorg;
       uid->keyupdate = rt.keyupdate;
       uid->updateurl = rt.url;
       rt.url = NULL;
@@ -3027,7 +3027,7 @@ parse_ring_trust (parse_packet_ctx_t ctx, unsigned long pktlen)
     {
       PKT_public_key *pk = ctx->last_pkt.pkt.public_key;
 
-      pk->keysrc = rt.keysrc;
+      pk->keyorg = rt.keyorg;
       pk->keyupdate = rt.keyupdate;
       pk->updateurl = rt.url;
       rt.url = NULL;

-----------------------------------------------------------------------

Summary of changes:
 doc/DETAILS              | 11 +++++----
 doc/gpg.texi             |  7 ++++++
 g10/build-packet.c       |  6 ++---
 g10/call-dirmngr.c       |  1 +
 g10/card-util.c          |  2 +-
 g10/getkey.c             | 35 ++++++++++++++++++++++++++
 g10/gpg.c                | 21 +++++++++++-----
 g10/import.c             | 64 +++++++++++++++++++++++++++++++-----------------
 g10/keydb.h              | 16 ++++++------
 g10/keyserver-internal.h |  2 +-
 g10/keyserver.c          | 11 +++++----
 g10/main.h               |  8 +++---
 g10/options.h            |  3 +++
 g10/packet.h             |  6 ++---
 g10/parse-packet.c       |  8 +++---
 15 files changed, 138 insertions(+), 63 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 14 11:14:58 2017
From: cvs at cvs.gnupg.org (by Damien Goutte-Gattat)
Date: Fri, 14 Jul 2017 11:14:58 +0200
Subject: [git] Scute - branch, master, updated. scute-1.5.0-1-gce7fb4a
Message-ID: <E1dVwgc-0002mI-HJ@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PKCS#11 token on top of gpg-agent".

The branch, master has been updated
       via  ce7fb4ad5404fdc74f2ab214bc5a70d0fbb60cc8 (commit)
       via  0b49362dab49697bfdf8b0fdc1dcfe66afb3c7fd (commit)
      from  e6ca8e2e6ae842e9e72c9287624a77e51fe2962f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ce7fb4ad5404fdc74f2ab214bc5a70d0fbb60cc8
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Fri Jul 14 11:13:07 2017 +0200

    Post-release updates.
    
    --
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/NEWS b/NEWS
index abc7093..ef5f50d 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,7 @@
+Noteworthy changes in version 1.6.0 (unreleased)
+------------------------------------------------
+
+
 Noteworthy changes in version 1.5.0 (2017-07-14)
 ------------------------------------------------
 
diff --git a/configure.ac b/configure.ac
index fc7607d..618d845 100644
--- a/configure.ac
+++ b/configure.ac
@@ -37,7 +37,7 @@ min_automake_version="1.14"
 # another commit and push so that the git magic is able to work.
 m4_define([mym4_package],[scute])
 m4_define([mym4_major], [1])
-m4_define([mym4_minor], [5])
+m4_define([mym4_minor], [6])
 m4_define([mym4_micro], [0])
 
 # To start a new development series, i.e a new major or minor number

commit 0b49362dab49697bfdf8b0fdc1dcfe66afb3c7fd
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Fri Jul 14 10:53:59 2017 +0200

    Release 1.5.0.
    
    * AUTHORS: Update maintainer name and contact.
    * NEWS: Update release date.
    * configure.ac: Update PACKAGE_BUGREPORT url. Bump LT_REVISION.
    * doc/website/download.xhtml: Add 1.5.O release.
    
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/AUTHORS b/AUTHORS
index 1eba0f1..2ce5e4a 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -1,5 +1,5 @@
 Package: scute
-Maintainer: Marcus Brinkmann <marcus at g10code.com>
+Maintainer: Damien Goutte-Gattat <dgouttegattat at incenp.org>
 Bug reports: https://dev.gnupg.org/
 Security related bug reports: security at gnupg.org
 License: GPLv2+ with exception for Mozilla
diff --git a/NEWS b/NEWS
index e6608bb..abc7093 100644
--- a/NEWS
+++ b/NEWS
@@ -1,4 +1,4 @@
-Noteworthy changes in version 1.5.0 (unreleased)
+Noteworthy changes in version 1.5.0 (2017-07-14)
 ------------------------------------------------
 
  * Support for TLS 1.2 client authentication and S/MIME signing.
diff --git a/configure.ac b/configure.ac
index 99003fd..fc7607d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -57,7 +57,7 @@ m4_define([mym4_version],      m4_argn(4, mym4_verslist))
 m4_define([mym4_revision],     m4_argn(7, mym4_verslist))
 m4_define([mym4_revision_dec], m4_argn(8, mym4_verslist))
 m4_esyscmd([echo ]mym4_version[>VERSION])
-AC_INIT([mym4_package],[mym4_version], [http://bugs.gnupg.org])
+AC_INIT([mym4_package],[mym4_version], [https://dev.gnupg.org])
 
 # LT Version numbers, remember to change them just *before* a release.
 #   (Code changed:			REVISION++)
@@ -67,7 +67,7 @@ AC_INIT([mym4_package],[mym4_version], [http://bugs.gnupg.org])
 #
 LIBSCUTE_LT_CURRENT=0
 LIBSCUTE_LT_AGE=0
-LIBSCUTE_LT_REVISION=2
+LIBSCUTE_LT_REVISION=3
 
 # Version numbers reported by the PKCS #11 module to its users.
 VERSION_MAJOR=1
diff --git a/doc/website/download.xhtml b/doc/website/download.xhtml
index 457b5b9..5eee902 100644
--- a/doc/website/download.xhtml
+++ b/doc/website/download.xhtml
@@ -56,7 +56,7 @@
           be cross-built for Windows 32-bit using MingW32.
         </p>
         <p>
-	  The most recent release of Scute is version 1.4.0.
+	  The most recent release of Scute is version 1.5.0.
 	</p>
 	<table>
 	  <caption>Scute source distributions.</caption>
@@ -70,6 +70,20 @@
 	  </tr>
 	  <tr>
 	    <td>Scute source distribution</td>
+	    <td>1.5.0</td>
+	    <td>2017-07-14</td>
+	    <td>969 kB</td>
+	    <td>
+	      <a href="ftp://ftp.gnupg.org/gcrypt/scute/scute-1.5.0.tar.bz2">
+		download</a>
+	    </td>
+	    <td>
+	      <a href="ftp://ftp.gnupg.org/gcrypt/scute/scute-1.5.0.tar.bz2.sig">
+		download</a>
+	    </td>
+	  </tr>
+	  <tr>
+	    <td>Scute source distribution</td>
 	    <td>1.4.0</td>
 	    <td>2010-04-21</td>
 	    <td>755 kB</td>

-----------------------------------------------------------------------

Summary of changes:
 AUTHORS                    |  2 +-
 NEWS                       |  6 +++++-
 configure.ac               |  6 +++---
 doc/website/download.xhtml | 16 +++++++++++++++-
 4 files changed, 24 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
PKCS#11 token on top of gpg-agent
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 14 11:21:27 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Fri, 14 Jul 2017 11:21:27 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-94-g956da89
Message-ID: <E1dVwmu-00043b-V8@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  956da89193370d5aa970cff5b77f605534481a02 (commit)
      from  330212efb927c119bb5135856f8582c0e4e2e6b7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 956da89193370d5aa970cff5b77f605534481a02
Author: Justus Winter <justus at g10code.com>
Date:   Fri Jul 14 11:17:49 2017 +0200

    gpg: Fix importing keys.
    
    * g10/import.c (import_one): Fix error handling.
    
    Fixes-commit: 330212efb927c119bb5135856f8582c0e4e2e6b7
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/g10/import.c b/g10/import.c
index 8010fa5..1737479 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -1627,9 +1627,12 @@ import_one (ctrl_t ctrl,
       if ( !(options & IMPORT_RESTORE) )
         {
           rc = apply_meta_data (keyblock, 0, origin);
-          log_error ("apply_meta_data failed: %s\n", gpg_strerror (rc));
-          keydb_release (hd);
-          return GPG_ERR_GENERAL;
+          if (rc)
+            {
+              log_error ("apply_meta_data failed: %s\n", gpg_strerror (rc));
+              keydb_release (hd);
+              return GPG_ERR_GENERAL;
+            }
         }
 
       rc = keydb_insert_keyblock (hd, keyblock );

-----------------------------------------------------------------------

Summary of changes:
 g10/import.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 14 14:16:53 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Fri, 14 Jul 2017 14:16:53 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 91aac71723e2d6dc345da9a56c44f1645d567065
Message-ID: <E1dVzWf-0005YG-Jk@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  91aac71723e2d6dc345da9a56c44f1645d567065 (commit)
       via  1c0c36f9fa441fc9df6ca172c8f57855322e9f0e (commit)
      from  4706bdd306010ed5a14e927f21446e661c166da2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 91aac71723e2d6dc345da9a56c44f1645d567065
Author: Justus Winter <justus at g10code.com>
Date:   Fri Jul 14 14:16:43 2017 +0200

    jenkins: use target check-all if available

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index a997b5d..2737c08 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -219,6 +219,15 @@ done
 set -x
 
 
+# Select the appropriate test target.
+function check_target() {
+    if grep >/dev/null check-all Makefile; then
+	echo check-all
+    else
+	echo check
+    fi
+}
+
 # Switch on the different targets.
 case "$XTARGET" in
     native)
@@ -229,7 +238,7 @@ case "$XTARGET" in
 	           CXXFLAGS="$CXXFLAGS -std=c++11"
         $MAKE $MAKEFLAGS
 
-        env $test_environment $MAKE -k check verbose=2 \
+        env $test_environment $MAKE -k $(check_target) verbose=2 \
 	    || echo "FAIL: make check failed with status $?"
         # Jenkins looks for "FAIL:" to mark a build unstable,
         # hence || ... here
@@ -249,7 +258,7 @@ case "$XTARGET" in
 	test_environment="$(echo $test_environment | sed -e 's#obj/##g')"
 	# KCAHKCAHKCAH
 
-        env $test_environment $MAKE -k check verbose=2 \
+        env $test_environment $MAKE -k $(check_target) verbose=2 \
 	    || echo "FAIL: make check failed with status $?"
         # Jenkins looks for "FAIL:" to mark a build unstable,
         # hence || ... here
@@ -267,7 +276,7 @@ case "$XTARGET" in
 	           CXXFLAGS="$CXXFLAGS $SANFLAGS -fPIC -std=c++11"
         $SCANBUILD $MAKE $MAKEFLAGS
 
-        env $test_environment $MAKE -k check verbose=2 \
+        env $test_environment $MAKE -k $(check_target) verbose=2 \
 	    || echo "FAIL: make check failed with status $?"
         # Jenkins looks for "FAIL:" to mark a build unstable,
         # hence || ... here

commit 1c0c36f9fa441fc9df6ca172c8f57855322e9f0e
Author: Justus Winter <justus at g10code.com>
Date:   Fri Jul 14 14:14:56 2017 +0200

    jenkins: more generic she bang

diff --git a/misc/jenkins/bin/build.bash b/misc/jenkins/bin/build.bash
index af492c1..a997b5d 100755
--- a/misc/jenkins/bin/build.bash
+++ b/misc/jenkins/bin/build.bash
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Script used jenkins to run builds for GnuPG and related packages.
 
 # Stop on error and be nice to other processes.

-----------------------------------------------------------------------

Summary of changes:
 misc/jenkins/bin/build.bash | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 14 14:22:07 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Fri, 14 Jul 2017 14:22:07 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-97-g58eafd1
Message-ID: <E1dVzbk-0006iY-OI@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  58eafd11ed5501c0b72fcb553eb3e097ad29b3c6 (commit)
       via  b4d25082fd4502ec01d511c22fecd60d513b81f4 (commit)
       via  7a6e6ad2880bbff54a75ff608d0ec97d6c405733 (commit)
      from  956da89193370d5aa970cff5b77f605534481a02 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 58eafd11ed5501c0b72fcb553eb3e097ad29b3c6
Author: Justus Winter <justus at g10code.com>
Date:   Fri Jul 14 12:59:00 2017 +0200

    tests: Improve 'shell.scm' script.
    
    * tests/openpgp/defs.scm (create-file): Unlink file first.
    * tests/openpgp/shell.scm: Ask whether to import legacy test keys or
    not, and whether to drop 'batch' from the configuration.  Add paths to
    all the programs to 'PATH'.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/openpgp/defs.scm b/tests/openpgp/defs.scm
index 50976b9..b5e3078 100644
--- a/tests/openpgp/defs.scm
+++ b/tests/openpgp/defs.scm
@@ -316,6 +316,7 @@
      (display (make-random-string size) port))))
 
 (define (create-file name . lines)
+  (catch #f (unlink name))
   (letfd ((fd (open name (logior O_WRONLY O_CREAT O_BINARY) #o600)))
     (let ((port (fdopen fd "wb")))
       (for-each (lambda (line) (display line port) (newline port))
diff --git a/tests/openpgp/shell.scm b/tests/openpgp/shell.scm
index bd6059a..347b3a0 100644
--- a/tests/openpgp/shell.scm
+++ b/tests/openpgp/shell.scm
@@ -18,7 +18,6 @@
 ;; along with this program; if not, see <http://www.gnu.org/licenses/>.
 
 (load (in-srcdir "tests" "openpgp" "defs.scm"))
-(setup-environment)
 
 ;; This is not a test, but can be used to inspect the test
 ;; environment.  Simply execute
@@ -27,7 +26,28 @@
 ;;
 ;; to run it.
 
-(echo "Note that gpg.conf includes 'batch'.  If you want to use gpg")
-(echo "interactively you should drop that.")
-(echo)
+(if (prompt-yes-no? "Load legacy test environment" #t)
+    (setup-legacy-environment)
+    (setup-environment))
+
+(if (prompt-yes-no? "Drop 'batch' from gpg.conf" #t)
+    (apply create-file
+	   (cons "gpg.conf"
+		 (filter (lambda (line) (not (equal? "batch" line)))
+			 (string-split-newlines
+			  (call-with-input-file "gpg.conf" read-all)))))
+    (begin
+      (echo "Note that gpg.conf includes 'batch'.  If you want to use gpg")
+      (echo "interactively you should drop that.")))
+
+;; Add paths to tools to PATH.
+(setenv "PATH" (pathsep-join
+		(append (map (lambda (t) (dirname (tool t)))
+			     '(gpg gpg-agent scdaemon gpgsm dirmngr gpgconf))
+			(pathsep-split (getenv "PATH"))))
+	#t)
+
+(echo "\nEnjoy your test environment. "
+      "Type 'exit' to exit it, it will be cleaned up after you.\n")
+
 (interactive-shell)

commit b4d25082fd4502ec01d511c22fecd60d513b81f4
Author: Justus Winter <justus at g10code.com>
Date:   Fri Jul 14 12:57:41 2017 +0200

    gpgscm: Library improvements.
    
    * tests/gpgscm/repl.scm (prompt-yes-no?): New function.
    * tests/gpgscm/tests.scm (pathsep-split): Likewise.
    (pathsep-join): Likewise.
    (with-path): Use the new function.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/repl.scm b/tests/gpgscm/repl.scm
index 84454dc..833ec0d 100644
--- a/tests/gpgscm/repl.scm
+++ b/tests/gpgscm/repl.scm
@@ -55,3 +55,15 @@
 (define (interactive-repl . environment)
   (repl (lambda (p) (prompt-append-prefix "gpgscm " p))
 	(if (null? environment) (interaction-environment) (car environment))))
+
+;; Ask a yes/no question.
+(define (prompt-yes-no? question default)
+  (let ((answer (prompt (string-append question "? ["
+				       (if default "Y/n" "y/N") "] "))))
+    (cond
+     ((= 0 (string-length answer))
+      default)
+     ((or (equal? "y" answer) (equal? "Y" answer))
+      #t)
+     (else
+      #f))))
diff --git a/tests/gpgscm/tests.scm b/tests/gpgscm/tests.scm
index 06084de..40ba7e3 100644
--- a/tests/gpgscm/tests.scm
+++ b/tests/gpgscm/tests.scm
@@ -192,6 +192,16 @@
 (define (in-srcdir . names)
   (canonical-path (apply path-join (cons (getenv "abs_top_srcdir") names))))
 
+;; Split a list of paths.
+(define (pathsep-split s)
+  (string-split s *pathsep*))
+
+;; Join a list of paths.
+(define (pathsep-join paths)
+  (foldr (lambda (a b) (string-append a (string *pathsep*) b))
+	 (car paths)
+	 (cdr paths)))
+
 ;; Try to find NAME in PATHS.  Returns the full path name on success,
 ;; or raises an error.
 (define (path-expand name paths)
@@ -209,7 +219,7 @@
 ;;   (load (with-path "library.scm"))
 (define (with-path name)
   (catch name
-	 (path-expand name (string-split (getenv "GPGSCM_PATH") *pathsep*))))
+	 (path-expand name (pathsep-split (getenv "GPGSCM_PATH")))))
 
 (define (basename path)
   (let ((i (string-index path #\/)))

commit 7a6e6ad2880bbff54a75ff608d0ec97d6c405733
Author: Justus Winter <justus at g10code.com>
Date:   Fri Jul 14 12:55:01 2017 +0200

    gpgscm: Fail early if the test setup fails.
    
    * tests/gpgscm/tests.scm (make-environment-cache): Check status code
    of setup script.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/tests.scm b/tests/gpgscm/tests.scm
index a6772d1..06084de 100644
--- a/tests/gpgscm/tests.scm
+++ b/tests/gpgscm/tests.scm
@@ -838,6 +838,8 @@
 	  (let ((tarball (make-temporary-file "environment-cache")))
 	    (atexit (lambda () (remove-temporary-file tarball)))
 	    (setup::run-sync '--create-tarball tarball)
+	    (if (not (equal? 'PASS (setup::status)))
+		(fail "Setup failed."))
 	    `(--unpack-tarball ,tarball)))))
 
 ;; Command line flag handling.  Returns the elements following KEY in

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgscm/repl.scm   | 12 ++++++++++++
 tests/gpgscm/tests.scm  | 14 +++++++++++++-
 tests/openpgp/defs.scm  |  1 +
 tests/openpgp/shell.scm | 28 ++++++++++++++++++++++++----
 4 files changed, 50 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 17 14:14:01 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 17 Jul 2017 14:14:01 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-121-gde1e125
Message-ID: <E1dX4uX-0001Df-F8@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  de1e12504dd72bbedd3441be9aab3cad6dbca251 (commit)
       via  9d99c6b973caa7fdf93b53cf764066214f763803 (commit)
      from  61b0f52c1cc85bf8c3cac9aba40e28682e4e1b8b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit de1e12504dd72bbedd3441be9aab3cad6dbca251
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 17 14:04:30 2017 +0200

    build: Bump LT version to C22/A2/R0.
    
    --
    
    This is required to allow installation of 1.7 and 1.8.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/configure.ac b/configure.ac
index d36673f..9aa89c7 100644
--- a/configure.ac
+++ b/configure.ac
@@ -51,12 +51,13 @@ m4_define([mym4_full_version],[mym4_version[]mym4_betastring])
 AC_INIT([libgcrypt],[mym4_full_version],[http://bugs.gnupg.org])
 
 # LT Version numbers, remember to change them just *before* a release.
+# !!!NOTE: Already updated for 1.8.0 !!
 #   (Interfaces removed:    CURRENT++, AGE=0, REVISION=0)
 #   (Interfaces added:      CURRENT++, AGE++, REVISION=0)
 #   (No interfaces changed:                   REVISION++)
-LIBGCRYPT_LT_CURRENT=21
-LIBGCRYPT_LT_AGE=1
-LIBGCRYPT_LT_REVISION=3
+LIBGCRYPT_LT_CURRENT=22
+LIBGCRYPT_LT_AGE=2
+LIBGCRYPT_LT_REVISION=0
 
 
 # If the API is changed in an incompatible way: increment the next counter.

commit 9d99c6b973caa7fdf93b53cf764066214f763803
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 17 12:34:13 2017 +0200

    random: Minor fix for getting the rndjent version.
    
    * random/rndjent.c (_gcry_rndjent_get_version): Always set R_ACTIVE.
    * tests/version.c (test_get_config): Check number of fields for
    rng-type.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/random/rndjent.c b/random/rndjent.c
index b1432e4..6e56c8a 100644
--- a/random/rndjent.c
+++ b/random/rndjent.c
@@ -327,6 +327,8 @@ _gcry_rndjent_poll (void (*add)(const void*, size_t, enum random_origins),
 unsigned int
 _gcry_rndjent_get_version (int *r_active)
 {
+  if (r_active)
+    *r_active = 0;
 #ifdef USE_JENT
   if ( is_rng_available () )
     {
diff --git a/tests/version.c b/tests/version.c
index 6a01610..7e68cd6 100644
--- a/tests/version.c
+++ b/tests/version.c
@@ -43,6 +43,8 @@ static void
 test_get_config (void)
 {
   char *string;
+  const char *s;
+  int i;
 
   string = gcry_get_config (0, NULL);
   if (!string)
@@ -81,6 +83,21 @@ test_get_config (void)
     fail ("gcry_get_config(\"no-such-item\") returned wrong error: %s\n",
           gpg_strerror (gpg_error_from_syserror ()));
 
+  /* Check the rng-type.  */
+  xfree (string);
+  string = gcry_get_config (0, "rng-type");
+  if (!string)
+    fail ("gcry_get_config(\"rng-type\") not returned\n");
+  else
+    {
+      for (i=0, s = string; *s; s++)
+        if (*s == ':')
+          i++;
+      if (i < 5)
+        fail ("gcry_get_config(\"rng-type\") has not enough fields\n");
+    }
+
+
   xfree (string);
 }
 

-----------------------------------------------------------------------

Summary of changes:
 configure.ac     |  7 ++++---
 random/rndjent.c |  2 ++
 tests/version.c  | 17 +++++++++++++++++
 3 files changed, 23 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 17 15:59:52 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 17 Jul 2017 15:59:52 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-100-ga149afe
Message-ID: <E1dX6Yz-0000gN-Th@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  a149afe338d61d86985c533cde5e7dbcd31e8698 (commit)
       via  bbbd0db34b4e387f8dc089fb7d69fdcf2ed91a01 (commit)
       via  849467870ee1c10e0a7b1e89cfc9e8214e4963fe (commit)
      from  58eafd11ed5501c0b72fcb553eb3e097ad29b3c6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a149afe338d61d86985c533cde5e7dbcd31e8698
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 17 15:52:26 2017 +0200

    gpg,sm: Check compliance of the RNG.
    
    * common/compliance.c (gnupg_rng_is_compliant): New.
    * g10/call-agent.c (start_agent) [W32]: Check rng compliance.
    * sm/call-agent.c (start_agent) [W32]: Ditto.
    * g10/encrypt.c (encrypt_simple, encrypt_crypt): Check that the RNG is
    compliant.
    * sm/encrypt.c (gpgsm_encrypt): Ditto.
    * g10/sign.c (do_sign): Ditto.
    * sm/sign.c (gpgsm_sign): Ditto.
    --
    
    Under Windows we need to check that the Jitter RNG is active in de-vs
    mode.  Under Linux this is not necessary because /dev/random can be
    scrutinized and is believed to provide enough entropy.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/compliance.c b/common/compliance.c
index 8b91677..268ea4d 100644
--- a/common/compliance.c
+++ b/common/compliance.c
@@ -466,6 +466,46 @@ gnupg_digest_is_allowed (enum gnupg_compliance_mode compliance, int producer,
 }
 
 
+/* Return True if the random number generator is compliant in
+ * COMPLIANCE mode.  */
+int
+gnupg_rng_is_compliant (enum gnupg_compliance_mode compliance)
+{
+  static int result = -1;
+
+  if (result != -1)
+    ; /* Use cached result.  */
+  else if (compliance == CO_DE_VS)
+    {
+      /* In DE_VS mode under Windows we require that the JENT RNG
+       * is active.  */
+#ifdef HAVE_W32_SYSTEM
+# if GCRYPT_VERSION_NUMBER >= 0x010800
+      char *buf;
+      char *fields[5];
+
+      buf = gcry_get_config (0, "rng-type");
+      if (buf
+          && split_fields_colon (buf, fields, DIM (fields)) >= 5
+          && atoi (fields[4]) > 0)
+        result = 1;
+      else
+        result = 0;
+      gcry_free (buf);
+# else
+      result = 0;  /* No JENT - can't be compliant.  */
+# endif
+#else /*!HAVE_W32_SYSTEM*/
+      result = 1;  /* Not Windows - RNG is good.  */
+#endif /*!HAVE_W32_SYSTEM*/
+    }
+  else
+    result = 1;
+
+  return result;
+}
+
+
 const char *
 gnupg_status_compliance_flag (enum gnupg_compliance_mode compliance)
 {
diff --git a/common/compliance.h b/common/compliance.h
index d55bbf3..2076e79 100644
--- a/common/compliance.h
+++ b/common/compliance.h
@@ -66,6 +66,8 @@ int gnupg_digest_is_compliant (enum gnupg_compliance_mode compliance,
 int gnupg_digest_is_allowed (enum gnupg_compliance_mode compliance,
                              int producer,
                              digest_algo_t digest);
+int gnupg_rng_is_compliant (enum gnupg_compliance_mode compliance);
+
 const char *gnupg_status_compliance_flag (enum gnupg_compliance_mode
                                           compliance);
 
diff --git a/g10/call-agent.c b/g10/call-agent.c
index 7b76933..3ad13e8 100644
--- a/g10/call-agent.c
+++ b/g10/call-agent.c
@@ -281,6 +281,24 @@ start_agent (ctrl_t ctrl, int flag_for_card)
                   write_status_error ("set_pinentry_mode", rc);
                 }
             }
+
+          /* In DE_VS mode under Windows we require that the JENT RNG
+           * is active.  */
+#ifdef HAVE_W32_SYSTEM
+          if (!rc && opt.compliance == CO_DE_VS)
+            {
+              if (assuan_transact (agent_ctx, "GETINFO jent_active",
+                                   NULL, NULL, NULL, NULL, NULL, NULL))
+                {
+                  rc = gpg_error (GPG_ERR_FORBIDDEN);
+                  log_error (_("%s is not compliant with %s mode\n"),
+                             GPG_AGENT_NAME,
+                             gnupg_compliance_option_string (opt.compliance));
+                  write_status_error ("random-compliance", rc);
+                }
+            }
+#endif /*HAVE_W32_SYSTEM*/
+
         }
     }
 
diff --git a/g10/encrypt.c b/g10/encrypt.c
index 4b21a61..c63ec88 100644
--- a/g10/encrypt.c
+++ b/g10/encrypt.c
@@ -185,6 +185,16 @@ encrypt_simple (const char *filename, int mode, int use_seskey)
   progress_filter_context_t *pfx;
   int do_compress = !!default_compress_algo();
 
+  if (!gnupg_rng_is_compliant (opt.compliance))
+    {
+      rc = gpg_error (GPG_ERR_FORBIDDEN);
+      log_error (_("%s is not compliant with %s mode\n"),
+                 "RNG",
+                 gnupg_compliance_option_string (opt.compliance));
+      write_status_error ("random-compliance", rc);
+      return rc;
+    }
+
   pfx = new_progress_context ();
   memset( &cfx, 0, sizeof cfx);
   memset( &zfx, 0, sizeof zfx);
@@ -626,6 +636,16 @@ encrypt_crypt (ctrl_t ctrl, int filefd, const char *filename,
       goto leave;
     }
 
+  if (!gnupg_rng_is_compliant (opt.compliance))
+    {
+      rc = gpg_error (GPG_ERR_FORBIDDEN);
+      log_error (_("%s is not compliant with %s mode\n"),
+                 "RNG",
+                 gnupg_compliance_option_string (opt.compliance));
+      write_status_error ("random-compliance", rc);
+      goto leave;
+    }
+
   compliant = gnupg_cipher_is_compliant (CO_DE_VS, cfx.dek->algo,
                                          GCRY_CIPHER_MODE_CFB);
 
diff --git a/g10/sign.c b/g10/sign.c
index 0ba1151..f7dd974 100644
--- a/g10/sign.c
+++ b/g10/sign.c
@@ -299,6 +299,16 @@ do_sign (ctrl_t ctrl, PKT_public_key *pksk, PKT_signature *sig,
       goto leave;
     }
 
+  if (!gnupg_rng_is_compliant (opt.compliance))
+    {
+      err = gpg_error (GPG_ERR_FORBIDDEN);
+      log_error (_("%s is not compliant with %s mode\n"),
+                 "RNG",
+                 gnupg_compliance_option_string (opt.compliance));
+      write_status_error ("random-compliance", err);
+      goto leave;
+    }
+
   print_digest_algo_note (mdalgo);
   dp = gcry_md_read  (md, mdalgo);
   sig->digest_algo = mdalgo;
diff --git a/sm/call-agent.c b/sm/call-agent.c
index 0e47c14..ba8fb12 100644
--- a/sm/call-agent.c
+++ b/sm/call-agent.c
@@ -171,6 +171,25 @@ start_agent (ctrl_t ctrl)
                            str_pinentry_mode (opt.pinentry_mode),
                            gpg_strerror (rc));
             }
+
+          /* In DE_VS mode under Windows we require that the JENT RNG
+           * is active.  */
+#ifdef HAVE_W32_SYSTEM
+          if (!rc && opt.compliance == CO_DE_VS)
+            {
+              if (assuan_transact (agent_ctx, "GETINFO jent_active",
+                                   NULL, NULL, NULL, NULL, NULL, NULL))
+                {
+                  rc = gpg_error (GPG_ERR_FORBIDDEN);
+                  log_error (_("%s is not compliant with %s mode\n"),
+                             GPG_AGENT_NAME,
+                             gnupg_compliance_option_string (opt.compliance));
+                  gpgsm_status_with_error (ctrl, STATUS_ERROR,
+                                           "random-compliance", rc);
+                }
+            }
+#endif /*HAVE_W32_SYSTEM*/
+
         }
     }
 
diff --git a/sm/encrypt.c b/sm/encrypt.c
index 9e3216a..7351932 100644
--- a/sm/encrypt.c
+++ b/sm/encrypt.c
@@ -420,6 +420,17 @@ gpgsm_encrypt (ctrl_t ctrl, certlist_t recplist, int data_fd, estream_t out_fp)
       goto leave;
     }
 
+  if (!gnupg_rng_is_compliant (opt.compliance))
+    {
+      rc = gpg_error (GPG_ERR_FORBIDDEN);
+      log_error (_("%s is not compliant with %s mode\n"),
+                 "RNG",
+                 gnupg_compliance_option_string (opt.compliance));
+      gpgsm_status_with_error (ctrl, STATUS_ERROR,
+                               "random-compliance", rc);
+      goto leave;
+    }
+
   /* Create a session key */
   dek = xtrycalloc_secure (1, sizeof *dek);
   if (!dek)
diff --git a/sm/sign.c b/sm/sign.c
index 7ba2319..1411501 100644
--- a/sm/sign.c
+++ b/sm/sign.c
@@ -339,6 +339,17 @@ gpgsm_sign (ctrl_t ctrl, certlist_t signerlist,
       goto leave;
     }
 
+  if (!gnupg_rng_is_compliant (opt.compliance))
+    {
+      rc = gpg_error (GPG_ERR_FORBIDDEN);
+      log_error (_("%s is not compliant with %s mode\n"),
+                 "RNG",
+                 gnupg_compliance_option_string (opt.compliance));
+      gpgsm_status_with_error (ctrl, STATUS_ERROR,
+                               "random-compliance", rc);
+      goto leave;
+    }
+
   ctrl->pem_name = "SIGNED MESSAGE";
   rc = gnupg_ksba_create_writer
     (&b64writer, ((ctrl->create_pem? GNUPG_KSBA_IO_PEM : 0)

commit bbbd0db34b4e387f8dc089fb7d69fdcf2ed91a01
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 17 14:08:00 2017 +0200

    agent: New GETINFO sub-command jent_active.
    
    * agent/command.c (cmd_getinfo): Implement it for gcrypt >= 1.8.
    --
    
    For the de-vs compliance of gpg we need to check whether the Jitter
    RNG is used on Windows.  This change allows to test this for
    gpg-agent.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/command.c b/agent/command.c
index d370821..e387db5 100644
--- a/agent/command.c
+++ b/agent/command.c
@@ -2852,6 +2852,7 @@ static const char hlp_getinfo[] =
   "  cmd_has_option\n"
   "              - Returns OK if the command CMD implements the option OPT.\n"
   "  connections - Return number of active connections.\n"
+  "  jent_active - Returns OK if Libgcrypt's JENT is active.\n"
   "  restricted  - Returns OK if the connection is in restricted mode.\n";
 static gpg_error_t
 cmd_getinfo (assuan_context_t ctx, char *line)
@@ -2992,6 +2993,24 @@ cmd_getinfo (assuan_context_t ctx, char *line)
                 get_agent_active_connection_count ());
       rc = assuan_send_data (ctx, numbuf, strlen (numbuf));
     }
+  else if (!strcmp (line, "jent_active"))
+    {
+#if GCRYPT_VERSION_NUMBER >= 0x010800
+      char *buf;
+      char *fields[5];
+
+      buf = gcry_get_config (0, "rng-type");
+      if (buf
+          && split_fields_colon (buf, fields, DIM (fields)) >= 5
+          && atoi (fields[4]) > 0)
+        rc = 0;
+      else
+        rc = gpg_error (GPG_ERR_FALSE);
+      gcry_free (buf);
+#else
+      rc = gpg_error (GPG_ERR_FALSE);
+#endif
+    }
   else
     rc = set_error (GPG_ERR_ASS_PARAMETER, "unknown value for WHAT");
   return rc;

commit 849467870ee1c10e0a7b1e89cfc9e8214e4963fe
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 17 13:00:44 2017 +0200

    common: New function split_fields_colon.
    
    * common/stringhelp.c (split_fields_colon): New.
    * common/t-stringhelp.c (test_split_fields_colon): New test.
    (main): Call that test.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/stringhelp.c b/common/stringhelp.c
index 3b481e8..0abac8a 100644
--- a/common/stringhelp.c
+++ b/common/stringhelp.c
@@ -1339,6 +1339,42 @@ split_fields (char *string, char **array, int arraysize)
 }
 
 
+/* Split a string into colon delimited fields A pointer to each field
+ * is stored in ARRAY.  Stop splitting at ARRAYSIZE fields.  The
+ * function modifies STRING.  The number of parsed fields is returned.
+ * Note that leading and trailing spaces are not removed from the fields.
+ * Example:
+ *
+ *   char *fields[2];
+ *   if (split_fields (string, fields, DIM (fields)) < 2)
+ *     return  // Not enough args.
+ *   foo (fields[0]);
+ *   foo (fields[1]);
+ */
+int
+split_fields_colon (char *string, char **array, int arraysize)
+{
+  int n = 0;
+  char *p, *pend;
+
+  p = string;
+  do
+    {
+      if (n == arraysize)
+        break;
+      array[n++] = p;
+      pend = strchr (p, ':');
+      if (!pend)
+        break;
+      *pend++ = 0;
+      p = pend;
+    }
+  while (*p);
+
+  return n;
+}
+
+
 

 /* Version number parsing.  */
 
diff --git a/common/stringhelp.h b/common/stringhelp.h
index a643f35..5b07af9 100644
--- a/common/stringhelp.h
+++ b/common/stringhelp.h
@@ -151,6 +151,10 @@ char **strtokenize (const char *string, const char *delim);
  * provided ARRAY.  */
 int split_fields (char *string, char **array, int arraysize);
 
+/* Split STRING into colon delimited fields and store them in the
+ * provided ARRAY.  */
+int split_fields_colon (char *string, char **array, int arraysize);
+
 /* Return True if MYVERSION is greater or equal than REQ_VERSION.  */
 int compare_version_strings (const char *my_version, const char *req_version);
 
diff --git a/common/t-stringhelp.c b/common/t-stringhelp.c
index 189fed1..7c6fb80 100644
--- a/common/t-stringhelp.c
+++ b/common/t-stringhelp.c
@@ -761,6 +761,81 @@ test_split_fields (void)
 }
 
 
+static void
+test_split_fields_colon (void)
+{
+  struct {
+    const char *s;
+    int nfields;
+    const char *fields_expected[10];
+  } tv[] = {
+    {
+      "a:bc:cde:fghi:jklmn:  foo ", 6,
+      { "a", "bc", "cde", "fghi", "jklmn", "  foo ", NULL }
+    },
+    {
+      " a:bc: def ", 2,
+      { " a", "bc", NULL }
+    },
+    {
+      " a:bc :def ", 3,
+      { " a", "bc ", "def ", NULL }
+    },
+    {
+      " a:bc: def ", 4,
+      { " a", "bc", " def ", NULL }
+    },
+    {
+      "", 0,
+      { NULL }
+    }
+  };
+
+  int tidx;
+  char *fields[10];
+  int field_count_expected, nfields, field_count, i;
+  char *s2;
+
+  for (tidx = 0; tidx < DIM(tv); tidx++)
+    {
+      nfields = tv[tidx].nfields;
+      assert (nfields <= DIM (fields));
+
+      /* Count the fields.  */
+      for (field_count_expected = 0;
+           tv[tidx].fields_expected[field_count_expected];
+           field_count_expected ++)
+        ;
+      if (field_count_expected > nfields)
+        field_count_expected = nfields;
+
+      /* We need to copy s since split_fields modifies in place.  */
+      s2 = xstrdup (tv[tidx].s);
+      field_count = split_fields_colon (s2, fields, nfields);
+
+      if (field_count != field_count_expected)
+        {
+          printf ("%s: tidx %d: expected %d, got %d\n",
+                  __func__, tidx, field_count_expected, field_count);
+          fail (tidx * 1000);
+        }
+      else
+        {
+          for (i = 0; i < field_count_expected; i ++)
+            if (strcmp (tv[tidx].fields_expected[i], fields[i]))
+              {
+                printf ("%s: tidx %d, field %d: expected '%s', got '%s'\n",
+                        __func__,
+                        tidx, i, tv[tidx].fields_expected[i], fields[i]);
+                fail (tidx * 1000 + i + 1);
+              }
+        }
+
+      xfree (s2);
+    }
+}
+
+
 static char *
 stresc (char *s)
 {
@@ -996,6 +1071,7 @@ main (int argc, char **argv)
   test_strsplit ();
   test_strtokenize ();
   test_split_fields ();
+  test_split_fields_colon ();
   test_compare_version_strings ();
   test_format_text ();
 

-----------------------------------------------------------------------

Summary of changes:
 agent/command.c       | 19 +++++++++++++
 common/compliance.c   | 40 +++++++++++++++++++++++++++
 common/compliance.h   |  2 ++
 common/stringhelp.c   | 36 ++++++++++++++++++++++++
 common/stringhelp.h   |  4 +++
 common/t-stringhelp.c | 76 +++++++++++++++++++++++++++++++++++++++++++++++++++
 g10/call-agent.c      | 18 ++++++++++++
 g10/encrypt.c         | 20 ++++++++++++++
 g10/sign.c            | 10 +++++++
 sm/call-agent.c       | 19 +++++++++++++
 sm/encrypt.c          | 11 ++++++++
 sm/sign.c             | 11 ++++++++
 12 files changed, 266 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 17 17:20:56 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 17 Jul 2017 17:20:56 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 6199ba81f28f4eb2f6a14bfd90149b405298921d
Message-ID: <E1dX7pQ-0004y9-Th@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  6199ba81f28f4eb2f6a14bfd90149b405298921d (commit)
      from  91aac71723e2d6dc345da9a56c44f1645d567065 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6199ba81f28f4eb2f6a14bfd90149b405298921d
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 17 17:16:01 2017 +0200

    web: Announce release of Scute 1.5.0

diff --git a/web/index.org b/web/index.org
index ccb196e..2b8ab08 100644
--- a/web/index.org
+++ b/web/index.org
@@ -88,6 +88,13 @@ The latest release news:\\
 # GnuPG's latest news are available as [[http://feedvalidator.org/check.cgi?url%3Dhttps://www.gnupg.org/news.en.rss][RSS 2.0 compliant]] feed.  Just
 # point or paste the [[news.en.rss][RSS file]] into your aggregator.
 
+** Scute 1.5.0 released (2017-07-14)
+
+Scute is a PKCS#11 module built around the GnuPG Agent and the GnuPG
+Smart Card Daemon.  It allows you to use your OpenPGP smart card for TLS
+client authentication and S/MIME mail and document signing.
+Read the full [[https://lists.gnupg.org/pipermail/gnupg-announce/2017q3/000409.html][announcement mail]] for details.
+
 ** Libgcrypt 1.7.8 released (2017-06-29)                          :important:
 
 We are pleased to announce the availability of [[file:software/libgcrypt/index.org][Libgcrypt]] version

-----------------------------------------------------------------------

Summary of changes:
 web/index.org | 7 +++++++
 1 file changed, 7 insertions(+)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 18 10:21:09 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 18 Jul 2017 10:21:09 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-122-gecf73da
Message-ID: <E1dXNkk-00045z-3t@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  ecf73dafb7aafed0d0f339d07235b58c2113f94c (commit)
      from  de1e12504dd72bbedd3441be9aab3cad6dbca251 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ecf73dafb7aafed0d0f339d07235b58c2113f94c
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jul 18 10:16:07 2017 +0200

    api: New function gcry_mpi_point_copy.
    
    * src/gcrypt.h.in (gcry_mpi_point_copy): New.
    (mpi_point_copy): New macro.
    * src/visibility.c (gcry_mpi_point_copy): New.
    * src/libgcrypt.def, src/libgcrypt.vers: Add function.
    * mpi/ec.c (_gcry_mpi_point_copy): New.
    * tests/t-mpi-point.c (set_get_point): Add test.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/NEWS b/NEWS
index b29bb89..17c9a42 100644
--- a/NEWS
+++ b/NEWS
@@ -72,6 +72,7 @@ Noteworthy changes in version 1.8.0 (unreleased)  [C21/A1/R_]
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    GCRYCTL_REINIT_SYSCALL_CLAMP    NEW macro.
    gcry_get_config                 NEW function.
+   gcry_mpi_point_copy             NEW function.
    gcry_md_info                    DEPRECATED.
 
 
diff --git a/doc/gcrypt.texi b/doc/gcrypt.texi
index cab1318..649332b 100644
--- a/doc/gcrypt.texi
+++ b/doc/gcrypt.texi
@@ -4876,6 +4876,13 @@ Release @var{point} and free all associated resources.  Passing
 @code{NULL} is allowed and ignored.
 @end deftypefun
 
+ at deftypefun gcry_mpi_point_t gcry_mpi_point_copy (@w{gcry_mpi_point_t @var{point}})
+
+Allocate and return a new point object and initialize it with
+ at var{point}.  If @var{point} is NULL the function is identical to
+ at code{gcry_mpi_point_new(0)}.
+ at end deftypefun
+
 @deftypefun void gcry_mpi_point_get (@w{gcry_mpi_t @var{x}}, @
  @w{gcry_mpi_t @var{y}}, @w{gcry_mpi_t @var{z}}, @
  @w{gcry_mpi_point_t @var{point}})
diff --git a/mpi/ec.c b/mpi/ec.c
index 8a6a656..a0f7357 100644
--- a/mpi/ec.c
+++ b/mpi/ec.c
@@ -139,6 +139,20 @@ point_set (mpi_point_t d, mpi_point_t s)
 }
 
 
+/* Return a copy of POINT. */
+gcry_mpi_point_t
+_gcry_mpi_point_copy (gcry_mpi_point_t point)
+{
+  mpi_point_t newpoint;
+
+  newpoint = _gcry_mpi_point_new (0);
+  if (point)
+    point_set (newpoint, point);
+
+  return newpoint;
+}
+
+
 static void
 point_resize (mpi_point_t p, mpi_ec_t ctx)
 {
diff --git a/src/gcrypt-int.h b/src/gcrypt-int.h
index ef5337b..ddcafa5 100644
--- a/src/gcrypt-int.h
+++ b/src/gcrypt-int.h
@@ -400,6 +400,7 @@ int _gcry_mpi_gcd (gcry_mpi_t g, gcry_mpi_t a, gcry_mpi_t b);
 int _gcry_mpi_invm (gcry_mpi_t x, gcry_mpi_t a, gcry_mpi_t m);
 gcry_mpi_point_t _gcry_mpi_point_new (unsigned int nbits);
 void _gcry_mpi_point_release (gcry_mpi_point_t point);
+gcry_mpi_point_t _gcry_mpi_point_copy (gcry_mpi_point_t point);
 void _gcry_mpi_point_get (gcry_mpi_t x, gcry_mpi_t y, gcry_mpi_t z,
                          gcry_mpi_point_t point);
 void _gcry_mpi_point_snatch_get (gcry_mpi_t x, gcry_mpi_t y, gcry_mpi_t z,
@@ -498,6 +499,8 @@ int _gcry_mpi_get_flag (gcry_mpi_t a, enum gcry_mpi_flag flag);
     }                                            \
   while (0)
 
+#define mpi_point_copy(p)      _gcry_mpi_point_copy((p))
+
 #define mpi_point_get(x,y,z,p)        _gcry_mpi_point_get((x),(y),(z),(p))
 #define mpi_point_snatch_get(x,y,z,p) _gcry_mpi_point_snatch_get((x),(y), \
                                                                  (z),(p))
diff --git a/src/gcrypt.h.in b/src/gcrypt.h.in
index 9a9acc4..68c1f9e 100644
--- a/src/gcrypt.h.in
+++ b/src/gcrypt.h.in
@@ -698,6 +698,9 @@ gcry_mpi_point_t gcry_mpi_point_new (unsigned int nbits);
 /* Release the object POINT.  POINT may be NULL. */
 void gcry_mpi_point_release (gcry_mpi_point_t point);
 
+/* Return a copy of POINT. */
+gcry_mpi_point_t gcry_mpi_point_copy (gcry_mpi_point_t point);
+
 /* Store the projective coordinates from POINT into X, Y, and Z.  */
 void gcry_mpi_point_get (gcry_mpi_t x, gcry_mpi_t y, gcry_mpi_t z,
                          gcry_mpi_point_t point);
@@ -868,6 +871,7 @@ gcry_mpi_t _gcry_mpi_get_const (int no);
       (p) = NULL;                               \
     }                                           \
   while (0)
+#define mpi_point_copy(p)             gcry_mpi_point_copy((p))
 #define mpi_point_get(x,y,z,p)        gcry_mpi_point_get((x),(y),(z),(p))
 #define mpi_point_snatch_get(x,y,z,p) gcry_mpi_point_snatch_get((x),(y),(z),(p))
 #define mpi_point_set(p,x,y,z)        gcry_mpi_point_set((p),(x),(y),(z))
diff --git a/src/libgcrypt.def b/src/libgcrypt.def
index c4a9eac..a76b377 100644
--- a/src/libgcrypt.def
+++ b/src/libgcrypt.def
@@ -284,4 +284,6 @@ EXPORTS
 
       gcry_get_config           @247
 
+      gcry_mpi_point_copy       @248
+
 ;; end of file with public symbols for Windows.
diff --git a/src/libgcrypt.vers b/src/libgcrypt.vers
index 1d2d150..1aa830f 100644
--- a/src/libgcrypt.vers
+++ b/src/libgcrypt.vers
@@ -107,6 +107,7 @@ GCRYPT_1.6 {
     gcry_mpi_ec_get_affine;
     gcry_mpi_ec_dup; gcry_mpi_ec_add; gcry_mpi_ec_sub; gcry_mpi_ec_mul;
     gcry_mpi_ec_curve_point; gcry_mpi_ec_decode_point;
+    gcry_mpi_point_copy;
 
     gcry_log_debug;
     gcry_log_debughex; gcry_log_debugmpi; gcry_log_debugpnt; gcry_log_debugsxp;
diff --git a/src/visibility.c b/src/visibility.c
index fe46c82..104c70d 100644
--- a/src/visibility.c
+++ b/src/visibility.c
@@ -484,6 +484,12 @@ gcry_mpi_point_release (gcry_mpi_point_t point)
   _gcry_mpi_point_release (point);
 }
 
+gcry_mpi_point_t
+gcry_mpi_point_copy (gcry_mpi_point_t point)
+{
+  return _gcry_mpi_point_copy (point);
+}
+
 void
 gcry_mpi_point_get (gcry_mpi_t x, gcry_mpi_t y, gcry_mpi_t z,
                     gcry_mpi_point_t point)
diff --git a/src/visibility.h b/src/visibility.h
index d28993a..df2caf6 100644
--- a/src/visibility.h
+++ b/src/visibility.h
@@ -246,6 +246,7 @@ MARK_VISIBLEX (gcry_mpi_new)
 MARK_VISIBLEX (gcry_mpi_point_get)
 MARK_VISIBLEX (gcry_mpi_point_new)
 MARK_VISIBLEX (gcry_mpi_point_release)
+MARK_VISIBLEX (gcry_mpi_point_copy)
 MARK_VISIBLEX (gcry_mpi_point_set)
 MARK_VISIBLEX (gcry_mpi_point_snatch_get)
 MARK_VISIBLEX (gcry_mpi_point_snatch_set)
@@ -466,6 +467,7 @@ MARK_VISIBLEX (_gcry_mpi_get_const)
 #define gcry_mpi_point_get          _gcry_USE_THE_UNDERSCORED_FUNCTION
 #define gcry_mpi_point_new          _gcry_USE_THE_UNDERSCORED_FUNCTION
 #define gcry_mpi_point_release      _gcry_USE_THE_UNDERSCORED_FUNCTION
+#define gcry_mpi_point_copy         _gcry_USE_THE_UNDERSCORED_FUNCTION
 #define gcry_mpi_point_set          _gcry_USE_THE_UNDERSCORED_FUNCTION
 #define gcry_mpi_point_snatch_get   _gcry_USE_THE_UNDERSCORED_FUNCTION
 #define gcry_mpi_point_snatch_set   _gcry_USE_THE_UNDERSCORED_FUNCTION
diff --git a/tests/t-mpi-point.c b/tests/t-mpi-point.c
index 9919932..1eaa08a 100644
--- a/tests/t-mpi-point.c
+++ b/tests/t-mpi-point.c
@@ -306,7 +306,7 @@ ec_p_new (gcry_ctx_t *r_ctx, gcry_mpi_t p, gcry_mpi_t a)
 static void
 set_get_point (void)
 {
-  gcry_mpi_point_t point;
+  gcry_mpi_point_t point, point2;
   gcry_mpi_t x, y, z;
 
   wherestr = "set_get_point";
@@ -350,7 +350,22 @@ set_get_point (void)
       || gcry_mpi_cmp_ui (y, 42) || gcry_mpi_cmp_ui (z, 11371))
     fail ("point_snatch_set/point_get failed\n");
 
+  point2 = gcry_mpi_point_copy (point);
+
+  gcry_mpi_point_get (x, y, z, point2);
+  if (gcry_mpi_cmp_ui (x, 17)
+      || gcry_mpi_cmp_ui (y, 42) || gcry_mpi_cmp_ui (z, 11371))
+    fail ("point_copy failed (1)\n");
+
   gcry_mpi_point_release (point);
+
+  gcry_mpi_point_get (x, y, z, point2);
+  if (gcry_mpi_cmp_ui (x, 17)
+      || gcry_mpi_cmp_ui (y, 42) || gcry_mpi_cmp_ui (z, 11371))
+    fail ("point_copy failed (2)\n");
+
+  gcry_mpi_point_release (point2);
+
   gcry_mpi_release (x);
   gcry_mpi_release (y);
   gcry_mpi_release (z);

-----------------------------------------------------------------------

Summary of changes:
 NEWS                |  1 +
 doc/gcrypt.texi     |  7 +++++++
 mpi/ec.c            | 14 ++++++++++++++
 src/gcrypt-int.h    |  3 +++
 src/gcrypt.h.in     |  4 ++++
 src/libgcrypt.def   |  2 ++
 src/libgcrypt.vers  |  1 +
 src/visibility.c    |  6 ++++++
 src/visibility.h    |  2 ++
 tests/t-mpi-point.c | 17 ++++++++++++++++-
 10 files changed, 56 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 18 13:57:04 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 18 Jul 2017 13:57:04 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-103-gb231959
Message-ID: <E1dXR7h-0001Qm-Vl@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  b231959728a0056094134e0fca8cc916c24ef37e (commit)
       via  ebb35ed7110d1a29061dfb4ccb9038645b20d7f4 (commit)
       via  3d670fa973a03ea88b5f9459b3222a951136dd7a (commit)
      from  a149afe338d61d86985c533cde5e7dbcd31e8698 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b231959728a0056094134e0fca8cc916c24ef37e
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jul 18 12:53:55 2017 +0200

    dirmngr: Honor http keyserver URLs.
    
    * dirmngr/http.c (parse_uri): Keep an unmodified copy of the URI.
    * dirmngr/http.h (struct parsed_uri_s): New field 'original'.
    * dirmngr/ks-action.c (ks_action_get): Properly handle http and https
    URLs.
    --
    
    If a key has a http or https URL as preferred keyserver, fetch the key
    from there.  Previously, dirmngr unconditionally interpreted these
    URLs as hkp servers.
    
    GnuPG-bug-id: 2924
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 7c9a682..0cb2708 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -1219,10 +1219,12 @@ parse_uri (parsed_uri_t *ret_uri, const char *uri,
 {
   gpg_err_code_t ec;
 
-  *ret_uri = xtrycalloc (1, sizeof **ret_uri + strlen (uri));
+  *ret_uri = xtrycalloc (1, sizeof **ret_uri + 2 * strlen (uri) + 1);
   if (!*ret_uri)
     return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
   strcpy ((*ret_uri)->buffer, uri);
+  strcpy ((*ret_uri)->buffer + strlen (uri) + 1, uri);
+  (*ret_uri)->original = (*ret_uri)->buffer + strlen (uri) + 1;
   ec = do_parse_uri (*ret_uri, 0, no_scheme_check, force_tls);
   if (ec)
     {
diff --git a/dirmngr/http.h b/dirmngr/http.h
index 448cd04..9fa462c 100644
--- a/dirmngr/http.h
+++ b/dirmngr/http.h
@@ -47,6 +47,7 @@ typedef struct uri_tuple_s *uri_tuple_t;
 struct parsed_uri_s
 {
   /* All these pointers point into BUFFER; most stuff is not escaped. */
+  char *original;       /* Unmodified copy of the parsed URI.  */
   char *scheme;	        /* Pointer to the scheme string (always lowercase). */
   unsigned int is_http:1; /* This is a HTTP style URI.   */
   unsigned int use_tls:1; /* Whether TLS should be used. */
diff --git a/dirmngr/ks-action.c b/dirmngr/ks-action.c
index 1087bb5..857aab1 100644
--- a/dirmngr/ks-action.c
+++ b/dirmngr/ks-action.c
@@ -232,7 +232,10 @@ ks_action_get (ctrl_t ctrl, uri_item_t keyservers,
      Need to think about a better strategy.  */
   for (uri = keyservers; !err && uri; uri = uri->next)
     {
-      int is_http = uri->parsed_uri->is_http;
+      int is_hkp_s = (strcmp (uri->parsed_uri->scheme, "hkp") == 0
+                      || strcmp (uri->parsed_uri->scheme, "hkps") == 0);
+      int is_http_s = (strcmp (uri->parsed_uri->scheme, "http") == 0
+                       || strcmp (uri->parsed_uri->scheme, "https") == 0);
       int is_ldap = 0;
 
 #if USE_LDAP
@@ -241,7 +244,7 @@ ks_action_get (ctrl_t ctrl, uri_item_t keyservers,
 		 || strcmp (uri->parsed_uri->scheme, "ldapi") == 0);
 #endif
 
-      if (is_http || is_ldap)
+      if (is_hkp_s || is_http_s || is_ldap)
         {
           any_server = 1;
           for (sl = patterns; !err && sl; sl = sl->next)
@@ -251,9 +254,12 @@ ks_action_get (ctrl_t ctrl, uri_item_t keyservers,
 		err = ks_ldap_get (ctrl, uri->parsed_uri, sl->d, &infp);
 	      else
 #endif
-		{
-	          err = ks_hkp_get (ctrl, uri->parsed_uri, sl->d, &infp);
-	        }
+              if (is_hkp_s)
+                err = ks_hkp_get (ctrl, uri->parsed_uri, sl->d, &infp);
+              else if (is_http_s)
+                err = ks_http_fetch (ctrl, uri->parsed_uri->original, &infp);
+              else
+                BUG ();
 
               if (err)
                 {

commit ebb35ed7110d1a29061dfb4ccb9038645b20d7f4
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jul 18 13:47:53 2017 +0200

    dirmngr: Fix memory leak.
    
    * dirmngr/http.c (parse_uri): Properly free partial results.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 3baa53a..7c9a682 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -1226,7 +1226,7 @@ parse_uri (parsed_uri_t *ret_uri, const char *uri,
   ec = do_parse_uri (*ret_uri, 0, no_scheme_check, force_tls);
   if (ec)
     {
-      xfree (*ret_uri);
+      http_release_parsed_uri (*ret_uri);
       *ret_uri = NULL;
     }
   return gpg_err_make (default_errsource, ec);

commit 3d670fa973a03ea88b5f9459b3222a951136dd7a
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jul 18 13:39:29 2017 +0200

    dirmngr: Fix memory leak.
    
    * dirmngr/http.c (http_release_parsed_uri): Free 'params'.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 0544c9b..3baa53a 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -1255,6 +1255,11 @@ http_release_parsed_uri (parsed_uri_t uri)
     {
       uri_tuple_t r, r2;
 
+      for (r = uri->params; r; r = r2)
+	{
+	  r2 = r->next;
+	  xfree (r);
+	}
       for (r = uri->query; r; r = r2)
 	{
 	  r2 = r->next;

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/http.c      | 11 +++++++++--
 dirmngr/http.h      |  1 +
 dirmngr/ks-action.c | 16 +++++++++++-----
 3 files changed, 21 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 18 14:25:00 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 18 Jul 2017 14:25:00 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 46bd6086b946f5556d2be750758e2618f2e9f68b
Message-ID: <E1dXRYi-0005J8-Nd@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  46bd6086b946f5556d2be750758e2618f2e9f68b (commit)
      from  6199ba81f28f4eb2f6a14bfd90149b405298921d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 46bd6086b946f5556d2be750758e2618f2e9f68b
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jul 18 14:24:47 2017 +0200

    jenkins: fix running tests on windows

diff --git a/misc/jenkins/bin/run-tests.bat b/misc/jenkins/bin/run-tests.bat
index 996809f..9b0527a 100644
--- a/misc/jenkins/bin/run-tests.bat
+++ b/misc/jenkins/bin/run-tests.bat
@@ -21,7 +21,7 @@ cd /d %WD%
 mkdir openpgp
 cd openpgp
 
-set srcdir=%BIN_PREFIX%/tests/openpgp
+set abs_top_srcdir=%BIN_PREFIX%/tests/openpgp
 %BIN_PREFIX%\gpgscm.exe %srcdir%/run-tests.scm --parallel version.scm enarmor.scm mds.scm decrypt.scm decrypt-multifile.scm decrypt-dsa.scm decrypt-session-key.scm sigs.scm sigs-dsa.scm encrypt.scm encrypt-multifile.scm encrypt-dsa.scm compression.scm seat.scm clearsig.scm encryptp.scm detach.scm detachm.scm armsigs.scm armencrypt.scm armencryptp.scm signencrypt.scm signencrypt-dsa.scm armsignencrypt.scm armdetach.scm armdetachm.scm genkey1024.scm conventional.scm conventional-mdc.scm multisig.scm verify.scm verify-multifile.scm gpgv-forged-keyring.scm armor.scm import.scm import-revocation-certificate.scm ecc.scm 4gb-packet.scm tofu.scm use-exact-key.scm default-key.scm export.scm ssh-import.scm ssh-export.scm quick-key-manipulation.scm key-selection.scm delete-keys.scm gpgconf.scm issue2015.scm issue2346.scm issue2417.scm issue2419.scm issue2929.scm
 
 echo Running gpgsm tests...
@@ -30,7 +30,7 @@ mkdir gpgsm
 cd gpgsm
 
 set GPGSCM_PATH=%BIN_PREFIX%/tests/gpgscm;%BIN_PREFIX%/tests/openpgp;%BIN_PREFIX%/tests/gpgsm
-set srcdir=%BIN_PREFIX%/tests/gpgsm
+set abs_top_srcdir=%BIN_PREFIX%/tests/gpgsm
 %BIN_PREFIX%\gpgscm.exe %srcdir%/run-tests.scm --parallel import.scm encrypt.scm verify.scm decrypt.scm sign.scm export.scm
 
 echo Running GPGME tests...
@@ -40,7 +40,7 @@ cd gpgme
 
 rem set verbose=3
 set GPGSCM_PATH=%BIN_PREFIX%/tests/gpgscm;%BIN_PREFIX%/tests/openpgp;%BIN_PREFIX%/tests/gpgme
-set srcdir=%BIN_PREFIX%/tests/gpgme
+set abs_top_srcdir=%BIN_PREFIX%/tests/gpgme
 set XTEST_GPGME_SRCDIR=%BIN_PREFIX%/gpgme
 set XTEST_GPGME_BUILDDIR=%BIN_PREFIX%/gpgme/obj.w32
 %BIN_PREFIX%\gpgscm.exe %srcdir%/run-tests.scm --parallel

-----------------------------------------------------------------------

Summary of changes:
 misc/jenkins/bin/run-tests.bat | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 18 14:30:12 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 18 Jul 2017 14:30:12 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-123-g95194c5
Message-ID: <E1dXRdk-0006MF-NN@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  95194c550443e8d5558856633f920daec8a975c4 (commit)
      from  ecf73dafb7aafed0d0f339d07235b58c2113f94c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 95194c550443e8d5558856633f920daec8a975c4
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jul 18 14:11:26 2017 +0200

    mac: Add selftests for HMAC-SHA3-xxx.
    
    * cipher/hmac-tests.c (check_one): Add arg trunc and change all
    callers to pass false.
    (selftests_sha3): New.
    (run_selftests): Call new selftests.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/cipher/hmac-tests.c b/cipher/hmac-tests.c
index 8c04708..78d260a 100644
--- a/cipher/hmac-tests.c
+++ b/cipher/hmac-tests.c
@@ -20,13 +20,18 @@
 /*
    Although algorithm self-tests are usually implemented in the module
    implementing the algorithm, the case for HMAC is different because
-   HMAC is implemnetd on a higher level using a special feature of the
+   HMAC is implemented on a higher level using a special feature of the
    gcry_md_ functions.  It would be possible to do this also in the
    digest algorithm modules, but that would blow up the code too much
    and spread the hmac tests over several modules.
 
    Thus we implement all HMAC tests in this test module and provide a
    function to run the tests.
+
+   To run all the Libgcrypt selftest in a verbose mode, use
+
+   $ tests/basic --selftest
+
 */
 
 #include <config.h>
@@ -42,21 +47,30 @@
 #include "hmac256.h"
 
 /* Check one HMAC with digest ALGO using the regualr HAMC
-   API. (DATA,DATALEN) is the data to be MACed, (KEY,KEYLEN) the key
-   and (EXPECT,EXPECTLEN) the expected result.  Returns NULL on
-   succdess or a string describing the failure.  */
+ * API. (DATA,DATALEN) is the data to be MACed, (KEY,KEYLEN) the key
+ * and (EXPECT,EXPECTLEN) the expected result.  If TRUNC is set, the
+ * EXPECTLEN may be less than the digest length.  Returns NULL on
+ * success or a string describing the failure.  */
 static const char *
 check_one (int algo,
            const void *data, size_t datalen,
            const void *key, size_t keylen,
-           const void *expect, size_t expectlen)
+           const void *expect, size_t expectlen, int trunc)
 {
   gcry_md_hd_t hd;
   const unsigned char *digest;
 
 /*   printf ("HMAC algo %d\n", algo); */
-  if (_gcry_md_get_algo_dlen (algo) != expectlen)
-    return "invalid tests data";
+  if (trunc)
+    {
+      if (_gcry_md_get_algo_dlen (algo) < expectlen)
+        return "invalid tests data";
+    }
+  else
+    {
+      if (_gcry_md_get_algo_dlen (algo) != expectlen)
+        return "invalid tests data";
+    }
   if (_gcry_md_open (&hd, algo, GCRY_MD_FLAG_HMAC))
     return "gcry_md_open failed";
   if (_gcry_md_setkey (hd, key, keylen))
@@ -107,7 +121,7 @@ selftests_sha1 (int extended, selftest_report_func_t report)
                       "Sample #1", 9,
                       key, 64,
                       "\x4f\x4c\xa3\xd5\xd6\x8b\xa7\xcc\x0a\x12"
-                      "\x08\xc9\xc6\x1e\x9c\x5d\xa0\x40\x3c\x0a", 20);
+                      "\x08\xc9\xc6\x1e\x9c\x5d\xa0\x40\x3c\x0a", 20, 0);
   if (errtxt)
     goto failed;
 
@@ -120,7 +134,7 @@ selftests_sha1 (int extended, selftest_report_func_t report)
                           "Sample #2", 9,
                           key, 20,
                           "\x09\x22\xd3\x40\x5f\xaa\x3d\x19\x4f\x82"
-                          "\xa4\x58\x30\x73\x7d\x5c\xc6\xc7\x5d\x24", 20);
+                          "\xa4\x58\x30\x73\x7d\x5c\xc6\xc7\x5d\x24", 20, 0);
       if (errtxt)
         goto failed;
 
@@ -131,7 +145,7 @@ selftests_sha1 (int extended, selftest_report_func_t report)
                           "Sample #3", 9,
                           key, 100,
                           "\xbc\xf4\x1e\xab\x8b\xb2\xd8\x02\xf3\xd0"
-                          "\x5c\xaf\x7c\xb0\x92\xec\xf8\xd1\xa3\xaa", 20 );
+                          "\x5c\xaf\x7c\xb0\x92\xec\xf8\xd1\xa3\xaa", 20, 0);
       if (errtxt)
         goto failed;
 
@@ -142,7 +156,7 @@ selftests_sha1 (int extended, selftest_report_func_t report)
                           "Sample #4", 9,
                           key, 49,
                           "\x9e\xa8\x86\xef\xe2\x68\xdb\xec\xce\x42"
-                          "\x0c\x75\x24\xdf\x32\xe0\x75\x1a\x2a\x26", 20 );
+                          "\x0c\x75\x24\xdf\x32\xe0\x75\x1a\x2a\x26", 20, 0);
       if (errtxt)
         goto failed;
     }
@@ -255,7 +269,7 @@ selftests_sha224 (int extended, selftest_report_func_t report)
       errtxt = check_one (GCRY_MD_SHA224,
                           tv[tvidx].data, strlen (tv[tvidx].data),
                           tv[tvidx].key, strlen (tv[tvidx].key),
-                          tv[tvidx].expect, DIM (tv[tvidx].expect) );
+                          tv[tvidx].expect, DIM (tv[tvidx].expect), 0);
       if (errtxt)
         goto failed;
       if (!extended)
@@ -373,7 +387,7 @@ selftests_sha256 (int extended, selftest_report_func_t report)
       errtxt = check_one (GCRY_MD_SHA256,
                           tv[tvidx].data, strlen (tv[tvidx].data),
                           tv[tvidx].key, strlen (tv[tvidx].key),
-                          tv[tvidx].expect, DIM (tv[tvidx].expect) );
+                          tv[tvidx].expect, DIM (tv[tvidx].expect), 0);
       if (errtxt)
         goto failed;
 
@@ -523,7 +537,7 @@ selftests_sha384 (int extended, selftest_report_func_t report)
       errtxt = check_one (GCRY_MD_SHA384,
                           tv[tvidx].data, strlen (tv[tvidx].data),
                           tv[tvidx].key, strlen (tv[tvidx].key),
-                          tv[tvidx].expect, DIM (tv[tvidx].expect) );
+                          tv[tvidx].expect, DIM (tv[tvidx].expect), 0);
       if (errtxt)
         goto failed;
       if (!extended)
@@ -661,7 +675,7 @@ selftests_sha512 (int extended, selftest_report_func_t report)
       errtxt = check_one (GCRY_MD_SHA512,
                           tv[tvidx].data, strlen (tv[tvidx].data),
                           tv[tvidx].key, strlen (tv[tvidx].key),
-                          tv[tvidx].expect, DIM (tv[tvidx].expect) );
+                          tv[tvidx].expect, DIM (tv[tvidx].expect), 0);
       if (errtxt)
         goto failed;
       if (!extended)
@@ -678,6 +692,412 @@ selftests_sha512 (int extended, selftest_report_func_t report)
 
 
 
+/* Test for the SHA3 algorithms.  Vectors taken on 2017-07-18 from
+ * http://www.wolfgang-ehrhardt.de/hmac-sha3-testvectors.html  */
+static gpg_err_code_t
+selftests_sha3 (int hashalgo, int extended, selftest_report_func_t report)
+{
+  static struct
+  {
+    const char * const desc;
+    const char * const data;
+    const char * const key;
+    const char expect_224[28];
+    const char expect_256[32];
+    const char expect_384[48];
+    const char expect_512[64];
+    unsigned char trunc;
+  } tv[] =
+    {
+      { "data-9 key-20", /* Test 1 */
+        "Hi There",
+	"\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b"
+        "\x0b\x0b\x0b\x0b",
+
+        { 0x3b, 0x16, 0x54, 0x6b, 0xbc, 0x7b, 0xe2, 0x70,
+          0x6a, 0x03, 0x1d, 0xca, 0xfd, 0x56, 0x37, 0x3d,
+          0x98, 0x84, 0x36, 0x76, 0x41, 0xd8, 0xc5, 0x9a,
+          0xf3, 0xc8, 0x60, 0xf7                          },
+        { 0xba, 0x85, 0x19, 0x23, 0x10, 0xdf, 0xfa, 0x96,
+          0xe2, 0xa3, 0xa4, 0x0e, 0x69, 0x77, 0x43, 0x51,
+          0x14, 0x0b, 0xb7, 0x18, 0x5e, 0x12, 0x02, 0xcd,
+          0xcc, 0x91, 0x75, 0x89, 0xf9, 0x5e, 0x16, 0xbb  },
+        { 0x68, 0xd2, 0xdc, 0xf7, 0xfd, 0x4d, 0xdd, 0x0a,
+          0x22, 0x40, 0xc8, 0xa4, 0x37, 0x30, 0x5f, 0x61,
+          0xfb, 0x73, 0x34, 0xcf, 0xb5, 0xd0, 0x22, 0x6e,
+          0x1b, 0xc2, 0x7d, 0xc1, 0x0a, 0x2e, 0x72, 0x3a,
+          0x20, 0xd3, 0x70, 0xb4, 0x77, 0x43, 0x13, 0x0e,
+          0x26, 0xac, 0x7e, 0x3d, 0x53, 0x28, 0x86, 0xbd  },
+        { 0xeb, 0x3f, 0xbd, 0x4b, 0x2e, 0xaa, 0xb8, 0xf5,
+          0xc5, 0x04, 0xbd, 0x3a, 0x41, 0x46, 0x5a, 0xac,
+          0xec, 0x15, 0x77, 0x0a, 0x7c, 0xab, 0xac, 0x53,
+          0x1e, 0x48, 0x2f, 0x86, 0x0b, 0x5e, 0xc7, 0xba,
+          0x47, 0xcc, 0xb2, 0xc6, 0xf2, 0xaf, 0xce, 0x8f,
+          0x88, 0xd2, 0x2b, 0x6d, 0xc6, 0x13, 0x80, 0xf2,
+          0x3a, 0x66, 0x8f, 0xd3, 0x88, 0x8b, 0xb8, 0x05,
+          0x37, 0xc0, 0xa0, 0xb8, 0x64, 0x07, 0x68, 0x9e  }
+      },
+
+      { "data-28 key-4",  /* Test 2  */
+        /* Test with a key shorter than the length of the HMAC output. */
+        "what do ya want for nothing?",
+        "Jefe",
+
+        { 0x7f, 0xdb, 0x8d, 0xd8, 0x8b, 0xd2, 0xf6, 0x0d,
+          0x1b, 0x79, 0x86, 0x34, 0xad, 0x38, 0x68, 0x11,
+          0xc2, 0xcf, 0xc8, 0x5b, 0xfa, 0xf5, 0xd5, 0x2b,
+          0xba, 0xce, 0x5e, 0x66                          },
+        { 0xc7, 0xd4, 0x07, 0x2e, 0x78, 0x88, 0x77, 0xae,
+          0x35, 0x96, 0xbb, 0xb0, 0xda, 0x73, 0xb8, 0x87,
+          0xc9, 0x17, 0x1f, 0x93, 0x09, 0x5b, 0x29, 0x4a,
+          0xe8, 0x57, 0xfb, 0xe2, 0x64, 0x5e, 0x1b, 0xa5  },
+        { 0xf1, 0x10, 0x1f, 0x8c, 0xbf, 0x97, 0x66, 0xfd,
+          0x67, 0x64, 0xd2, 0xed, 0x61, 0x90, 0x3f, 0x21,
+          0xca, 0x9b, 0x18, 0xf5, 0x7c, 0xf3, 0xe1, 0xa2,
+          0x3c, 0xa1, 0x35, 0x08, 0xa9, 0x32, 0x43, 0xce,
+          0x48, 0xc0, 0x45, 0xdc, 0x00, 0x7f, 0x26, 0xa2,
+          0x1b, 0x3f, 0x5e, 0x0e, 0x9d, 0xf4, 0xc2, 0x0a  },
+        { 0x5a, 0x4b, 0xfe, 0xab, 0x61, 0x66, 0x42, 0x7c,
+          0x7a, 0x36, 0x47, 0xb7, 0x47, 0x29, 0x2b, 0x83,
+          0x84, 0x53, 0x7c, 0xdb, 0x89, 0xaf, 0xb3, 0xbf,
+          0x56, 0x65, 0xe4, 0xc5, 0xe7, 0x09, 0x35, 0x0b,
+          0x28, 0x7b, 0xae, 0xc9, 0x21, 0xfd, 0x7c, 0xa0,
+          0xee, 0x7a, 0x0c, 0x31, 0xd0, 0x22, 0xa9, 0x5e,
+          0x1f, 0xc9, 0x2b, 0xa9, 0xd7, 0x7d, 0xf8, 0x83,
+          0x96, 0x02, 0x75, 0xbe, 0xb4, 0xe6, 0x20, 0x24  }
+      },
+
+      { "data-50 key-20",  /* Test 3 */
+        /* Test with a combined length of key and data that is larger
+         * than 64 bytes (= block-size of SHA-224 and SHA-256).  */
+        "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd"
+        "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd"
+        "\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd\xdd"
+        "\xdd\xdd",
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa",
+
+        { 0x67, 0x6c, 0xfc, 0x7d, 0x16, 0x15, 0x36, 0x38,
+          0x78, 0x03, 0x90, 0x69, 0x2b, 0xe1, 0x42, 0xd2,
+          0xdf, 0x7c, 0xe9, 0x24, 0xb9, 0x09, 0xc0, 0xc0,
+          0x8d, 0xbf, 0xdc, 0x1a  },
+        { 0x84, 0xec, 0x79, 0x12, 0x4a, 0x27, 0x10, 0x78,
+          0x65, 0xce, 0xdd, 0x8b, 0xd8, 0x2d, 0xa9, 0x96,
+          0x5e, 0x5e, 0xd8, 0xc3, 0x7b, 0x0a, 0xc9, 0x80,
+          0x05, 0xa7, 0xf3, 0x9e, 0xd5, 0x8a, 0x42, 0x07  },
+        { 0x27, 0x5c, 0xd0, 0xe6, 0x61, 0xbb, 0x8b, 0x15,
+          0x1c, 0x64, 0xd2, 0x88, 0xf1, 0xf7, 0x82, 0xfb,
+          0x91, 0xa8, 0xab, 0xd5, 0x68, 0x58, 0xd7, 0x2b,
+          0xab, 0xb2, 0xd4, 0x76, 0xf0, 0x45, 0x83, 0x73,
+          0xb4, 0x1b, 0x6a, 0xb5, 0xbf, 0x17, 0x4b, 0xec,
+          0x42, 0x2e, 0x53, 0xfc, 0x31, 0x35, 0xac, 0x6e  },
+        { 0x30, 0x9e, 0x99, 0xf9, 0xec, 0x07, 0x5e, 0xc6,
+          0xc6, 0xd4, 0x75, 0xed, 0xa1, 0x18, 0x06, 0x87,
+          0xfc, 0xf1, 0x53, 0x11, 0x95, 0x80, 0x2a, 0x99,
+          0xb5, 0x67, 0x74, 0x49, 0xa8, 0x62, 0x51, 0x82,
+          0x85, 0x1c, 0xb3, 0x32, 0xaf, 0xb6, 0xa8, 0x9c,
+          0x41, 0x13, 0x25, 0xfb, 0xcb, 0xcd, 0x42, 0xaf,
+          0xcb, 0x7b, 0x6e, 0x5a, 0xab, 0x7e, 0xa4, 0x2c,
+          0x66, 0x0f, 0x97, 0xfd, 0x85, 0x84, 0xbf, 0x03  }
+      },
+
+      { "data-50 key-25",  /* Test 4 */
+        /* Test with a combined length of key and data that is larger
+         * than 64 bytes (= block-size of SHA-224 and SHA-256).  */
+        "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+        "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+        "\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd\xcd"
+        "\xcd\xcd",
+        "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10"
+        "\x11\x12\x13\x14\x15\x16\x17\x18\x19",
+
+        { 0xa9, 0xd7, 0x68, 0x5a, 0x19, 0xc4, 0xe0, 0xdb,
+          0xd9, 0xdf, 0x25, 0x56, 0xcc, 0x8a, 0x7d, 0x2a,
+          0x77, 0x33, 0xb6, 0x76, 0x25, 0xce, 0x59, 0x4c,
+          0x78, 0x27, 0x0e, 0xeb   },
+        { 0x57, 0x36, 0x6a, 0x45, 0xe2, 0x30, 0x53, 0x21,
+          0xa4, 0xbc, 0x5a, 0xa5, 0xfe, 0x2e, 0xf8, 0xa9,
+          0x21, 0xf6, 0xaf, 0x82, 0x73, 0xd7, 0xfe, 0x7b,
+          0xe6, 0xcf, 0xed, 0xb3, 0xf0, 0xae, 0xa6, 0xd7  },
+        { 0x3a, 0x5d, 0x7a, 0x87, 0x97, 0x02, 0xc0, 0x86,
+          0xbc, 0x96, 0xd1, 0xdd, 0x8a, 0xa1, 0x5d, 0x9c,
+          0x46, 0x44, 0x6b, 0x95, 0x52, 0x13, 0x11, 0xc6,
+          0x06, 0xfd, 0xc4, 0xe3, 0x08, 0xf4, 0xb9, 0x84,
+          0xda, 0x2d, 0x0f, 0x94, 0x49, 0xb3, 0xba, 0x84,
+          0x25, 0xec, 0x7f, 0xb8, 0xc3, 0x1b, 0xc1, 0x36  },
+        { 0xb2, 0x7e, 0xab, 0x1d, 0x6e, 0x8d, 0x87, 0x46,
+          0x1c, 0x29, 0xf7, 0xf5, 0x73, 0x9d, 0xd5, 0x8e,
+          0x98, 0xaa, 0x35, 0xf8, 0xe8, 0x23, 0xad, 0x38,
+          0xc5, 0x49, 0x2a, 0x20, 0x88, 0xfa, 0x02, 0x81,
+          0x99, 0x3b, 0xbf, 0xff, 0x9a, 0x0e, 0x9c, 0x6b,
+          0xf1, 0x21, 0xae, 0x9e, 0xc9, 0xbb, 0x09, 0xd8,
+          0x4a, 0x5e, 0xba, 0xc8, 0x17, 0x18, 0x2e, 0xa9,
+          0x74, 0x67, 0x3f, 0xb1, 0x33, 0xca, 0x0d, 0x1d  }
+      },
+
+      { "data-20 key-20 trunc",  /* Test 5 */
+        /* Test with a truncation of output to 128 bits.  */
+        "Test With Truncation",
+        "\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c\x0c"
+        "\x0c\x0c\x0c\x0c",
+
+        { 0x49, 0xfd, 0xd3, 0xab, 0xd0, 0x05, 0xeb, 0xb8,
+          0xae, 0x63, 0xfe, 0xa9, 0x46, 0xd1, 0x88, 0x3c  },
+        { 0x6e, 0x02, 0xc6, 0x45, 0x37, 0xfb, 0x11, 0x80,
+          0x57, 0xab, 0xb7, 0xfb, 0x66, 0xa2, 0x3b, 0x3c  },
+        { 0x47, 0xc5, 0x1a, 0xce, 0x1f, 0xfa, 0xcf, 0xfd,
+          0x74, 0x94, 0x72, 0x46, 0x82, 0x61, 0x57, 0x83  },
+        { 0x0f, 0xa7, 0x47, 0x59, 0x48, 0xf4, 0x3f, 0x48,
+          0xca, 0x05, 0x16, 0x67, 0x1e, 0x18, 0x97, 0x8c  },
+        16
+      },
+
+      { "data-54 key-131",  /* Test 6 */
+        /* Test with a key larger than 128 bytes (= block-size of
+         * SHA-384 and SHA-512).  */
+        "Test Using Larger Than Block-Size Key - Hash Key First",
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa",
+
+        { 0xb4, 0xa1, 0xf0, 0x4c, 0x00, 0x28, 0x7a, 0x9b,
+          0x7f, 0x60, 0x75, 0xb3, 0x13, 0xd2, 0x79, 0xb8,
+          0x33, 0xbc, 0x8f, 0x75, 0x12, 0x43, 0x52, 0xd0,
+          0x5f, 0xb9, 0x99, 0x5f  },
+        { 0xed, 0x73, 0xa3, 0x74, 0xb9, 0x6c, 0x00, 0x52,
+          0x35, 0xf9, 0x48, 0x03, 0x2f, 0x09, 0x67, 0x4a,
+          0x58, 0xc0, 0xce, 0x55, 0x5c, 0xfc, 0x1f, 0x22,
+          0x3b, 0x02, 0x35, 0x65, 0x60, 0x31, 0x2c, 0x3b  },
+        { 0x0f, 0xc1, 0x95, 0x13, 0xbf, 0x6b, 0xd8, 0x78,
+          0x03, 0x70, 0x16, 0x70, 0x6a, 0x0e, 0x57, 0xbc,
+          0x52, 0x81, 0x39, 0x83, 0x6b, 0x9a, 0x42, 0xc3,
+          0xd4, 0x19, 0xe4, 0x98, 0xe0, 0xe1, 0xfb, 0x96,
+          0x16, 0xfd, 0x66, 0x91, 0x38, 0xd3, 0x3a, 0x11,
+          0x05, 0xe0, 0x7c, 0x72, 0xb6, 0x95, 0x3b, 0xcc  },
+        { 0x00, 0xf7, 0x51, 0xa9, 0xe5, 0x06, 0x95, 0xb0,
+          0x90, 0xed, 0x69, 0x11, 0xa4, 0xb6, 0x55, 0x24,
+          0x95, 0x1c, 0xdc, 0x15, 0xa7, 0x3a, 0x5d, 0x58,
+          0xbb, 0x55, 0x21, 0x5e, 0xa2, 0xcd, 0x83, 0x9a,
+          0xc7, 0x9d, 0x2b, 0x44, 0xa3, 0x9b, 0xaf, 0xab,
+          0x27, 0xe8, 0x3f, 0xde, 0x9e, 0x11, 0xf6, 0x34,
+          0x0b, 0x11, 0xd9, 0x91, 0xb1, 0xb9, 0x1b, 0xf2,
+          0xee, 0xe7, 0xfc, 0x87, 0x24, 0x26, 0xc3, 0xa4  }
+      },
+
+      { "data-54 key-147",  /* Test 6a */
+        /* Test with a key larger than 144 bytes (= block-size of
+         * SHA3-224).  */
+        "Test Using Larger Than Block-Size Key - Hash Key First",
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa",
+
+        { 0xb9, 0x6d, 0x73, 0x0c, 0x14, 0x8c, 0x2d, 0xaa,
+          0xd8, 0x64, 0x9d, 0x83, 0xde, 0xfa, 0xa3, 0x71,
+          0x97, 0x38, 0xd3, 0x47, 0x75, 0x39, 0x7b, 0x75,
+          0x71, 0xc3, 0x85, 0x15  },
+        { 0xa6, 0x07, 0x2f, 0x86, 0xde, 0x52, 0xb3, 0x8b,
+          0xb3, 0x49, 0xfe, 0x84, 0xcd, 0x6d, 0x97, 0xfb,
+          0x6a, 0x37, 0xc4, 0xc0, 0xf6, 0x2a, 0xae, 0x93,
+          0x98, 0x11, 0x93, 0xa7, 0x22, 0x9d, 0x34, 0x67  },
+        { 0x71, 0x3d, 0xff, 0x03, 0x02, 0xc8, 0x50, 0x86,
+          0xec, 0x5a, 0xd0, 0x76, 0x8d, 0xd6, 0x5a, 0x13,
+          0xdd, 0xd7, 0x90, 0x68, 0xd8, 0xd4, 0xc6, 0x21,
+          0x2b, 0x71, 0x2e, 0x41, 0x64, 0x94, 0x49, 0x11,
+          0x14, 0x80, 0x23, 0x00, 0x44, 0x18, 0x5a, 0x99,
+          0x10, 0x3e, 0xd8, 0x20, 0x04, 0xdd, 0xbf, 0xcc  },
+        { 0xb1, 0x48, 0x35, 0xc8, 0x19, 0xa2, 0x90, 0xef,
+          0xb0, 0x10, 0xac, 0xe6, 0xd8, 0x56, 0x8d, 0xc6,
+          0xb8, 0x4d, 0xe6, 0x0b, 0xc4, 0x9b, 0x00, 0x4c,
+          0x3b, 0x13, 0xed, 0xa7, 0x63, 0x58, 0x94, 0x51,
+          0xe5, 0xdd, 0x74, 0x29, 0x28, 0x84, 0xd1, 0xbd,
+          0xce, 0x64, 0xe6, 0xb9, 0x19, 0xdd, 0x61, 0xdc,
+          0x9c, 0x56, 0xa2, 0x82, 0xa8, 0x1c, 0x0b, 0xd1,
+          0x4f, 0x1f, 0x36, 0x5b, 0x49, 0xb8, 0x3a, 0x5b  }
+      },
+
+      { "data-152 key-131",  /* Test 7  */
+        /* Test with a key and data that is larger than 128 bytes (=
+         * block-size of SHA-384 and SHA-512).  */
+        "This is a test using a larger than block-size key and a larger "
+        "than block-size data. The key needs to be hashed before being "
+        "used by the HMAC algorithm.",
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa",
+
+        { 0x05, 0xd8, 0xcd, 0x6d, 0x00, 0xfa, 0xea, 0x8d,
+          0x1e, 0xb6, 0x8a, 0xde, 0x28, 0x73, 0x0b, 0xbd,
+          0x3c, 0xba, 0xb6, 0x92, 0x9f, 0x0a, 0x08, 0x6b,
+          0x29, 0xcd, 0x62, 0xa0  },
+        { 0x65, 0xc5, 0xb0, 0x6d, 0x4c, 0x3d, 0xe3, 0x2a,
+          0x7a, 0xef, 0x87, 0x63, 0x26, 0x1e, 0x49, 0xad,
+          0xb6, 0xe2, 0x29, 0x3e, 0xc8, 0xe7, 0xc6, 0x1e,
+          0x8d, 0xe6, 0x17, 0x01, 0xfc, 0x63, 0xe1, 0x23  },
+        { 0x02, 0x6f, 0xdf, 0x6b, 0x50, 0x74, 0x1e, 0x37,
+          0x38, 0x99, 0xc9, 0xf7, 0xd5, 0x40, 0x6d, 0x4e,
+          0xb0, 0x9f, 0xc6, 0x66, 0x56, 0x36, 0xfc, 0x1a,
+          0x53, 0x00, 0x29, 0xdd, 0xf5, 0xcf, 0x3c, 0xa5,
+          0xa9, 0x00, 0xed, 0xce, 0x01, 0xf5, 0xf6, 0x1e,
+          0x2f, 0x40, 0x8c, 0xdf, 0x2f, 0xd3, 0xe7, 0xe8  },
+        { 0x38, 0xa4, 0x56, 0xa0, 0x04, 0xbd, 0x10, 0xd3,
+          0x2c, 0x9a, 0xb8, 0x33, 0x66, 0x84, 0x11, 0x28,
+          0x62, 0xc3, 0xdb, 0x61, 0xad, 0xcc, 0xa3, 0x18,
+          0x29, 0x35, 0x5e, 0xaf, 0x46, 0xfd, 0x5c, 0x73,
+          0xd0, 0x6a, 0x1f, 0x0d, 0x13, 0xfe, 0xc9, 0xa6,
+          0x52, 0xfb, 0x38, 0x11, 0xb5, 0x77, 0xb1, 0xb1,
+          0xd1, 0xb9, 0x78, 0x9f, 0x97, 0xae, 0x5b, 0x83,
+          0xc6, 0xf4, 0x4d, 0xfc, 0xf1, 0xd6, 0x7e, 0xba  }
+      },
+
+      { "data-152 key-147",  /* Test 7a  */
+        /* Test with a key larger than 144 bytes (= block-size of
+         * SHA3-224). */
+        "This is a test using a larger than block-size key and a larger "
+        "than block-size data. The key needs to be hashed before being "
+        "used by the HMAC algorithm.",
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa"
+        "\xaa\xaa\xaa",
+
+        { 0xc7, 0x9c, 0x9b, 0x09, 0x34, 0x24, 0xe5, 0x88,
+          0xa9, 0x87, 0x8b, 0xbc, 0xb0, 0x89, 0xe0, 0x18,
+          0x27, 0x00, 0x96, 0xe9, 0xb4, 0xb1, 0xa9, 0xe8,
+          0x22, 0x0c, 0x86, 0x6a  },
+        { 0xe6, 0xa3, 0x6d, 0x9b, 0x91, 0x5f, 0x86, 0xa0,
+          0x93, 0xca, 0xc7, 0xd1, 0x10, 0xe9, 0xe0, 0x4c,
+          0xf1, 0xd6, 0x10, 0x0d, 0x30, 0x47, 0x55, 0x09,
+          0xc2, 0x47, 0x5f, 0x57, 0x1b, 0x75, 0x8b, 0x5a  },
+        { 0xca, 0xd1, 0x8a, 0x8f, 0xf6, 0xc4, 0xcc, 0x3a,
+          0xd4, 0x87, 0xb9, 0x5f, 0x97, 0x69, 0xe9, 0xb6,
+          0x1c, 0x06, 0x2a, 0xef, 0xd6, 0x95, 0x25, 0x69,
+          0xe6, 0xe6, 0x42, 0x18, 0x97, 0x05, 0x4c, 0xfc,
+          0x70, 0xb5, 0xfd, 0xc6, 0x60, 0x5c, 0x18, 0x45,
+          0x71, 0x12, 0xfc, 0x6a, 0xaa, 0xd4, 0x55, 0x85  },
+        { 0xdc, 0x03, 0x0e, 0xe7, 0x88, 0x70, 0x34, 0xf3,
+          0x2c, 0xf4, 0x02, 0xdf, 0x34, 0x62, 0x2f, 0x31,
+          0x1f, 0x3e, 0x6c, 0xf0, 0x48, 0x60, 0xc6, 0xbb,
+          0xd7, 0xfa, 0x48, 0x86, 0x74, 0x78, 0x2b, 0x46,
+          0x59, 0xfd, 0xbd, 0xf3, 0xfd, 0x87, 0x78, 0x52,
+          0x88, 0x5c, 0xfe, 0x6e, 0x22, 0x18, 0x5f, 0xe7,
+          0xb2, 0xee, 0x95, 0x20, 0x43, 0x62, 0x9b, 0xc9,
+          0xd5, 0xf3, 0x29, 0x8a, 0x41, 0xd0, 0x2c, 0x66  }
+      }/*,*/
+
+      /* Our API does not allow to specify a bit count and thus we
+       * can't use the following test.  */
+      /* { "data-5bit key-4",  /\* Test 8  *\/ */
+      /*   /\* Test with data bit size no multiple of 8, the data bits are */
+      /*    * '11001' from the NIST example using SHA-3 order (= 5 bits */
+      /*    * from LSB hex byte 13 or 5 bits from MSB hex byte c8).  *\/ */
+      /*   "\xc8", */
+      /*   "Jefe", */
+
+      /*   { 0x5f, 0x8c, 0x0e, 0xa7, 0xfa, 0xfe, 0xcd, 0x0c, */
+      /*     0x34, 0x63, 0xaa, 0xd0, 0x97, 0x42, 0xce, 0xce, */
+      /*     0xb1, 0x42, 0xfe, 0x0a, 0xb6, 0xf4, 0x53, 0x94, */
+      /*     0x38, 0xc5, 0x9d, 0xe8  }, */
+      /*   { 0xec, 0x82, 0x22, 0x77, 0x3f, 0xac, 0x68, 0xb3, */
+      /*     0xd3, 0xdc, 0xb1, 0x82, 0xae, 0xc8, 0xb0, 0x50, */
+      /*     0x7a, 0xce, 0x44, 0x48, 0xd2, 0x0a, 0x11, 0x47, */
+      /*     0xe6, 0x82, 0x11, 0x8d, 0xa4, 0xe3, 0xf4, 0x4c  }, */
+      /*   { 0x21, 0xfb, 0xd3, 0xbf, 0x3e, 0xbb, 0xa3, 0xcf, */
+      /*     0xc9, 0xef, 0x64, 0xc0, 0x59, 0x1c, 0x92, 0xc5, */
+      /*     0xac, 0xb2, 0x65, 0xe9, 0x2d, 0x87, 0x61, 0xd1, */
+      /*     0xf9, 0x1a, 0x52, 0xa1, 0x03, 0xa6, 0xc7, 0x96, */
+      /*     0x94, 0xcf, 0xd6, 0x7a, 0x9a, 0x2a, 0xc1, 0x32, */
+      /*     0x4f, 0x02, 0xfe, 0xa6, 0x3b, 0x81, 0xef, 0xfc  }, */
+      /*   { 0x27, 0xf9, 0x38, 0x8c, 0x15, 0x67, 0xef, 0x4e, */
+      /*     0xf2, 0x00, 0x60, 0x2a, 0x6c, 0xf8, 0x71, 0xd6, */
+      /*     0x8a, 0x6f, 0xb0, 0x48, 0xd4, 0x73, 0x7a, 0xc4, */
+      /*     0x41, 0x8a, 0x2f, 0x02, 0x12, 0x89, 0xd1, 0x3d, */
+      /*     0x1f, 0xd1, 0x12, 0x0f, 0xec, 0xb9, 0xcf, 0x96, */
+      /*     0x4c, 0x5b, 0x11, 0x7a, 0xb5, 0xb1, 0x1c, 0x61, */
+      /*     0x4b, 0x2d, 0xa3, 0x9d, 0xad, 0xd5, 0x1f, 0x2f, */
+      /*     0x5e, 0x22, 0xaa, 0xcc, 0xec, 0x7d, 0x57, 0x6e  } */
+      /* } */
+
+    };
+  const char *what;
+  const char *errtxt;
+  int tvidx;
+  const char *expect;
+  int nexpect;
+
+  for (tvidx=0; tvidx < DIM(tv); tvidx++)
+    {
+      what = tv[tvidx].desc;
+      if (hashalgo == GCRY_MD_SHA3_224)
+        {
+          expect = tv[tvidx].expect_224;
+          nexpect = DIM (tv[tvidx].expect_224);
+        }
+      else if (hashalgo == GCRY_MD_SHA3_256)
+        {
+          expect = tv[tvidx].expect_256;
+          nexpect = DIM (tv[tvidx].expect_256);
+        }
+      else if (hashalgo == GCRY_MD_SHA3_384)
+        {
+          expect = tv[tvidx].expect_384;
+          nexpect = DIM (tv[tvidx].expect_384);
+        }
+      else if (hashalgo == GCRY_MD_SHA3_512)
+        {
+          expect = tv[tvidx].expect_512;
+          nexpect = DIM (tv[tvidx].expect_512);
+        }
+      else
+        BUG();
+
+      if (tv[tvidx].trunc && tv[tvidx].trunc < nexpect)
+        nexpect = tv[tvidx].trunc;
+
+      errtxt = check_one (hashalgo,
+                          tv[tvidx].data, strlen (tv[tvidx].data),
+                          tv[tvidx].key, strlen (tv[tvidx].key),
+                          expect, nexpect, !!tv[tvidx].trunc);
+      if (errtxt)
+        goto failed;
+      if (!extended)
+        break;
+    }
+
+  return 0; /* Succeeded. */
+
+ failed:
+  if (report)
+    report ("hmac", hashalgo, what, errtxt);
+  return GPG_ERR_SELFTEST_FAILED;
+}
+
+
 /* Run a full self-test for ALGO and return 0 on success.  */
 static gpg_err_code_t
 run_selftests (int algo, int extended, selftest_report_func_t report)
@@ -706,10 +1126,7 @@ run_selftests (int algo, int extended, selftest_report_func_t report)
     case GCRY_MD_SHA3_256:
     case GCRY_MD_SHA3_384:
     case GCRY_MD_SHA3_512:
-      ec = 0;  /* FIXME: Add selftests.  */
-#if defined(__GNUC__) && defined(IS_DEVELOPMENT_VERSION)
-# warning Please add self test functions for HMAC-SHA3
-#endif
+      ec = selftests_sha3 (algo, extended, report);
       break;
 
     default:

-----------------------------------------------------------------------

Summary of changes:
 cipher/hmac-tests.c | 455 +++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 436 insertions(+), 19 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 18 16:13:58 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 18 Jul 2017 16:13:58 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. cbc7b683f909b68cc421642c5f5cca0c944edfba
Message-ID: <E1dXTGA-0005UQ-MT@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  cbc7b683f909b68cc421642c5f5cca0c944edfba (commit)
      from  46bd6086b946f5556d2be750758e2618f2e9f68b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cbc7b683f909b68cc421642c5f5cca0c944edfba
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jul 18 16:13:53 2017 +0200

    jenkins: really fix running tests on windows

diff --git a/misc/jenkins/bin/run-tests.bat b/misc/jenkins/bin/run-tests.bat
index 9b0527a..99cfc53 100644
--- a/misc/jenkins/bin/run-tests.bat
+++ b/misc/jenkins/bin/run-tests.bat
@@ -1,6 +1,7 @@
 @echo off
 
 set BIN_PREFIX=d:\gnupg
+set abs_top_srcdir=%BIN_PREFIX%
 set PATH=%BIN_PREFIX%;%PATH%
 set GPGSCM_PATH=%BIN_PREFIX%/tests/gpgscm;%BIN_PREFIX%/tests/openpgp
 set EXEEXT=.exe
@@ -21,8 +22,7 @@ cd /d %WD%
 mkdir openpgp
 cd openpgp
 
-set abs_top_srcdir=%BIN_PREFIX%/tests/openpgp
-%BIN_PREFIX%\gpgscm.exe %srcdir%/run-tests.scm --parallel version.scm enarmor.scm mds.scm decrypt.scm decrypt-multifile.scm decrypt-dsa.scm decrypt-session-key.scm sigs.scm sigs-dsa.scm encrypt.scm encrypt-multifile.scm encrypt-dsa.scm compression.scm seat.scm clearsig.scm encryptp.scm detach.scm detachm.scm armsigs.scm armencrypt.scm armencryptp.scm signencrypt.scm signencrypt-dsa.scm armsignencrypt.scm armdetach.scm armdetachm.scm genkey1024.scm conventional.scm conventional-mdc.scm multisig.scm verify.scm verify-multifile.scm gpgv-forged-keyring.scm armor.scm import.scm import-revocation-certificate.scm ecc.scm 4gb-packet.scm tofu.scm use-exact-key.scm default-key.scm export.scm ssh-import.scm ssh-export.scm quick-key-manipulation.scm key-selection.scm delete-keys.scm gpgconf.scm issue2015.scm issue2346.scm issue2417.scm issue2419.scm issue2929.scm
+%BIN_PREFIX%\gpgscm.exe %abs_top_srcdir%/tests/openpgp/run-tests.scm --parallel version.scm enarmor.scm mds.scm decrypt.scm decrypt-multifile.scm decrypt-dsa.scm decrypt-session-key.scm sigs.scm sigs-dsa.scm encrypt.scm encrypt-multifile.scm encrypt-dsa.scm compression.scm seat.scm clearsig.scm encryptp.scm detach.scm detachm.scm armsigs.scm armencrypt.scm armencryptp.scm signencrypt.scm signencrypt-dsa.scm armsignencrypt.scm armdetach.scm armdetachm.scm genkey1024.scm conventional.scm conventional-mdc.scm multisig.scm verify.scm verify-multifile.scm gpgv-forged-keyring.scm armor.scm import.scm import-revocation-certificate.scm ecc.scm 4gb-packet.scm tofu.scm use-exact-key.scm default-key.scm export.scm ssh-import.scm ssh-export.scm quick-key-manipulation.scm key-selection.scm delete-keys.scm gpgconf.scm issue2015.scm issue2346.scm issue2417.scm issue2419.scm issue2929.scm
 
 echo Running gpgsm tests...
 cd /d %WD%
@@ -30,8 +30,7 @@ mkdir gpgsm
 cd gpgsm
 
 set GPGSCM_PATH=%BIN_PREFIX%/tests/gpgscm;%BIN_PREFIX%/tests/openpgp;%BIN_PREFIX%/tests/gpgsm
-set abs_top_srcdir=%BIN_PREFIX%/tests/gpgsm
-%BIN_PREFIX%\gpgscm.exe %srcdir%/run-tests.scm --parallel import.scm encrypt.scm verify.scm decrypt.scm sign.scm export.scm
+%BIN_PREFIX%\gpgscm.exe %abs_top_srcdir%/tests/gpgsm/run-tests.scm --parallel import.scm encrypt.scm verify.scm decrypt.scm sign.scm export.scm
 
 echo Running GPGME tests...
 cd /d %WD%
@@ -40,7 +39,6 @@ cd gpgme
 
 rem set verbose=3
 set GPGSCM_PATH=%BIN_PREFIX%/tests/gpgscm;%BIN_PREFIX%/tests/openpgp;%BIN_PREFIX%/tests/gpgme
-set abs_top_srcdir=%BIN_PREFIX%/tests/gpgme
 set XTEST_GPGME_SRCDIR=%BIN_PREFIX%/gpgme
 set XTEST_GPGME_BUILDDIR=%BIN_PREFIX%/gpgme/obj.w32
-%BIN_PREFIX%\gpgscm.exe %srcdir%/run-tests.scm --parallel
+%BIN_PREFIX%\gpgscm.exe %abs_top_srcdir%/tests/gpgme/run-tests.scm --parallel

-----------------------------------------------------------------------

Summary of changes:
 misc/jenkins/bin/run-tests.bat | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 18 16:16:55 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Tue, 18 Jul 2017 16:16:55 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-104-g2e1342b
Message-ID: <E1dXTJ1-0005bR-N6@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  2e1342b78b020f5b28359b08a4f63cf11479602f (commit)
      from  b231959728a0056094134e0fca8cc916c24ef37e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2e1342b78b020f5b28359b08a4f63cf11479602f
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jul 18 16:15:45 2017 +0200

    gpgscm,w32: Fix testing for absolute paths.
    
    * tests/gpgscm/main.c (path_absolute_p): New function.
    (load): Use new function.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/tests/gpgscm/main.c b/tests/gpgscm/main.c
index 4dae365..5540ac3 100644
--- a/tests/gpgscm/main.c
+++ b/tests/gpgscm/main.c
@@ -124,6 +124,19 @@ my_strusage( int level )
 }
 
 

+
+static int
+path_absolute_p (const char *p)
+{
+#if _WIN32
+  return ((strlen (p) > 2 && p[1] == ':' && (p[2] == '\\' || p[2] == '/'))
+          || p[0] == '\\' || p[0] == '/');
+#else
+  return p[0] == '/';
+#endif
+}
+
+
 /* Load the Scheme program from FILE_NAME.  If FILE_NAME is not an
    absolute path, and LOOKUP_IN_PATH is given, then it is qualified
    with the values in scmpath until the file is found.  */
@@ -139,9 +152,9 @@ load (scheme *sc, char *file_name,
   FILE *h = NULL;
 
   use_path =
-    lookup_in_path && ! (file_name[0] == '/' || scmpath_len == 0);
+    lookup_in_path && ! (path_absolute_p (file_name) || scmpath_len == 0);
 
-  if (file_name[0] == '/' || lookup_in_cwd || scmpath_len == 0)
+  if (path_absolute_p (file_name) || lookup_in_cwd || scmpath_len == 0)
     {
       h = fopen (file_name, "r");
       if (! h)

-----------------------------------------------------------------------

Summary of changes:
 tests/gpgscm/main.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 18 16:32:49 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 18 Jul 2017 16:32:49 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.7.3-126-g2c90586
Message-ID: <E1dXTYP-0008AL-Jt@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  2c905868abdfecad1442712346ed1a950faed3d7 (commit)
       via  850aca744eeda5fd410f478a0778e353045ac962 (commit)
       via  ffb66ff0f9af0f5caccfbe355684821e2a3861e7 (commit)
      from  95194c550443e8d5558856633f920daec8a975c4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2c905868abdfecad1442712346ed1a950faed3d7
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jul 18 16:27:13 2017 +0200

    Post release updates
    
    --

diff --git a/NEWS b/NEWS
index 66e3b62..5460bae 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,7 @@
+Noteworthy changes in version 1.8.1 (unreleased)  [C22/A2/R_]
+------------------------------------------------
+
+
 Noteworthy changes in version 1.8.0 (2017-07-18)  [C22/A2/R0]
 ------------------------------------------------
 
diff --git a/configure.ac b/configure.ac
index bbe8104..27faa7f 100644
--- a/configure.ac
+++ b/configure.ac
@@ -30,7 +30,7 @@ min_automake_version="1.14"
 # for the LT versions.
 m4_define(mym4_version_major, [1])
 m4_define(mym4_version_minor, [8])
-m4_define(mym4_version_micro, [0])
+m4_define(mym4_version_micro, [1])
 
 # Below is m4 magic to extract and compute the revision number, the
 # decimalized short revision number, a beta version string, and a flag

commit 850aca744eeda5fd410f478a0778e353045ac962
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jul 18 16:13:18 2017 +0200

    Release 1.8.0
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/AUTHORS b/AUTHORS
index c1e813d..0d1da12 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -21,7 +21,7 @@ year that would otherwise be listed individually.
 List of Copyright holders
 =========================
 
-  Copyright (C) 1989,1991-2016 Free Software Foundation, Inc.
+  Copyright (C) 1989,1991-2017 Free Software Foundation, Inc.
   Copyright (C) 1994 X Consortium
   Copyright (C) 1996 L. Peter Deutsch
   Copyright (C) 1997 Werner Koch
@@ -34,7 +34,7 @@ List of Copyright holders
   Copyright (C) 2012 Simon Josefsson, Niels M??ller
   Copyright (c) 2012 Intel Corporation
   Copyright (C) 2013 Christian Grothoff
-  Copyright (C) 2013-2016 Jussi Kivilinna
+  Copyright (C) 2013-2017 Jussi Kivilinna
   Copyright (C) 2013-2014 Dmitry Eremin-Solenikov
   Copyright (C) 2014 Stephan Mueller
   Copyright (C) 2017 Bundesamt f??r Sicherheit in der Informationstechnik
diff --git a/NEWS b/NEWS
index 17c9a42..66e3b62 100644
--- a/NEWS
+++ b/NEWS
@@ -1,17 +1,36 @@
-Noteworthy changes in version 1.8.0 (unreleased)  [C21/A1/R_]
+Noteworthy changes in version 1.8.0 (2017-07-18)  [C22/A2/R0]
 ------------------------------------------------
 
  * New interfaces:
 
+   - New cipher mode XTS
+
+   - New hash function Blake-2
+
+   - New function gcry_mpi_point_copy.
+
+   - New function gcry_get_config.
+
    - GCRYCTL_REINIT_SYSCALL_CLAMP allows to init nPth after Libgcrypt.
 
+   - New gobal configuration file /etc/gcrypt/random.conf.
+
  * Extended interfaces:
 
    - GCRYCTL_PRINT_CONFIG does now also print build information for
      libgpg-error and the used compiler version.
 
+   - GCRY_CIPHER_MODE_CFB8 is now supported.
+
+   - Add Stribog OIDs.  [also in 1.7.4]
+
  * Performance:
 
+   - A jitter based entropy collector is now used in addition to the
+     other entropy collectors.
+
+   - Optimized gcry_md_hash_buffers for SHA-256 and SHA-512.
+
    - More ARMv8/AArch32 improvements for AES, GCM, SHA-256, and SHA-1.
      [also in 1.7.4]
 
@@ -21,8 +40,6 @@ Noteworthy changes in version 1.8.0 (unreleased)  [C21/A1/R_]
    - Add bulk processing implementation for ARMv8/AArch32.
      [also in 1.7.4]
 
-   - Add Stribog OIDs.  [also in 1.7.4]
-
    - Improve the DRBG performance and sync the code with the Linux
      version.  [also in 1.7.4]
 
@@ -67,15 +84,22 @@ Noteworthy changes in version 1.8.0 (unreleased)  [C21/A1/R_]
      dubbed "Sliding right into disaster".  For details see
      <https://eprint.iacr.org/2017/627>.  [CVE-2017-7526] [also in 1.7.8]
 
-
  * Interface changes relative to the 1.7.0 release:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-   GCRYCTL_REINIT_SYSCALL_CLAMP    NEW macro.
    gcry_get_config                 NEW function.
    gcry_mpi_point_copy             NEW function.
+   GCRYCTL_REINIT_SYSCALL_CLAMP    NEW macro.
+   GCRY_MD_BLAKE2B_512             NEW constant.
+   GCRY_MD_BLAKE2B_384             NEW constant.
+   GCRY_MD_BLAKE2B_256             NEW constant.
+   GCRY_MD_BLAKE2B_160             NEW constant.
+   GCRY_MD_BLAKE2S_256             NEW constant.
+   GCRY_MD_BLAKE2S_224             NEW constant.
+   GCRY_MD_BLAKE2S_160             NEW constant.
+   GCRY_MD_BLAKE2S_128             NEW constant.
+   GCRY_CIPHER_MODE_XTS            NEW constant.
    gcry_md_info                    DEPRECATED.
 
-
  * Release dates of 1.7.x versions:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Version 1.7.8 (2017-06-29)  [C21/A1/R8]
diff --git a/README b/README
index 1148a24..c14181a 100644
--- a/README
+++ b/README
@@ -2,9 +2,9 @@
 		   ------------------------------------
                              Version 1.7
 
-       Copyright (C) 1989,1991-2016 Free Software Foundation, Inc.
-       Copyright (C) 2012-2016 g10 Code GmbH
-       Copyright (C) 2013-2016 Jussi Kivilinna
+       Copyright (C) 1989,1991-2017 Free Software Foundation, Inc.
+       Copyright (C) 2012-2017 g10 Code GmbH
+       Copyright (C) 2013-2017 Jussi Kivilinna
 
     Libgcrypt is free software.  See the file AUTHORS for full copying
     notices, and LICENSES for notices about contributions that require
diff --git a/compat/compat.c b/compat/compat.c
index 96b3e2e..b835293 100644
--- a/compat/compat.c
+++ b/compat/compat.c
@@ -30,9 +30,9 @@ _gcry_compat_identification (void)
   static const char blurb[] =
     "\n\n"
     "This is Libgcrypt " PACKAGE_VERSION " - The GNU Crypto Library\n"
-    "Copyright (C) 2000-2016 Free Software Foundation, Inc.\n"
-    "Copyright (C) 2012-2016 g10 Code GmbH\n"
-    "Copyright (C) 2013-2016 Jussi Kivilinna\n"
+    "Copyright (C) 2000-2017 Free Software Foundation, Inc.\n"
+    "Copyright (C) 2012-2017 g10 Code GmbH\n"
+    "Copyright (C) 2013-2017 Jussi Kivilinna\n"
     "\n"
     "(" BUILD_REVISION " " BUILD_TIMESTAMP ")\n"
     "\n\n";
diff --git a/configure.ac b/configure.ac
index d4e78cd..bbe8104 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,7 +1,7 @@
 # Configure.ac script for Libgcrypt
 # Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2006,
 #               2007, 2008, 2009, 2011 Free Software Foundation, Inc.
-# Copyright (C) 2012, 2013, 2014, 2015, 2016  g10 Code GmbH
+# Copyright (C) 2012-2017  g10 Code GmbH
 #
 # This file is part of Libgcrypt.
 #
@@ -51,7 +51,6 @@ m4_define([mym4_full_version],[mym4_version[]mym4_betastring])
 AC_INIT([libgcrypt],[mym4_full_version],[http://bugs.gnupg.org])
 
 # LT Version numbers, remember to change them just *before* a release.
-# !!!NOTE: Already updated for 1.8.0 !!
 #   (Interfaces removed:    CURRENT++, AGE=0, REVISION=0)
 #   (Interfaces added:      CURRENT++, AGE++, REVISION=0)
 #   (No interfaces changed:                   REVISION++)
diff --git a/doc/gcrypt.texi b/doc/gcrypt.texi
index 649332b..2bf23a5 100644
--- a/doc/gcrypt.texi
+++ b/doc/gcrypt.texi
@@ -14,7 +14,7 @@ which is GNU's library of cryptographic building blocks.
 
 @noindent
 Copyright @copyright{} 2000, 2002, 2003, 2004, 2006, 2007, 2008, 2009, 2011, 2012 Free Software Foundation, Inc. @*
-Copyright @copyright{} 2012, 2013, 2016 g10 Code GmbH
+Copyright @copyright{} 2012, 2013, 2016, 2017 g10 Code GmbH
 
 @quotation
 Permission is granted to copy, distribute and/or modify this document
diff --git a/src/gcrypt.h.in b/src/gcrypt.h.in
index 68c1f9e..89b1303 100644
--- a/src/gcrypt.h.in
+++ b/src/gcrypt.h.in
@@ -1,6 +1,6 @@
 /* gcrypt.h -  GNU Cryptographic Library Interface              -*- c -*-
- * Copyright (C) 1998-2016 Free Software Foundation, Inc.
- * Copyright (C) 2012-2016 g10 Code GmbH
+ * Copyright (C) 1998-2017 Free Software Foundation, Inc.
+ * Copyright (C) 2012-2017 g10 Code GmbH
  *
  * This file is part of Libgcrypt.
  *
diff --git a/src/versioninfo.rc.in b/src/versioninfo.rc.in
index 1adb4e9..b85d494 100644
--- a/src/versioninfo.rc.in
+++ b/src/versioninfo.rc.in
@@ -39,7 +39,7 @@ BEGIN
             VALUE "FileDescription", "Libgcrypt - The GNU Crypto Library\0"
             VALUE "FileVersion", "@LIBGCRYPT_LT_CURRENT at .@LIBGCRYPT_LT_AGE at .@LIBGCRYPT_LT_REVISION at .@BUILD_REVISION@\0"
             VALUE "InternalName", "libgcrypt\0"
-            VALUE "LegalCopyright", "Copyright ? 2016 Free Software Foundation, Inc.\0"
+            VALUE "LegalCopyright", "Copyright ? 2017 Free Software Foundation, Inc.\0"
             VALUE "LegalTrademarks", "\0"
             VALUE "OriginalFilename", "libgcrypt.dll\0"
             VALUE "PrivateBuild", "\0"

commit ffb66ff0f9af0f5caccfbe355684821e2a3861e7
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jul 18 14:57:36 2017 +0200

    build: Remove the configure run notice on EGD.
    
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/configure.ac b/configure.ac
index 9aa89c7..d4e78cd 100644
--- a/configure.ac
+++ b/configure.ac
@@ -213,7 +213,6 @@ auto_random_modules="$available_random_modules"
 LIBGCRYPT_THREAD_MODULES=""
 
 # Other definitions.
-print_egd_notice=no
 have_w32_system=no
 have_w32ce_system=no
 have_pthread=no
@@ -2473,7 +2472,6 @@ LIST_MEMBER(unix, $random_modules)
 if test "$found" = "1" ; then
    GCRYPT_RANDOM="$GCRYPT_RANDOM rndunix.lo"
    AC_DEFINE(USE_RNDUNIX, 1, [Defined if the default Unix RNG should be used.])
-   print_egd_notice=yes
 fi
 
 LIST_MEMBER(egd, $random_modules)
@@ -2655,23 +2653,6 @@ cat <<G10EOF
 
 G10EOF
 fi
-if test "$print_egd_notice" = "yes"; then
-cat <<G10EOF
-   The performance of the Unix random gatherer module (rndunix) is not
-   very good and it does not keep the entropy pool over multiple
-   invocations of Libgcrypt base applications.  The suggested way to
-   overcome this problem is to use the
-
-                 Entropy Gathering Daemon (EGD)
-
-   which provides a entropy source for the whole system.  It is written
-   in Perl and available at the GnuPG FTP servers.  For more information
-   consult the GnuPG site:
-
-          https://gnupg.org/related_software/swlist.html#egd
-
-G10EOF
-fi
 
 if test "$gcry_cv_gcc_attribute_aligned" != "yes" ; then
 cat <<G10EOF

-----------------------------------------------------------------------

Summary of changes:
 AUTHORS               |  4 ++--
 NEWS                  | 40 ++++++++++++++++++++++++++++++++++------
 README                |  6 +++---
 compat/compat.c       |  6 +++---
 configure.ac          | 24 ++----------------------
 doc/gcrypt.texi       |  2 +-
 src/gcrypt.h.in       |  4 ++--
 src/versioninfo.rc.in |  2 +-
 8 files changed, 48 insertions(+), 40 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 18 16:35:38 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 18 Jul 2017 16:35:38 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. cc99c4355c2a3971aa5aa69f87b7edb5ba317c59
Message-ID: <E1dXTb8-0008Io-9A@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  cc99c4355c2a3971aa5aa69f87b7edb5ba317c59 (commit)
      from  cbc7b683f909b68cc421642c5f5cca0c944edfba (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cc99c4355c2a3971aa5aa69f87b7edb5ba317c59
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jul 18 16:30:39 2017 +0200

    swdb: Release Libgcrypt 1.8.0

diff --git a/web/swdb.mac b/web/swdb.mac
index e5ce4ab..9609359 100644
--- a/web/swdb.mac
+++ b/web/swdb.mac
@@ -81,11 +81,11 @@
 #
 # LIBGCRYPT
 #
-#+macro: libgcrypt_ver  1.7.8
-#+macro: libgcrypt_date 2017-06-29
-#+macro: libgcrypt_size 2829k
-#+macro: libgcrypt_sha1 65a4a495aa858483e66868199eaa8238572ca6cd
-#+macro: libgcrypt_sha2 948276ea47e6ba0244f36a17b51dcdd52cfd1e664b0a1ac3bc82134fb6cec199
+#+macro: libgcrypt_ver  1.8.0
+#+macro: libgcrypt_date 2017-07-18
+#+macro: libgcrypt_size 2893k
+#+macro: libgcrypt_sha1 b4ffb20369f2ab8249d5cc0fb8b3b31371f6b112
+#+macro: libgcrypt_sha2 23e49697b87cc4173b03b4757c8df4314e3149058fa18bdc4f82098f103d891b
 
 
 #

-----------------------------------------------------------------------

Summary of changes:
 web/swdb.mac | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 18 18:13:03 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Tue, 18 Jul 2017 18:13:03 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-105-gf17862d
Message-ID: <E1dXV7Q-00072N-DK@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  f17862d47d184d7f6ef883778cf63801365599a0 (commit)
      from  2e1342b78b020f5b28359b08a4f63cf11479602f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit f17862d47d184d7f6ef883778cf63801365599a0
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Tue Jul 18 18:08:25 2017 +0200

    common: Allow abbreviations of standard options.
    
    * argparse.h (ARGPARSE_SHORTOPT_HELP, ARGPARSE_SHORTOPT_VERSION,
    ARGPARSE_SHORTOPT_WARRANTY, ARGPARSE_SHORTOPT_DUMP_OPTIONS): New
    macros.
    (ARGPARSE_end): Add some placeholders for standard options.
    * argparse.c (arg_parse): Fill in missing standard options so
    default machinery works.  Check for standard options in new way.
    Do not write out standard options for --dump-options.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 1747

diff --git a/common/argparse.c b/common/argparse.c
index 2540894..590e6e9 100644
--- a/common/argparse.c
+++ b/common/argparse.c
@@ -918,6 +918,41 @@ arg_parse( ARGPARSE_ARGS *arg, ARGPARSE_OPTS *opts)
   char *s, *s2;
   int i;
 
+  /* Fill in missing standard options: help, version, warranty and dump-options.  */
+  ARGPARSE_OPTS help_opt = ARGPARSE_s_n(ARGPARSE_SHORTOPT_HELP, "help", "@");
+  ARGPARSE_OPTS version_opt = ARGPARSE_s_n(ARGPARSE_SHORTOPT_VERSION, "version", "@");
+  ARGPARSE_OPTS warranty_opt = ARGPARSE_s_n(ARGPARSE_SHORTOPT_WARRANTY, "warranty", "@");
+  ARGPARSE_OPTS dump_options_opt = ARGPARSE_s_n(ARGPARSE_SHORTOPT_DUMP_OPTIONS, "dump-options", "@");
+  int seen_help = 0;
+  int seen_version = 0;
+  int seen_warranty = 0;
+  int seen_dump_options = 0;
+
+  i = 0;
+  while (opts[i].short_opt)
+    {
+      if (opts[i].long_opt)
+	{
+	  if (!strcmp(opts[i].long_opt, help_opt.long_opt))
+	    seen_help = 1;
+	  else if (!strcmp(opts[i].long_opt, version_opt.long_opt))
+	    seen_version = 1;
+	  else if (!strcmp(opts[i].long_opt, warranty_opt.long_opt))
+	    seen_warranty = 1;
+	  else if (!strcmp(opts[i].long_opt, dump_options_opt.long_opt))
+	    seen_dump_options = 1;
+	}
+      i++;
+    }
+  if (! seen_help)
+    opts[i++] = help_opt;
+  if (! seen_version)
+    opts[i++] = version_opt;
+  if (! seen_warranty)
+    opts[i++] = warranty_opt;
+  if (! seen_dump_options)
+    opts[i++] = dump_options_opt;
+
   initialize( arg, NULL, NULL );
   argc = *arg->argc;
   argv = *arg->argv;
@@ -974,9 +1009,9 @@ arg_parse( ARGPARSE_ARGS *arg, ARGPARSE_OPTS *opts)
       if ( argpos )
         *argpos = '=';
 
-      if ( i < 0 && !strcmp ( "help", s+2) )
+      if (i > 0 && opts[i].short_opt == ARGPARSE_SHORTOPT_HELP)
         show_help (opts, arg->flags);
-      else if ( i < 0 && !strcmp ( "version", s+2) )
+      else if (i > 0 && opts[i].short_opt == ARGPARSE_SHORTOPT_VERSION)
         {
           if (!(arg->flags & ARGPARSE_FLAG_NOVERSION))
             {
@@ -984,20 +1019,18 @@ arg_parse( ARGPARSE_ARGS *arg, ARGPARSE_OPTS *opts)
               exit(0);
             }
 	}
-      else if ( i < 0 && !strcmp( "warranty", s+2))
+      else if (i > 0 && opts[i].short_opt == ARGPARSE_SHORTOPT_WARRANTY)
         {
           writestrings (0, strusage (16), "\n", NULL);
           exit (0);
 	}
-      else if ( i < 0 && !strcmp( "dump-options", s+2) )
+      else if (i > 0 && opts[i].short_opt == ARGPARSE_SHORTOPT_DUMP_OPTIONS)
         {
           for (i=0; opts[i].short_opt; i++ )
             {
               if (opts[i].long_opt && !(opts[i].flags & ARGPARSE_OPT_IGNORE))
                 writestrings (0, "--", opts[i].long_opt, "\n", NULL);
 	    }
-          writestrings (0, "--dump-options\n--help\n--version\n--warranty\n",
-                        NULL);
           exit (0);
 	}
 
diff --git a/common/argparse.h b/common/argparse.h
index d75b49f..cdd18d9 100644
--- a/common/argparse.h
+++ b/common/argparse.h
@@ -71,6 +71,12 @@ typedef struct
   const char  *description; /* Optional option description. */
 } ARGPARSE_OPTS;
 
+/* Short options.  */
+#define ARGPARSE_SHORTOPT_HELP 32768
+#define ARGPARSE_SHORTOPT_VERSION 32769
+#define ARGPARSE_SHORTOPT_WARRANTY 32770
+#define ARGPARSE_SHORTOPT_DUMP_OPTIONS 32771
+
 
 /* Global flags (ARGPARSE_ARGS).  */
 #define ARGPARSE_FLAG_KEEP       1   /* Do not remove options form argv.     */
@@ -169,7 +175,13 @@ typedef struct
 #define ARGPARSE_group(s,d) \
      { (s), NULL, 0, (d) }
 
-#define ARGPARSE_end()  { 0, NULL, 0, NULL }
+/* Placeholder options for help, version, warranty and dump-options.  See arg_parse(). */
+#define ARGPARSE_end() \
+     { 0, NULL, 0, NULL }, \
+     { 0, NULL, 0, NULL }, \
+     { 0, NULL, 0, NULL }, \
+     { 0, NULL, 0, NULL }, \
+     { 0, NULL, 0, NULL }
 
 
 /* Other constants.  */

-----------------------------------------------------------------------

Summary of changes:
 common/argparse.c | 45 +++++++++++++++++++++++++++++++++++++++------
 common/argparse.h | 14 +++++++++++++-
 2 files changed, 52 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 19 06:46:04 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Wed, 19 Jul 2017 06:46:04 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-107-g9979118
Message-ID: <E1dXgs9-00041G-N6@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  99791184ac4c7486ccdefc150b9921cd923428b9 (commit)
       via  fa63db89f9581186ed758c502d4e69914b774157 (commit)
      from  f17862d47d184d7f6ef883778cf63801365599a0 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 99791184ac4c7486ccdefc150b9921cd923428b9
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Jul 19 13:43:23 2017 +0900

    gpgconf: Make vars read-only explicitly.
    
    * tools/gpgconf-comp.c (gc_backend, gc_arg_type, gc_level, gc_flag)
    (gc_component): Add const qualifier.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index f608f7a..a8ecb07 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -149,7 +149,7 @@ typedef enum
 
 /* To be able to implement generic algorithms for the various
    backends, we collect all information about them in this struct.  */
-static struct
+static const struct
 {
   /* The name of the backend.  */
   const char *name;
@@ -256,7 +256,7 @@ typedef enum
 
 /* For every argument, we record some information about it in the
    following struct.  */
-static struct
+static const struct
 {
   /* For every argument type exists a basic argument type that can be
      used as a fallback for input and validation purposes.  */
@@ -328,7 +328,7 @@ typedef enum
   } gc_expert_level_t;
 
 /* A description for each expert level.  */
-static struct
+static const struct
 {
   const char *name;
 } gc_level[] =
@@ -361,7 +361,7 @@ static struct
 
 
 /* A human-readable description for each flag.  */
-static struct
+static const struct
 {
   const char *name;
 } gc_flag[] =
@@ -1070,7 +1070,7 @@ typedef enum
 
 
 /* The information associated with each component.  */
-static struct
+static const struct
 {
   /* The name of this component.  Must not contain a colon (':')
      character.  */

commit fa63db89f9581186ed758c502d4e69914b774157
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Jul 19 13:41:18 2017 +0900

    Fix usage of ARGPARSE_OPTS.
    
    * agent/gpg-agent.c, agent/preset-passphrase.c,
    dirmngr/dirmngr-client.c, dirmngr/dirmngr_ldap.c, kbx/kbxutil.c,
    tools/gpg-check-pattern.c, tools/gpgconf.c, tools/gpgsplit.c,
    tools/symcryptrun.c: Use ARGPARSE_end.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
index d3db3e1..efaebfd 100644
--- a/agent/gpg-agent.c
+++ b/agent/gpg-agent.c
@@ -249,7 +249,7 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_s_n (oUseStandardSocket, "use-standard-socket", "@"),
   ARGPARSE_s_n (oNoUseStandardSocket, "no-use-standard-socket", "@"),
 
-  {0} /* End of list */
+  ARGPARSE_end () /* End of list */
 };
 
 
diff --git a/agent/preset-passphrase.c b/agent/preset-passphrase.c
index 3d240b9..7a9ea1b 100644
--- a/agent/preset-passphrase.c
+++ b/agent/preset-passphrase.c
@@ -78,7 +78,8 @@ static ARGPARSE_OPTS opts[] = {
   { oForget,  "forget",  256, "forget passphrase"},
 
   { oHomedir, "homedir", 2, "@" },
-  {0}
+
+  ARGPARSE_end ()
 };
 
 
diff --git a/dirmngr/dirmngr-client.c b/dirmngr/dirmngr-client.c
index 4dc64bf..53b405e 100644
--- a/dirmngr/dirmngr-client.c
+++ b/dirmngr/dirmngr-client.c
@@ -80,7 +80,7 @@ static ARGPARSE_OPTS opts[] = {
   { oPEM,      "pem",       0, N_("expect certificates in PEM format")},
   { oForceDefaultResponder, "force-default-responder", 0,
     N_("force the use of the default OCSP responder")},
-  { 0, NULL, 0, NULL }
+  ARGPARSE_end ()
 };
 
 
diff --git a/dirmngr/dirmngr_ldap.c b/dirmngr/dirmngr_ldap.c
index 836ced0..5a9ae97 100644
--- a/dirmngr/dirmngr_ldap.c
+++ b/dirmngr/dirmngr_ldap.c
@@ -150,7 +150,7 @@ static ARGPARSE_OPTS opts[] = {
   { oAttr,     "attr",      2, N_("|STRING|return the attribute STRING")},
   { oOnlySearchTimeout, "only-search-timeout", 0, "@"},
   { oLogWithPID,"log-with-pid", 0, "@"},
-  { 0, NULL, 0, NULL }
+  ARGPARSE_end ()
 };
 
 
diff --git a/kbx/kbxutil.c b/kbx/kbxutil.c
index 0889231..9b43584 100644
--- a/kbx/kbxutil.c
+++ b/kbx/kbxutil.c
@@ -92,7 +92,7 @@ static ARGPARSE_OPTS opts[] = {
   { oDebug, "debug"     ,4|16, N_("set debugging flags")},
   { oDebugAll, "debug-all" ,0, N_("enable full debugging")},
 
-  {0} /* end of list */
+  ARGPARSE_end () /* end of list */
 };
 
 
diff --git a/tools/gpg-check-pattern.c b/tools/gpg-check-pattern.c
index 7197340..4db8f37 100644
--- a/tools/gpg-check-pattern.c
+++ b/tools/gpg-check-pattern.c
@@ -74,7 +74,7 @@ static ARGPARSE_OPTS opts[] = {
   { oCheck,   "check", 0,  "run only a syntax check on the patternfile" },
   { oNull,    "null", 0,   "input is expected to be null delimited" },
 
-  {0}
+  ARGPARSE_end ()
 };
 
 
diff --git a/tools/gpgconf.c b/tools/gpgconf.c
index 2236555..fefa2ff 100644
--- a/tools/gpgconf.c
+++ b/tools/gpgconf.c
@@ -105,7 +105,8 @@ static ARGPARSE_OPTS opts[] =
     { oBuilddir, "build-prefix", 2, "@" },
     { oNull, "null", 0, "@" },
     { oNoVerbose, "no-verbose",  0, "@"},
-    {0}
+
+    ARGPARSE_end(),
   };
 
 
diff --git a/tools/gpgsplit.c b/tools/gpgsplit.c
index b9787b1..674be62 100644
--- a/tools/gpgsplit.c
+++ b/tools/gpgsplit.c
@@ -75,7 +75,9 @@ static ARGPARSE_OPTS opts[] = {
     { oUncompress, "uncompress", 0, "uncompress a packet"},
     { oSecretToPublic, "secret-to-public", 0, "convert secret keys to public keys"},
     { oNoSplit, "no-split", 0, "write to stdout and don't actually split"},
-{0} };
+
+    ARGPARSE_end ()
+};
 
 
 static const char *
diff --git a/tools/symcryptrun.c b/tools/symcryptrun.c
index 54976ca..c5780fd 100644
--- a/tools/symcryptrun.c
+++ b/tools/symcryptrun.c
@@ -185,7 +185,7 @@ static ARGPARSE_OPTS opts[] =
     { oHomedir, "homedir", 2, "@" },
     { oNoOptions, "no-options", 0, "@" },/* shortcut for --options /dev/null */
 
-    {0}
+    ARGPARSE_end ()
   };
 
 

-----------------------------------------------------------------------

Summary of changes:
 agent/gpg-agent.c         |  2 +-
 agent/preset-passphrase.c |  3 ++-
 dirmngr/dirmngr-client.c  |  2 +-
 dirmngr/dirmngr_ldap.c    |  2 +-
 kbx/kbxutil.c             |  2 +-
 tools/gpg-check-pattern.c |  2 +-
 tools/gpgconf-comp.c      | 10 +++++-----
 tools/gpgconf.c           |  3 ++-
 tools/gpgsplit.c          |  4 +++-
 tools/symcryptrun.c       |  2 +-
 10 files changed, 18 insertions(+), 14 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 19 07:29:16 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Wed, 19 Jul 2017 07:29:16 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.8.0-2-g1d8e4c2
Message-ID: <E1dXhXw-0001gF-Kf@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  1d8e4c2c3a7d0a4154caf5bd720a9a0b04179390 (commit)
      from  2c905868abdfecad1442712346ed1a950faed3d7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1d8e4c2c3a7d0a4154caf5bd720a9a0b04179390
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Wed Jul 19 14:28:14 2017 +0900

    Remove byte order mark.
    
    * random/jitterentropy-base.c, random/jitterentropy.h: Remove
    byte order mark.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/random/jitterentropy-base.c b/random/jitterentropy-base.c
index 4f3de10..dc907b2 100644
--- a/random/jitterentropy-base.c
+++ b/random/jitterentropy-base.c
@@ -1,4 +1,4 @@
-?/*
+/*
  * Non-physical true random number generator based on timing jitter.
  *
  * Copyright Stephan Mueller <smueller at chronox.de>, 2014 - 2017
diff --git a/random/jitterentropy.h b/random/jitterentropy.h
index 28859f5..3b7d14a 100644
--- a/random/jitterentropy.h
+++ b/random/jitterentropy.h
@@ -1,4 +1,4 @@
-?/*
+/*
  * Non-physical true random number generator based on timing jitter.
  *
  * Copyright Stephan Mueller <smueller at chronox.de>, 2014

-----------------------------------------------------------------------

Summary of changes:
 random/jitterentropy-base.c | 2 +-
 random/jitterentropy.h      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 19 09:43:12 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 19 Jul 2017 09:43:12 +0200
Subject: [git] GCRYPT - branch, LIBGCRYPT-1-7-BRANCH,
 updated. libgcrypt-1.7.8-5-gcd271dc
Message-ID: <E1dXjdY-0005SF-81@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, LIBGCRYPT-1-7-BRANCH has been updated
       via  cd271dce4cd8479567d1e3c8b65f04abb9445fdf (commit)
      from  23f473d04d16a2ec8dbd2537719c782ae233e7d8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cd271dce4cd8479567d1e3c8b65f04abb9445fdf
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 19 09:37:57 2017 +0200

    Announce end-of-life for 1.7 at 2019-06-30.
    
    --

diff --git a/AUTHORS b/AUTHORS
index 82f82e2..bde51ed 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -6,6 +6,7 @@ Repository: git://git.gnupg.org/libgcrypt.git
 Maintainer: Werner Koch <wk at gnupg.org>
 Bug reports: https://bugs.gnupg.org
 Security related bug reports: <security at gnupg.org>
+End-of-life: 2019-06-30
 License (library): LGPLv2.1+
 License (manual and tools): GPLv2+
 

-----------------------------------------------------------------------

Summary of changes:
 AUTHORS | 1 +
 1 file changed, 1 insertion(+)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 19 09:44:35 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 19 Jul 2017 09:44:35 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 5dc247026f6deab18986e89d1dcef5dabeb264b5
Message-ID: <E1dXjet-0005Ty-Dh@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  5dc247026f6deab18986e89d1dcef5dabeb264b5 (commit)
      from  cc99c4355c2a3971aa5aa69f87b7edb5ba317c59 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5dc247026f6deab18986e89d1dcef5dabeb264b5
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 19 09:39:48 2017 +0200

    web: Announce Libgcrypt 1.8.0.

diff --git a/web/index.org b/web/index.org
index 2b8ab08..765a5e2 100644
--- a/web/index.org
+++ b/web/index.org
@@ -88,6 +88,15 @@ The latest release news:\\
 # GnuPG's latest news are available as [[http://feedvalidator.org/check.cgi?url%3Dhttps://www.gnupg.org/news.en.rss][RSS 2.0 compliant]] feed.  Just
 # point or paste the [[news.en.rss][RSS file]] into your aggregator.
 
+** Libgcrypt 1.8.0 released (2017-07-18)
+
+We are pleased to announce the availability of [[file:software/libgcrypt/index.org][Libgcrypt]] version
+1.8.0.  This is a new stable version with full API and ABI
+compatibility to the 1.7 series.  Its main features are support for
+the hash algorithm [[https://en.wikipedia.org/wiki/BLAKE_(hash_function)][Blake-2]], the addition of [[https://en.wikipedia.org/wiki/Disk_encryption_theory][XTS]] mode, an improved
+random number generator, and performance improvements for the [[https://en.wikipedia.org/wiki/ARM_architecture][ARM]]
+architecture.  See the [[https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000410.html][announcement mail]] for details.
+
 ** Scute 1.5.0 released (2017-07-14)
 
 Scute is a PKCS#11 module built around the GnuPG Agent and the GnuPG
diff --git a/web/software/libgcrypt/index.org b/web/software/libgcrypt/index.org
index 4bfd79d..83bb35f 100644
--- a/web/software/libgcrypt/index.org
+++ b/web/software/libgcrypt/index.org
@@ -37,6 +37,9 @@
   It can also be built using a cross-compiler system for Microsoft
   Windows.
 
+  See also its [[https://en.wikipedia.org/wiki/Libgcrypt][Wikipedia]] entry.
+
+
 ** Availibility
 
    Due to former U.S. export restrictions on cryptographic software,
@@ -47,6 +50,11 @@
    released on {{{libgcrypt_date}}}.  See the [[../../download/index.org::libgcrypt][download]] section for the
    latest tarball.
 
+   All versions of Libgcrypt since 1.2 are API and ABI compatible.
+   The 1.6 series reached end-of-life on 2017-06-30.  The 1.7 series
+   will receive updates for severe bugs and security problems until
+   2019-06-30.
+
 ** Copying
 
    Libgcrypt is distributed under the terms of the GNU Lesser General

-----------------------------------------------------------------------

Summary of changes:
 web/index.org                    | 9 +++++++++
 web/software/libgcrypt/index.org | 8 ++++++++
 2 files changed, 17 insertions(+)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 19 10:39:22 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 19 Jul 2017 10:39:22 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. c580ac5de36ff17caf40db409af3171c5757c376
Message-ID: <E1dXkVu-00057C-Rt@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  c580ac5de36ff17caf40db409af3171c5757c376 (commit)
      from  5dc247026f6deab18986e89d1dcef5dabeb264b5 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c580ac5de36ff17caf40db409af3171c5757c376
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 19 10:34:36 2017 +0200

    web: Fix URL

diff --git a/web/index.org b/web/index.org
index 765a5e2..76ba822 100644
--- a/web/index.org
+++ b/web/index.org
@@ -95,7 +95,7 @@ We are pleased to announce the availability of [[file:software/libgcrypt/index.o
 compatibility to the 1.7 series.  Its main features are support for
 the hash algorithm [[https://en.wikipedia.org/wiki/BLAKE_(hash_function)][Blake-2]], the addition of [[https://en.wikipedia.org/wiki/Disk_encryption_theory][XTS]] mode, an improved
 random number generator, and performance improvements for the [[https://en.wikipedia.org/wiki/ARM_architecture][ARM]]
-architecture.  See the [[https://lists.gnupg.org/pipermail/gnupg-announce/2017q2/000410.html][announcement mail]] for details.
+architecture.  See the [[https://lists.gnupg.org/pipermail/gnupg-announce/2017q3/000410.html][announcement mail]] for details.
 
 ** Scute 1.5.0 released (2017-07-14)
 

-----------------------------------------------------------------------

Summary of changes:
 web/index.org | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 19 11:55:29 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 19 Jul 2017 11:55:29 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 2610bd7d3ce7b309fd69fbe9705bddcce9fb38a6
Message-ID: <E1dXlhZ-00017O-Qr@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  2610bd7d3ce7b309fd69fbe9705bddcce9fb38a6 (commit)
      from  c580ac5de36ff17caf40db409af3171c5757c376 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2610bd7d3ce7b309fd69fbe9705bddcce9fb38a6
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 19 11:50:28 2017 +0200

    swdb: Release gnupg 1.4.22

diff --git a/web/index.org b/web/index.org
index 76ba822..d4f7dc9 100644
--- a/web/index.org
+++ b/web/index.org
@@ -88,6 +88,12 @@ The latest release news:\\
 # GnuPG's latest news are available as [[http://feedvalidator.org/check.cgi?url%3Dhttps://www.gnupg.org/news.en.rss][RSS 2.0 compliant]] feed.  Just
 # point or paste the [[news.en.rss][RSS file]] into your aggregator.
 
+** GnuPG 1.4.22 released (2017-07-19)
+
+Although GnuPG 1.4 is of limited use today we did a maintenance
+release to address the recently published local side channel attack
+CVE-2017-7526.  See the [[../../download/index.org][download]] section on how to get this version.
+
 ** Libgcrypt 1.8.0 released (2017-07-18)
 
 We are pleased to announce the availability of [[file:software/libgcrypt/index.org][Libgcrypt]] version
diff --git a/web/swdb.mac b/web/swdb.mac
index 9609359..728531b 100644
--- a/web/swdb.mac
+++ b/web/swdb.mac
@@ -36,16 +36,15 @@
 #
 # GnuPG-1
 #
-#+macro: gnupg1_ver  1.4.21
-#+macro: gnupg1_date 2016-08-17
-#+macro: gnupg1_branch   STABLE-BRANCH-1-4
-#+macro: gnupg1_size 3602k
-#+macro: gnupg1_sha1 e3bdb585026f752ae91360f45c28e76e4a15d338
-#+macro: gnupg1_sha2 6b47a3100c857dcab3c60e6152e56a997f2c7862c1b8b2b25adf3884a1ae2276
-#
-#+macro: gnupg1_w32cli_ver  1.4.21
-#+macro: gnupg1_w32cli_size 2363k
-#+macro: gnupg1_w32cli_sha1 8edea5cda7dc9e39d12b24cf12164b28b832918d
+#+macro: gnupg1_ver  1.4.22
+#+macro: gnupg1_date 2017-07-19
+#+macro: gnupg1_size 3658k
+#+macro: gnupg1_sha1 4bad84fba712626cbbd5adf20988788028c5a5a6
+#+macro: gnupg1_sha2 9594a24bec63a21568424242e3f198b9d9828dea5ff0c335e47b06f835f930b4
+#
+#+macro: gnupg1_w32cli_ver  1.4.22
+#+macro: gnupg1_w32cli_size 2372k
+#+macro: gnupg1_w32cli_sha1 27b8069872d6d2b271222ffb9322dbd6197b0b89
 
 
 #

-----------------------------------------------------------------------

Summary of changes:
 web/index.org |  6 ++++++
 web/swdb.mac  | 19 +++++++++----------
 2 files changed, 15 insertions(+), 10 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 19 12:30:26 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 19 Jul 2017 12:30:26 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-112-gda91d21
Message-ID: <E1dXmFQ-0006Nj-ME@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  da91d2106a17c796ddb066a34db92d33b21c81f7 (commit)
       via  e7eabe66b6409c1f5225b751ea5c2d456a3856e6 (commit)
       via  1ba220e68149fdb197accf4a15b0a11126c8b431 (commit)
       via  46a4a0c0e77e19f9589088bb87357c33142c3f04 (commit)
       via  73d4781e4595634548269bafe46aeb7674c5b219 (commit)
      from  99791184ac4c7486ccdefc150b9921cd923428b9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit da91d2106a17c796ddb066a34db92d33b21c81f7
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jul 19 11:12:14 2017 +0200

    dirmngr: Implement TLS over http proxies.
    
    * dirmngr/http.c (send_request): If a http proxy is to be used, and we
    want to use TLS, try to use the CONNECT method to get a connection to
    the target server.
    
    GnuPG-bug-id: 2940
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 25368bb..dea4c71 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -1672,6 +1672,7 @@ send_request (http_t hd, const char *httphost, const char *auth,
   char *proxy_authstr = NULL;
   char *authstr = NULL;
   assuan_fd_t sock;
+  int have_http_proxy = 0;
 
   if (hd->uri->use_tls && !hd->session)
     {
@@ -1759,7 +1760,7 @@ send_request (http_t hd, const char *httphost, const char *auth,
       if (err)
         ;
       else if (!strcmp (uri->scheme, "http"))
-        ;
+        have_http_proxy = 1;
       else if (!strcmp (uri->scheme, "socks4")
                || !strcmp (uri->scheme, "socks5h"))
         err = gpg_err_make (default_errsource, GPG_ERR_NOT_IMPLEMENTED);
@@ -1810,6 +1811,94 @@ send_request (http_t hd, const char *httphost, const char *auth,
       return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
     }
 
+#if USE_TLS
+  if (have_http_proxy && hd->uri->use_tls)
+    {
+      int saved_flags;
+      cookie_t cookie;
+
+      /* Try to use the CONNECT method to proxy our TLS stream.  */
+      request = es_bsprintf
+        ("CONNECT %s:%hu HTTP/1.0\r\nHost: %s:%hu\r\n%s",
+         httphost ? httphost : server,
+         port,
+         httphost ? httphost : server,
+         port,
+         proxy_authstr ? proxy_authstr : "");
+      xfree (proxy_authstr);
+      proxy_authstr = NULL;
+
+      if (! request)
+        return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
+
+      if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP))
+        log_debug_with_string (request, "http.c:request:");
+
+      cookie = xtrycalloc (1, sizeof *cookie);
+      if (! cookie)
+        {
+          err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
+          xfree (request);
+          return err;
+        }
+      cookie->sock = my_socket_ref (hd->sock);
+      hd->write_cookie = cookie;
+
+      hd->fp_write = es_fopencookie (cookie, "w", cookie_functions);
+      if (! hd->fp_write)
+        {
+          err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
+          my_socket_unref (cookie->sock, NULL, NULL);
+          xfree (cookie);
+          xfree (request);
+          hd->write_cookie = NULL;
+          return err;
+        }
+      else if (es_fputs (request, hd->fp_write) || es_fflush (hd->fp_write))
+        err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
+
+      xfree (request);
+      request = NULL;
+
+      /* Make sure http_wait_response doesn't close the stream.  */
+      saved_flags = hd->flags;
+      hd->flags &= ~HTTP_FLAG_SHUTDOWN;
+
+      /* Get the response.  */
+      err = http_wait_response (hd);
+
+      /* Restore flags, destroy stream.  */
+      hd->flags = saved_flags;
+      es_fclose (hd->fp_read);
+      hd->fp_read = NULL;
+      hd->read_cookie = NULL;
+
+      /* Reset state.  */
+      hd->in_data = 0;
+
+      if (err)
+        return err;
+
+      if (hd->status_code != 200)
+        {
+          request = es_bsprintf
+            ("CONNECT %s:%hu",
+             httphost ? httphost : server,
+             port);
+
+          log_error (_("error accessing '%s': http status %u\n"),
+                     request ? request : "out of core",
+                     http_get_status_code (hd));
+
+          xfree (request);
+          return gpg_error (GPG_ERR_NO_DATA);
+        }
+
+      /* We are done with the proxy, the code below will establish a
+       * TLS session and talk directly to the target server.  */
+      http_proxy = NULL;
+    }
+#endif	/* USE_TLS */
 
 #if HTTP_USE_NTBTLS
   if (hd->uri->use_tls)

commit e7eabe66b6409c1f5225b751ea5c2d456a3856e6
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jul 19 11:10:26 2017 +0200

    dirmngr: Log http response in debug mode.
    
    * dirmngr/http.c (parse_response): Log http response in debug mode.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 29854b5..25368bb 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -2344,7 +2344,7 @@ parse_response (http_t hd)
       if (!len)
 	return GPG_ERR_EOF;
 
-      if ((hd->flags & HTTP_FLAG_LOG_RESP))
+      if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP))
         log_debug_with_string (line, "http.c:response:\n");
     }
   while (!*line);
@@ -2389,7 +2389,7 @@ parse_response (http_t hd)
       /* Trim line endings of empty lines. */
       if ((*line == '\r' && line[1] == '\n') || *line == '\n')
 	*line = 0;
-      if ((hd->flags & HTTP_FLAG_LOG_RESP))
+      if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP))
         log_info ("http.c:RESP: '%.*s'\n",
                   (int)strlen(line)-(*line&&line[1]?2:0),line);
       if (*line)

commit 1ba220e68149fdb197accf4a15b0a11126c8b431
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jul 19 11:07:59 2017 +0200

    dirmngr: Amend TLS handling.
    
    * dirmngr/http.c (http_wait_response): Get the 'use_tls' flag from the
    write cookie, not from the URI.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index b63beb6..29854b5 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -1064,6 +1064,7 @@ http_wait_response (http_t hd)
 {
   gpg_error_t err;
   cookie_t cookie;
+  int use_tls;
 
   /* Make sure that we are in the data. */
   http_start_data (hd);
@@ -1074,6 +1075,7 @@ http_wait_response (http_t hd)
   if (!cookie)
     return gpg_err_make (default_errsource, GPG_ERR_INTERNAL);
 
+  use_tls = cookie->use_tls;
   es_fclose (hd->fp_write);
   hd->fp_write = NULL;
   /* The close has released the cookie and thus we better set it to NULL.  */
@@ -1092,7 +1094,7 @@ http_wait_response (http_t hd)
     return gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
   cookie->sock = my_socket_ref (hd->sock);
   cookie->session = http_session_ref (hd->session);
-  cookie->use_tls = hd->uri->use_tls;
+  cookie->use_tls = use_tls;
 
   hd->read_cookie = cookie;
   hd->fp_read = es_fopencookie (cookie, "r", cookie_functions);

commit 46a4a0c0e77e19f9589088bb87357c33142c3f04
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jul 19 12:12:49 2017 +0200

    dirmngr: Fix connecting to http proxies.
    
    * dirmngr/http.c (send_request): Do not use the 'srvtag' intended for
    the target host to connect to the http proxy.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index b5b0e9d..b63beb6 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -1788,7 +1788,7 @@ send_request (http_t hd, const char *httphost, const char *auth,
 
       err = connect_server (*uri->host ? uri->host : "localhost",
                             uri->port ? uri->port : 80,
-                            hd->flags, srvtag, timeout, &sock);
+                            hd->flags, NULL, timeout, &sock);
       http_release_parsed_uri (uri);
     }
   else

commit 73d4781e4595634548269bafe46aeb7674c5b219
Author: Justus Winter <justus at g10code.com>
Date:   Tue Jul 18 17:24:21 2017 +0200

    dirmngr: Fix handling of proxy URIs.
    
    * dirmngr/http.c (send_request): We do not support socks4.
    
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 0cb2708..b5b0e9d 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -1756,9 +1756,10 @@ send_request (http_t hd, const char *httphost, const char *auth,
 
       if (err)
         ;
-      else if (!strcmp (uri->scheme, "http") || !strcmp (uri->scheme, "socks4"))
+      else if (!strcmp (uri->scheme, "http"))
         ;
-      else if (!strcmp (uri->scheme, "socks5h"))
+      else if (!strcmp (uri->scheme, "socks4")
+               || !strcmp (uri->scheme, "socks5h"))
         err = gpg_err_make (default_errsource, GPG_ERR_NOT_IMPLEMENTED);
       else
         err = gpg_err_make (default_errsource, GPG_ERR_INV_URI);

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/http.c | 106 +++++++++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 99 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 19 13:17:32 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 19 Jul 2017 13:17:32 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-113-g2e54594
Message-ID: <E1dXmyz-0005k5-H4@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  2e5459457473eb4b3e7b2b14815cb94faa66e8bb (commit)
      from  da91d2106a17c796ddb066a34db92d33b21c81f7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 2e5459457473eb4b3e7b2b14815cb94faa66e8bb
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 19 13:03:43 2017 +0200

    gpg: Avoid asking by fpr and then by keyid during auto-key-retrieve.
    
    * g10/mainproc.c (check_sig_and_print): Track key server request via
    fingerprint.
    --
    
    New signatures carry the fingerprint and thus --auto-key-retrieve tries
    to lookup the key by fingerprint.  If that failed it used to also ask
    the same thing by KEYID - but the keyid is part of the fingerprint and
    thus it will either get no response or the wrong key back.  We can
    easily avoid this.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/mainproc.c b/g10/mainproc.c
index c57925c..fddafd8 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -1658,6 +1658,7 @@ check_sig_and_print (CTX c, kbnode_t node)
   int is_revkey = 0;
   char *issuer_fpr;
   PKT_public_key *pk = NULL;  /* The public key for the signature or NULL. */
+  int tried_ks_by_fpr;
 
   if (opt.skip_verify)
     {
@@ -1886,6 +1887,7 @@ check_sig_and_print (CTX c, kbnode_t node)
    * that the signers fingerprint is encoded in the signature.  We
    * favor this over the WKD method (to be tried next), because an
    * arbitrary keyserver is less subject to web bug like monitoring.  */
+  tried_ks_by_fpr = 0;
   if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
       && (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE)
       && keyserver_any_configured (c->ctrl))
@@ -1902,6 +1904,7 @@ check_sig_and_print (CTX c, kbnode_t node)
           pk = NULL;
           glo_ctrl.in_auto_key_retrieve++;
           res = keyserver_import_fprint (c->ctrl, p+1, n-1, opt.keyserver, 1);
+          tried_ks_by_fpr = 1;
           glo_ctrl.in_auto_key_retrieve--;
           if (!res)
             rc = do_check_sig (c, node, NULL, &is_expkey, &is_revkey, &pk);
@@ -1933,6 +1936,7 @@ check_sig_and_print (CTX c, kbnode_t node)
    * keyserver.  */
   if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY
       && (opt.keyserver_options.options&KEYSERVER_AUTO_KEY_RETRIEVE)
+      && !tried_ks_by_fpr
       && keyserver_any_configured (c->ctrl))
     {
       int res;

-----------------------------------------------------------------------

Summary of changes:
 g10/mainproc.c | 4 ++++
 1 file changed, 4 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 19 17:04:09 2017
From: cvs at cvs.gnupg.org (by Justus Winter)
Date: Wed, 19 Jul 2017 17:04:09 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-114-ge7fc6e3
Message-ID: <E1dXqWI-0007rE-5S@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e7fc6e3bf0eb6ffe53e1f099d28ce45cef4a8a87 (commit)
      from  2e5459457473eb4b3e7b2b14815cb94faa66e8bb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e7fc6e3bf0eb6ffe53e1f099d28ce45cef4a8a87
Author: Justus Winter <justus at g10code.com>
Date:   Wed Jul 19 16:02:05 2017 +0200

    dirmngr: Forbid redirects from .onion to clearnet URIs.
    
    * dirmngr/ks-engine-hkp.c (send_request): Forbid redirects from .onion
    to clearnet URIs.
    * dirmngr/ks-engine-http.c (ks_http_fetch): Likewise.
    --
    This protects users from misconfigured .onion services.
    
    GnuPG-bug-id: 3087
    Signed-off-by: Justus Winter <justus at g10code.com>

diff --git a/dirmngr/ks-engine-hkp.c b/dirmngr/ks-engine-hkp.c
index aa98b37..4a0b08f 100644
--- a/dirmngr/ks-engine-hkp.c
+++ b/dirmngr/ks-engine-hkp.c
@@ -1162,9 +1162,16 @@ send_request (ctrl_t ctrl, const char *request, const char *hostportstr,
   int redirects_left = MAX_REDIRECTS;
   estream_t fp = NULL;
   char *request_buffer = NULL;
+  parsed_uri_t uri = NULL;
+  int is_onion;
 
   *r_fp = NULL;
 
+  err = http_parse_uri (&uri, request, 0);
+  if (err)
+    goto leave;
+  is_onion = uri->onion;
+
   err = http_session_new (&session, httphost,
                           ((ctrl->http_no_crl? HTTP_FLAG_NO_CRL : 0)
                            | HTTP_FLAG_TRUST_DEF),
@@ -1250,6 +1257,23 @@ send_request (ctrl_t ctrl, const char *request, const char *hostportstr,
                   request, s?s:"[none]", http_get_status_code (http));
         if (s && *s && redirects_left-- )
           {
+            if (is_onion)
+              {
+                /* Make sure that an onion address only redirects to
+                 * another onion address.  */
+                http_release_parsed_uri (uri);
+                uri = NULL;
+                err = http_parse_uri (&uri, s, 0);
+                if (err)
+                  goto leave;
+
+                if (! uri->onion)
+                  {
+                    err = gpg_error (GPG_ERR_FORBIDDEN);
+                    goto leave;
+                  }
+              }
+
             xfree (request_buffer);
             request_buffer = xtrystrdup (s);
             if (request_buffer)
@@ -1298,6 +1322,7 @@ send_request (ctrl_t ctrl, const char *request, const char *hostportstr,
   http_close (http, 0);
   http_session_release (session);
   xfree (request_buffer);
+  http_release_parsed_uri (uri);
   return err;
 }
 
diff --git a/dirmngr/ks-engine-http.c b/dirmngr/ks-engine-http.c
index 95fa34c..7fb7731 100644
--- a/dirmngr/ks-engine-http.c
+++ b/dirmngr/ks-engine-http.c
@@ -72,6 +72,13 @@ ks_http_fetch (ctrl_t ctrl, const char *url, estream_t *r_fp)
   int redirects_left = MAX_REDIRECTS;
   estream_t fp = NULL;
   char *request_buffer = NULL;
+  parsed_uri_t uri = NULL;
+  int is_onion;
+
+  err = http_parse_uri (&uri, url, 0);
+  if (err)
+    goto leave;
+  is_onion = uri->onion;
 
  once_more:
   /* Note that we only use the system provided certificates with the
@@ -145,6 +152,23 @@ ks_http_fetch (ctrl_t ctrl, const char *url, estream_t *r_fp)
                   url, s?s:"[none]", http_get_status_code (http));
         if (s && *s && redirects_left-- )
           {
+            if (is_onion)
+              {
+                /* Make sure that an onion address only redirects to
+                 * another onion address.  */
+                http_release_parsed_uri (uri);
+                uri = NULL;
+                err = http_parse_uri (&uri, s, 0);
+                if (err)
+                  goto leave;
+
+                if (! uri->onion)
+                  {
+                    err = gpg_error (GPG_ERR_FORBIDDEN);
+                    goto leave;
+                  }
+              }
+
             xfree (request_buffer);
             request_buffer = xtrystrdup (s);
             if (request_buffer)
@@ -186,5 +210,6 @@ ks_http_fetch (ctrl_t ctrl, const char *url, estream_t *r_fp)
   http_close (http, 0);
   http_session_release (session);
   xfree (request_buffer);
+  http_release_parsed_uri (uri);
   return err;
 }

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/ks-engine-hkp.c  | 25 +++++++++++++++++++++++++
 dirmngr/ks-engine-http.c | 25 +++++++++++++++++++++++++
 2 files changed, 50 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 20 06:21:35 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 20 Jul 2017 06:21:35 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-115-gcc12cf3
Message-ID: <E1dY2y0-0000MZ-2j@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  cc12cf386b620e658fa93a0bd40477bc16d85d98 (commit)
      from  e7fc6e3bf0eb6ffe53e1f099d28ce45cef4a8a87 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cc12cf386b620e658fa93a0bd40477bc16d85d98
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Thu Jul 20 13:19:18 2017 +0900

    dnsmngr: Fix use of CPP.
    
    * dirmngr/dns.c (HAVE_STATIC_ASSERT, HAVE___ATOMIC_FETCH_ADD)
    (DNS_HAVE_SOCKADDR_UN, HAVE_SOCK_NONBLOCK): Don't use defined
    to be expanded for expression evaluation.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/dirmngr/dns.c b/dirmngr/dns.c
index a89411b..94dc7ae 100644
--- a/dirmngr/dns.c
+++ b/dirmngr/dns.c
@@ -205,8 +205,10 @@ typedef int socket_fd_t;
 #ifndef HAVE_STATIC_ASSERT
 #if DNS_GNUC_PREREQ(0,0,0) && !DNS_GNUC_PREREQ(4,6,0)
 #define HAVE_STATIC_ASSERT 0 /* glibc doesn't check GCC version */
+#elif defined(static_assert)
+#define HAVE_STATIC_ASSERT 1
 #else
-#define HAVE_STATIC_ASSERT (defined static_assert)
+#define HAVE_STATIC_ASSERT 0
 #endif
 #endif
 
@@ -380,7 +382,11 @@ const char *dns_strerror(int error) {
  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
 
 #ifndef HAVE___ATOMIC_FETCH_ADD
-#define HAVE___ATOMIC_FETCH_ADD (defined __ATOMIC_RELAXED)
+#ifdef __ATOMIC_RELAXED
+#define HAVE___ATOMIC_FETCH_ADD 1
+#else
+#define HAVE___ATOMIC_FETCH_ADD 0
+#endif
 #endif
 
 #ifndef HAVE___ATOMIC_FETCH_SUB
@@ -787,7 +793,11 @@ DNS_NOTUSED static size_t dns_strnlcpy(char *dst, size_t lim, const char *src, s
 } /* dns_strnlcpy() */
 
 
-#define DNS_HAVE_SOCKADDR_UN (defined AF_UNIX && !defined _WIN32)
+#if (defined AF_UNIX && !defined _WIN32)
+#define DNS_HAVE_SOCKADDR_UN 1
+#else
+#define DNS_HAVE_SOCKADDR_UN 0
+#endif
 
 static size_t dns_af_len(int af) {
 	static const size_t table[AF_MAX]	= {
@@ -7051,11 +7061,19 @@ static void dns_socketclose(int *fd, const struct dns_options *opts) {
 #endif
 
 #ifndef HAVE_SOCK_CLOEXEC
-#define HAVE_SOCK_CLOEXEC (defined SOCK_CLOEXEC)
+#ifdef SOCK_CLOEXEC
+#define HAVE_SOCK_CLOEXEC 1
+#else
+#define HAVE_SOCK_CLOEXEC 0
+#endif
 #endif
 
 #ifndef HAVE_SOCK_NONBLOCK
-#define HAVE_SOCK_NONBLOCK (defined SOCK_NONBLOCK)
+#ifdef SOCK_NONBLOCK
+#define HAVE_SOCK_NONBLOCK 1
+#else
+#define HAVE_SOCK_NONBLOCK 0
+#endif
 #endif
 
 #define DNS_SO_MAXTRY	7

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dns.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 20 09:38:58 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 20 Jul 2017 09:38:58 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-116-g84146b3
Message-ID: <E1dY631-00040U-Sm@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  84146b3ec44943f06c66a603de19094b930ad446 (commit)
      from  cc12cf386b620e658fa93a0bd40477bc16d85d98 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 84146b3ec44943f06c66a603de19094b930ad446
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Thu Jul 20 16:37:56 2017 +0900

    common: logstream fix.
    
    * common/logging.c (set_file_fd): Don't close es_stderr.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/common/logging.c b/common/logging.c
index bc5f72b..c4eaca4 100644
--- a/common/logging.c
+++ b/common/logging.c
@@ -472,7 +472,8 @@ set_file_fd (const char *name, int fd)
   /* Close an open log stream.  */
   if (logstream)
     {
-      es_fclose (logstream);
+      if (logstream != es_stderr)
+        es_fclose (logstream);
       logstream = NULL;
     }
 

-----------------------------------------------------------------------

Summary of changes:
 common/logging.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 20 10:32:55 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Thu, 20 Jul 2017 10:32:55 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-117-g69614d5
Message-ID: <E1dY6tE-0003Xg-D3@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  69614d55018ddb8678d8904a52e648931f480d72 (commit)
      from  84146b3ec44943f06c66a603de19094b930ad446 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 69614d55018ddb8678d8904a52e648931f480d72
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Thu Jul 20 17:27:21 2017 +0900

    scd: Support longer data length for special DOs for v3 card.
    
    * scd/app-openpgp.c (data_objects): Special DOs like "Login Data",
    "URL", "Private DO N" can be longer size >= 256.
    (struct app_local_s): Define bits for v3 card.
    (get_cached_data): Use extcap.max_special_do for special DOs.
    (app_select_openpgp): Detect if extcap_v3, kdf_do, and other bits.
    
    --
    
    GnuPG-bug-id: 3262
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index 25f3dbe..f63b18d 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -85,12 +85,15 @@ static struct {
                                  does not work with composite DO and
                                  is currently only useful for the CHV
                                  status bytes. */
-  int try_extlen:1;           /* Large object; try to use an extended
-                                 length APDU.  */
+  int try_extlen:2;           /* Large object; try to use an extended
+                                 length APDU when !=0.  The size is
+                                 determined by extcap.max_certlen_3
+                                 when == 1, and by extcap.max_special_do
+                                 when == 2.  */
   char *desc;
 } data_objects[] = {
-  { 0x005E, 0,    0, 1, 0, 0, 0, 0, "Login Data" },
-  { 0x5F50, 0,    0, 0, 0, 0, 0, 0, "URL" },
+  { 0x005E, 0,    0, 1, 0, 0, 0, 2, "Login Data" },
+  { 0x5F50, 0,    0, 0, 0, 0, 0, 2, "URL" },
   { 0x5F52, 0,    0, 1, 0, 0, 0, 0, "Historical Bytes" },
   { 0x0065, 1,    0, 1, 0, 0, 0, 0, "Cardholder Related Data"},
   { 0x005B, 0, 0x65, 0, 0, 0, 0, 0, "Name" },
@@ -110,10 +113,10 @@ static struct {
   { 0x00CD, 0, 0x6E, 1, 0, 0, 0, 0, "Generation time" },
   { 0x007A, 1,    0, 1, 0, 0, 0, 0, "Security Support Template" },
   { 0x0093, 0, 0x7A, 1, 1, 0, 0, 0, "Digital Signature Counter" },
-  { 0x0101, 0,    0, 0, 0, 0, 0, 0, "Private DO 1"},
-  { 0x0102, 0,    0, 0, 0, 0, 0, 0, "Private DO 2"},
-  { 0x0103, 0,    0, 0, 0, 0, 0, 0, "Private DO 3"},
-  { 0x0104, 0,    0, 0, 0, 0, 0, 0, "Private DO 4"},
+  { 0x0101, 0,    0, 0, 0, 0, 0, 2, "Private DO 1"},
+  { 0x0102, 0,    0, 0, 0, 0, 0, 2, "Private DO 2"},
+  { 0x0103, 0,    0, 0, 0, 0, 0, 2, "Private DO 3"},
+  { 0x0104, 0,    0, 0, 0, 0, 0, 2, "Private DO 4"},
   { 0x7F21, 1,    0, 1, 0, 0, 0, 1, "Cardholder certificate"},
   /* V3.0 */
   { 0x7F74, 0,    0, 1, 0, 0, 0, 0, "General Feature Management"},
@@ -185,18 +188,25 @@ struct app_local_s {
   /* Keep track of extended card capabilities.  */
   struct
   {
-    unsigned int is_v2:1;              /* This is a v2.0 compatible card.  */
-    unsigned int sm_supported:1;       /* Secure Messaging is supported.  */
+    unsigned int is_v2:1;              /* Compatible to v2 or later.        */
+    unsigned int extcap_v3:1;          /* Extcap is in v3 format.           */
+    unsigned int has_button:1;         /* Has confirmation button or not.   */
+
+    unsigned int sm_supported:1;       /* Secure Messaging is supported.    */
     unsigned int get_challenge:1;
     unsigned int key_import:1;
     unsigned int change_force_chv:1;
     unsigned int private_dos:1;
     unsigned int algo_attr_change:1;   /* Algorithm attributes changeable.  */
-    unsigned int has_decrypt:1;        /* Support symmetric decryption.  */
-    unsigned int has_button:1;
-    unsigned int sm_algo:2;            /* Symmetric crypto algo for SM.  */
+    unsigned int has_decrypt:1;        /* Support symmetric decryption.     */
+    unsigned int kdf_do:1;                /* Support KDF DOs.               */
+
+    unsigned int sm_algo:2;            /* Symmetric crypto algo for SM.     */
+    unsigned int pin_blk2:1;           /* PIN block 2 format supported.     */
+    unsigned int mse:1;                /* MSE command supported.            */
     unsigned int max_certlen_3:16;
-    unsigned int max_get_challenge:16; /* Maximum size for get_challenge.  */
+    unsigned int max_get_challenge:16; /* Maximum size for get_challenge.   */
+    unsigned int max_special_do:16;    /* Maximum size for special DOs.     */
   } extcap;
 
   /* Flags used to control the application.  */
@@ -323,7 +333,14 @@ get_cached_data (app_t app, int tag,
     }
 
   if (try_extlen && app->app_local->cardcap.ext_lc_le)
-    exmode = app->app_local->extcap.max_certlen_3;
+    {
+      if (try_extlen == 1)
+        exmode = app->app_local->extcap.max_certlen_3;
+      else if (try_extlen == 2 && app->app_local->extcap.extcap_v3)
+        exmode = app->app_local->extcap.max_special_do;
+      else
+        exmode = 0;
+    }
   else
     exmode = 0;
 
@@ -5006,6 +5023,8 @@ app_select_openpgp (app_t app)
       if (app->card_version >= 0x0200)
         app->app_local->extcap.is_v2 = 1;
 
+      if (app->card_version >= 0x0300)
+        app->app_local->extcap.extcap_v3 = 1;
 
       /* Read the historical bytes.  */
       relptr = get_one_do (app, 0x5f52, &buffer, &buflen, NULL);
@@ -5048,14 +5067,24 @@ app_select_openpgp (app_t app)
           app->app_local->extcap.private_dos      = !!(*buffer & 0x08);
           app->app_local->extcap.algo_attr_change = !!(*buffer & 0x04);
           app->app_local->extcap.has_decrypt      = !!(*buffer & 0x02);
+          app->app_local->extcap.kdf_do           = !!(*buffer & 0x01);
         }
       if (buflen >= 10)
         {
-          /* Available with v2 cards.  */
+          /* Available with cards of v2 or later.  */
           app->app_local->extcap.sm_algo = buffer[1];
           app->app_local->extcap.max_get_challenge
                                                = (buffer[2] << 8 | buffer[3]);
           app->app_local->extcap.max_certlen_3 = (buffer[4] << 8 | buffer[5]);
+
+          /* Interpretation is different between v2 and v3, unfortunately.  */
+          if (app->app_local->extcap.extcap_v3)
+            {
+              app->app_local->extcap.max_special_do
+                = (buffer[6] << 8 | buffer[7]);
+              app->app_local->extcap.pin_blk2 = !!(buffer[8] & 0x01);
+              app->app_local->extcap.mse= !!(buffer[9] & 0x01);
+            }
         }
       xfree (relptr);
 

-----------------------------------------------------------------------

Summary of changes:
 scd/app-openpgp.c | 61 ++++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 45 insertions(+), 16 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 20 10:54:14 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 20 Jul 2017 10:54:14 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.8.0-3-g9347809
Message-ID: <E1dY7Dq-0006E9-Gm@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  93478098dce6a123ffb511767861b09255a3f784 (commit)
      from  1d8e4c2c3a7d0a4154caf5bd720a9a0b04179390 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 93478098dce6a123ffb511767861b09255a3f784
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 20 10:49:24 2017 +0200

    doc: Typo fix.
    
    --

diff --git a/NEWS b/NEWS
index 5460bae..4ca8bc2 100644
--- a/NEWS
+++ b/NEWS
@@ -17,7 +17,7 @@ Noteworthy changes in version 1.8.0 (2017-07-18)  [C22/A2/R0]
 
    - GCRYCTL_REINIT_SYSCALL_CLAMP allows to init nPth after Libgcrypt.
 
-   - New gobal configuration file /etc/gcrypt/random.conf.
+   - New global configuration file /etc/gcrypt/random.conf.
 
  * Extended interfaces:
 

-----------------------------------------------------------------------

Summary of changes:
 NEWS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 20 17:48:16 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Thu, 20 Jul 2017 17:48:16 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-118-g9998b16
Message-ID: <E1dYDgX-0000pG-GX@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  9998b162b47931fb8a8ed961d53418d505358888 (commit)
      from  69614d55018ddb8678d8904a52e648931f480d72 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 9998b162b47931fb8a8ed961d53418d505358888
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Thu Jul 20 17:41:49 2017 +0200

    g10: Return proper error when gpg-agent fails to start during probe.
    
    * g10/getkey.c (lookup): Return immediately on any other error than
    GPG_ERR_NO_SECKEY from agent_probe_any_secret_key.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2204

diff --git a/g10/getkey.c b/g10/getkey.c
index 285ea35..2bec984 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -3741,8 +3741,14 @@ lookup (ctrl_t ctrl, getkey_ctx_t ctx, int want_secret,
 	  goto skip;
 	}
 
-      if (want_secret && agent_probe_any_secret_key (NULL, keyblock))
-        goto skip; /* No secret key available.  */
+      if (want_secret)
+	{
+	  rc = agent_probe_any_secret_key (NULL, keyblock);
+	  if (gpg_err_code(rc) == GPG_ERR_NO_SECKEY)
+	    goto skip; /* No secret key available.  */
+	  if (rc)
+	    goto found; /* Unexpected error.  */
+	}
 
       /* Warning: node flag bits 0 and 1 should be preserved by
        * merge_selfsigs.  */

-----------------------------------------------------------------------

Summary of changes:
 g10/getkey.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 20 18:20:24 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 20 Jul 2017 18:20:24 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-122-g165cdd8
Message-ID: <E1dYEBe-0006Ke-TY@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  165cdd8121bbf80bfe2da071539d3578630f198f (commit)
       via  bddc2e04f1ddc18be20efc0f0508be401b345f42 (commit)
       via  33ecb541fcc2e8030989384b5e8c55aeccd21128 (commit)
       via  3ee314dde16d1d69ddf840cdb8b5aa186c592262 (commit)
      from  9998b162b47931fb8a8ed961d53418d505358888 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 165cdd8121bbf80bfe2da071539d3578630f198f
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 20 17:27:48 2017 +0200

    gpg: New option --with-key-origin.
    
    * g10/getkey.c (parse_key_origin): Factor list out as ...
    (key_origin_list): new struct.
    (key_origin_string): New.
    * g10/gpg.c (oWithKeyOrigin): New const.
    (opts): New option --with-key-origin.
    (main): Implement option.
    * g10/options.h (struct opt): New flag with_key_origin.
    * g10/keylist.c (list_keyblock_print): Print key origin info.
    (list_keyblock_colon): Ditto.

diff --git a/doc/DETAILS b/doc/DETAILS
index 28fb55a..0be55f4 100644
--- a/doc/DETAILS
+++ b/doc/DETAILS
@@ -241,8 +241,7 @@ described here.
 
     The origin of the key or the user ID.  This is an integer
     optionally followed by a space and an URL.  This goes along with
-    the previous field.  The values are not yet defined.
-
+    the previous field.  The URL is quoted in C style.
 
 ** Special fields
 
diff --git a/doc/gpg.texi b/doc/gpg.texi
index 64dd502..cae351b 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -2531,6 +2531,13 @@ Print the ICAO spelling of the fingerprint in addition to the hex digits.
 Include the keygrip in the key listings.  In @code{--with-colons} mode
 this is implicitly enable for secret keys.
 
+ at item --with-key-origin
+ at opindex with-key-origin
+Include the locally held information on the origin and last update of
+a key in a key listing.  In @code{--with-colons} mode this is always
+printed.  This data is currently experimental and shall not be
+considered part of the stable API.
+
 @item --with-wkd-hash
 @opindex with-wkd-hash
 Print a Web Key Directory identifier along with each user ID in key
diff --git a/g10/getkey.c b/g10/getkey.c
index 2bec984..484063e 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -4300,11 +4300,13 @@ parse_auto_key_locate (char *options)
 }
 
 
-/* Parse the argument for --key-origin.  Return false on error. */
-int
-parse_key_origin (char *string)
-{
-  struct { const char *name; int origin; } list[] = {
+

+/* The list of key origins. */
+static struct {
+  const char *name;
+  int origin;
+} key_origin_list[] =
+  {
     { "self",    KEYORG_SELF    },
     { "file",    KEYORG_FILE    },
     { "url",     KEYORG_URL     },
@@ -4314,27 +4316,45 @@ parse_key_origin (char *string)
     { "ks",      KEYORG_KS      },
     { "unknown", KEYORG_UNKNOWN }
   };
+
+/* Parse the argument for --key-origin.  Return false on error. */
+int
+parse_key_origin (char *string)
+{
   int i;
 
   if (!ascii_strcasecmp (string, "help"))
     {
       log_info (_("valid values for option '%s':\n"), "--key-origin");
-      for (i=0; i < DIM (list); i++)
-        log_info ("  %s\n", list[i].name);
+      for (i=0; i < DIM (key_origin_list); i++)
+        log_info ("  %s\n", key_origin_list[i].name);
       g10_exit (1);
     }
 
-  for (i=0; i < DIM (list); i++)
-    if (!ascii_strcasecmp (string, list[i].name))
+  for (i=0; i < DIM (key_origin_list); i++)
+    if (!ascii_strcasecmp (string, key_origin_list[i].name))
       {
-        opt.key_origin = list[i].origin;
+        opt.key_origin = key_origin_list[i].origin;
         return 1;
       }
 
   return 0;
 }
 
+/* Return a string or "?" for the key ORIGIN.  */
+const char *
+key_origin_string (int origin)
+{
+  int i;
 
+  for (i=0; i < DIM (key_origin_list); i++)
+    if (key_origin_list[i].origin == origin)
+      return key_origin_list[i].name;
+  return "?";
+}
+
+
+

 /* Returns true if a secret key is available for the public key with
    key id KEYID; returns false if not.  This function ignores legacy
    keys.  Note: this is just a fast check and does not tell us whether
diff --git a/g10/gpg.c b/g10/gpg.c
index 5c60e1d..70b8011 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -201,6 +201,7 @@ enum cmd_and_opt_values
     oWithWKDHash,
     oWithColons,
     oWithKeyData,
+    oWithKeyOrigin,
     oWithTofuInfo,
     oWithSigList,
     oWithSigCheck,
@@ -785,6 +786,7 @@ static ARGPARSE_OPTS opts[] = {
   ARGPARSE_s_n (oWithKeygrip,     "with-keygrip", "@"),
   ARGPARSE_s_n (oWithSecret,      "with-secret", "@"),
   ARGPARSE_s_n (oWithWKDHash,     "with-wkd-hash", "@"),
+  ARGPARSE_s_n (oWithKeyOrigin,   "with-key-origin", "@"),
   ARGPARSE_s_s (oDisableCipherAlgo,  "disable-cipher-algo", "@"),
   ARGPARSE_s_s (oDisablePubkeyAlgo,  "disable-pubkey-algo", "@"),
   ARGPARSE_s_n (oAllowNonSelfsignedUID,      "allow-non-selfsigned-uid", "@"),
@@ -2733,6 +2735,10 @@ main (int argc, char **argv)
             opt.with_wkd_hash = 1;
             break;
 
+	  case oWithKeyOrigin:
+            opt.with_key_origin = 1;
+            break;
+
 	  case oSecretKeyring:
             /* Ignore this old option.  */
             break;
diff --git a/g10/keydb.h b/g10/keydb.h
index 6416e63..15345bb 100644
--- a/g10/keydb.h
+++ b/g10/keydb.h
@@ -398,6 +398,7 @@ char *get_user_id_byfpr_native (ctrl_t ctrl, const byte *fpr);
 void release_akl(void);
 int parse_auto_key_locate(char *options);
 int parse_key_origin (char *string);
+const char *key_origin_string (int origin);
 
 /*-- keyid.c --*/
 int pubkey_letter( int algo );
diff --git a/g10/keylist.c b/g10/keylist.c
index e4d5d06..37a26dc 100644
--- a/g10/keylist.c
+++ b/g10/keylist.c
@@ -922,6 +922,21 @@ list_keyblock_print (ctrl_t ctrl, kbnode_t keyblock, int secret, int fpr,
   if (opt.with_key_data)
     print_key_data (pk);
 
+  if (opt.with_key_origin
+      && (pk->keyorg || pk->keyupdate || pk->updateurl))
+    {
+      char updatestr[MK_DATESTR_SIZE];
+
+      es_fprintf (es_stdout, "      origin=%s last=%s %s",
+                  key_origin_string (pk->keyorg),
+                  mk_datestr (updatestr, sizeof updatestr, pk->keyupdate),
+                  pk->updateurl? "url=":"");
+      if (pk->updateurl)
+        print_utf8_string (es_stdout, pk->updateurl);
+      es_putc ('\n', es_stdout);
+    }
+
+
   for (kbctx = NULL; (node = walk_kbnode (keyblock, &kbctx, 0));)
     {
       if (node->pkt->pkttype == PKT_USER_ID)
@@ -987,6 +1002,22 @@ list_keyblock_print (ctrl_t ctrl, kbnode_t keyblock, int secret, int fpr,
               xfree (mbox);
             }
 
+          if (opt.with_key_origin
+              && (uid->keyorg || uid->keyupdate || uid->updateurl))
+            {
+              char updatestr[MK_DATESTR_SIZE];
+
+              es_fprintf (es_stdout, "   %*sorigin=%s last=%s %s",
+                          indent, "",
+                          key_origin_string (uid->keyorg),
+                          mk_datestr (updatestr, sizeof updatestr,
+                                      uid->keyupdate),
+                          pk->updateurl? "url=":"");
+              if (pk->updateurl)
+                print_utf8_string (es_stdout, pk->updateurl);
+              es_putc ('\n', es_stdout);
+            }
+
 	  if ((opt.list_options & LIST_SHOW_PHOTOS) && uid->attribs != NULL)
 	    show_photos (ctrl, uid->attribs, uid->numattribs, pk, uid);
 	}
@@ -1315,7 +1346,13 @@ list_keyblock_colon (ctrl_t ctrl, kbnode_t keyblock,
   es_putc (':', es_stdout);		/* End of field 17. */
   print_compliance_flags (pk, keylength, curvename);
   es_putc (':', es_stdout);		/* End of field 18 (compliance). */
+  if (pk->keyupdate)
+    es_fputs (colon_strtime (pk->keyupdate), es_stdout);
   es_putc (':', es_stdout);		/* End of field 19 (last_update). */
+  es_fprintf (es_stdout, "%d%s", pk->keyorg, pk->updateurl? " ":"");
+  if (pk->updateurl)
+    es_write_sanitized (es_stdout, pk->updateurl, strlen (pk->updateurl),
+                        ":", NULL);
   es_putc (':', es_stdout);		/* End of field 20 (origin). */
   es_putc ('\n', es_stdout);
 
@@ -1367,7 +1404,14 @@ list_keyblock_colon (ctrl_t ctrl, kbnode_t keyblock,
 	  else
 	    es_write_sanitized (es_stdout, uid->name, uid->len, ":", NULL);
 	  es_fputs (":::::::::", es_stdout);
+          if (uid->keyupdate)
+            es_fputs (colon_strtime (uid->keyupdate), es_stdout);
           es_putc (':', es_stdout);	/* End of field 19 (last_update). */
+          es_fprintf (es_stdout, "%d%s", uid->keyorg, uid->updateurl? " ":"");
+          if (uid->updateurl)
+            es_write_sanitized (es_stdout,
+                                uid->updateurl, strlen (uid->updateurl),
+                                ":", NULL);
           es_putc (':', es_stdout);	/* End of field 20 (origin). */
 	  es_putc ('\n', es_stdout);
 #ifdef USE_TOFU
diff --git a/g10/options.h b/g10/options.h
index 5bb506e..21249e9 100644
--- a/g10/options.h
+++ b/g10/options.h
@@ -85,6 +85,7 @@ struct
   int with_tofu_info;   /* Option --with-tofu_info active.  */
   int with_secret;      /* Option --with-secret active.  */
   int with_wkd_hash;    /* Option --with-wkd-hash.  */
+  int with_key_origin;  /* Option --with-key-origin.  */
   int fingerprint; /* list fingerprints */
   int list_sigs;   /* list signatures */
   int no_armor;

commit bddc2e04f1ddc18be20efc0f0508be401b345f42
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 20 17:20:17 2017 +0200

    common: New function print_utf9_string.
    
    * common/miscellaneous.c (print_utf8_string): New.
    --
    
    This is a simple convenience function.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/miscellaneous.c b/common/miscellaneous.c
index c9c603d..caeb66f 100644
--- a/common/miscellaneous.c
+++ b/common/miscellaneous.c
@@ -228,6 +228,16 @@ print_utf8_buffer (estream_t stream, const void *p, size_t n)
   do_print_utf8_buffer (stream, p, n, NULL, NULL);
 }
 
+
+void
+print_utf8_string (estream_t stream, const char *p)
+{
+  if (!p)
+    p = "";
+  do_print_utf8_buffer (stream, p, strlen (p), NULL, NULL);
+}
+
+
 /* Write LENGTH bytes of BUFFER to FP as a hex encoded string.
    RESERVED must be 0. */
 void
diff --git a/common/util.h b/common/util.h
index c0aa57a..5b712d3 100644
--- a/common/util.h
+++ b/common/util.h
@@ -302,6 +302,7 @@ void print_utf8_buffer3 (estream_t fp, const void *p, size_t n,
                          const char *delim);
 void print_utf8_buffer2 (estream_t fp, const void *p, size_t n, int delim);
 void print_utf8_buffer (estream_t fp, const void *p, size_t n);
+void print_utf8_string (estream_t stream, const char *p);
 void print_hexstring (FILE *fp, const void *buffer, size_t length,
                       int reserved);
 char *try_make_printable_string (const void *p, size_t n, int delim);

commit 33ecb541fcc2e8030989384b5e8c55aeccd21128
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 20 14:49:07 2017 +0200

    doc: Comment fixes and one trailing comma fix.
    
    --

diff --git a/doc/DETAILS b/doc/DETAILS
index cbeead7..28fb55a 100644
--- a/doc/DETAILS
+++ b/doc/DETAILS
@@ -1348,7 +1348,7 @@ CREATE TABLE signatures (
   - 1 octet :: Key Source; i.e. the origin of the key:
                - 0 :: Unknown source.
                - 1 :: Public keyserver.
-               - 2 :: Preferred keysrver.
+               - 2 :: Preferred keyserver.
                - 3 :: OpenPGP DANE.
                - 4 :: Web Key Directory.
                - 5 :: Import from a trusted URL.
@@ -1538,5 +1538,5 @@ Description of some debug flags:
    If one of the "foo/*" names are used a "keygen.flags" prompt needs
    to be answered as well.  Instead of toggling the predefined flags,
    it is also possible to set them direct: Use a "=" character
-   directly followed by a comination of "a" (for authentication), "s"
+   directly followed by a combination of "a" (for authentication), "s"
    (for signing), or "c" (for certification).
diff --git a/g10/build-packet.c b/g10/build-packet.c
index 6d00fc5..d4a1d6a 100644
--- a/g10/build-packet.c
+++ b/g10/build-packet.c
@@ -182,8 +182,8 @@ build_packet (IOBUF out, PACKET *pkt)
 
 
 /* Build a packet and write it to the stream OUT.  This variant also
- * writes the meta data using ring tyrust packets.  Returns: 0 on
- * success or on aerror code.  */
+ * writes the meta data using ring trust packets.  Returns: 0 on
+ * success or on error code.  */
 gpg_error_t
 build_packet_and_meta (iobuf_t out, PACKET *pkt)
 {
diff --git a/g10/keydb.h b/g10/keydb.h
index 803987b..6416e63 100644
--- a/g10/keydb.h
+++ b/g10/keydb.h
@@ -126,7 +126,7 @@ enum
     KEYORG_WKD     = 4, /* Web Key Directory.   */
     KEYORG_URL     = 5, /* Trusted URL.         */
     KEYORG_FILE    = 6, /* Trusted file.        */
-    KEYORG_SELF    = 7, /* We generated it.     */
+    KEYORG_SELF    = 7  /* We generated it.     */
   };
 
 
diff --git a/g10/packet.h b/g10/packet.h
index 56ac503..8dca88b 100644
--- a/g10/packet.h
+++ b/g10/packet.h
@@ -485,8 +485,8 @@ typedef struct {
 
 /* Subtypes for the ring trust packet.  */
 #define RING_TRUST_SIG 0  /* The classical signature cache.  */
-#define RING_TRUST_KEY 1  /* A KEYSRC on a primary key.      */
-#define RING_TRUST_UID 2  /* A KEYSRC on a user id.          */
+#define RING_TRUST_KEY 1  /* A KEYORG on a primary key.      */
+#define RING_TRUST_UID 2  /* A KEYORG on a user id.          */
 
 /* The local only ring trust packet which OpenPGP declares as
  * implementation defined.  GnuPG uses this to cache signature
@@ -498,7 +498,7 @@ typedef struct {
   unsigned int trustval;
   unsigned int sigcache;
   unsigned char subtype; /* The subtype of this ring trust packet.   */
-  unsigned char keyorg;  /* The origin of the key (KEYSRC_*).        */
+  unsigned char keyorg;  /* The origin of the key (KEYORG_*).        */
   u32 keyupdate;         /* The wall time the key was last updated.  */
   char *url;             /* NULL or the URL of the source.           */
 } PKT_ring_trust;

commit 3ee314dde16d1d69ddf840cdb8b5aa186c592262
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 20 13:36:44 2017 +0200

    gpg: Make function mk_datestr public.
    
    * g10/keydb.h (MK_DATESTR_SIZE): New.
    * g10/keyid.c (mk_datestr): Make public.  Add arg bufsize and use
    snprintf.  Change arg atime to u32.
    (datestr_from_pk): Simplify.
    (datestr_from_sig): Ditto.
    (expirestr_from_pk): Ditto.
    (expirestr_from_sig): Ditto.
    (revokestr_from_pk): Ditto.
    --
    
    Note that this also reduces the size of the static buffers from 16 to
    11 which is sufficient for the string.  In the past we added the 5
    extra bytes to cope for bugs in gmtime which is now handles by
    snprintf.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/keydb.h b/g10/keydb.h
index bad3149..803987b 100644
--- a/g10/keydb.h
+++ b/g10/keydb.h
@@ -458,6 +458,13 @@ u32 keyid_from_fingerprint (ctrl_t ctrl, const byte *fprint, size_t fprint_len,
                             u32 *keyid);
 byte *namehash_from_uid(PKT_user_id *uid);
 unsigned nbits_from_pk( PKT_public_key *pk );
+
+/* Convert an UTC TIMESTAMP into an UTC yyyy-mm-dd string.  Return
+ * that string.  The caller should pass a buffer with at least a size
+ * of MK_DATESTR_SIZE.  */
+char *mk_datestr (char *buffer, size_t bufsize, u32 timestamp);
+#define MK_DATESTR_SIZE 11
+
 const char *datestr_from_pk( PKT_public_key *pk );
 const char *datestr_from_sig( PKT_signature *sig );
 const char *expirestr_from_pk( PKT_public_key *pk );
diff --git a/g10/keyid.c b/g10/keyid.c
index 24a5643..d733156 100644
--- a/g10/keyid.c
+++ b/g10/keyid.c
@@ -613,9 +613,13 @@ nbits_from_pk (PKT_public_key *pk)
 }
 
 
-static const char *
-mk_datestr (char *buffer, time_t atime)
+/* Convert an UTC TIMESTAMP into an UTC yyyy-mm-dd string.  Return
+ * that string.  The caller should pass a buffer with at least a size
+ * of MK_DATESTR_SIZE.  */
+char *
+mk_datestr (char *buffer, size_t bufsize, u32 timestamp)
 {
+  time_t atime = timestamp;
   struct tm *tp;
 
   if (IS_INVALID_TIME_T (atime))
@@ -623,8 +627,8 @@ mk_datestr (char *buffer, time_t atime)
   else
     {
       tp = gmtime (&atime);
-      sprintf (buffer,"%04d-%02d-%02d",
-               1900+tp->tm_year, tp->tm_mon+1, tp->tm_mday );
+      snprintf (buffer, bufsize, "%04d-%02d-%02d",
+                1900+tp->tm_year, tp->tm_mon+1, tp->tm_mday );
     }
   return buffer;
 }
@@ -638,59 +642,51 @@ mk_datestr (char *buffer, time_t atime)
 const char *
 datestr_from_pk (PKT_public_key *pk)
 {
-  static char buffer[11+5];
-  time_t atime = pk->timestamp;
+  static char buffer[MK_DATESTR_SIZE];
 
-  return mk_datestr (buffer, atime);
+  return mk_datestr (buffer, sizeof buffer, pk->timestamp);
 }
 
 
 const char *
 datestr_from_sig (PKT_signature *sig )
 {
-  static char buffer[11+5];
-  time_t atime = sig->timestamp;
+  static char buffer[MK_DATESTR_SIZE];
 
-  return mk_datestr (buffer, atime);
+  return mk_datestr (buffer, sizeof buffer, sig->timestamp);
 }
 
 
 const char *
 expirestr_from_pk (PKT_public_key *pk)
 {
-  static char buffer[11+5];
-  time_t atime;
+  static char buffer[MK_DATESTR_SIZE];
 
   if (!pk->expiredate)
     return _("never     ");
-  atime = pk->expiredate;
-  return mk_datestr (buffer, atime);
+  return mk_datestr (buffer, sizeof buffer, pk->expiredate);
 }
 
 
 const char *
 expirestr_from_sig (PKT_signature *sig)
 {
-  static char buffer[11+5];
-  time_t atime;
+  static char buffer[MK_DATESTR_SIZE];
 
   if (!sig->expiredate)
     return _("never     ");
-  atime=sig->expiredate;
-  return mk_datestr (buffer, atime);
+  return mk_datestr (buffer, sizeof buffer, sig->expiredate);
 }
 
 
 const char *
 revokestr_from_pk( PKT_public_key *pk )
 {
-  static char buffer[11+5];
-  time_t atime;
+  static char buffer[MK_DATESTR_SIZE];
 
   if(!pk->revoked.date)
     return _("never     ");
-  atime=pk->revoked.date;
-  return mk_datestr (buffer, atime);
+  return mk_datestr (buffer, sizeof buffer, pk->revoked.date);
 }
 
 

-----------------------------------------------------------------------

Summary of changes:
 common/miscellaneous.c | 10 ++++++++++
 common/util.h          |  1 +
 doc/DETAILS            |  7 +++----
 doc/gpg.texi           |  7 +++++++
 g10/build-packet.c     |  4 ++--
 g10/getkey.c           | 40 ++++++++++++++++++++++++++++++----------
 g10/gpg.c              |  6 ++++++
 g10/keydb.h            | 10 +++++++++-
 g10/keyid.c            | 40 ++++++++++++++++++----------------------
 g10/keylist.c          | 44 ++++++++++++++++++++++++++++++++++++++++++++
 g10/options.h          |  1 +
 g10/packet.h           |  6 +++---
 12 files changed, 134 insertions(+), 42 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 20 18:40:56 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 20 Jul 2017 18:40:56 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-123-ga5dcc01
Message-ID: <E1dYEVV-0000tc-8f@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  a5dcc01a739db7dd75aeb2cd65f51d4839ef7fc9 (commit)
      from  165cdd8121bbf80bfe2da071539d3578630f198f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a5dcc01a739db7dd75aeb2cd65f51d4839ef7fc9
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 20 18:35:46 2017 +0200

    indent: Improve readability of some comments in getkey.c
    
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/getkey.c b/g10/getkey.c
index 484063e..74eed13 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -2491,32 +2491,32 @@ sig_to_revoke_info (PKT_signature * sig, struct revoke_info *rinfo)
 
 
 /* Given a keyblock, parse the key block and extract various pieces of
-   information and save them with the primary key packet and the user
-   id packets.  For instance, some information is stored in signature
-   packets.  We find the latest such valid packet (since the user can
-   change that information) and copy its contents into the
-   PKT_public_key.
-
-   Note that R_REVOKED may be set to 0, 1 or 2.
-
-   This function fills in the following fields in the primary key's
-   keyblock:
-
-     main_keyid          (computed)
-     revkey / numrevkeys (derived from self signed key data)
-     flags.valid         (whether we have at least 1 self-sig)
-     flags.maybe_revoked (whether a designed revoked the key, but
-                          we are missing the key to check the sig)
-     selfsigversion      (highest version of any valid self-sig)
-     pubkey_usage        (derived from most recent self-sig or most
-                          recent user id)
-     has_expired         (various sources)
-     expiredate          (various sources)
-
-  See the documentation for fixup_uidnode for how the user id packets
-  are modified.  In addition to that the primary user id's is_primary
-  field is set to 1 and the other user id's is_primary are set to
-  0.  */
+ * information and save them with the primary key packet and the user
+ * id packets.  For instance, some information is stored in signature
+ * packets.  We find the latest such valid packet (since the user can
+ * change that information) and copy its contents into the
+ * PKT_public_key.
+ *
+ * Note that R_REVOKED may be set to 0, 1 or 2.
+ *
+ * This function fills in the following fields in the primary key's
+ * keyblock:
+ *
+ *   main_keyid          (computed)
+ *   revkey / numrevkeys (derived from self signed key data)
+ *   flags.valid         (whether we have at least 1 self-sig)
+ *   flags.maybe_revoked (whether a designed revoked the key, but
+ *                        we are missing the key to check the sig)
+ *   selfsigversion      (highest version of any valid self-sig)
+ *   pubkey_usage        (derived from most recent self-sig or most
+ *                        recent user id)
+ *   has_expired         (various sources)
+ *   expiredate          (various sources)
+ *
+ * See the documentation for fixup_uidnode for how the user id packets
+ * are modified.  In addition to that the primary user id's is_primary
+ * field is set to 1 and the other user id's is_primary are set to 0.
+ */
 static void
 merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
 		     struct revoke_info *rinfo)
@@ -2537,17 +2537,16 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
   memset (rinfo, 0, sizeof (*rinfo));
 
   /* Section 11.1 of RFC 4880 determines the order of packets within a
-     message.  There are three sections, which must occur in the
-     following order: the public key, the user ids and user attributes
-     and the subkeys.  Within each section, each primary packet (e.g.,
-     a user id packet) is followed by one or more signature packets,
-     which modify that packet.  */
+   * message.  There are three sections, which must occur in the
+   * following order: the public key, the user ids and user attributes
+   * and the subkeys.  Within each section, each primary packet (e.g.,
+   * a user id packet) is followed by one or more signature packets,
+   * which modify that packet.  */
 
   /* According to Section 11.1 of RFC 4880, the public key must be the
-     first packet.  */
+     first packet.  Note that parse_keyblock_image ensures that the
+     first packet is the public key.  */
   if (keyblock->pkt->pkttype != PKT_PUBLIC_KEY)
-    /* parse_keyblock_image ensures that the first packet is the
-       public key.  */
     BUG ();
   pk = keyblock->pkt->pkt.public_key;
   keytimestamp = pk->timestamp;
@@ -2566,16 +2565,16 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
     }
 
   /* First pass:
-
-      - Find the latest direct key self-signature.  We assume that the
-        newest one overrides all others.
-
-      - Determine whether the key has been revoked.
-
-      - Gather all revocation keys (unlike other data, we don't just
-        take them from the latest self-signed packet).
-
-      - Determine max (sig[...]->version).
+   *
+   * - Find the latest direct key self-signature.  We assume that the
+   *   newest one overrides all others.
+   *
+   * - Determine whether the key has been revoked.
+   *
+   * - Gather all revocation keys (unlike other data, we don't just
+   *   take them from the latest self-signed packet).
+   *
+   * - Determine max (sig[...]->version).
    */
 
   /* Reset this in case this key was already merged. */
@@ -2587,8 +2586,8 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
   sigdate = 0; /* Helper variable to find the latest signature.  */
 
   /* According to Section 11.1 of RFC 4880, the public key comes first
-     and is immediately followed by any signature packets that modify
-     it.  */
+   * and is immediately followed by any signature packets that modify
+   * it.  */
   for (k = keyblock;
        k && k->pkt->pkttype != PKT_USER_ID
 	 && k->pkt->pkttype != PKT_ATTRIBUTE
@@ -2599,8 +2598,8 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
 	{
 	  PKT_signature *sig = k->pkt->pkt.signature;
 	  if (sig->keyid[0] == kid[0] && sig->keyid[1] == kid[1])
-	    /* Self sig.  */
-	    {
+	    { /* Self sig.  */
+
 	      if (check_key_signature (ctrl, keyblock, k, NULL))
 		; /* Signature did not verify.  */
 	      else if (IS_KEY_REV (sig))
@@ -2620,11 +2619,11 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
 	      else if (IS_KEY_SIG (sig))
 		{
 		  /* Add the indicated revocations keys from all
-		     signatures not just the latest.  We do this
-		     because you need multiple 1F sigs to properly
-		     handle revocation keys (PGP does it this way, and
-		     a revocation key could be sensitive and hence in
-		     a different signature). */
+		   * signatures not just the latest.  We do this
+		   * because you need multiple 1F sigs to properly
+		   * handle revocation keys (PGP does it this way, and
+		   * a revocation key could be sensitive and hence in
+		   * a different signature).  */
 		  if (sig->revkey)
 		    {
 		      int i;
@@ -2640,8 +2639,8 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
 		    }
 
 		  if (sig->timestamp >= sigdate)
-		    /* This is the latest signature so far.  */
-		    {
+		    { /* This is the latest signature so far.  */
+
 		      if (sig->flags.expired)
 			; /* Signature has expired - ignore it.  */
 		      else
@@ -2688,9 +2687,9 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
 			       sizeof (struct revocation_key));
     }
 
+  /* SIGNODE is the 1F signature packet with the latest creation time.
+   * Extract some information from it.  */
   if (signode)
-    /* SIGNODE is the 1F signature packet with the latest creation
-       time.  Extract some information from it.  */
     {
       /* Some information from a direct key signature take precedence
        * over the same information given in UID sigs.  */
@@ -2712,9 +2711,9 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
     }
 
   /* Pass 1.5: Look for key revocation signatures that were not made
-     by the key (i.e. did a revocation key issue a revocation for
-     us?).  Only bother to do this if there is a revocation key in the
-     first place and we're not revoked already.  */
+   * by the key (i.e. did a revocation key issue a revocation for
+   * us?).  Only bother to do this if there is a revocation key in the
+   * first place and we're not revoked already.  */
 
   if (!*r_revoked && pk->revkey)
     for (k = keyblock; k && k->pkt->pkttype != PKT_USER_ID; k = k->next)
@@ -2732,20 +2731,20 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
 		    *r_revoked = 2;
 		    sig_to_revoke_info (sig, rinfo);
 		    /* Don't continue checking since we can't be any
-		       more revoked than this.  */
+		     * more revoked than this.  */
 		    break;
 		  }
 		else if (gpg_err_code (rc) == GPG_ERR_NO_PUBKEY)
 		  pk->flags.maybe_revoked = 1;
 
 		/* A failure here means the sig did not verify, was
-		   not issued by a revocation key, or a revocation
-		   key loop was broken.  If a revocation key isn't
-		   findable, however, the key might be revoked and
-		   we don't know it.  */
+		 * not issued by a revocation key, or a revocation
+		 * key loop was broken.  If a revocation key isn't
+		 * findable, however, the key might be revoked and
+		 * we don't know it.  */
 
-		/* TODO: In the future handle subkey and cert
-		   revocations?  PGP doesn't, but it's in 2440. */
+		/* Fixme: In the future handle subkey and cert
+		 * revocations?  PGP doesn't, but it's in 2440.  */
 	      }
 	  }
       }
@@ -2753,28 +2752,30 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
   /* Second pass: Look at the self-signature of all user IDs.  */
 
   /* According to RFC 4880 section 11.1, user id and attribute packets
-     are in the second section, after the public key packet and before
-     the subkey packets.  */
+   * are in the second section, after the public key packet and before
+   * the subkey packets.  */
   signode = uidnode = NULL;
   sigdate = 0; /* Helper variable to find the latest signature in one UID. */
   for (k = keyblock; k && k->pkt->pkttype != PKT_PUBLIC_SUBKEY; k = k->next)
     {
       if (k->pkt->pkttype == PKT_USER_ID || k->pkt->pkttype == PKT_ATTRIBUTE)
-	/* New user id packet.  */
-	{
+	{ /* New user id packet.  */
+
+          /* Apply the data from the most recent self-signed packet to
+	   * the preceding user id packet.  */
 	  if (uidnode && signode)
-	    /* Apply the data from the most recent self-signed packet
-	       to the preceding user id packet.  */
 	    {
 	      fixup_uidnode (uidnode, signode, keytimestamp);
 	      pk->flags.valid = 1;
 	    }
+
 	  /* Clear SIGNODE.  The only relevant self-signed data for
-	     UIDNODE follows it.  */
+	   * UIDNODE follows it.  */
 	  if (k->pkt->pkttype == PKT_USER_ID)
 	    uidnode = k;
 	  else
 	    uidnode = NULL;
+
 	  signode = NULL;
 	  sigdate = 0;
 	}
@@ -2812,7 +2813,7 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
     }
 
   /* If the key isn't valid yet, and we have
-     --allow-non-selfsigned-uid set, then force it valid. */
+   * --allow-non-selfsigned-uid set, then force it valid. */
   if (!pk->flags.valid && opt.allow_non_selfsigned_uid)
     {
       if (opt.verbose)
@@ -2822,7 +2823,7 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
     }
 
   /* The key STILL isn't valid, so try and find an ultimately
-     trusted signature. */
+   * trusted signature. */
   if (!pk->flags.valid)
     {
       uidnode = NULL;
@@ -2842,12 +2843,11 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
 
 		  ultimate_pk = xmalloc_clear (sizeof (*ultimate_pk));
 
-		  /* We don't want to use the full get_pubkey to
-		     avoid infinite recursion in certain cases.
-		     There is no reason to check that an ultimately
-		     trusted key is still valid - if it has been
-		     revoked the user should also remove the
-		     ultimate trust flag.  */
+		  /* We don't want to use the full get_pubkey to avoid
+		   * infinite recursion in certain cases.  There is no
+		   * reason to check that an ultimately trusted key is
+		   * still valid - if it has been revoked the user
+		   * should also remove the ultimate trust flag.  */
 		  if (get_pubkey_fast (ultimate_pk, sig->keyid) == 0
 		      && check_key_signature2 (ctrl,
                                                keyblock, k, ultimate_pk,
@@ -2865,20 +2865,18 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
 	}
     }
 
-  /* Record the highest selfsig version so we know if this is a v3
-     key through and through, or a v3 key with a v4 selfsig
-     somewhere.  This is useful in a few places to know if the key
-     must be treated as PGP2-style or OpenPGP-style.  Note that a
-     selfsig revocation with a higher version number will also raise
-     this value.  This is okay since such a revocation must be
-     issued by the user (i.e. it cannot be issued by someone else to
-     modify the key behavior.) */
+  /* Record the highest selfsig version so we know if this is a v3 key
+   * through and through, or a v3 key with a v4 selfsig somewhere.
+   * This is useful in a few places to know if the key must be treated
+   * as PGP2-style or OpenPGP-style.  Note that a selfsig revocation
+   * with a higher version number will also raise this value.  This is
+   * okay since such a revocation must be issued by the user (i.e. it
+   * cannot be issued by someone else to modify the key behavior.) */
 
   pk->selfsigversion = sigversion;
 
-  /* Now that we had a look at all user IDs we can now get some information
-   * from those user IDs.
-   */
+  /* Now that we had a look at all user IDs we can now get some
+   * information from those user IDs.  */
 
   if (!key_usage)
     {
@@ -2890,6 +2888,7 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
 	  if (k->pkt->pkttype == PKT_USER_ID)
 	    {
 	      PKT_user_id *uid = k->pkt->pkt.user_id;
+
 	      if (uid->help_key_usage && uid->created > uiddate)
 		{
 		  key_usage = uid->help_key_usage;
@@ -2898,6 +2897,7 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
 	    }
 	}
     }
+
   if (!key_usage)
     {
       /* No key flags at all: get it from the algo.  */
@@ -2936,7 +2936,7 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
     }
 
   /* Currently only v3 keys have a maximum expiration date, but I'll
-     bet v5 keys get this feature again. */
+   * bet v5 keys get this feature again. */
   if (key_expire == 0
       || (pk->max_expiredate && key_expire > pk->max_expiredate))
     key_expire = pk->max_expiredate;
@@ -2944,8 +2944,8 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
   pk->has_expired = key_expire >= curtime ? 0 : key_expire;
   pk->expiredate = key_expire;
 
-  /* Fixme: we should see how to get rid of the expiretime fields  but
-   * this needs changes at other places too. */
+  /* Fixme: we should see how to get rid of the expiretime fields but
+   * this needs changes at other places too.  */
 
   /* And now find the real primary user ID and delete all others.  */
   uiddate = uiddate2 = 0;
@@ -2964,12 +2964,11 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
 		}
 	      else if (uid->created == uiddate && uidnode)
 		{
-		  /* The dates are equal, so we need to do a
-		     different (and arbitrary) comparison.  This
-		     should rarely, if ever, happen.  It's good to
-		     try and guarantee that two different GnuPG
-		     users with two different keyrings at least pick
-		     the same primary. */
+		  /* The dates are equal, so we need to do a different
+		   * (and arbitrary) comparison.  This should rarely,
+		   * if ever, happen.  It's good to try and guarantee
+		   * that two different GnuPG users with two different
+		   * keyrings at least pick the same primary.  */
 		  if (cmp_user_ids (uid, uidnode->pkt->pkt.user_id) > 0)
 		    uidnode = k;
 		}
@@ -3006,14 +3005,14 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
   else if (uidnode2)
     {
       /* None is flagged primary - use the latest user ID we have,
-         and disambiguate with the arbitrary packet comparison. */
+       * and disambiguate with the arbitrary packet comparison. */
       uidnode2->pkt->pkt.user_id->flags.primary = 1;
     }
   else
     {
       /* None of our uids were self-signed, so pick the one that
-         sorts first to be the primary.  This is the best we can do
-         here since there are no self sigs to date the uids. */
+       * sorts first to be the primary.  This is the best we can do
+       * here since there are no self sigs to date the uids. */
 
       uidnode = NULL;
 
@@ -3039,16 +3038,19 @@ merge_selfsigs_main (ctrl_t ctrl, kbnode_t keyblock, int *r_revoked,
 		      uidnode->pkt->pkt.user_id->flags.primary = 1;
 		    }
 		  else
-		    k->pkt->pkt.user_id->flags.primary = 0;	/* just to be
-								   safe */
+                    {
+                      /* just to be safe: */
+                      k->pkt->pkt.user_id->flags.primary = 0;
+                    }
 		}
 	    }
 	}
     }
 }
 
+
 /* Convert a buffer to a signature.  Useful for 0x19 embedded sigs.
-   Caller must free the signature when they are done. */
+ * Caller must free the signature when they are done. */
 static PKT_signature *
 buf_to_sig (const byte * buf, size_t len)
 {
@@ -3068,25 +3070,26 @@ buf_to_sig (const byte * buf, size_t len)
   return sig;
 }
 
-/* Use the self-signed data to fill in various fields in subkeys.
-
-   KEYBLOCK is the whole keyblock.  SUBNODE is the subkey to fill in.
 
-   Sets the following fields on the subkey:
-
-     main_keyid
-     flags.valid        if the subkey has a valid self-sig binding
-     flags.revoked
-     flags.backsig
-     pubkey_usage
-     has_expired
-     expired_date
-
-   On this subkey's most revent valid self-signed packet, the
-   following field is set:
-
-     flags.chosen_selfsig
-  */
+/* Use the self-signed data to fill in various fields in subkeys.
+ *
+ * KEYBLOCK is the whole keyblock.  SUBNODE is the subkey to fill in.
+ *
+ * Sets the following fields on the subkey:
+ *
+ *   main_keyid
+ *   flags.valid        if the subkey has a valid self-sig binding
+ *   flags.revoked
+ *   flags.backsig
+ *   pubkey_usage
+ *   has_expired
+ *   expired_date
+ *
+ * On this subkey's most revent valid self-signed packet, the
+ * following field is set:
+ *
+ *   flags.chosen_selfsig
+ */
 static void
 merge_selfsigs_subkey (ctrl_t ctrl, kbnode_t keyblock, kbnode_t subnode)
 {
@@ -3132,13 +3135,13 @@ merge_selfsigs_subkey (ctrl_t ctrl, kbnode_t keyblock, kbnode_t subnode)
 	      else if (IS_SUBKEY_REV (sig))
 		{
 		  /* Note that this means that the date on a
-		     revocation sig does not matter - even if the
-		     binding sig is dated after the revocation sig,
-		     the subkey is still marked as revoked.  This
-		     seems ok, as it is just as easy to make new
-		     subkeys rather than re-sign old ones as the
-		     problem is in the distribution.  Plus, PGP (7)
-		     does this the same way.  */
+		   * revocation sig does not matter - even if the
+		   * binding sig is dated after the revocation sig,
+		   * the subkey is still marked as revoked.  This
+		   * seems ok, as it is just as easy to make new
+		   * subkeys rather than re-sign old ones as the
+		   * problem is in the distribution.  Plus, PGP (7)
+		   * does this the same way.  */
 		  subpk->flags.revoked = 1;
 		  sig_to_revoke_info (sig, &subpk->revoked);
 		  /* Although we could stop now, we continue to
@@ -3188,6 +3191,7 @@ merge_selfsigs_subkey (ctrl_t ctrl, kbnode_t keyblock, kbnode_t subnode)
     key_expire = keytimestamp + buf32_to_u32 (p);
   else
     key_expire = 0;
+
   subpk->has_expired = key_expire >= curtime ? 0 : key_expire;
   subpk->expiredate = key_expire;
 
@@ -3207,7 +3211,7 @@ merge_selfsigs_subkey (ctrl_t ctrl, kbnode_t keyblock, kbnode_t subnode)
       sigdate = 0;
 
       /* We do this while() since there may be other embedded
-         signatures in the future.  We only want 0x19 here. */
+       * signatures in the future.  We only want 0x19 here. */
 
       while ((p = enum_sig_subpkt (sig->hashed,
 				   SIGSUBPKT_SIGNATURE, &n, &seq, NULL)))
@@ -3233,7 +3237,7 @@ merge_selfsigs_subkey (ctrl_t ctrl, kbnode_t keyblock, kbnode_t subnode)
       seq = 0;
 
       /* It is safe to have this in the unhashed area since the 0x19
-         is located on the selfsig for convenience, not security. */
+       * is located on the selfsig for convenience, not security. */
 
       while ((p = enum_sig_subpkt (sig->unhashed, SIGSUBPKT_SIGNATURE,
 				   &n, &seq, NULL)))
@@ -3259,7 +3263,7 @@ merge_selfsigs_subkey (ctrl_t ctrl, kbnode_t keyblock, kbnode_t subnode)
       if (backsig)
 	{
 	  /* At this point, backsig contains the most recent 0x19 sig.
-	     Let's see if it is good. */
+	   * Let's see if it is good. */
 
 	  /* 2==valid, 1==invalid, 0==didn't check */
 	  if (check_backsig (mainpk, subpk, backsig) == 0)
@@ -3274,10 +3278,10 @@ merge_selfsigs_subkey (ctrl_t ctrl, kbnode_t keyblock, kbnode_t subnode)
 
 
 /* Merge information from the self-signatures with the public key,
-   subkeys and user ids to make using them more easy.
-
-   See documentation for merge_selfsigs_main, merge_selfsigs_subkey
-   and fixup_uidnode for exactly which fields are updated.  */
+ * subkeys and user ids to make using them more easy.
+ *
+ * See documentation for merge_selfsigs_main, merge_selfsigs_subkey
+ * and fixup_uidnode for exactly which fields are updated.  */
 static void
 merge_selfsigs (ctrl_t ctrl, kbnode_t keyblock)
 {
@@ -3295,8 +3299,8 @@ merge_selfsigs (ctrl_t ctrl, kbnode_t keyblock)
 	  log_error ("expected public key but found secret key "
 		     "- must stop\n");
 	  /* We better exit here because a public key is expected at
-	     other places too.  FIXME: Figure this out earlier and
-	     don't get to here at all */
+	   * other places too.  FIXME: Figure this out earlier and
+	   * don't get to here at all */
 	  g10_exit (1);
 	}
       BUG ();
@@ -3691,22 +3695,22 @@ print_status_key_considered (kbnode_t keyblock, unsigned int flags)
 
 
 /* A high-level function to lookup keys.
-
-   This function builds on top of the low-level keydb API.  It first
-   searches the database using the description stored in CTX->ITEMS,
-   then it filters the results using CTX and, finally, if WANT_SECRET
-   is set, it ignores any keys for which no secret key is available.
-
-   Unlike the low-level search functions, this function also merges
-   all of the self-signed data into the keys, subkeys and user id
-   packets (see the merge_selfsigs for details).
-
-   On success the key's keyblock is stored at *RET_KEYBLOCK, and the
-   specific subkey is stored at *RET_FOUND_KEY.  Note that we do not
-   return a reference in *RET_FOUND_KEY, i.e. the result must not be
-   freed using 'release_kbnode', and it is only valid until
-   *RET_KEYBLOCK is deallocated.  Therefore, if RET_FOUND_KEY is not
-   NULL, then RET_KEYBLOCK must not be NULL.  */
+ *
+ * This function builds on top of the low-level keydb API.  It first
+ * searches the database using the description stored in CTX->ITEMS,
+ * then it filters the results using CTX and, finally, if WANT_SECRET
+ * is set, it ignores any keys for which no secret key is available.
+ *
+ * Unlike the low-level search functions, this function also merges
+ * all of the self-signed data into the keys, subkeys and user id
+ * packets (see the merge_selfsigs for details).
+ *
+ * On success the key's keyblock is stored at *RET_KEYBLOCK, and the
+ * specific subkey is stored at *RET_FOUND_KEY.  Note that we do not
+ * return a reference in *RET_FOUND_KEY, i.e. the result must not be
+ * freed using 'release_kbnode', and it is only valid until
+ * *RET_KEYBLOCK is deallocated.  Therefore, if RET_FOUND_KEY is not
+ * NULL, then RET_KEYBLOCK must not be NULL.  */
 static int
 lookup (ctrl_t ctrl, getkey_ctx_t ctx, int want_secret,
         kbnode_t *ret_keyblock, kbnode_t *ret_found_key)
@@ -3728,9 +3732,8 @@ lookup (ctrl_t ctrl, getkey_ctx_t ctx, int want_secret,
         break;
 
       /* If we are iterating over the entire database, then we need to
-	 change from KEYDB_SEARCH_MODE_FIRST, which does an implicit
-	 reset, to KEYDB_SEARCH_MODE_NEXT, which gets the next
-	 record.  */
+       * change from KEYDB_SEARCH_MODE_FIRST, which does an implicit
+       * reset, to KEYDB_SEARCH_MODE_NEXT, which gets the next record.  */
       if (ctx->nitems && ctx->items->mode == KEYDB_SEARCH_MODE_FIRST)
 	ctx->items->mode = KEYDB_SEARCH_MODE_NEXT;
 
@@ -3771,10 +3774,10 @@ lookup (ctrl_t ctrl, getkey_ctx_t ctx, int want_secret,
       release_kbnode (keyblock);
       keyblock = NULL;
       /* The keyblock cache ignores the current "file position".
-         Thus, if we request the next result and the cache matches
-         (and it will since it is what we just looked for), we'll get
-         the same entry back!  We can avoid this infinite loop by
-         disabling the cache.  */
+       * Thus, if we request the next result and the cache matches
+       * (and it will since it is what we just looked for), we'll get
+       * the same entry back!  We can avoid this infinite loop by
+       * disabling the cache.  */
       keydb_disable_caching (ctx->kr_handle);
     }
 

-----------------------------------------------------------------------

Summary of changes:
 g10/getkey.c | 333 ++++++++++++++++++++++++++++++-----------------------------
 1 file changed, 168 insertions(+), 165 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 20 19:12:42 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Thu, 20 Jul 2017 19:12:42 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-124-gcea4313
Message-ID: <E1dYF0E-0005jP-R8@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  cea4313644b531ef87b8c8e4bfddde4388cbbe0d (commit)
      from  a5dcc01a739db7dd75aeb2cd65f51d4839ef7fc9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit cea4313644b531ef87b8c8e4bfddde4388cbbe0d
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Thu Jul 20 19:10:42 2017 +0200

    doc: Clarify wording of export-attributes.
    
    * doc/gpg.texi: Clarify wording of export-attributes.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2228

diff --git a/doc/gpg.texi b/doc/gpg.texi
index cae351b..8ee745c 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -2433,9 +2433,10 @@ opposite meaning.  The options are:
   Defaults to no.
 
   @item export-attributes
-  Include attribute user IDs (photo IDs) while exporting. This is
-  useful to export keys if they are going to be used by an OpenPGP
-  program that does not accept attribute user IDs. Defaults to yes.
+  Include attribute user IDs (photo IDs) while exporting. Not
+  including attribute user IDs is useful to export keys that are going
+  to be used by an OpenPGP program that does not accept attribute user
+  IDs.  Defaults to yes.
 
   @item export-sensitive-revkeys
   Include designated revoker information that was marked as

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 21 06:34:14 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Fri, 21 Jul 2017 06:34:14 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-127-gd8a55da
Message-ID: <E1dYPdo-00073r-AS@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  d8a55da715ce8447b0686f321fa43d00be34a467 (commit)
       via  a76b6cf9709c0a2a89fa2887075491b80f3d9608 (commit)
       via  892e86b0dc69193ddff018bf9b3938509dd72cb3 (commit)
      from  cea4313644b531ef87b8c8e4bfddde4388cbbe0d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d8a55da715ce8447b0686f321fa43d00be34a467
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jul 21 13:26:53 2017 +0900

    scd: Fix SEGV in CCID driver.
    
    * scd/ccid-driver.c (intr_cb): Only kick the loop for removal.
    (bulk_in): Don't set POWERED_OFF when interrupt transfer is enabled.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/ccid-driver.c b/scd/ccid-driver.c
index ce6133f..9c22f51 100644
--- a/scd/ccid-driver.c
+++ b/scd/ccid-driver.c
@@ -1487,6 +1487,7 @@ intr_cb (struct libusb_transfer *transfer)
         {
           DEBUGOUT ("CCID: card removed\n");
           handle->powered_off = 1;
+          scd_kick_the_loop ();
         }
       else
         {
@@ -1501,9 +1502,8 @@ intr_cb (struct libusb_transfer *transfer)
     device_removed:
       DEBUGOUT ("CCID: device removed\n");
       handle->powered_off = 1;
+      scd_kick_the_loop ();
     }
-
-  scd_kick_the_loop ();
 }
 
 static void
@@ -2043,8 +2043,11 @@ bulk_in (ccid_driver_t handle, unsigned char *buffer, size_t length,
        * Possibly, it was forcibly suspended and resumed.
        */
       DEBUGOUT ("CCID: card inactive/removed\n");
-      handle->powered_off = 1;
-      scd_kick_the_loop ();
+      if (handle->transfer == NULL)
+        {
+          handle->powered_off = 1;
+          scd_kick_the_loop ();
+        }
     }
 
   return rc;

commit a76b6cf9709c0a2a89fa2887075491b80f3d9608
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jul 21 11:22:38 2017 +0900

    g10: Don't limit at the frontend side for card capability.
    
    * g10/card-util.c (MAX_GET_DATA_FROM_FILE): New.
    (get_data_from_file): Use MAX_GET_DATA_FROM_FILE.
    (change_url, change_login, change_private_do): Don't limit.
    
    --
    
    V3.3 card support longer data for URL, Login and Private DOs.
    It's scdaemon which knows that.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/g10/card-util.c b/g10/card-util.c
index f1795b8..62b2a67 100644
--- a/g10/card-util.c
+++ b/g10/card-util.c
@@ -777,14 +777,6 @@ change_url (void)
   trim_spaces (url);
   cpr_kill_prompt ();
 
-  if (strlen (url) > 254 )
-    {
-      tty_printf (_("Error: URL too long "
-                    "(limit is %d characters).\n"), 254);
-      xfree (url);
-      return -1;
-    }
-
   rc = agent_scd_setattr ("PUBKEY-URL", url, strlen (url), NULL );
   if (rc)
     log_error ("error setting URL: %s\n", gpg_strerror (rc));
@@ -831,12 +823,14 @@ fetch_url (ctrl_t ctrl)
 }
 
 
-/* Read data from file FNAME up to MAXLEN characters.  On error return
-   -1 and store NULL at R_BUFFER; on success return the number of
-   bytes read and store the address of a newly allocated buffer at
-   R_BUFFER. */
+#define MAX_GET_DATA_FROM_FILE 16384
+
+/* Read data from file FNAME up to MAX_GET_DATA_FROM_FILE characters.
+   On error return -1 and store NULL at R_BUFFER; on success return
+   the number of bytes read and store the address of a newly allocated
+   buffer at R_BUFFER. */
 static int
-get_data_from_file (const char *fname, size_t maxlen, char **r_buffer)
+get_data_from_file (const char *fname, char **r_buffer)
 {
   estream_t fp;
   char *data;
@@ -859,7 +853,7 @@ get_data_from_file (const char *fname, size_t maxlen, char **r_buffer)
       return -1;
     }
 
-  data = xtrymalloc (maxlen? maxlen:1);
+  data = xtrymalloc (MAX_GET_DATA_FROM_FILE);
   if (!data)
     {
       tty_printf (_("error allocating enough memory: %s\n"), strerror (errno));
@@ -867,10 +861,7 @@ get_data_from_file (const char *fname, size_t maxlen, char **r_buffer)
       return -1;
     }
 
-  if (maxlen)
-    n = es_fread (data, 1, maxlen, fp);
-  else
-    n = 0;
+  n = es_fread (data, 1, MAX_GET_DATA_FROM_FILE, fp);
   es_fclose (fp);
   if (n < 0)
     {
@@ -927,7 +918,7 @@ change_login (const char *args)
     {
       for (args++; spacep (args); args++)
         ;
-      n = get_data_from_file (args, 254, &data);
+      n = get_data_from_file (args, &data);
       if (n < 0)
         return -1;
     }
@@ -942,14 +933,6 @@ change_login (const char *args)
       n = strlen (data);
     }
 
-  if (n > 254 )
-    {
-      tty_printf (_("Error: Login data too long "
-                    "(limit is %d characters).\n"), 254);
-      xfree (data);
-      return -1;
-    }
-
   rc = agent_scd_setattr ("LOGIN-DATA", data, n, NULL );
   if (rc)
     log_error ("error setting login data: %s\n", gpg_strerror (rc));
@@ -973,7 +956,7 @@ change_private_do (const char *args, int nr)
     {
       for (args++; spacep (args); args++)
         ;
-      n = get_data_from_file (args, 254, &data);
+      n = get_data_from_file (args, &data);
       if (n < 0)
         return -1;
     }
@@ -988,14 +971,6 @@ change_private_do (const char *args, int nr)
       n = strlen (data);
     }
 
-  if (n > 254 )
-    {
-      tty_printf (_("Error: Private DO too long "
-                    "(limit is %d characters).\n"), 254);
-      xfree (data);
-      return -1;
-    }
-
   rc = agent_scd_setattr (do_name, data, n, NULL );
   if (rc)
     log_error ("error setting private DO: %s\n", gpg_strerror (rc));
@@ -1016,7 +991,7 @@ change_cert (const char *args)
     {
       for (args++; spacep (args); args++)
         ;
-      n = get_data_from_file (args, 16384, &data);
+      n = get_data_from_file (args, &data);
       if (n < 0)
         return -1;
     }

commit 892e86b0dc69193ddff018bf9b3938509dd72cb3
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Fri Jul 21 11:21:19 2017 +0900

    scd: Add debug message for v3 card.
    
    * scd/app-openpgp.c (show_caps): Output more messages.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index f63b18d..2d53b84 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -4757,7 +4757,14 @@ do_check_pin (app_t app, const char *keyidstr,
 static void
 show_caps (struct app_local_s *s)
 {
-  log_info ("Version-2 ......: %s\n", s->extcap.is_v2? "yes":"no");
+  log_info ("Version-2+ .....: %s\n", s->extcap.is_v2? "yes":"no");
+  log_info ("Extcap-v3 ......: %s\n", s->extcap.extcap_v3? "yes":"no");
+  log_info ("Button .........: %s\n", s->extcap.has_button? "yes":"no");
+
+  log_info ("SM-Support .....: %s", s->extcap.sm_supported? "yes":"no");
+  if (s->extcap.sm_supported)
+    log_printf (" (%s)", s->extcap.sm_algo==2? "3DES":
+                (s->extcap.sm_algo==2? "AES-128" : "AES-256"));
   log_info ("Get-Challenge ..: %s", s->extcap.get_challenge? "yes":"no");
   if (s->extcap.get_challenge)
     log_printf (" (%u bytes max)", s->extcap.max_get_challenge);
@@ -4765,16 +4772,18 @@ show_caps (struct app_local_s *s)
   log_info ("Change-Force-PW1: %s\n", s->extcap.change_force_chv? "yes":"no");
   log_info ("Private-DOs ....: %s\n", s->extcap.private_dos? "yes":"no");
   log_info ("Algo-Attr-Change: %s\n", s->extcap.algo_attr_change? "yes":"no");
-  log_info ("SM-Support .....: %s", s->extcap.sm_supported? "yes":"no");
-  if (s->extcap.sm_supported)
-    log_printf (" (%s)", s->extcap.sm_algo==2? "3DES":
-                (s->extcap.sm_algo==2? "AES-128" : "AES-256"));
+  log_info ("Symmetric Crypto: %s\n", s->extcap.has_decrypt? "yes":"no");
+  log_info ("KDF-Support ....: %s\n", s->extcap.kdf_do? "yes":"no");
   log_info ("Max-Cert3-Len ..: %u\n", s->extcap.max_certlen_3);
+  if (s->extcap.extcap_v3)
+    {
+      log_info ("PIN-Block-2 ....: %s\n", s->extcap.pin_blk2? "yes":"no");
+      log_info ("MSE-Support ....: %s\n", s->extcap.mse? "yes":"no");
+      log_info ("Max-Special-DOs : %u\n", s->extcap.max_special_do);
+    }
   log_info ("Cmd-Chaining ...: %s\n", s->cardcap.cmd_chaining?"yes":"no");
   log_info ("Ext-Lc-Le ......: %s\n", s->cardcap.ext_lc_le?"yes":"no");
-  log_info ("Status Indicator: %02X\n", s->status_indicator);
-  log_info ("Symmetric crypto: %s\n", s->extcap.has_decrypt? "yes":"no");
-  log_info ("Button..........: %s\n", s->extcap.has_button? "yes":"no");
+  log_info ("Status-Indicator: %02X\n", s->status_indicator);
 
   log_info ("GnuPG-No-Sync ..: %s\n",  s->flags.no_sync? "yes":"no");
   log_info ("GnuPG-Def-PW2 ..: %s\n",  s->flags.def_chv2? "yes":"no");

-----------------------------------------------------------------------

Summary of changes:
 g10/card-util.c   | 49 ++++++++++++-------------------------------------
 scd/app-openpgp.c | 25 +++++++++++++++++--------
 scd/ccid-driver.c | 11 +++++++----
 3 files changed, 36 insertions(+), 49 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 21 16:04:27 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Fri, 21 Jul 2017 16:04:27 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-128-g609bbdf
Message-ID: <E1dYYXc-00081n-L4@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  609bbdf3614fbadeba7a6cbdfdf5004b23516a64 (commit)
      from  d8a55da715ce8447b0686f321fa43d00be34a467 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 609bbdf3614fbadeba7a6cbdfdf5004b23516a64
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Fri Jul 21 16:03:04 2017 +0200

    g10: Clean keyblock on initial commit.
    
    * g10/import.c (import_one): If option import-clean is set,
    also clean on initial import, not only for merge.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2401

diff --git a/g10/import.c b/g10/import.c
index 1737479..c450367 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -1606,6 +1606,7 @@ import_one (ctrl_t ctrl,
   else if (rc )  /* Insert this key. */
     {
       KEYDB_HANDLE hd;
+      int n_sigs_cleaned, n_uids_cleaned;
 
       hd = keydb_new ();
       if (!hd)
@@ -1635,6 +1636,10 @@ import_one (ctrl_t ctrl,
             }
         }
 
+      if ((options & IMPORT_CLEAN))
+        clean_key (ctrl, keyblock, opt.verbose, (options&IMPORT_MINIMAL),
+                   &n_uids_cleaned,&n_sigs_cleaned);
+
       rc = keydb_insert_keyblock (hd, keyblock );
       if (rc)
         log_error (_("error writing keyring '%s': %s\n"),

-----------------------------------------------------------------------

Summary of changes:
 g10/import.c | 5 +++++
 1 file changed, 5 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 21 18:20:30 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 21 Jul 2017 18:20:30 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-131-gb55b72b
Message-ID: <E1dYafI-000316-BF@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  b55b72bb815ad5870456b89c3a011fa00991b4a8 (commit)
       via  e888f7af6571ecd3994fd55cc18c9e2df7fd0c60 (commit)
       via  5818ff0ae314af08548fcc23df2b807736144a00 (commit)
      from  609bbdf3614fbadeba7a6cbdfdf5004b23516a64 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b55b72bb815ad5870456b89c3a011fa00991b4a8
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 21 14:12:55 2017 +0200

    gpg: Extend --quick-set-expire to allow subkey expiration setting.
    
    * g10/keyedit.c (keyedit_quick_set_expire): Add new arg subkeyfprs.
    (menu_expire): Rename arg force_mainkey to unattended and allow
    unattended changing of subkey expiration.
    * g10/gpg.c (main): Extend --quick-set-expire.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 8ee745c..1b5dee0 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -663,10 +663,16 @@ supplied passphrase is used for the new key and the agent does not ask
 for it.  To create a key without any protection @code{--passphrase ''}
 may be used.
 
- at item --quick-set-expire @code{fpr} @code{expire}
+ at item --quick-set-expire @var{fpr} @var{expire} [*|@var{subfprs}]
 @opindex quick-set-expire
-Directly set the expiration time of the primary key to @code{expire}.
-To remove the expiration time @code{0} can be used.
+With two arguments given, directly set the expiration time of the
+primary key identified by @var{fpr} to @var{expire}.  To remove the
+expiration time @code{0} can be used.  With three arguments and the
+third given as an asterisk, the expiration time of all non-revoked and
+not yet expired subkeys are set to @var{expire}.  With more than two
+arguments and a list of fingerprints given for @var{subfprs}, all
+non-revoked subkeys matching these fingerprints are set to
+ at var{expire}.
 
 
 @item --quick-add-key @code{fpr} [@code{algo} [@code{usage} [@code{expire}]]]
diff --git a/g10/gpg.c b/g10/gpg.c
index 70b8011..e32e14a 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -4491,11 +4491,11 @@ main (int argc, char **argv)
         {
           const char *x_fpr, *x_expire;
 
-          if (argc != 2)
-            wrong_args ("--quick-set-exipre FINGERPRINT EXPIRE");
+          if (argc < 2)
+            wrong_args ("--quick-set-exipre FINGERPRINT EXPIRE [SUBKEY-FPRS]");
           x_fpr = *argv++; argc--;
           x_expire = *argv++; argc--;
-          keyedit_quick_set_expire (ctrl, x_fpr, x_expire);
+          keyedit_quick_set_expire (ctrl, x_fpr, x_expire, argv);
         }
 	break;
 
diff --git a/g10/keyedit.c b/g10/keyedit.c
index 29fe466..0a90cf5 100644
--- a/g10/keyedit.c
+++ b/g10/keyedit.c
@@ -73,7 +73,7 @@ static int menu_clean (ctrl_t ctrl, kbnode_t keyblock, int self_only);
 static void menu_delkey (KBNODE pub_keyblock);
 static int menu_addrevoker (ctrl_t ctrl, kbnode_t pub_keyblock, int sensitive);
 static gpg_error_t menu_expire (ctrl_t ctrl, kbnode_t pub_keyblock,
-                                int force_mainkey, u32 newexpiration);
+                                int unattended, u32 newexpiration);
 static int menu_changeusage (ctrl_t ctrl, kbnode_t keyblock);
 static int menu_backsign (ctrl_t ctrl, kbnode_t pub_keyblock);
 static int menu_set_primary_uid (ctrl_t ctrl, kbnode_t pub_keyblock);
@@ -2808,18 +2808,24 @@ keyedit_quick_addkey (ctrl_t ctrl, const char *fpr, const char *algostr,
 }
 
 
-/* Unattended expiration setting function for the main key.
- *
+/* Unattended expiration setting function for the main key.  If
+ * SUBKEYFPRS is not NULL and SUBKEYSFPRS[0] is neither NULL, it is
+ * expected to be an array of fingerprints for subkeys to change. It
+ * may also be an array which just one item "*" to indicate that all
+ * keys shall be set to that expiration date.
  */
 void
-keyedit_quick_set_expire (ctrl_t ctrl, const char *fpr, const char *expirestr)
+keyedit_quick_set_expire (ctrl_t ctrl, const char *fpr, const char *expirestr,
+                          char **subkeyfprs)
 {
   gpg_error_t err;
-  kbnode_t keyblock;
+  kbnode_t keyblock, node;
   KEYDB_HANDLE kdbhd;
   int modified = 0;
   PKT_public_key *pk;
   u32 expire;
+  int primary_only = 0;
+  int idx;
 
 #ifdef HAVE_W32_SYSTEM
   /* See keyedit_menu for why we need this.  */
@@ -2846,7 +2852,6 @@ keyedit_quick_set_expire (ctrl_t ctrl, const char *fpr, const char *expirestr)
       goto leave;
     }
 
-
   expire = parse_expire_string (expirestr);
   if (expire == (u32)-1 )
     {
@@ -2857,8 +2862,78 @@ keyedit_quick_set_expire (ctrl_t ctrl, const char *fpr, const char *expirestr)
   if (expire)
     expire += make_timestamp ();
 
+  /* Check whether a subkey's expiration time shall be changed or the
+   * expiration time of all keys.  */
+  if (!subkeyfprs || !subkeyfprs[0])
+    primary_only = 1;
+  else if ( !strcmp (subkeyfprs[0], "*") && !subkeyfprs[1])
+    {
+      /* Change all subkeys keys which have not been revoked and are
+       * not yet expired.  */
+      merge_keys_and_selfsig (ctrl, keyblock);
+      for (node = keyblock; node; node = node->next)
+        {
+          if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
+              && (pk = node->pkt->pkt.public_key)
+              && !pk->flags.revoked
+              && !pk->has_expired)
+            node->flag |= NODFLG_SELKEY;
+        }
+    }
+  else
+    {
+      /* Change specified subkeys.  */
+      KEYDB_SEARCH_DESC desc;
+      byte fprbin[MAX_FINGERPRINT_LEN];
+      size_t fprlen;
+
+      err = 0;
+      merge_keys_and_selfsig (ctrl, keyblock);
+      for (idx=0; subkeyfprs[idx]; idx++)
+        {
+          int any = 0;
+
+          /* Parse the fingerprint.  */
+          if (classify_user_id (subkeyfprs[idx], &desc, 1)
+              || !(desc.mode == KEYDB_SEARCH_MODE_FPR
+                   || desc.mode == KEYDB_SEARCH_MODE_FPR20))
+            {
+              log_error (_("\"%s\" is not a proper fingerprint\n"),
+                         subkeyfprs[idx] );
+              if (!err)
+                err = gpg_error (GPG_ERR_INV_NAME);
+              continue;
+            }
+
+          /* Set the flag for the matching non revoked subkey.  */
+          for (node = keyblock; node; node = node->next)
+            {
+              if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY
+                  && (pk = node->pkt->pkt.public_key)
+                  && !pk->flags.revoked )
+                {
+                  fingerprint_from_pk (pk, fprbin, &fprlen);
+                  if (fprlen == 20 && !memcmp (fprbin, desc.u.fpr, 20))
+                    {
+                      node->flag |= NODFLG_SELKEY;
+                      any = 1;
+                    }
+                }
+            }
+          if (!any)
+            {
+              log_error (_("subkey \"%s\" not found\n"), subkeyfprs[idx]);
+              if (!err)
+                err = gpg_error (GPG_ERR_NOT_FOUND);
+            }
+        }
+
+      if (err)
+        goto leave;
+    }
+
   /* Set the new expiration date.  */
-  err = menu_expire (ctrl, keyblock, 1, expire);
+  err = menu_expire (ctrl, keyblock, primary_only? 1 : 2, expire);
   if (gpg_err_code (err) == GPG_ERR_TRUE)
     modified = 1;
   else if (err)
@@ -4283,30 +4358,34 @@ fail:
 
 
 /* With FORCE_MAINKEY cleared this function handles the interactive
- * menu option "expire".  With FORCE_MAINKEY set this functions only
+ * menu option "expire".  With UNATTENDED set to 1 this function only
  * sets the expiration date of the primary key to NEWEXPIRATION and
- * avoid all interactivity.  Retirns 0 if nothing was done,
+ * avoid all interactivity; with a value of 2 only the flagged subkeys
+ * are set to NEWEXPIRATION.  Returns 0 if nothing was done,
  * GPG_ERR_TRUE if the key was modified, or any other error code. */
 static gpg_error_t
 menu_expire (ctrl_t ctrl, kbnode_t pub_keyblock,
-             int force_mainkey, u32 newexpiration)
+             int unattended, u32 newexpiration)
 {
   int signumber, rc;
   u32 expiredate;
-  int mainkey = 0;
+  int only_mainkey;  /* Set if only the mainkey is to be updated.  */
   PKT_public_key *main_pk, *sub_pk;
   PKT_user_id *uid;
   kbnode_t node;
   u32 keyid[2];
 
-  if (force_mainkey)
+  if (unattended)
     {
-      mainkey = 1;
+      only_mainkey = (unattended == 1);
       expiredate = newexpiration;
     }
   else
     {
-      int n1 = count_selected_keys (pub_keyblock);
+      int n1;
+
+      only_mainkey = 0;
+      n1 = count_selected_keys (pub_keyblock);
       if (n1 > 1)
         {
           if (!cpr_get_answer_is_yes
@@ -4320,7 +4399,7 @@ menu_expire (ctrl_t ctrl, kbnode_t pub_keyblock,
       else
         {
           tty_printf (_("Changing expiration time for the primary key.\n"));
-          mainkey = 1;
+          only_mainkey = 1;
           no_primary_warning (pub_keyblock);
         }
 
@@ -4342,8 +4421,10 @@ menu_expire (ctrl_t ctrl, kbnode_t pub_keyblock,
 	}
       else if (node->pkt->pkttype == PKT_PUBLIC_SUBKEY)
 	{
-          if ((node->flag & NODFLG_SELKEY) && !force_mainkey)
+          if ((node->flag & NODFLG_SELKEY) && unattended != 1)
             {
+              /* The flag is set and we do not want to set the
+               * expiration date only for the main key.  */
               sub_pk = node->pkt->pkt.public_key;
               sub_pk->expiredate = expiredate;
             }
@@ -4353,14 +4434,14 @@ menu_expire (ctrl_t ctrl, kbnode_t pub_keyblock,
       else if (node->pkt->pkttype == PKT_USER_ID)
 	uid = node->pkt->pkt.user_id;
       else if (main_pk && node->pkt->pkttype == PKT_SIGNATURE
-	       && (mainkey || sub_pk))
+	       && (only_mainkey || sub_pk))
 	{
 	  PKT_signature *sig = node->pkt->pkt.signature;
 
 	  if (keyid[0] == sig->keyid[0] && keyid[1] == sig->keyid[1]
-	      && ((mainkey && uid
+	      && ((only_mainkey && uid
 		   && uid->created && (sig->sig_class & ~3) == 0x10)
-		  || (!mainkey && sig->sig_class == 0x18))
+		  || (!only_mainkey && sig->sig_class == 0x18))
 	      && sig->flags.chosen_selfsig)
 	    {
 	      /* This is a self-signature which is to be replaced.  */
@@ -4369,15 +4450,15 @@ menu_expire (ctrl_t ctrl, kbnode_t pub_keyblock,
 
 	      signumber++;
 
-	      if ((mainkey && main_pk->version < 4)
-		  || (!mainkey && sub_pk->version < 4))
+	      if ((only_mainkey && main_pk->version < 4)
+		  || (!only_mainkey && sub_pk->version < 4))
 		{
 		  log_info
                     (_("You can't change the expiration date of a v3 key\n"));
 		  return gpg_error (GPG_ERR_LEGACY_KEY);
 		}
 
-	      if (mainkey)
+	      if (only_mainkey)
 		rc = update_keysig_packet (ctrl,
                                            &newsig, sig, main_pk, uid, NULL,
 					   main_pk, keygen_add_key_expire,
diff --git a/g10/keyedit.h b/g10/keyedit.h
index d4c9632..23a126b 100644
--- a/g10/keyedit.h
+++ b/g10/keyedit.h
@@ -46,7 +46,8 @@ void keyedit_quick_revuid (ctrl_t ctrl, const char *username,
 void keyedit_quick_sign (ctrl_t ctrl, const char *fpr,
                          strlist_t uids, strlist_t locusr, int local);
 void keyedit_quick_set_expire (ctrl_t ctrl,
-                               const char *fpr, const char *expirestr);
+                               const char *fpr, const char *expirestr,
+                               char **subkeyfprs);
 void keyedit_quick_set_primary (ctrl_t ctrl, const char *username,
                                 const char *primaryuid);
 void show_basic_key_info (ctrl_t ctrl, kbnode_t keyblock);

commit e888f7af6571ecd3994fd55cc18c9e2df7fd0c60
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 21 17:48:40 2017 +0200

    gpg: Fix possible double free of the card serialno.
    
    * g10/free-packet.c (copy_public_key): Copy fields serialno and
    updateurl.
    --
    
    The PK->serialno is used to get the version of the card to decide
    whether it does support other algorithms than SHA-1.  This value is
    cached but no deep copy was done when calling copy_public_key.
    
    Bug detected by importing some public keys and then importing a secret
    key which led to a double free.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/free-packet.c b/g10/free-packet.c
index cd222a2..e15ad3f 100644
--- a/g10/free-packet.c
+++ b/g10/free-packet.c
@@ -224,6 +224,12 @@ copy_public_key (PKT_public_key *d, PKT_public_key *s)
     }
   else
     d->revkey = NULL;
+
+  if (s->serialno)
+    d->serialno = xstrdup (s->serialno);
+  if (s->updateurl)
+    d->updateurl = xstrdup (s->updateurl);
+
   return d;
 }
 

commit 5818ff0ae314af08548fcc23df2b807736144a00
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 21 17:38:03 2017 +0200

    gpg: Use macros to check the signature class.
    
    * g10/import.c: Use the extistin macros for better readability.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/import.c b/g10/import.c
index c450367..02440ff 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -575,7 +575,7 @@ import (ctrl_t ctrl, IOBUF inp, const char* fname,struct import_stats_s *stats,
                                 opt.batch, options, 0,
                                 screener, screener_arg);
       else if (keyblock->pkt->pkttype == PKT_SIGNATURE
-               && keyblock->pkt->pkt.signature->sig_class == 0x20 )
+               && IS_KEY_REV (keyblock->pkt->pkt.signature) )
         rc = import_revoke_cert (ctrl, keyblock, stats);
       else
         {
@@ -822,7 +822,7 @@ read_block( IOBUF a, int with_meta,
         in_v3key = 0;
 
 	if (!root && pkt->pkttype == PKT_SIGNATURE
-		  && pkt->pkt.signature->sig_class == 0x20 )
+            && IS_KEY_REV (pkt->pkt.signature) )
           {
 	    /* This is a revocation certificate which is handled in a
 	     * special way.  */
@@ -925,7 +925,7 @@ fix_pks_corruption (ctrl_t ctrl, kbnode_t keyblock)
 	    sknode=node;
 	}
       else if (node->pkt->pkttype == PKT_SIGNATURE
-               && node->pkt->pkt.signature->sig_class == 0x18
+               && IS_SUBKEY_SIG (node->pkt->pkt.signature)
                && keycount >= 2
                && !node->next)
 	{
@@ -2398,7 +2398,7 @@ import_revoke_cert (ctrl_t ctrl, kbnode_t node, struct import_stats_s *stats)
 
   log_assert (!node->next );
   log_assert (node->pkt->pkttype == PKT_SIGNATURE );
-  log_assert (node->pkt->pkt.signature->sig_class == 0x20 );
+  log_assert (IS_KEY_REV (node->pkt->pkt.signature));
 
   keyid[0] = node->pkt->pkt.signature->keyid[0];
   keyid[1] = node->pkt->pkt.signature->keyid[1];
@@ -2451,8 +2451,8 @@ import_revoke_cert (ctrl_t ctrl, kbnode_t node, struct import_stats_s *stats)
     }
 
   /* it is okay, that node is not in keyblock because
-   * check_key_signature works fine for sig_class 0x20 in this
-   * special case. */
+   * check_key_signature works fine for sig_class 0x20 (KEY_REV) in
+   * this special case. */
   rc = check_key_signature (ctrl, keyblock, node, NULL);
   if (rc )
     {
@@ -2797,7 +2797,7 @@ delete_inv_parts (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid,
           delete_kbnode( node );
         }
       else if (node->pkt->pkttype == PKT_SIGNATURE
-               && node->pkt->pkt.signature->sig_class == 0x20)
+               && IS_KEY_REV (node->pkt->pkt.signature))
         {
           if (uid_seen )
             {
@@ -2829,8 +2829,8 @@ delete_inv_parts (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid,
 	    }
 	}
       else if (node->pkt->pkttype == PKT_SIGNATURE
-               && (node->pkt->pkt.signature->sig_class == 0x18
-                   || node->pkt->pkt.signature->sig_class == 0x28)
+               && (IS_SUBKEY_SIG (node->pkt->pkt.signature)
+                   || IS_SUBKEY_REV (node->pkt->pkt.signature))
                && !subkey_seen )
         {
           if(opt.verbose)
@@ -3006,9 +3006,9 @@ revocation_present (ctrl_t ctrl, kbnode_t keyblock)
       if(onode->pkt->pkttype==PKT_USER_ID)
 	break;
 
-      if(onode->pkt->pkttype==PKT_SIGNATURE &&
-	 onode->pkt->pkt.signature->sig_class==0x1F &&
-	 onode->pkt->pkt.signature->revkey)
+      if (onode->pkt->pkttype == PKT_SIGNATURE
+          && IS_KEY_SIG (onode->pkt->pkt.signature)
+          && onode->pkt->pkt.signature->revkey)
 	{
 	  int idx;
 	  PKT_signature *sig=onode->pkt->pkt.signature;
@@ -3026,14 +3026,14 @@ revocation_present (ctrl_t ctrl, kbnode_t keyblock)
 		  if(inode->pkt->pkttype==PKT_USER_ID)
 		    break;
 
-		  if(inode->pkt->pkttype==PKT_SIGNATURE &&
-		     inode->pkt->pkt.signature->sig_class==0x20 &&
-		     inode->pkt->pkt.signature->keyid[0]==keyid[0] &&
-		     inode->pkt->pkt.signature->keyid[1]==keyid[1])
+		  if (inode->pkt->pkttype == PKT_SIGNATURE
+                      && IS_KEY_REV (inode->pkt->pkt.signature)
+                      && inode->pkt->pkt.signature->keyid[0]==keyid[0]
+                      && inode->pkt->pkt.signature->keyid[1]==keyid[1])
 		    {
 		      /* Okay, we have a revocation key, and a
-                         revocation issued by it.  Do we have the key
-                         itself? */
+                       * revocation issued by it.  Do we have the key
+                       * itself?  */
 		      int rc;
 
 		      rc=get_pubkey_byfprint_fast (NULL,sig->revkey[idx].fpr,
@@ -3102,7 +3102,7 @@ merge_blocks (ctrl_t ctrl, kbnode_t keyblock_orig, kbnode_t keyblock,
       if (node->pkt->pkttype == PKT_USER_ID )
         break;
       else if (node->pkt->pkttype == PKT_SIGNATURE
-               && node->pkt->pkt.signature->sig_class == 0x20)
+               && IS_KEY_REV (node->pkt->pkt.signature))
         {
           /* check whether we already have this */
           found = 0;
@@ -3111,7 +3111,7 @@ merge_blocks (ctrl_t ctrl, kbnode_t keyblock_orig, kbnode_t keyblock,
               if (onode->pkt->pkttype == PKT_USER_ID )
                 break;
               else if (onode->pkt->pkttype == PKT_SIGNATURE
-                       && onode->pkt->pkt.signature->sig_class == 0x20
+                       && IS_KEY_REV (onode->pkt->pkt.signature)
                        && !cmp_signatures(onode->pkt->pkt.signature,
                                           node->pkt->pkt.signature))
                 {
@@ -3142,7 +3142,7 @@ merge_blocks (ctrl_t ctrl, kbnode_t keyblock_orig, kbnode_t keyblock,
       if (node->pkt->pkttype == PKT_USER_ID )
         break;
       else if (node->pkt->pkttype == PKT_SIGNATURE
-               && node->pkt->pkt.signature->sig_class == 0x1F)
+               && IS_KEY_SIG (node->pkt->pkt.signature))
         {
           /* check whether we already have this */
           found = 0;
@@ -3151,7 +3151,7 @@ merge_blocks (ctrl_t ctrl, kbnode_t keyblock_orig, kbnode_t keyblock,
               if (onode->pkt->pkttype == PKT_USER_ID)
                 break;
               else if (onode->pkt->pkttype == PKT_SIGNATURE
-                       && onode->pkt->pkt.signature->sig_class == 0x1F
+                       && IS_KEY_SIG (onode->pkt->pkt.signature)
                        && !cmp_signatures(onode->pkt->pkt.signature,
                                           node->pkt->pkt.signature))
                 {
@@ -3345,8 +3345,8 @@ merge_sigs (kbnode_t dst, kbnode_t src, int *n_sigs)
     {
       if (n->pkt->pkttype != PKT_SIGNATURE )
         continue;
-      if (n->pkt->pkt.signature->sig_class == 0x18
-          || n->pkt->pkt.signature->sig_class == 0x28 )
+      if (IS_SUBKEY_SIG (n->pkt->pkt.signature)
+          || IS_SUBKEY_REV (n->pkt->pkt.signature) )
         continue; /* skip signatures which are only valid on subkeys */
 
       found = 0;

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi      |  12 ++++--
 g10/free-packet.c |   6 +++
 g10/gpg.c         |   6 +--
 g10/import.c      |  48 ++++++++++-----------
 g10/keyedit.c     | 125 ++++++++++++++++++++++++++++++++++++++++++++----------
 g10/keyedit.h     |   3 +-
 6 files changed, 147 insertions(+), 53 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 21 20:04:05 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Fri, 21 Jul 2017 20:04:05 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-132-ge4c720f
Message-ID: <E1dYcHW-0001EQ-1x@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e4c720fa3b31ebd3e9d764c6eab02729cf06124c (commit)
      from  b55b72bb815ad5870456b89c3a011fa00991b4a8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e4c720fa3b31ebd3e9d764c6eab02729cf06124c
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Fri Jul 21 20:01:10 2017 +0200

    g10: Avoid caching passphrase for failed symmetric encryption.
    
    * g10/mainproc.c (proc_encrypted): If error code is GPG_ERR_CIPHER_ALGO,
    assume the symmetric passphrase was wrong and invalidate the cache.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2270

diff --git a/g10/mainproc.c b/g10/mainproc.c
index fddafd8..d0584d3 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -681,7 +681,8 @@ proc_encrypted (CTX c, PACKET *pkt)
     }
   else
     {
-      if (gpg_err_code (result) == GPG_ERR_BAD_KEY
+      if ((gpg_err_code (result) == GPG_ERR_BAD_KEY
+	   || gpg_err_code (result) == GPG_ERR_CIPHER_ALGO)
           && *c->dek->s2k_cacheid != '\0')
         {
           if (opt.debug)

-----------------------------------------------------------------------

Summary of changes:
 g10/mainproc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 08:31:20 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Mon, 24 Jul 2017 08:31:20 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-134-g2746028
Message-ID: <E1dZWtl-00045f-QL@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  274602820cfbb15c7cdb4525acd9793bdb472e78 (commit)
       via  328fca187253c069e3630bd387a71f6d16e9820a (commit)
      from  e4c720fa3b31ebd3e9d764c6eab02729cf06124c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 274602820cfbb15c7cdb4525acd9793bdb472e78
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jul 24 15:28:36 2017 +0900

    dirmngr: Minor fix for Windows.
    
    * dirmngr/http.c (connect_with_timeout): Use FD2INT.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index dea4c71..c641070 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -2745,7 +2745,7 @@ connect_with_timeout (assuan_fd_t sock,
     }
 
   FD_ZERO (&rset);
-  FD_SET (sock, &rset);
+  FD_SET (FD2INT (sock), &rset);
   wset = rset;
   tval.tv_sec = timeout / 1000;
   tval.tv_usec = (timeout % 1000) * 1000;

commit 328fca187253c069e3630bd387a71f6d16e9820a
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jul 24 15:26:20 2017 +0900

    agent: Minor fix for Windows.
    
    * agent/command-ssh.c (serve_mmapped_ssh_request): Add const
    qualifier.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/agent/command-ssh.c b/agent/command-ssh.c
index c5897ef..9d45a18 100644
--- a/agent/command-ssh.c
+++ b/agent/command-ssh.c
@@ -3707,7 +3707,7 @@ serve_mmapped_ssh_request (ctrl_t ctrl,
   gpg_error_t err;
   int send_err = 0;
   int valid_response = 0;
-  ssh_request_spec_t *spec;
+  const ssh_request_spec_t *spec;
   u32 msglen;
   estream_t request_stream, response_stream;
 

-----------------------------------------------------------------------

Summary of changes:
 agent/command-ssh.c | 2 +-
 dirmngr/http.c      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 08:36:26 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Mon, 24 Jul 2017 08:36:26 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-135-g789401e
Message-ID: <E1dZWyg-0004Cx-UD@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  789401e9557db13422f47a8c09e693f3cee0132b (commit)
      from  274602820cfbb15c7cdb4525acd9793bdb472e78 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 789401e9557db13422f47a8c09e693f3cee0132b
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jul 24 15:35:34 2017 +0900

    dirmngr: More minor fixes.
    
    * dirmngr/http.c (http_verify_server_credentials): Duplicated const.
    * dirmngr/ldap.c (parse_one_pattern): Add comment.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index c641070..b16de7d 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -3282,7 +3282,7 @@ gpg_error_t
 http_verify_server_credentials (http_session_t sess)
 {
 #if HTTP_USE_GNUTLS
-  static const char const errprefix[] = "TLS verification of peer failed";
+  static const char errprefix[] = "TLS verification of peer failed";
   int rc;
   unsigned int status;
   const char *hostname;
diff --git a/dirmngr/ldap.c b/dirmngr/ldap.c
index d661a68..adf8307 100644
--- a/dirmngr/ldap.c
+++ b/dirmngr/ldap.c
@@ -363,6 +363,7 @@ parse_one_pattern (const char *pattern)
       break;
     case '*':
       pattern++;
+      /* fall through */
     default:			/* Take as substring match. */
       {
 	const char format[] = "(|(sn=*%s*)(|(cn=*%s*)(mail=*%s*)))";

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/http.c | 2 +-
 dirmngr/ldap.c | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 09:11:40 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Mon, 24 Jul 2017 09:11:40 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-137-g45e4048
Message-ID: <E1dZXWn-00010p-Pg@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  45e40487fb7bb51228c96c8966e38c643a9b9ba5 (commit)
       via  ade4b2744c848e07b87afa4f186256c2a2ef1d13 (commit)
      from  789401e9557db13422f47a8c09e693f3cee0132b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 45e40487fb7bb51228c96c8966e38c643a9b9ba5
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jul 24 16:10:22 2017 +0900

    scd: Use unsigned int for fields.
    
    * scd/app-openpgp.c (data_objects): Use unsigned ints.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/scd/app-openpgp.c b/scd/app-openpgp.c
index 2d53b84..365f246 100644
--- a/scd/app-openpgp.c
+++ b/scd/app-openpgp.c
@@ -76,16 +76,16 @@ static struct {
   int tag;
   int constructed;
   int get_from;  /* Constructed DO with this DO or 0 for direct access. */
-  int binary:1;
-  int dont_cache:1;
-  int flush_on_error:1;
-  int get_immediate_in_v11:1; /* Enable a hack to bypass the cache of
+  unsigned int binary:1;
+  unsigned int dont_cache:1;
+  unsigned int flush_on_error:1;
+  unsigned int get_immediate_in_v11:1; /* Enable a hack to bypass the cache of
                                  this data object if it is used in 1.1
                                  and later versions of the card.  This
                                  does not work with composite DO and
                                  is currently only useful for the CHV
                                  status bytes. */
-  int try_extlen:2;           /* Large object; try to use an extended
+  unsigned int try_extlen:2;           /* Large object; try to use an extended
                                  length APDU when !=0.  The size is
                                  determined by extcap.max_certlen_3
                                  when == 1, and by extcap.max_special_do

commit ade4b2744c848e07b87afa4f186256c2a2ef1d13
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Mon Jul 24 16:09:11 2017 +0900

    dirmngr: More minor fix.
    
    * dirmngr/http.c (send_request): Care the case of !USE_TLS.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index b16de7d..63ed5d3 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -1672,7 +1672,9 @@ send_request (http_t hd, const char *httphost, const char *auth,
   char *proxy_authstr = NULL;
   char *authstr = NULL;
   assuan_fd_t sock;
+#ifdef USE_TLS
   int have_http_proxy = 0;
+#endif
 
   if (hd->uri->use_tls && !hd->session)
     {
@@ -1759,8 +1761,10 @@ send_request (http_t hd, const char *httphost, const char *auth,
 
       if (err)
         ;
+#ifdef USE_TLS
       else if (!strcmp (uri->scheme, "http"))
         have_http_proxy = 1;
+#endif
       else if (!strcmp (uri->scheme, "socks4")
                || !strcmp (uri->scheme, "socks5h"))
         err = gpg_err_make (default_errsource, GPG_ERR_NOT_IMPLEMENTED);

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/http.c    |  4 ++++
 scd/app-openpgp.c | 10 +++++-----
 2 files changed, 9 insertions(+), 5 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 09:38:31 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 24 Jul 2017 09:38:31 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.8.0-4-gac39522
Message-ID: <E1dZXwl-0005OJ-4u@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  ac39522ab08fcd2483edc223334c6ab9d19e91f3 (commit)
      from  93478098dce6a123ffb511767861b09255a3f784 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ac39522ab08fcd2483edc223334c6ab9d19e91f3
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 24 09:32:25 2017 +0200

    random: Fix the command line munging for jitterbase.
    
    * random/Makefile.am (o_flag_munging): Make the first sed term also
    global.
    --
    
    The sed script did not caught multiple -O which are not -O0.
    
    GnuPG-bug-id: 3293
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/random/Makefile.am b/random/Makefile.am
index 7698a72..60af5b4 100644
--- a/random/Makefile.am
+++ b/random/Makefile.am
@@ -55,7 +55,7 @@ jitterentropy-base.c jitterentropy.h jitterentropy-base-user.h
 
 # The rndjent module needs to be compiled without optimization.  */
 if ENABLE_O_FLAG_MUNGING
-o_flag_munging = sed -e 's/-O\([1-9s][1-9s]*\)/-O0/' -e 's/-Ofast/-O0/g'
+o_flag_munging = sed -e 's/-O\([1-9s][1-9s]*\)/-O0/g' -e 's/-Ofast/-O0/g'
 else
 o_flag_munging = cat
 endif

-----------------------------------------------------------------------

Summary of changes:
 random/Makefile.am | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 10:51:25 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 24 Jul 2017 10:51:25 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-138-g5dac85f
Message-ID: <E1dZZ5K-0007YA-7U@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  5dac85fba78075b525a9aab24ea079fc4addf372 (commit)
      from  45e40487fb7bb51228c96c8966e38c643a9b9ba5 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5dac85fba78075b525a9aab24ea079fc4addf372
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 24 10:41:30 2017 +0200

    doc: Revert the bug reporting address to bugs.gnupg.org
    
    --
    
    dev.gnupg org is the development platform but the canonical bug
    address is and has always been bugs.gnupg.org.  We should keep on
    using this address for the case that we switch the tracker again or
    split it off the development system.
    
    That is also the reason why we should keep on communicating a plain
    bug number without the 'T' prefix.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/AUTHORS b/AUTHORS
index 76eb6e4..99bb0e2 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -2,7 +2,7 @@ Program: GnuPG
 Homepage: https://www.gnupg.org
 Download: https://gnupg.org/ftp/gcrypt/gnupg/
 Repository: git://git.gnupg.org/gnupg.git
-Bug reports: https://dev.gnupg.org
+Bug reports: https://bugs.gnupg.org
 Security related bug reports: <security at gnupg.org>
 Maintainer: Werner Koch <wk at gnupg.org>
 License: GPLv3+
diff --git a/README b/README
index e0c5d71..aaf347c 100644
--- a/README
+++ b/README
@@ -227,7 +227,7 @@
   https://www.gnupg.org/documentation/mailing-lists.html for archives
   of the mailing lists.
 
-  Please direct bug reports to http://dev.gnupg.org or post them
+  Please direct bug reports to [[http://bugs.gnupg.org]] or post them
   direct to the mailing list <gnupg-devel at gnupg.org>.
 
   Please direct questions about GnuPG to the users mailing list or one
diff --git a/configure.ac b/configure.ac
index 56cb78e..02ee1a2 100644
--- a/configure.ac
+++ b/configure.ac
@@ -47,7 +47,7 @@ m4_define([mym4_version],      m4_argn(4, mym4_verslist))
 m4_define([mym4_revision],     m4_argn(7, mym4_verslist))
 m4_define([mym4_revision_dec], m4_argn(8, mym4_verslist))
 m4_esyscmd([echo ]mym4_version[>VERSION])
-AC_INIT([mym4_package],[mym4_version], [https://dev.gnupg.org])
+AC_INIT([mym4_package],[mym4_version], [https://bugs.gnupg.org])
 
 NEED_GPG_ERROR_VERSION=1.24
 
diff --git a/doc/announce-2.1.txt b/doc/announce-2.1.txt
index 137f0b1..eccd0e7 100644
--- a/doc/announce-2.1.txt
+++ b/doc/announce-2.1.txt
@@ -236,7 +236,7 @@ Support
 Please consult the archive of the gnupg-users mailing list before
 reporting a bug <https://gnupg.org/documentation/mailing-lists.html>.
 We suggest to send bug reports for a new release to this list in favor
-of filing a bug at <https://dev.gnupg.org>.  For commercial support
+of filing a bug at <https://bugs.gnupg.org>.  For commercial support
 requests we keep a list of known service companies at:
 
   https://gnupg.org/service.html
diff --git a/doc/faq.org b/doc/faq.org
index 5619faa..ddbeafa 100644
--- a/doc/faq.org
+++ b/doc/faq.org
@@ -1139,7 +1139,7 @@ update this FAQ in the next month.  See the section "Changes" for recent updates
     the list of reported bugs on the documentation page). If you're
     not sure about it being a bug, you can send mail to the
     gnupg-devel list. Otherwise, use the bug tracking system at
-    [[https://dev.gnupg.org][dev.gnupg.org]].
+    [[https://bugs.gnupg.org][bugs.gnupg.org]].
 
 ** Why doesn't GnuPG support X.509 certificates?
    :PROPERTIES:
diff --git a/doc/gpg.texi b/doc/gpg.texi
index 1b5dee0..9147bdf 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -3806,7 +3806,7 @@ may be recoverable from it later.
 
 Before you report a bug you should first search the mailing list
 archives for similar problems and second check whether such a bug has
-already been reported to our bug tracker at https://dev.gnupg.org .
+already been reported to our bug tracker at @url{https://bugs.gnupg.org}.
 
 @c *******************************************
 @c ***************              **************

-----------------------------------------------------------------------

Summary of changes:
 AUTHORS              | 2 +-
 README               | 2 +-
 configure.ac         | 2 +-
 doc/announce-2.1.txt | 2 +-
 doc/faq.org          | 2 +-
 doc/gpg.texi         | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 11:26:17 2017
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Mon, 24 Jul 2017 11:26:17 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 7a1f6d89573a17887459b343aa482f8de979054f
Message-ID: <E1dZZd3-0004Yn-LZ@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  7a1f6d89573a17887459b343aa482f8de979054f (commit)
      from  2610bd7d3ce7b309fd69fbe9705bddcce9fb38a6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 7a1f6d89573a17887459b343aa482f8de979054f
Author: Neal H. Walfield <neal at gnu.org>
Date:   Mon Jul 24 11:25:23 2017 +0200

    campaign: Replace video of the day with a list of all videos.

diff --git a/web/donate/index.org b/web/donate/index.org
index 777810c..1477154 100644
--- a/web/donate/index.org
+++ b/web/donate/index.org
@@ -217,11 +217,61 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Video of the Day: Arthur Jordan
-            <small><a href="https://2u.com/">2U</a></small>
-          </h2>
+	  <h2>Videos of the Day</h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
+              <ul>
+                <li> <a href="https://youtu.be/1OMJWpdl0DA?t=8s">Alex Abdo</a>
+                  from the <a href="https://aclu.org">ACLU</a>
+                <li> <a href="https://www.youtube.com/watch?v=bcNLlWqZ9d0t=10s">Andre Meister</a>
+                  from <a href="https://netzpolitik.org">netzpolitik.org</a>
+                <li> <a href="https://www.youtube.com/watch?v=atFz16nInIs&t=10s">Benjamin Isma?l</a>
+                  from <a href="https://rsf.org/">Reporters without Borders</a>
+                <li> <a href="https://youtu.be/sQMj332dgIE?t=8s">Thenmozhi Soundararajan</a>
+                  from <a href="https://www.equalitylabs.org/">Equality Labs</a>
+                <li> <a href="https://youtu.be/5MCGTd8pOG4?t=10s">Matt Mitchell</a>
+                  from <a href="http://www.meetup.com/New-York-Cryptoparty-Network/">CryptoHarlem</a>
+                <li> <a href="https://youtu.be/IdCiJMc3q80?t=8s">Cindy Cohn</a>
+                  from <a href="https://eff.org">EFF</a>
+                <li> <a href="https://youtu.be/Qqg3_a72aEw?t=8s">Ksenia Ermoshina</a>,
+                  Researcher at <a href="https://nextleap.eu/">nextleap.eu</a>
+                <li> <a href="https://youtu.be/6DqfWz-KHSI?t=8s">Micha? 'Rysiek' Wo?niak</a>
+                  from <a href="https://www.occrp.org/">OCCRP</a>
+                <li> <a href="https://youtu.be/OpeFuKRYGVA?t=8s">Sze Ming</a>
+                  from the <a href="https://sinarproject.org/">Sinar Project</a>
+                <li> <a href="https://youtu.be/oQvP9SXm-ek?t=8s">Jason Reich</a>
+                  from <a href="https://www.buzzfeed.com/">BuzzFeed</a>
+                <li> <a href="https://youtu.be/iRuo57Hzask?t=8s">John Pershing</a>
+                  from <a href="https://1010data.com">1010data</a>
+                <li> <a href="https://youtu.be/sX0lncD0VCM?t=10s">Jochim Selzer</a>
+                  from <a href="https://koeln.ccc.de/">CCC K?ln</a>
+                <li> <a href="https://youtu.be/Z0h_uPWFp7o?t=8s">C5</a>,
+                  Digital Security Trainer from the Philippines
+                <li> <a href="https://youtu.be/xB6AvoeCWro?t=9s">Noah Vesely</a>
+                  from <a href="https://securedrop.org/">SecureDrop</a>
+                <li> <a href="https://youtu.be/_aJPaR9Cfmk?t=9s">Lisa 'Leez' Wright</a>
+                  from the <a href="https://eff.org">EFF</a>
+                <li> <a href="https://youtu.be/VJIR5zzpUr8?t=8s">Hern?ni Marques</a>
+                  from <a href="https://www.ccc-ch.ch/">CCC Switzerland</a>
+                <li> <a href="https://youtu.be/K8-pmUyegYk?t=8s">Geoffrey King</a>,
+                  <a href="https://geoffreyking.org/">Lawyer and Journalist</a>
+                <li> <a href="https://youtu.be/l1ByJCSvQKk?t=9s">Andrew Ford Lyons</a>
+                  from <a href="http://www.internews.org/">Internews Europe</a>
+                <li> <a href="https://youtu.be/6dreAkVxmpg?t=8s">Seamus Tuohy</a>,
+                  <a href="http://prudentinnovation.org/">Digital Security Trainer</a>
+                <li> <a href="https://youtu.be/j0Zd0wZyLP8?t=7s">Meik Michalke</a>
+                  from <a href="https://www.c3s.cc/">C3S</a>
+                <li> <a href="https://youtu.be/mak22hXcslg?t=8s">Sheera Frenkel</a>
+                  from <a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
+                <li> <a href=" https://youtu.be/MSu_FF49MtU?t=8s">Michael Stehmann</a>,
+                  <a href="http://www.rechtsanwalt-stehmann.de/">Lawyer</a>
+                <li> <a href="https://youtu.be/-Rkrf9GIw8M?t=9s">C?dric Laurant</a>
+                  from <a href="https://sontusdatos.org/">SonTusDatos</a>
+                <li> <a href="https://youtu.be/SdlnauJ5XWM?t=9s">Daniel Kahn Gillmor</a>
+                  from <a href="https://debian.org">Debian</a> and the <a href="https://aclu.org">ACLU</a>
+                <li> <a href="https://youtu.be/g9a_snLWRxE?t=8s">Arthur Jordan</a>
+                  from <a href="https://2u.com/">2U</a>
+              </ul>
 	      <div class="embed-responsive embed-responsive-16by9 camp-video"
 		   data-embed="votd"
                    data-embed-list="PLjX3x3GHoOWKs-VCjFBu_Yk5l1-l9mJzi">

-----------------------------------------------------------------------

Summary of changes:
 web/donate/index.org | 56 +++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 53 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 11:41:15 2017
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Mon, 24 Jul 2017 11:41:15 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. dd166d8c508184e649ee6e7dc5f46eacf59d7c1e
Message-ID: <E1dZZrX-0006tu-ES@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  dd166d8c508184e649ee6e7dc5f46eacf59d7c1e (commit)
      from  7a1f6d89573a17887459b343aa482f8de979054f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit dd166d8c508184e649ee6e7dc5f46eacf59d7c1e
Author: Neal H. Walfield <neal at gnu.org>
Date:   Mon Jul 24 11:41:02 2017 +0200

    campaign: Fix a few links in the last commit.

diff --git a/web/donate/index.org b/web/donate/index.org
index 1477154..9ed05a0 100644
--- a/web/donate/index.org
+++ b/web/donate/index.org
@@ -221,19 +221,19 @@
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
               <ul>
-                <li> <a href="https://youtu.be/1OMJWpdl0DA?t=8s">Alex Abdo</a>
+                <li> <a href="https://youtu.be/1OMJWpdl0DA?t=9s">Alex Abdo</a>
                   from the <a href="https://aclu.org">ACLU</a>
-                <li> <a href="https://www.youtube.com/watch?v=bcNLlWqZ9d0t=10s">Andre Meister</a>
+                <li> <a href="https://youtu.be/bcNLlWqZ9d0?t=9s">Andre Meister</a>
                   from <a href="https://netzpolitik.org">netzpolitik.org</a>
                 <li> <a href="https://www.youtube.com/watch?v=atFz16nInIs&t=10s">Benjamin Isma?l</a>
                   from <a href="https://rsf.org/">Reporters without Borders</a>
-                <li> <a href="https://youtu.be/sQMj332dgIE?t=8s">Thenmozhi Soundararajan</a>
+                <li> <a href="https://youtu.be/sQMj332dgIE?t=10s">Thenmozhi Soundararajan</a>
                   from <a href="https://www.equalitylabs.org/">Equality Labs</a>
                 <li> <a href="https://youtu.be/5MCGTd8pOG4?t=10s">Matt Mitchell</a>
                   from <a href="http://www.meetup.com/New-York-Cryptoparty-Network/">CryptoHarlem</a>
                 <li> <a href="https://youtu.be/IdCiJMc3q80?t=8s">Cindy Cohn</a>
                   from <a href="https://eff.org">EFF</a>
-                <li> <a href="https://youtu.be/Qqg3_a72aEw?t=8s">Ksenia Ermoshina</a>,
+                <li> <a href="https://youtu.be/Qqg3_a72aEw?t=9s">Ksenia Ermoshina</a>,
                   Researcher at <a href="https://nextleap.eu/">nextleap.eu</a>
                 <li> <a href="https://youtu.be/6DqfWz-KHSI?t=8s">Micha? 'Rysiek' Wo?niak</a>
                   from <a href="https://www.occrp.org/">OCCRP</a>
@@ -241,7 +241,7 @@
                   from the <a href="https://sinarproject.org/">Sinar Project</a>
                 <li> <a href="https://youtu.be/oQvP9SXm-ek?t=8s">Jason Reich</a>
                   from <a href="https://www.buzzfeed.com/">BuzzFeed</a>
-                <li> <a href="https://youtu.be/iRuo57Hzask?t=8s">John Pershing</a>
+                <li> <a href="https://youtu.be/iRuo57Hzask?t=9s">John Pershing</a>
                   from <a href="https://1010data.com">1010data</a>
                 <li> <a href="https://youtu.be/sX0lncD0VCM?t=10s">Jochim Selzer</a>
                   from <a href="https://koeln.ccc.de/">CCC K?ln</a>
@@ -253,17 +253,17 @@
                   from the <a href="https://eff.org">EFF</a>
                 <li> <a href="https://youtu.be/VJIR5zzpUr8?t=8s">Hern?ni Marques</a>
                   from <a href="https://www.ccc-ch.ch/">CCC Switzerland</a>
-                <li> <a href="https://youtu.be/K8-pmUyegYk?t=8s">Geoffrey King</a>,
+                <li> <a href="https://youtu.be/K8-pmUyegYk?t=9s">Geoffrey King</a>,
                   <a href="https://geoffreyking.org/">Lawyer and Journalist</a>
                 <li> <a href="https://youtu.be/l1ByJCSvQKk?t=9s">Andrew Ford Lyons</a>
                   from <a href="http://www.internews.org/">Internews Europe</a>
                 <li> <a href="https://youtu.be/6dreAkVxmpg?t=8s">Seamus Tuohy</a>,
                   <a href="http://prudentinnovation.org/">Digital Security Trainer</a>
-                <li> <a href="https://youtu.be/j0Zd0wZyLP8?t=7s">Meik Michalke</a>
+                <li> <a href="https://youtu.be/j0Zd0wZyLP8?t=10s">Meik Michalke</a>
                   from <a href="https://www.c3s.cc/">C3S</a>
                 <li> <a href="https://youtu.be/mak22hXcslg?t=8s">Sheera Frenkel</a>
                   from <a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
-                <li> <a href=" https://youtu.be/MSu_FF49MtU?t=8s">Michael Stehmann</a>,
+                <li> <a href=" https://youtu.be/MSu_FF49MtU?t=9s">Michael Stehmann</a>,
                   <a href="http://www.rechtsanwalt-stehmann.de/">Lawyer</a>
                 <li> <a href="https://youtu.be/-Rkrf9GIw8M?t=9s">C?dric Laurant</a>
                   from <a href="https://sontusdatos.org/">SonTusDatos</a>

-----------------------------------------------------------------------

Summary of changes:
 web/donate/index.org | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 13:27:30 2017
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Mon, 24 Jul 2017 13:27:30 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. d2f076d22348153abeb11f71518d78ea6f5e594e
Message-ID: <E1dZbWM-0006sH-Py@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  d2f076d22348153abeb11f71518d78ea6f5e594e (commit)
       via  473fb9b30c8edfdc9dddbad85ee19b31ff58a17f (commit)
      from  dd166d8c508184e649ee6e7dc5f46eacf59d7c1e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d2f076d22348153abeb11f71518d78ea6f5e594e
Author: Neal H. Walfield <neal at gnu.org>
Date:   Mon Jul 24 12:56:47 2017 +0200

    campaign: Remove the paragraph about the FLM matching donations.

diff --git a/web/donate/index.org b/web/donate/index.org
index 60ffd24..255d313 100644
--- a/web/donate/index.org
+++ b/web/donate/index.org
@@ -172,19 +172,6 @@
 	  </div>
 	</div>
       </div>
-      <div class="row">
-	<div class="col-sm-10 col-sm-offset-1">
-          <br /><p class="lead"><b>For each recurring
-              donation, <a href="https://www.firstlook.media/">First Look
-                Media</a></b>, the parent organization
-            of <a href="https://theintercept.com/">The Intercept</a> and
-            Laura Poitras' <a href="https://fieldofvision.org/">Field of
-              Vision</a>, <b>will match the first 12 months</b> of your
-              gift up to 25&#x202f;000&nbsp;USD (<!--CMPGN-FLM-USD-->
-              matched so far)!
-          </p>
-        </div>
-      </div>
     </div>
 
     <div class="camp-gutter container-fluid flying-locks">

commit 473fb9b30c8edfdc9dddbad85ee19b31ff58a17f
Author: Neal H. Walfield <neal at gnu.org>
Date:   Mon Jul 24 12:56:12 2017 +0200

    campaign: Remove embedded video.

diff --git a/web/donate/index.org b/web/donate/index.org
index 9ed05a0..60ffd24 100644
--- a/web/donate/index.org
+++ b/web/donate/index.org
@@ -272,19 +272,6 @@
                 <li> <a href="https://youtu.be/g9a_snLWRxE?t=8s">Arthur Jordan</a>
                   from <a href="https://2u.com/">2U</a>
               </ul>
-	      <div class="embed-responsive embed-responsive-16by9 camp-video"
-		   data-embed="votd"
-                   data-embed-list="PLjX3x3GHoOWKs-VCjFBu_Yk5l1-l9mJzi">
-		<img src="/share/campaign/img/thumbs/votd.jpg">
-		<div class="play-button"></div>
-		<div class="video-text">Click to start the video
-                  <noscript><br />
-                    <span style="font-size: 60%"
-                          >(requires JavaScript from YouTube.)
-                    </span>
-                  </noscript>
-                </div>
-              </div>
 	    </div>
 	  </div>
 	  <p class="vid-howto">

-----------------------------------------------------------------------

Summary of changes:
 web/donate/index.org | 26 --------------------------
 1 file changed, 26 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 13:39:25 2017
From: cvs at cvs.gnupg.org (by Neal H. Walfield)
Date: Mon, 24 Jul 2017 13:39:25 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. b8fd72086cbb9a016b72253bfd2ed94f932b974d
Message-ID: <E1dZbhu-0000Sl-2y@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  b8fd72086cbb9a016b72253bfd2ed94f932b974d (commit)
       via  d69e314460ec46666802e1969314795bbfe6a0ef (commit)
      from  d2f076d22348153abeb11f71518d78ea6f5e594e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b8fd72086cbb9a016b72253bfd2ed94f932b974d
Author: Neal H. Walfield <neal at gnu.org>
Date:   Mon Jul 24 13:38:59 2017 +0200

    campaign: Propagate previous changes to the non-English versions

diff --git a/web/donate/index.de.org b/web/donate/index.de.org
index ac02314..84891ad 100644
--- a/web/donate/index.de.org
+++ b/web/donate/index.de.org
@@ -170,21 +170,6 @@ href="/cgi-bin/procdonate.cgi?mode=preset&lang=de"
 	  </div>
 	</div>
       </div>
-      <div class="row">
-	<div class="col-sm-10 col-sm-offset-1">
-          <br /><p class="lead"><b>F?r jede Dauerspende
-              wird <a href="https://www.firstlook.media/">First Look
-              Media</a></b>, der Dachverband
-              von <a href="https://theintercept.com/">The
-              Intercept</a> und Laura
-              Poitras <a href="https://fieldofvision.org/">Field of
-              Vision</a>, <b>innerhalb der ersten 12 Monate den
-              gleichen Betrag noch einmal spenden</b> bis
-              25&#x202f;000&nbsp;USD (<!--CMPGN-FLM-USD-->
-              erreicht)!
-          </p>
-        </div>
-      </div>
     </div>
 
     <div class="camp-gutter container-fluid flying-locks">
@@ -222,32 +207,63 @@ href="/cgi-bin/procdonate.cgi?mode=preset&lang=de"
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Video des Tages: Arthur Jordan
-            <small><a href="https://2u.com/">2U</a></small>
-          </h2>
+	  <h2>Videos</h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
-	      <div class="embed-responsive embed-responsive-16by9 camp-video"
-		   data-embed="votd"
-                   data-embed-list="PLjX3x3GHoOWKs-VCjFBu_Yk5l1-l9mJzi">
-		<img src="/share/campaign/img/thumbs/votd.jpg">
-		<div class="play-button"></div>
-		<div class="video-text">Klicken um das Video zu starten
-		  <noscript><br />
-                    <span style="font-size: 60%"
-			  >(erfordert JavaScript von YouTube).
-                    </span>
-		  </noscript>
-		</div>
-              </div>
+              <ul>
+                <li> <a href="https://youtu.be/1OMJWpdl0DA?t=9s">Alex Abdo</a>
+                  from the <a href="https://aclu.org">ACLU</a>
+                <li> <a href="https://youtu.be/bcNLlWqZ9d0?t=9s">Andre Meister</a>
+                  from <a href="https://netzpolitik.org">netzpolitik.org</a>
+                <li> <a href="https://www.youtube.com/watch?v=atFz16nInIs&t=10s">Benjamin Isma?l</a>
+                  from <a href="https://rsf.org/">Reporters without Borders</a>
+                <li> <a href="https://youtu.be/sQMj332dgIE?t=10s">Thenmozhi Soundararajan</a>
+                  from <a href="https://www.equalitylabs.org/">Equality Labs</a>
+                <li> <a href="https://youtu.be/5MCGTd8pOG4?t=10s">Matt Mitchell</a>
+                  from <a href="http://www.meetup.com/New-York-Cryptoparty-Network/">CryptoHarlem</a>
+                <li> <a href="https://youtu.be/IdCiJMc3q80?t=8s">Cindy Cohn</a>
+                  from <a href="https://eff.org">EFF</a>
+                <li> <a href="https://youtu.be/Qqg3_a72aEw?t=9s">Ksenia Ermoshina</a>,
+                  Researcher at <a href="https://nextleap.eu/">nextleap.eu</a>
+                <li> <a href="https://youtu.be/6DqfWz-KHSI?t=8s">Micha? 'Rysiek' Wo?niak</a>
+                  from <a href="https://www.occrp.org/">OCCRP</a>
+                <li> <a href="https://youtu.be/OpeFuKRYGVA?t=8s">Sze Ming</a>
+                  from the <a href="https://sinarproject.org/">Sinar Project</a>
+                <li> <a href="https://youtu.be/oQvP9SXm-ek?t=8s">Jason Reich</a>
+                  from <a href="https://www.buzzfeed.com/">BuzzFeed</a>
+                <li> <a href="https://youtu.be/iRuo57Hzask?t=9s">John Pershing</a>
+                  from <a href="https://1010data.com">1010data</a>
+                <li> <a href="https://youtu.be/sX0lncD0VCM?t=10s">Jochim Selzer</a>
+                  from <a href="https://koeln.ccc.de/">CCC K?ln</a>
+                <li> <a href="https://youtu.be/Z0h_uPWFp7o?t=8s">C5</a>,
+                  Digital Security Trainer from the Philippines
+                <li> <a href="https://youtu.be/xB6AvoeCWro?t=9s">Noah Vesely</a>
+                  from <a href="https://securedrop.org/">SecureDrop</a>
+                <li> <a href="https://youtu.be/_aJPaR9Cfmk?t=9s">Lisa 'Leez' Wright</a>
+                  from the <a href="https://eff.org">EFF</a>
+                <li> <a href="https://youtu.be/VJIR5zzpUr8?t=8s">Hern?ni Marques</a>
+                  from <a href="https://www.ccc-ch.ch/">CCC Switzerland</a>
+                <li> <a href="https://youtu.be/K8-pmUyegYk?t=9s">Geoffrey King</a>,
+                  <a href="https://geoffreyking.org/">Lawyer and Journalist</a>
+                <li> <a href="https://youtu.be/l1ByJCSvQKk?t=9s">Andrew Ford Lyons</a>
+                  from <a href="http://www.internews.org/">Internews Europe</a>
+                <li> <a href="https://youtu.be/6dreAkVxmpg?t=8s">Seamus Tuohy</a>,
+                  <a href="http://prudentinnovation.org/">Digital Security Trainer</a>
+                <li> <a href="https://youtu.be/j0Zd0wZyLP8?t=10s">Meik Michalke</a>
+                  from <a href="https://www.c3s.cc/">C3S</a>
+                <li> <a href="https://youtu.be/mak22hXcslg?t=8s">Sheera Frenkel</a>
+                  from <a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
+                <li> <a href=" https://youtu.be/MSu_FF49MtU?t=9s">Michael Stehmann</a>,
+                  <a href="http://www.rechtsanwalt-stehmann.de/">Lawyer</a>
+                <li> <a href="https://youtu.be/-Rkrf9GIw8M?t=9s">C?dric Laurant</a>
+                  from <a href="https://sontusdatos.org/">SonTusDatos</a>
+                <li> <a href="https://youtu.be/SdlnauJ5XWM?t=9s">Daniel Kahn Gillmor</a>
+                  from <a href="https://debian.org">Debian</a> and the <a href="https://aclu.org">ACLU</a>
+                <li> <a href="https://youtu.be/g9a_snLWRxE?t=8s">Arthur Jordan</a>
+                  from <a href="https://2u.com/">2U</a>
+              </ul>
 	    </div>
 	  </div>
-	  <p class="vid-howto">
-	    Jeden Tag gibt es ein neues Video! Im Men?
-	    <img src="/share/campaign/img/vidmenu.svg" style="height:
-	    1em; vertical-align: baseline;" aria-hidden="true"/>
-	    k?nnen weitere Videos ausgew?hlt werden.
-	  </p>
 	</div>
       </div>
     </div>
diff --git a/web/donate/index.fr.org b/web/donate/index.fr.org
index 91db737..558214e 100644
--- a/web/donate/index.fr.org
+++ b/web/donate/index.fr.org
@@ -167,21 +167,6 @@
 	  </div>
 	</div>
       </div>
-      <div class="row">
-	<div class="col-sm-10 col-sm-offset-1">
-          <br /><p class="lead">Pour chaque donation r?guli?re,
-            <a href="https://www.firstlook.media/">First Look
-              Media</a></b>, l'organisation m?re de
-              <a href="https://theintercept.com/">The Intercept</a> et
-              du
-              <a href="https://fieldofvision.org/">Field of Vision</a>
-              de Laura Poitras,
-              <b>?galera les premier 12 mois</b> jusqu'?
-              25&#x202f;000&nbsp;USD (<!--CMPGN-FLM-USD-->
-              ?galera jusqu'? pr?sent).
-          </p>
-        </div>
-      </div>
     </div>
 
     <div class="camp-gutter container-fluid flying-locks">
@@ -215,32 +200,62 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>Clip du jour?: Arthur Jordan
-            <small><a href="https://2u.com/">2U</a></small>
-          </h2>
+	  <h2>Clips</h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
-	      <div class="embed-responsive embed-responsive-16by9 camp-video"
-		   data-embed="votd"
-                   data-embed-list="PLjX3x3GHoOWKs-VCjFBu_Yk5l1-l9mJzi">
-		<img src="/share/campaign/img/thumbs/votd.jpg">
-		<div class="play-button"></div>
-		<div class="video-text">Cliquez pour lancer la vid?o
-                  <noscript><br />
-                    <span style="font-size: 60%"
-                          >(n?cessite JavaScript depuis YouTube.)
-                    </span>
-                  </noscript>
-                </div>
-              </div>
+              <ul>
+                <li> <a href="https://youtu.be/1OMJWpdl0DA?t=9s">Alex Abdo</a>
+                  from the <a href="https://aclu.org">ACLU</a>
+                <li> <a href="https://youtu.be/bcNLlWqZ9d0?t=9s">Andre Meister</a>
+                  from <a href="https://netzpolitik.org">netzpolitik.org</a>
+                <li> <a href="https://www.youtube.com/watch?v=atFz16nInIs&t=10s">Benjamin Isma?l</a>
+                  from <a href="https://rsf.org/">Reporters without Borders</a>
+                <li> <a href="https://youtu.be/sQMj332dgIE?t=10s">Thenmozhi Soundararajan</a>
+                  from <a href="https://www.equalitylabs.org/">Equality Labs</a>
+                <li> <a href="https://youtu.be/5MCGTd8pOG4?t=10s">Matt Mitchell</a>
+                  from <a href="http://www.meetup.com/New-York-Cryptoparty-Network/">CryptoHarlem</a>
+                <li> <a href="https://youtu.be/IdCiJMc3q80?t=8s">Cindy Cohn</a>
+                  from <a href="https://eff.org">EFF</a>
+                <li> <a href="https://youtu.be/Qqg3_a72aEw?t=9s">Ksenia Ermoshina</a>,
+                  Researcher at <a href="https://nextleap.eu/">nextleap.eu</a>
+                <li> <a href="https://youtu.be/6DqfWz-KHSI?t=8s">Micha? 'Rysiek' Wo?niak</a>
+                  from <a href="https://www.occrp.org/">OCCRP</a>
+                <li> <a href="https://youtu.be/OpeFuKRYGVA?t=8s">Sze Ming</a>
+                  from the <a href="https://sinarproject.org/">Sinar Project</a>
+                <li> <a href="https://youtu.be/oQvP9SXm-ek?t=8s">Jason Reich</a>
+                  from <a href="https://www.buzzfeed.com/">BuzzFeed</a>
+                <li> <a href="https://youtu.be/iRuo57Hzask?t=9s">John Pershing</a>
+                  from <a href="https://1010data.com">1010data</a>
+                <li> <a href="https://youtu.be/sX0lncD0VCM?t=10s">Jochim Selzer</a>
+                  from <a href="https://koeln.ccc.de/">CCC K?ln</a>
+                <li> <a href="https://youtu.be/Z0h_uPWFp7o?t=8s">C5</a>,
+                  Digital Security Trainer from the Philippines
+                <li> <a href="https://youtu.be/xB6AvoeCWro?t=9s">Noah Vesely</a>
+                  from <a href="https://securedrop.org/">SecureDrop</a>
+                <li> <a href="https://youtu.be/_aJPaR9Cfmk?t=9s">Lisa 'Leez' Wright</a>
+                  from the <a href="https://eff.org">EFF</a>
+                <li> <a href="https://youtu.be/VJIR5zzpUr8?t=8s">Hern?ni Marques</a>
+                  from <a href="https://www.ccc-ch.ch/">CCC Switzerland</a>
+                <li> <a href="https://youtu.be/K8-pmUyegYk?t=9s">Geoffrey King</a>,
+                  <a href="https://geoffreyking.org/">Lawyer and Journalist</a>
+                <li> <a href="https://youtu.be/l1ByJCSvQKk?t=9s">Andrew Ford Lyons</a>
+                  from <a href="http://www.internews.org/">Internews Europe</a>
+                <li> <a href="https://youtu.be/6dreAkVxmpg?t=8s">Seamus Tuohy</a>,
+                  <a href="http://prudentinnovation.org/">Digital Security Trainer</a>
+                <li> <a href="https://youtu.be/j0Zd0wZyLP8?t=10s">Meik Michalke</a>
+                  from <a href="https://www.c3s.cc/">C3S</a>
+                <li> <a href="https://youtu.be/mak22hXcslg?t=8s">Sheera Frenkel</a>
+                  from <a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
+                <li> <a href=" https://youtu.be/MSu_FF49MtU?t=9s">Michael Stehmann</a>,
+                  <a href="http://www.rechtsanwalt-stehmann.de/">Lawyer</a>
+                <li> <a href="https://youtu.be/-Rkrf9GIw8M?t=9s">C?dric Laurant</a>
+                  from <a href="https://sontusdatos.org/">SonTusDatos</a>
+                <li> <a href="https://youtu.be/SdlnauJ5XWM?t=9s">Daniel Kahn Gillmor</a>
+                  from <a href="https://debian.org">Debian</a> and the <a href="https://aclu.org">ACLU</a>
+                <li> <a href="https://youtu.be/g9a_snLWRxE?t=8s">Arthur Jordan</a>
+                  from <a href="https://2u.com/">2U</a>
+              </ul>
 	    </div>
-	  </div>
-	  <p class="vid-howto">
-	    Cliquez sur le menu
-	    <img src="/share/campaign/img/vidmenu.svg" style="height:
-	    1em; vertical-align: baseline;" aria-hidden="true"/> pour
-            s?lectionner d'autres vid?os.
-	  </p>
 	</div>
       </div>
     </div>
diff --git a/web/donate/index.ja.org b/web/donate/index.ja.org
index b3323a6..028d009 100644
--- a/web/donate/index.ja.org
+++ b/web/donate/index.ja.org
@@ -169,18 +169,6 @@
 	  </div>
 	</div>
       </div>
-      <div class="row">
-	<div class="col-sm-10 col-sm-offset-1">
-          <br /><p class="lead"><b>?????(??/????/??)?????
-	      <a href="https://www.firstlook.media/">First Look
-                Media</a>?</b>(<a href="https://theintercept.com/">The Intercept</a>?
-            Laura Poitras?<a href="https://fieldofvision.org/">Field of
-              Vision</a>??????)??????????????????<b>???12????????????</b>??????????(???25&#x202f;000&nbsp;USD (?????
-	    <!--CMPGN-FLM-USD-->
-            ??)??)!
-          </p>
-        </div>
-      </div>
     </div>
 
     <div class="camp-gutter container-fluid flying-locks">
@@ -202,32 +190,63 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>?????: Arthur Jordan
-            <small><a href="https://2u.com/">2U</a></small>
-          </h2>
+	  <h2>?????</h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
-	      <div class="embed-responsive embed-responsive-16by9 camp-video"
-		   data-embed="votd"
-                   data-embed-list="PLjX3x3GHoOWKs-VCjFBu_Yk5l1-l9mJzi">
-		<img src="/share/campaign/img/thumbs/votd.jpg">
-		<div class="play-button"></div>
-		<div class="video-text">?????????????
-                  <noscript><br />
-                    <span style="font-size: 60%"
-                          >(YouTube???JavaScript?????????)
-                    </span>
-                  </noscript>
-                </div>
-              </div>
+              <ul>
+                <li> <a href="https://youtu.be/1OMJWpdl0DA?t=9s">Alex Abdo</a>
+                  from the <a href="https://aclu.org">ACLU</a>
+                <li> <a href="https://youtu.be/bcNLlWqZ9d0?t=9s">Andre Meister</a>
+                  from <a href="https://netzpolitik.org">netzpolitik.org</a>
+                <li> <a href="https://www.youtube.com/watch?v=atFz16nInIs&t=10s">Benjamin Isma?l</a>
+                  from <a href="https://rsf.org/">Reporters without Borders</a>
+                <li> <a href="https://youtu.be/sQMj332dgIE?t=10s">Thenmozhi Soundararajan</a>
+                  from <a href="https://www.equalitylabs.org/">Equality Labs</a>
+                <li> <a href="https://youtu.be/5MCGTd8pOG4?t=10s">Matt Mitchell</a>
+                  from <a href="http://www.meetup.com/New-York-Cryptoparty-Network/">CryptoHarlem</a>
+                <li> <a href="https://youtu.be/IdCiJMc3q80?t=8s">Cindy Cohn</a>
+                  from <a href="https://eff.org">EFF</a>
+                <li> <a href="https://youtu.be/Qqg3_a72aEw?t=9s">Ksenia Ermoshina</a>,
+                  Researcher at <a href="https://nextleap.eu/">nextleap.eu</a>
+                <li> <a href="https://youtu.be/6DqfWz-KHSI?t=8s">Micha? 'Rysiek' Wo?niak</a>
+                  from <a href="https://www.occrp.org/">OCCRP</a>
+                <li> <a href="https://youtu.be/OpeFuKRYGVA?t=8s">Sze Ming</a>
+                  from the <a href="https://sinarproject.org/">Sinar Project</a>
+                <li> <a href="https://youtu.be/oQvP9SXm-ek?t=8s">Jason Reich</a>
+                  from <a href="https://www.buzzfeed.com/">BuzzFeed</a>
+                <li> <a href="https://youtu.be/iRuo57Hzask?t=9s">John Pershing</a>
+                  from <a href="https://1010data.com">1010data</a>
+                <li> <a href="https://youtu.be/sX0lncD0VCM?t=10s">Jochim Selzer</a>
+                  from <a href="https://koeln.ccc.de/">CCC K?ln</a>
+                <li> <a href="https://youtu.be/Z0h_uPWFp7o?t=8s">C5</a>,
+                  Digital Security Trainer from the Philippines
+                <li> <a href="https://youtu.be/xB6AvoeCWro?t=9s">Noah Vesely</a>
+                  from <a href="https://securedrop.org/">SecureDrop</a>
+                <li> <a href="https://youtu.be/_aJPaR9Cfmk?t=9s">Lisa 'Leez' Wright</a>
+                  from the <a href="https://eff.org">EFF</a>
+                <li> <a href="https://youtu.be/VJIR5zzpUr8?t=8s">Hern?ni Marques</a>
+                  from <a href="https://www.ccc-ch.ch/">CCC Switzerland</a>
+                <li> <a href="https://youtu.be/K8-pmUyegYk?t=9s">Geoffrey King</a>,
+                  <a href="https://geoffreyking.org/">Lawyer and Journalist</a>
+                <li> <a href="https://youtu.be/l1ByJCSvQKk?t=9s">Andrew Ford Lyons</a>
+                  from <a href="http://www.internews.org/">Internews Europe</a>
+                <li> <a href="https://youtu.be/6dreAkVxmpg?t=8s">Seamus Tuohy</a>,
+                  <a href="http://prudentinnovation.org/">Digital Security Trainer</a>
+                <li> <a href="https://youtu.be/j0Zd0wZyLP8?t=10s">Meik Michalke</a>
+                  from <a href="https://www.c3s.cc/">C3S</a>
+                <li> <a href="https://youtu.be/mak22hXcslg?t=8s">Sheera Frenkel</a>
+                  from <a href="https://www.buzzfeed.com/news">BuzzFeed News</a>
+                <li> <a href=" https://youtu.be/MSu_FF49MtU?t=9s">Michael Stehmann</a>,
+                  <a href="http://www.rechtsanwalt-stehmann.de/">Lawyer</a>
+                <li> <a href="https://youtu.be/-Rkrf9GIw8M?t=9s">C?dric Laurant</a>
+                  from <a href="https://sontusdatos.org/">SonTusDatos</a>
+                <li> <a href="https://youtu.be/SdlnauJ5XWM?t=9s">Daniel Kahn Gillmor</a>
+                  from <a href="https://debian.org">Debian</a> and the <a href="https://aclu.org">ACLU</a>
+                <li> <a href="https://youtu.be/g9a_snLWRxE?t=8s">Arthur Jordan</a>
+                  from <a href="https://2u.com/">2U</a>
+              </ul>
 	    </div>
 	  </div>
-	  <p class="vid-howto">
-	    ????????????! ???????????
-	    <img src="/share/campaign/img/vidmenu.svg" style="height:
-	    1em; vertical-align: baseline;" aria-hidden="true"/>
-	    ????????????
-	  </p>
 	</div>
       </div>
     </div>

commit d69e314460ec46666802e1969314795bbfe6a0ef
Author: Neal H. Walfield <neal at gnu.org>
Date:   Mon Jul 24 13:35:51 2017 +0200

    campaign: Remove some left over text.

diff --git a/web/donate/index.org b/web/donate/index.org
index 255d313..9502892 100644
--- a/web/donate/index.org
+++ b/web/donate/index.org
@@ -261,12 +261,6 @@
               </ul>
 	    </div>
 	  </div>
-	  <p class="vid-howto">
-	    There is a new video every day! Click the menu
-	    <img src="/share/campaign/img/vidmenu.svg" style="height:
-	    1em; vertical-align: baseline;" aria-hidden="true"/> to
-	    select more videos.
-	  </p>
 	</div>
       </div>
     </div>

-----------------------------------------------------------------------

Summary of changes:
 web/donate/index.de.org | 90 ++++++++++++++++++++++++++++--------------------
 web/donate/index.fr.org | 91 ++++++++++++++++++++++++++++---------------------
 web/donate/index.ja.org | 87 ++++++++++++++++++++++++++++------------------
 web/donate/index.org    |  6 ----
 4 files changed, 159 insertions(+), 115 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 16:05:50 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Mon, 24 Jul 2017 16:05:50 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-139-gd8e46f1
Message-ID: <E1dZdza-0005tU-Vs@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  d8e46f10698da0bee4cd58d95f1f9832bdda0c5f (commit)
      from  5dac85fba78075b525a9aab24ea079fc4addf372 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d8e46f10698da0bee4cd58d95f1f9832bdda0c5f
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Mon Jul 24 16:03:25 2017 +0200

    g10: Make sure to emit NEED_PASSPHRASE on --export-secret-key.
    
    * call-agent.h (agent_export_key): Add keyid parameters.
    * call-agent.c (agent_export_key): Set keyid parameters.
    * export.c (receive_seckey_from_agent): Pass keyid parameters.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2667

diff --git a/g10/call-agent.c b/g10/call-agent.c
index 3ad13e8..b17c2e6 100644
--- a/g10/call-agent.c
+++ b/g10/call-agent.c
@@ -2152,7 +2152,8 @@ agent_import_key (ctrl_t ctrl, const char *desc, char **cache_nonce_addr,
 gpg_error_t
 agent_export_key (ctrl_t ctrl, const char *hexkeygrip, const char *desc,
                   int openpgp_protected, char **cache_nonce_addr,
-                  unsigned char **r_result, size_t *r_resultlen)
+                  unsigned char **r_result, size_t *r_resultlen,
+		  u32 *keyid, u32 *mainkeyid, int pubkey_algo)
 {
   gpg_error_t err;
   struct cache_nonce_parm_s cn_parm;
@@ -2164,6 +2165,9 @@ agent_export_key (ctrl_t ctrl, const char *hexkeygrip, const char *desc,
 
   memset (&dfltparm, 0, sizeof dfltparm);
   dfltparm.ctrl = ctrl;
+  dfltparm.keyinfo.keyid       = keyid;
+  dfltparm.keyinfo.mainkeyid   = mainkeyid;
+  dfltparm.keyinfo.pubkey_algo = pubkey_algo;
 
   *r_result = NULL;
 
diff --git a/g10/call-agent.h b/g10/call-agent.h
index a04fc73..dcabbe8 100644
--- a/g10/call-agent.h
+++ b/g10/call-agent.h
@@ -192,7 +192,8 @@ gpg_error_t agent_import_key (ctrl_t ctrl, const char *desc,
 gpg_error_t agent_export_key (ctrl_t ctrl, const char *keygrip,
                               const char *desc, int openpgp_protected,
                               char **cache_nonce_addr,
-                              unsigned char **r_result, size_t *r_resultlen);
+                              unsigned char **r_result, size_t *r_resultlen,
+			      u32 *keyid, u32 *mainkeyid, int pubkey_algo);
 
 /* Delete a key from the agent.  */
 gpg_error_t agent_delete_key (ctrl_t ctrl, const char *hexkeygrip,
diff --git a/g10/export.c b/g10/export.c
index ce79a2f..8f6371b 100644
--- a/g10/export.c
+++ b/g10/export.c
@@ -1190,7 +1190,8 @@ receive_seckey_from_agent (ctrl_t ctrl, gcry_cipher_hd_t cipherhd,
 
   prompt = gpg_format_keydesc (ctrl, pk, FORMAT_KEYDESC_EXPORT,1);
   err = agent_export_key (ctrl, hexgrip, prompt, !cleartext, cache_nonce_addr,
-                          &wrappedkey, &wrappedkeylen);
+                          &wrappedkey, &wrappedkeylen,
+			  pk->keyid, pk->main_keyid, pk->pubkey_algo);
   xfree (prompt);
 
   if (err)

-----------------------------------------------------------------------

Summary of changes:
 g10/call-agent.c | 6 +++++-
 g10/call-agent.h | 3 ++-
 g10/export.c     | 3 ++-
 3 files changed, 9 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 16:39:35 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Mon, 24 Jul 2017 16:39:35 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-140-g78ebc62
Message-ID: <E1dZeWF-0002nL-Og@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  78ebc62604d77600b9865950610717d28c6027a2 (commit)
      from  d8e46f10698da0bee4cd58d95f1f9832bdda0c5f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 78ebc62604d77600b9865950610717d28c6027a2
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Mon Jul 24 16:31:55 2017 +0200

    w32: Change directory on daemon startup.
    
    * agent/gpg-agent.c [HAVE_W32_SYSTEM]: Include <direct.h>.
    (main) [HAVE_W32_SYSTEM]: Change working directory to \.
    * dirmngr/dirmngr.c [HAVE_W32_SYSTEM]: Include <direct.h>.
    (main) [HAVE_W32_SYSTEM]: Change working directory to \.
    * scd/scdaemon.c [HAVE_W32_SYSTEM]: Include <direct.h>.
    (main) [HAVE_W32_SYSTEM]: Change working directory to \.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2670

diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
index efaebfd..90e8a26 100644
--- a/agent/gpg-agent.c
+++ b/agent/gpg-agent.c
@@ -39,6 +39,7 @@
 # endif
 # include <aclapi.h>
 # include <sddl.h>
+# include <direct.h>
 #else /*!HAVE_W32_SYSTEM*/
 # include <sys/socket.h>
 # include <sys/un.h>
@@ -1558,6 +1559,11 @@ main (int argc, char **argv )
       (void)csh_style;
       (void)nodetach;
       initialize_modules ();
+      if (_chdir("\\"))
+        {
+          log_error ("chdir to / failed: %s\n", strerror (errno));
+          exit (1);
+        }
 
 #else /*!HAVE_W32_SYSTEM*/
 
diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 6eabca9..b19b418 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -30,9 +30,11 @@
 #include <assert.h>
 #include <time.h>
 #include <fcntl.h>
-#ifndef HAVE_W32_SYSTEM
-#include <sys/socket.h>
-#include <sys/un.h>
+#ifdef HAVE_W32_SYSTEM
+# include <direct.h>
+#else
+# include <sys/socket.h>
+# include <sys/un.h>
 #endif
 #include <sys/stat.h>
 #include <unistd.h>
@@ -1268,6 +1270,11 @@ main (int argc, char **argv)
 #ifdef HAVE_W32_SYSTEM
       (void)csh_style;
       (void)nodetach;
+      if (_chdir("\\"))
+        {
+          log_error ("chdir to / failed: %s\n", strerror (errno));
+          exit (1);
+        }
 
       pid = getpid ();
       es_printf ("set %s=%s;%lu;1\n",
diff --git a/scd/scdaemon.c b/scd/scdaemon.c
index 26e89dd..bbb0433 100644
--- a/scd/scdaemon.c
+++ b/scd/scdaemon.c
@@ -29,9 +29,11 @@
 #include <assert.h>
 #include <time.h>
 #include <fcntl.h>
-#ifndef HAVE_W32_SYSTEM
-#include <sys/socket.h>
-#include <sys/un.h>
+#ifdef HAVE_W32_SYSTEM
+# include <direct.h>
+#else
+# include <sys/socket.h>
+# include <sys/un.h>
 #endif /*HAVE_W32_SYSTEM*/
 #include <unistd.h>
 #include <signal.h>
@@ -811,6 +813,11 @@ main (int argc, char **argv )
 #ifdef HAVE_W32_SYSTEM
       (void)csh_style;
       (void)nodetach;
+      if (_chdir("\\"))
+        {
+          log_error ("chdir to / failed: %s\n", strerror (errno));
+          exit (1);
+        }
 #else
       pid = fork ();
       if (pid == (pid_t)-1)

-----------------------------------------------------------------------

Summary of changes:
 agent/gpg-agent.c |  6 ++++++
 dirmngr/dirmngr.c | 13 ++++++++++---
 scd/scdaemon.c    | 13 ++++++++++---
 3 files changed, 26 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 17:18:52 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Mon, 24 Jul 2017 17:18:52 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-141-g872137b
Message-ID: <E1dZf8H-0008Es-FM@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  872137b5921dd297e7d2c1def6e3868b7595feb5 (commit)
      from  78ebc62604d77600b9865950610717d28c6027a2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 872137b5921dd297e7d2c1def6e3868b7595feb5
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Mon Jul 24 17:18:42 2017 +0200

    g10: Make sure to emit NEED_PASSPHRASE on --import of secret key.
    
    * call-agent.h (agent_import_key): Add keyid parameters.
    * call-agent.c (agent_import_key): Set keyid parameters.
    * import.c (transfer_secret_keys): Pass keyid parameters.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2667

diff --git a/g10/call-agent.c b/g10/call-agent.c
index b17c2e6..1ce6641 100644
--- a/g10/call-agent.c
+++ b/g10/call-agent.c
@@ -2096,7 +2096,8 @@ inq_import_key_parms (void *opaque, const char *line)
 /* Call the agent to import a key into the agent.  */
 gpg_error_t
 agent_import_key (ctrl_t ctrl, const char *desc, char **cache_nonce_addr,
-                  const void *key, size_t keylen, int unattended, int force)
+                  const void *key, size_t keylen, int unattended, int force,
+		  u32 *keyid, u32 *mainkeyid, int pubkey_algo)
 {
   gpg_error_t err;
   struct import_key_parm_s parm;
@@ -2106,6 +2107,9 @@ agent_import_key (ctrl_t ctrl, const char *desc, char **cache_nonce_addr,
 
   memset (&dfltparm, 0, sizeof dfltparm);
   dfltparm.ctrl = ctrl;
+  dfltparm.keyinfo.keyid       = keyid;
+  dfltparm.keyinfo.mainkeyid   = mainkeyid;
+  dfltparm.keyinfo.pubkey_algo = pubkey_algo;
 
   err = start_agent (ctrl, 0);
   if (err)
diff --git a/g10/call-agent.h b/g10/call-agent.h
index dcabbe8..f45b64d 100644
--- a/g10/call-agent.h
+++ b/g10/call-agent.h
@@ -186,7 +186,8 @@ gpg_error_t agent_keywrap_key (ctrl_t ctrl, int forexport,
 /* Send a key to the agent.  */
 gpg_error_t agent_import_key (ctrl_t ctrl, const char *desc,
                               char **cache_nonce_addr, const void *key,
-                              size_t keylen, int unattended, int force);
+                              size_t keylen, int unattended, int force,
+			      u32 *keyid, u32 *mainkeyid, int pubkey_algo);
 
 /* Receive a key from the agent.  */
 gpg_error_t agent_export_key (ctrl_t ctrl, const char *keygrip,
diff --git a/g10/import.c b/g10/import.c
index 02440ff..c87f49b 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -2109,7 +2109,8 @@ transfer_secret_keys (ctrl_t ctrl, struct import_stats_s *stats,
       {
         char *desc = gpg_format_keydesc (ctrl, pk, FORMAT_KEYDESC_IMPORT, 1);
         err = agent_import_key (ctrl, desc, &cache_nonce,
-                                wrappedkey, wrappedkeylen, batch, force);
+                                wrappedkey, wrappedkeylen, batch, force,
+				pk->keyid, pk->main_keyid, pk->pubkey_algo);
         xfree (desc);
       }
       if (!err)

-----------------------------------------------------------------------

Summary of changes:
 g10/call-agent.c | 6 +++++-
 g10/call-agent.h | 3 ++-
 g10/import.c     | 3 ++-
 3 files changed, 9 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 20:24:58 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 24 Jul 2017 20:24:58 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-145-ge7068bf
Message-ID: <E1dZi2N-0002Fl-VG@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  e7068bf92ec5ca5d440346d43a382c1f625b924d (commit)
       via  f6f0dd4d5ea85e0b16e96d7678b1d508182049a8 (commit)
       via  e97548223948222a5c22acdf3775c7f93c1e17a9 (commit)
       via  9b88cfa0962f28894658cff8777fe7a217c6f700 (commit)
      from  872137b5921dd297e7d2c1def6e3868b7595feb5 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit e7068bf92ec5ca5d440346d43a382c1f625b924d
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 24 20:05:28 2017 +0200

    gpg: Store key origin info for new DANE and WKD retrieved keys.
    
    * g10/import.c (apply_meta_data): Remove arg 'merge'.  Add arg 'url'.
    Implement WKD and DANE key origin.
    (import_keys_internal): Add arg 'url' and change all callers.
    (import_keys_es_stream): Ditto.
    (import): Ditto.
    (import_one): Ditto.
    * g10/keylist.c (list_keyblock_print): Fix update URL printing.
    * g10/call-dirmngr.c (gpg_dirmngr_wkd_get): Add arg 'r_url' to return
    the SOURCE.  Pass ks_status_cb to assuan_transact.
    * g10/keyserver.c (keyserver_import_wkd): Get that URL and pass it to
    the import function.
    --
    
    Note that this only for new keys.  Merging this info will be added
    soon.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/call-dirmngr.c b/g10/call-dirmngr.c
index 76fa072..9bae59f 100644
--- a/g10/call-dirmngr.c
+++ b/g10/call-dirmngr.c
@@ -41,7 +41,8 @@
 #include "call-dirmngr.h"
 
 
-/* Parameter structure used to gather status info.  */
+/* Parameter structure used to gather status info.  Note that it is
+ * also used for WKD requests.  */
 struct ks_status_parm_s
 {
   const char *keyword; /* Look for this keyword or NULL for "SOURCE". */
@@ -368,7 +369,7 @@ clear_context_flags (ctrl_t ctrl, assuan_context_t ctx)
 
 
 

-/* Status callback for ks_list, ks_get and ks_search.  */
+/* Status callback for ks_list, ks_get, ks_search, and wkd_get  */
 static gpg_error_t
 ks_status_cb (void *opaque, const char *line)
 {
@@ -1317,17 +1318,24 @@ gpg_dirmngr_get_pka (ctrl_t ctrl, const char *userid,
 

 /* Ask the dirmngr to retrieve a key via the Web Key Directory
  * protocol.  If QUICK is set the dirmngr is advised to use a shorter
- * timeout.  On success a new estream with the key is stored at R_KEY.
+ * timeout.  On success a new estream with the key stored at R_KEY and the
+ * url of the lookup (if any) stored at R_URL.  Note that
  */
 gpg_error_t
-gpg_dirmngr_wkd_get (ctrl_t ctrl, const char *name, int quick, estream_t *r_key)
+gpg_dirmngr_wkd_get (ctrl_t ctrl, const char *name, int quick,
+                     estream_t *r_key, char **r_url)
 {
   gpg_error_t err;
   assuan_context_t ctx;
-  struct dns_cert_parm_s parm;
+  struct ks_status_parm_s stparm = { NULL };
+  struct dns_cert_parm_s parm = { NULL };
   char *line = NULL;
 
-  memset (&parm, 0, sizeof parm);
+  if (r_key)
+    *r_key = NULL;
+
+  if (r_url)
+    *r_url = NULL;
 
   err = open_context (ctrl, &ctx);
   if (err)
@@ -1352,7 +1360,7 @@ gpg_dirmngr_wkd_get (ctrl_t ctrl, const char *name, int quick, estream_t *r_key)
       goto leave;
     }
   err = assuan_transact (ctx, line, dns_cert_data_cb, &parm,
-                         NULL, NULL, NULL, &parm);
+                         NULL, NULL, ks_status_cb, &stparm);
   if (err)
     goto leave;
 
@@ -1363,7 +1371,14 @@ gpg_dirmngr_wkd_get (ctrl_t ctrl, const char *name, int quick, estream_t *r_key)
       parm.memfp = NULL;
     }
 
+  if (r_url)
+    {
+      *r_url = stparm.source;
+      stparm.source = NULL;
+    }
+
  leave:
+  xfree (stparm.source);
   xfree (parm.fpr);
   xfree (parm.url);
   es_fclose (parm.memfp);
diff --git a/g10/call-dirmngr.h b/g10/call-dirmngr.h
index 95a8c4a..285c4cb 100644
--- a/g10/call-dirmngr.h
+++ b/g10/call-dirmngr.h
@@ -41,7 +41,7 @@ gpg_error_t gpg_dirmngr_get_pka (ctrl_t ctrl, const char *userid,
                                  unsigned char **r_fpr, size_t *r_fprlen,
                                  char **r_url);
 gpg_error_t gpg_dirmngr_wkd_get (ctrl_t ctrl, const char *name, int quick,
-                                 estream_t *r_key);
+                                 estream_t *r_key, char **r_url);
 
 
 #endif /*GNUPG_G10_CALL_DIRMNGR_H*/
diff --git a/g10/gpg.c b/g10/gpg.c
index e32e14a..7495e17 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -4515,7 +4515,7 @@ main (int argc, char **argv)
         opt.import_options |= IMPORT_FAST; /* fall through */
       case aImport:
 	import_keys (ctrl, argc? argv:NULL, argc, NULL,
-                     opt.import_options, opt.key_origin);
+                     opt.import_options, opt.key_origin, NULL);
 	break;
 
 	/* TODO: There are a number of command that use this same
diff --git a/g10/import.c b/g10/import.c
index c87f49b..e3c8c37 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -97,7 +97,8 @@ struct import_filter_s import_filter;
 static int import (ctrl_t ctrl,
                    IOBUF inp, const char* fname, struct import_stats_s *stats,
 		   unsigned char **fpr, size_t *fpr_len, unsigned int options,
-		   import_screener_t screener, void *screener_arg, int origin);
+		   import_screener_t screener, void *screener_arg,
+                   int origin, const char *url);
 static int read_block (IOBUF a, int with_meta,
                        PACKET **pending_pkt, kbnode_t *ret_root, int *r_v3keys);
 static void revocation_present (ctrl_t ctrl, kbnode_t keyblock);
@@ -107,7 +108,7 @@ static int import_one (ctrl_t ctrl,
                        unsigned char **fpr, size_t *fpr_len,
                        unsigned int options, int from_sk, int silent,
                        import_screener_t screener, void *screener_arg,
-                       int origin);
+                       int origin, const char *url);
 static int import_secret_one (ctrl_t ctrl, kbnode_t keyblock,
                               struct import_stats_s *stats, int batch,
                               unsigned int options, int for_migration,
@@ -432,7 +433,7 @@ import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames,
                       unsigned char **fpr, size_t *fpr_len,
 		      unsigned int options,
                       import_screener_t screener, void *screener_arg,
-                      int origin)
+                      int origin, const char *url)
 {
   int i;
   int rc = 0;
@@ -444,7 +445,7 @@ import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames,
   if (inp)
     {
       rc = import (ctrl, inp, "[stream]", stats, fpr, fpr_len, options,
-                   screener, screener_arg, origin);
+                   screener, screener_arg, origin, url);
     }
   else
     {
@@ -469,7 +470,7 @@ import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames,
           else
             {
               rc = import (ctrl, inp2, fname, stats, fpr, fpr_len, options,
-                           screener, screener_arg, origin);
+                           screener, screener_arg, origin, url);
               iobuf_close (inp2);
               /* Must invalidate that ugly cache to actually close it. */
               iobuf_ioctl (NULL, IOBUF_IOCTL_INVALIDATE_CACHE, 0, (char*)fname);
@@ -503,10 +504,11 @@ import_keys_internal (ctrl_t ctrl, iobuf_t inp, char **fnames, int nnames,
 
 void
 import_keys (ctrl_t ctrl, char **fnames, int nnames,
-	     import_stats_t stats_handle, unsigned int options, int origin)
+	     import_stats_t stats_handle, unsigned int options,
+             int origin, const char *url)
 {
   import_keys_internal (ctrl, NULL, fnames, nnames, stats_handle,
-                        NULL, NULL, options, NULL, NULL, origin);
+                        NULL, NULL, options, NULL, NULL, origin, url);
 }
 
 
@@ -516,7 +518,7 @@ import_keys_es_stream (ctrl_t ctrl, estream_t fp,
                        unsigned char **fpr, size_t *fpr_len,
                        unsigned int options,
                        import_screener_t screener, void *screener_arg,
-                       int origin)
+                       int origin, const char *url)
 {
   int rc;
   iobuf_t inp;
@@ -531,7 +533,7 @@ import_keys_es_stream (ctrl_t ctrl, estream_t fp,
 
   rc = import_keys_internal (ctrl, inp, NULL, 0, stats_handle,
                              fpr, fpr_len, options,
-                             screener, screener_arg, origin);
+                             screener, screener_arg, origin, url);
 
   iobuf_close (inp);
   return rc;
@@ -541,7 +543,8 @@ import_keys_es_stream (ctrl_t ctrl, estream_t fp,
 static int
 import (ctrl_t ctrl, IOBUF inp, const char* fname,struct import_stats_s *stats,
 	unsigned char **fpr,size_t *fpr_len, unsigned int options,
-	import_screener_t screener, void *screener_arg, int origin)
+	import_screener_t screener, void *screener_arg,
+        int origin, const char *url)
 {
   PACKET *pending_pkt = NULL;
   kbnode_t keyblock = NULL;  /* Need to initialize because gcc can't
@@ -569,7 +572,7 @@ import (ctrl_t ctrl, IOBUF inp, const char* fname,struct import_stats_s *stats,
       if (keyblock->pkt->pkttype == PKT_PUBLIC_KEY)
         rc = import_one (ctrl, keyblock,
                          stats, fpr, fpr_len, options, 0, 0,
-                         screener, screener_arg, origin);
+                         screener, screener_arg, origin, url);
       else if (keyblock->pkt->pkttype == PKT_SECRET_KEY)
         rc = import_secret_one (ctrl, keyblock, stats,
                                 opt.batch, options, 0,
@@ -1379,11 +1382,53 @@ apply_drop_sig_filter (ctrl_t ctrl, kbnode_t keyblock, recsel_expr_t selector)
 
 
 /* Apply meta data to KEYBLOCK.  This sets the origin of the key to
- * ORIGIN.  If MERGE is true KEYBLOCK has been updated and the meta
- * data is merged and not simply inserted.  */
+ * ORIGIN and the updateurl to URL.  Note that this function is only
+ * used for a new key, that is not when we are merging keys.  */
 static gpg_error_t
-apply_meta_data (kbnode_t keyblock, int merge, int origin)
+apply_meta_data (kbnode_t keyblock, int origin, const char *url)
 {
+  kbnode_t node;
+  u32 curtime = make_timestamp ();
+
+  for (node = keyblock; node; node = node->next)
+    {
+      if (is_deleted_kbnode (node))
+        ;
+      else if (node->pkt->pkttype == PKT_PUBLIC_KEY
+               && (origin == KEYORG_WKD || origin == KEYORG_DANE))
+        {
+          /* For WKD and DANE we insert origin information also for
+           * the key but we don't record the URL because we have have
+           * no use for that: An update using a keyserver has higher
+           * precedence and will thus update this origin info.  For
+           * refresh using WKD or DANE we need to go via the User ID
+           * anyway.  Recall that we are only inserting a new key. */
+          PKT_public_key *pk = node->pkt->pkt.public_key;
+
+          pk->keyorg = origin;
+          pk->keyupdate = curtime;
+        }
+      else if (node->pkt->pkttype == PKT_USER_ID
+               && (origin == KEYORG_WKD || origin == KEYORG_DANE))
+        {
+          /* We insert origin information on a UID only when we
+           * received them via the Web Key Directory or a DANE record.
+           * The key we receive here from the WKD has been filtered to
+           * contain only the user ID as looked up in the WKD.  For a
+           * DANE origin we this should also be the case.  Thus we
+           * will see here only one user id.  */
+          PKT_user_id *uid = node->pkt->pkt.user_id;
+
+          uid->keyorg = origin;
+          uid->keyupdate = curtime;
+          if (url)
+            {
+              uid->updateurl = xtrystrdup (url);
+              if (!uid->updateurl)
+                return gpg_error_from_syserror ();
+            }
+        }
+    }
 
   return 0;
 }
@@ -1395,7 +1440,7 @@ apply_meta_data (kbnode_t keyblock, int merge, int origin)
  * the internal errorcount, so that invalid input can be detected by
  * programs which called gpg.  If SILENT is no messages are printed -
  * even most error messages are suppressed.  ORIGIN is the origin of
- * the key (0 for unknown).
+ * the key (0 for unknown) and URL the corresponding URL.
  */
 static int
 import_one (ctrl_t ctrl,
@@ -1403,7 +1448,7 @@ import_one (ctrl_t ctrl,
 	    unsigned char **fpr, size_t *fpr_len, unsigned int options,
 	    int from_sk, int silent,
             import_screener_t screener, void *screener_arg,
-            int origin)
+            int origin, const char *url)
 {
   PKT_public_key *pk;
   PKT_public_key *pk_orig = NULL;
@@ -1627,7 +1672,7 @@ import_one (ctrl_t ctrl,
        * and thus the address of KEYBLOCK won't change.  */
       if ( !(options & IMPORT_RESTORE) )
         {
-          rc = apply_meta_data (keyblock, 0, origin);
+          rc = apply_meta_data (keyblock, origin, url);
           if (rc)
             {
               log_error ("apply_meta_data failed: %s\n", gpg_strerror (rc));
@@ -2313,7 +2358,7 @@ import_secret_one (ctrl_t ctrl, kbnode_t keyblock,
 	 the secret keys.  FIXME?  */
       import_one (ctrl, pub_keyblock, stats,
 		  NULL, NULL, options, 1, for_migration,
-                  screener, screener_arg, 0);
+                  screener, screener_arg, 0, NULL);
 
       /* Fixme: We should check for an invalid keyblock and
 	 cancel the secret key import in this case.  */
diff --git a/g10/keylist.c b/g10/keylist.c
index 37a26dc..7203d16 100644
--- a/g10/keylist.c
+++ b/g10/keylist.c
@@ -1012,9 +1012,9 @@ list_keyblock_print (ctrl_t ctrl, kbnode_t keyblock, int secret, int fpr,
                           key_origin_string (uid->keyorg),
                           mk_datestr (updatestr, sizeof updatestr,
                                       uid->keyupdate),
-                          pk->updateurl? "url=":"");
-              if (pk->updateurl)
-                print_utf8_string (es_stdout, pk->updateurl);
+                          uid->updateurl? "url=":"");
+              if (uid->updateurl)
+                print_utf8_string (es_stdout, uid->updateurl);
               es_putc ('\n', es_stdout);
             }
 
diff --git a/g10/keyserver.c b/g10/keyserver.c
index a84961e..9586448 100644
--- a/g10/keyserver.c
+++ b/g10/keyserver.c
@@ -1747,7 +1747,7 @@ keyserver_get_chunk (ctrl_t ctrl, KEYDB_SEARCH_DESC *desc, int ndesc,
                              (opt.keyserver_options.import_options
                               | IMPORT_NO_SECKEY),
                              keyserver_retrieval_screener, &screenerarg,
-                             0 /* FIXME? */);
+                             0 /* FIXME? */, NULL);
     }
   es_fclose (datastream);
   xfree (source);
@@ -1878,7 +1878,7 @@ keyserver_fetch (ctrl_t ctrl, strlist_t urilist, int origin)
           stats_handle = import_new_stats_handle();
           import_keys_es_stream (ctrl, datastream, stats_handle, NULL, NULL,
                                  opt.keyserver_options.import_options,
-                                 NULL, NULL, origin);
+                                 NULL, NULL, origin, NULL);
 
           import_print_stats (stats_handle);
           import_release_stats_handle (stats_handle);
@@ -1945,7 +1945,7 @@ keyserver_import_cert (ctrl_t ctrl, const char *name, int dane_mode,
               if (!err)
                 err = import_keys_es_stream (ctrl, key, NULL, fpr, fpr_len,
                                              IMPORT_NO_SECKEY,
-                                             NULL, NULL, KEYORG_DANE);
+                                             NULL, NULL, KEYORG_DANE, NULL);
               restore_import_filter (save_filt);
             }
         }
@@ -1954,7 +1954,7 @@ keyserver_import_cert (ctrl_t ctrl, const char *name, int dane_mode,
           err = import_keys_es_stream (ctrl, key, NULL, fpr, fpr_len,
                                        (opt.keyserver_options.import_options
                                         | IMPORT_NO_SECKEY),
-                                       NULL, NULL, 0);
+                                       NULL, NULL, 0, NULL);
         }
 
       opt.no_armor=armor_status;
@@ -2043,6 +2043,7 @@ keyserver_import_wkd (ctrl_t ctrl, const char *name, int quick,
   gpg_error_t err;
   char *mbox;
   estream_t key;
+  char *url = NULL;
 
   /* We want to work on the mbox.  That is what dirmngr will do anyway
    * and we need the mbox for the import filter anyway.  */
@@ -2055,7 +2056,7 @@ keyserver_import_wkd (ctrl_t ctrl, const char *name, int quick,
       return err;
     }
 
-  err = gpg_dirmngr_wkd_get (ctrl, mbox, quick, &key);
+  err = gpg_dirmngr_wkd_get (ctrl, mbox, quick, &key, &url);
   if (err)
     ;
   else if (key)
@@ -2078,7 +2079,7 @@ keyserver_import_wkd (ctrl_t ctrl, const char *name, int quick,
           if (!err)
             err = import_keys_es_stream (ctrl, key, NULL, fpr, fpr_len,
                                          IMPORT_NO_SECKEY,
-                                         NULL, NULL, KEYORG_WKD);
+                                         NULL, NULL, KEYORG_WKD, url);
 
         }
 
@@ -2089,6 +2090,7 @@ keyserver_import_wkd (ctrl_t ctrl, const char *name, int quick,
       key = NULL;
     }
 
+  xfree (url);
   xfree (mbox);
   return err;
 }
diff --git a/g10/main.h b/g10/main.h
index e69ed9d..87417ee 100644
--- a/g10/main.h
+++ b/g10/main.h
@@ -352,13 +352,14 @@ void            restore_import_filter (import_filter_t filt);
 gpg_error_t read_key_from_file (ctrl_t ctrl, const char *fname,
                                 kbnode_t *r_keyblock);
 void import_keys (ctrl_t ctrl, char **fnames, int nnames,
-		  import_stats_t stats_hd, unsigned int options, int origin);
+		  import_stats_t stats_hd, unsigned int options,
+                  int origin, const char *url);
 int import_keys_es_stream (ctrl_t ctrl, estream_t fp,
                            import_stats_t stats_handle,
                            unsigned char **fpr, size_t *fpr_len,
                            unsigned int options,
                            import_screener_t screener, void *screener_arg,
-                           int origin);
+                           int origin, const char *url);
 gpg_error_t import_old_secring (ctrl_t ctrl, const char *fname);
 import_stats_t import_new_stats_handle (void);
 void import_release_stats_handle (import_stats_t hd);

commit f6f0dd4d5ea85e0b16e96d7678b1d508182049a8
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 24 19:35:45 2017 +0200

    gpg: Filter keys received via DANE
    
    * g10/keyserver.c (keyserver_import_cert): Use an import filter in
    DANE mode.
    --
    
    We only want to see the user ids requested via DANE and not any
    additional ids.  This filter enables this in the same way we do this
    in WKD.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/keyserver.c b/g10/keyserver.c
index bec30e3..a84961e 100644
--- a/g10/keyserver.c
+++ b/g10/keyserver.c
@@ -1926,14 +1926,36 @@ keyserver_import_cert (ctrl_t ctrl, const char *name, int dane_mode,
   else if (key)
     {
       int armor_status=opt.no_armor;
+      import_filter_t save_filt;
 
       /* CERTs and DANE records are always in binary format */
       opt.no_armor=1;
-
-      err = import_keys_es_stream (ctrl, key, NULL, fpr, fpr_len,
-                                   (opt.keyserver_options.import_options
-                                    | IMPORT_NO_SECKEY),
-                                   NULL, NULL, KEYORG_DANE);
+      if (dane_mode)
+        {
+          save_filt = save_and_clear_import_filter ();
+          if (!save_filt)
+            err = gpg_error_from_syserror ();
+          else
+            {
+              char *filtstr = es_bsprintf ("keep-uid=mbox = %s", look);
+              err = filtstr? 0 : gpg_error_from_syserror ();
+              if (!err)
+                err = parse_and_set_import_filter (filtstr);
+              xfree (filtstr);
+              if (!err)
+                err = import_keys_es_stream (ctrl, key, NULL, fpr, fpr_len,
+                                             IMPORT_NO_SECKEY,
+                                             NULL, NULL, KEYORG_DANE);
+              restore_import_filter (save_filt);
+            }
+        }
+      else
+        {
+          err = import_keys_es_stream (ctrl, key, NULL, fpr, fpr_len,
+                                       (opt.keyserver_options.import_options
+                                        | IMPORT_NO_SECKEY),
+                                       NULL, NULL, 0);
+        }
 
       opt.no_armor=armor_status;
 

commit e97548223948222a5c22acdf3775c7f93c1e17a9
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 24 18:21:11 2017 +0200

    dirmngr: Print a SOURCE status for WKD requests.
    
    * dirmngr/server.c (cmd_wkd_get): Print a SOURCE status.
    --
    
    This status allows to see whether the the WKD requests has been
    resolved from the standard address or from a SRV record derived one.
    We return only host and port and not the .well-known suffix because
    that is obvious.  HTTP redirects are not taken in account because they
    may chnage at any time due to load balancing etc and not relevant for
    gpg which may use the URL to detect changes in the WKD results.
    
    For example my current setup returns
    
        S SOURCE https://wkd.gnupg.org
    
    for wk at gnupg.org.  Without a SRV record
    
        S SOURCE https://gnupg.org
    
    would have been returned.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/server.c b/dirmngr/server.c
index 9039534..4f5a3b2 100644
--- a/dirmngr/server.c
+++ b/dirmngr/server.c
@@ -896,7 +896,6 @@ cmd_wkd_get (assuan_context_t ctx, char *line)
             }
         }
       xfree (srvs);
-      log_debug ("srv: got '%s%s'\n", domain, portstr);
     }
 
   gcry_md_hash_buffer (GCRY_MD_SHA1, sha1buf, mbox, strlen (mbox));
@@ -932,6 +931,13 @@ cmd_wkd_get (assuan_context_t ctx, char *line)
                        encodedhash,
                        NULL);
       no_log = 1;
+      if (uri)
+        {
+          err = dirmngr_status_printf (ctrl, "SOURCE", "https://%s%s",
+                                       domain, portstr);
+          if (err)
+            goto leave;
+        }
     }
   if (!uri)
     {

commit 9b88cfa0962f28894658cff8777fe7a217c6f700
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 24 18:14:37 2017 +0200

    dirmngr: New function dirmngr_status_printf.
    
    * dirmngr/server.c (dirmngr_status_printf): New.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dirmngr.h b/dirmngr/dirmngr.h
index 0f5dde2..1f660de 100644
--- a/dirmngr/dirmngr.h
+++ b/dirmngr/dirmngr.h
@@ -229,6 +229,9 @@ int dirmngr_assuan_log_monitor (assuan_context_t ctx, unsigned int cat,
 void start_command_handler (gnupg_fd_t fd);
 gpg_error_t dirmngr_status (ctrl_t ctrl, const char *keyword, ...);
 gpg_error_t dirmngr_status_help (ctrl_t ctrl, const char *text);
+gpg_error_t dirmngr_status_printf (ctrl_t ctrl, const char *keyword,
+                                   const char *format,
+                                   ...) GPGRT_ATTR_PRINTF(3,4);
 gpg_error_t dirmngr_tick (ctrl_t ctrl);
 
 /*-- http-ntbtls.c --*/
diff --git a/dirmngr/server.c b/dirmngr/server.c
index 788bebd..9039534 100644
--- a/dirmngr/server.c
+++ b/dirmngr/server.c
@@ -2776,6 +2776,24 @@ dirmngr_status_help (ctrl_t ctrl, const char *text)
   return err;
 }
 
+
+/* This function is similar to print_assuan_status but takes a CTRL
+ * arg instead of an assuan context as first argument.  */
+gpg_error_t
+dirmngr_status_printf (ctrl_t ctrl, const char *keyword,
+                       const char *format, ...)
+{
+  gpg_error_t err;
+  va_list arg_ptr;
+  assuan_context_t ctx = ctrl->server_local->assuan_ctx;
+
+  va_start (arg_ptr, format);
+  err = vprint_assuan_status (ctx, keyword, format, arg_ptr);
+  va_end (arg_ptr);
+  return err;
+}
+
+
 /* Send a tick progress indicator back.  Fixme: This is only done for
    the currently active channel.  */
 gpg_error_t

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dirmngr.h  |  3 ++
 dirmngr/server.c   | 26 +++++++++++++++++-
 g10/call-dirmngr.c | 29 ++++++++++++++-----
 g10/call-dirmngr.h |  2 +-
 g10/gpg.c          |  2 +-
 g10/import.c       | 81 ++++++++++++++++++++++++++++++++++++++++++------------
 g10/keylist.c      |  6 ++--
 g10/keyserver.c    | 42 ++++++++++++++++++++++------
 g10/main.h         |  5 ++--
 9 files changed, 154 insertions(+), 42 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 21:16:02 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 24 Jul 2017 21:16:02 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-147-g87b5421
Message-ID: <E1dZipn-0001rj-Pw@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  87b5421ca84bbea68217c9ed771ee8c0a98a4d0c (commit)
       via  2ca0381d077d766593db26f4215b8eddee8d7963 (commit)
      from  e7068bf92ec5ca5d440346d43a382c1f625b924d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 87b5421ca84bbea68217c9ed771ee8c0a98a4d0c
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 24 21:07:03 2017 +0200

    gpg: Extend --key-origin to take an optional URL arg.
    
    * g10/getkey.c (parse_key_origin): Parse appended URL.
    * g10/options.h (struct opt): Add field 'key_origin_url'.
    * g10/gpg.c (main) <aImport>: Pass that option to import_keys.
    * g10/import.c (apply_meta_data): Extend for file and url.
    * g10/keyserver.c (keyserver_fetch): Pass the url to
    import_keys_es_stream.
    --
    
    Example:
    
      gpg --key-origin url,myscheme://bla --import FILE
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index 9147bdf..dddb930 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -2260,12 +2260,14 @@ hint to optimize its buffer allocation strategy.  It is also used by
 the @option{--status-fd} line ``PROGRESS'' to provide a value for
 ``total'' if that is not available by other means.
 
- at item --key-origin @var{string}
+ at item --key-origin @var{string}[, at var{url}]
 @opindex key-origin
 gpg can track the origin of a key. Certain origins are implicitly
 known (e.g. keyserver, web key directory) and set.  For a standard
-import the origin of the keys imported can be set with this optionb.
-To list the possible values use "help" for @var{string}.
+import the origin of the keys imported can be set with this option.
+To list the possible values use "help" for @var{string}.  Some origins
+can store an optional @var{url} argument.  That URL can appended to
+ at var{string} after a comma.
 
 @item --import-options @code{parameters}
 @opindex import-options
diff --git a/g10/getkey.c b/g10/getkey.c
index 74eed13..390e2dc 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -4325,6 +4325,11 @@ int
 parse_key_origin (char *string)
 {
   int i;
+  char *comma;
+
+  comma = strchr (string, ',');
+  if (comma)
+    *comma = 0;
 
   if (!ascii_strcasecmp (string, "help"))
     {
@@ -4338,9 +4343,19 @@ parse_key_origin (char *string)
     if (!ascii_strcasecmp (string, key_origin_list[i].name))
       {
         opt.key_origin = key_origin_list[i].origin;
+        xfree (opt.key_origin_url);
+        opt.key_origin_url = NULL;
+        if (comma && comma[1])
+          {
+            opt.key_origin_url = xstrdup (comma+1);
+            trim_spaces (opt.key_origin_url);
+          }
+
         return 1;
       }
 
+  if (comma)
+    *comma = ',';
   return 0;
 }
 
diff --git a/g10/gpg.c b/g10/gpg.c
index 7495e17..52b6089 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -4515,7 +4515,7 @@ main (int argc, char **argv)
         opt.import_options |= IMPORT_FAST; /* fall through */
       case aImport:
 	import_keys (ctrl, argc? argv:NULL, argc, NULL,
-                     opt.import_options, opt.key_origin, NULL);
+                     opt.import_options, opt.key_origin, opt.key_origin_url);
 	break;
 
 	/* TODO: There are a number of command that use this same
diff --git a/g10/import.c b/g10/import.c
index d22c8f4..f18ef48 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -1425,6 +1425,22 @@ apply_meta_data (kbnode_t keyblock, int origin, const char *url)
               if (!pk->updateurl)
                 return gpg_error_from_syserror ();
             }
+          else if (origin == KEYORG_FILE)
+            {
+              pk->keyorg = origin;
+              pk->keyupdate = curtime;
+            }
+          else if (origin == KEYORG_URL)
+            {
+              pk->keyorg = origin;
+              pk->keyupdate = curtime;
+              if (url)
+                {
+                  pk->updateurl = xtrystrdup (url);
+                  if (!pk->updateurl)
+                    return gpg_error_from_syserror ();
+                }
+            }
         }
       else if (node->pkt->pkttype == PKT_USER_ID)
         {
@@ -1458,6 +1474,16 @@ apply_meta_data (kbnode_t keyblock, int origin, const char *url)
               uid->keyorg = origin;
               uid->keyupdate = curtime;
             }
+          else if (origin == KEYORG_FILE)
+            {
+              uid->keyorg = origin;
+              uid->keyupdate = curtime;
+            }
+          else if (origin == KEYORG_URL)
+            {
+              uid->keyorg = origin;
+              uid->keyupdate = curtime;
+            }
         }
     }
 
diff --git a/g10/keyserver.c b/g10/keyserver.c
index 4d2a2c8..a8c222d 100644
--- a/g10/keyserver.c
+++ b/g10/keyserver.c
@@ -1884,7 +1884,7 @@ keyserver_fetch (ctrl_t ctrl, strlist_t urilist, int origin)
           stats_handle = import_new_stats_handle();
           import_keys_es_stream (ctrl, datastream, stats_handle, NULL, NULL,
                                  opt.keyserver_options.import_options,
-                                 NULL, NULL, origin, NULL);
+                                 NULL, NULL, origin, sl->d);
 
           import_print_stats (stats_handle);
           import_release_stats_handle (stats_handle);
diff --git a/g10/options.h b/g10/options.h
index 21249e9..83f4028 100644
--- a/g10/options.h
+++ b/g10/options.h
@@ -266,6 +266,7 @@ struct
 
   /* The value of --key-origin.  See parse_key_origin().  */
   int key_origin;
+  char *key_origin_url;
 
   int passphrase_repeat;
   int pinentry_mode;

commit 2ca0381d077d766593db26f4215b8eddee8d7963
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 24 20:47:41 2017 +0200

    gpg: Store key origin info for new keys from a keyserver
    
    * g10/keyserver.c (keyserver_get_chunk): Use KEYORG_KS if request was
    done by fingerprint.
    * g10/import.c (apply_meta_data): Implement that.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/import.c b/g10/import.c
index e3c8c37..d22c8f4 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -1394,38 +1394,69 @@ apply_meta_data (kbnode_t keyblock, int origin, const char *url)
     {
       if (is_deleted_kbnode (node))
         ;
-      else if (node->pkt->pkttype == PKT_PUBLIC_KEY
-               && (origin == KEYORG_WKD || origin == KEYORG_DANE))
-        {
-          /* For WKD and DANE we insert origin information also for
-           * the key but we don't record the URL because we have have
-           * no use for that: An update using a keyserver has higher
-           * precedence and will thus update this origin info.  For
-           * refresh using WKD or DANE we need to go via the User ID
-           * anyway.  Recall that we are only inserting a new key. */
+      else if (node->pkt->pkttype == PKT_PUBLIC_KEY)
+        {
           PKT_public_key *pk = node->pkt->pkt.public_key;
 
-          pk->keyorg = origin;
-          pk->keyupdate = curtime;
+          if (origin == KEYORG_WKD || origin == KEYORG_DANE)
+            {
+              /* For WKD and DANE we insert origin information also
+               * for the key but we don't record the URL because we
+               * have have no use for that: An update using a
+               * keyserver has higher precedence and will thus update
+               * this origin info.  For refresh using WKD or DANE we
+               * need to go via the User ID anyway.  Recall that we
+               * are only inserting a new key. */
+              pk->keyorg = origin;
+              pk->keyupdate = curtime;
+            }
+          else if (origin == KEYORG_KS && url)
+            {
+              /* If the key was retrieved from a keyserver using a
+               * fingerprint request we add the meta information.
+               * Note that the use of a fingerprint needs to be
+               * enforced by the caller of the import function.  This
+               * is commonly triggered by verifying a modern signature
+               * which has an Issuer Fingerprint signature
+               * subpacket.  */
+              pk->keyorg = origin;
+              pk->keyupdate = curtime;
+              pk->updateurl = xtrystrdup (url);
+              if (!pk->updateurl)
+                return gpg_error_from_syserror ();
+            }
         }
-      else if (node->pkt->pkttype == PKT_USER_ID
-               && (origin == KEYORG_WKD || origin == KEYORG_DANE))
-        {
-          /* We insert origin information on a UID only when we
-           * received them via the Web Key Directory or a DANE record.
-           * The key we receive here from the WKD has been filtered to
-           * contain only the user ID as looked up in the WKD.  For a
-           * DANE origin we this should also be the case.  Thus we
-           * will see here only one user id.  */
+      else if (node->pkt->pkttype == PKT_USER_ID)
+        {
           PKT_user_id *uid = node->pkt->pkt.user_id;
 
-          uid->keyorg = origin;
-          uid->keyupdate = curtime;
-          if (url)
+          if (origin == KEYORG_WKD || origin == KEYORG_DANE)
             {
-              uid->updateurl = xtrystrdup (url);
-              if (!uid->updateurl)
-                return gpg_error_from_syserror ();
+              /* We insert origin information on a UID only when we
+               * received them via the Web Key Directory or a DANE
+               * record.  The key we receive here from the WKD has
+               * been filtered to contain only the user ID as looked
+               * up in the WKD.  For a DANE origin we this should also
+               * be the case.  Thus we will see here only one user
+               * id.  */
+              uid->keyorg = origin;
+              uid->keyupdate = curtime;
+              if (url)
+                {
+                  uid->updateurl = xtrystrdup (url);
+                  if (!uid->updateurl)
+                    return gpg_error_from_syserror ();
+                }
+            }
+          else if (origin == KEYORG_KS && url)
+            {
+              /* If the key was retrieved from a keyserver using a
+               * fingerprint request we mark that also in the user ID.
+               * However we do not store the keyserver URL in the UID.
+               * A later update (merge) from a more trusted source
+               * will replace this info.  */
+              uid->keyorg = origin;
+              uid->keyupdate = curtime;
             }
         }
     }
diff --git a/g10/keyserver.c b/g10/keyserver.c
index 9586448..4d2a2c8 100644
--- a/g10/keyserver.c
+++ b/g10/keyserver.c
@@ -1590,11 +1590,12 @@ keyserver_get_chunk (ctrl_t ctrl, KEYDB_SEARCH_DESC *desc, int ndesc,
 {
   gpg_error_t err = 0;
   char **pattern;
-  int idx, npat;
+  int idx, npat, npat_fpr;
   estream_t datastream;
   char *source = NULL;
   size_t linelen;  /* Estimated linelen for KS_GET.  */
   size_t n;
+  int only_fprs;
 
 #define MAX_KS_GET_LINELEN 950  /* Somewhat lower than the real limit.  */
 
@@ -1613,7 +1614,7 @@ keyserver_get_chunk (ctrl_t ctrl, KEYDB_SEARCH_DESC *desc, int ndesc,
      but we are sure that R_NDESC_USED has been updated.  This avoids
      a possible indefinite loop.  */
   linelen = 17; /* "KS_GET --quick --" */
-  for (npat=idx=0; idx < ndesc; idx++)
+  for (npat=npat_fpr=0, idx=0; idx < ndesc; idx++)
     {
       int quiet = 0;
 
@@ -1635,6 +1636,8 @@ keyserver_get_chunk (ctrl_t ctrl, KEYDB_SEARCH_DESC *desc, int ndesc,
                        desc[idx].mode == KEYDB_SEARCH_MODE_FPR20? 20 : 16,
                        pattern[npat]+2);
               npat++;
+              if (desc[idx].mode == KEYDB_SEARCH_MODE_FPR20)
+                npat_fpr++;
             }
         }
       else if(desc[idx].mode == KEYDB_SEARCH_MODE_LONG_KID)
@@ -1716,6 +1719,8 @@ keyserver_get_chunk (ctrl_t ctrl, KEYDB_SEARCH_DESC *desc, int ndesc,
      this is different from NPAT.  */
   *r_ndesc_used = idx;
 
+  only_fprs = (npat && npat == npat_fpr);
+
   err = gpg_dirmngr_ks_get (ctrl, pattern, override_keyserver, quick,
                             &datastream, &source);
   for (idx=0; idx < npat; idx++)
@@ -1747,7 +1752,8 @@ keyserver_get_chunk (ctrl_t ctrl, KEYDB_SEARCH_DESC *desc, int ndesc,
                              (opt.keyserver_options.import_options
                               | IMPORT_NO_SECKEY),
                              keyserver_retrieval_screener, &screenerarg,
-                             0 /* FIXME? */, NULL);
+                             only_fprs? KEYORG_KS : 0,
+                             source);
     }
   es_fclose (datastream);
   xfree (source);

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi    |   8 +++--
 g10/getkey.c    |  15 ++++++++
 g10/gpg.c       |   2 +-
 g10/import.c    | 109 ++++++++++++++++++++++++++++++++++++++++++--------------
 g10/keyserver.c |  14 +++++---
 g10/options.h   |   1 +
 6 files changed, 115 insertions(+), 34 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 24 21:34:51 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 24 Jul 2017 21:34:51 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-148-gaa358ac
Message-ID: <E1dZj7z-0004X6-U1@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  aa358ac78cf8042dc107b130e6492d6bf12d7088 (commit)
      from  87b5421ca84bbea68217c9ed771ee8c0a98a4d0c (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit aa358ac78cf8042dc107b130e6492d6bf12d7088
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 24 21:29:51 2017 +0200

    doc: Use @var for meta variables in gpg.texi
    
    --
    
    This results in more standrard man pages.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/gpg.texi b/doc/gpg.texi
index dddb930..1984445 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -392,13 +392,13 @@ Present a menu to allow changing the PIN of a smartcard. This
 functionality is also available as the subcommand "passwd" with the
 @option{--edit-card} command.
 
- at item --delete-keys @code{name}
+ at item --delete-keys @var{name}
 @opindex delete-keys
 Remove key from the public keyring. In batch mode either @option{--yes} is
 required or the key must be specified by fingerprint. This is a
 safeguard against accidental deletion of multiple keys.
 
- at item --delete-secret-keys @code{name}
+ at item --delete-secret-keys @var{name}
 @opindex delete-secret-keys
 Remove key from the secret keyring. In batch mode the key must be
 specified by fingerprint.  The option @option{--yes} can be used to
@@ -408,7 +408,7 @@ secret key (as controlled by gpg-agent) is only used for the given
 OpenPGP public key.
 
 
- at item --delete-secret-and-public-key @code{name}
+ at item --delete-secret-and-public-key @var{name}
 @opindex delete-secret-and-public-key
 Same as @option{--delete-key}, but if a secret key exists, it will be
 removed first. In batch mode the key must be specified by fingerprint.
@@ -423,13 +423,14 @@ those of the given name. The exported keys are written to STDOUT or to the
 file given with option @option{--output}.  Use together with
 @option{--armor} to mail those keys.
 
- at item --send-keys @code{key IDs}
+ at item --send-keys @var{keyIDs}
 @opindex send-keys
 Similar to @option{--export} but sends the keys to a keyserver.
-Fingerprints may be used instead of key IDs. Option @option{--keyserver}
-must be used to give the name of this keyserver. Don't send your
-complete keyring to a keyserver --- select only those keys which are new
-or changed by you.  If no key IDs are given, @command{@gpgname} does nothing.
+Fingerprints may be used instead of key IDs.  Option
+ at option{--keyserver} must be used to give the name of this
+keyserver. Don't send your complete keyring to a keyserver --- select
+only those keys which are new or changed by you.  If no @var{keyIDs}
+are given, @command{@gpgname} does nothing.
 
 @item --export-secret-keys
 @itemx --export-secret-subkeys
@@ -478,11 +479,11 @@ Most notable here is the @option{--import-options merge-only} option
 which does not insert new keys but does only the merging of new
 signatures, user-IDs and subkeys.
 
- at item --receive-keys @code{key IDs}
+ at item --receive-keys @var{keyIDs}
 @opindex receive-keys
- at itemx --recv-keys @code{key IDs}
+ at itemx --recv-keys @var{keyIDs}
 @opindex recv-keys
-Import the keys with the given key IDs from a keyserver. Option
+Import the keys with the given @var{keyIDs} from a keyserver. Option
 @option{--keyserver} must be used to give the name of this keyserver.
 
 @item --refresh-keys
@@ -494,9 +495,9 @@ the entire keyring. Option @option{--keyserver} must be used to give the
 name of the keyserver for all keys that do not have preferred keyservers
 set (see @option{--keyserver-options honor-keyserver-url}).
 
- at item --search-keys @code{names}
+ at item --search-keys @var{names}
 @opindex search-keys
-Search the keyserver for the given names. Multiple names given here will
+Search the keyserver for the given @var{names}. Multiple names given here will
 be joined together to create the search string for the keyserver.
 Option @option{--keyserver} must be used to give the name of this
 keyserver.  Keyservers that support different search methods allow using
@@ -504,9 +505,9 @@ the syntax specified in "How to specify a user ID" below. Note that
 different keyserver types support different search methods. Currently
 only LDAP supports them all.
 
- at item --fetch-keys @code{URIs}
+ at item --fetch-keys @var{URIs}
 @opindex fetch-keys
-Retrieve keys located at the specified URIs. Note that different
+Retrieve keys located at the specified @var{URIs}. Note that different
 installations of GnuPG may support different protocols (HTTP, FTP,
 LDAP, etc.).  When using HTTPS the system provided root certificates
 are used by this command.
@@ -572,14 +573,14 @@ When updating from version 1.0.6 to 1.0.7 this command should be used
 to create signature caches in the keyring. It might be handy in other
 situations too.
 
- at item --print-md @code{algo}
+ at item --print-md @var{algo}
 @itemx --print-mds
 @opindex print-md
-Print message digest of algorithm ALGO for all given files or STDIN.
-With the second form (or a deprecated "*" as algo) digests for all
+Print message digest of algorithm @var{algo} for all given files or STDIN.
+With the second form (or a deprecated "*" for @var{algo}) digests for all
 available algorithms are printed.
 
- at item --gen-random @code{0|1|2} @code{count}
+ at item --gen-random @var{0|1|2} @var{count}
 @opindex gen-random
 Emit @var{count} random bytes of the given quality level 0, 1 or 2. If
 @var{count} is not given or zero, an endless sequence of random bytes
@@ -587,9 +588,10 @@ will be emitted.  If used with @option{--armor} the output will be
 base64 encoded.  PLEASE, don't use this command unless you know what
 you are doing; it may remove precious entropy from the system!
 
- at item --gen-prime @code{mode}  @code{bits}
+ at item --gen-prime @var{mode}  @var{bits}
 @opindex gen-prime
-Use the source, Luke :-). The output format is still subject to change.
+Use the source, Luke :-). The output format is subject to change
+with ant release.
 
 
 @item --enarmor
@@ -599,11 +601,11 @@ Use the source, Luke :-). The output format is still subject to change.
 Pack or unpack an arbitrary input into/from an OpenPGP ASCII armor.
 This is a GnuPG extension to OpenPGP and in general not very useful.
 
- at item --tofu-policy @code{auto|good|unknown|bad|ask}  @code{key...}
+ at item --tofu-policy @{auto|good|unknown|bad|ask@}  @var{keys}
 @opindex tofu-policy
 Set the TOFU policy for all the bindings associated with the specified
-keys.  For more information about the meaning of the policies,
- at pxref{trust-model-tofu}.  The keys may be specified either by their
+ at var{keys}.  For more information about the meaning of the policies,
+ at pxref{trust-model-tofu}.  The @var{keys} may be specified either by their
 fingerprint (preferred) or their keyid.
 
 @c @item --server
@@ -624,7 +626,7 @@ This section explains the main commands for key management.
 
 @table @gnupgtabopt
 
- at item --quick-generate-key @code{user-id} [@code{algo} [@code{usage} [@code{expire}]]]
+ at item --quick-generate-key @var{user-id} [@var{algo} [@var{usage} [@var{expire}]]]
 @opindex quick-generate-key
 This is a simple command to generate a standard key with one user id.
 In contrast to @option{--generate-key} the key is generated directly
@@ -637,16 +639,16 @@ answer to a ``Continue?'' style confirmation prompt is required.  In
 case the user id already exists in the keyring a second prompt to
 force the creation of the key will show up.
 
-If @code{algo} or @code{usage} are given, only the primary key is
+If @var{algo} or @var{usage} are given, only the primary key is
 created and no prompts are shown.  To specify an expiration date but
 still create a primary and subkey use ``default'' or
-``future-default'' for @code{algo} and ``default'' for @code{usage}.
+``future-default'' for @var{algo} and ``default'' for @var{usage}.
 For a description of these optional arguments see the command
- at code{--quick-add-key}.  The @code{usage} accepts also the value
+ at code{--quick-add-key}.  The @var{usage} accepts also the value
 ``cert'' which can be used to create a certification only primary key;
 the default is to a create certification and signing key.
 
-The @code{expire} argument can be used to specify an expiration date
+The @var{expire} argument can be used to specify an expiration date
 for the key.  Several formats are supported; commonly the ISO formats
 ``YYYY-MM-DD'' or ``YYYYMMDDThhmmss'' are used.  To make the key
 expire in N seconds, N days, N weeks, N months, or N years use
@@ -675,14 +677,14 @@ non-revoked subkeys matching these fingerprints are set to
 @var{expire}.
 
 
- at item --quick-add-key @code{fpr} [@code{algo} [@code{usage} [@code{expire}]]]
+ at item --quick-add-key @var{fpr} [@var{algo} [@var{usage} [@var{expire}]]]
 @opindex quick-add-key
 Directly add a subkey to the key identified by the fingerprint
- at code{fpr}.  Without the optional arguments an encryption subkey is
+ at var{fpr}.  Without the optional arguments an encryption subkey is
 added.  If any of the arguments are given a more specific subkey is
 added.
 
- at code{algo} may be any of the supported algorithms or curve names
+ at var{algo} may be any of the supported algorithms or curve names
 given in the format as used by key listings.  To use the default
 algorithm the string ``default'' or ``-'' can be used.  Supported
 algorithms are ``rsa'', ``dsa'', ``elg'', ``ed25519'', ``cv25519'',
@@ -692,9 +694,9 @@ key length is 4096 bits.  The string ``future-default'' is an alias
 for the algorithm which will likely be used as default algorithm in
 future versions of gpg.
 
-Depending on the given @code{algo} the subkey may either be an
+Depending on the given @var{algo} the subkey may either be an
 encryption subkey or a signing subkey.  If an algorithm is capable of
-signing and encryption and such a subkey is desired, a @code{usage}
+signing and encryption and such a subkey is desired, a @var{usage}
 string must be given.  This string is either ``default'' or ``-'' to
 keep the default or a comma delimited list (or space delimited list)
 of keywords: ``sign'' for a signing subkey, ``auth'' for an
@@ -702,7 +704,7 @@ authentication subkey, and ``encr'' for an encryption subkey
 (``encrypt'' can be used as alias for ``encr'').  The valid
 combinations depend on the algorithm.
 
-The @code{expire} argument can be used to specify an expiration date
+The @var{expire} argument can be used to specify an expiration date
 for the key.  Several formats are supported; commonly the ISO formats
 ``YYYY-MM-DD'' or ``YYYYMMDDThhmmss'' are used.  To make the key
 expire in N seconds, N days, N weeks, N months, or N years use
@@ -732,9 +734,9 @@ mode. See the manual section ``Unattended key generation'' on how
 to use this.
 
 
- at item --generate-revocation @code{name}
+ at item --generate-revocation @var{name}
 @opindex generate-revocation
- at itemx --gen-revoke @code{name}
+ at itemx --gen-revoke @var{name}
 @opindex gen-revoke
 Generate a revocation certificate for the complete key.  To only revoke
 a subkey or a key signature, use the @option{--edit} command.
@@ -749,9 +751,9 @@ published, which is best done by sending the key to a keyserver
 to a file which is then send to frequent communication partners.
 
 
- at item --generate-designated-revocation @code{name}
+ at item --generate-designated-revocation @var{name}
 @opindex generate-designated-revocation
- at itemx --desig-revoke @code{name}
+ at itemx --desig-revoke @var{name}
 @opindex desig-revoke
 Generate a designated revocation certificate for a key. This allows a
 user (with the permission of the keyholder) to revoke someone else's
@@ -767,14 +769,14 @@ line.
 @c ******** Begin Edit-key Options **********
 @table @asis
 
-  @item uid @code{n}
+  @item uid @var{n}
   @opindex keyedit:uid
-  Toggle selection of user ID or photographic user ID with index @code{n}.
+  Toggle selection of user ID or photographic user ID with index @var{n}.
   Use @code{*} to select all and @code{0} to deselect all.
 
-  @item key @code{n}
+  @item key @var{n}
   @opindex keyedit:key
-  Toggle selection of subkey with index @code{n} or key ID @code{n}.
+  Toggle selection of subkey with index @var{n} or key ID @var{n}.
   Use @code{*} to select all and @code{0} to deselect all.
 
   @item sign
@@ -899,9 +901,9 @@ signing.
   not already included in the preference list. In addition, the
   preferred keyserver and signature notations (if any) are shown.
 
-  @item setpref @code{string}
+  @item setpref @var{string}
   @opindex keyedit:setpref
-  Set the list of user ID preferences to @code{string} for all (or just
+  Set the list of user ID preferences to @var{string} for all (or just
   the selected) user IDs. Calling setpref with no arguments sets the
   preference list to the default (either built-in or set via
   @option{--default-preference-list}), and calling setpref with "none"
@@ -941,9 +943,9 @@ signing.
   from the card - if the card gets broken your secret key will be lost
   unless you have a backup somewhere.
 
-  @item bkuptocard @code{file}
+  @item bkuptocard @var{file}
   @opindex keyedit:bkuptocard
-  Restore the given file to a card. This command may be used to restore a
+  Restore the given @var{file} to a card. This command may be used to restore a
   backup key (as generated during card initialization) to a new card. In
   almost all cases this will be the encryption key. You should use this
   command only with the corresponding public key and make sure that the
@@ -1063,25 +1065,25 @@ the values:
 @end table
 @c ******** End Edit-key Options **********
 
- at item --sign-key @code{name}
+ at item --sign-key @var{name}
 @opindex sign-key
 Signs a public key with your secret key. This is a shortcut version of
 the subcommand "sign" from @option{--edit}.
 
- at item --lsign-key @code{name}
+ at item --lsign-key @var{name}
 @opindex lsign-key
 Signs a public key with your secret key but marks it as
 non-exportable. This is a shortcut version of the subcommand "lsign"
 from @option{--edit-key}.
 
- at item --quick-sign-key @code{fpr} [@code{names}]
- at itemx --quick-lsign-key @code{fpr} [@code{names}]
+ at item --quick-sign-key @var{fpr} [@var{names}]
+ at itemx --quick-lsign-key @var{fpr} [@var{names}]
 @opindex quick-sign-key
 @opindex quick-lsign-key
 Directly sign a key from the passphrase without any further user
-interaction.  The @code{fpr} must be the verified primary fingerprint
-of a key in the local keyring. If no @code{names} are given, all
-useful user ids are signed; with given [@code{names}] only useful user
+interaction.  The @var{fpr} must be the verified primary fingerprint
+of a key in the local keyring. If no @var{names} are given, all
+useful user ids are signed; with given [@var{names}] only useful user
 ids matching one of theses names are signed.  By default, or if a name
 is prefixed with a '*', a case insensitive substring match is used.
 If a name is prefixed with a '=' a case sensitive exact match is done.
@@ -1248,7 +1250,7 @@ Assume "yes" on most questions.
 Assume "no" on most questions.
 
 
- at item --list-options @code{parameters}
+ at item --list-options @var{parameters}
 @opindex list-options
 This is a space or comma delimited string that gives options used when
 listing keys and signatures (that is, @option{--list-keys},
@@ -1327,7 +1329,7 @@ give the opposite meaning.  The options are:
 
 @end table
 
- at item --verify-options @code{parameters}
+ at item --verify-options @var{parameters}
 @opindex verify-options
 This is a space or comma delimited string that gives options used when
 verifying signatures. Options can be prepended with a `no-' to give
@@ -1408,7 +1410,7 @@ Enable hash truncation for all DSA keys even for old DSA Keys up to
 that older versions of GnuPG also required this flag to allow the
 generation of DSA larger than 1024 bit.
 
- at item --photo-viewer @code{string}
+ at item --photo-viewer @var{string}
 @opindex photo-viewer
 This is the command line that should be run to view a photo ID. "%i"
 will be expanded to a filename containing the photo. "%I" does the
@@ -1426,7 +1428,7 @@ The default viewer is "xloadimage -fork -quiet -title 'KeyID 0x%k'
 STDIN". Note that if your image viewer program is not secure, then
 executing it from GnuPG does not make it secure.
 
- at item --exec-path @code{string}
+ at item --exec-path @var{string}
 @opindex exec-path
 @efindex PATH
 Sets a list of directories to search for photo viewers and keyserver
@@ -1436,9 +1438,9 @@ variable.
 Note, that on W32 system this value is ignored when searching for
 keyserver helpers.
 
- at item --keyring @code{file}
+ at item --keyring @var{file}
 @opindex keyring
-Add @code{file} to the current list of keyrings. If @code{file} begins
+Add @var{file} to the current list of keyrings. If @var{file} begins
 with a tilde and a slash, these are replaced by the $HOME directory. If
 the filename does not contain a slash, it is assumed to be in the GnuPG
 home directory ("~/.gnupg" if @option{--homedir} or $GNUPGHOME is not
@@ -1452,20 +1454,20 @@ If the option @option{--no-keyring} has been used no keyrings will
 be used at all.
 
 
- at item --secret-keyring @code{file}
+ at item --secret-keyring @var{file}
 @opindex secret-keyring
 This is an obsolete option and ignored.  All secret keys are stored in
 the @file{private-keys-v1.d} directory below the GnuPG home directory.
 
- at item --primary-keyring @code{file}
+ at item --primary-keyring @var{file}
 @opindex primary-keyring
-Designate @code{file} as the primary public keyring. This means that
+Designate @var{file} as the primary public keyring. This means that
 newly imported keys (via @option{--import} or keyserver
 @option{--recv-from}) will go to this keyring.
 
- at item --trustdb-name @code{file}
+ at item --trustdb-name @var{file}
 @opindex trustdb-name
-Use @code{file} instead of the default trustdb. If @code{file} begins
+Use @var{file} instead of the default trustdb. If @var{file} begins
 with a tilde and a slash, these are replaced by the $HOME directory. If
 the filename does not contain a slash, it is assumed to be in the GnuPG
 home directory (@file{~/.gnupg} if @option{--homedir} or $GNUPGHOME is
@@ -1474,7 +1476,7 @@ not used).
 @include opt-homedir.texi
 
 
- at item --display-charset @code{name}
+ at item --display-charset @var{name}
 @opindex display-charset
 Set the name of the native character set. This is used to convert
 some informational strings like user IDs to the proper UTF-8 encoding.
@@ -1482,7 +1484,7 @@ Note that this has nothing to do with the character set of data to be
 encrypted or signed; GnuPG does not recode user-supplied data. If
 this option is not used, the default character set is determined from
 the current locale. A verbosity level of 3 shows the chosen set.
-Valid values for @code{name} are:
+Valid values for @var{name} are:
 
 @table @asis
 
@@ -1519,9 +1521,9 @@ encoded in the character set as specified by
 arguments. Both options may be used multiple times.
 
 @anchor{gpg-option --options}
- at item --options @code{file}
+ at item --options @var{file}
 @opindex options
-Read options from @code{file} and do not try to read them from the
+Read options from @var{file} and do not try to read them from the
 default options file in the homedir (see @option{--homedir}). This
 option is ignored if used in an options file.
 
@@ -1531,18 +1533,18 @@ Shortcut for @option{--options /dev/null}. This option is detected
 before an attempt to open an option file.  Using this option will also
 prevent the creation of a @file{~/.gnupg} homedir.
 
- at item -z @code{n}
- at itemx --compress-level @code{n}
- at itemx --bzip2-compress-level @code{n}
+ at item -z @var{n}
+ at itemx --compress-level @var{n}
+ at itemx --bzip2-compress-level @var{n}
 @opindex compress-level
 @opindex bzip2-compress-level
-Set compression level to @code{n} for the ZIP and ZLIB compression
+Set compression level to @var{n} for the ZIP and ZLIB compression
 algorithms. The default is to use the default compression level of zlib
 (normally 6). @option{--bzip2-compress-level} sets the compression level
 for the BZIP2 compression algorithm (defaulting to 6 as well). This is a
 different option from @option{--compress-level} since BZIP2 uses a
 significant amount of memory for each additional compression level.
- at option{-z} sets both. A value of 0 for @code{n} disables compression.
+ at option{-z} sets both. A value of 0 for @var{n} disables compression.
 
 @item --bzip2-decompress-lowmem
 @opindex bzip2-decompress-lowmem
@@ -1573,7 +1575,7 @@ information on the specific levels and how they are
 used. @option{--no-ask-cert-level} disables this option. This option
 defaults to no.
 
- at item --default-cert-level @code{n}
+ at item --default-cert-level @var{n}
 @opindex default-cert-level
 The default to use for the check level when signing a key.
 
@@ -1610,7 +1612,7 @@ certification level below this as invalid. Defaults to 2, which
 disregards level 1 signatures. Note that level 0 "no particular
 claim" signatures are always accepted.
 
- at item --trusted-key @code{long key ID}
+ at item --trusted-key @var{long key ID}
 @opindex trusted-key
 Assume that the specified key (which must be given
 as a full 8 byte key ID) is as trustworthy as one of
@@ -1619,7 +1621,7 @@ don't want to keep your secret keys (or one of them)
 online but still want to be able to check the validity of a given
 recipient's or signator's key.
 
- at item --trust-model @code{pgp|classic|tofu|tofu+pgp|direct|always|auto}
+ at item --trust-model @{pgp|classic|tofu|tofu+pgp|direct|always|auto@}
 @opindex trust-model
 Set what trust model GnuPG should follow. The models are:
 
@@ -1724,7 +1726,7 @@ Set what trust model GnuPG should follow. The models are:
   exists.
 @end table
 
- at item --auto-key-locate @code{parameters}
+ at item --auto-key-locate @var{parameters}
 @itemx --no-auto-key-locate
 @opindex auto-key-locate
 GnuPG can automatically locate and retrieve keys as needed using this
@@ -1800,7 +1802,7 @@ you naturally will not have on your local keyring), the operator can
 tell both your IP address and the time when you verified the
 signature.
 
- at item --keyid-format @code{none|short|0xshort|long|0xlong}
+ at item --keyid-format @{none|short|0xshort|long|0xlong@}
 @opindex keyid-format
 Select how to display key IDs.  "none" does not show the key ID at all
 but shows the fingerprint in a separate line.  "short" is the
@@ -1809,15 +1811,15 @@ convenient) 16-character key ID.  Add an "0x" to either to include an
 "0x" at the beginning of the key ID, as in 0x99242560.  Note that this
 option is ignored if the option @option{--with-colons} is used.
 
- at item --keyserver @code{name}
+ at item --keyserver @var{name}
 @opindex keyserver
 This option is deprecated - please use the @option{--keyserver} in
 @file{dirmngr.conf} instead.
 
-Use @code{name} as your keyserver. This is the server that
+Use @var{name} as your keyserver. This is the server that
 @option{--receive-keys}, @option{--send-keys}, and @option{--search-keys}
 will communicate with to receive keys from, send keys to, and search for
-keys on. The format of the @code{name} is a URI:
+keys on. The format of the @var{name} is a URI:
 `scheme:[//]keyservername[:port]' The scheme is the type of keyserver:
 "hkp" for the HTTP (or compatible) keyservers, "ldap" for the LDAP
 keyservers, or "mailto" for the Graff email keyserver. Note that your
@@ -1832,7 +1834,7 @@ need to send keys to more than one server. The keyserver
 @code{hkp://keys.gnupg.net} uses round robin DNS to give a different
 keyserver each time you use it.
 
- at item --keyserver-options @code{name=value}
+ at item --keyserver-options @{@var{name}=@var{value}@}
 @opindex keyserver-options
 This is a space or comma delimited string that gives options for the
 keyserver. Options can be prefixed with a `no-' to give the opposite
@@ -1888,7 +1890,7 @@ are available for all keyserver types, some common options are:
   timeout applies separately to each key retrieval, and not to the
   @option{--receive-keys} command as a whole. Defaults to 30 seconds.
 
-  @item http-proxy=@code{value}
+  @item http-proxy=@var{value}
   This option is deprecated.
   Set the proxy to use for HTTP and HKP keyservers.
   This overrides any proxy defined in @file{dirmngr.conf}.
@@ -1911,22 +1913,22 @@ are available for all keyserver types, some common options are:
 
 @end table
 
- at item --completes-needed @code{n}
+ at item --completes-needed @var{n}
 @opindex compliant-needed
 Number of completely trusted users to introduce a new
 key signer (defaults to 1).
 
- at item --marginals-needed @code{n}
+ at item --marginals-needed @var{n}
 @opindex marginals-needed
 Number of marginally trusted users to introduce a new
 key signer (defaults to 3)
 
- at item --tofu-default-policy @code{auto|good|unknown|bad|ask}
+ at item --tofu-default-policy @{auto|good|unknown|bad|ask@}
 @opindex tofu-default-policy
 The default TOFU policy (defaults to @code{auto}).  For more
 information about the meaning of this option, @pxref{trust-model-tofu}.
 
- at item --max-cert-depth @code{n}
+ at item --max-cert-depth @var{n}
 @opindex max-cert-depth
 Maximum depth of a certification chain (default is 5).
 
@@ -2008,9 +2010,9 @@ connected pipe too early. Using this option along with
 @option{--enable-progress-filter} may be used to cleanly cancel long
 running gpg operations.
 
- at item --limit-card-insert-tries @code{n}
+ at item --limit-card-insert-tries @var{n}
 @opindex limit-card-insert-tries
-With @code{n} greater than 0 the number of prompts asking to insert a
+With @var{n} greater than 0 the number of prompts asking to insert a
 smartcard gets limited to N-1. Thus with a value of 1 gpg won't at
 all ask to insert a card if none has been inserted at startup. This
 option is useful in the configuration file in case an application does
@@ -2120,7 +2122,7 @@ encrypts to a key stored in the given file.  @var{file} must be the
 name of a file containing exactly one key.  @command{@gpgname} assumes that
 the key in this file is fully valid.
 
- at item --encrypt-to @code{name}
+ at item --encrypt-to @var{name}
 @opindex encrypt-to
 Same as @option{--recipient} but this one is intended for use in the
 options file and may be used with your own user-id as an
@@ -2129,7 +2131,7 @@ recipients given either by use of @option{--recipient} or by the asked
 user id.  No trust checking is performed for these user ids and even
 disabled keys can be used.
 
- at item --hidden-encrypt-to @code{name}
+ at item --hidden-encrypt-to @var{name}
 @opindex hidden-encrypt-to
 Same as @option{--hidden-recipient} but this one is intended for use in the
 options file and may be used with your own user-id as a hidden
@@ -2143,7 +2145,7 @@ keys can be used.
 Disable the use of all @option{--encrypt-to} and
 @option{--hidden-encrypt-to} keys.
 
- at item --group @code{name=value}
+ at item --group @{@var{name}=@var{value}@}
 @opindex group
 Sets up a named group, which is similar to aliases in email programs.
 Any time the group name is a recipient (@option{-r} or
@@ -2159,7 +2161,7 @@ from the command line, it may be necessary to quote the argument to
 this option to prevent the shell from treating it as multiple
 arguments.
 
- at item --ungroup @code{name}
+ at item --ungroup @var{name}
 @opindex ungroup
 Remove a given entry from the @option{--group} list.
 
@@ -2241,7 +2243,7 @@ Assume the input data is not in ASCII armored format.
 Write output to @var{file}.  To write to stdout use @code{-} as the
 filename.
 
- at item --max-output @code{n}
+ at item --max-output @var{n}
 @opindex max-output
 This option sets a limit on the number of bytes that will be generated
 when processing a file. Since OpenPGP supports various levels of
@@ -2269,7 +2271,7 @@ To list the possible values use "help" for @var{string}.  Some origins
 can store an optional @var{url} argument.  That URL can appended to
 @var{string} after a comma.
 
- at item --import-options @code{parameters}
+ at item --import-options @var{parameters}
 @opindex import-options
 This is a space or comma delimited string that gives options for
 importing keys. Options can be prepended with a `no-' to give the
@@ -2340,8 +2342,8 @@ opposite meaning. The options are:
   contradicting options are overridden.
 @end table
 
- at item --import-filter @code{@var{name}=@var{expr}}
- at itemx --export-filter @code{@var{name}=@var{expr}}
+ at item --import-filter @{@var{name}=@var{expr}@}
+ at itemx --export-filter @{@var{name}=@var{expr}@}
 @opindex import-filter
 @opindex export-filter
 These options define an import/export filter which are applied to the
@@ -2427,7 +2429,7 @@ The available properties are:
 
 @end table
 
- at item --export-options @code{parameters}
+ at item --export-options @var{parameters}
 @opindex export-options
 This is a space or comma delimited string that gives options for
 exporting keys.  Options can be prepended with a `no-' to give the
@@ -2606,9 +2608,9 @@ specified with @option{local-user} using a mail address.  This
 information can be helpful for verifier to locate the key; see
 option @option{--auto-key-retrieve}.
 
- at item --personal-cipher-preferences @code{string}
+ at item --personal-cipher-preferences @var{string}
 @opindex personal-cipher-preferences
-Set the list of personal cipher preferences to @code{string}.  Use
+Set the list of personal cipher preferences to @var{string}.  Use
 @command{@gpgname --version} to get a list of available algorithms,
 and use @code{none} to set no preference at all.  This allows the user
 to safely override the algorithm chosen by the recipient key
@@ -2616,9 +2618,9 @@ preferences, as GPG will only select an algorithm that is usable by
 all recipients.  The most highly ranked cipher in this list is also
 used for the @option{--symmetric} encryption command.
 
- at item --personal-digest-preferences @code{string}
+ at item --personal-digest-preferences @var{string}
 @opindex personal-digest-preferences
-Set the list of personal digest preferences to @code{string}.  Use
+Set the list of personal digest preferences to @var{string}.  Use
 @command{@gpgname --version} to get a list of available algorithms,
 and use @code{none} to set no preference at all.  This allows the user
 to safely override the algorithm chosen by the recipient key
@@ -2627,9 +2629,9 @@ all recipients.  The most highly ranked digest algorithm in this list
 is also used when signing without encryption
 (e.g. @option{--clear-sign} or @option{--sign}).
 
- at item --personal-compress-preferences @code{string}
+ at item --personal-compress-preferences @var{string}
 @opindex personal-compress-preferences
-Set the list of personal compression preferences to @code{string}.
+Set the list of personal compression preferences to @var{string}.
 Use @command{@gpgname --version} to get a list of available
 algorithms, and use @code{none} to set no preference at all.  This
 allows the user to safely override the algorithm chosen by the
@@ -2638,26 +2640,26 @@ is usable by all recipients.  The most highly ranked compression
 algorithm in this list is also used when there are no recipient keys
 to consider (e.g. @option{--symmetric}).
 
- at item --s2k-cipher-algo @code{name}
+ at item --s2k-cipher-algo @var{name}
 @opindex s2k-cipher-algo
-Use @code{name} as the cipher algorithm for symmetric encryption with
+Use @var{name} as the cipher algorithm for symmetric encryption with
 a passphrase if @option{--personal-cipher-preferences} and
 @option{--cipher-algo} are not given.  The default is @value{GPGSYMENCALGO}.
 
- at item --s2k-digest-algo @code{name}
+ at item --s2k-digest-algo @var{name}
 @opindex s2k-digest-algo
-Use @code{name} as the digest algorithm used to mangle the passphrases
+Use @var{name} as the digest algorithm used to mangle the passphrases
 for symmetric encryption.  The default is SHA-1.
 
- at item --s2k-mode @code{n}
+ at item --s2k-mode @var{n}
 @opindex s2k-mode
 Selects how passphrases for symmetric encryption are mangled. If
- at code{n} is 0 a plain passphrase (which is in general not recommended)
+ at var{n} is 0 a plain passphrase (which is in general not recommended)
 will be used, a 1 adds a salt (which should not be used) to the
 passphrase and a 3 (the default) iterates the whole process a number
 of times (see @option{--s2k-count}).
 
- at item --s2k-count @code{n}
+ at item --s2k-count @var{n}
 @opindex s2k-count
 Specify how many times the passphrases mangling for symmetric
 encryption is repeated.  This value may range between 1024 and
@@ -2838,42 +2840,42 @@ Enable certain PROGRESS status outputs. This option allows frontends
 to display a progress indicator while gpg is processing larger files.
 There is a slight performance overhead using it.
 
- at item --status-fd @code{n}
+ at item --status-fd @var{n}
 @opindex status-fd
-Write special status strings to the file descriptor @code{n}.
+Write special status strings to the file descriptor @var{n}.
 See the file DETAILS in the documentation for a listing of them.
 
- at item --status-file @code{file}
+ at item --status-file @var{file}
 @opindex status-file
 Same as @option{--status-fd}, except the status data is written to file
- at code{file}.
+ at var{file}.
 
- at item --logger-fd @code{n}
+ at item --logger-fd @var{n}
 @opindex logger-fd
-Write log output to file descriptor @code{n} and not to STDERR.
+Write log output to file descriptor @var{n} and not to STDERR.
 
- at item --log-file @code{file}
- at itemx --logger-file @code{file}
+ at item --log-file @var{file}
+ at itemx --logger-file @var{file}
 @opindex log-file
 Same as @option{--logger-fd}, except the logger data is written to
-file @code{file}.  Use @file{socket://} to log to socket.
+file @var{file}.  Use @file{socket://} to log to s socket.
 
- at item --attribute-fd @code{n}
+ at item --attribute-fd @var{n}
 @opindex attribute-fd
-Write attribute subpackets to the file descriptor @code{n}. This is most
+Write attribute subpackets to the file descriptor @var{n}. This is most
 useful for use with @option{--status-fd}, since the status messages are
 needed to separate out the various subpackets from the stream delivered
 to the file descriptor.
 
- at item --attribute-file @code{file}
+ at item --attribute-file @var{file}
 @opindex attribute-file
 Same as @option{--attribute-fd}, except the attribute data is written to
-file @code{file}.
+file @var{file}.
 
- at item --comment @code{string}
+ at item --comment @var{string}
 @itemx --no-comments
 @opindex comment
-Use @code{string} as a comment string in cleartext signatures and ASCII
+Use @var{string} as a comment string in cleartext signatures and ASCII
 armored messages or keys (see @option{--armor}). The default behavior is
 not to use a comment string. @option{--comment} may be repeated multiple
 times to get multiple comment strings. @option{--no-comments} removes
@@ -2892,21 +2894,21 @@ the micro is added, and given four times an operating system identification
 is also emitted.  @option{--no-emit-version} (default) disables the version
 line.
 
- at item --sig-notation @code{name=value}
- at itemx --cert-notation @code{name=value}
- at itemx -N, --set-notation @code{name=value}
+ at item --sig-notation @{@var{name}=@var{value}@}
+ at itemx --cert-notation @{@var{name}=@var{value}@}
+ at itemx -N, --set-notation @{@var{name}=@var{value}@}
 @opindex sig-notation
 @opindex cert-notation
 @opindex set-notation
 Put the name value pair into the signature as notation data.
- at code{name} must consist only of printable characters or spaces, and
+ at var{name} must consist only of printable characters or spaces, and
 must contain a '@@' character in the form keyname@@domain.example.com
 (substituting the appropriate keyname and domain name, of course).  This
 is to help prevent pollution of the IETF reserved notation
 namespace. The @option{--expert} flag overrides the '@@'
-check. @code{value} may be any printable string; it will be encoded in
+check. @var{value} may be any printable string; it will be encoded in
 UTF-8, so you should check that your @option{--display-charset} is set
-correctly. If you prefix @code{name} with an exclamation mark (!), the
+correctly. If you prefix @var{name} with an exclamation mark (!), the
 notation data will be flagged as critical
 (rfc4880:5.2.3.16). @option{--sig-notation} sets a notation for data
 signatures. @option{--cert-notation} sets a notation for key signatures
@@ -2924,13 +2926,13 @@ smartcard, and "%%" results in a single "%". %k, %K, and %f are only
 meaningful when making a key signature (certification), and %c is only
 meaningful when using the OpenPGP smartcard.
 
- at item --sig-policy-url @code{string}
- at itemx --cert-policy-url @code{string}
- at itemx --set-policy-url @code{string}
+ at item --sig-policy-url @var{string}
+ at itemx --cert-policy-url @var{string}
+ at itemx --set-policy-url @var{string}
 @opindex sig-policy-url
 @opindex cert-policy-url
 @opindex set-policy-url
-Use @code{string} as a Policy URL for signatures (rfc4880:5.2.3.20).  If
+Use @var{string} as a Policy URL for signatures (rfc4880:5.2.3.20).  If
 you prefix it with an exclamation mark (!), the policy URL packet will
 be flagged as critical. @option{--sig-policy-url} sets a policy url for
 data signatures. @option{--cert-policy-url} sets a policy url for key
@@ -2938,19 +2940,19 @@ signatures (certifications). @option{--set-policy-url} sets both.
 
 The same %-expandos used for notation data are available here as well.
 
- at item --sig-keyserver-url @code{string}
+ at item --sig-keyserver-url @var{string}
 @opindex sig-keyserver-url
-Use @code{string} as a preferred keyserver URL for data signatures. If
+Use @var{string} as a preferred keyserver URL for data signatures. If
 you prefix it with an exclamation mark (!), the keyserver URL packet
 will be flagged as critical.
 
 The same %-expandos used for notation data are available here as well.
 
- at item --set-filename @code{string}
+ at item --set-filename @var{string}
 @opindex set-filename
-Use @code{string} as the filename which is stored inside messages.
+Use @var{string} as the filename which is stored inside messages.
 This overrides the default, which is to use the actual filename of the
-file being encrypted.  Using the empty string for @code{string}
+file being encrypted.  Using the empty string for @var{string}
 effectively removes the filename from the output.
 
 @item --for-your-eyes-only
@@ -2968,9 +2970,9 @@ to display the message. This option overrides @option{--set-filename}.
 Try to create a file with a name as embedded in the data. This can be
 a dangerous option as it enables overwriting files. Defaults to no.
 
- at item --cipher-algo @code{name}
+ at item --cipher-algo @var{name}
 @opindex cipher-algo
-Use @code{name} as cipher algorithm. Running the program with the
+Use @var{name} as cipher algorithm. Running the program with the
 command @option{--version} yields a list of supported algorithms. If
 this is not used the cipher algorithm is selected from the preferences
 stored with the key. In general, you do not want to use this option as
@@ -2978,17 +2980,17 @@ it allows you to violate the OpenPGP standard.
 @option{--personal-cipher-preferences} is the safe way to accomplish the
 same thing.
 
- at item --digest-algo @code{name}
+ at item --digest-algo @var{name}
 @opindex digest-algo
-Use @code{name} as the message digest algorithm. Running the program
+Use @var{name} as the message digest algorithm. Running the program
 with the command @option{--version} yields a list of supported algorithms. In
 general, you do not want to use this option as it allows you to
 violate the OpenPGP standard. @option{--personal-digest-preferences} is the
 safe way to accomplish the same thing.
 
- at item --compress-algo @code{name}
+ at item --compress-algo @var{name}
 @opindex compress-algo
-Use compression algorithm @code{name}. "zlib" is RFC-1950 ZLIB
+Use compression algorithm @var{name}. "zlib" is RFC-1950 ZLIB
 compression. "zip" is RFC-1951 ZIP compression which is used by PGP.
 "bzip2" is a more modern compression scheme that can compress some
 things better than zip or zlib, but at the cost of more memory used
@@ -3009,24 +3011,24 @@ general, you do not want to use this option as it allows you to
 violate the OpenPGP standard. @option{--personal-compress-preferences} is the
 safe way to accomplish the same thing.
 
- at item --cert-digest-algo @code{name}
+ at item --cert-digest-algo @var{name}
 @opindex cert-digest-algo
-Use @code{name} as the message digest algorithm used when signing a
+Use @var{name} as the message digest algorithm used when signing a
 key. Running the program with the command @option{--version} yields a
 list of supported algorithms. Be aware that if you choose an algorithm
 that GnuPG supports but other OpenPGP implementations do not, then some
 users will not be able to use the key signatures you make, or quite
 possibly your entire key.
 
- at item --disable-cipher-algo @code{name}
+ at item --disable-cipher-algo @var{name}
 @opindex disable-cipher-algo
-Never allow the use of @code{name} as cipher algorithm.
+Never allow the use of @var{name} as cipher algorithm.
 The given name will not be checked so that a later loaded algorithm
 will still get disabled.
 
- at item --disable-pubkey-algo @code{name}
+ at item --disable-pubkey-algo @var{name}
 @opindex disable-pubkey-algo
-Never allow the use of @code{name} as public key algorithm.
+Never allow the use of @var{name} as public key algorithm.
 The given name will not be checked so that a later loaded algorithm
 will still get disabled.
 
@@ -3062,44 +3064,44 @@ signatures to prevent the mail system from breaking the signature. Note
 that all other PGP versions do it this way too.  Enabled by
 default. @option{--no-escape-from-lines} disables this option.
 
- at item --passphrase-repeat @code{n}
+ at item --passphrase-repeat @var{n}
 @opindex passphrase-repeat
 Specify how many times @command{@gpgname} will request a new
 passphrase be repeated.  This is useful for helping memorize a
 passphrase.  Defaults to 1 repetition.
 
- at item --passphrase-fd @code{n}
+ at item --passphrase-fd @var{n}
 @opindex passphrase-fd
-Read the passphrase from file descriptor @code{n}. Only the first line
-will be read from file descriptor @code{n}. If you use 0 for @code{n},
+Read the passphrase from file descriptor @var{n}. Only the first line
+will be read from file descriptor @var{n}. If you use 0 for @var{n},
 the passphrase will be read from STDIN. This can only be used if only
 one passphrase is supplied.
 
 Note that this passphrase is only used if the option @option{--batch}
 has also been given.  This is different from GnuPG version 1.x.
 
- at item --passphrase-file @code{file}
+ at item --passphrase-file @var{file}
 @opindex passphrase-file
-Read the passphrase from file @code{file}. Only the first line will
-be read from file @code{file}. This can only be used if only one
+Read the passphrase from file @var{file}. Only the first line will
+be read from file @var{file}. This can only be used if only one
 passphrase is supplied. Obviously, a passphrase stored in a file is
 of questionable security if other users can read this file. Don't use
 this option if you can avoid it.
 Note that this passphrase is only used if the option @option{--batch}
 has also been given.  This is different from GnuPG version 1.x.
 
- at item --passphrase @code{string}
+ at item --passphrase @var{string}
 @opindex passphrase
-Use @code{string} as the passphrase. This can only be used if only one
+Use @var{string} as the passphrase. This can only be used if only one
 passphrase is supplied. Obviously, this is of very questionable
 security on a multi-user system. Don't use this option if you can
 avoid it.
 Note that this passphrase is only used if the option @option{--batch}
 has also been given.  This is different from GnuPG version 1.x.
 
- at item --pinentry-mode @code{mode}
+ at item --pinentry-mode @var{mode}
 @opindex pinentry-mode
-Set the pinentry mode to @code{mode}.  Allowed values for @code{mode}
+Set the pinentry mode to @var{mode}.  Allowed values for @var{mode}
 are:
 @table @asis
   @item default
@@ -3115,7 +3117,7 @@ are:
   Pinentry the user is not prompted again if he enters a bad password.
 @end table
 
- at item --command-fd @code{n}
+ at item --command-fd @var{n}
 @opindex command-fd
 This is a replacement for the deprecated shared-memory IPC mode.
 If this option is enabled, user input on questions is not expected
@@ -3123,10 +3125,10 @@ from the TTY but from the given file descriptor. It should be used
 together with @option{--status-fd}. See the file doc/DETAILS in the source
 distribution for details on how to use it.
 
- at item --command-file @code{file}
+ at item --command-file @var{file}
 @opindex command-file
 Same as @option{--command-fd}, except the commands are read out of file
- at code{file}
+ at var{file}
 
 @item --allow-non-selfsigned-uid
 @itemx --no-allow-non-selfsigned-uid
@@ -3181,7 +3183,7 @@ allows the verification of signatures made with such weak algorithms.
 MD5 is the only digest algorithm considered weak by default.  See also
 @option{--weak-digest} to reject other digest algorithms.
 
- at item --weak-digest @code{name}
+ at item --weak-digest @var{name}
 @opindex weak-digest
 Treat the specified digest algorithm as weak.  Signatures made over
 weak digests algorithms are normally rejected. This option can be
@@ -3246,12 +3248,12 @@ messaging system that the ciphertext transmitted corresponds to an
 inappropriate plaintext so they can take action against the offending
 user.
 
- at item --override-session-key @code{string}
- at itemx --override-session-key-fd @code{fd}
+ at item --override-session-key @var{string}
+ at itemx --override-session-key-fd @var{fd}
 @opindex override-session-key
-Don't use the public key but the session key @code{string} respective
+Don't use the public key but the session key @var{string} respective
 the session key taken from the first line read from file descriptor
- at code{fd}.  The format of this string is the same as the one printed
+ at var{fd}.  The format of this string is the same as the one printed
 by @option{--show-session-key}. This option is normally not used but
 comes handy in case someone forces you to reveal the content of an
 encrypted message; using this option you can do this without handing
@@ -3330,15 +3332,15 @@ Experimental use only.
 Don't change the permissions of a secret keyring back to user
 read/write only. Use this option only if you really know what you are doing.
 
- at item --default-preference-list @code{string}
+ at item --default-preference-list @var{string}
 @opindex default-preference-list
-Set the list of default preferences to @code{string}. This preference
+Set the list of default preferences to @var{string}. This preference
 list is used for new keys and becomes the default for "setpref" in the
 edit menu.
 
- at item --default-keyserver-url @code{name}
+ at item --default-keyserver-url @var{name}
 @opindex default-keyserver-url
-Set the default keyserver URL to @code{name}. This keyserver will be
+Set the default keyserver URL to @var{name}. This keyserver will be
 used as the keyserver URL when writing a new self-signature on a key,
 which includes key generation and changing preferences.
 

-----------------------------------------------------------------------

Summary of changes:
 doc/gpg.texi | 356 ++++++++++++++++++++++++++++++-----------------------------
 1 file changed, 179 insertions(+), 177 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 25 04:54:03 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 25 Jul 2017 04:54:03 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-149-gd40b4a4
Message-ID: <E1dZpz2-0001i6-5a@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  d40b4a41a8d60292fd4b5b951a19883e31090179 (commit)
      from  aa358ac78cf8042dc107b130e6492d6bf12d7088 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d40b4a41a8d60292fd4b5b951a19883e31090179
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jul 25 11:49:23 2017 +0900

    dirmngr: Add annotation for fallthrough.
    
    * dirmngr/dns.c: Add /* FALL THROUGH */ to clarify.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/dirmngr/dns.c b/dirmngr/dns.c
index 94dc7ae..8e8b6db 100644
--- a/dirmngr/dns.c
+++ b/dirmngr/dns.c
@@ -7617,14 +7617,14 @@ retry:
 				goto error;
 		}
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_UDP_CONN:
 		error = dns_connect(so->udp, (struct sockaddr *)&so->remote, dns_sa_len(&so->remote));
 		dns_trace_sys_connect(so->trace, so->udp, SOCK_DGRAM, (struct sockaddr *)&so->remote, error);
 		if (error)
 			goto error;
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_UDP_SEND:
 		n = dns_send(so->udp, (void *)so->query->data, so->query->end, 0, &error);
 		dns_trace_sys_send(so->trace, so->udp, SOCK_DGRAM, so->query->data, n, error);
@@ -7634,7 +7634,7 @@ retry:
 		so->stat.udp.sent.bytes += n;
 		so->stat.udp.sent.count++;
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_UDP_RECV:
 		n = dns_recv(so->udp, (void *)so->answer->data, so->answer->size, 0, &error);
 		dns_trace_sys_recv(so->trace, so->udp, SOCK_DGRAM, so->answer->data, n, error);
@@ -7648,12 +7648,12 @@ retry:
 		if ((error = dns_so_verify(so, so->answer)))
 			goto trash;
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_UDP_DONE:
 		if (!dns_header(so->answer)->tc || so->type == SOCK_DGRAM)
 			return 0;
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_TCP_INIT:
 		if (so->remote.ss_family != so->local.ss_family) {
 			/* Family mismatch.  Reinitialize.  */
@@ -7680,24 +7680,24 @@ retry:
 		if (-1 == (so->tcp = dns_socket((struct sockaddr *)&so->local, SOCK_STREAM, &error)))
 			goto error;
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_TCP_CONN:
 		error = dns_connect(so->tcp, (struct sockaddr *)&so->remote, dns_sa_len(&so->remote));
 		dns_trace_sys_connect(so->trace, so->tcp, SOCK_STREAM, (struct sockaddr *)&so->remote, error);
 		if (error && error != DNS_EISCONN)
 			goto error;
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_TCP_SEND:
 		if ((error = dns_so_tcp_send(so)))
 			goto error;
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_TCP_RECV:
 		if ((error = dns_so_tcp_recv(so)))
 			goto error;
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_TCP_DONE:
 		/* close unless DNS_RESCONF_TCP_ONLY (see dns_res_tcp2type) */
 		if (so->type != SOCK_STREAM) {
@@ -7716,7 +7716,7 @@ retry:
 		if (-1 == (so->tcp = dns_socket((struct sockaddr *)&so->local, SOCK_STREAM, &error)))
 			goto error;
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_SOCKS_CONN: {
 		unsigned char method;
 
@@ -7744,13 +7744,13 @@ retry:
 		buffer[2] = method;
 
 		so->state++;
-	}
+	} /* FALL THROUGH */
 	case DNS_SO_SOCKS_HELLO_SEND:
 		if ((error = dns_so_tcp_send(so)))
 			goto error;
 
 		dns_so_tcp_recv_expect(so, 2);
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_SOCKS_HELLO_RECV: {
 		unsigned char method;
 
@@ -7798,7 +7798,7 @@ retry:
 		}
 
 		so->state++;
-	}
+	} /* FALL THROUGH */
 	case DNS_SO_SOCKS_AUTH_SEND:
 		if ((error = dns_so_tcp_send(so)))
 			goto error;
@@ -7806,7 +7806,7 @@ retry:
 		/* Skip the two length octets, and receive two octets.  */
 		dns_so_tcp_recv_expect(so, 2);
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_SOCKS_AUTH_RECV:
 		if ((error = dns_so_tcp_recv(so)))
 			goto error;
@@ -7823,7 +7823,7 @@ retry:
 			goto error;
 		}
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_SOCKS_REQUEST_PREPARE:
 		/* Send request details (rfc-1928, 4).  */
 		buffer = dns_so_tcp_send_buffer(so, so->remote.ss_family == AF_INET6 ? 22 : 10);
@@ -7844,7 +7844,7 @@ retry:
 			memcpy (buffer+8, &addr_in->sin_port, 2);        /* DST.PORT */
 		}
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_SOCKS_REQUEST_SEND:
 		if ((error = dns_so_tcp_send(so)))
 			goto error;
@@ -7852,7 +7852,7 @@ retry:
 		/* Expect ten octets.  This is the length of the
 		 * response assuming a IPv4 address is used.  */
 		dns_so_tcp_recv_expect(so, 10);
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_SOCKS_REQUEST_RECV:
 		if ((error = dns_so_tcp_recv(so)))
 			goto error;
@@ -7910,12 +7910,12 @@ retry:
 		 * the remaining bytes assuming an IPv6 address is
 		 * used.  */
 		dns_so_tcp_recv_expect(so, 12);
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_SOCKS_REQUEST_RECV_V6:
 		if ((error = dns_so_tcp_recv(so)))
 			goto error;
 
-		so->state++;
+		so->state++;	/* FALL THROUGH */
 	case DNS_SO_SOCKS_HANDSHAKE_DONE:
 		/* We have not way to store the actual address used by
 		 * the server.  Then again, we don't really care.  */
@@ -8543,7 +8543,7 @@ exec:
 
 	switch (F->state) {
 	case DNS_R_INIT:
-		F->state++;
+		F->state++;	/* FALL THROUGH */
 	case DNS_R_GLUE:
 		if (R->sp == 0)
 			dgoto(R->sp, DNS_R_SWITCH);
@@ -8657,17 +8657,17 @@ exec:
 		} else if (error)
 			goto error;
 
-		F->state++;
+		F->state++;	/* FALL THROUGH */
 	case DNS_R_SUBMIT:
 		if ((error = R->cache->submit(F->query, R->cache)))
 			goto error;
 
-		F->state++;
+		F->state++;	/* FALL THROUGH */
 	case DNS_R_CHECK:
 		if ((error = R->cache->check(R->cache)))
 			goto error;
 
-		F->state++;
+		F->state++;	/* FALL THROUGH */
 	case DNS_R_FETCH:
 		error = 0;
 
@@ -8692,7 +8692,7 @@ exec:
 
 		R->search = 0;
 
-		F->state++;
+		F->state++;	/* FALL THROUGH */
 	case DNS_R_SEARCH:
 		/*
 		 * XXX: We probably should only apply the domain search
@@ -8704,12 +8704,12 @@ exec:
 		if ((error = dns_q_make2(&F->query, u.name, len, R->qtype, R->qclass, F->qflags)))
 			goto error;
 
-		F->state++;
+		F->state++;	/* FALL THROUGH */
 	case DNS_R_HINTS:
 		if (!dns_p_setptr(&F->hints, dns_hints_query(R->hints, F->query, &error)))
 			goto error;
 
-		F->state++;
+		F->state++;	/* FALL THROUGH */
 	case DNS_R_ITERATE:
 		dns_rr_i_init(&F->hints_i, F->hints);
 
@@ -8718,7 +8718,7 @@ exec:
 		F->hints_i.sort		= &dns_res_nameserv_cmp;
 		F->hints_i.args[0]	= F->hints->end;
 
-		F->state++;
+		F->state++;	/* FALL THROUGH */
 	case DNS_R_FOREACH_NS:
 		dns_rr_i_save(&F->hints_i);
 
@@ -8824,7 +8824,7 @@ exec:
 			goto error;
 
 		F->state++;
-	}
+	} /* FALL THROUGH */
 	case DNS_R_QUERY_A:
 		if (dns_so_elapsed(&R->so) >= dns_resconf_timeout(R->resconf))
 			dgoto(R->sp, DNS_R_FOREACH_A);
@@ -8957,7 +8957,7 @@ exec:
 			goto error;
 
 		F->state++;
-	}
+	} /* FALL THROUGH */
 	case DNS_R_QUERY_AAAA:
 		if (dns_so_elapsed(&R->so) >= dns_resconf_timeout(R->resconf))
 			dgoto(R->sp, DNS_R_FOREACH_AAAA);
@@ -9060,7 +9060,7 @@ exec:
 
 		dns_rr_i_init(&R->smart, F->answer);
 
-		F->state++;
+		F->state++;	/* FALL THROUGH */
 	case DNS_R_SMART0_A:
 		if (&F[1] >= endof(R->stack))
 			dgoto(R->sp, DNS_R_DONE);
@@ -9745,12 +9745,12 @@ exec:
 
 	switch (ai->state) {
 	case DNS_AI_S_INIT:
-		ai->state++;
+		ai->state++;	/* FALL THROUGH */
 	case DNS_AI_S_NEXTAF:
 		if (!dns_ai_nextaf(ai))
 			dns_ai_goto(DNS_AI_S_DONE);
 
-		ai->state++;
+		ai->state++;	/* FALL THROUGH */
 	case DNS_AI_S_NUMERIC:
 		if (1 == dns_inet_pton(AF_INET, ai->qname, &any.a)) {
 			if (ai->af.atype == AF_INET) {
@@ -9773,19 +9773,19 @@ exec:
 		if (ai->hints.ai_flags & AI_NUMERICHOST)
 			dns_ai_goto(DNS_AI_S_NEXTAF);
 
-		ai->state++;
+		ai->state++;	/* FALL THROUGH */
 	case DNS_AI_S_SUBMIT:
 		assert(ai->res);
 
 		if ((error = dns_res_submit(ai->res, ai->qname, dns_ai_qtype(ai), DNS_C_IN)))
 			return error;
 
-		ai->state++;
+		ai->state++;	/* FALL THROUGH */
 	case DNS_AI_S_CHECK:
 		if ((error = dns_res_check(ai->res)))
 			return error;
 
-		ai->state++;
+		ai->state++;	/* FALL THROUGH */
 	case DNS_AI_S_FETCH:
 		if (!(ans = dns_res_fetch_and_study(ai->res, &error)))
 			return error;
@@ -9808,7 +9808,7 @@ exec:
 		ai->i.type    = dns_ai_qtype(ai);
 		ai->i.sort    = &dns_rr_i_order;
 
-		ai->state++;
+		ai->state++;	/* FALL THROUGH */
 	case DNS_AI_S_FOREACH_I:
 		if (!dns_rr_grep(&rr, 1, &ai->i, ai->answer, &error))
 			dns_ai_goto(DNS_AI_S_NEXTAF);
@@ -9842,11 +9842,11 @@ exec:
 			break;
 		} /* switch() */
 
-		ai->state++;
+		ai->state++;	/* FALL THROUGH */
 	case DNS_AI_S_INIT_G:
 		ai->g_depth = 0;
 
-		ai->state++;
+		ai->state++;	/* FALL THROUGH */
 	case DNS_AI_S_ITERATE_G:
 		dns_strlcpy(ai->g_cname, ai->cname, sizeof ai->g_cname);
 		dns_rr_i_init(&ai->g, ai->glue);
@@ -9854,7 +9854,7 @@ exec:
 		ai->g.name    = ai->g_cname;
 		ai->g.type    = ai->af.qtype;
 
-		ai->state++;
+		ai->state++;	/* FALL THROUGH */
 	case DNS_AI_S_FOREACH_G:
 		if (!dns_rr_grep(&rr, 1, &ai->g, ai->glue, &error)) {
 			if (dns_rr_i_count(&ai->g) > 0)
@@ -9878,12 +9878,12 @@ exec:
 		if ((error = dns_res_submit(ai->res, ai->g.name, ai->g.type, DNS_C_IN)))
 			return error;
 
-		ai->state++;
+		ai->state++;	/* FALL THROUGH */
 	case DNS_AI_S_CHECK_G:
 		if ((error = dns_res_check(ai->res)))
 			return error;
 
-		ai->state++;
+		ai->state++;	/* FALL THROUGH */
 	case DNS_AI_S_FETCH_G:
 		if (!(ans = dns_res_fetch_and_study(ai->res, &error)))
 			return error;

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dns.c | 82 +++++++++++++++++++++++++++++------------------------------
 1 file changed, 41 insertions(+), 41 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 25 08:27:22 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 25 Jul 2017 08:27:22 +0200
Subject: [git] GCRYPT - branch, master, updated. libgcrypt-1.8.0-5-gb7cd443
Message-ID: <E1dZtJS-0000hN-L3@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU crypto library".

The branch, master has been updated
       via  b7cd44335d9cde43be6f693dca6399ed0762649c (commit)
      from  ac39522ab08fcd2483edc223334c6ab9d19e91f3 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit b7cd44335d9cde43be6f693dca6399ed0762649c
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jul 25 15:26:33 2017 +0900

    sexp: Add fall through annotation.
    
    * src/dumpsexp.c (parse_and_print): It's fall through.
    
    Signed-off-by: NIIBE Yutaka <gniibe at fsij.org>

diff --git a/src/dumpsexp.c b/src/dumpsexp.c
index f6384d7..5aeb77d 100644
--- a/src/dumpsexp.c
+++ b/src/dumpsexp.c
@@ -546,6 +546,7 @@ parse_and_print (FILE *fp)
           state = IN_DATA;
           printctl ("begindata");
           init_data ();
+	  /* fall through */
         case IN_DATA:
           if (datalen)
             {

-----------------------------------------------------------------------

Summary of changes:
 src/dumpsexp.c | 1 +
 1 file changed, 1 insertion(+)


hooks/post-receive
-- 
The GNU crypto library
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 25 11:30:23 2017
From: cvs at cvs.gnupg.org (by NIIBE Yutaka)
Date: Tue, 25 Jul 2017 11:30:23 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 329cb28391f7fda3a88df03b678cc15d6d338387
Message-ID: <E1dZwAa-0002e1-2T@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  329cb28391f7fda3a88df03b678cc15d6d338387 (commit)
      from  b8fd72086cbb9a016b72253bfd2ed94f932b974d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 329cb28391f7fda3a88df03b678cc15d6d338387
Author: NIIBE Yutaka <gniibe at fsij.org>
Date:   Tue Jul 25 18:29:38 2017 +0900

    campaign: Fix Japanese translation.

diff --git a/web/donate/index.ja.org b/web/donate/index.ja.org
index 028d009..ca4f793 100644
--- a/web/donate/index.ja.org
+++ b/web/donate/index.ja.org
@@ -190,7 +190,7 @@
     <div id="dailyvideo" class="camp-gutter camp-gutter-clump container">
       <div class="row">
 	<div class="col-sm-10 col-sm-offset-1">
-	  <h2>?????</h2>
+	  <h2>??????</h2>
 	  <div class="row">
 	    <div class="col-lg-10 col-lg-offset-0">
               <ul>

-----------------------------------------------------------------------

Summary of changes:
 web/donate/index.ja.org | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 25 11:36:28 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 25 Jul 2017 11:36:28 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-151-g166d0d7
Message-ID: <E1dZwGT-0003cP-F7@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  166d0d7a2439f30c0a250faadc16ce3453447d71 (commit)
       via  84c993d9325fc000acac7950b2dfeefa5976df3b (commit)
      from  d40b4a41a8d60292fd4b5b951a19883e31090179 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 166d0d7a2439f30c0a250faadc16ce3453447d71
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jul 25 11:23:08 2017 +0200

    gpg: Update key origin info during import merge.
    
    * g10/import.c (update_key_origin): New.
    (merge_blocks): Add arg curtime.
    (import_one): Pass curtime to merge_blocks.  Call update_key_origin.
    --
    
    We probably need to refine the rules on how this is done.  But it is a
    start.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/import.c b/g10/import.c
index fda308b..6e83225 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -123,7 +123,7 @@ static int any_uid_left (kbnode_t keyblock);
 static int merge_blocks (ctrl_t ctrl, unsigned int options,
                          kbnode_t keyblock_orig,
 			 kbnode_t keyblock, u32 *keyid,
-                         int origin, const char *url,
+                         u32 curtime, int origin, const char *url,
 			 int *n_uids, int *n_sigs, int *n_subk );
 static gpg_error_t append_new_uid (unsigned int options,
                                    kbnode_t keyblock, kbnode_t node,
@@ -1521,6 +1521,81 @@ insert_key_origin (kbnode_t keyblock, int origin, const char *url)
 }
 
 
+/* Update meta data on KEYBLOCK.  This updates the key origin on the
+ * public key according to ORIGIN and URL.  The UIDs are already
+ * updated when this function is called.  */
+static gpg_error_t
+update_key_origin (kbnode_t keyblock, u32 curtime, int origin, const char *url)
+{
+  PKT_public_key *pk;
+
+  log_assert (keyblock->pkt->pkttype == PKT_PUBLIC_KEY);
+  pk = keyblock->pkt->pkt.public_key;
+
+  if (pk->keyupdate > curtime)
+    ; /* Don't do it for a time warp.  */
+  else if (origin == KEYORG_WKD || origin == KEYORG_DANE)
+    {
+      /* We only update the origin info if they either have never been
+       * set or are the origin was the same as the new one.  If this
+       * is WKD we also update the UID to show from which user id this
+       * was updated.  */
+      if (!pk->keyorg || pk->keyorg == KEYORG_WKD || pk->keyorg == KEYORG_DANE)
+        {
+          pk->keyorg = origin;
+          pk->keyupdate = curtime;
+          xfree (pk->updateurl);
+          pk->updateurl = NULL;
+          if (origin == KEYORG_WKD && url)
+            {
+              pk->updateurl = xtrystrdup (url);
+              if (!pk->updateurl)
+                return gpg_error_from_syserror ();
+            }
+        }
+    }
+  else if (origin == KEYORG_KS)
+    {
+      /* All updates from a keyserver are considered to have the
+       * freshed key.  Thus we always set the new key origin.  */
+      pk->keyorg = origin;
+      pk->keyupdate = curtime;
+      xfree (pk->updateurl);
+      pk->updateurl = NULL;
+      if (url)
+        {
+          pk->updateurl = xtrystrdup (url);
+          if (!pk->updateurl)
+            return gpg_error_from_syserror ();
+        }
+    }
+  else if (origin == KEYORG_FILE)
+    {
+      /* Updates from a file are considered to be fresh.  */
+      pk->keyorg = origin;
+      pk->keyupdate = curtime;
+      xfree (pk->updateurl);
+      pk->updateurl = NULL;
+    }
+  else if (origin == KEYORG_URL)
+    {
+      /* Updates from a URL are considered to be fresh.  */
+      pk->keyorg = origin;
+      pk->keyupdate = curtime;
+      xfree (pk->updateurl);
+      pk->updateurl = NULL;
+      if (url)
+        {
+          pk->updateurl = xtrystrdup (url);
+          if (!pk->updateurl)
+            return gpg_error_from_syserror ();
+        }
+    }
+
+  return 0;
+}
+
+
 /*
  * Try to import one keyblock. Return an error only in serious cases,
  * but never for an invalid keyblock.  It uses log_error to increase
@@ -1812,6 +1887,7 @@ import_one (ctrl_t ctrl,
     {
       KEYDB_HANDLE hd;
       int n_uids, n_sigs, n_subk, n_sigs_cleaned, n_uids_cleaned;
+      u32 curtime = make_timestamp ();
 
       /* Compare the original against the new key; just to be sure nothing
        * weird is going on */
@@ -1858,7 +1934,7 @@ import_one (ctrl_t ctrl,
       clear_kbnode_flags( keyblock );
       n_uids = n_sigs = n_subk = n_uids_cleaned = 0;
       rc = merge_blocks (ctrl, options, keyblock_orig, keyblock, keyid,
-                         origin, url,
+                         curtime, origin, url,
                          &n_uids, &n_sigs, &n_subk );
       if (rc )
         {
@@ -1872,6 +1948,21 @@ import_one (ctrl_t ctrl,
 
       if (n_uids || n_sigs || n_subk || n_sigs_cleaned || n_uids_cleaned)
         {
+          /* Unless we are in restore mode apply meta data to the
+           * keyblock.  Note that this will never change the first packet
+           * and thus the address of KEYBLOCK won't change.  */
+          if ( !(options & IMPORT_RESTORE) )
+            {
+              rc = update_key_origin (keyblock_orig, curtime, origin, url);
+              if (rc)
+                {
+                  log_error ("update_key_origin failed: %s\n",
+                             gpg_strerror (rc));
+                  keydb_release (hd);
+                  goto leave;
+                }
+            }
+
           mod_key = 1;
           /* KEYBLOCK_ORIG has been updated; write */
           rc = keydb_update_keyblock (ctrl, hd, keyblock_orig);
@@ -1929,6 +2020,9 @@ import_one (ctrl_t ctrl,
 	}
       else
         {
+          /* Fixme: we do not track the time we last checked a key for
+           * updates.  To do this we would need to rewrite even the
+           * keys which have no changes.  */
           same_key = 1;
           if (is_status_enabled ())
             print_import_ok (pk, 0);
@@ -3226,12 +3320,11 @@ revocation_present (ctrl_t ctrl, kbnode_t keyblock)
 static int
 merge_blocks (ctrl_t ctrl, unsigned int options,
               kbnode_t keyblock_orig, kbnode_t keyblock,
-              u32 *keyid, int origin, const char *url,
+              u32 *keyid, u32 curtime, int origin, const char *url,
 	      int *n_uids, int *n_sigs, int *n_subk )
 {
   kbnode_t onode, node;
   int rc, found;
-  u32 curtime = make_timestamp ();
 
   /* 1st: handle revocation certificates */
   for (node=keyblock->next; node; node=node->next )

commit 84c993d9325fc000acac7950b2dfeefa5976df3b
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jul 25 10:19:12 2017 +0200

    gpg: Store key origin for new userids during import merge.
    
    * g10/import.c (apply_meta_data): Rename to ...
    (insert_key_origin): this.  Factor code out to ...
    (insert_key_origin_pk, insert_key_origin_uid): new funcs.
    (import_one): Move insert_key_origin behind clean_key.
    (merge_blocks): Add args options, origin, and url.
    (append_uid): Rename to ...
    (append_new_uid): this.  Add args options, curtime, origin, and url.
    Call insert_key_origin_uid for new UIDs.
    --
    
    This is a straightforward change to handle new user ids.
    
    How to test:
    
    With an empty keyring run
    
      gpg --with-key-origin --locate-key \
          --auto-key-locate clear,nodefault,wkd  wk at gnupg.org
    
    and then append a new keyid using
    
      gpg --with-key-origin --locate-key \
          --auto-key-locate clear,nodefault,wkd  wk at g10code.com
    
    Works with my current key 80615870F5BAD690333686D0F2AD85AC1E42B367.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/import.c b/g10/import.c
index f18ef48..fda308b 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -1,6 +1,6 @@
 /* import.c - import a key into our key storage.
  * Copyright (C) 1998-2007, 2010-2011 Free Software Foundation, Inc.
- * Copyright (C) 2014, 2016  Werner Koch
+ * Copyright (C) 2014, 2016, 2017  Werner Koch
  *
  * This file is part of GnuPG.
  *
@@ -120,10 +120,15 @@ static int chk_self_sigs (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid,
 static int delete_inv_parts (ctrl_t ctrl, kbnode_t keyblock,
                              u32 *keyid, unsigned int options);
 static int any_uid_left (kbnode_t keyblock);
-static int merge_blocks (ctrl_t ctrl, kbnode_t keyblock_orig,
+static int merge_blocks (ctrl_t ctrl, unsigned int options,
+                         kbnode_t keyblock_orig,
 			 kbnode_t keyblock, u32 *keyid,
+                         int origin, const char *url,
 			 int *n_uids, int *n_sigs, int *n_subk );
-static int append_uid (kbnode_t keyblock, kbnode_t node, int *n_sigs);
+static gpg_error_t append_new_uid (unsigned int options,
+                                   kbnode_t keyblock, kbnode_t node,
+                                   u32 curtime, int origin, const char *url,
+                                   int *n_sigs);
 static int append_key (kbnode_t keyblock, kbnode_t node, int *n_sigs);
 static int merge_sigs (kbnode_t dst, kbnode_t src, int *n_sigs);
 static int merge_keysigs (kbnode_t dst, kbnode_t src, int *n_sigs);
@@ -1381,12 +1386,114 @@ apply_drop_sig_filter (ctrl_t ctrl, kbnode_t keyblock, recsel_expr_t selector)
 }
 
 
+/* Insert a key origin into a public key packet.  */
+static gpg_error_t
+insert_key_origin_pk (PKT_public_key *pk, u32 curtime,
+                      int origin, const char *url)
+{
+  if (origin == KEYORG_WKD || origin == KEYORG_DANE)
+    {
+      /* For WKD and DANE we insert origin information also for the
+       * key but we don't record the URL because we have have no use
+       * for that: An update using a keyserver has higher precedence
+       * and will thus update this origin info.  For refresh using WKD
+       * or DANE we need to go via the User ID anyway.  Recall that we
+       * are only inserting a new key. */
+      pk->keyorg = origin;
+      pk->keyupdate = curtime;
+    }
+  else if (origin == KEYORG_KS && url)
+    {
+      /* If the key was retrieved from a keyserver using a fingerprint
+       * request we add the meta information.  Note that the use of a
+       * fingerprint needs to be enforced by the caller of the import
+       * function.  This is commonly triggered by verifying a modern
+       * signature which has an Issuer Fingerprint signature
+       * subpacket.  */
+      pk->keyorg = origin;
+      pk->keyupdate = curtime;
+      xfree (pk->updateurl);
+      pk->updateurl = xtrystrdup (url);
+      if (!pk->updateurl)
+        return gpg_error_from_syserror ();
+    }
+  else if (origin == KEYORG_FILE)
+    {
+      pk->keyorg = origin;
+      pk->keyupdate = curtime;
+    }
+  else if (origin == KEYORG_URL)
+    {
+      pk->keyorg = origin;
+      pk->keyupdate = curtime;
+      if (url)
+        {
+          xfree (pk->updateurl);
+          pk->updateurl = xtrystrdup (url);
+          if (!pk->updateurl)
+            return gpg_error_from_syserror ();
+        }
+    }
+
+  return 0;
+}
+
+
+/* Insert a key origin into a user id packet.  */
+static gpg_error_t
+insert_key_origin_uid (PKT_user_id *uid, u32 curtime,
+                       int origin, const char *url)
+
+{
+  if (origin == KEYORG_WKD || origin == KEYORG_DANE)
+    {
+      /* We insert origin information on a UID only when we received
+       * them via the Web Key Directory or a DANE record.  The key we
+       * receive here from the WKD has been filtered to contain only
+       * the user ID as looked up in the WKD.  For a DANE origin we
+       * this should also be the case.  Thus we will see here only one
+       * user id.  */
+      uid->keyorg = origin;
+      uid->keyupdate = curtime;
+      if (url)
+        {
+          xfree (uid->updateurl);
+          uid->updateurl = xtrystrdup (url);
+          if (!uid->updateurl)
+            return gpg_error_from_syserror ();
+        }
+    }
+  else if (origin == KEYORG_KS && url)
+    {
+      /* If the key was retrieved from a keyserver using a fingerprint
+       * request we mark that also in the user ID.  However we do not
+       * store the keyserver URL in the UID.  A later update (merge)
+       * from a more trusted source will replace this info.  */
+      uid->keyorg = origin;
+      uid->keyupdate = curtime;
+    }
+  else if (origin == KEYORG_FILE)
+    {
+      uid->keyorg = origin;
+      uid->keyupdate = curtime;
+    }
+  else if (origin == KEYORG_URL)
+    {
+      uid->keyorg = origin;
+      uid->keyupdate = curtime;
+    }
+
+  return 0;
+}
+
+
 /* Apply meta data to KEYBLOCK.  This sets the origin of the key to
  * ORIGIN and the updateurl to URL.  Note that this function is only
  * used for a new key, that is not when we are merging keys.  */
 static gpg_error_t
-apply_meta_data (kbnode_t keyblock, int origin, const char *url)
+insert_key_origin (kbnode_t keyblock, int origin, const char *url)
 {
+  gpg_error_t err;
   kbnode_t node;
   u32 curtime = make_timestamp ();
 
@@ -1396,94 +1503,17 @@ apply_meta_data (kbnode_t keyblock, int origin, const char *url)
         ;
       else if (node->pkt->pkttype == PKT_PUBLIC_KEY)
         {
-          PKT_public_key *pk = node->pkt->pkt.public_key;
-
-          if (origin == KEYORG_WKD || origin == KEYORG_DANE)
-            {
-              /* For WKD and DANE we insert origin information also
-               * for the key but we don't record the URL because we
-               * have have no use for that: An update using a
-               * keyserver has higher precedence and will thus update
-               * this origin info.  For refresh using WKD or DANE we
-               * need to go via the User ID anyway.  Recall that we
-               * are only inserting a new key. */
-              pk->keyorg = origin;
-              pk->keyupdate = curtime;
-            }
-          else if (origin == KEYORG_KS && url)
-            {
-              /* If the key was retrieved from a keyserver using a
-               * fingerprint request we add the meta information.
-               * Note that the use of a fingerprint needs to be
-               * enforced by the caller of the import function.  This
-               * is commonly triggered by verifying a modern signature
-               * which has an Issuer Fingerprint signature
-               * subpacket.  */
-              pk->keyorg = origin;
-              pk->keyupdate = curtime;
-              pk->updateurl = xtrystrdup (url);
-              if (!pk->updateurl)
-                return gpg_error_from_syserror ();
-            }
-          else if (origin == KEYORG_FILE)
-            {
-              pk->keyorg = origin;
-              pk->keyupdate = curtime;
-            }
-          else if (origin == KEYORG_URL)
-            {
-              pk->keyorg = origin;
-              pk->keyupdate = curtime;
-              if (url)
-                {
-                  pk->updateurl = xtrystrdup (url);
-                  if (!pk->updateurl)
-                    return gpg_error_from_syserror ();
-                }
-            }
+          err = insert_key_origin_pk (node->pkt->pkt.public_key, curtime,
+                                      origin, url);
+          if (err)
+            return err;
         }
       else if (node->pkt->pkttype == PKT_USER_ID)
         {
-          PKT_user_id *uid = node->pkt->pkt.user_id;
-
-          if (origin == KEYORG_WKD || origin == KEYORG_DANE)
-            {
-              /* We insert origin information on a UID only when we
-               * received them via the Web Key Directory or a DANE
-               * record.  The key we receive here from the WKD has
-               * been filtered to contain only the user ID as looked
-               * up in the WKD.  For a DANE origin we this should also
-               * be the case.  Thus we will see here only one user
-               * id.  */
-              uid->keyorg = origin;
-              uid->keyupdate = curtime;
-              if (url)
-                {
-                  uid->updateurl = xtrystrdup (url);
-                  if (!uid->updateurl)
-                    return gpg_error_from_syserror ();
-                }
-            }
-          else if (origin == KEYORG_KS && url)
-            {
-              /* If the key was retrieved from a keyserver using a
-               * fingerprint request we mark that also in the user ID.
-               * However we do not store the keyserver URL in the UID.
-               * A later update (merge) from a more trusted source
-               * will replace this info.  */
-              uid->keyorg = origin;
-              uid->keyupdate = curtime;
-            }
-          else if (origin == KEYORG_FILE)
-            {
-              uid->keyorg = origin;
-              uid->keyupdate = curtime;
-            }
-          else if (origin == KEYORG_URL)
-            {
-              uid->keyorg = origin;
-              uid->keyupdate = curtime;
-            }
+          err = insert_key_origin_uid (node->pkt->pkt.user_id, curtime,
+                                       origin, url);
+          if (err)
+            return err;
         }
     }
 
@@ -1724,24 +1754,24 @@ import_one (ctrl_t ctrl,
       if (opt.verbose > 1 )
         log_info (_("writing to '%s'\n"), keydb_get_resource_name (hd) );
 
+      if ((options & IMPORT_CLEAN))
+        clean_key (ctrl, keyblock, opt.verbose, (options&IMPORT_MINIMAL),
+                   &n_uids_cleaned,&n_sigs_cleaned);
+
       /* Unless we are in restore mode apply meta data to the
        * keyblock.  Note that this will never change the first packet
        * and thus the address of KEYBLOCK won't change.  */
       if ( !(options & IMPORT_RESTORE) )
         {
-          rc = apply_meta_data (keyblock, origin, url);
+          rc = insert_key_origin (keyblock, origin, url);
           if (rc)
             {
-              log_error ("apply_meta_data failed: %s\n", gpg_strerror (rc));
+              log_error ("insert_key_origin failed: %s\n", gpg_strerror (rc));
               keydb_release (hd);
               return GPG_ERR_GENERAL;
             }
         }
 
-      if ((options & IMPORT_CLEAN))
-        clean_key (ctrl, keyblock, opt.verbose, (options&IMPORT_MINIMAL),
-                   &n_uids_cleaned,&n_sigs_cleaned);
-
       rc = keydb_insert_keyblock (hd, keyblock );
       if (rc)
         log_error (_("error writing keyring '%s': %s\n"),
@@ -1778,7 +1808,7 @@ import_one (ctrl_t ctrl,
       stats->imported++;
       new_key = 1;
     }
-  else /* merge */
+  else /* Merge the key.  */
     {
       KEYDB_HANDLE hd;
       int n_uids, n_sigs, n_subk, n_sigs_cleaned, n_uids_cleaned;
@@ -1827,8 +1857,9 @@ import_one (ctrl_t ctrl,
       clear_kbnode_flags( keyblock_orig );
       clear_kbnode_flags( keyblock );
       n_uids = n_sigs = n_subk = n_uids_cleaned = 0;
-      rc = merge_blocks (ctrl, keyblock_orig, keyblock,
-                         keyid, &n_uids, &n_sigs, &n_subk );
+      rc = merge_blocks (ctrl, options, keyblock_orig, keyblock, keyid,
+                         origin, url,
+                         &n_uids, &n_sigs, &n_subk );
       if (rc )
         {
           keydb_release (hd);
@@ -3193,11 +3224,14 @@ revocation_present (ctrl_t ctrl, kbnode_t keyblock)
  * Note: We indicate newly inserted packets with NODE_FLAG_A.
  */
 static int
-merge_blocks (ctrl_t ctrl, kbnode_t keyblock_orig, kbnode_t keyblock,
-	      u32 *keyid, int *n_uids, int *n_sigs, int *n_subk )
+merge_blocks (ctrl_t ctrl, unsigned int options,
+              kbnode_t keyblock_orig, kbnode_t keyblock,
+              u32 *keyid, int origin, const char *url,
+	      int *n_uids, int *n_sigs, int *n_subk )
 {
   kbnode_t onode, node;
   int rc, found;
+  u32 curtime = make_timestamp ();
 
   /* 1st: handle revocation certificates */
   for (node=keyblock->next; node; node=node->next )
@@ -3308,7 +3342,8 @@ merge_blocks (ctrl_t ctrl, kbnode_t keyblock_orig, kbnode_t keyblock,
               break;
           if (!onode ) /* this is a new user id: append */
             {
-              rc = append_uid (keyblock_orig, node, n_sigs);
+              rc = append_new_uid (options, keyblock_orig, node,
+                                   curtime, origin, url, n_sigs);
               if (rc )
                 return rc;
               ++*n_uids;
@@ -3384,17 +3419,23 @@ merge_blocks (ctrl_t ctrl, kbnode_t keyblock_orig, kbnode_t keyblock,
 
 
 /* Helper function for merge_blocks.
- * Append the userid starting with NODE and all signatures to KEYBLOCK.
+ *
+ * Append the new userid starting with NODE and all signatures to
+ * KEYBLOCK.  ORIGIN and URL conveys the usual key origin info.  The
+ * integer at N_SIGS is updated with the number of new signatures.
  */
-static int
-append_uid (kbnode_t keyblock, kbnode_t node, int *n_sigs)
+static gpg_error_t
+append_new_uid (unsigned int options,
+                kbnode_t keyblock, kbnode_t node, u32 curtime,
+                int origin, const char *url, int *n_sigs)
 {
+  gpg_error_t err;
   kbnode_t n;
   kbnode_t n_where = NULL;
 
-  log_assert (node->pkt->pkttype == PKT_USER_ID );
+  log_assert (node->pkt->pkttype == PKT_USER_ID);
 
-  /* find the position */
+  /* Find the right position for the new user id and its signatures.  */
   for (n = keyblock; n; n_where = n, n = n->next)
     {
       if (n->pkt->pkttype == PKT_PUBLIC_SUBKEY
@@ -3408,8 +3449,17 @@ append_uid (kbnode_t keyblock, kbnode_t node, int *n_sigs)
   while (node)
     {
       /* we add a clone to the original keyblock, because this
-       * one is released first */
+       * one is released first. */
       n = clone_kbnode(node);
+      if (n->pkt->pkttype == PKT_USER_ID
+          && !(options & IMPORT_RESTORE) )
+        {
+          err = insert_key_origin_uid (n->pkt->pkt.user_id,
+                                       curtime, origin, url);
+          if (err)
+            return err;
+        }
+
       if (n_where)
         {
           insert_kbnode( n_where, n, 0 );

-----------------------------------------------------------------------

Summary of changes:
 g10/import.c | 347 +++++++++++++++++++++++++++++++++++++++++------------------
 1 file changed, 245 insertions(+), 102 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 25 13:09:41 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 25 Jul 2017 13:09:41 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-154-g0ef5034
Message-ID: <E1dZxih-0000cH-0X@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  0ef50340ef68b2541d9a1aafa71f5400aef4dc7e (commit)
       via  226f143ca01cf335c7c4e3e94c96fb9d271eccc9 (commit)
       via  f2d2648a4deb205c26ac869c857c000a95d3ff0c (commit)
      from  166d0d7a2439f30c0a250faadc16ce3453447d71 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0ef50340ef68b2541d9a1aafa71f5400aef4dc7e
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jul 25 12:52:33 2017 +0200

    w32: Also change the directory on daemon startup.
    
    * agent/gpg-agent.c (main): Always to the chdir.
    * dirmngr/dirmngr.c (main): Ditto.
    * scd/scdaemon.c (main): Ditto.
    --
    
    Note that only dirmngr did not call the chdir with --no-detach.  thus
    we kept it this way.
    
    Tested gpg-agent by checking the properties shown by procexp.
    
    Gnupg-bug-id: 2670
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
index ef35174..36c05bc 100644
--- a/agent/gpg-agent.c
+++ b/agent/gpg-agent.c
@@ -1708,13 +1708,6 @@ main (int argc, char **argv )
           opt.running_detached = 1;
         }
 
-      if (gnupg_chdir (gnupg_daemon_rootdir ()))
-        {
-          log_error ("chdir to '%s' failed: %s\n",
-                     gnupg_daemon_rootdir (), strerror (errno));
-          exit (1);
-        }
-
       {
         struct sigaction sa;
 
@@ -1725,6 +1718,13 @@ main (int argc, char **argv )
       }
 #endif /*!HAVE_W32_SYSTEM*/
 
+      if (gnupg_chdir (gnupg_daemon_rootdir ()))
+        {
+          log_error ("chdir to '%s' failed: %s\n",
+                     gnupg_daemon_rootdir (), strerror (errno));
+          exit (1);
+        }
+
       log_info ("%s %s started\n", strusage(11), strusage(13) );
       handle_connections (fd, fd_extra, fd_browser, fd_ssh);
       assuan_sock_close (fd);
diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 436c808..5f3a4cd 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -1351,15 +1351,18 @@ main (int argc, char **argv)
           log_set_prefix (NULL, oldflags | GPGRT_LOG_RUN_DETACHED);
           opt.running_detached = 1;
 
+        }
+#endif
+
+      if (!nodetach )
+        {
           if (gnupg_chdir (gnupg_daemon_rootdir ()))
             {
               log_error ("chdir to '%s' failed: %s\n",
                          gnupg_daemon_rootdir (), strerror (errno));
               dirmngr_exit (1);
             }
-
         }
-#endif
 
       thread_init ();
       cert_cache_init (hkp_cacert_filenames);
diff --git a/scd/scdaemon.c b/scd/scdaemon.c
index bf3f42a..60d539d 100644
--- a/scd/scdaemon.c
+++ b/scd/scdaemon.c
@@ -908,6 +908,8 @@ main (int argc, char **argv )
         sigaction (SIGPIPE, &sa, NULL);
       }
 
+#endif /*!HAVE_W32_SYSTEM*/
+
       if (gnupg_chdir (gnupg_daemon_rootdir ()))
         {
           log_error ("chdir to '%s' failed: %s\n",
@@ -915,8 +917,6 @@ main (int argc, char **argv )
           exit (1);
         }
 
-#endif /*!HAVE_W32_SYSTEM*/
-
       handle_connections (fd);
 
       close (fd);

commit 226f143ca01cf335c7c4e3e94c96fb9d271eccc9
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jul 25 12:24:01 2017 +0200

    common: New functions gnupg_daemon_rootdir and gnupg_chdir.
    
    * common/sysutils.c (gnupg_chdir): New.
    * common/homedir.c (gnupg_daemon_rootdir): New.
    * agent/gpg-agent.c (main): Use these functions instead chdir("/").
    * dirmngr/dirmngr.c (main): Ditto.
    * scd/scdaemon.c (main): Ditto.
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
index efaebfd..ef35174 100644
--- a/agent/gpg-agent.c
+++ b/agent/gpg-agent.c
@@ -1708,9 +1708,10 @@ main (int argc, char **argv )
           opt.running_detached = 1;
         }
 
-      if (chdir("/"))
+      if (gnupg_chdir (gnupg_daemon_rootdir ()))
         {
-          log_error ("chdir to / failed: %s\n", strerror (errno));
+          log_error ("chdir to '%s' failed: %s\n",
+                     gnupg_daemon_rootdir (), strerror (errno));
           exit (1);
         }
 
diff --git a/common/homedir.c b/common/homedir.c
index fce6d44..a30e8dc 100644
--- a/common/homedir.c
+++ b/common/homedir.c
@@ -433,6 +433,34 @@ gnupg_default_homedir_p (void)
 }
 
 
+/* Return the directory name used by daemons for their current working
+ * directory.  */
+const char *
+gnupg_daemon_rootdir (void)
+{
+#ifdef HAVE_W32_SYSTEM
+  static char *name;
+
+  if (!name)
+    {
+      char path[MAX_PATH];
+      size_t n;
+
+      n = GetSystemDirectoryA (path, sizeof path);
+      if (!n || n >= sizeof path)
+        name = xstrdup ("/"); /* Error - use the curret top dir instead.  */
+      else
+        name = xstrdup (path);
+    }
+
+  return name;
+
+#else /*!HAVE_W32_SYSTEM*/
+  return "/";
+#endif /*!HAVE_W32_SYSTEM*/
+}
+
+
 /* Helper for gnupg-socketdir.  This is a global function, so that
  * gpgconf can use it for its --create-socketdir command.  If
  * SKIP_CHECKS is set permission checks etc. are not done.  The
diff --git a/common/sysutils.c b/common/sysutils.c
index 1aa2e53..e90010c 100644
--- a/common/sysutils.c
+++ b/common/sysutils.c
@@ -796,6 +796,15 @@ gnupg_mkdir (const char *name, const char *modestr)
 }
 
 
+/* A simple wrapper around chdir.  NAME is expected to be utf8
+ * encoded.  */
+int
+gnupg_chdir (const char *name)
+{
+  return chdir (name);
+}
+
+
 /* A wrapper around chmod which takes a string for the mode argument.
    This makes it easier to handle the mode argument which is not
    defined on all systems.  The format of the modestring is the same
diff --git a/common/sysutils.h b/common/sysutils.h
index e93ea2b..009b14b 100644
--- a/common/sysutils.h
+++ b/common/sysutils.h
@@ -65,7 +65,8 @@ void gnupg_allow_set_foregound_window (pid_t pid);
 int  gnupg_remove (const char *fname);
 gpg_error_t gnupg_rename_file (const char *oldname, const char *newname,
                                int *block_signals);
-int  gnupg_mkdir (const char *name, const char *modestr);
+int gnupg_mkdir (const char *name, const char *modestr);
+int gnupg_chdir (const char *name);
 int gnupg_chmod (const char *name, const char *modestr);
 char *gnupg_mkdtemp (char *template);
 int  gnupg_setenv (const char *name, const char *value, int overwrite);
diff --git a/common/util.h b/common/util.h
index 5b712d3..c6d19c6 100644
--- a/common/util.h
+++ b/common/util.h
@@ -235,6 +235,7 @@ const char *default_homedir (void);
 void gnupg_set_homedir (const char *newdir);
 const char *gnupg_homedir (void);
 int gnupg_default_homedir_p (void);
+const char *gnupg_daemon_rootdir (void);
 const char *gnupg_socketdir (void);
 const char *gnupg_sysconfdir (void);
 const char *gnupg_bindir (void);
diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 6eabca9..436c808 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -1351,11 +1351,13 @@ main (int argc, char **argv)
           log_set_prefix (NULL, oldflags | GPGRT_LOG_RUN_DETACHED);
           opt.running_detached = 1;
 
-          if (chdir("/"))
+          if (gnupg_chdir (gnupg_daemon_rootdir ()))
             {
-              log_error ("chdir to / failed: %s\n", strerror (errno));
+              log_error ("chdir to '%s' failed: %s\n",
+                         gnupg_daemon_rootdir (), strerror (errno));
               dirmngr_exit (1);
             }
+
         }
 #endif
 
diff --git a/scd/scdaemon.c b/scd/scdaemon.c
index 26e89dd..bf3f42a 100644
--- a/scd/scdaemon.c
+++ b/scd/scdaemon.c
@@ -908,9 +908,10 @@ main (int argc, char **argv )
         sigaction (SIGPIPE, &sa, NULL);
       }
 
-      if (chdir("/"))
+      if (gnupg_chdir (gnupg_daemon_rootdir ()))
         {
-          log_error ("chdir to / failed: %s\n", strerror (errno));
+          log_error ("chdir to '%s' failed: %s\n",
+                     gnupg_daemon_rootdir (), strerror (errno));
           exit (1);
         }
 

commit f2d2648a4deb205c26ac869c857c000a95d3ff0c
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jul 25 12:19:08 2017 +0200

    Revert "w32: Change directory on daemon startup."
    
    --
    This reverts commit 78ebc62604d77600b9865950610717d28c6027a2.
    Gnupg-bug-id: 2670

diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
index 90e8a26..efaebfd 100644
--- a/agent/gpg-agent.c
+++ b/agent/gpg-agent.c
@@ -39,7 +39,6 @@
 # endif
 # include <aclapi.h>
 # include <sddl.h>
-# include <direct.h>
 #else /*!HAVE_W32_SYSTEM*/
 # include <sys/socket.h>
 # include <sys/un.h>
@@ -1559,11 +1558,6 @@ main (int argc, char **argv )
       (void)csh_style;
       (void)nodetach;
       initialize_modules ();
-      if (_chdir("\\"))
-        {
-          log_error ("chdir to / failed: %s\n", strerror (errno));
-          exit (1);
-        }
 
 #else /*!HAVE_W32_SYSTEM*/
 
diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index b19b418..6eabca9 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -30,11 +30,9 @@
 #include <assert.h>
 #include <time.h>
 #include <fcntl.h>
-#ifdef HAVE_W32_SYSTEM
-# include <direct.h>
-#else
-# include <sys/socket.h>
-# include <sys/un.h>
+#ifndef HAVE_W32_SYSTEM
+#include <sys/socket.h>
+#include <sys/un.h>
 #endif
 #include <sys/stat.h>
 #include <unistd.h>
@@ -1270,11 +1268,6 @@ main (int argc, char **argv)
 #ifdef HAVE_W32_SYSTEM
       (void)csh_style;
       (void)nodetach;
-      if (_chdir("\\"))
-        {
-          log_error ("chdir to / failed: %s\n", strerror (errno));
-          exit (1);
-        }
 
       pid = getpid ();
       es_printf ("set %s=%s;%lu;1\n",
diff --git a/scd/scdaemon.c b/scd/scdaemon.c
index bbb0433..26e89dd 100644
--- a/scd/scdaemon.c
+++ b/scd/scdaemon.c
@@ -29,11 +29,9 @@
 #include <assert.h>
 #include <time.h>
 #include <fcntl.h>
-#ifdef HAVE_W32_SYSTEM
-# include <direct.h>
-#else
-# include <sys/socket.h>
-# include <sys/un.h>
+#ifndef HAVE_W32_SYSTEM
+#include <sys/socket.h>
+#include <sys/un.h>
 #endif /*HAVE_W32_SYSTEM*/
 #include <unistd.h>
 #include <signal.h>
@@ -813,11 +811,6 @@ main (int argc, char **argv )
 #ifdef HAVE_W32_SYSTEM
       (void)csh_style;
       (void)nodetach;
-      if (_chdir("\\"))
-        {
-          log_error ("chdir to / failed: %s\n", strerror (errno));
-          exit (1);
-        }
 #else
       pid = fork ();
       if (pid == (pid_t)-1)

-----------------------------------------------------------------------

Summary of changes:
 agent/gpg-agent.c | 19 +++++++------------
 common/homedir.c  | 28 ++++++++++++++++++++++++++++
 common/sysutils.c |  9 +++++++++
 common/sysutils.h |  3 ++-
 common/util.h     |  1 +
 dirmngr/dirmngr.c | 24 +++++++++++-------------
 scd/scdaemon.c    | 22 ++++++++--------------
 7 files changed, 66 insertions(+), 40 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 25 14:17:31 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Tue, 25 Jul 2017 14:17:31 +0200
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-270-g883676e
Message-ID: <E1dZymJ-0002Oy-Mr@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  883676e5a8a72c628993df1ad994800c8a9afb21 (commit)
      from  a288530385d9395c64d7fa2c92ecc67ad2d0d67d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 883676e5a8a72c628993df1ad994800c8a9afb21
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Tue Jul 25 14:04:28 2017 +0200

    Ensure that the correct window is enabled again
    
    * src/mail.cpp (encrypt_sign): Store window handle.
    
    --
    This fixes a rare case where the active window changes during
    encrypt and the wrong window would be enabled again. This would
    result in an unsresponsive Outlook.

diff --git a/src/mail.cpp b/src/mail.cpp
index 027d71e..f0a32b8 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -904,7 +904,9 @@ Mail::encrypt_sign ()
     }
   flags = get_gpgol_draft_info_flags (message);
 
-  EnableWindow (get_active_hwnd(), FALSE);
+  const auto window = get_active_hwnd ();
+
+  EnableWindow (window, FALSE);
   if (flags == 3)
     {
       log_debug ("%s:%s: Sign / Encrypting message",
@@ -929,7 +931,7 @@ Mail::encrypt_sign ()
     }
   log_debug ("%s:%s: Status: %i",
              SRCNAME, __func__, err);
-  EnableWindow (get_active_hwnd(), TRUE);
+  EnableWindow (window, TRUE);
   gpgol_release (message);
   m_crypt_successful = !err;
   return err;

-----------------------------------------------------------------------

Summary of changes:
 src/mail.cpp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 25 15:36:56 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Tue, 25 Jul 2017 15:36:56 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-155-g24c7aa0
Message-ID: <E1da01A-0005p3-QT@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  24c7aa0d58e3768690dd8ebef0e8e01af7e80f83 (commit)
      from  0ef50340ef68b2541d9a1aafa71f5400aef4dc7e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 24c7aa0d58e3768690dd8ebef0e8e01af7e80f83
Author: Werner Koch <wk at gnupg.org>
Date:   Tue Jul 25 15:22:48 2017 +0200

    common: Strip trailing slashes from the homedir.
    
    * common/homedir.c (default_homedir): Strip trailing slashes.
    (gnupg_set_homedir): Ditto.
    
    --
    
    is_gnupg_default_homedir() does not ignore trailing slashes when
    comparing directory names.  This can lead to multiple agents started
    on the same directory if the homedir was specified with --homedir or
    GNUPGHOME without or with a number of slashes.
    
    We now make sure that the home directory name never ends in a
    slash (except for the roo of course).
    
    GnuPG-bug-id: 3295
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/homedir.c b/common/homedir.c
index a30e8dc..149e1ec 100644
--- a/common/homedir.c
+++ b/common/homedir.c
@@ -247,7 +247,7 @@ default_homedir (void)
         {
           if (!dir || !*dir)
             {
-              char *tmp;
+              char *tmp, *p;
 
               tmp = read_w32_registry_string (NULL,
                                               GNUPG_REGISTRY_DIR,
@@ -258,7 +258,13 @@ default_homedir (void)
                   tmp = NULL;
                 }
               if (tmp)
-                saved_dir = tmp;
+                {
+                  /* Strip trailing backslashes.  */
+                  p = tmp + strlen (tmp) - 1;
+                  while (p > tmp && *p == '\\')
+                    *p-- = 0;
+                  saved_dir = tmp;
+                }
             }
 
           if (!saved_dir)
@@ -267,10 +273,27 @@ default_homedir (void)
       dir = saved_dir;
     }
 #endif /*HAVE_W32_SYSTEM*/
+
   if (!dir || !*dir)
     dir = GNUPG_DEFAULT_HOMEDIR;
-  else if (!is_gnupg_default_homedir (dir))
-    non_default_homedir = 1;
+  else
+    {
+      /* Strip trailing slashes if any.  */
+      if (dir[strlen (dir)-1] == '/')
+        {
+          char *tmp, *p;
+
+          tmp = xstrdup (dir);
+          p = tmp + strlen (tmp) - 1;
+          while (p > tmp && *p == '/')
+            *p-- = 0;
+
+          dir = tmp;
+        }
+
+      if (!is_gnupg_default_homedir (dir))
+        non_default_homedir = 1;
+    }
 
   return dir;
 }
@@ -403,12 +426,40 @@ w32_commondir (void)
 void
 gnupg_set_homedir (const char *newdir)
 {
+  char *tmp = NULL;
+
   if (!newdir || !*newdir)
     newdir = default_homedir ();
-  else if (!is_gnupg_default_homedir (newdir))
-    non_default_homedir = 1;
+  else
+    {
+      /* Remove trailing slashes from NEWSDIR.  */
+      if (newdir[strlen (newdir)-1] == '/'
+#ifdef HAVE_W32_SYSTEM
+          || newdir[strlen (newdir)-1] == '\\'
+#endif
+          )
+        {
+          char *p;
+
+          tmp = xstrdup (newdir);
+          p = tmp + strlen (tmp) - 1;
+          while (p > tmp
+                 && (*p == '/'
+#ifdef HAVE_W32_SYSTEM
+                     || *p == '\\'
+#endif
+                     )
+                 )
+            *p-- = 0;
+
+          newdir = tmp;
+        }
+      if (!is_gnupg_default_homedir (newdir))
+        non_default_homedir = 1;
+    }
   xfree (the_gnupg_homedir);
   the_gnupg_homedir = make_absfilename (newdir, NULL);;
+  xfree (tmp);
 }
 
 
diff --git a/configure.ac b/configure.ac
index 02ee1a2..764a62d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -486,7 +486,8 @@ AH_BOTTOM([
 #define SAFE_VERSION_DOT  '.'
 #define SAFE_VERSION_DASH '-'
 
-/* Some global constants. */
+/* Some global constants.
+ * Note that the homedir must not end in a slash.  */
 #ifdef HAVE_DOSISH_SYSTEM
 # ifdef HAVE_DRIVE_LETTERS
 #  define GNUPG_DEFAULT_HOMEDIR "c:/gnupg"

-----------------------------------------------------------------------

Summary of changes:
 common/homedir.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++------
 configure.ac     |  3 ++-
 2 files changed, 59 insertions(+), 7 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Tue Jul 25 23:09:43 2017
From: cvs at cvs.gnupg.org (by Damien Goutte-Gattat)
Date: Tue, 25 Jul 2017 23:09:43 +0200
Subject: [git] Scute - branch, master, updated. scute-1.5.0-2-ga9a229a
Message-ID: <E1da75L-00069A-Ve@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "PKCS#11 token on top of gpg-agent".

The branch, master has been updated
       via  a9a229a7f4a8920a7cc335f7a8bf0b5736ebec64 (commit)
      from  ce7fb4ad5404fdc74f2ab214bc5a70d0fbb60cc8 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a9a229a7f4a8920a7cc335f7a8bf0b5736ebec64
Author: Damien Goutte-Gattat <dgouttegattat at incenp.org>
Date:   Mon Jul 24 11:33:20 2017 +0200

    doc: Revert bug report address to bugs.gnupg.org.
    
    --
    
    In agreement with Werner's decision as stated in GnuPG commit
    5dac85fba780: bugs.gnupg.org is the canonical bug report address,
    independently of what the current development platform is.
    
    Signed-off-by: Damien Goutte-Gattat <dgouttegattat at incenp.org>

diff --git a/AUTHORS b/AUTHORS
index 2ce5e4a..70007d6 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -1,6 +1,6 @@
 Package: scute
 Maintainer: Damien Goutte-Gattat <dgouttegattat at incenp.org>
-Bug reports: https://dev.gnupg.org/
+Bug reports: https://bugs.gnupg.org/
 Security related bug reports: security at gnupg.org
 License: GPLv2+ with exception for Mozilla
 
diff --git a/configure.ac b/configure.ac
index 618d845..3615a49 100644
--- a/configure.ac
+++ b/configure.ac
@@ -57,7 +57,7 @@ m4_define([mym4_version],      m4_argn(4, mym4_verslist))
 m4_define([mym4_revision],     m4_argn(7, mym4_verslist))
 m4_define([mym4_revision_dec], m4_argn(8, mym4_verslist))
 m4_esyscmd([echo ]mym4_version[>VERSION])
-AC_INIT([mym4_package],[mym4_version], [https://dev.gnupg.org])
+AC_INIT([mym4_package],[mym4_version], [https://bugs.gnupg.org])
 
 # LT Version numbers, remember to change them just *before* a release.
 #   (Code changed:			REVISION++)
diff --git a/doc/website/contact.xhtml b/doc/website/contact.xhtml
index 7fbe731..d1e306b 100644
--- a/doc/website/contact.xhtml
+++ b/doc/website/contact.xhtml
@@ -61,7 +61,7 @@
 	<h2>Bug Reports</h2>
 	<p>
 	  All bug reports should be submitted to our <a
-	  href="https://dev.gnupg.org/">bug tracking system</a> or
+	  href="https://bugs.gnupg.org/">bug tracking system</a> or
 	  sent via e-mail to the <a
 	  href="http://lists.gnupg.org/mailman/listinfo/gnupg-devel">GnuPG
 	  development mailing list.</a> Sensitive information can also

-----------------------------------------------------------------------

Summary of changes:
 AUTHORS                   | 2 +-
 configure.ac              | 2 +-
 doc/website/contact.xhtml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
PKCS#11 token on top of gpg-agent
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 26 10:41:30 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 26 Jul 2017 10:41:30 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-157-gd50c2ef
Message-ID: <E1daHsq-0001sN-8v@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  d50c2eff8d6931586c527edb3dea98dbc6facdec (commit)
       via  f4ec7697a9c2d7587794d3bd75efbb0b51d6562f (commit)
      from  24c7aa0d58e3768690dd8ebef0e8e01af7e80f83 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d50c2eff8d6931586c527edb3dea98dbc6facdec
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 26 10:02:52 2017 +0200

    agent,dirmngr: Check for homedir removal also using stat(2).
    
    * agent/gpg-agent.c (have_homedir_inotify): New var.
    (reliable_homedir_inotify): New var.
    (main):  Set reliable_homedir_inotify.
    (handle_tick): Call stat on the homedir.
    (handle_connections): Mark availibility of the inotify watch.
    * dirmngr/dirmngr.c (handle_tick): Call stat on the homedir.
    (TIMERTICK_INTERVAL_SHUTDOWN): New.
    (handle_connections): Depend tick interval on the shutdown state.
    --
    
    The stat call is used on systems which do not support inotify and also
    when we assume that the inotify does not work reliable.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
index 2906cc3..e4fdf2e 100644
--- a/agent/gpg-agent.c
+++ b/agent/gpg-agent.c
@@ -380,10 +380,20 @@ static const char *debug_level;
 static char *current_logfile;
 
 /* The handle_tick() function may test whether a parent is still
-   running.  We record the PID of the parent here or -1 if it should be
-   watched. */
+ * running.  We record the PID of the parent here or -1 if it should
+ * be watched.  */
 static pid_t parent_pid = (pid_t)(-1);
 
+/* This flag is true if the inotify mechanism for detecting the
+ * removal of the homedir is active.  This flag is used to disable the
+ * alternative but portable stat based check.  */
+static int have_homedir_inotify;
+
+/* Depending on how gpg-agent was started, the homedir inotify watch
+ * may not be reliable.  This flag is set if we assume that inotify
+ * works reliable.  */
+static int reliable_homedir_inotify;
+
 /* Number of active connections.  */
 static int active_connections;
 
@@ -1704,6 +1714,12 @@ main (int argc, char **argv )
           log_get_prefix (&oldflags);
           log_set_prefix (NULL, oldflags | GPGRT_LOG_RUN_DETACHED);
           opt.running_detached = 1;
+
+          /* Unless we are running with a program given on the command
+           * line we can assume that the inotify things works and thus
+           * we can avoid tye regular stat calls.  */
+          if (!argc)
+            reliable_homedir_inotify = 1;
         }
 
       {
@@ -2297,6 +2313,7 @@ static void
 handle_tick (void)
 {
   static time_t last_minute;
+  struct stat statbuf;
 
   if (!last_minute)
     last_minute = time (NULL);
@@ -2329,6 +2346,14 @@ handle_tick (void)
     }
 #endif
 
+  /* Check whether the homedir is still available.  */
+  if (!shutdown_pending
+      && (!have_homedir_inotify || !reliable_homedir_inotify)
+      && stat (gnupg_homedir (), &statbuf) && errno == ENOENT)
+    {
+      shutdown_pending = 1;
+      log_info ("homedir has been removed - shutting down\n");
+    }
 }
 
 
@@ -2803,9 +2828,11 @@ handle_connections (gnupg_fd_t listen_fd,
                                                    gnupg_homedir ())))
     {
       if (gpg_err_code (err) != GPG_ERR_NOT_SUPPORTED)
-        log_info ("error enabling daemon termination bu homedir removal: %s\n",
+        log_info ("error enabling daemon termination by homedir removal: %s\n",
                   gpg_strerror (err));
     }
+  else
+    have_homedir_inotify = 1;
 
   /* On Windows we need to fire up a separate thread to listen for
      requests from Putty (an SSH client), so we can replace Putty's
diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 5f3a4cd..1ddc568 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -334,8 +334,9 @@ static int network_activity_seen;
 static strlist_t hkp_cacert_filenames;
 
 
-/* The timer tick used for housekeeping stuff.  */
-#define TIMERTICK_INTERVAL         (60)
+/* The timer tick used for housekeeping stuff.  The second constant is used when a shutdown is pending.  */
+#define TIMERTICK_INTERVAL           (60)
+#define TIMERTICK_INTERVAL_SHUTDOWN  (4)
 
 /* How oft to run the housekeeping.  */
 #define HOUSEKEEPING_INTERVAL      (600)
@@ -1967,6 +1968,8 @@ time_for_housekeeping_p (time_t curtime)
 static void
 handle_tick (void)
 {
+  struct stat statbuf;
+
   if (time_for_housekeeping_p (gnupg_get_time ()))
     {
       npth_t thread;
@@ -1986,6 +1989,14 @@ handle_tick (void)
           npth_attr_destroy (&tattr);
         }
     }
+
+  /* Check whether the homedir is still available.  */
+  if (!shutdown_pending
+      && stat (gnupg_homedir (), &statbuf) && errno == ENOENT)
+    {
+      shutdown_pending = 1;
+      log_info ("homedir has been removed - shutting down\n");
+    }
 }
 
 
@@ -2179,10 +2190,13 @@ handle_connections (assuan_fd_t listen_fd)
       npth_clock_gettime (&curtime);
       if (!(npth_timercmp (&curtime, &abstime, <)))
 	{
-	  /* Timeout.  */
+	  /* Timeout.  When a shutdown is pending we use a shorter
+           * interval to handle the shutdown more quickly.  */
 	  handle_tick ();
 	  npth_clock_gettime (&abstime);
-	  abstime.tv_sec += TIMERTICK_INTERVAL;
+	  abstime.tv_sec += (shutdown_pending
+                             ? TIMERTICK_INTERVAL_SHUTDOWN
+                             : TIMERTICK_INTERVAL);
 	}
       npth_timersub (&abstime, &curtime, &timeout);
 

commit f4ec7697a9c2d7587794d3bd75efbb0b51d6562f
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 26 09:55:51 2017 +0200

    agent: Lengthen timertick interval on Unix to 4 seconds.
    
    * agent/gpg-agent.c (TIMERTICK_INTERVAL): Same value for Windows and
    Unix.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
index 36c05bc..2906cc3 100644
--- a/agent/gpg-agent.c
+++ b/agent/gpg-agent.c
@@ -276,19 +276,17 @@ static struct debug_flags_s debug_flags [] =
 #define MIN_PASSPHRASE_NONALPHA (1)
 #define MAX_PASSPHRASE_DAYS   (0)
 
-/* The timer tick used for housekeeping stuff.  For Windows we use a
-   longer period as the SetWaitableTimer seems to signal earlier than
-   the 2 seconds.  CHECK_OWN_SOCKET_INTERVAL defines how often we
-   check our own socket in standard socket mode.  If that value is 0
-   we don't check at all.   All values are in seconds. */
+/* The timer tick used for housekeeping stuff.  Note that on Windows
+ * we use a SetWaitableTimer seems to signal earlier than about 2
+ * seconds.  Thus we use 4 seconds on all platforms except for
+ * Windowsce.  CHECK_OWN_SOCKET_INTERVAL defines how often we check
+ * our own socket in standard socket mode.  If that value is 0 we
+ * don't check at all.  All values are in seconds. */
 #if defined(HAVE_W32CE_SYSTEM)
 # define TIMERTICK_INTERVAL         (60)
 # define CHECK_OWN_SOCKET_INTERVAL   (0)  /* Never */
-#elif defined(HAVE_W32_SYSTEM)
-# define TIMERTICK_INTERVAL          (4)
-# define CHECK_OWN_SOCKET_INTERVAL  (60)
 #else
-# define TIMERTICK_INTERVAL          (2)
+# define TIMERTICK_INTERVAL          (4)
 # define CHECK_OWN_SOCKET_INTERVAL  (60)
 #endif
 

-----------------------------------------------------------------------

Summary of changes:
 agent/gpg-agent.c | 49 +++++++++++++++++++++++++++++++++++++------------
 dirmngr/dirmngr.c | 22 ++++++++++++++++++----
 2 files changed, 55 insertions(+), 16 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 26 13:54:57 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 26 Jul 2017 13:54:57 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-159-gc5e5748
Message-ID: <E1daKu3-00074d-1i@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  c5e5748480952e5bcedb16f6ce6ef7e435acb3c7 (commit)
       via  fd68bdb61ec4f8441da6d3023a8da4315df54cec (commit)
      from  d50c2eff8d6931586c527edb3dea98dbc6facdec (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c5e5748480952e5bcedb16f6ce6ef7e435acb3c7
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 26 13:48:27 2017 +0200

    dirmngr: Do not use a blocking connect in Tor mode.
    
    * dirmngr/http.c (http_raw_connect): Disable the timeout in Tor mode.
    (send_request): Ditto.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 63ed5d3..0bedba0 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -955,6 +955,10 @@ http_raw_connect (http_t *r_hd, const char *server, unsigned short port,
           log_error ("Tor support is not available\n");
           return gpg_err_make (default_errsource, GPG_ERR_NOT_IMPLEMENTED);
         }
+      /* Non-blocking connects do not work with our Tor proxy because
+       * we can't continue the Socks protocol after the EINPROGRESS.
+       * Disable the timeout to use a blocking connect.  */
+      timeout = 0;
     }
 
   /* Create the handle. */
@@ -1698,6 +1702,10 @@ send_request (http_t hd, const char *httphost, const char *auth,
           log_error ("Tor support is not available\n");
           return gpg_err_make (default_errsource, GPG_ERR_NOT_IMPLEMENTED);
         }
+      /* Non-blocking connects do not work with our Tor proxy because
+       * we can't continue the Socks protocol after the EINPROGRESS.
+       * Disable the timeout to use a blocking connect.  */
+      timeout = 0;
     }
 
   server = *hd->uri->host ? hd->uri->host : "localhost";
diff --git a/dirmngr/t-http.c b/dirmngr/t-http.c
index b0f2bcf..440633d 100644
--- a/dirmngr/t-http.c
+++ b/dirmngr/t-http.c
@@ -40,6 +40,7 @@
 
 #include "../common/util.h"
 #include "../common/logging.h"
+#include "dns-stuff.h"
 #include "http.h"
 
 #include <ksba.h>
@@ -312,9 +313,25 @@ main (int argc, char **argv)
   if (!cafile)
     cafile = prepend_srcdir ("tls-ca.pem");
 
+  if (verbose)
+    my_http_flags |= HTTP_FLAG_LOG_RESP;
+
+  if (verbose || debug)
+    http_set_verbose (verbose, debug);
+
   /* http.c makes use of the assuan socket wrapper.  */
   assuan_sock_init ();
 
+  if ((my_http_flags & HTTP_FLAG_FORCE_TOR))
+    {
+      enable_dns_tormode (1);
+      if (assuan_sock_set_flag (ASSUAN_INVALID_FD, "tor-mode", 1))
+        {
+          log_error ("error enabling Tor mode: %s\n", strerror (errno));
+          log_info ("(is your Libassuan recent enough?)\n");
+        }
+    }
+
 #if HTTP_USE_NTBTLS
   log_info ("new session.\n");
   err = http_session_new (&session, NULL,

commit fd68bdb61ec4f8441da6d3023a8da4315df54cec
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 26 10:58:15 2017 +0200

    dirmngr: Auto-enable Tor on startup or reload.
    
    * dirmngr/dirmngr.c (dirmngr_use_tor): Test for Tor availibility.
    --
    
    GnuPG-bug-id: 2935
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index 1ddc568..0d133c6 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -532,7 +532,17 @@ dirmngr_use_tor (void)
 {
   if (tor_mode == TOR_MODE_AUTO)
     {
-      /* FIXME: Figure out whether Tor is running.  */
+      /* Figure out whether Tor is running.  */
+      assuan_fd_t sock;
+
+      sock = assuan_sock_connect_byname (NULL, 0, 0, NULL, ASSUAN_SOCK_TOR);
+      if (sock == ASSUAN_INVALID_FD)
+        tor_mode = TOR_MODE_NO;
+      else
+        {
+          tor_mode = TOR_MODE_YES;
+          assuan_sock_close (sock);
+        }
     }
 
   if (tor_mode == TOR_MODE_FORCE)
diff --git a/dirmngr/server.c b/dirmngr/server.c
index 4f5a3b2..7ed6cde 100644
--- a/dirmngr/server.c
+++ b/dirmngr/server.c
@@ -308,8 +308,8 @@ strcpy_escaped_plus (char *d, const unsigned char *s)
 }
 
 
-/* This function returns true if a Tor server is running.  The sattus
-   is cached for the current connection.  */
+/* This function returns true if a Tor server is running.  The status
+ * is cached for the current connection.  */
 static int
 is_tor_running (ctrl_t ctrl)
 {
diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
index 64b24f9..eef78a8 100644
--- a/doc/dirmngr.texi
+++ b/doc/dirmngr.texi
@@ -243,10 +243,16 @@ Enabling this option forces loading of expired CRLs; this is only
 useful for debugging.
 
 @item --use-tor
+ at itemx --no-use-tor
 @opindex use-tor
-This option switches Dirmngr and thus GnuPG into ``Tor mode'' to route
-all network access via Tor (an anonymity network).  Certain other
-features are disabled if this mode is active.
+ at opindex no-use-tor
+The option @option{--use-tor} switches Dirmngr and thus GnuPG into
+``Tor mode'' to route all network access via Tor (an anonymity
+network).  Certain other features are disabled in this mode.  The
+effect of @option{--use-tor} cannot be overridden by any other command
+or even be reloading gpg-agent.  The use of @option{--no-use-tor}
+disables the use of Tor.  The default is to use Tor if it is available
+on startup or after reloading dirmngr.
 
 @item --standard-resolver
 @opindex standard-resolver

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/dirmngr.c | 12 +++++++++++-
 dirmngr/http.c    |  8 ++++++++
 dirmngr/server.c  |  4 ++--
 dirmngr/t-http.c  | 17 +++++++++++++++++
 doc/dirmngr.texi  | 12 +++++++++---
 5 files changed, 47 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 26 15:08:05 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Wed, 26 Jul 2017 15:08:05 +0200
Subject: [git] GPGME - branch, master, updated. gpgme-1.9.0-56-gc7be41a
Message-ID: <E1daM2n-0002Ct-Ub@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  c7be41a5f850addceb2a95444bad2a31cdcd1ce5 (commit)
      from  7fde780cc1773c6d3902d4f49a8d4aadbf3223d4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit c7be41a5f850addceb2a95444bad2a31cdcd1ce5
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Jul 26 15:07:27 2017 +0200

    cpp: Fix Key::isDeVs for subkeys
    
    * lang/cpp/src/key.cpp (Key::isDeVs): Check all subkeys.
    
    --
    Previosly only the primary key was checked and not all subkeys.

diff --git a/lang/cpp/src/key.cpp b/lang/cpp/src/key.cpp
index 31e59e1..66fdea9 100644
--- a/lang/cpp/src/key.cpp
+++ b/lang/cpp/src/key.cpp
@@ -236,7 +236,18 @@ bool Key::isQualified() const
 
 bool Key::isDeVs() const
 {
-    return key && key->subkeys && key->subkeys->is_de_vs;
+    if (!key) {
+        return false;
+    }
+    if (!key->subkeys || !key->subkeys->is_de_vs) {
+        return false;
+    }
+    for (gpgme_sub_key_t subkey = key->subkeys ; subkey ; subkey = subkey->next) {
+        if (!subkey->is_de_vs) {
+            return false;
+        }
+    }
+    return true;
 }
 
 const char *Key::issuerSerial() const

-----------------------------------------------------------------------

Summary of changes:
 lang/cpp/src/key.cpp | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 26 15:49:13 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Wed, 26 Jul 2017 15:49:13 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-160-g4f569c6
Message-ID: <E1daMgc-0000AZ-DQ@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  4f569c69075fddbaea588544a6625c28cb4cb8f4 (commit)
      from  c5e5748480952e5bcedb16f6ce6ef7e435acb3c7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4f569c69075fddbaea588544a6625c28cb4cb8f4
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Wed Jul 26 15:48:02 2017 +0200

    doc: Update vsnfd profile example
    
    * doc/examples/vsnfd.prf: Use rsa3072
    
    --
    This brings it in line with the requested default for vsnfd.

diff --git a/doc/examples/vsnfd.prf b/doc/examples/vsnfd.prf
index 17c6d4c..e8732de 100644
--- a/doc/examples/vsnfd.prf
+++ b/doc/examples/vsnfd.prf
@@ -2,7 +2,7 @@
 
 [gpg]
 compliance de-vs
-default-new-key-algo brainpoolP256r1+brainpoolP256r1
+default-new-key-algo rsa3072/cert,sign+rsa3072/encr
 
 [gpgsm]
 enable-crl-checks

-----------------------------------------------------------------------

Summary of changes:
 doc/examples/vsnfd.prf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 26 17:58:15 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Wed, 26 Jul 2017 17:58:15 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-163-gbe636c3
Message-ID: <E1daOhU-00037M-OX@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  be636c3cfca178927b09ef4154c3e555d6f5b1c4 (commit)
       via  c76398da5b15df2086f68bc26b7fde75219976c7 (commit)
       via  b428dd495a1a960de0da27976bf50b191b6a1ddf (commit)
      from  4f569c69075fddbaea588544a6625c28cb4cb8f4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit be636c3cfca178927b09ef4154c3e555d6f5b1c4
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 26 17:51:03 2017 +0200

    doc: Add man pages form gpg-wks-server and gpg-wks-client.
    
    * doc/wks.texi: New.
    * doc/gnupg.texi: Include wks.texi.
    * doc/Makefile.am (gnupg_TEXINFOS): Add wks.texi.
    (myman_pages): Add new man pages.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/doc/Makefile.am b/doc/Makefile.am
index 1fa04b4..89079b3 100644
--- a/doc/Makefile.am
+++ b/doc/Makefile.am
@@ -68,7 +68,7 @@ nobase_dist_doc_DATA = FAQ DETAILS HACKING DCO TRANSLATE OpenPGP KEYSERVER \
 gnupg_TEXINFOS = \
 	gpg.texi gpgsm.texi gpg-agent.texi scdaemon.texi instguide.texi \
 	tools.texi debugging.texi glossary.texi contrib.texi gpl.texi \
-	sysnotes.texi dirmngr.texi \
+	sysnotes.texi dirmngr.texi wks.texi \
         gnupg-module-overview.svg \
         gnupg-card-architecture.fig \
 	howtos.texi howto-create-a-server-cert.texi
@@ -88,11 +88,11 @@ YAT2M_OPTIONS = -I $(srcdir) \
         --release "GnuPG @PACKAGE_VERSION@" --source "GNU Privacy Guard 2.1"
 
 myman_sources = gnupg7.texi gpg.texi gpgsm.texi gpg-agent.texi \
-	        dirmngr.texi scdaemon.texi tools.texi
+	        dirmngr.texi scdaemon.texi tools.texi wks.texi
 myman_pages   = gpgsm.1 gpg-agent.1 dirmngr.8 scdaemon.1 \
                 watchgnupg.1 gpgconf.1 addgnupghome.8 gpg-preset-passphrase.1 \
 		gpg-connect-agent.1 gpgparsemail.1 symcryptrun.1 \
-		applygnupgdefaults.8 \
+		applygnupgdefaults.8 gpg-wks-client.1 gpg-wks-server.1 \
 		dirmngr-client.1
 if USE_GPG2_HACK
 myman_pages += gpg2.1 gpgv2.1
diff --git a/doc/gnupg.texi b/doc/gnupg.texi
index c99c129..7154fc8 100644
--- a/doc/gnupg.texi
+++ b/doc/gnupg.texi
@@ -45,7 +45,7 @@ Published by The GnuPG Project@*
 
 @copyright{} 2002, 2004, 2005, 2006, 2007, 2010 Free Software Foundation, Inc.@*
 @copyright{} 2013, 2014, 2015 Werner Koch.@*
- at copyright{} 2015 g10 Code GmbH.
+ at copyright{} 2015, 2016, 2017 g10 Code GmbH.
 
 @quotation
 Permission is granted to copy, distribute and/or modify this document
@@ -142,6 +142,7 @@ the administration and the architecture.
 * Specify a User ID::   How to Specify a User Id.
 
 * Helper Tools::        Description of small helper tools
+* Web Key Service::     Tools for the Web Key Service
 
 * Howtos::              How to do certain things.
 * System Notes::        Notes pertaining to certain OSes.
@@ -180,6 +181,7 @@ the administration and the architecture.
 
 
 @include tools.texi
+ at include wks.texi
 
 @include howtos.texi
 
diff --git a/doc/wks.texi b/doc/wks.texi
new file mode 100644
index 0000000..f9b1a0c
--- /dev/null
+++ b/doc/wks.texi
@@ -0,0 +1,340 @@
+ at c wks.texi - man pages for the Web Key Service tools.
+ at c Copyright (C) 2017 g10 Code GmbH
+ at c Copyright (C) 2017 Bundesamt f?r Sicherheit in der Informationstechnik
+ at c This is part of the GnuPG manual.
+ at c For copying conditions, see the file GnuPG.texi.
+
+ at include defs.inc
+
+ at node Web Key Service
+ at chapter Web Key Service
+
+GnuPG comes with tools used to maintain and access a Web Key
+Directory.
+
+ at menu
+* gpg-wks-client::        Send requests via WKS
+* gpg-wks-server::        Server to provide the WKS.
+ at end menu
+
+ at c
+ at c  GPG-WKS-CLIENT
+ at c
+ at manpage gpg-wks-client.1
+ at node gpg-wks-client
+ at section Send requests via WKS
+ at ifset manverb
+.B gpg-wks-client
+\- Client for the Web Key Service
+ at end ifset
+
+ at mansect synopsis
+ at ifset manverb
+.B gpg-wks-client
+.RI [ options ]
+.B \-\-supported
+.I user-id
+.br
+.B gpg-wks-client
+.RI [ options ]
+.B \-\-check
+.I user-id
+.br
+.B gpg-wks-client
+.RI [ options ]
+.B \-\-create
+.I fingerprint
+.I user-id
+.br
+.B gpg-wks-client
+.RI [ options ]
+.B \-\-receive
+.br
+.B gpg-wks-client
+.RI [ options ]
+.B \-\-read
+ at end ifset
+
+ at mansect description
+The @command{gpg-wks-client} is used to send requests to a Web Key
+Service provider.  This is usuallay done to upload a key into a Web
+Key Directory.
+
+With the @option{--supported} command the caller can test whether a
+site supports the Web Key Service.  The argument is an arbitray
+address in the to be tested domain. For example
+ at file{foo@@example.net}.  The command returns success if the Web Key
+Service is supported.  The operation is silent; to get diagnostic
+output use the option @option{--verbose}.
+
+With the @option{--check} command the caller can test whether a key
+exists for a supplied mail address.  The command returns success if a
+key is available.
+
+The @option{--create} command is used to send a request for
+publication in the Web Key Directory.  The arguments are the
+fingerprint of the key and the user id to publish.  The output from
+the command is a properly formatted mail with all standard headers.
+This mail can be fed to @command{sendmail(8)} or any other tool to
+actually send that mail.  If @command{sendmail(8)} is installed the
+option @option{--send} can be used to directly send the created
+request.
+
+The @option{--receive} and @option{--read} commands are used to
+process confirmation mails as send from the service provider.  The
+former expects an encrypted MIME messages, the latter an already
+decrypted MIME message.  The result of these commands are another mail
+which can be send in the same way as the mail created with
+ at option{--create}.
+
+ at command{gpg-wks-client} is not commonly invoked directly and thus it
+is not installed in the bin directory.  Here is an example how it can
+be invoked manually to check for a Web Key Directory entry for
+ at file{foo@@example.org}:
+
+ at example
+$(gpgconf --list-dirs libexecdir)/gpg-wks-client --check foo@@example.net
+ at end example
+
+ at mansect options
+ at noindent
+ at command{gpg-wks-client} understands these options:
+
+ at table @gnupgtabopt
+
+ at item --send
+ at opindex send
+Directly send created mails using the @command{sendmail} command.
+Requires installation of that command.
+
+ at item --output @var{file}
+ at itemx -o
+ at opindex output
+Write the created mail to @var{file} instead of stdout.  Note that the
+value @code{-} for @var{file} is the same as writing to stdout.
+
+ at item --status-fd @var{n}
+ at opindex status-fd
+Write special status strings to the file descriptor @var{n}.
+This program returns only the status messages SUCCESS or FAILURE which
+are helpful when the caller uses a double fork approach and can't
+easily get the return code of the process.
+
+ at item --verbose
+ at opindex verbose
+Enable extra informational output.
+
+ at item --quiet
+ at opindex quiet
+Disable almost all informational output.
+
+ at item --version
+ at opindex version
+Print version of the program and exit.
+
+ at item --help
+ at opindex help
+Display a brief help page and exit.
+
+ at end table
+
+
+ at mansect see also
+ at ifset isman
+ at command{gpg-wks-server}(1)
+ at end ifset
+
+
+ at c
+ at c  GPG-WKS-SERVER
+ at c
+ at manpage gpg-wks-server.1
+ at node gpg-wks-server
+ at section Provide the Web Key Service
+ at ifset manverb
+.B gpg-wks-server
+\- Server providing the Web Key Service
+ at end ifset
+
+ at mansect synopsis
+ at ifset manverb
+.B gpg-wks-server
+.RI [ options ]
+.B \-\-receive
+.br
+.B gpg-wks-server
+.RI [ options ]
+.B \-\-cron
+.br
+.B gpg-wks-server
+.RI [ options ]
+.B \-\-list-domains
+.br
+.B gpg-wks-server
+.RI [ options ]
+.B \-\-install-key
+.I file
+.br
+.B gpg-wks-server
+.RI [ options ]
+.B \-\-remove-key
+.I mailaddr
+.br
+.B gpg-wks-server
+.RI [ options ]
+.B \-\-revoke-key
+.I mailaddr
+ at end ifset
+
+ at mansect description
+The @command{gpg-wks-server} is a server site implementation of the
+Web Key Service.  It receives requests for publication, sends
+confirmation requests, receives confirmations, and published the key.
+It also has features to ease the setup and maintenance of a Web Key
+Directory.
+
+When used with the command @option{--receive} a single Web Key Service
+mail is processed.  Commonly this command is used with the option
+ at option{--send} to directly send the crerated mails back.  See below
+for an installation example.
+
+The command @option{--cron} is used for regualr cleanup tasks.  For
+example non-confirmed requested should be removed after their expire
+time.  It is best to run this command once a day from a cronjob.
+
+The command @option{--list-domains} prints all configured domains.
+Further it creates missing directories for the configuration and
+prints warnings pertaining to problems in the configuration.
+
+The commands @option{--install-key}, @option{--remove-key}, and
+ at option{--revoke-key} are not yet functional.
+
+
+ at mansect options
+ at noindent
+ at command{gpg-wks-server} understands these options:
+
+ at table @gnupgtabopt
+
+ at item --from @var{mailaddr}
+ at opindex from
+Use @var{mailaddr} as the default sender address.
+
+ at item --header @var{name}=@var{value}
+ at opindex header
+Add the mail header "@var{name}: @var{value}" to all outgoing mails.
+
+ at item --send
+ at opindex send
+Directly send created mails using the @command{sendmail} command.
+Requires installation of that command.
+
+ at item --output @var{file}
+ at itemx -o
+ at opindex output
+Write the created mail also to @var{file}. Note that the value
+ at code{-} for @var{file} would write it to stdout.
+
+ at item --verbose
+ at opindex verbose
+Enable extra informational output.
+
+ at item --quiet
+ at opindex quiet
+Disable almost all informational output.
+
+ at item --version
+ at opindex version
+Print version of the program and exit.
+
+ at item --help
+ at opindex help
+Display a brief help page and exit.
+
+ at end table
+
+ at noindent
+ at mansect examples
+ at chapheading Examples
+
+The Web Key Service requires a working directory to store keys
+pending for publication.  As root create a working directory:
+
+ at example
+  # mkdir /var/lib/gnupg/wks
+  # chown webkey:webkey /var/lib/gnupg/wks
+  # chmod 2750 /var/lib/gnupg/wks
+ at end example
+
+Then under your webkey account create directories for all your
+domains.  Here we do it for "example.net":
+
+ at example
+  $ mkdir /var/lib/gnupg/wks/example.net
+ at end example
+
+Finally run
+
+ at example
+  $ gpg-wks-server --list-domains
+ at end example
+
+to create the required sub-directories with the permission set
+correctly.  For each domain a submission address needs to be
+configured.  All service mails are directed to that address.  It can
+be the same address for all configured domains, for example:
+
+ at example
+  $ cd /var/lib/gnupg/wks/example.net
+  $ echo key-submission@@example.net >submission-address
+ at end example
+
+The protocol requires that the key to be published is sent with an
+encrypted mail to the service.  Thus you need to create a key for
+the submission address:
+
+ at example
+  $ gpg --batch --passphrase '' --quick-gen-key key-submission@@example.net
+  $ gpg --with-wkd-hash -K key-submission@@example.net
+ at end example
+
+The output of the last command looks similar to this:
+
+ at example
+  sec   rsa2048 2016-08-30 [SC]
+        C0FCF8642D830C53246211400346653590B3795B
+  uid           [ultimate] key-submission@@example.net
+                bxzcxpxk8h87z1k7bzk86xn5aj47intu@@example.net
+  ssb   rsa2048 2016-08-30 [E]
+ at end example
+
+Take the hash of the string "key-submission", which is
+"bxzcxpxk8h87z1k7bzk86xn5aj47intu" and manually publish that key:
+
+ at example
+  $ gpg --export-options export-minimal --export \
+  >  -o /var/lib/gnupg/wks/example.net/hu/bxzcxpxk8h87z1k7bzk86xn5aj47intu \
+  >  key-submission@@example.new
+ at end example
+
+Make sure that the created file is world readable.
+
+Finally that submission address needs to be redirected to a script
+running @command{gpg-wks-server}.  The @command{procmail} command can
+be used for this: Redirect the submission address to the user "webkey"
+and put this into webkey's @file{.procmailrc}:
+
+ at example
+:0
+* !^From: webkey@@example.net
+* !^X-WKS-Loop: webkey.example.net
+|gpg-wks-server -v --receive \
+     --header X-WKS-Loop=webkey.example.net \
+     --from webkey@@example.net --send
+ at end example
+
+
+ at mansect see also
+ at ifset isman
+ at command{gpg-wks-client}(1)
+ at end ifset

commit c76398da5b15df2086f68bc26b7fde75219976c7
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 26 17:45:28 2017 +0200

    wks: Fix program names in the usage diagnostics.
    
    * tools/gpg-wks-client.c (my_strusage): Add case 12.
    * tools/gpg-wks-server.c (my_strusage): Add case 12:
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/gpg-wks-client.c b/tools/gpg-wks-client.c
index 67b489a..746aa53 100644
--- a/tools/gpg-wks-client.c
+++ b/tools/gpg-wks-client.c
@@ -138,8 +138,8 @@ my_strusage( int level )
 
   switch (level)
     {
-    case 11: p = "gpg-wks-client (@GNUPG@)";
-      break;
+    case 11: p = "gpg-wks-client"; break;
+    case 12: p = "@GNUPG@"; break;
     case 13: p = VERSION; break;
     case 17: p = PRINTABLE_OS_NAME; break;
     case 19: p = ("Please report bugs to <@EMAIL@>.\n"); break;
diff --git a/tools/gpg-wks-server.c b/tools/gpg-wks-server.c
index cdb1674..1633a20 100644
--- a/tools/gpg-wks-server.c
+++ b/tools/gpg-wks-server.c
@@ -154,8 +154,8 @@ my_strusage( int level )
 
   switch (level)
     {
-    case 11: p = "gpg-wks-server (@GNUPG@)";
-      break;
+    case 11: p = "gpg-wks-server"; break;
+    case 12: p = "@GNUPG@"; break;
     case 13: p = VERSION; break;
     case 17: p = PRINTABLE_OS_NAME; break;
     case 19: p = ("Please report bugs to <@EMAIL@>.\n"); break;

commit b428dd495a1a960de0da27976bf50b191b6a1ddf
Author: Werner Koch <wk at gnupg.org>
Date:   Wed Jul 26 17:49:39 2017 +0200

    wks: Add stubs for new gpg-wks-server commands.
    
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/tools/gpg-wks-server.c b/tools/gpg-wks-server.c
index fc5bd70..cdb1674 100644
--- a/tools/gpg-wks-server.c
+++ b/tools/gpg-wks-server.c
@@ -63,6 +63,9 @@ enum cmd_and_opt_values
     aReceive,
     aCron,
     aListDomains,
+    aInstallKey,
+    aRevokeKey,
+    aRemoveKey,
 
     oGpgProgram,
     oSend,
@@ -83,6 +86,12 @@ static ARGPARSE_OPTS opts[] = {
               ("run regular jobs")),
   ARGPARSE_c (aListDomains, "list-domains",
               ("list configured domains")),
+  ARGPARSE_c (aInstallKey, "install-key",
+              "|FILE|install a key from FILE into the WKD"),
+  ARGPARSE_c (aRemoveKey, "remove-key",
+              "|ADDR|remove the key ADDR from the WKD"),
+  ARGPARSE_c (aRevokeKey, "revoke-key",
+              "|ADDR|mark the key ADDR in the WKD as revoked"),
 
   ARGPARSE_group (301, ("@\nOptions:\n ")),
 
@@ -130,6 +139,9 @@ static gpg_error_t command_receive_cb (void *opaque,
                                        const char *mediatype, estream_t fp,
                                        unsigned int flags);
 static gpg_error_t command_list_domains (void);
+static gpg_error_t command_install_key (const char *fname);
+static gpg_error_t command_remove_key (const char *mailaddr);
+static gpg_error_t command_revoke_key (const char *mailaddr);
 static gpg_error_t command_cron (void);
 
 
@@ -212,6 +224,9 @@ parse_arguments (ARGPARSE_ARGS *pargs, ARGPARSE_OPTS *popts)
 	case aReceive:
         case aCron:
         case aListDomains:
+        case aInstallKey:
+        case aRemoveKey:
+        case aRevokeKey:
           cmd = pargs->r_opt;
           break;
 
@@ -337,6 +352,24 @@ main (int argc, char **argv)
       err = command_list_domains ();
       break;
 
+    case aInstallKey:
+      if (argc != 1)
+        wrong_args ("--install-key FILE");
+      err = command_install_key (*argv);
+      break;
+
+    case aRemoveKey:
+      if (argc != 1)
+        wrong_args ("--remove-key MAILADDR");
+      err = command_remove_key (*argv);
+      break;
+
+    case aRevokeKey:
+      if (argc != 1)
+        wrong_args ("--revoke-key MAILADDR");
+      err = command_revoke_key (*argv);
+      break;
+
     default:
       usage (1);
       err = gpg_error (GPG_ERR_BUG);
@@ -1862,3 +1895,30 @@ command_cron (void)
   free_strlist (domaindirs);
   return err;
 }
+
+
+/* Install a single key into the WKD by reading FNAME.  */
+static gpg_error_t
+command_install_key (const char *fname)
+{
+  (void)fname;
+  return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
+}
+
+
+/* Remove the key with mail address MAILADDR.  */
+static gpg_error_t
+command_remove_key (const char *mailaddr)
+{
+  (void)mailaddr;
+  return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
+}
+
+
+/* Revoke the key with mail address MAILADDR.  */
+static gpg_error_t
+command_revoke_key (const char *mailaddr)
+{
+  (void)mailaddr;
+  return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
+}

-----------------------------------------------------------------------

Summary of changes:
 doc/Makefile.am        |   6 +-
 doc/gnupg.texi         |   4 +-
 doc/wks.texi           | 340 +++++++++++++++++++++++++++++++++++++++++++++++++
 tools/gpg-wks-client.c |   4 +-
 tools/gpg-wks-server.c |  64 +++++++++-
 5 files changed, 410 insertions(+), 8 deletions(-)
 create mode 100644 doc/wks.texi


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Wed Jul 26 18:10:23 2017
From: cvs at cvs.gnupg.org (by Marcus Brinkmann)
Date: Wed, 26 Jul 2017 18:10:23 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-164-g94eea0e
Message-ID: <E1daOtE-00057X-CG@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  94eea0ed2c8b47cb0fe02b22cbe668705a5fe0d0 (commit)
      from  be636c3cfca178927b09ef4154c3e555d6f5b1c4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 94eea0ed2c8b47cb0fe02b22cbe668705a5fe0d0
Author: Marcus Brinkmann <marcus.brinkmann at ruhr-uni-bochum.de>
Date:   Wed Jul 26 18:06:29 2017 +0200

    g10: Make sure exactly one fingerprint is output with --quick-gen-key.
    
    * g10/keygen.c (do_generate_keypair): Only set fpr in
    list_keyblock_direct invocation if neither --fingerprint nor
    --with-fingerprints are given.
    
    Signed-off-by: Marcus Brinkmann <mb at g10code.com>
    GnuPG-bug-id: 2741

diff --git a/g10/keygen.c b/g10/keygen.c
index bfbed0e..542c1a5 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -4808,7 +4808,8 @@ do_generate_keypair (ctrl_t ctrl, struct para_data_s *para,
               tty_printf (_("public and secret key created and signed.\n") );
               tty_printf ("\n");
               merge_keys_and_selfsig (ctrl, pub_root);
-              list_keyblock_direct (ctrl, pub_root, 0, 1, 1, 1);
+
+              list_keyblock_direct (ctrl, pub_root, 0, 1, opt.fingerprint || opt.with_fingerprint, 1);
             }
 
 

-----------------------------------------------------------------------

Summary of changes:
 g10/keygen.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 27 09:19:40 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 27 Jul 2017 09:19:40 +0200
Subject: [git] GpgOL - branch, master, updated. gpgol-1.4.0-275-g11f3374
Message-ID: <E1dad5A-0008Ho-MU@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG extension for MS Outlook".

The branch, master has been updated
       via  11f337486e24cb49cb8074d15794ec037b627567 (commit)
       via  e84e7ee9d47b1f09fbdb7ccc005bbf21156f6b0c (commit)
       via  d3682aed76a2f8db220f3da39074f92e3ac2b654 (commit)
      from  37c40baf5b49b55b886b203f30ed5a4d7107b587 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 11f337486e24cb49cb8074d15794ec037b627567
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Jul 27 09:19:26 2017 +0200

    Update German translation
    
    --

diff --git a/po/de.po b/po/de.po
index 123b12a..ccf8231 100644
--- a/po/de.po
+++ b/po/de.po
@@ -9,7 +9,7 @@ msgstr ""
 "Project-Id-Version: GpgOL 1.0.0\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
 "POT-Creation-Date: 2017-07-27 09:17+0200\n"
-"PO-Revision-Date: 2017-07-25 14:45+0100\n"
+"PO-Revision-Date: 2017-07-27 09:18+0100\n"
 "Last-Translator: Andre Heinecke <andre.heinecke at intevation.de>\n"
 "Language-Team: English <kde-i18n-de at kde.org>\n"
 "Language: en_US\n"
@@ -483,14 +483,12 @@ msgstr ""
 "w?hrend der ?bertragung gelesen hat."
 
 #: src/mail.cpp:1767
-#, fuzzy
 msgid "The encryption was VS-NfD-compliant."
-msgstr "Diese Verschl?sselung war VS-Konform."
+msgstr "Diese Verschl?sselung war VS-NfD-konform."
 
 #: src/mail.cpp:1771
-#, fuzzy
 msgid "The encryption was not VS-NfD-compliant."
-msgstr "Diese Verschl?sselung war nicht VS-Konform."
+msgstr "Diese Verschl?sselung war nicht VS-NfD-konform."
 
 #: src/mail.cpp:1775
 msgid "You cannot be sure who sent the message because it is not signed."
@@ -636,24 +634,20 @@ msgid "is marked as not trustworthy."
 msgstr "ist als nicht vertrauensw?rdig markiert."
 
 #: src/mail.cpp:1975
-#, fuzzy
 msgid "The signature is VS-NfD-compliant."
-msgstr "Die Signatur ist VS-Konform."
+msgstr "Die Signatur ist VS-NfD-konform."
 
 #: src/mail.cpp:1979
-#, fuzzy
 msgid "The signature is not VS-NfD-compliant."
-msgstr "Die Signatur ist nicht VS-Konform."
+msgstr "Die Signatur ist nicht VS-NfD-konform."
 
 #: src/mail.cpp:1987
-#, fuzzy
 msgid "The encryption is VS-NfD-compliant."
-msgstr "Diese Verschl?sselung ist VS-Konform."
+msgstr "Diese Verschl?sselung ist VS-NfD-konform."
 
 #: src/mail.cpp:1991
-#, fuzzy
 msgid "The encryption is not VS-NfD-compliant."
-msgstr "Diese Verschl?sselung ist nicht VS-Konform."
+msgstr "Diese Verschl?sselung ist nicht VS-NfD-konform."
 
 #: src/mail.cpp:1998
 msgid "Click here to change the key used for this address."

commit e84e7ee9d47b1f09fbdb7ccc005bbf21156f6b0c
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Jul 27 09:17:46 2017 +0200

    Auto update po files
    
    --

diff --git a/po/de.po b/po/de.po
index d7d8eff..123b12a 100644
--- a/po/de.po
+++ b/po/de.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL 1.0.0\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2017-07-25 14:26+0200\n"
+"POT-Creation-Date: 2017-07-27 09:17+0200\n"
 "PO-Revision-Date: 2017-07-25 14:45+0100\n"
 "Last-Translator: Andre Heinecke <andre.heinecke at intevation.de>\n"
 "Language-Team: English <kde-i18n-de at kde.org>\n"
@@ -483,11 +483,13 @@ msgstr ""
 "w?hrend der ?bertragung gelesen hat."
 
 #: src/mail.cpp:1767
-msgid "The encryption was VS-compliant."
+#, fuzzy
+msgid "The encryption was VS-NfD-compliant."
 msgstr "Diese Verschl?sselung war VS-Konform."
 
 #: src/mail.cpp:1771
-msgid "The encryption was not VS-compliant."
+#, fuzzy
+msgid "The encryption was not VS-NfD-compliant."
 msgstr "Diese Verschl?sselung war nicht VS-Konform."
 
 #: src/mail.cpp:1775
@@ -634,19 +636,23 @@ msgid "is marked as not trustworthy."
 msgstr "ist als nicht vertrauensw?rdig markiert."
 
 #: src/mail.cpp:1975
-msgid "The signature is VS-compliant."
+#, fuzzy
+msgid "The signature is VS-NfD-compliant."
 msgstr "Die Signatur ist VS-Konform."
 
 #: src/mail.cpp:1979
-msgid "The signature is not VS-compliant."
+#, fuzzy
+msgid "The signature is not VS-NfD-compliant."
 msgstr "Die Signatur ist nicht VS-Konform."
 
 #: src/mail.cpp:1987
-msgid "The encryption is VS-compliant."
+#, fuzzy
+msgid "The encryption is VS-NfD-compliant."
 msgstr "Diese Verschl?sselung ist VS-Konform."
 
 #: src/mail.cpp:1991
-msgid "The encryption is not VS-compliant."
+#, fuzzy
+msgid "The encryption is not VS-NfD-compliant."
 msgstr "Diese Verschl?sselung ist nicht VS-Konform."
 
 #: src/mail.cpp:1998
@@ -899,9 +905,10 @@ msgid ""
 "\n"
 "Please note that any support may be removed in a future version."
 msgstr ""
-"GpgOL f?r Outlook 2003 / 2007 wird nicht weitergepflegt.\n\n"
-"Bitte beachten Sie das jegliche Unterst?tzung dieser Versionen in Zukunft"
-" entfallen kann."
+"GpgOL f?r Outlook 2003 / 2007 wird nicht weitergepflegt.\n"
+"\n"
+"Bitte beachten Sie das jegliche Unterst?tzung dieser Versionen in Zukunft "
+"entfallen kann."
 
 #: src/olflange-dlgs.cpp:50
 msgid "Message receiving"
diff --git a/po/fr.po b/po/fr.po
index 83d832b..77a6e03 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: \n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2017-07-25 14:26+0200\n"
+"POT-Creation-Date: 2017-07-27 09:17+0200\n"
 "PO-Revision-Date: 2015-10-01 17:05+0200\n"
 "Last-Translator: Olivier Serve <olivier.serve at atos.net>\n"
 "Language-Team: French <kde-i18n-doc at kde.org>\n"
@@ -470,12 +470,14 @@ msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
 #: src/mail.cpp:1767
-msgid "The encryption was VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption was VS-NfD-compliant."
+msgstr "Cette signature est valide\n"
 
 #: src/mail.cpp:1771
-msgid "The encryption was not VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption was not VS-NfD-compliant."
+msgstr "Cette signature est valide\n"
 
 #: src/mail.cpp:1775
 msgid "You cannot be sure who sent the message because it is not signed."
@@ -609,21 +611,23 @@ msgstr ""
 
 #: src/mail.cpp:1975
 #, fuzzy
-msgid "The signature is VS-compliant."
+msgid "The signature is VS-NfD-compliant."
 msgstr "Cette signature est valide\n"
 
 #: src/mail.cpp:1979
 #, fuzzy
-msgid "The signature is not VS-compliant."
+msgid "The signature is not VS-NfD-compliant."
 msgstr "Cette signature est valide\n"
 
 #: src/mail.cpp:1987
-msgid "The encryption is VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption is VS-NfD-compliant."
+msgstr "Cette signature est valide\n"
 
 #: src/mail.cpp:1991
-msgid "The encryption is not VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption is not VS-NfD-compliant."
+msgstr "Cette signature est valide\n"
 
 #: src/mail.cpp:1998
 msgid "Click here to change the key used for this address."
diff --git a/po/pt.po b/po/pt.po
index 6d654c7..6fe3d65 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL 1.1.1\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2017-07-25 14:26+0200\n"
+"POT-Creation-Date: 2017-07-27 09:17+0200\n"
 "PO-Revision-Date: 2016-02-02 17:33+0000\n"
 "Last-Translator: Marco A.G.Pinto <marcoagpinto at mail.telepac.pt>\n"
 "Language-Team: Portuguese <marcoagpinto at mail.telepac.pt>\n"
@@ -476,12 +476,14 @@ msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
 #: src/mail.cpp:1767
-msgid "The encryption was VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption was VS-NfD-compliant."
+msgstr "Esta assinatura ? v?lida\n"
 
 #: src/mail.cpp:1771
-msgid "The encryption was not VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption was not VS-NfD-compliant."
+msgstr "Esta assinatura ? v?lida\n"
 
 #: src/mail.cpp:1775
 msgid "You cannot be sure who sent the message because it is not signed."
@@ -615,21 +617,23 @@ msgstr ""
 
 #: src/mail.cpp:1975
 #, fuzzy
-msgid "The signature is VS-compliant."
+msgid "The signature is VS-NfD-compliant."
 msgstr "Esta assinatura ? v?lida\n"
 
 #: src/mail.cpp:1979
 #, fuzzy
-msgid "The signature is not VS-compliant."
+msgid "The signature is not VS-NfD-compliant."
 msgstr "Esta assinatura ? v?lida\n"
 
 #: src/mail.cpp:1987
-msgid "The encryption is VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption is VS-NfD-compliant."
+msgstr "Esta assinatura ? v?lida\n"
 
 #: src/mail.cpp:1991
-msgid "The encryption is not VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption is not VS-NfD-compliant."
+msgstr "Esta assinatura ? v?lida\n"
 
 #: src/mail.cpp:1998
 msgid "Click here to change the key used for this address."
diff --git a/po/sv.po b/po/sv.po
index 8c4fd1a..6e8ed4c 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GPGol\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2017-07-25 14:26+0200\n"
+"POT-Creation-Date: 2017-07-27 09:17+0200\n"
 "PO-Revision-Date: 2006-12-12 23:52+0100\n"
 "Last-Translator: Daniel Nylander <po at danielnylander.se>\n"
 "Language-Team: Swedish <tp-sv at listor.tp-sv.se>\n"
@@ -459,12 +459,14 @@ msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
 #: src/mail.cpp:1767
-msgid "The encryption was VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption was VS-NfD-compliant."
+msgstr "Den h?r signaturen ?r giltig\n"
 
 #: src/mail.cpp:1771
-msgid "The encryption was not VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption was not VS-NfD-compliant."
+msgstr "Den h?r signaturen ?r giltig\n"
 
 #: src/mail.cpp:1775
 msgid "You cannot be sure who sent the message because it is not signed."
@@ -598,21 +600,23 @@ msgstr ""
 
 #: src/mail.cpp:1975
 #, fuzzy
-msgid "The signature is VS-compliant."
+msgid "The signature is VS-NfD-compliant."
 msgstr "Den h?r signaturen ?r giltig\n"
 
 #: src/mail.cpp:1979
 #, fuzzy
-msgid "The signature is not VS-compliant."
+msgid "The signature is not VS-NfD-compliant."
 msgstr "Den h?r signaturen ?r giltig\n"
 
 #: src/mail.cpp:1987
-msgid "The encryption is VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption is VS-NfD-compliant."
+msgstr "Den h?r signaturen ?r giltig\n"
 
 #: src/mail.cpp:1991
-msgid "The encryption is not VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption is not VS-NfD-compliant."
+msgstr "Den h?r signaturen ?r giltig\n"
 
 #: src/mail.cpp:1998
 msgid "Click here to change the key used for this address."
diff --git a/po/zh_CN.po b/po/zh_CN.po
index 5f227a9..b694f45 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2017-07-25 14:26+0200\n"
+"POT-Creation-Date: 2017-07-27 09:17+0200\n"
 "PO-Revision-Date: 2015-08-15 21:58+0800\n"
 "Last-Translator: Mingye Wang (Arthur2e5) <arthur200126 at hotmail.com>\n"
 "Language-Team: \n"
@@ -458,12 +458,14 @@ msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
 #: src/mail.cpp:1767
-msgid "The encryption was VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption was VS-NfD-compliant."
+msgstr "????\n"
 
 #: src/mail.cpp:1771
-msgid "The encryption was not VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption was not VS-NfD-compliant."
+msgstr "????\n"
 
 #: src/mail.cpp:1775
 msgid "You cannot be sure who sent the message because it is not signed."
@@ -597,21 +599,23 @@ msgstr ""
 
 #: src/mail.cpp:1975
 #, fuzzy
-msgid "The signature is VS-compliant."
+msgid "The signature is VS-NfD-compliant."
 msgstr "????\n"
 
 #: src/mail.cpp:1979
 #, fuzzy
-msgid "The signature is not VS-compliant."
+msgid "The signature is not VS-NfD-compliant."
 msgstr "????\n"
 
 #: src/mail.cpp:1987
-msgid "The encryption is VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption is VS-NfD-compliant."
+msgstr "????\n"
 
 #: src/mail.cpp:1991
-msgid "The encryption is not VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption is not VS-NfD-compliant."
+msgstr "????\n"
 
 #: src/mail.cpp:1998
 msgid "Click here to change the key used for this address."
diff --git a/po/zh_TW.po b/po/zh_TW.po
index 19b086c..189a19c 100644
--- a/po/zh_TW.po
+++ b/po/zh_TW.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GpgOL\n"
 "Report-Msgid-Bugs-To: bug-gpgol at g10code.com\n"
-"POT-Creation-Date: 2017-07-25 14:26+0200\n"
+"POT-Creation-Date: 2017-07-27 09:17+0200\n"
 "PO-Revision-Date: 2015-08-15 21:58+0800\n"
 "Last-Translator: Mingye Wang (Arthur2e5) <arthur200126 at hotmail.com>\n"
 "Language-Team: \n"
@@ -458,12 +458,14 @@ msgid "You cannot be sure who sent, modified and read the message in transit."
 msgstr ""
 
 #: src/mail.cpp:1767
-msgid "The encryption was VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption was VS-NfD-compliant."
+msgstr "????\n"
 
 #: src/mail.cpp:1771
-msgid "The encryption was not VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption was not VS-NfD-compliant."
+msgstr "????\n"
 
 #: src/mail.cpp:1775
 msgid "You cannot be sure who sent the message because it is not signed."
@@ -597,21 +599,23 @@ msgstr ""
 
 #: src/mail.cpp:1975
 #, fuzzy
-msgid "The signature is VS-compliant."
+msgid "The signature is VS-NfD-compliant."
 msgstr "????\n"
 
 #: src/mail.cpp:1979
 #, fuzzy
-msgid "The signature is not VS-compliant."
+msgid "The signature is not VS-NfD-compliant."
 msgstr "????\n"
 
 #: src/mail.cpp:1987
-msgid "The encryption is VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption is VS-NfD-compliant."
+msgstr "????\n"
 
 #: src/mail.cpp:1991
-msgid "The encryption is not VS-compliant."
-msgstr ""
+#, fuzzy
+msgid "The encryption is not VS-NfD-compliant."
+msgstr "????\n"
 
 #: src/mail.cpp:1998
 msgid "Click here to change the key used for this address."

commit d3682aed76a2f8db220f3da39074f92e3ac2b654
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Jul 27 09:16:49 2017 +0200

    Change VS to VS-NfD for deVS stuff
    
    * src/mail.cpp (Mail::get_crypto_details): Change VS to VS-NfD

diff --git a/src/mail.cpp b/src/mail.cpp
index f0a32b8..77d5f29 100644
--- a/src/mail.cpp
+++ b/src/mail.cpp
@@ -1764,11 +1764,11 @@ Mail::get_crypto_details()
        {
          if (m_sig.isDeVs())
            {
-             message += _("The encryption was VS-compliant.");
+             message += _("The encryption was VS-NfD-compliant.");
            }
          else
            {
-             message += _("The encryption was not VS-compliant.");
+             message += _("The encryption was not VS-NfD-compliant.");
            }
         }
       message += "\n";
@@ -1972,11 +1972,11 @@ Mail::get_crypto_details()
          {
            if (m_sig.isDeVs ())
              {
-               message += _("The signature is VS-compliant.");
+               message += _("The signature is VS-NfD-compliant.");
              }
            else
              {
-               message += _("The signature is not VS-compliant.");
+               message += _("The signature is not VS-NfD-compliant.");
              }
            message += "\n";
          }
@@ -1984,11 +1984,11 @@ Mail::get_crypto_details()
          {
            if (m_decrypt_result.isDeVs ())
              {
-               message += _("The encryption is VS-compliant.");
+               message += _("The encryption is VS-NfD-compliant.");
              }
            else
              {
-               message += _("The encryption is not VS-compliant.");
+               message += _("The encryption is not VS-NfD-compliant.");
              }
            message += "\n\n";
          }

-----------------------------------------------------------------------

Summary of changes:
 po/de.po     | 35 ++++++++++++++++++-----------------
 po/fr.po     | 26 +++++++++++++++-----------
 po/pt.po     | 26 +++++++++++++++-----------
 po/sv.po     | 26 +++++++++++++++-----------
 po/zh_CN.po  | 26 +++++++++++++++-----------
 po/zh_TW.po  | 26 +++++++++++++++-----------
 src/mail.cpp | 12 ++++++------
 7 files changed, 99 insertions(+), 78 deletions(-)


hooks/post-receive
-- 
GnuPG extension for MS Outlook
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 27 11:47:33 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 27 Jul 2017 11:47:33 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-166-g6d95611
Message-ID: <E1dafOI-0005Pg-DB@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  6d95611d01b0768a365173668a878e903e3078e9 (commit)
       via  fcb62fe20f45290bf95703ec3bf4d0b361fa4339 (commit)
      from  94eea0ed2c8b47cb0fe02b22cbe668705a5fe0d0 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6d95611d01b0768a365173668a878e903e3078e9
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 27 11:41:40 2017 +0200

    indent: Wrap an overlong line.
    
    --
    
    Folks, please set your editors to 80 columns to notice such flaws.

diff --git a/g10/keygen.c b/g10/keygen.c
index 542c1a5..6a3d323 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -4809,7 +4809,9 @@ do_generate_keypair (ctrl_t ctrl, struct para_data_s *para,
               tty_printf ("\n");
               merge_keys_and_selfsig (ctrl, pub_root);
 
-              list_keyblock_direct (ctrl, pub_root, 0, 1, opt.fingerprint || opt.with_fingerprint, 1);
+              list_keyblock_direct (ctrl, pub_root, 0, 1,
+                                    opt.fingerprint || opt.with_fingerprint,
+                                    1);
             }
 
 

commit fcb62fe20f45290bf95703ec3bf4d0b361fa4339
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 27 11:37:00 2017 +0200

    gpg: Avoid output to the tty during import.
    
    * g10/key-check.c (key_check_all_keysigs): Add arg mode and change all
    output calls to use it.
    * g10/keyedit.c (keyedit_print_one_sig): Add arg fp and chnage all
    output calls to use it.
    (keyedit_menu): Adjust for changes.
    * g10/gpgcompose.c (keyedit_print_one_sig): Add dummy arg fp.
    * g10/import.c (import_one): Call key_check_all_keysigs with output to
    the log stream.
    --
    
    Fixes-commit: 404fa8211b6188a0abe83ef43a4b44d528c0b035
    GnuPG-bug-id: 3288
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/gpgcompose.c b/g10/gpgcompose.c
index f38d755..2b42bfb 100644
--- a/g10/gpgcompose.c
+++ b/g10/gpgcompose.c
@@ -3065,11 +3065,13 @@ show_basic_key_info (ctrl_t ctrl, KBNODE keyblock)
 }
 
 int
-keyedit_print_one_sig (ctrl_t ctrl, int rc, kbnode_t keyblock, kbnode_t node,
+keyedit_print_one_sig (ctrl_t ctrl, estream_t fp,
+                       int rc, kbnode_t keyblock, kbnode_t node,
 		       int *inv_sigs, int *no_key, int *oth_err,
 		       int is_selfsig, int print_without_key, int extended)
 {
   (void) ctrl;
+  (void) fp;
   (void) rc;
   (void) keyblock;
   (void) node;
diff --git a/g10/import.c b/g10/import.c
index 6e83225..8136625 100644
--- a/g10/import.c
+++ b/g10/import.c
@@ -1701,7 +1701,7 @@ import_one (ctrl_t ctrl,
               keystr_from_pk(pk));
 
   if ((options & IMPORT_REPAIR_KEYS))
-    key_check_all_keysigs (ctrl, keyblock, 0, 0);
+    key_check_all_keysigs (ctrl, 1, keyblock, 0, 0);
 
   if (chk_self_sigs (ctrl, keyblock, keyid, &non_self))
     return 0;  /* Invalid keyblock - error already printed.  */
diff --git a/g10/key-check.c b/g10/key-check.c
index a22394d..d32067b 100644
--- a/g10/key-check.c
+++ b/g10/key-check.c
@@ -33,7 +33,7 @@
 #include "key-check.h"
 
 /* Order two signatures.  The actual ordering isn't important.  Our
-   goal is to ensure that identical signatures occur together.  */
+ * goal is to ensure that identical signatures occur together.  */
 static int
 sig_comparison (const void *av, const void *bv)
 {
@@ -72,28 +72,35 @@ sig_comparison (const void *av, const void *bv)
   return 0;
 }
 
-/* Perform a few sanity checks on a keyblock is okay and possibly
-   repair some damage.  Concretely:
-
-     - Detect duplicate signatures and remove them.
-
-     - Detect out of order signatures and relocate them (e.g., a sig
-       over user id X located under subkey Y).
 
-   Note: this function does not remove signatures that don't belong or
-   components that are not signed!  (Although it would be trivial to
-   do so.)
-
-   If ONLY_SELFSIGS is true, then this function only reorders self
-   signatures (it still checks all signatures for duplicates,
-   however).
-
-   Returns 1 if the keyblock was modified, 0 otherwise.  */
+/* Perform a few sanity checks on a keyblock is okay and possibly
+ * repair some damage.  Concretely:
+ *
+ *   - Detect duplicate signatures and remove them.
+ *
+ *   - Detect out of order signatures and relocate them (e.g., a sig
+ *     over user id X located under subkey Y).
+ *
+ * Note: this function does not remove signatures that don't belong or
+ * components that are not signed!  (Although it would be trivial to
+ * do so.)
+ *
+ * If ONLY_SELFSIGS is true, then this function only reorders self
+ * signatures (it still checks all signatures for duplicates,
+ * however).
+ *
+ * Allowed values for MODE are:
+ *  -1 - print to the TTY
+ *   0 - print to stdout
+ *   1 - use log_info.
+ *
+ * Returns true if the keyblock was modified.  */
 int
-key_check_all_keysigs (ctrl_t ctrl, kbnode_t kb,
+key_check_all_keysigs (ctrl_t ctrl, int mode, kbnode_t kb,
                        int only_selected, int only_selfsigs)
 {
   gpg_error_t err;
+  estream_t fp = mode < 0? NULL : mode ? log_get_stream () : es_stdout;
   PKT_public_key *pk;
   KBNODE n, n_next, *n_prevp, n2;
   char *pending_desc = NULL;
@@ -329,8 +336,8 @@ key_check_all_keysigs (ctrl_t ctrl, kbnode_t kb,
             {
               if (DBG_PACKET && pending_desc)
                 log_debug ("%s", pending_desc);
-              tty_printf (_("can't check signature with unsupported"
-                            " public-key algorithm (%d): %s.\n"),
+              log_info (_("can't check signature with unsupported"
+                          " public-key algorithm (%d): %s.\n"),
                           sig->pubkey_algo, gpg_strerror (err));
               break;
             }
@@ -338,8 +345,8 @@ key_check_all_keysigs (ctrl_t ctrl, kbnode_t kb,
             {
               if (DBG_PACKET && pending_desc)
                 log_debug ("%s", pending_desc);
-              tty_printf (_("can't check signature with unsupported"
-                            " message-digest algorithm %d: %s.\n"),
+              log_info (_("can't check signature with unsupported"
+                          " message-digest algorithm %d: %s.\n"),
                           sig->digest_algo, gpg_strerror (err));
               break;
             }
@@ -482,32 +489,36 @@ key_check_all_keysigs (ctrl_t ctrl, kbnode_t kb,
                   ;
                 else if (last_printed_component->pkt->pkttype == PKT_USER_ID)
                   {
-                    tty_printf ("uid  ");
-                    tty_print_utf8_string (last_printed_component
-                                           ->pkt->pkt.user_id->name,
-                                           last_printed_component
-                                           ->pkt->pkt.user_id->len);
+                    tty_fprintf (fp, "uid  ");
+                    tty_print_utf8_string2 (fp,
+                                            last_printed_component
+                                            ->pkt->pkt.user_id->name,
+                                            last_printed_component
+                                            ->pkt->pkt.user_id->len, 0);
                   }
                 else if (last_printed_component->pkt->pkttype
                          == PKT_PUBLIC_KEY)
-                  tty_printf ("pub  %s",
-                              pk_keyid_str (last_printed_component
-                                            ->pkt->pkt.public_key));
+                  tty_fprintf (fp, "pub  %s",
+                               pk_keyid_str (last_printed_component
+                                             ->pkt->pkt.public_key));
                 else
-                  tty_printf ("sub  %s",
-                              pk_keyid_str (last_printed_component
-                                            ->pkt->pkt.public_key));
+                  tty_fprintf (fp, "sub  %s",
+                               pk_keyid_str (last_printed_component
+                                             ->pkt->pkt.public_key));
 
                 if (modified)
                   {
                     if (is_reordered)
-                      tty_printf (_(" (reordered signatures follow)"));
-                    tty_printf ("\n");
+                      tty_fprintf (fp, _(" (reordered signatures follow)"));
+                    if (mode > 0)
+                      log_printf ("\n");
+                    else
+                      tty_fprintf (fp, "\n");
                   }
               }
 
             if (modified)
-              keyedit_print_one_sig (ctrl, rc, kb, n, NULL, NULL, NULL,
+              keyedit_print_one_sig (ctrl, fp, rc, kb, n, NULL, NULL, NULL,
 				     has_selfsig, 0, only_selfsigs);
           }
 
@@ -524,7 +535,7 @@ key_check_all_keysigs (ctrl_t ctrl, kbnode_t kb,
                                   buffer, sizeof (buffer), &len,
                                   sig->data[i]);
                   printable = bin2hex (buffer, len, NULL);
-                  log_info ("        %d: %s\n", i, printable);
+                  log_debug ("        %d: %s\n", i, printable);
                   xfree (printable);
                 }
             }
@@ -614,27 +625,31 @@ key_check_all_keysigs (ctrl_t ctrl, kbnode_t kb,
   }
 
   if (dups || missing_issuer || bad_signature || reordered)
-    tty_printf (_("key %s:\n"), pk_keyid_str (pk));
+    tty_fprintf (fp, _("key %s:\n"), pk_keyid_str (pk));
 
   if (dups)
-    tty_printf (ngettext ("%d duplicate signature removed\n",
-                          "%d duplicate signatures removed\n", dups), dups);
+    tty_fprintf (fp,
+                 ngettext ("%d duplicate signature removed\n",
+                           "%d duplicate signatures removed\n", dups), dups);
   if (missing_issuer)
-    tty_printf (ngettext ("%d signature not checked due to a missing key\n",
-                          "%d signatures not checked due to missing keys\n",
-                          missing_issuer), missing_issuer);
+    tty_fprintf (fp,
+                 ngettext ("%d signature not checked due to a missing key\n",
+                           "%d signatures not checked due to missing keys\n",
+                           missing_issuer), missing_issuer);
   if (bad_signature)
-    tty_printf (ngettext ("%d bad signature\n",
-                          "%d bad signatures\n",
-                          bad_signature), bad_signature);
+    tty_fprintf (fp,
+                 ngettext ("%d bad signature\n",
+                           "%d bad signatures\n",
+                           bad_signature), bad_signature);
   if (reordered)
-    tty_printf (ngettext ("%d signature reordered\n",
-                          "%d signatures reordered\n",
-                          reordered), reordered);
+    tty_fprintf (fp,
+                 ngettext ("%d signature reordered\n",
+                           "%d signatures reordered\n",
+                           reordered), reordered);
 
   if (only_selfsigs && (bad_signature || reordered))
-    tty_printf (_("Warning: errors found and only checked self-signatures,"
-                  " run '%s' to check all signatures.\n"), "check");
+    tty_fprintf (fp, _("Warning: errors found and only checked self-signatures,"
+                       " run '%s' to check all signatures.\n"), "check");
 
   return modified;
 }
diff --git a/g10/key-check.h b/g10/key-check.h
index 3e4dd10..9f7886c 100644
--- a/g10/key-check.h
+++ b/g10/key-check.h
@@ -22,7 +22,7 @@
 
 #include "gpg.h"
 
-int key_check_all_keysigs (ctrl_t ctrl, kbnode_t kb,
+int key_check_all_keysigs (ctrl_t ctrl, int mode, kbnode_t kb,
 			   int only_selected, int only_selfsigs);
 
 #endif	/* GNUPG_G10_PACKET_TOOLS_H */
diff --git a/g10/keyedit.c b/g10/keyedit.c
index 0a90cf5..e221b32 100644
--- a/g10/keyedit.c
+++ b/g10/keyedit.c
@@ -193,7 +193,8 @@ print_and_check_one_sig_colon (ctrl_t ctrl, kbnode_t keyblock, kbnode_t node,
  * always be printed.
  */
 int
-keyedit_print_one_sig (ctrl_t ctrl, int rc, kbnode_t keyblock, kbnode_t node,
+keyedit_print_one_sig (ctrl_t ctrl, estream_t fp,
+                       int rc, kbnode_t keyblock, kbnode_t node,
 		       int *inv_sigs, int *no_key, int *oth_err,
 		       int is_selfsig, int print_without_key, int extended)
 {
@@ -232,7 +233,7 @@ keyedit_print_one_sig (ctrl_t ctrl, int rc, kbnode_t keyblock, kbnode_t node,
     }
   if (sigrc != '?' || print_without_key)
     {
-      tty_printf ("%s%c%c %c%c%c%c%c%c %s %s",
+      tty_fprintf (fp, "%s%c%c %c%c%c%c%c%c %s %s",
 		  is_rev ? "rev" : "sig", sigrc,
 		  (sig->sig_class - 0x10 > 0 &&
 		   sig->sig_class - 0x10 <
@@ -248,38 +249,41 @@ keyedit_print_one_sig (ctrl_t ctrl, int rc, kbnode_t keyblock, kbnode_t node,
                   keystr (sig->keyid),
 		  datestr_from_sig (sig));
       if ((opt.list_options & LIST_SHOW_SIG_EXPIRE) || extended )
-	tty_printf (" %s", expirestr_from_sig (sig));
-      tty_printf ("  ");
+	tty_fprintf (fp, " %s", expirestr_from_sig (sig));
+      tty_fprintf (fp, "  ");
       if (sigrc == '%')
-	tty_printf ("[%s] ", gpg_strerror (rc));
+	tty_fprintf (fp, "[%s] ", gpg_strerror (rc));
       else if (sigrc == '?')
 	;
       else if (is_selfsig)
 	{
-	  tty_printf (is_rev ? _("[revocation]") : _("[self-signature]"));
+	  tty_fprintf (fp, is_rev ? _("[revocation]") : _("[self-signature]"));
           if (extended && sig->flags.chosen_selfsig)
-            tty_printf ("*");
+            tty_fprintf (fp, "*");
 	}
       else
 	{
 	  size_t n;
 	  char *p = get_user_id (ctrl, sig->keyid, &n);
-	  tty_print_utf8_string2 (NULL, p, n,
+	  tty_print_utf8_string2 (fp, p, n,
 				  opt.screen_columns - keystrlen () - 26 -
 				  ((opt.
 				    list_options & LIST_SHOW_SIG_EXPIRE) ? 11
 				   : 0));
 	  xfree (p);
 	}
-      tty_printf ("\n");
+      if (fp == log_get_stream ())
+        log_printf ("\n");
+      else
+        tty_fprintf (fp, "\n");
 
       if (sig->flags.policy_url
           && ((opt.list_options & LIST_SHOW_POLICY_URLS) || extended))
-	show_policy_url (sig, 3, -1);
+	show_policy_url (sig, 3, (!fp? -1 : fp == log_get_stream ()? 1 : 0));
 
       if (sig->flags.notation
           && ((opt.list_options & LIST_SHOW_NOTATIONS) || extended))
-	show_notation (sig, 3, -1,
+	show_notation (sig, 3, (!fp? -1 : fp == log_get_stream ()? 1 : 0),
 		       ((opt.
 			 list_options & LIST_SHOW_STD_NOTATIONS) ? 1 : 0) +
 		       ((opt.
@@ -287,7 +291,7 @@ keyedit_print_one_sig (ctrl_t ctrl, int rc, kbnode_t keyblock, kbnode_t node,
 
       if (sig->flags.pref_ks
           && ((opt.list_options & LIST_SHOW_KEYSERVER_URLS) || extended))
-	show_keyserver_url (sig, 3, -1);
+	show_keyserver_url (sig, 3, (!fp? -1 : fp == log_get_stream ()? 1 : 0));
 
       if (extended)
         {
@@ -296,12 +300,12 @@ keyedit_print_one_sig (ctrl_t ctrl, int rc, kbnode_t keyblock, kbnode_t node,
 
           s = parse_sig_subpkt (sig->hashed, SIGSUBPKT_PRIMARY_UID, NULL);
           if (s && *s)
-            tty_printf ("             [primary]\n");
+            tty_fprintf (fp, "             [primary]\n");
 
           s = parse_sig_subpkt (sig->hashed, SIGSUBPKT_KEY_EXPIRE, NULL);
           if (s && buf32_to_u32 (s))
-            tty_printf ("             [expires: %s]\n",
-                        isotimestamp (pk->timestamp + buf32_to_u32 (s)));
+            tty_fprintf (fp, "             [expires: %s]\n",
+                         isotimestamp (pk->timestamp + buf32_to_u32 (s)));
         }
     }
 
@@ -317,7 +321,7 @@ print_and_check_one_sig (ctrl_t ctrl, kbnode_t keyblock, kbnode_t node,
   int rc;
 
   rc = check_key_signature (ctrl, keyblock, node, is_selfsig);
-  return keyedit_print_one_sig (ctrl, rc,
+  return keyedit_print_one_sig (ctrl, NULL, rc,
 				keyblock, node, inv_sigs, no_key, oth_err,
 				*is_selfsig, print_without_key, extended);
 }
@@ -1166,7 +1170,7 @@ fix_keyblock (ctrl_t ctrl, kbnode_t *keyblockp)
 
   if (collapse_uids (keyblockp))
     changed++;
-  if (key_check_all_keysigs (ctrl, *keyblockp, 0, 1))
+  if (key_check_all_keysigs (ctrl, 1, *keyblockp, 0, 1))
     changed++;
   reorder_keyblock (*keyblockp);
   /* If we modified the keyblock, make sure the flags are right. */
@@ -1613,7 +1617,7 @@ keyedit_menu (ctrl_t ctrl, const char *username, strlist_t locusr,
 	  break;
 
 	case cmdCHECK:
-	  if (key_check_all_keysigs (ctrl, keyblock,
+	  if (key_check_all_keysigs (ctrl, -1, keyblock,
 				     count_selected_uids (keyblock),
 				     !strcmp (arg_string, "selfsig")))
             modified = 1;
diff --git a/g10/keyedit.h b/g10/keyedit.h
index 23a126b..d1f453a 100644
--- a/g10/keyedit.h
+++ b/g10/keyedit.h
@@ -51,7 +51,8 @@ void keyedit_quick_set_expire (ctrl_t ctrl,
 void keyedit_quick_set_primary (ctrl_t ctrl, const char *username,
                                 const char *primaryuid);
 void show_basic_key_info (ctrl_t ctrl, kbnode_t keyblock);
-int keyedit_print_one_sig (ctrl_t ctrl, int rc, kbnode_t keyblock,
+int keyedit_print_one_sig (ctrl_t ctrl, estream_t fp,
+                           int rc, kbnode_t keyblock,
 			   kbnode_t node, int *inv_sigs, int *no_key,
 			   int *oth_err, int is_selfsig,
 			   int print_without_key, int extended);
diff --git a/g10/keylist.c b/g10/keylist.c
index 7203d16..86d1c56 100644
--- a/g10/keylist.c
+++ b/g10/keylist.c
@@ -193,7 +193,7 @@ print_seckey_info (ctrl_t ctrl, PKT_public_key *pk)
 }
 
 /* Print information about the public key.  With FP passed as NULL,
-   the tty output interface is used, otherwise output is directted to
+   the tty output interface is used, otherwise output is directed to
    the given stream.  */
 void
 print_pubkey_info (ctrl_t ctrl, estream_t fp, PKT_public_key *pk)

-----------------------------------------------------------------------

Summary of changes:
 g10/gpgcompose.c |   4 +-
 g10/import.c     |   2 +-
 g10/key-check.c  | 117 +++++++++++++++++++++++++++++++------------------------
 g10/key-check.h  |   2 +-
 g10/keyedit.c    |  40 ++++++++++---------
 g10/keyedit.h    |   3 +-
 g10/keygen.c     |   4 +-
 g10/keylist.c    |   2 +-
 8 files changed, 99 insertions(+), 75 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 27 14:05:17 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 27 Jul 2017 14:05:17 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-167-ga0d0cbe
Message-ID: <E1dahXZ-0000ms-L3@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  a0d0cbee7654ad7582400efaa92d493cd8e669e9 (commit)
      from  6d95611d01b0768a365173668a878e903e3078e9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit a0d0cbee7654ad7582400efaa92d493cd8e669e9
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 27 13:56:38 2017 +0200

    gpg,sm: Fix compliance checking for decryption.
    
    * common/compliance.c (gnupg_pk_is_compliant): Remove the Elgamal
    signing check.  We don't support Elgamal signing at all.
    (gnupg_pk_is_allowed) <de-vs>: Revert encryption/decryption for RSA.
    Check the curvenames for ECDH.
    * g10/pubkey-enc.c (get_session_key): Print only a warning if the key
    is not compliant.
    * sm/decrypt.c (gpgsm_decrypt): Ditto.  Use the same string as in gpg
    so that we have only one translation.
    --
    
    We always allow decryption and print only a note if the key was not
    complaint at the encryption site.
    
    GnuPG-bug-id: 3308
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/compliance.c b/common/compliance.c
index 268ea4d..9511724 100644
--- a/common/compliance.c
+++ b/common/compliance.c
@@ -99,7 +99,7 @@ gnupg_pk_is_compliant (enum gnupg_compliance_mode compliance, int algo,
 		       gcry_mpi_t key[], unsigned int keylength,
                        const char *curvename)
 {
-  enum { is_rsa, is_dsa, is_pgp5, is_elg_sign, is_ecc } algotype;
+  enum { is_rsa, is_dsa, is_elg, is_ecc } algotype;
   int result = 0;
 
   if (! initialized)
@@ -118,7 +118,7 @@ gnupg_pk_is_compliant (enum gnupg_compliance_mode compliance, int algo,
       break;
 
     case PUBKEY_ALGO_ELGAMAL_E:
-      algotype = is_pgp5;
+      algotype = is_elg;
       break;
 
     case PUBKEY_ALGO_ECDH:
@@ -128,8 +128,7 @@ gnupg_pk_is_compliant (enum gnupg_compliance_mode compliance, int algo,
       break;
 
     case PUBKEY_ALGO_ELGAMAL:
-      algotype = is_elg_sign;
-      break;
+      return 0; /* Signing with Elgamal is not at all supported.  */
 
     default: /* Unknown.  */
       return 0;
@@ -141,7 +140,7 @@ gnupg_pk_is_compliant (enum gnupg_compliance_mode compliance, int algo,
 
       switch (algotype)
         {
-        case is_pgp5:
+        case is_elg:
           result = 0;
           break;
 
@@ -183,11 +182,6 @@ gnupg_pk_is_compliant (enum gnupg_compliance_mode compliance, int algo,
         }
       xfree (curve);
     }
-  else if (algotype == is_elg_sign)
-    {
-      /* An Elgamal signing key is only RFC-2440 compliant.  */
-      result = (compliance == CO_RFC2440);
-    }
   else
     {
       result = 1; /* Assume compliance.  */
@@ -219,9 +213,9 @@ gnupg_pk_is_allowed (enum gnupg_compliance_mode compliance,
 	case PUBKEY_ALGO_RSA_S:
 	  switch (use)
 	    {
-	    case PK_USE_ENCRYPTION:
-	      return 1;
 	    case PK_USE_DECRYPTION:
+	      return 1;
+	    case PK_USE_ENCRYPTION:
 	    case PK_USE_SIGNING:
 	      return (keylength == 2048
 		      || keylength == 3072
@@ -253,10 +247,34 @@ gnupg_pk_is_allowed (enum gnupg_compliance_mode compliance,
 
 	case PUBKEY_ALGO_ELGAMAL:
 	case PUBKEY_ALGO_ELGAMAL_E:
-	  return use == PK_USE_ENCRYPTION;
+	  return use == PK_USE_DECRYPTION;
 
 	case PUBKEY_ALGO_ECDH:
-	  return use == PK_USE_ENCRYPTION;
+	  if (use == PK_USE_DECRYPTION)
+            return 1;
+          else if (use == PK_USE_ENCRYPTION)
+            {
+              int result = 0;
+              char *curve = NULL;
+
+              if (!curvename && key)
+                {
+                  curve = openpgp_oid_to_str (key[0]);
+                  curvename = openpgp_oid_to_curve (curve, 0);
+                  if (!curvename)
+                    curvename = curve;
+                }
+
+              result = (curvename
+                        && (!strcmp (curvename, "brainpoolP256r1")
+                            || !strcmp (curvename, "brainpoolP384r1")
+                            || !strcmp (curvename, "brainpoolP512r1")));
+
+              xfree (curve);
+              return result;
+            }
+          else
+            return 0;
 
 	case PUBKEY_ALGO_ECDSA:
 	  {
diff --git a/g10/pubkey-enc.c b/g10/pubkey-enc.c
index 0ddb8d7..013fd2f 100644
--- a/g10/pubkey-enc.c
+++ b/g10/pubkey-enc.c
@@ -90,19 +90,16 @@ get_session_key (ctrl_t ctrl, PKT_pubkey_enc * k, DEK * dek)
       sk->pubkey_algo = k->pubkey_algo; /* We want a pubkey with this algo.  */
       if (!(rc = get_seckey (ctrl, sk, k->keyid)))
         {
-          /* Check compliance.  */
-          if (! gnupg_pk_is_allowed (opt.compliance, PK_USE_DECRYPTION,
-                                     sk->pubkey_algo,
-                                     sk->pkey, nbits_from_pk (sk), NULL))
-            {
-              log_info (_("key %s not suitable for decryption"
-                          " while in %s mode\n"),
-                        keystr_from_pk (sk),
-                        gnupg_compliance_option_string (opt.compliance));
-              rc = gpg_error (GPG_ERR_PUBKEY_ALGO);
-            }
-          else
-            rc = get_it (ctrl, k, dek, sk, k->keyid);
+          /* Print compliance warning.  */
+          if (!gnupg_pk_is_compliant (opt.compliance,
+                                      sk->pubkey_algo,
+                                      sk->pkey, nbits_from_pk (sk), NULL))
+            log_info (_("Note: key %s was not suitable for encryption"
+                        " in %s mode\n"),
+                      keystr_from_pk (sk),
+                      gnupg_compliance_option_string (opt.compliance));
+
+          rc = get_it (ctrl, k, dek, sk, k->keyid);
         }
     }
   else if (opt.skip_hidden_recipients)
@@ -131,17 +128,14 @@ get_session_key (ctrl_t ctrl, PKT_pubkey_enc * k, DEK * dek)
             log_info (_("anonymous recipient; trying secret key %s ...\n"),
                       keystr (keyid));
 
-          /* Check compliance.  */
-          if (! gnupg_pk_is_allowed (opt.compliance, PK_USE_DECRYPTION,
-                                     sk->pubkey_algo,
-                                     sk->pkey, nbits_from_pk (sk), NULL))
-            {
-              log_info (_("key %s not suitable for decryption"
-                          " while in %s mode\n"),
-                          keystr_from_pk (sk),
-                          gnupg_compliance_option_string (opt.compliance));
-              continue;
-            }
+          /* Print compliance warning.  */
+          if (!gnupg_pk_is_compliant (opt.compliance,
+                                      sk->pubkey_algo,
+                                      sk->pkey, nbits_from_pk (sk), NULL))
+            log_info (_("Note: key %s was not suitable for encryption"
+                        " in %s mode\n"),
+                      keystr_from_pk (sk),
+                      gnupg_compliance_option_string (opt.compliance));
 
           rc = get_it (ctrl, k, dek, sk, keyid);
           if (!rc)
diff --git a/sm/decrypt.c b/sm/decrypt.c
index 170ad5a..3de742a 100644
--- a/sm/decrypt.c
+++ b/sm/decrypt.c
@@ -480,17 +480,19 @@ gpgsm_decrypt (ctrl_t ctrl, int in_fd, estream_t out_fp)
                     unsigned int nbits;
                     int pk_algo = gpgsm_get_key_algo_info (cert, &nbits);
 
-                    /* Check compliance.  */
-                    if (! gnupg_pk_is_allowed (opt.compliance,
-                                               PK_USE_DECRYPTION,
-                                               pk_algo, NULL, nbits, NULL))
+                    /* Print compliance warning.  */
+                    if (! gnupg_pk_is_compliant (opt.compliance,
+                                                 pk_algo, NULL, nbits, NULL))
                       {
-                        log_error ("certificate ID 0x%08lX not suitable for "
-                                   "decryption while in %s mode\n",
-                                   gpgsm_get_short_fingerprint (cert, NULL),
-                                   gnupg_compliance_option_string (opt.compliance));
-                        rc = gpg_error (GPG_ERR_PUBKEY_ALGO);
-                        goto oops;
+                        char  kidstr[10+1];
+
+                        snprintf (kidstr, sizeof kidstr, "0x%08lX",
+                                  gpgsm_get_short_fingerprint (cert, NULL));
+                        log_info
+                          (_("Note: key %s was not suitable for encryption"
+                             " in %s mode\n"),
+                           kidstr,
+                           gnupg_compliance_option_string (opt.compliance));
                       }
 
                     /* Check that all certs are compliant with CO_DE_VS.  */

-----------------------------------------------------------------------

Summary of changes:
 common/compliance.c | 46 ++++++++++++++++++++++++++++++++--------------
 g10/pubkey-enc.c    | 42 ++++++++++++++++++------------------------
 sm/decrypt.c        | 22 ++++++++++++----------
 3 files changed, 62 insertions(+), 48 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 27 14:25:10 2017
From: cvs at cvs.gnupg.org (by Andre Heinecke)
Date: Thu, 27 Jul 2017 14:25:10 +0200
Subject: [git] GPGME - branch, master, updated. gpgme-1.9.0-57-gd3796e4
Message-ID: <E1dahqp-0004bA-3U@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GnuPG Made Easy".

The branch, master has been updated
       via  d3796e4504a2b4f422de17d78f3acfe8dd199c9c (commit)
      from  c7be41a5f850addceb2a95444bad2a31cdcd1ce5 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit d3796e4504a2b4f422de17d78f3acfe8dd199c9c
Author: Andre Heinecke <aheinecke at intevation.de>
Date:   Thu Jul 27 14:20:58 2017 +0200

    core: Fix status parsing for decrypt + verify
    
    * src/decrypt.c (parse_status_error): Don't modify args.
    
    --
    Otherwise chained status handlers will not see the full args
    which resulted in a parse error in the verify status handler.
    
    GnuPG-Bug-Id: T3310

diff --git a/src/decrypt.c b/src/decrypt.c
index aa17771..eb7ec4d 100644
--- a/src/decrypt.c
+++ b/src/decrypt.c
@@ -145,10 +145,18 @@ parse_status_error (char *args, op_data_t opd)
   gpgme_error_t err;
   char *field[3];
   int nfields;
+  char *args2;
 
-  nfields = _gpgme_split_fields (args, field, DIM (field));
+  if (!args)
+    return trace_gpg_error (GPG_ERR_INV_ENGINE);
+
+  args2 = strdup (args); /* Split modifies the input string. */
+  nfields = _gpgme_split_fields (args2, field, DIM (field));
   if (nfields < 1)
-    return trace_gpg_error (GPG_ERR_INV_ENGINE); /* Required arg missing.  */
+    {
+      free (args2);
+      return trace_gpg_error (GPG_ERR_INV_ENGINE); /* Required arg missing.  */
+    }
   err = nfields < 2 ? 0 : atoi (field[1]);
 
   if (!strcmp (field[0], "decrypt.algorithm"))
@@ -159,7 +167,10 @@ parse_status_error (char *args, op_data_t opd)
         {
           opd->result.unsupported_algorithm = strdup (field[2]);
           if (!opd->result.unsupported_algorithm)
-            return gpg_error_from_syserror ();
+            {
+              free (args2);
+              return gpg_error_from_syserror ();
+            }
         }
     }
   else if (!strcmp (field[0], "decrypt.keyusage"))
@@ -193,6 +204,7 @@ parse_status_error (char *args, op_data_t opd)
     }
 
 
+  free (args2);
   return 0;
 }
 

-----------------------------------------------------------------------

Summary of changes:
 src/decrypt.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)


hooks/post-receive
-- 
GnuPG Made Easy
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 27 15:02:57 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 27 Jul 2017 15:02:57 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-168-g1bd22a8
Message-ID: <E1daiRO-00022X-Az@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  1bd22a85b4f06324037b3500d2fa8af62733c926 (commit)
      from  a0d0cbee7654ad7582400efaa92d493cd8e669e9 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1bd22a85b4f06324037b3500d2fa8af62733c926
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 27 14:54:50 2017 +0200

    gpg,sm: Allow encryption (with warning) to any key in de-vs mode.
    
    * g10/encrypt.c (encrypt_crypt): Do not abort for a non-compliant key.
    * sm/encrypt.c (gpgsm_encrypt): Ditto.
    --
    
    GnuPG-bug-id: 3306
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/encrypt.c b/g10/encrypt.c
index c63ec88..c7982d4 100644
--- a/g10/encrypt.c
+++ b/g10/encrypt.c
@@ -657,16 +657,12 @@ encrypt_crypt (ctrl_t ctrl, int filefd, const char *filename,
         PKT_public_key *pk = pkr->pk;
         unsigned int nbits = nbits_from_pk (pk);
 
-        if (! gnupg_pk_is_allowed (opt.compliance, PK_USE_ENCRYPTION,
-                                   pk->pubkey_algo, pk->pkey, nbits, NULL))
-          {
-            log_error (_("key %s not suitable for encryption"
-                         " while in %s mode\n"),
-                       keystr_from_pk (pk),
-                       gnupg_compliance_option_string (opt.compliance));
-            rc = gpg_error (GPG_ERR_PUBKEY_ALGO);
-            goto leave;
-          }
+        if (!gnupg_pk_is_compliant (opt.compliance,
+                                    pk->pubkey_algo, pk->pkey, nbits, NULL))
+          log_info (_("WARNING: key %s is not suitable for encryption"
+                      " in %s mode\n"),
+                    keystr_from_pk (pk),
+                    gnupg_compliance_option_string (opt.compliance));
 
         if (compliant
             && !gnupg_pk_is_compliant (CO_DE_VS, pk->pubkey_algo, pk->pkey,
diff --git a/sm/encrypt.c b/sm/encrypt.c
index 7351932..0225476 100644
--- a/sm/encrypt.c
+++ b/sm/encrypt.c
@@ -481,15 +481,16 @@ gpgsm_encrypt (ctrl_t ctrl, certlist_t recplist, int data_fd, estream_t out_fp)
 
       /* Check compliance.  */
       pk_algo = gpgsm_get_key_algo_info (cl->cert, &nbits);
-      if (! gnupg_pk_is_allowed (opt.compliance, PK_USE_ENCRYPTION, pk_algo,
-                                 NULL, nbits, NULL))
+      if (!gnupg_pk_is_compliant (opt.compliance, pk_algo, NULL, nbits, NULL))
         {
-          log_error ("certificate ID 0x%08lX not suitable for "
-                     "encryption while in %s mode\n",
-                     gpgsm_get_short_fingerprint (cl->cert, NULL),
-                     gnupg_compliance_option_string (opt.compliance));
-          rc = gpg_error (GPG_ERR_PUBKEY_ALGO);
-          goto leave;
+          char  kidstr[10+1];
+
+          snprintf (kidstr, sizeof kidstr, "0x%08lX",
+                    gpgsm_get_short_fingerprint (cl->cert, NULL));
+          log_info (_("WARNING: key %s is not suitable for encryption"
+                      " in %s mode\n"),
+                    kidstr,
+                    gnupg_compliance_option_string (opt.compliance));
         }
 
       /* Fixme: When adding ECC we need to provide the curvename and

-----------------------------------------------------------------------

Summary of changes:
 g10/encrypt.c | 16 ++++++----------
 sm/encrypt.c  | 17 +++++++++--------
 2 files changed, 15 insertions(+), 18 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Thu Jul 27 16:27:51 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Thu, 27 Jul 2017 16:27:51 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-169-g6502bb0
Message-ID: <E1dajlX-0006b0-K1@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  6502bb0d2af5784918ebb74242fff6f0a72844bf (commit)
      from  1bd22a85b4f06324037b3500d2fa8af62733c926 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 6502bb0d2af5784918ebb74242fff6f0a72844bf
Author: Werner Koch <wk at gnupg.org>
Date:   Thu Jul 27 16:22:36 2017 +0200

    gpg: Tweak compliance checking for verification
    
    * common/compliance.c (gnupg_pk_is_allowed): Rework to always allow
    verification.
    * g10/mainproc.c (check_sig_and_print): Print a con-compliant warning.
    * g10/sig-check.c (check_signature2): Use log_error instead of
    log_info.
    --
    
    We should be able to verify all signatures.  So we only print a
    warning.  That is the same beheavour as for untrusted keys etc.
    
    GnuPG-bug-id: 3311
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/common/compliance.c b/common/compliance.c
index 9511724..49aada1 100644
--- a/common/compliance.c
+++ b/common/compliance.c
@@ -200,6 +200,8 @@ gnupg_pk_is_allowed (enum gnupg_compliance_mode compliance,
 		     enum pk_use_case use, int algo, gcry_mpi_t key[],
 		     unsigned int keylength, const char *curvename)
 {
+  int result = 0;
+
   if (! initialized)
     return 1;
 
@@ -214,47 +216,41 @@ gnupg_pk_is_allowed (enum gnupg_compliance_mode compliance,
 	  switch (use)
 	    {
 	    case PK_USE_DECRYPTION:
-	      return 1;
+	    case PK_USE_VERIFICATION:
+	      result = 1;
+              break;
 	    case PK_USE_ENCRYPTION:
 	    case PK_USE_SIGNING:
-	      return (keylength == 2048
-		      || keylength == 3072
-		      || keylength == 4096);
-	    case PK_USE_VERIFICATION:
-	      return (keylength == 2048
-		      || keylength == 3072
-		      || keylength == 4096
-		      || keylength < 2048);
+	      result = (keylength == 2048
+                        || keylength == 3072
+                        || keylength == 4096);
+              break;
 	    default:
 	      log_assert (!"reached");
 	    }
-	  log_assert (!"reached");
+	  break;
 
 	case PUBKEY_ALGO_DSA:
-	  if (key)
+          if (use == PK_USE_VERIFICATION)
+            result = 1;
+	  else if (use == PK_USE_SIGNING && key)
 	    {
 	      size_t P = gcry_mpi_get_nbits (key[0]);
 	      size_t Q = gcry_mpi_get_nbits (key[1]);
-	      return ((use == PK_USE_SIGNING
-		       && Q == 256
-		       && (P == 2048 || P == 3072))
-		      || (use == PK_USE_VERIFICATION
-			  && P < 2048));
-	    }
-	  else
-	    return 0;
-	  log_assert (!"reached");
+	      result = (Q == 256 && (P == 2048 || P == 3072));
+            }
+          break;
 
 	case PUBKEY_ALGO_ELGAMAL:
 	case PUBKEY_ALGO_ELGAMAL_E:
-	  return use == PK_USE_DECRYPTION;
+	  result = (use == PK_USE_DECRYPTION);
+          break;
 
 	case PUBKEY_ALGO_ECDH:
 	  if (use == PK_USE_DECRYPTION)
-            return 1;
+            result = 1;
           else if (use == PK_USE_ENCRYPTION)
             {
-              int result = 0;
               char *curve = NULL;
 
               if (!curvename && key)
@@ -271,17 +267,17 @@ gnupg_pk_is_allowed (enum gnupg_compliance_mode compliance,
                             || !strcmp (curvename, "brainpoolP512r1")));
 
               xfree (curve);
-              return result;
             }
-          else
-            return 0;
+          break;
 
 	case PUBKEY_ALGO_ECDSA:
-	  {
-	    int result = 0;
-	    char *curve = NULL;
+          if (use == PK_USE_VERIFICATION)
+            result = 1;
+          else
+            {
+              char *curve = NULL;
 
-	    if (! curvename && key)
+              if (! curvename && key)
 	      {
 		curve = openpgp_oid_to_str (key[0]);
 		curvename = openpgp_oid_to_curve (curve, 0);
@@ -289,31 +285,30 @@ gnupg_pk_is_allowed (enum gnupg_compliance_mode compliance,
 		  curvename = curve;
 	      }
 
-	    result = ((use == PK_USE_SIGNING
-		       && curvename
-		       && (!strcmp (curvename, "brainpoolP256r1")
-			   || !strcmp (curvename, "brainpoolP384r1")
-			   || !strcmp (curvename, "brainpoolP512r1")))
-		      || use == PK_USE_VERIFICATION);
+              result = (use == PK_USE_SIGNING
+                         && curvename
+                         && (!strcmp (curvename, "brainpoolP256r1")
+                             || !strcmp (curvename, "brainpoolP384r1")
+                             || !strcmp (curvename, "brainpoolP512r1")));
+              xfree (curve);
+            }
+          break;
 
-	    xfree (curve);
-	    return result;
-	  }
 
 	case PUBKEY_ALGO_EDDSA:
-	  return 0;
+	  break;
 
 	default:
-	  return 0;
+	  break;
 	}
-      log_assert (!"reached");
+      break;
 
     default:
       /* The default policy is to allow all algorithms.  */
-      return 1;
+      result = 1;
     }
 
-  log_assert (!"reached");
+  return result;
 }
 
 
diff --git a/g10/mainproc.c b/g10/mainproc.c
index d0584d3..b712e60 100644
--- a/g10/mainproc.c
+++ b/g10/mainproc.c
@@ -2168,6 +2168,16 @@ check_sig_and_print (CTX c, kbnode_t node)
                                mainpkhex);
 	}
 
+      /* Print compliance warning for Good signatures.  */
+      if (!rc && pk && !opt.quiet
+          && !gnupg_pk_is_compliant (opt.compliance, pk->pubkey_algo,
+                                     pk->pkey, nbits_from_pk (pk), NULL))
+        {
+          log_info (_("WARNING: This key is not suitable for signing"
+                      " in %s mode\n"),
+                    gnupg_compliance_option_string (opt.compliance));
+        }
+
       /* For good signatures compute and print the trust information.
          Note that in the Tofu trust model this may ask the user on
          how to resolve a conflict.  */
diff --git a/g10/sig-check.c b/g10/sig-check.c
index 9123179..2a3acc4 100644
--- a/g10/sig-check.c
+++ b/g10/sig-check.c
@@ -162,10 +162,10 @@ check_signature2 (ctrl_t ctrl,
 				    NULL))
       {
 	/* Compliance failure.  */
-	log_info (_("key %s not suitable for signature verification"
-                    " while in %s mode\n"),
-		  keystr_from_pk (pk),
-                  gnupg_compliance_option_string (opt.compliance));
+	log_error (_("key %s is not suitable for signature verification"
+                     " in %s mode\n"),
+                   keystr_from_pk (pk),
+                   gnupg_compliance_option_string (opt.compliance));
 	rc = gpg_error (GPG_ERR_PUBKEY_ALGO);
       }
     else if(!pk->flags.valid)
@@ -207,6 +207,7 @@ check_signature2 (ctrl_t ctrl,
 		rc = gpg_error (GPG_ERR_GENERAL);
 	      }
 	  }
+
       }
 
     if( !rc && sig->sig_class < 2 && is_status_enabled() ) {

-----------------------------------------------------------------------

Summary of changes:
 common/compliance.c | 83 +++++++++++++++++++++++++----------------------------
 g10/mainproc.c      | 10 +++++++
 g10/sig-check.c     |  9 +++---
 3 files changed, 54 insertions(+), 48 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 28 10:44:08 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 28 Jul 2017 10:44:08 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-170-g5516ef4
Message-ID: <E1db0sT-0005H9-HQ@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  5516ef47a22dfdf9cdf56107f34d2bda9e46deec (commit)
      from  6502bb0d2af5784918ebb74242fff6f0a72844bf (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5516ef47a22dfdf9cdf56107f34d2bda9e46deec
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 28 10:37:33 2017 +0200

    agent: Minor cleanup (mostly for documentation).
    
    * agent/command.c (cmd_pksign): Change var name 'rc' to 'err'.
    * agent/findkey.c (read_key_file): Ditto.  Change return type to
    gpg_error_t.  On es_fessk failure return a correct error code.
    (agent_key_from_file): Change var name 'rc' to 'err'.
    * agent/pksign.c (agent_pksign_do): Ditto.  Change return type to
    gpg_error_t.  Return a valid erro code on malloc failure.
    (agent_pksign): Ditto.  Change return type to gpg_error_t.  replace
    xmalloc by xtrymalloc.
    * agent/protect.c (calculate_mic): Change return type to gpg_error_t.
    (do_decryption): Ditto.  Do not init RC.
    (merge_lists): Change return type to gpg_error_t.
    (agent_unprotect): Ditto.
    (agent_get_shadow_info): Ditto.
    --
    
    While code starring for bug 3266 I found two glitches and also changed
    var name for easier reading.
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/agent.h b/agent/agent.h
index b95df57..815d9a5 100644
--- a/agent/agent.h
+++ b/agent/agent.h
@@ -450,14 +450,14 @@ void agent_store_cache_hit (const char *key);
 
 
 /*-- pksign.c --*/
-int agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
-                     const char *desc_text,
-		     gcry_sexp_t *signature_sexp,
-                     cache_mode_t cache_mode, lookup_ttl_t lookup_ttl,
-                     const void *overridedata, size_t overridedatalen);
-int agent_pksign (ctrl_t ctrl, const char *cache_nonce,
-                  const char *desc_text,
-                  membuf_t *outbuf, cache_mode_t cache_mode);
+gpg_error_t agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
+                             const char *desc_text,
+                             gcry_sexp_t *signature_sexp,
+                             cache_mode_t cache_mode, lookup_ttl_t lookup_ttl,
+                             const void *overridedata, size_t overridedatalen);
+gpg_error_t agent_pksign (ctrl_t ctrl, const char *cache_nonce,
+                          const char *desc_text,
+                          membuf_t *outbuf, cache_mode_t cache_mode);
 
 /*-- pkdecrypt.c --*/
 int agent_pkdecrypt (ctrl_t ctrl, const char *desc_text,
@@ -482,7 +482,7 @@ unsigned char get_standard_s2k_count_rfc4880 (void);
 int agent_protect (const unsigned char *plainkey, const char *passphrase,
                    unsigned char **result, size_t *resultlen,
 		   unsigned long s2k_count, int use_ocb);
-int agent_unprotect (ctrl_t ctrl,
+gpg_error_t agent_unprotect (ctrl_t ctrl,
                      const unsigned char *protectedkey, const char *passphrase,
                      gnupg_isotime_t protected_at,
                      unsigned char **result, size_t *resultlen);
@@ -491,8 +491,8 @@ unsigned char *make_shadow_info (const char *serialno, const char *idstring);
 int agent_shadow_key (const unsigned char *pubkey,
                       const unsigned char *shadow_info,
                       unsigned char **result);
-int agent_get_shadow_info (const unsigned char *shadowkey,
-                           unsigned char const **shadow_info);
+gpg_error_t agent_get_shadow_info (const unsigned char *shadowkey,
+                                   unsigned char const **shadow_info);
 gpg_error_t parse_shadow_info (const unsigned char *shadow_info,
                                char **r_hexsn, char **r_idstr, int *r_pinlen);
 gpg_error_t s2k_hash_passphrase (const char *passphrase, int hashalgo,
diff --git a/agent/command.c b/agent/command.c
index e387db5..f2a6683 100644
--- a/agent/command.c
+++ b/agent/command.c
@@ -782,7 +782,7 @@ static const char hlp_pksign[] =
 static gpg_error_t
 cmd_pksign (assuan_context_t ctx, char *line)
 {
-  int rc;
+  gpg_error_t err;
   cache_mode_t cache_mode = CACHE_MODE_NORMAL;
   ctrl_t ctrl = assuan_get_pointer (ctx);
   membuf_t outbuf;
@@ -804,17 +804,17 @@ cmd_pksign (assuan_context_t ctx, char *line)
 
   init_membuf (&outbuf, 512);
 
-  rc = agent_pksign (ctrl, cache_nonce, ctrl->server_local->keydesc,
-                     &outbuf, cache_mode);
-  if (rc)
+  err = agent_pksign (ctrl, cache_nonce, ctrl->server_local->keydesc,
+                      &outbuf, cache_mode);
+  if (err)
     clear_outbuf (&outbuf);
   else
-    rc = write_and_clear_outbuf (ctx, &outbuf);
+    err = write_and_clear_outbuf (ctx, &outbuf);
 
   xfree (cache_nonce);
   xfree (ctrl->server_local->keydesc);
   ctrl->server_local->keydesc = NULL;
-  return leave_cmd (ctx, rc);
+  return leave_cmd (ctx, err);
 }
 
 
diff --git a/agent/findkey.c b/agent/findkey.c
index cff0a7d..e3e9a12 100644
--- a/agent/findkey.c
+++ b/agent/findkey.c
@@ -488,7 +488,7 @@ agent_modify_description (const char *in, const char *comment,
    passphrase (entered or from the cache) is stored there; if not NULL
    will be stored.  The caller needs to free the returned
    passphrase. */
-static int
+static gpg_error_t
 unprotect (ctrl_t ctrl, const char *cache_nonce, const char *desc_text,
            unsigned char **keybuf, const unsigned char *grip,
            cache_mode_t cache_mode, lookup_ttl_t lookup_ttl,
@@ -690,7 +690,7 @@ unprotect (ctrl_t ctrl, const char *cache_nonce, const char *desc_text,
 static gpg_error_t
 read_key_file (const unsigned char *grip, gcry_sexp_t *result)
 {
-  int rc;
+  gpg_error_t err;
   char *fname;
   estream_t fp;
   struct stat st;
@@ -710,30 +710,30 @@ read_key_file (const unsigned char *grip, gcry_sexp_t *result)
   fp = es_fopen (fname, "rb");
   if (!fp)
     {
-      rc = gpg_error_from_syserror ();
-      if (gpg_err_code (rc) != GPG_ERR_ENOENT)
-        log_error ("can't open '%s': %s\n", fname, strerror (errno));
+      err = gpg_error_from_syserror ();
+      if (gpg_err_code (err) != GPG_ERR_ENOENT)
+        log_error ("can't open '%s': %s\n", fname, gpg_strerror (err));
       xfree (fname);
-      return rc;
+      return err;
     }
 
   if (es_fread (&first, 1, 1, fp) != 1)
     {
-      rc = gpg_error_from_syserror ();
+      err = gpg_error_from_syserror ();
       log_error ("error reading first byte from '%s': %s\n",
-                 fname, strerror (errno));
+                 fname, gpg_strerror (err));
       xfree (fname);
       es_fclose (fp);
-      return rc;
+      return err;
     }
 
-  rc = es_fseek (fp, 0, SEEK_SET);
-  if (rc)
+  if (es_fseek (fp, 0, SEEK_SET))
     {
-      log_error ("error seeking in '%s': %s\n", fname, strerror (errno));
+      err = gpg_error_from_syserror ();
+      log_error ("error seeking in '%s': %s\n", fname, gpg_strerror (err));
       xfree (fname);
       es_fclose (fp);
-      return rc;
+      return err;
     }
 
   if (first != '(')
@@ -742,69 +742,69 @@ read_key_file (const unsigned char *grip, gcry_sexp_t *result)
       nvc_t pk;
       int line;
 
-      rc = nvc_parse_private_key (&pk, &line, fp);
+      err = nvc_parse_private_key (&pk, &line, fp);
       es_fclose (fp);
 
-      if (rc)
+      if (err)
         log_error ("error parsing '%s' line %d: %s\n",
-                   fname, line, gpg_strerror (rc));
+                   fname, line, gpg_strerror (err));
       else
         {
-          rc = nvc_get_private_key (pk, result);
+          err = nvc_get_private_key (pk, result);
           nvc_release (pk);
-          if (rc)
+          if (err)
             log_error ("error getting private key from '%s': %s\n",
-                       fname, gpg_strerror (rc));
+                       fname, gpg_strerror (err));
         }
 
       xfree (fname);
-      return rc;
+      return err;
     }
 
   if (fstat (es_fileno (fp), &st))
     {
-      rc = gpg_error_from_syserror ();
-      log_error ("can't stat '%s': %s\n", fname, strerror (errno));
+      err = gpg_error_from_syserror ();
+      log_error ("can't stat '%s': %s\n", fname, gpg_strerror (err));
       xfree (fname);
       es_fclose (fp);
-      return rc;
+      return err;
     }
 
   buflen = st.st_size;
   buf = xtrymalloc (buflen+1);
   if (!buf)
     {
-      rc = gpg_error_from_syserror ();
+      err = gpg_error_from_syserror ();
       log_error ("error allocating %zu bytes for '%s': %s\n",
-                 buflen, fname, strerror (errno));
+                 buflen, fname, gpg_strerror (err));
       xfree (fname);
       es_fclose (fp);
       xfree (buf);
-      return rc;
+      return err;
 
     }
 
   if (es_fread (buf, buflen, 1, fp) != 1)
     {
-      rc = gpg_error_from_syserror ();
+      err = gpg_error_from_syserror ();
       log_error ("error reading %zu bytes from '%s': %s\n",
-                 buflen, fname, strerror (errno));
+                 buflen, fname, gpg_strerror (err));
       xfree (fname);
       es_fclose (fp);
       xfree (buf);
-      return rc;
+      return err;
     }
 
   /* Convert the file into a gcrypt S-expression object.  */
-  rc = gcry_sexp_sscan (&s_skey, &erroff, (char*)buf, buflen);
+  err = gcry_sexp_sscan (&s_skey, &erroff, (char*)buf, buflen);
   xfree (fname);
   es_fclose (fp);
   xfree (buf);
-  if (rc)
+  if (err)
     {
       log_error ("failed to build S-Exp (off=%u): %s\n",
-                 (unsigned int)erroff, gpg_strerror (rc));
-      return rc;
+                 (unsigned int)erroff, gpg_strerror (err));
+      return err;
     }
   *result = s_skey;
   return 0;
@@ -852,7 +852,7 @@ agent_key_from_file (ctrl_t ctrl, const char *cache_nonce,
                      cache_mode_t cache_mode, lookup_ttl_t lookup_ttl,
                      gcry_sexp_t *result, char **r_passphrase)
 {
-  int rc;
+  gpg_error_t err;
   unsigned char *buf;
   size_t len, buflen, erroff;
   gcry_sexp_t s_skey;
@@ -863,20 +863,20 @@ agent_key_from_file (ctrl_t ctrl, const char *cache_nonce,
   if (r_passphrase)
     *r_passphrase = NULL;
 
-  rc = read_key_file (grip, &s_skey);
-  if (rc)
+  err = read_key_file (grip, &s_skey);
+  if (err)
     {
-      if (gpg_err_code (rc) == GPG_ERR_ENOENT)
-        rc = gpg_error (GPG_ERR_NO_SECKEY);
-      return rc;
+      if (gpg_err_code (err) == GPG_ERR_ENOENT)
+        err = gpg_error (GPG_ERR_NO_SECKEY);
+      return err;
     }
 
   /* For use with the protection functions we also need the key as an
      canonical encoded S-expression in a buffer.  Create this buffer
      now.  */
-  rc = make_canon_sexp (s_skey, &buf, &len);
-  if (rc)
-    return rc;
+  err = make_canon_sexp (s_skey, &buf, &len);
+  if (err)
+    return err;
 
   switch (agent_private_key_type (buf))
     {
@@ -887,10 +887,10 @@ agent_key_from_file (ctrl_t ctrl, const char *cache_nonce,
         unsigned char *buf_new;
         size_t buf_newlen;
 
-        rc = agent_unprotect (ctrl, buf, "", NULL, &buf_new, &buf_newlen);
-        if (rc)
+        err = agent_unprotect (ctrl, buf, "", NULL, &buf_new, &buf_newlen);
+        if (err)
           log_error ("failed to convert unprotected openpgp key: %s\n",
-                     gpg_strerror (rc));
+                     gpg_strerror (err));
         else
           {
             xfree (buf);
@@ -917,17 +917,17 @@ agent_key_from_file (ctrl_t ctrl, const char *cache_nonce,
 
         desc_text_final = NULL;
 	if (desc_text)
-          rc = agent_modify_description (desc_text, comment, s_skey,
-                                         &desc_text_final);
+          err = agent_modify_description (desc_text, comment, s_skey,
+                                          &desc_text_final);
         gcry_free (comment);
 
-	if (!rc)
+	if (!err)
 	  {
-	    rc = unprotect (ctrl, cache_nonce, desc_text_final, &buf, grip,
+	    err = unprotect (ctrl, cache_nonce, desc_text_final, &buf, grip,
                             cache_mode, lookup_ttl, r_passphrase);
-	    if (rc)
+	    if (err)
 	      log_error ("failed to unprotect the secret key: %s\n",
-			 gpg_strerror (rc));
+			 gpg_strerror (err));
 	  }
 
 	xfree (desc_text_final);
@@ -939,34 +939,34 @@ agent_key_from_file (ctrl_t ctrl, const char *cache_nonce,
           const unsigned char *s;
           size_t n;
 
-          rc = agent_get_shadow_info (buf, &s);
-          if (!rc)
+          err = agent_get_shadow_info (buf, &s);
+          if (!err)
             {
               n = gcry_sexp_canon_len (s, 0, NULL,NULL);
-              assert (n);
+              log_assert (n);
               *shadow_info = xtrymalloc (n);
               if (!*shadow_info)
-                rc = out_of_core ();
+                err = out_of_core ();
               else
                 {
                   memcpy (*shadow_info, s, n);
-                  rc = 0;
+                  err = 0;
                 }
             }
-          if (rc)
-            log_error ("get_shadow_info failed: %s\n", gpg_strerror (rc));
+          if (err)
+            log_error ("get_shadow_info failed: %s\n", gpg_strerror (err));
         }
       else
-        rc = gpg_error (GPG_ERR_UNUSABLE_SECKEY);
+        err = gpg_error (GPG_ERR_UNUSABLE_SECKEY);
       break;
     default:
       log_error ("invalid private key format\n");
-      rc = gpg_error (GPG_ERR_BAD_SECKEY);
+      err = gpg_error (GPG_ERR_BAD_SECKEY);
       break;
     }
   gcry_sexp_release (s_skey);
   s_skey = NULL;
-  if (rc)
+  if (err)
     {
       xfree (buf);
       if (r_passphrase)
@@ -974,23 +974,23 @@ agent_key_from_file (ctrl_t ctrl, const char *cache_nonce,
           xfree (*r_passphrase);
           *r_passphrase = NULL;
         }
-      return rc;
+      return err;
     }
 
   buflen = gcry_sexp_canon_len (buf, 0, NULL, NULL);
-  rc = gcry_sexp_sscan (&s_skey, &erroff, (char*)buf, buflen);
+  err = gcry_sexp_sscan (&s_skey, &erroff, (char*)buf, buflen);
   wipememory (buf, buflen);
   xfree (buf);
-  if (rc)
+  if (err)
     {
       log_error ("failed to build S-Exp (off=%u): %s\n",
-                 (unsigned int)erroff, gpg_strerror (rc));
+                 (unsigned int)erroff, gpg_strerror (err));
       if (r_passphrase)
         {
           xfree (*r_passphrase);
           *r_passphrase = NULL;
         }
-      return rc;
+      return err;
     }
 
   *result = s_skey;
diff --git a/agent/pksign.c b/agent/pksign.c
index 8faf4a4..f54af08 100644
--- a/agent/pksign.c
+++ b/agent/pksign.c
@@ -271,26 +271,26 @@ do_encode_raw_pkcs1 (const byte *md, size_t mdlen, unsigned int nbits,
 
 
 /* SIGN whatever information we have accumulated in CTRL and return
-   the signature S-expression.  LOOKUP is an optional function to
-   provide a way for lower layers to ask for the caching TTL.  If a
-   CACHE_NONCE is given that cache item is first tried to get a
-   passphrase.  If OVERRIDEDATA is not NULL, OVERRIDEDATALEN bytes
-   from this buffer are used instead of the data in CTRL.  The
-   override feature is required to allow the use of Ed25519 with ssh
-   because Ed25519 does the hashing itself.  */
-int
+ * the signature S-expression.  LOOKUP is an optional function to
+ * provide a way for lower layers to ask for the caching TTL.  If a
+ * CACHE_NONCE is given that cache item is first tried to get a
+ * passphrase.  If OVERRIDEDATA is not NULL, OVERRIDEDATALEN bytes
+ * from this buffer are used instead of the data in CTRL.  The
+ * override feature is required to allow the use of Ed25519 with ssh
+ * because Ed25519 does the hashing itself.  */
+gpg_error_t
 agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
                  const char *desc_text,
 		 gcry_sexp_t *signature_sexp,
                  cache_mode_t cache_mode, lookup_ttl_t lookup_ttl,
                  const void *overridedata, size_t overridedatalen)
 {
+  gpg_error_t err = 0;
   gcry_sexp_t s_skey = NULL;
   gcry_sexp_t s_sig  = NULL;
   gcry_sexp_t s_hash = NULL;
   gcry_sexp_t s_pkey = NULL;
   unsigned char *shadow_info = NULL;
-  unsigned int rc = 0;		/* FIXME: gpg-error? */
   const unsigned char *data;
   int datalen;
   int check_signature = 0;
@@ -309,12 +309,12 @@ agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
   if (!ctrl->have_keygrip)
     return gpg_error (GPG_ERR_NO_SECKEY);
 
-  rc = agent_key_from_file (ctrl, cache_nonce, desc_text, ctrl->keygrip,
-                            &shadow_info, cache_mode, lookup_ttl,
-                            &s_skey, NULL);
-  if (rc)
+  err = agent_key_from_file (ctrl, cache_nonce, desc_text, ctrl->keygrip,
+                             &shadow_info, cache_mode, lookup_ttl,
+                             &s_skey, NULL);
+  if (err)
     {
-      if (gpg_err_code (rc) != GPG_ERR_NO_SECKEY)
+      if (gpg_err_code (err) != GPG_ERR_NO_SECKEY)
         log_error ("failed to read the secret key\n");
       goto leave;
     }
@@ -329,8 +329,8 @@ agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
       int is_ECDSA = 0;
       int is_EdDSA = 0;
 
-      rc = agent_public_key_from_file (ctrl, ctrl->keygrip, &s_pkey);
-      if (rc)
+      err = agent_public_key_from_file (ctrl, ctrl->keygrip, &s_pkey);
+      if (err)
         {
           log_error ("failed to read the public key\n");
           goto leave;
@@ -353,15 +353,15 @@ agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
         if (desc_text)
           agent_modify_description (desc_text, NULL, s_skey, &desc2);
 
-        rc = divert_pksign (ctrl, desc2? desc2 : desc_text,
-                            data, datalen,
-                            ctrl->digest.algo,
-                            shadow_info, &buf, &len);
+        err = divert_pksign (ctrl, desc2? desc2 : desc_text,
+                             data, datalen,
+                             ctrl->digest.algo,
+                             shadow_info, &buf, &len);
         xfree (desc2);
       }
-      if (rc)
+      if (err)
         {
-          log_error ("smartcard signing failed: %s\n", gpg_strerror (rc));
+          log_error ("smartcard signing failed: %s\n", gpg_strerror (err));
           goto leave;
         }
 
@@ -379,13 +379,13 @@ agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
               *buf = 0;
             }
 
-          rc = gcry_sexp_build (&s_sig, NULL, "(sig-val(rsa(s%b)))",
-                                (int)len, buf);
+          err = gcry_sexp_build (&s_sig, NULL, "(sig-val(rsa(s%b)))",
+                                 (int)len, buf);
         }
       else if (is_EdDSA)
         {
-          rc = gcry_sexp_build (&s_sig, NULL, "(sig-val(eddsa(r%b)(s%b)))",
-                                (int)len/2, buf, (int)len/2, buf + len/2);
+          err = gcry_sexp_build (&s_sig, NULL, "(sig-val(eddsa(r%b)(s%b)))",
+                                 (int)len/2, buf, (int)len/2, buf + len/2);
         }
       else if (is_ECDSA)
         {
@@ -401,7 +401,10 @@ agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
               r_buflen++;
               r_buf_allocated = xtrymalloc (r_buflen);
               if (!r_buf_allocated)
-                goto leave;
+                {
+                  err = gpg_error_from_syserror ();
+                  goto leave;
+                }
 
               r_buf = r_buf_allocated;
               memcpy (r_buf + 1, buf, len/2);
@@ -416,6 +419,7 @@ agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
               s_buf_allocated = xtrymalloc (s_buflen);
               if (!s_buf_allocated)
                 {
+                  err = gpg_error_from_syserror ();
                   xfree (r_buf_allocated);
                   goto leave;
                 }
@@ -427,20 +431,20 @@ agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
           else
             s_buf = buf + len/2;
 
-          rc = gcry_sexp_build (&s_sig, NULL, "(sig-val(ecdsa(r%b)(s%b)))",
-                                r_buflen, r_buf,
-                                s_buflen, s_buf);
+          err = gcry_sexp_build (&s_sig, NULL, "(sig-val(ecdsa(r%b)(s%b)))",
+                                 r_buflen, r_buf,
+                                 s_buflen, s_buf);
           xfree (r_buf_allocated);
           xfree (s_buf_allocated);
         }
       else
-        rc = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
+        err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
 
       xfree (buf);
-      if (rc)
+      if (err)
 	{
 	  log_error ("failed to convert sigbuf returned by divert_pksign "
-		     "into S-Exp: %s", gpg_strerror (rc));
+		     "into S-Exp: %s", gpg_strerror (err));
 	  goto leave;
 	}
     }
@@ -451,27 +455,29 @@ agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
 
       /* Put the hash into a sexp */
       if (agent_is_eddsa_key (s_skey))
-        rc = do_encode_eddsa (data, datalen,
-                              &s_hash);
+        err = do_encode_eddsa (data, datalen,
+                               &s_hash);
       else if (ctrl->digest.algo == MD_USER_TLS_MD5SHA1)
-        rc = do_encode_raw_pkcs1 (data, datalen,
-                                  gcry_pk_get_nbits (s_skey),
-                                  &s_hash);
+        err = do_encode_raw_pkcs1 (data, datalen,
+                                   gcry_pk_get_nbits (s_skey),
+                                   &s_hash);
       else if ( (dsaalgo = agent_is_dsa_key (s_skey)) )
-        rc = do_encode_dsa (data, datalen,
-                            dsaalgo, s_skey,
-                            &s_hash);
+        err = do_encode_dsa (data, datalen,
+                             dsaalgo, s_skey,
+                             &s_hash);
       else
-        rc = do_encode_md (data, datalen,
-                           ctrl->digest.algo,
-                           &s_hash,
-                           ctrl->digest.raw_value);
-      if (rc)
+        err = do_encode_md (data, datalen,
+                            ctrl->digest.algo,
+                            &s_hash,
+                            ctrl->digest.raw_value);
+      if (err)
         goto leave;
 
       if (dsaalgo == 0 && GCRYPT_VERSION_NUMBER < 0x010700)
-        /* It's RSA and Libgcrypt < 1.7 */
-        check_signature = 1;
+        {
+          /* It's RSA and Libgcrypt < 1.7 */
+          check_signature = 1;
+        }
 
       if (DBG_CRYPTO)
         {
@@ -480,10 +486,10 @@ agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
         }
 
       /* sign */
-      rc = gcry_pk_sign (&s_sig, s_hash, s_skey);
-      if (rc)
+      err = gcry_pk_sign (&s_sig, s_hash, s_skey);
+      if (err)
         {
-          log_error ("signing failed: %s\n", gpg_strerror (rc));
+          log_error ("signing failed: %s\n", gpg_strerror (err));
           goto leave;
         }
 
@@ -502,20 +508,20 @@ agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
       if (s_hash == NULL)
         {
           if (ctrl->digest.algo == MD_USER_TLS_MD5SHA1)
-            rc = do_encode_raw_pkcs1 (data, datalen,
-                                      gcry_pk_get_nbits (sexp_key), &s_hash);
+            err = do_encode_raw_pkcs1 (data, datalen,
+                                       gcry_pk_get_nbits (sexp_key), &s_hash);
           else
-            rc = do_encode_md (data, datalen, ctrl->digest.algo, &s_hash,
-                               ctrl->digest.raw_value);
+            err = do_encode_md (data, datalen, ctrl->digest.algo, &s_hash,
+                                ctrl->digest.raw_value);
         }
 
-      if (! rc)
-        rc = gcry_pk_verify (s_sig, s_hash, sexp_key);
+      if (!err)
+        err = gcry_pk_verify (s_sig, s_hash, sexp_key);
 
-      if (rc)
+      if (err)
         {
           log_error (_("checking created signature failed: %s\n"),
-                     gpg_strerror (rc));
+                     gpg_strerror (err));
           gcry_sexp_release (s_sig);
           s_sig = NULL;
         }
@@ -530,37 +536,42 @@ agent_pksign_do (ctrl_t ctrl, const char *cache_nonce,
   gcry_sexp_release (s_hash);
   xfree (shadow_info);
 
-  return rc;
+  return err;
 }
 
+
 /* SIGN whatever information we have accumulated in CTRL and write it
-   back to OUTFP.  If a CACHE_NONCE is given that cache item is first
-   tried to get a passphrase.  */
-int
+ * back to OUTFP.  If a CACHE_NONCE is given that cache item is first
+ * tried to get a passphrase.  */
+gpg_error_t
 agent_pksign (ctrl_t ctrl, const char *cache_nonce, const char *desc_text,
               membuf_t *outbuf, cache_mode_t cache_mode)
 {
+  gpg_error_t err;
   gcry_sexp_t s_sig = NULL;
   char *buf = NULL;
   size_t len = 0;
-  int rc = 0;
 
-  rc = agent_pksign_do (ctrl, cache_nonce, desc_text, &s_sig, cache_mode, NULL,
-                        NULL, 0);
-  if (rc)
+  err = agent_pksign_do (ctrl, cache_nonce, desc_text, &s_sig, cache_mode,
+                         NULL, NULL, 0);
+  if (err)
     goto leave;
 
   len = gcry_sexp_sprint (s_sig, GCRYSEXP_FMT_CANON, NULL, 0);
-  assert (len);
-  buf = xmalloc (len);
+  log_assert (len);
+  buf = xtrymalloc (len);
+  if (!buf)
+    {
+      err = gpg_error_from_syserror ();
+      goto leave;
+    }
   len = gcry_sexp_sprint (s_sig, GCRYSEXP_FMT_CANON, buf, len);
-  assert (len);
-
+  log_assert (len);
   put_membuf (outbuf, buf, len);
 
  leave:
   gcry_sexp_release (s_sig);
   xfree (buf);
 
-  return rc;
+  return err;
 }
diff --git a/agent/protect.c b/agent/protect.c
index 18b44f1..7817901 100644
--- a/agent/protect.c
+++ b/agent/protect.c
@@ -238,7 +238,7 @@ get_standard_s2k_count_rfc4880 (void)
 /* Calculate the MIC for a private key or shared secret S-expression.
    SHA1HASH should point to a 20 byte buffer.  This function is
    suitable for all algorithms. */
-static int
+static gpg_error_t
 calculate_mic (const unsigned char *plainkey, unsigned char *sha1hash)
 {
   const unsigned char *hash_begin, *hash_end;
@@ -728,7 +728,7 @@ agent_protect (const unsigned char *plainkey, const char *passphrase,
 
 

 /* Do the actual decryption and check the return list for consistency.  */
-static int
+static gpg_error_t
 do_decryption (const unsigned char *aad_begin, size_t aad_len,
                const unsigned char *aadhole_begin, size_t aadhole_len,
                const unsigned char *protected, size_t protectedlen,
@@ -738,7 +738,7 @@ do_decryption (const unsigned char *aad_begin, size_t aad_len,
                int prot_cipher, int prot_cipher_keylen, int is_ocb,
                unsigned char **result)
 {
-  int rc = 0;
+  int rc;
   int blklen;
   gcry_cipher_hd_t hd;
   unsigned char *outbuf;
@@ -858,7 +858,7 @@ do_decryption (const unsigned char *aad_begin, size_t aad_len,
  * CUTOFF and CUTLEN will receive the offset and the length of the
  * resulting list which should go into the MIC calculation but then be
  * removed.  */
-static int
+static gpg_error_t
 merge_lists (const unsigned char *protectedkey,
              size_t replacepos,
              const unsigned char *cleartext,
@@ -1011,7 +1011,7 @@ merge_lists (const unsigned char *protectedkey,
 /* Unprotect the key encoded in canonical format.  We assume a valid
    S-Exp here.  If a protected-at item is available, its value will
    be stored at protected_at unless this is NULL.  */
-int
+gpg_error_t
 agent_unprotect (ctrl_t ctrl,
                  const unsigned char *protectedkey, const char *passphrase,
                  gnupg_isotime_t protected_at,
@@ -1291,6 +1291,7 @@ agent_unprotect (ctrl_t ctrl,
   return 0;
 }
 
+
 /* Check the type of the private key, this is one of the constants:
    PRIVATE_KEY_UNKNOWN if we can't figure out the type (this is the
    value 0), PRIVATE_KEY_CLEAR for an unprotected private key.
@@ -1549,7 +1550,7 @@ agent_shadow_key (const unsigned char *pubkey,
 
 /* Parse a canonical encoded shadowed key and return a pointer to the
    inner list with the shadow_info */
-int
+gpg_error_t
 agent_get_shadow_info (const unsigned char *shadowkey,
                        unsigned char const **shadow_info)
 {

-----------------------------------------------------------------------

Summary of changes:
 agent/agent.h   |  22 ++++----
 agent/command.c |  12 ++---
 agent/findkey.c | 132 +++++++++++++++++++++++------------------------
 agent/pksign.c  | 155 ++++++++++++++++++++++++++++++--------------------------
 agent/protect.c |  13 ++---
 5 files changed, 173 insertions(+), 161 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 28 12:01:30 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 28 Jul 2017 12:01:30 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-173-g5cf9515
Message-ID: <E1db25L-0000XY-Hw@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  5cf95157c5db88dd599ac4d48f619782179b1438 (commit)
       via  1c35e29af95c46475f297d2bd70a5f3bd49d45b1 (commit)
       via  6496dc1f9d2aef3bf8cf950da2434c96f7a0145c (commit)
      from  5516ef47a22dfdf9cdf56107f34d2bda9e46deec (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5cf95157c5db88dd599ac4d48f619782179b1438
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 28 11:40:56 2017 +0200

    agent: For OCB key files return Bad Passprase instead of Checksum Error.
    
    * agent/protect.c (do_decryption): Map error checksum to bad
    passpharse protection
    
    * agent/call-pinentry.c (unlock_pinentry): Don't munge the error
    source for corrupted protection.
    --
    
    GnuPG-bug-id: 3266
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/agent/call-pinentry.c b/agent/call-pinentry.c
index cb7997f..6a5c1fe 100644
--- a/agent/call-pinentry.c
+++ b/agent/call-pinentry.c
@@ -167,6 +167,10 @@ unlock_pinentry (gpg_error_t rc)
         case GPG_ERR_BAD_PIN:
           break;
 
+        case GPG_ERR_CORRUPTED_PROTECTION:
+          /* This comes from gpg-agent.  */
+          break;
+
         default:
           rc = gpg_err_make (GPG_ERR_SOURCE_PINENTRY, gpg_err_code (rc));
           break;
diff --git a/agent/protect.c b/agent/protect.c
index 7817901..c257861 100644
--- a/agent/protect.c
+++ b/agent/protect.c
@@ -813,7 +813,14 @@ do_decryption (const unsigned char *aad_begin, size_t aad_len,
                                         protected, protectedlen - 16);
             }
           if (!rc)
-            rc = gcry_cipher_checktag (hd, protected + protectedlen - 16, 16);
+            {
+              rc = gcry_cipher_checktag (hd, protected + protectedlen - 16, 16);
+              if (gpg_err_code (rc) == GPG_ERR_CHECKSUM)
+                {
+                  /* Return Bad Passphrase instead of checksum error */
+                  rc = gpg_error (GPG_ERR_BAD_PASSPHRASE);
+                }
+            }
         }
       else
         {
@@ -833,8 +840,6 @@ do_decryption (const unsigned char *aad_begin, size_t aad_len,
   /* Do a quick check on the data structure. */
   if (*outbuf != '(' && outbuf[1] != '(')
     {
-      /* Note that in OCB mode this is actually invalid _encrypted_
-       * data and not a bad passphrase.  */
       xfree (outbuf);
       return gpg_error (GPG_ERR_BAD_PASSPHRASE);
     }

commit 1c35e29af95c46475f297d2bd70a5f3bd49d45b1
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 28 11:08:32 2017 +0200

    gpg: Minor rework for better readibility of get_best_pubkey_byname.
    
    * g10/getkey.c (get_best_pubkey_byname): Change return type to
    gpg_error_t.  Use var name err instead of rc.  Move a
    gpg_error_from_syserror closer to the call.
    --
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/getkey.c b/g10/getkey.c
index e0c4bd9..79bce61 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -1583,24 +1583,23 @@ pubkey_cmp (ctrl_t ctrl, const char *name, struct pubkey_cmp_cookie *old,
 /* This function works like get_pubkey_byname, but if the name
  * resembles a mail address, the results are ranked and only the best
  * result is returned.  */
-int
+gpg_error_t
 get_best_pubkey_byname (ctrl_t ctrl, GETKEY_CTX *retctx, PKT_public_key *pk,
                         const char *name, KBNODE *ret_keyblock,
                         int include_unusable, int no_akl)
 {
-  int rc;
+  gpg_error_t err;
   struct getkey_ctx_s *ctx = NULL;
 
   if (retctx)
     *retctx = NULL;
 
-  rc = get_pubkey_byname (ctrl, &ctx, pk, name, ret_keyblock,
-                          NULL, include_unusable, no_akl);
-  if (rc)
+  err = get_pubkey_byname (ctrl, &ctx, pk, name, ret_keyblock,
+                           NULL, include_unusable, no_akl);
+  if (err)
     {
-      if (ctx)
-        getkey_end (ctrl, ctx);
-      return rc;
+      getkey_end (ctrl, ctx);
+      return err;
     }
 
   if (is_valid_mailbox (name) && ctx)
@@ -1647,16 +1646,17 @@ get_best_pubkey_byname (ctrl_t ctrl, GETKEY_CTX *retctx, PKT_public_key *pk,
             {
               ctx = xtrycalloc (1, sizeof **retctx);
               if (! ctx)
-                rc = gpg_error_from_syserror ();
+                err = gpg_error_from_syserror ();
               else
                 {
                   ctx->kr_handle = keydb_new ();
                   if (! ctx->kr_handle)
                     {
+                      err = gpg_error_from_syserror ();
                       xfree (ctx);
+                      ctx = NULL;
                       if (retctx)
                         *retctx = NULL;
-                      rc = gpg_error_from_syserror ();
                     }
                   else
                     {
@@ -1671,7 +1671,7 @@ get_best_pubkey_byname (ctrl_t ctrl, GETKEY_CTX *retctx, PKT_public_key *pk,
                         {
                           release_kbnode (*ret_keyblock);
                           *ret_keyblock = NULL;
-                          rc = getkey_next (ctrl, ctx, NULL, ret_keyblock);
+                          err = getkey_next (ctrl, ctx, NULL, ret_keyblock);
                         }
                     }
                 }
@@ -1684,7 +1684,7 @@ get_best_pubkey_byname (ctrl_t ctrl, GETKEY_CTX *retctx, PKT_public_key *pk,
         }
     }
 
-  if (rc && ctx)
+  if (err && ctx)
     {
       getkey_end (ctrl, ctx);
       ctx = NULL;
@@ -1695,7 +1695,7 @@ get_best_pubkey_byname (ctrl_t ctrl, GETKEY_CTX *retctx, PKT_public_key *pk,
   else
     getkey_end (ctrl, ctx);
 
-  return rc;
+  return err;
 }
 
 

diff --git a/g10/keydb.h b/g10/keydb.h
index 15345bb..f793ada 100644
--- a/g10/keydb.h
+++ b/g10/keydb.h
@@ -319,10 +319,10 @@ int get_pubkey_byname (ctrl_t ctrl,
 
 /* Likewise, but only return the best match if NAME resembles a mail
  * address.  */
-int get_best_pubkey_byname (ctrl_t ctrl,
-			    GETKEY_CTX *retctx, PKT_public_key *pk,
-			    const char *name, KBNODE *ret_keyblock,
-			    int include_unusable, int no_akl);
+gpg_error_t get_best_pubkey_byname (ctrl_t ctrl,
+                                    GETKEY_CTX *retctx, PKT_public_key *pk,
+                                    const char *name, KBNODE *ret_keyblock,
+                                    int include_unusable, int no_akl);
 
 /* Get a public key directly from file FNAME.  */
 gpg_error_t get_pubkey_fromfile (ctrl_t ctrl,

commit 6496dc1f9d2aef3bf8cf950da2434c96f7a0145c
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 28 10:58:59 2017 +0200

    gpg: Fix segv in get_best_pubkey_byname.
    
    * g10/getkey.c (get_best_pubkey_byname): Init NEW.
    --
    
    We call free_user_id on NEW.uid and thus it needs to be initialized.
    
    This fixes the ref-count or invisible segv bug from
    GnuPG-bug-id: 3266
    
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/getkey.c b/g10/getkey.c
index 390e2dc..e0c4bd9 100644
--- a/g10/getkey.c
+++ b/g10/getkey.c
@@ -1607,7 +1607,7 @@ get_best_pubkey_byname (ctrl_t ctrl, GETKEY_CTX *retctx, PKT_public_key *pk,
     {
       /* Rank results and return only the most relevant key.  */
       struct pubkey_cmp_cookie best = { 0 };
-      struct pubkey_cmp_cookie new;
+      struct pubkey_cmp_cookie new = { 0 };
       kbnode_t new_keyblock;
 
       while (getkey_next (ctrl, ctx, &new.key, &new_keyblock) == 0)

-----------------------------------------------------------------------

Summary of changes:
 agent/call-pinentry.c |  4 ++++
 agent/protect.c       | 11 ++++++++---
 g10/getkey.c          | 28 ++++++++++++++--------------
 g10/keydb.h           |  8 ++++----
 4 files changed, 30 insertions(+), 21 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 28 14:18:00 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 28 Jul 2017 14:18:00 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 0075cc681c13e9579412d6115e1be0c0c722fc0e
Message-ID: <E1db4DR-0004Dk-3V@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  0075cc681c13e9579412d6115e1be0c0c722fc0e (commit)
       via  1407143b6a50365ce9c52f8fd4ab65939573a923 (commit)
      from  329cb28391f7fda3a88df03b678cc15d6d338387 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 0075cc681c13e9579412d6115e1be0c0c722fc0e
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 28 14:13:00 2017 +0200

    drafts,openpgp-webkey-service: Published -04.

diff --git a/misc/id/openpgp-webkey-service/draft-koch-openpgp-webkey-service-04.txt b/misc/id/openpgp-webkey-service/draft-koch-openpgp-webkey-service-04.txt
new file mode 100644
index 0000000..b10fae5
--- /dev/null
+++ b/misc/id/openpgp-webkey-service/draft-koch-openpgp-webkey-service-04.txt
@@ -0,0 +1,952 @@
+
+
+
+
+Network Working Group                                            W. Koch
+Internet-Draft                                             GnuPG Project
+Intended status: Informational                             July 28, 2017
+Expires: January 29, 2018
+
+
+                        OpenPGP Web Key Service
+                  draft-koch-openpgp-webkey-service-04
+
+Abstract
+
+   This specification describes a service to locate OpenPGP keys by mail
+   address using a Web service and the HTTPS protocol.  It also provides
+   a method for secure communication between the key owner and the mail
+   provider to publish and revoke the public key.
+
+Status of This Memo
+
+   This Internet-Draft is submitted in full conformance with the
+   provisions of BCP 78 and BCP 79.
+
+   Internet-Drafts are working documents of the Internet Engineering
+   Task Force (IETF).  Note that other groups may also distribute
+   working documents as Internet-Drafts.  The list of current Internet-
+   Drafts is at http://datatracker.ietf.org/drafts/current/.
+
+   Internet-Drafts are draft documents valid for a maximum of six months
+   and may be updated, replaced, or obsoleted by other documents at any
+   time.  It is inappropriate to use Internet-Drafts as reference
+   material or to cite them other than as "work in progress."
+
+   This Internet-Draft will expire on January 29, 2018.
+
+Copyright Notice
+
+   Copyright (c) 2017 IETF Trust and the persons identified as the
+   document authors.  All rights reserved.
+
+   This document is subject to BCP 78 and the IETF Trust's Legal
+   Provisions Relating to IETF Documents
+   (http://trustee.ietf.org/license-info) in effect on the date of
+   publication of this document.  Please review these documents
+   carefully, as they describe your rights and restrictions with respect
+   to this document.  Code Components extracted from this document must
+   include Simplified BSD License text as described in Section 4.e of
+   the Trust Legal Provisions and are provided without warranty as
+   described in the Simplified BSD License.
+
+
+
+
+Koch                    Expires January 29, 2018                [Page 1]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+Table of Contents
+
+   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
+   2.  Notational Conventions  . . . . . . . . . . . . . . . . . . .   2
+   3.  Web Key Directory . . . . . . . . . . . . . . . . . . . . . .   2
+     3.1.  Key Discovery . . . . . . . . . . . . . . . . . . . . . .   3
+   4.  Web Key Directory Update Protocol . . . . . . . . . . . . . .   5
+     4.1.  The Submission Address  . . . . . . . . . . . . . . . . .   6
+     4.2.  The Submission Mail . . . . . . . . . . . . . . . . . . .   6
+     4.3.  The Confirmation Request  . . . . . . . . . . . . . . . .   6
+     4.4.  The Confirmation Response . . . . . . . . . . . . . . . .   8
+     4.5.  Policy Flags  . . . . . . . . . . . . . . . . . . . . . .   9
+   5.  Security Considerations . . . . . . . . . . . . . . . . . . .   9
+   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  10
+     6.1.  Well-Known URI  . . . . . . . . . . . . . . . . . . . . .  10
+   7.  Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .  10
+   8.  Normative References  . . . . . . . . . . . . . . . . . . . .  10
+   Appendix A.  Sample Protocol Run  . . . . . . . . . . . . . . . .  11
+     A.1.  Sample Keys . . . . . . . . . . . . . . . . . . . . . . .  11
+     A.2.  Sample Messages . . . . . . . . . . . . . . . . . . . . .  12
+   Appendix B.  Changes Since -03  . . . . . . . . . . . . . . . . .  16
+   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .  17
+
+1.  Introduction
+
+   This memo describes a method to associate OpenPGP keys with a mail
+   address and how to look them up using a web service with a well-known
+   URI.  In addition a mail based protocol is given to allow a client to
+   setup such an association and to maintain it.
+
+2.  Notational Conventions
+
+   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
+   "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
+   document are to be interpreted as described in [RFC2119].
+
+3.  Web Key Directory
+
+   A major use case for OpenPGP is the encryption of mail.  A common
+   difficulty of sending encrypted mails to a new communication partner
+   is to find the appropriate public key of the recipient.  Unless an
+   off-channel key exchange has been done, there are no easy ways to
+   discover the required key.  The common practice is to search the
+   network of public key servers for a key matching the recipient's mail
+   address.  This practise bears the problem that the keyservers are not
+   able to give a positive confirmation that a key actually belongs to
+   the mail addresses given in the key.  Further, there are often
+   several keys matching a mail address and thus one needs to pick a key
+
+
+
+Koch                    Expires January 29, 2018                [Page 2]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+   on good luck.  This is clearly not a secure way to setup an end-to-
+   end encryption.  Even if the need for a trusted key for an initial
+   mail message is relinquished, a non-authenticated key may be a wrong
+   one and the actual recipient would receive a mail which she can't
+   decrypt, due to the use of a wrong key.
+
+   Methods to overcome this problem are
+
+   o  sending an initial unencrypted message with the public key
+      attached,
+
+   o  using the OpenPGP DANE protocol to lookup the recipients key via
+      the DNS.
+
+   The first method has the obvious problems of not even trying to
+   encrypt the initial mail, an extra mail round-trip, and problems with
+   unattended key discovery.
+
+   The latter method works fine but requires that mail providers need to
+   set up a separate DNS resolver to provide the key.  The
+   administration of a DNS zone is often not in the hands of small mail
+   installations.  Thus an update of the DNS resource records needs to
+   be delegated to the ISP running the DNS service.  Further, DNS
+   lookups are not encrypted and missing all confidentially.  Even if
+   the participating MUAs are using STARTTLS to encrypt the mail
+   exchange, a DNS lookup for the key unnecessarily identifies the
+   local-part of the recipients mail address to any passive
+   eavesdroppers.
+
+   This memo specified a new method for key discovery using an encrypted
+   https connection.
+
+3.1.  Key Discovery
+
+   Although URIs are able to encode all kind of characters,
+   straightforward implementations of a key directory may want to store
+   the local-part of a mail address directly in the file system.  This
+   forbids the use of certain characters in the local-part.  To allow
+   for such an implementation method the URI uses an encoded form of the
+   local-part which can be directly mapped to a file name.
+
+   OpenPGP defines its User IDs, and thus the mail address, as UTF-8
+   strings.  To help with the common pattern of using capitalized names
+   (e.g.  "Joe.Doe at example.org") for mail addresses, and under the
+   premise that almost all MTAs treat the local-part case-insensitive
+   and that the domain-part is required to be compared case-insensitive
+   anyway, all upper-case ASCII characters in a User ID are mapped to
+   lowercase.  Non-ASCII characters are not changed.
+
+
+
+Koch                    Expires January 29, 2018                [Page 3]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+   The so mapped local-part is hashed using the SHA-1 algorithm.  The
+   resulting 160 bit digest is encoded using the Z-Base-32 method as
+   described in [RFC6189], section 5.1.6.  The resulting string has a
+   fixed length of 32 octets.  To form the URI, the following parts are
+   concatenated:
+
+   o  The scheme "https://",
+
+   o  the domain-part,
+
+   o  the string "/.well-known/openpgpkey/hu/",
+
+   o  and the above constructed 32 octet string.
+
+   For example the URI to lookup the key for Joe.Doe at Example.ORG is:
+
+     https://example.org/.well-known/openpgpkey/
+     hu/iy9q119eutrkn8s1mk4r39qejnbu3n5q
+
+   (line has been wrapped for rendering purposes)
+
+   DNS SRV resource records ([RFC2782]) may be used to query a different
+   host or a port other than 443.  For example:
+
+     _openpgpkey._tcp.example.org.  IN  SRV 0 0 8443 wkd.example.org.
+
+   changes the above to query the host "wkd.example.org" at port 8443
+   instead of the host "example.org" at port 443.  The target (in the
+   example "wkd.example.org") MUST be a sub-domain of the domain-part
+   (here "example.org").  If the target is not a sub-domain, the SRV RR
+   MUST be be ignored.  The recommended name for the sub-domain is
+   "wkd".
+
+   The HTTP GET method MUST return the binary representation of the
+   OpenPGP key for the given mail address.  The key needs to carry a
+   User ID packet ([RFC4880]) with that mail address.  Note that the key
+   may be revoked or expired - it is up to the client to handle such
+   conditions.  To ease distribution of revoked keys, a server may
+   return revoked keys in addition to a new key.  The keys are returned
+   by a single request as concatenated key blocks.
+
+   The server MUST accept the HTTP HEAD method to allow a client to
+   check for the existence of a key.
+
+   The server SHOULD use "application/octet-string" as the Content-Type
+   for the data but clients SHOULD also accept any other Content-Type.
+   The server MUST NOT return an ASCII armored version of the key.
+
+
+
+
+Koch                    Expires January 29, 2018                [Page 4]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+4.  Web Key Directory Update Protocol
+
+   To put keys into the key directory a protocol to automate the task is
+   desirable.  The protocol defined here is entirely based on mail and
+   the assumption that a mail provider can securely deliver mail to the
+   INBOX of a user (e.g. an IMAP folder).  Note that the same protocol
+   may also be used for submitting keys for use with OpenPGP DANE.
+
+   We assume that the user already created a key for her mail account
+   alice at example.org.  To install the key at her provider's Web Key
+   Directory, she performs the following steps:
+
+   1.  She retrieves a file which contains one line with the mail
+       address used to submit the key to the mail provider.  The DNS SRV
+       rules described for the Web Key Directory apply here as well.
+       See below for the syntax of that file.  For a mail address at the
+       domain "example.org" the URI of the file is
+
+       https://example.org/.well-known/openpgpkey/submission-address
+
+   2.  She sends her key using SMTP (or any other transport mechanism)
+       to the provider using the submission address and key format as
+       specified by PGP/MIME.
+
+   3.  The provider checks that the received key has a User ID which
+       matches an account name of the provider.
+
+   4.  The provider sends an encrypted message containing a nonce and
+       the fingerprint of the key to the mail account of the user.  Note
+       that a similar scheme is used by the well known caff(1) tool to
+       help with key signing parties.
+
+   5.  A legitimate user will be able to decrypt the message because she
+       created the key and is in charge of the private key.  This step
+       verifies that the submitted key has actually been created by the
+       owner of the account.
+
+   6.  The user sends the decrypted nonce back to the submission address
+       as a confirmation that the private key is owned by her and that
+       the provider may now publish the key.  Although technically not
+       required, it is suggested that the mail to the provider is
+       encrypted.  The public key for this is retrieved using the key
+       lookup protocol described above.
+
+   7.  The provider receives the nonce, matches it with its database of
+       pending confirmations and then publishes the key.  Finally the
+       provider sends a mail back to the user to notify her of the
+       publication of her key.
+
+
+
+Koch                    Expires January 29, 2018                [Page 5]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+   The message data structures used for the above protocol are specified
+   in detail below.  In the following sections the string "WELLKNOWN"
+   denotes the first part of an URI specific for a domain.  In the
+   examples the domain "example.org" is assumed, thus
+
+     WELLKNOWN := https://example.org/.well-known/openpgpkey
+
+   The term "target key" denotes the to be published key, the term
+   "submission key" the key associated with the submission-address of
+   the mail provider.
+
+4.1.  The Submission Address
+
+   The address of the submission file is
+
+     WELLKNOWN/submission-address
+
+   The file consists of exactly one line, terminated by a LF, or the
+   sequence of CR and LF, with the full mail address to be used for
+   submission of a key to the mail provider.  For example the content of
+   the file may be
+
+     key-submission-example.org at directory.example.org
+
+4.2.  The Submission Mail
+
+   The mail used to submit a key to the mail provider MUST comply to the
+   PGP/MIME specification ([RFC3156], section 7), which states that the
+   Content-Type must be "application/pgp-keys", there are no required or
+   optional parameters, and the body part contains the ASCII-armored
+   transferable Public Key Packets as defined in [RFC4880], section
+   11.1.
+
+   The mail provider MUST publish a key capable of signing and
+   encryption for the submission-address in the Web Key Directory or via
+   DANE.  The key to be published MUST be submitted using a PGP/MIME
+   encrypted message ([RFC3156], section 4).  The message MUST NOT be
+   signed (because the authenticity of the signing key has not yet been
+   confirmed).  After decryption of the message at the mail provider a
+   single "application/pgp-keys" part, as specified above, is expected.
+
+4.3.  The Confirmation Request
+
+   The mail provider sends a confirmation mail in response to a received
+   key publication request.  The message MUST be sent from the
+   submission-address of the mail provider to the mail address extracted
+   from the target key.  The message needs to be a PGP/MIME signed
+
+
+
+
+Koch                    Expires January 29, 2018                [Page 6]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+   message using the submission key of the provider for the signature.
+   The signed message MUST have two parts:
+
+   The first part MUST have "text" as its Content-Type and can be used
+   to explain the purpose of the mail.  For example it may point to this
+   RFC and explain on how to manually perform the protocol.
+
+   The second part MUST have "application/vnd.gnupg.wks" as its Content-
+   Type and carry an OpenPGP encrypted message in ASCII Armor format.
+   The message MUST be encrypted to the target key and MUST NOT be
+   signed.  After decryption a text file in the Web Key data format must
+   be yielded.
+
+   That data format consists of name-value pairs with one name-value
+   pair per LF or CR+LF terminated line.  Empty lines are allowed and
+   will be ignored by the receiver.  A colon is used to terminate a
+   name.
+
+   In a confirmation request the following names MUST be send in the
+   specified order:
+
+   o  "type": The value must be "confirmation-request".
+
+   o  "sender": This is the mailbox the user is expected to sent the
+      confirmation response to.  The value must match the mailbox part
+      of the "From:" address of this request.  Exactly one address MUST
+      be given.
+
+   o  "address": The value is the addr-spec part of the target key's
+      mail address.  The value SHOULD match the addr-spec part of the
+      recipient's address.  The value MUST be UTF-8 encoded as required
+      for an OpenPGP User ID.
+
+   o  "fingerprint": The value is the fingerprint of the target key.
+      The fingerprint is given in uppercase hex encoding without any
+      interleaving spaces.
+
+   o  "nonce": The value is a string with a minimum length of 16 octets
+      and a maximum length of 64 octets.  The string must entirely be
+      made up of random ASCII letters or digits.  This nonce will be
+      sent back to the mail provider as proof that the recipient is the
+      legitimate owner of the target-key.
+
+   The receiver of that message is expected to verify the outer
+   signature and disregard the entire message if it can't be verified or
+   has not been signed by the key associated with the submission
+   address.
+
+
+
+
+Koch                    Expires January 29, 2018                [Page 7]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+   After the message as been verified the receiver decrypts the second
+   part of the message, checks that the "fingerprint" matches the target
+   key, checks that the "address" matches a User ID of the target key,
+   and checks the other constrains of the request format.  If any
+   constraint is not asserted, or the fingerprint or User ID do not
+   match the target key, or there is no pending publication requests
+   (i.e. a mail recently sent o the submission address), the user MAY be
+   notified about this fake confirmation attempt.
+
+   In other cases the confirmation request is legitimate and the MUA
+   shall silently send a response as described in the next section.
+
+   The rationale for the outer signature used with this request is to
+   allow early detection of spam mails.  This can be done prior to the
+   decryption step and avoids asking the user to enter a passphrase to
+   perform the decryption for a non-legitimate message.  The use of a
+   simple encrypted attachment, instead of using PGP/MIME encryption, is
+   to convey the Content-Type of that attachment in the clear and also
+   to prevent automatic decryption of that attachment by PGP/MIME aware
+   clients.  The MUA may in fact detect this confirmation request and
+   present a customized dialog for confirming that request.
+
+4.4.  The Confirmation Response
+
+   A response to a confirmation request MUST only be send in the
+   positive case; there is no negative confirmation response.  A mail
+   service provider is expected to cancel a pending key submission after
+   a suitable time without a confirmation.  The mail service provider
+   SHOULD NOT retry the sending of a confirmation request after the
+   first request has been send successfully.
+
+   The user MUST send the confirmation response from her target mail
+   address to the "from" address of the confirmation request.  The
+   message MUST be signed and encrypted using the PGP/MIME Combined
+   format ([RFC3156], section 6.2).  The signing key is the target key
+   and the encryption key is the key associated with the provider's
+   submission address.
+
+   The Content-Type used for the plaintext message MUST also be
+   "application/vnd.gnupg.wks".  The format is the same as described
+   above for the Confirmation Request.  The body must contain three
+   name-value pairs in this order:
+
+   o  "type": The value must be "confirmation-response".
+
+   o  "sender": The value must match the mailbox part of the "From:"
+      address of this response.  Exactly one address MUST be given.
+
+
+
+
+Koch                    Expires January 29, 2018                [Page 8]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+   o  "nonce": The value is the value of the "nonce" parameter from the
+      confirmation request.
+
+4.5.  Policy Flags
+
+   For key generation and submission it is sometimes useful to tell the
+   client about certain properties of the mail provider in advance.
+   This can be done with a file at the URL
+
+     WELLKNOWN/policy
+
+   The file contains keywords and optioanlly values, one per line with
+   each line terminated by a LF or the sequence of CR and LF.  Empty
+   lines and lines starting with a '#' character are considered comment
+   lines.  A keyword is made up of lowercase letters, digits, hyphens,
+   or dots.  An underscore is allowed as a name space delimiters; see
+   below.  The first character must be a letter.  Keywords which are
+   defined to require a value are directly followed by a colon and then
+   after optional white space the value.  Clients MUST use case-
+   insensitive matching for the keyword.
+
+   Currently defined keywords are:
+
+   o  "mailbox-only": The mail server provider does only accept keys
+      with only a mailbox in the User ID.  In particular User IDs with a
+      real name in addition to the mailbox will be rejected as invalid.
+
+   o  "dane-only": The mail server provider does not run a Web Key
+      Directory but only an OpenPGP DANE service.  The Web Key Directory
+      Update protocol is used to update the keys for the DANE service.
+
+   o  "auth-submit": The submission of the mail to the server is done
+      using an authenticated connection.  Thus the submitted key will be
+      published immediately without any confirmation request.
+
+   More keywords will be defined in updates to this I-D.  There is no
+   registry except for this document.  For experimental use of new
+   features or for provider specific settings, keywords MUST be prefixed
+   with a domain name and an underscore.
+
+5.  Security Considerations
+
+   The use of SHA-1 for the mapping of the local-part to a fixed string
+   is not a security feature but merely used to map the local-part to a
+   fixed-sized string made from a well defined set of characters.  It is
+   not intended to conceal information about a mail address.
+
+
+
+
+
+Koch                    Expires January 29, 2018                [Page 9]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+   The domain name part of the mail address is not part of the hash to
+   avoid problems with internationalized domain names.  Instead a
+   separate URL is required for each domain name.
+
+   The use of DNS SRV records reduces the certainty that a mail address
+   belongs to a domain.  For example an attacker may change the target
+   to a host in a sub-domain under their control and thus gain full
+   control over all keys.  An implementation may want to weight the
+   certainty of a mapping different if it has been retrieved via a sub-
+   domain and in particular if a non-recommended name is used for the
+   sub-domain.
+
+6.  IANA Considerations
+
+6.1.  Well-Known URI
+
+   IANA is requested to assign a well-known URI in the "Well-Known URIs"
+   registry as defined by [RFC5785]:
+
+   URI suffix: openpgpkey
+
+   Change controller: IETF
+
+   Specification document: This
+
+7.  Acknowledgments
+
+   The author would like to acknowledge the help of the individuals who
+   kindly voiced their opinions on the GnuPG mailing lists, in
+   particular, the help of Bernhard Reiter and Guilhem Moulin.
+
+8.  Normative References
+
+   [RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
+              Requirement Levels", BCP 14, RFC 2119, March 1997.
+
+   [RFC2782]  Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR for
+              specifying the location of services (DNS SRV)", RFC 2782,
+              DOI 10.17487/RFC2782, February 2000,
+              <http://www.rfc-editor.org/info/rfc2782>.
+
+   [RFC3156]  Elkins, M., Del Torto, D., Levien, R., and T. Roessler,
+              "MIME Security with OpenPGP", RFC 3156, August 2001.
+
+   [RFC4880]  Callas, J., Donnerhacke, L., Finney, H., Shaw, D., and R.
+              Thayer, "OpenPGP Message Format", RFC 4880, November 2007.
+
+
+
+
+
+Koch                    Expires January 29, 2018               [Page 10]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+   [RFC5785]  Nottingham, M. and E. Hammer-Lahav, "Defining Well-Known
+              Uniform Resource Identifiers (URIs)", RFC 5785, DOI
+              10.17487/RFC5785, April 2010,
+              <http://www.rfc-editor.org/info/rfc5785>.
+
+   [RFC6189]  Zimmermann, P., Johnston, A., Ed., and J. Callas, "ZRTP:
+              Media Path Key Agreement for Unicast Secure RTP", RFC
+              6189, DOI 10.17487/RFC6189, April 2011,
+              <http://www.rfc-editor.org/info/rfc6189>.
+
+Appendix A.  Sample Protocol Run
+
+   The following non-normative example can be used by implementors as
+   guidance.
+
+   Note that GnuPG version 2.1.12 supports the key discovery described
+   in version -00 of this document (auto-key-locate method "wkd").
+   Version 2.1.16 can run the protocol decribed in this document but is
+   also able to run the protocol version specified by -01.
+
+A.1.  Sample Keys
+
+   This is the provider's submission key:
+
+     -----BEGIN PGP PRIVATE KEY BLOCK-----
+
+     lFgEV/TAohYJKwYBBAHaRw8BAQdAB/k9YQfSTI8qQqqK1KimH/BsvzsowWItSQPT
+     FP+fOC4AAP46uJ3Snno3Vy+kORye3rf0VvWvuz82voEQLxG6WpfHhREEtBprZXkt
+     c3VibWlzc2lvbkBleGFtcGxlLm5ldIh5BBMWCAAhBQJX9MCiAhsDBQsJCAcCBhUI
+     CQoLAgQWAgMBAh4BAheAAAoJEKhtNooW0cqEWMUA/0e9XaeptszWC9ZvPg8INL6a
+     BvRqPBYGU7PGmuXsxBovAQDyckOykG0UAfHVyN1w4gSK/biMcnqVr857i8/HuvjW
+     C5xdBFf0wKISCisGAQQBl1UBBQEBB0Apvaoe4MtSEJ1fpds/4DFl2kXXBpnVji/s
+     Wg9btdthNQMBCAcAAP9FJX99T1LEJzBnvBBnc6bimnT6/1OKM9RdO4R0/uVP6BFL
+     iGEEGBYIAAkFAlf0wKICGwwACgkQqG02ihbRyoTlGwD9FBr92osjL7HkhhZZ7Z2D
+     My3b9zpoZeMjvPg5YPqpdKMA/jhZoHuZCRMBYf7YRFb8aXtuyetDFZYrkjnum+OG
+     HFAD
+     =Hnwd
+     -----END PGP PRIVATE KEY BLOCK-----
+
+   This is the target key to be published:
+
+
+
+
+
+
+
+
+
+
+
+Koch                    Expires January 29, 2018               [Page 11]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+     -----BEGIN PGP PRIVATE KEY BLOCK-----
+
+     lFgEV2o9XRYJKwYBBAHaRw8BAQdAZ8zkuQDL9x7rcvvoo6s3iEF1j88Dknd9nZhL
+     nTEoBRkAAP94nCZMM4WY2IORXfM6phLGSz3RsHvs/vA1Opaus4+R3BKJtBtwYXRy
+     aWNlLmx1bXVtYmFAZXhhbXBsZS5uZXSIeQQTFggAIQUCV2o9XQIbAwULCQgHAgYV
+     CAkKCwIEFgIDAQIeAQIXgAAKCRATlWNoKgINCpkNAQDFDcwJUzsxu7aJUiPdpYXj
+     4uVarrXakxEE8mGFotWhLAD9GH4rqLDYIE3NKEU0s+Okt4tEIwJaV8H1NNPPPMiK
+     3g2cXQRXaj2NEgorBgEEAZdVAQUBAQdAFnnmZc99TuKk5iCq9wmYZUVF2RcXN2Cs
+     qAl8iGQQUWsDAQgHAAD/VN/VGmlcwGBPcLTya2hfU4t37nMcFCKdNSXjJ5DFA0AP
+     PohhBBgWCAAJBQJXaj2NAhsMAAoJEBOVY2gqAg0Ky4UA/0GmVaXzXemLvv1Xw4yx
+     Eaz/KfKKGc4RJ+38fyqUzw8NAQCohQ+ki3I5f84EXLZEiUiLsnVtOn1HNxvND/gW
+     TiFZBA==
+     =GHi7
+     -----END PGP PRIVATE KEY BLOCK-----
+
+A.2.  Sample Messages
+
+   The first message triggeres the publication requests.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Koch                    Expires January 29, 2018               [Page 12]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+     From: patrice.lumumba at example.net
+     To: key-submission at example.net
+     Subject: Key publishing request
+     MIME-Version: 1.0
+     Content-Type: multipart/encrypted;
+             protocol="application/pgp-encrypted";
+             boundary="=-=01-e8k41e11ob31eefa36wo=-="
+     Date: Wed, 05 Oct 2016 10:15:51 +0000
+
+
+     --=-=01-e8k41e11ob31eefa36wo=-=
+     Content-Type: application/pgp-encrypted
+
+     Version: 1
+
+     --=-=01-e8k41e11ob31eefa36wo=-=
+     Content-Type: application/octet-stream
+
+     -----BEGIN PGP MESSAGE-----
+
+     hF4DUgLY5tvmW2sSAQdAR1AcqvFpQe/fHRZbf0xcnl9Tb+AtwaX2yZnZXGELGHsw
+     1/e3E0JptwM5tpRAVe71ooF8Zq4jl76ZgQKfj/SyjpLJxyoEDy2N5wTQaqW4JtML
+     0ukB1vh7dIRDxBJX/LQIJC0wz8o1Q3vjcLJKFFvDb7YrerABpPIzwOAupcgIbQHj
+     5m1+2WU5CL8ffyJy2h1jV2X4OnvWF1Sn6J6SVD6DfZpOPRt9TxSemJrN1LJ3lG0N
+     ts8AuYmCOeC1H2r5TYyxqkC98JF8+Nvyxd/fwne8IOjK9uixkNMC5H9/ZOH0YWCb
+     wBnNB4iXuym4OIPxiLkDymsVF0ww/XrODE9Y259EGmO45VFNrJAX3HFs9/PcMCVk
+     n2qMyEkr8LHiXeEPun6Z54RHUPYv2cUkEZ0hhSJ+rtBxkc/5D/cAScCEXRKFSKEF
+     jLJAvLK/u/ga5DAzVai+vh6b6Bq+YVPaD9GWMhWj4CgR90p9LULi6S/Hzwhv9Wzf
+     8fJoJOaDjyvRDgr09jYLWamxkS9NWxqwy6MXJvxwbNdd5XtqiW4Y4o0Ll1hDJhxR
+     ljn/XvotXKwhKN+4QGhIXDVt4Dl4XxS5ptWfVTau8W8DYqDsU2obEcfsirZv53M1
+     Q9FCD8CD9+dkBt8VAJekCWVhEltcRHxlrznbk2jxm93xSD2o6gZ5X0VSaSUXyEhm
+     J+8F3gyTHGgbq/TgyjFoockWh5EtGgAFuWvmPJCF5PO/UaNeoKwgwSJBu6oTXkHx
+     R4nvvMRcj5UgTsKpZ79NiDQukbjG5ScNT5TCUiiZsBXBqBx3fD61EH6cAuh4P3Kr
+     iM7PY4fwAHo890Dx+Qlt
+     =WIhx
+     -----END PGP MESSAGE-----
+
+     --=-=01-e8k41e11ob31eefa36wo=-=--
+
+   The server decrypts this message to
+
+
+
+
+
+
+
+
+
+
+
+Koch                    Expires January 29, 2018               [Page 13]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+     Content-Type: application/pgp-keys
+
+     -----BEGIN PGP PUBLIC KEY BLOCK-----
+
+     mDMEV2o9XRYJKwYBBAHaRw8BAQdAZ8zkuQDL9x7rcvvoo6s3iEF1j88Dknd9nZhL
+     nTEoBRm0G3BhdHJpY2UubHVtdW1iYUBleGFtcGxlLm5ldIh5BBMWCAAhBQJXaj1d
+     AhsDBQsJCAcCBhUICQoLAgQWAgMBAh4BAheAAAoJEBOVY2gqAg0KmQ0BAMUNzAlT
+     OzG7tolSI92lhePi5VqutdqTEQTyYYWi1aEsAP0YfiuosNggTc0oRTSz46S3i0Qj
+     AlpXwfU00888yIreDbg4BFdqPY0SCisGAQQBl1UBBQEBB0AWeeZlz31O4qTmIKr3
+     CZhlRUXZFxc3YKyoCXyIZBBRawMBCAeIYQQYFggACQUCV2o9jQIbDAAKCRATlWNo
+     KgINCsuFAP9BplWl813pi779V8OMsRGs/ynyihnOESft/H8qlM8PDQEAqIUPpIty
+     OX/OBFy2RIlIi7J1bTp9RzcbzQ/4Fk4hWQQ=
+     =qRfF
+     -----END PGP PUBLIC KEY BLOCK-----
+
+   and returns this confirmation request
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Koch                    Expires January 29, 2018               [Page 14]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+     From: key-submission at example.net
+     To: patrice.lumumba at example.net
+     Subject: Confirm your key publication
+     MIME-Version: 1.0
+     Content-Type: multipart/encrypted;
+             protocol="application/pgp-encrypted";
+             boundary="=-=01-wrzqued738dfx4x97u7y=-="
+     Date: Wed, 05 Oct 2016 10:16:57 +0000
+
+
+     --=-=01-wrzqued738dfx4x97u7y=-=
+     Content-Type: application/pgp-encrypted
+
+     Version: 1
+
+     --=-=01-wrzqued738dfx4x97u7y=-=
+     Content-Type: application/octet-stream
+
+     -----BEGIN PGP MESSAGE-----
+
+     hF4DkYWHjk/NdMASAQdAluQeqhECpU2T0zEyBAEbFzhLkpubN160wjkFCrtUc0Mw
+     FwYgM2fp9cvTMdJ/xjkvmAcIEOT4AY/hn1yFQ4z0KG0gCkSac+8mkDylnPdxlXYw
+     0sBSAXlbqpVA7eUpFuU2Zs10zbIXxlwe6osR5wUIJut/RCOsYQmfvxC55x8mUX5/
+     zgTnNzlMzye5ws4pTgAeQm2x0Yv018L8IZgY5KxwJLBzlss0wLZ45ZcS80hR11Fx
+     NCow1fKF8lMnOJxagTEOih807nctz8vT5bR1gx0d7N3LM+th8nAg9/6Ghf1XTpLo
+     MzwGW0FtOG7Dg1Uxbw2bjaOuRBeh6IIpmNAw1pmIfnNu7PpoRydU5w1K/R8MT06z
+     MKdJ7IW5mVGes9EGnG3e4mjuILvNaZhfYy+a73IhDSaPm3oqdl1Qx7tbNg6lGjn6
+     KStCYAcPGPp3m7aWkfsPGThOVRhEXqaFFywfwSVEj1pdIRjDFA==
+     =Cdjh
+     -----END PGP MESSAGE-----
+
+     --=-=01-wrzqued738dfx4x97u7y=-=--
+
+   The client decrypts the attachment as
+
+     Content-Type: application/vnd.gnupg.wks
+     Content-Transfer-Encoding: 8bit
+
+     type: confirmation-request
+     sender: key-submission at example.net
+     address: patrice.lumumba at example.net
+     fingerprint: B21DEAB4F875FB3DA42F1D1D139563682A020D0A
+     nonce: f5pscz57zj6fk11wekk8gx4cmrb659a7
+
+   creates this response
+
+
+
+
+
+
+Koch                    Expires January 29, 2018               [Page 15]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+     Content-Type: application/vnd.gnupg.wks
+     Content-Transfer-Encoding: 8bit
+
+     type: confirmation-response
+     sender: key-submission at example.net
+     address: patrice.lumumba at example.net
+     nonce: f5pscz57zj6fk11wekk8gx4cmrb659a7
+
+   and sends it encrypted to the server
+
+     From: patrice.lumumba at example.net
+     To: key-submission at example.net
+     Subject: Key publication confirmation
+     MIME-Version: 1.0
+     Content-Type: multipart/encrypted;
+             protocol="application/pgp-encrypted";
+             boundary="=-=01-iacqg4og4pqz11a5cg1o=-="
+     Date: Wed, 05 Oct 2016 10:18:52 +0000
+
+
+     --=-=01-iacqg4og4pqz11a5cg1o=-=
+     Content-Type: application/pgp-encrypted
+
+     Version: 1
+
+     --=-=01-iacqg4og4pqz11a5cg1o=-=
+     Content-Type: application/octet-stream
+
+     -----BEGIN PGP MESSAGE-----
+
+     hF4DUgLY5tvmW2sSAQdAnB1C3PMjS4AsGU0qaCqBdWQO5i6blWEyZrEsY+JZY1Qw
+     ooNq7zdVWOHhL9LPGAALAgoL3Qfz+dN2u5QamSQ/LJ2c8M0XipNs3lqlNH63yQN1
+     0sAmAc3W8xkwul+rf6OLK/gMi6WzM4fnUhd4D1LJGIJoNUN0l3636C7ecOt2lkMl
+     5bVAYg/SyMT3ymyfQnvtiem2T5DSnPsS1g6n6QNXWvkqvX9yGxNsNDJEHTuGJB8k
+     OJoRlfWQTEo6pgA89febWl1EdeM1pPLstQ2uZE8NPjXoY1nMxAlu+iPYsR41/4sg
+     dqwOv5BPLh/GIat8hh9SPWCA9iKlgSQ/EIv5DpjQogEzpriT55dkgfvSVYIAcOdO
+     ShZ91YKkcZffevdY72omqTk10a1SUXehPooIlRFmroDsi3VDaRKrUIo=
+     =7uve
+     -----END PGP MESSAGE-----
+
+     --=-=01-iacqg4og4pqz11a5cg1o=-=--
+
+Appendix B.  Changes Since -03
+
+   o  Fixed Content-Type in the description.  The one used in the
+      example was correct.
+
+
+
+
+
+Koch                    Expires January 29, 2018               [Page 16]
+

+Internet-Draft           OpenPGP Web Key Service               July 2017
+
+
+Author's Address
+
+   Werner Koch
+   GnuPG Project
+
+   Email: wk at gnupg.org
+   URI:   https://gnupg.org
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Koch                    Expires January 29, 2018               [Page 17]

commit 1407143b6a50365ce9c52f8fd4ab65939573a923
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 28 14:07:31 2017 +0200

    drafts,openpgp-webkey-service: Prepare -04 for publication

diff --git a/misc/id/openpgp-webkey-service/draft.org b/misc/id/openpgp-webkey-service/draft.org
index a422204..9fa20bd 100644
--- a/misc/id/openpgp-webkey-service/draft.org
+++ b/misc/id/openpgp-webkey-service/draft.org
@@ -40,7 +40,7 @@
       </address>
     </author>
 
-    <date month="MONTH" year="2017" />
+    <date month="July" year="2017" />
     <area>Security</area>
 
     <abstract>

-----------------------------------------------------------------------

Summary of changes:
 ...xt => draft-koch-openpgp-webkey-service-04.txt} | 88 +++++++++++-----------
 misc/id/openpgp-webkey-service/draft.org           |  2 +-
 2 files changed, 45 insertions(+), 45 deletions(-)
 copy misc/id/openpgp-webkey-service/{draft-koch-openpgp-webkey-service-03.txt => draft-koch-openpgp-webkey-service-04.txt} (91%)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 28 20:17:29 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 28 Jul 2017 20:17:29 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.21-179-gdd56bc4
Message-ID: <E1db9pK-0007zd-AL@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  dd56bc411e40f31ee42effa0d6496bfdc3bef59e (commit)
       via  7d335ff496b129ee6f33c4ca25bd7a6631a4b590 (commit)
      from  731d7c6de4d24fd3c1ec46efbe09c1dfd165eb78 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit dd56bc411e40f31ee42effa0d6496bfdc3bef59e
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 28 20:10:16 2017 +0200

    Post release updates
    
    --

diff --git a/NEWS b/NEWS
index c859eb4..70bef2e 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,7 @@
+Noteworthy changes in version 2.1.23 (unreleased)
+-------------------------------------------------
+
+
 Noteworthy changes in version 2.1.22 (2017-07-28)
 -------------------------------------------------
 
diff --git a/configure.ac b/configure.ac
index 764a62d..7d50274 100644
--- a/configure.ac
+++ b/configure.ac
@@ -28,7 +28,7 @@ min_automake_version="1.14"
 m4_define([mym4_package],[gnupg])
 m4_define([mym4_major], [2])
 m4_define([mym4_minor], [1])
-m4_define([mym4_micro], [22])
+m4_define([mym4_micro], [23])
 
 # To start a new development series, i.e a new major or minor number
 # you need to mark an arbitrary commit before the first beta release

commit 7d335ff496b129ee6f33c4ca25bd7a6631a4b590
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 28 18:59:04 2017 +0200

    Release 2.1.22

diff --git a/NEWS b/NEWS
index 3caaa2e..c859eb4 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,45 @@
-Noteworthy changes in version 2.1.22 (unreleased)
+Noteworthy changes in version 2.1.22 (2017-07-28)
 -------------------------------------------------
 
+  * gpg: Extend command --quick-set-expire to allow for setting the
+    expiration time of subkeys.
+
+  * gpg: By default try to repair keys during import.  New sub-option
+    no-repair-keys for --import-options.
+
+  * gpg,gpgsm: Improved checking and reporting of DE-VS compliance.
+
+  * gpg: New options --key-origin and --with-key-origin.  Store the
+    time of the last key update from keyservers, WKD, or DANE.
+
+  * agent: New option --ssh-fingerprint-digest.
+
+  * dimngr: Lower timeouts on keyserver connection attempts and made
+    it configurable.
+
+  * dirmngr: Tor will now automatically be detected and used.  The
+    option --no-use-tor disables Tor detection.
+
+  * dirmngr: Now detects a changed /etc/resolv.conf.
+
+  * agent,dirmngr: Initiate shutdown on removal of the GnuPG home
+    directory.
+
+  * gpg: Avoid caching passphrase for failed symmetric encryption.
+
+  * agent: Support for unprotected ssh keys.
+
+  * dirmngr: Fixed name resolving on systems using only v6
+    nameservers.
+
+  * dirmngr: Allow the use of TLS over http proxies.
+
+  * w32: Change directory of the daemons after startup.
+
+  * wks: New man pages for client and server.
+
+  * Many other bug fixes.
+
 
 Noteworthy changes in version 2.1.21 (2017-05-15)
 -------------------------------------------------
@@ -3515,8 +3554,8 @@ Version 0.1.0 (1998-01-05)
 Version 0.0.0 (1997-12-20)
 
 
- Copyright (C) 1998-2016 Free Software Foundation, Inc.
- Copyright (C) 1997-2016 Werner Koch
+ Copyright (C) 1998-2017 Free Software Foundation, Inc.
+ Copyright (C) 1997-2017 Werner Koch
 
  This file is free software; as a special exception the author gives
  unlimited permission to copy and/or distribute it, with or without

-----------------------------------------------------------------------

Summary of changes:
 NEWS         | 49 ++++++++++++++++++++++++++++++++++++++++++++++---
 configure.ac |  2 +-
 2 files changed, 47 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 28 20:22:03 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 28 Jul 2017 20:22:03 +0200
Subject: [git] GnuPG - branch, STABLE-BRANCH-2-2,
 updated. gnupg-2.1.22-1-gdd56bc4
Message-ID: <E1db9tk-0000kX-4v@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, STABLE-BRANCH-2-2 has been updated
       via  dd56bc411e40f31ee42effa0d6496bfdc3bef59e (commit)
       via  7d335ff496b129ee6f33c4ca25bd7a6631a4b590 (commit)
       via  731d7c6de4d24fd3c1ec46efbe09c1dfd165eb78 (commit)
       via  339f672dad94b4e0000fd2d3a1f272a4861c91c3 (commit)
       via  6c9899bede6ecb2ccf7336d12724090f36a6aa3d (commit)
       via  efe187e8a2b583defdcd9d4b96e3dc83f95bef0d (commit)
       via  5cf95157c5db88dd599ac4d48f619782179b1438 (commit)
       via  1c35e29af95c46475f297d2bd70a5f3bd49d45b1 (commit)
       via  6496dc1f9d2aef3bf8cf950da2434c96f7a0145c (commit)
       via  5516ef47a22dfdf9cdf56107f34d2bda9e46deec (commit)
       via  6502bb0d2af5784918ebb74242fff6f0a72844bf (commit)
       via  1bd22a85b4f06324037b3500d2fa8af62733c926 (commit)
       via  a0d0cbee7654ad7582400efaa92d493cd8e669e9 (commit)
       via  6d95611d01b0768a365173668a878e903e3078e9 (commit)
       via  fcb62fe20f45290bf95703ec3bf4d0b361fa4339 (commit)
       via  94eea0ed2c8b47cb0fe02b22cbe668705a5fe0d0 (commit)
       via  be636c3cfca178927b09ef4154c3e555d6f5b1c4 (commit)
       via  c76398da5b15df2086f68bc26b7fde75219976c7 (commit)
       via  b428dd495a1a960de0da27976bf50b191b6a1ddf (commit)
       via  4f569c69075fddbaea588544a6625c28cb4cb8f4 (commit)
       via  c5e5748480952e5bcedb16f6ce6ef7e435acb3c7 (commit)
       via  fd68bdb61ec4f8441da6d3023a8da4315df54cec (commit)
       via  d50c2eff8d6931586c527edb3dea98dbc6facdec (commit)
       via  f4ec7697a9c2d7587794d3bd75efbb0b51d6562f (commit)
       via  24c7aa0d58e3768690dd8ebef0e8e01af7e80f83 (commit)
       via  0ef50340ef68b2541d9a1aafa71f5400aef4dc7e (commit)
       via  226f143ca01cf335c7c4e3e94c96fb9d271eccc9 (commit)
       via  f2d2648a4deb205c26ac869c857c000a95d3ff0c (commit)
       via  166d0d7a2439f30c0a250faadc16ce3453447d71 (commit)
       via  84c993d9325fc000acac7950b2dfeefa5976df3b (commit)
       via  d40b4a41a8d60292fd4b5b951a19883e31090179 (commit)
       via  aa358ac78cf8042dc107b130e6492d6bf12d7088 (commit)
       via  87b5421ca84bbea68217c9ed771ee8c0a98a4d0c (commit)
       via  2ca0381d077d766593db26f4215b8eddee8d7963 (commit)
       via  e7068bf92ec5ca5d440346d43a382c1f625b924d (commit)
       via  f6f0dd4d5ea85e0b16e96d7678b1d508182049a8 (commit)
       via  e97548223948222a5c22acdf3775c7f93c1e17a9 (commit)
       via  9b88cfa0962f28894658cff8777fe7a217c6f700 (commit)
       via  872137b5921dd297e7d2c1def6e3868b7595feb5 (commit)
       via  78ebc62604d77600b9865950610717d28c6027a2 (commit)
       via  d8e46f10698da0bee4cd58d95f1f9832bdda0c5f (commit)
       via  5dac85fba78075b525a9aab24ea079fc4addf372 (commit)
       via  45e40487fb7bb51228c96c8966e38c643a9b9ba5 (commit)
       via  ade4b2744c848e07b87afa4f186256c2a2ef1d13 (commit)
       via  789401e9557db13422f47a8c09e693f3cee0132b (commit)
       via  274602820cfbb15c7cdb4525acd9793bdb472e78 (commit)
       via  328fca187253c069e3630bd387a71f6d16e9820a (commit)
       via  e4c720fa3b31ebd3e9d764c6eab02729cf06124c (commit)
       via  b55b72bb815ad5870456b89c3a011fa00991b4a8 (commit)
       via  e888f7af6571ecd3994fd55cc18c9e2df7fd0c60 (commit)
       via  5818ff0ae314af08548fcc23df2b807736144a00 (commit)
       via  609bbdf3614fbadeba7a6cbdfdf5004b23516a64 (commit)
       via  d8a55da715ce8447b0686f321fa43d00be34a467 (commit)
       via  a76b6cf9709c0a2a89fa2887075491b80f3d9608 (commit)
       via  892e86b0dc69193ddff018bf9b3938509dd72cb3 (commit)
       via  cea4313644b531ef87b8c8e4bfddde4388cbbe0d (commit)
       via  a5dcc01a739db7dd75aeb2cd65f51d4839ef7fc9 (commit)
       via  165cdd8121bbf80bfe2da071539d3578630f198f (commit)
       via  bddc2e04f1ddc18be20efc0f0508be401b345f42 (commit)
       via  33ecb541fcc2e8030989384b5e8c55aeccd21128 (commit)
       via  3ee314dde16d1d69ddf840cdb8b5aa186c592262 (commit)
       via  9998b162b47931fb8a8ed961d53418d505358888 (commit)
       via  69614d55018ddb8678d8904a52e648931f480d72 (commit)
       via  84146b3ec44943f06c66a603de19094b930ad446 (commit)
       via  cc12cf386b620e658fa93a0bd40477bc16d85d98 (commit)
       via  e7fc6e3bf0eb6ffe53e1f099d28ce45cef4a8a87 (commit)
       via  2e5459457473eb4b3e7b2b14815cb94faa66e8bb (commit)
       via  da91d2106a17c796ddb066a34db92d33b21c81f7 (commit)
       via  e7eabe66b6409c1f5225b751ea5c2d456a3856e6 (commit)
       via  1ba220e68149fdb197accf4a15b0a11126c8b431 (commit)
       via  46a4a0c0e77e19f9589088bb87357c33142c3f04 (commit)
       via  73d4781e4595634548269bafe46aeb7674c5b219 (commit)
       via  99791184ac4c7486ccdefc150b9921cd923428b9 (commit)
       via  fa63db89f9581186ed758c502d4e69914b774157 (commit)
       via  f17862d47d184d7f6ef883778cf63801365599a0 (commit)
       via  2e1342b78b020f5b28359b08a4f63cf11479602f (commit)
       via  b231959728a0056094134e0fca8cc916c24ef37e (commit)
       via  ebb35ed7110d1a29061dfb4ccb9038645b20d7f4 (commit)
       via  3d670fa973a03ea88b5f9459b3222a951136dd7a (commit)
       via  a149afe338d61d86985c533cde5e7dbcd31e8698 (commit)
       via  bbbd0db34b4e387f8dc089fb7d69fdcf2ed91a01 (commit)
       via  849467870ee1c10e0a7b1e89cfc9e8214e4963fe (commit)
       via  58eafd11ed5501c0b72fcb553eb3e097ad29b3c6 (commit)
       via  b4d25082fd4502ec01d511c22fecd60d513b81f4 (commit)
       via  7a6e6ad2880bbff54a75ff608d0ec97d6c405733 (commit)
       via  956da89193370d5aa970cff5b77f605534481a02 (commit)
       via  330212efb927c119bb5135856f8582c0e4e2e6b7 (commit)
       via  fa1155e89ebb4b16ee95549b8ab72672df3a0c54 (commit)
       via  877a321d011deb3e8501aa9cc5e9f9cd0b19dddf (commit)
       via  f78fe1a4ec9d343199e1f424dd09e2937c913412 (commit)
       via  bce02a8b0f0e51775a4ee5536ccf35efc1f15ca6 (commit)
       via  957f8ebc89caadbf84320b60aeb18a100c314855 (commit)
       via  d24594976686983c7186cbe4e78153888a13b6e4 (commit)
       via  1455b406e63dd262938e49da5f83c05c17c60a8d (commit)
       via  243b2a570c30586e19b8c88e43b282d62d8eb77c (commit)
       via  4c3a59e9c0a4902f96b9f199b9821573ffb7c628 (commit)
       via  4538f3cf8d7a0a7477b3e0258de5b743830ae20c (commit)
       via  3681ee7dc1e9d8c94fdb046d7be0bbcfeba1cfe9 (commit)
       via  139de02b93773615bdd95e04a7f0c1ad73b4f6fb (commit)
       via  f6faa058749846de18cb34f1cc79867bb0029922 (commit)
       via  7fb724c61655c6f75c61572d65a46e21ae112574 (commit)
       via  ecd6c0160f49ae83001dfd150df6b1238fc479d5 (commit)
       via  273964798592cd479c111f47e8ce46d5b1999d6a (commit)
       via  b49b1a87ac2695e3892fb001878da59fbc92fa37 (commit)
       via  1ead1ca818bddabc3bca22c195be667993eb3e2e (commit)
       via  815ecdf08a4285c75892cf9ab72feb13f3bcf590 (commit)
       via  f31dc2540acf7cd7f09fd94658e815822222bfcb (commit)
       via  e0877a98a06de797184d3871545979887d5c2b38 (commit)
       via  a68a98233ab83f0c7b90e6e588b882085fe59d91 (commit)
       via  62274d3c309d8948405c2f966bef507638b4d5c6 (commit)
       via  890a3a70f2e1340d90c7f499358467979b182719 (commit)
       via  48aae8167dcae80d43b08167a88d9eb170781a04 (commit)
       via  fc4834d213af031b456c49c1ba5b5ef8873d1f18 (commit)
       via  794261c4bdb271060125feda534a26580c6b9f26 (commit)
       via  badc1cdae52bd434e5fac2e4275575afeccc2837 (commit)
       via  3621dbe52584bc8b417f61b5370ebaa5598db956 (commit)
       via  6cc4702767eec5506a974aa942868066a40cf54c (commit)
       via  61ef43546ba9f0209692a1569d2f033436566a02 (commit)
       via  e555e7ed7de20fbbb1e3b005c32e292f29cc4a58 (commit)
       via  6639aedaee051e8104d7f63b9a5812abf79440ed (commit)
       via  4c8be58fd46bb16332e84ab8ce978087dc5c68a3 (commit)
       via  b766d3d1034e6068a91755ada68f7f7dbe2943b6 (commit)
       via  3419a339d9c4e800bf30e9021e05982d8c1021c1 (commit)
       via  6e23416fe61d4130918f2d1bf6e1f98d102c4610 (commit)
       via  9b12b45aa5e67d4d422bf75a3879df1d52dbe67f (commit)
       via  404fa8211b6188a0abe83ef43a4b44d528c0b035 (commit)
       via  8095d16b3ef6b5f01ec351824855708149f1c1c3 (commit)
       via  15d2a009931f44a60b9df6325f837add208459d6 (commit)
       via  e80925171ddb20c7e76c1db88c15ce2d9b09db86 (commit)
       via  a36c48a780adac28748804af2aab403636c3f450 (commit)
       via  7c91b48f0e80266cf7491c2bb7d8aabc12362643 (commit)
       via  7aeac20f12ed257d3d159b304afeeac7f406c9d2 (commit)
       via  cb0484e0762a1ce05d00d949f4b70162e2f7b82c (commit)
       via  4ddf4e114c8df06d89144e857b7601de0b7e5a7c (commit)
       via  8a9066865688cf17594b2bdde4b260b0ef36d68e (commit)
       via  bc5503b2bf273b51d5dc59617e596f1cfb742fbc (commit)
       via  a64a55e10420cf11e00062b590dffe5d0c3e8192 (commit)
       via  b03fab09e188f7bb10237d4f20455e4026737e4e (commit)
       via  9b43220b8ad1a5c1cd51de3bbfff7ccbcc3fa877 (commit)
       via  5b9025cfa1f9b1c67ddf2f6bf87d863e780cf157 (commit)
       via  17e5afd80f247c356f03c71e8b61da424ffedabb (commit)
       via  e051e396156211449568afa0ca7505dc13eaa3b4 (commit)
       via  21fc2508c979a8202dd8ca7fa7b801e0d62a5ceb (commit)
       via  f440cf73eab0b0e75e3cb2e8c9e70a77f20ef1dc (commit)
       via  842d233d408457cfa9a8473a6748472956f44e84 (commit)
       via  027ce4ba37be1d052bca2f6109fe810ef57f4038 (commit)
       via  13dc75a4e7cc2959003c08940fc53c6ece7b77e4 (commit)
       via  96acbdd7265f504d06783adfd6322a6675c41c0a (commit)
       via  216f0804c1452c777c0252c36f56e279d18632a2 (commit)
       via  be8ca8852629786266db4d3d69b2c2fb03bd6365 (commit)
       via  3b70f62423041e614332b90d782576ee6868a030 (commit)
       via  8a012280e0f0a462c094d106355aa436fceb1b76 (commit)
       via  02af509dfc2b893720aa0c7b380fd7736b2bafd0 (commit)
       via  f9cb15b385f64f7c9403670f03632f81a874f213 (commit)
       via  30c71a9476fa6557ab2846f703acb625b49f1b37 (commit)
       via  485b5a6e6dfe7aa545afa926e060d516ae911e42 (commit)
       via  c03e0eb01dc4632432d0472a6f8051142082bea4 (commit)
       via  8defb21d34410d000c8b776e0e3a1edd04762638 (commit)
       via  5c33649782bf255af5a55f16eac5e85f059b00bf (commit)
       via  663e5ed0737465e79a9c877f18d93bddfd05a7a4 (commit)
       via  d3d640b9cc98dd0d06b49a2e4d46eb67af96fe29 (commit)
       via  996544626ea416c173a940db47f47f9e5cbd844c (commit)
       via  de3a0988ef9addccd6b5c7950fb8797afbc3978d (commit)
       via  b5f356e9fba2d99909f8f54d7b7e6836bed87b68 (commit)
       via  525f2c482abb6bc2002eb878b03558fb43e6b004 (commit)
       via  a5f046d99a084b6a95268f03c1b588e8b78083cb (commit)
       via  3a07a69dfc87b4fff610740d3dde8e23f0d2f8bc (commit)
       via  3ac1a9d3a018816233a855faff059b4e0657a0f1 (commit)
       via  0c628321a18c0d898b3db988fd44df2780803d11 (commit)
       via  509e4a4d7491daf496b21e5892f4f63ab90e8e21 (commit)
       via  fbb2259d22e6c6eadc2af722bdc52922da348677 (commit)
       via  3713f67026467f63f80649c92ac4cc7973589855 (commit)
       via  705da1eb23aef92c42d6d657b20a0984b104f72f (commit)
       via  aae50e0b6a61549e226e0c7785260ad517f0ffff (commit)
       via  0e1729bb993648deca84a2664ae78edc848d7003 (commit)
       via  ae95a7f5335e605fcd71fbe4a18ed384c88d590a (commit)
       via  a8dd96826f8484c0ae93c954035b95c2a75c80f2 (commit)
       via  386a7bbb245dd3ab7c4156a554adbe75d82bdf49 (commit)
      from  99e68350a8a94b98a0864d858720859196168a6f (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
-----------------------------------------------------------------------

Summary of changes:
 AUTHORS                                           |  27 +-
 COPYING.GPL2                                      | 339 +++++++++
 COPYING.LGPL21                                    | 509 ++++++++++++++
 COPYING.LIB => COPYING.LGPL3                      |   0
 Makefile.am                                       |   3 +-
 NEWS                                              |  53 +-
 README                                            |   2 +-
 agent/agent.h                                     |  26 +-
 agent/call-pinentry.c                             |  14 +-
 agent/command-ssh.c                               |  51 +-
 agent/command.c                                   |  33 +-
 agent/divert-scd.c                                |   8 +-
 agent/findkey.c                                   | 135 ++--
 agent/genkey.c                                    |   4 +-
 agent/gpg-agent.c                                 | 153 ++++-
 agent/pksign.c                                    | 155 +++--
 agent/preset-passphrase.c                         |   3 +-
 agent/protect.c                                   |  59 +-
 artwork/banner/Bungee-Regular.ttf                 | Bin 0 -> 126736 bytes
 artwork/banner/Bungee-license.txt                 |  92 +++
 artwork/banner/Raleway-ExtraBold.ttf              | Bin 0 -> 178128 bytes
 artwork/banner/Raleway-SemiBold.ttf               | Bin 0 -> 180492 bytes
 artwork/banner/Raleway-license.txt                |  94 +++
 artwork/banner/banner-full.png                    | Bin 0 -> 49267 bytes
 artwork/banner/banner-half.png                    | Bin 0 -> 82305 bytes
 artwork/banner/banner-rectangle.png               | Bin 0 -> 82061 bytes
 artwork/banner/banner-skyscraper.png              | Bin 0 -> 52697 bytes
 artwork/banner/banner.svg                         | 509 ++++++++++++++
 build-aux/Vagrantfile                             |  36 +
 build-aux/speedo.mk                               |   4 +-
 build-aux/speedo/w32/g4wihelp.c                   |   5 +-
 common/Makefile.am                                |   3 +-
 common/argparse.c                                 |  45 +-
 common/argparse.h                                 |  14 +-
 common/compliance.c                               | 590 ++++++++++++++++
 common/compliance.h                               |  88 +++
 common/homedir.c                                  |  91 ++-
 common/logging.c                                  |   3 +-
 common/miscellaneous.c                            |  10 +
 common/ssh-utils.c                                | 128 +++-
 common/ssh-utils.h                                |   6 +-
 common/status.h                                   |   4 +
 common/stringhelp.c                               |  36 +
 common/stringhelp.h                               |   4 +
 common/sysutils.c                                 |  46 ++
 common/sysutils.h                                 |   4 +-
 common/t-ssh-utils.c                              | 103 ++-
 common/t-stringhelp.c                             |  76 ++
 common/util.h                                     |   2 +
 configure.ac                                      |   7 +-
 dirmngr/Makefile.am                               |   8 +-
 dirmngr/dirmngr-client.c                          |   2 +-
 dirmngr/dirmngr.c                                 |  88 ++-
 dirmngr/dirmngr.h                                 |   9 +
 dirmngr/dirmngr_ldap.c                            |   2 +-
 dirmngr/dns-stuff.c                               |  49 +-
 dirmngr/dns.c                                     | 288 ++++++--
 dirmngr/http.c                                    | 328 ++++++++-
 dirmngr/http.h                                    |   5 +-
 dirmngr/ks-action.c                               |  16 +-
 dirmngr/ks-engine-finger.c                        |   2 +-
 dirmngr/ks-engine-hkp.c                           | 272 +++++---
 dirmngr/ks-engine-http.c                          |  26 +
 dirmngr/ldap.c                                    |   1 +
 dirmngr/loadswdb.c                                |   1 +
 dirmngr/server.c                                  |  42 +-
 dirmngr/t-http.c                                  |  31 +
 doc/DETAILS                                       |  33 +-
 doc/Makefile.am                                   |  10 +-
 doc/dirmngr.texi                                  |  25 +-
 doc/examples/vsnfd.prf                            |   2 +-
 doc/faq.org                                       |  31 +-
 doc/gnupg.texi                                    |   4 +-
 doc/gpg-agent.texi                                |   7 +
 doc/gpg.texi                                      | 417 +++++------
 doc/gpgsm.texi                                    |   7 +-
 doc/tools.texi                                    |   2 +
 doc/wks.texi                                      | 340 +++++++++
 doc/yat2m.c                                       |  14 +-
 g10/Makefile.am                                   |   7 +-
 g10/build-packet.c                                |  10 +-
 g10/call-agent.c                                  |  49 +-
 g10/call-agent.h                                  |   6 +-
 g10/call-dirmngr.c                                |  30 +-
 g10/call-dirmngr.h                                |   2 +-
 g10/card-util.c                                   |  51 +-
 g10/cpr.c                                         |   2 +-
 g10/decrypt-data.c                                |  12 +
 g10/encrypt.c                                     |  69 +-
 g10/export.c                                      |   3 +-
 g10/free-packet.c                                 |   6 +
 g10/getkey.c                                      | 510 +++++++++-----
 g10/gpg.c                                         | 134 ++--
 g10/gpgcompose.c                                  |  75 +-
 g10/gpgv.c                                        |   1 +
 g10/import.c                                      | 405 +++++++++--
 g10/key-check.c                                   | 655 ++++++++++++++++++
 tests/gpgscm/ffi.h => g10/key-check.h             |  18 +-
 g10/keydb.h                                       |  34 +-
 g10/keyedit.c                                     | 803 ++++------------------
 g10/keyedit.h                                     |  60 ++
 g10/keygen.c                                      |   7 +-
 g10/keyid.c                                       |  40 +-
 g10/keylist.c                                     |  62 +-
 g10/keyserver-internal.h                          |   2 +-
 g10/keyserver.c                                   |  55 +-
 g10/main.h                                        |  32 +-
 g10/mainproc.c                                    |  73 +-
 g10/misc.c                                        | 106 ---
 g10/options.h                                     |  13 +-
 g10/packet.h                                      |  10 +-
 g10/parse-packet.c                                |   8 +-
 g10/pkclist.c                                     |   8 +-
 g10/pubkey-enc.c                                  |  25 +-
 g10/sig-check.c                                   |  21 +
 g10/sign.c                                        |  34 +-
 g10/skclist.c                                     |  16 +-
 g10/sqrtu32.c                                     | 244 -------
 g10/sqrtu32.h                                     |  14 -
 g10/tofu.c                                        |  18 +-
 kbx/kbxutil.c                                     |   2 +-
 po/ca.po                                          | 202 +++---
 po/cs.po                                          | 253 ++++---
 po/da.po                                          | 245 ++++---
 po/de.po                                          | 266 +++----
 po/el.po                                          | 204 +++---
 po/eo.po                                          | 197 +++---
 po/es.po                                          | 248 ++++---
 po/et.po                                          | 202 +++---
 po/fi.po                                          | 205 +++---
 po/fr.po                                          | 250 ++++---
 po/gl.po                                          | 202 +++---
 po/hu.po                                          | 204 +++---
 po/id.po                                          | 205 +++---
 po/it.po                                          | 202 +++---
 po/ja.po                                          | 224 +++---
 po/nb.po                                          | 240 ++++---
 po/pl.po                                          | 252 ++++---
 po/pt.po                                          | 201 +++---
 po/ro.po                                          | 229 +++---
 po/ru.po                                          | 242 ++++---
 po/sk.po                                          | 204 +++---
 po/sv.po                                          | 244 ++++---
 po/tr.po                                          | 244 ++++---
 po/uk.po                                          | 247 ++++---
 po/zh_CN.po                                       | 228 +++---
 po/zh_TW.po                                       | 237 ++++---
 scd/app-openpgp.c                                 |  94 ++-
 scd/ccid-driver.c                                 |  30 +-
 scd/scdaemon.c                                    |   9 +-
 sm/call-agent.c                                   |  19 +
 sm/decrypt.c                                      |  53 +-
 sm/encrypt.c                                      |  54 ++
 sm/gpgsm.c                                        |  56 +-
 sm/gpgsm.h                                        |   2 +
 sm/keylist.c                                      |   5 +-
 sm/sign.c                                         |  40 ++
 sm/verify.c                                       |  42 +-
 tests/fake-pinentries/README.txt                  |   2 +-
 tests/gpgme/gpgme-defs.scm                        |   4 +-
 tests/gpgscm/ffi.c                                |   2 +
 tests/gpgscm/ffi.scm                              |   3 +-
 tests/gpgscm/init.scm                             |   6 +-
 tests/gpgscm/main.c                               |  19 +-
 tests/gpgscm/repl.scm                             |  12 +
 tests/gpgscm/scheme.c                             |  53 +-
 tests/gpgscm/tests.scm                            | 128 +++-
 tests/gpgsm/gpgsm-defs.scm                        |   4 +-
 tests/openpgp/Makefile.am                         |   3 +-
 tests/openpgp/all-tests.scm                       |  22 +-
 tests/openpgp/defs.scm                            |  10 +-
 tests/openpgp/gpgv.scm                            |  75 ++
 tests/openpgp/shell.scm                           |  28 +-
 tests/openpgp/{verify.scm => signed-messages.scm} |  72 --
 tests/openpgp/ssh-export.scm                      |   4 +-
 tests/openpgp/verify.scm                          | 268 +-------
 tools/call-dirmngr.c                              |  15 +-
 tools/call-dirmngr.h                              |  15 +-
 tools/gpg-check-pattern.c                         |   2 +-
 tools/gpg-wks-client.c                            |  19 +-
 tools/gpg-wks-server.c                            |  79 ++-
 tools/gpg-wks.h                                   |  15 +-
 tools/gpgconf-comp.c                              |  14 +-
 tools/gpgconf.c                                   |   3 +-
 tools/gpgsplit.c                                  |   4 +-
 tools/mime-maker.c                                |  15 +-
 tools/mime-maker.h                                |  15 +-
 tools/mime-parser.c                               |  15 +-
 tools/mime-parser.h                               |  15 +-
 tools/rfc822parse.c                               |  20 +-
 tools/rfc822parse.h                               |  18 +-
 tools/send-mail.c                                 |  15 +-
 tools/send-mail.h                                 |  15 +-
 tools/symcryptrun.c                               |   2 +-
 tools/wks-receive.c                               |  15 +-
 tools/wks-util.c                                  |  16 +-
 196 files changed, 11274 insertions(+), 5417 deletions(-)
 create mode 100644 COPYING.GPL2
 create mode 100644 COPYING.LGPL21
 rename COPYING.LIB => COPYING.LGPL3 (100%)
 create mode 100644 artwork/banner/Bungee-Regular.ttf
 create mode 100644 artwork/banner/Bungee-license.txt
 create mode 100644 artwork/banner/Raleway-ExtraBold.ttf
 create mode 100644 artwork/banner/Raleway-SemiBold.ttf
 create mode 100644 artwork/banner/Raleway-license.txt
 create mode 100644 artwork/banner/banner-full.png
 create mode 100644 artwork/banner/banner-half.png
 create mode 100644 artwork/banner/banner-rectangle.png
 create mode 100644 artwork/banner/banner-skyscraper.png
 create mode 100644 artwork/banner/banner.svg
 create mode 100644 build-aux/Vagrantfile
 create mode 100644 common/compliance.c
 create mode 100644 common/compliance.h
 create mode 100644 doc/wks.texi
 create mode 100644 g10/key-check.c
 copy tests/gpgscm/ffi.h => g10/key-check.h (67%)
 create mode 100644 g10/keyedit.h
 delete mode 100644 g10/sqrtu32.c
 delete mode 100644 g10/sqrtu32.h
 create mode 100755 tests/openpgp/gpgv.scm
 copy tests/openpgp/{verify.scm => signed-messages.scm} (84%)
 mode change 100755 => 100644


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Fri Jul 28 21:12:14 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Fri, 28 Jul 2017 21:12:14 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 420cda13f3d2d3391a22fb452f0fca1b6b0791c7
Message-ID: <E1dbAgI-0008NK-Rd@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  420cda13f3d2d3391a22fb452f0fca1b6b0791c7 (commit)
       via  1ba02732c8b87122fb4b0a97a3153a2663015f25 (commit)
      from  0075cc681c13e9579412d6115e1be0c0c722fc0e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 420cda13f3d2d3391a22fb452f0fca1b6b0791c7
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 28 21:07:11 2017 +0200

    web: Announce GnuPG 2.1.22

diff --git a/web/index.org b/web/index.org
index d4f7dc9..17d3131 100644
--- a/web/index.org
+++ b/web/index.org
@@ -29,6 +29,25 @@ page for other maintained versions.
 is nicely integrated into an installer and features several frontends
 as well as English and German manuals.
 
+
+* Reconquer your privacy
+
+#+begin_quote
+Arguing that you don't care about the right to privacy
+because you have nothing to hide is no different from
+saying you don't care about free speech because you have
+nothing to say.   \ndash\nbsp{}Edward\nbsp{}Snowden
+#+end_quote
+
+Using encryption helps to protect your privacy and the privacy of the
+people you communicate with.  Encryption makes life difficult for bulk
+surveillance systems.  GnuPG is one of the tools that Snowden used to
+uncover the secrets of the NSA.
+
+Please visit the [[https://emailselfdefense.fsf.org][Email Self-Defense]] site to learn how and why you
+should use GnuPG for your electronic communication.  If you need
+printed leaflets check out [[https://fsfe.org/contribute/spreadtheword.html#gnupg-leaflet][FSFE?s GnuPG leaflet]].
+
 * GnuPG needs your support to help protect online privacy.
 
 Please consider [[file:donate/index.org][donating]] to ensure that this critical piece of
@@ -52,25 +71,6 @@ software continues to work for everyone.
 #+end_html
 
 
-* Reconquer your privacy
-
-#+begin_quote
-Arguing that you don't care about the right to privacy
-because you have nothing to hide is no different from
-saying you don't care about free speech because you have
-nothing to say.   \ndash\nbsp{}Edward\nbsp{}Snowden
-#+end_quote
-
-Using encryption helps to protect your privacy and the privacy of the
-people you communicate with.  Encryption makes life difficult for bulk
-surveillance systems.  GnuPG is one of the tools that Snowden used to
-uncover the secrets of the NSA.
-
-Please visit the [[https://emailselfdefense.fsf.org][Email Self-Defense]] site to learn how and why you
-should use GnuPG for your electronic communication.  If you need
-printed leaflets check out [[https://fsfe.org/contribute/spreadtheword.html#gnupg-leaflet][FSFE?s GnuPG leaflet]].
-
-
 * News
 #+index: News
 
@@ -88,6 +88,11 @@ The latest release news:\\
 # GnuPG's latest news are available as [[http://feedvalidator.org/check.cgi?url%3Dhttps://www.gnupg.org/news.en.rss][RSS 2.0 compliant]] feed.  Just
 # point or paste the [[news.en.rss][RSS file]] into your aggregator.
 
+** GnuPG 2.1.22 released (2017-07-28)
+
+A new version of GnuPG has been released.  Read the full [[https://lists.gnupg.org/pipermail/gnupg-announce/2017q3/000411.html][announcement
+mail]] for details.
+
 ** GnuPG 1.4.22 released (2017-07-19)
 
 Although GnuPG 1.4 is of limited use today we did a maintenance

commit 1ba02732c8b87122fb4b0a97a3153a2663015f25
Author: Werner Koch <wk at gnupg.org>
Date:   Fri Jul 28 20:18:51 2017 +0200

    swdb: Release GnuPG 2.1.22

diff --git a/web/swdb.mac b/web/swdb.mac
index 728531b..6ea2f34 100644
--- a/web/swdb.mac
+++ b/web/swdb.mac
@@ -21,16 +21,16 @@
 #
 # GnuPG-2.1
 #
-#+macro: gnupg21_ver  2.1.21
-#+macro: gnupg21_date 2017-05-15
-#+macro: gnupg21_size 6321k
-#+macro: gnupg21_sha1 1852c066bc21893bc52026ead78edf50fdf15e13
-#+macro: gnupg21_sha2 7aead8a8ba75b69866f583b6c747d91414d523bfdfbe9a8e0fe026b16ba427dd
-#+macro: gnupg21_w32_ver  2.1.21_20170515
-#+macro: gnupg21_w32_date 2017-05-15
-#+macro: gnupg21_w32_size 3761k
-#+macro: gnupg21_w32_sha1 f8a75914e8d82375a89e39fbf45d9f72ed8ab92c
-#+macro: gnupg21_w32_sha2 ae4af56d069cebe82b5891e67b54cd297c4799f5d590fc1c678bbd9cd7b932b2
+#+macro: gnupg21_ver  2.1.22
+#+macro: gnupg21_date 2017-07-28
+#+macro: gnupg21_size 6377k
+#+macro: gnupg21_sha1 706b806f7d8d328b4ffa67954c613fdd3dfed1b9
+#+macro: gnupg21_sha2 46716faf9e1b92cfca86609f3bfffbf5bb4b6804df90dc853ff7061cfcfb4ad7
+#+macro: gnupg21_w32_ver  2.1.22_20170728
+#+macro: gnupg21_w32_date 2017-07-28
+#+macro: gnupg21_w32_size 3791k
+#+macro: gnupg21_w32_sha1 9e517a550da5619445be6820a614faf3e1bb5a46
+#+macro: gnupg21_w32_sha2 c5e65b55fed2b6f3e04565391a0ba1027acf32e5d9d61b1fec032b01b4e76a58
 
 
 #

-----------------------------------------------------------------------

Summary of changes:
 web/index.org | 43 ++++++++++++++++++++++++-------------------
 web/swdb.mac  | 20 ++++++++++----------
 2 files changed, 34 insertions(+), 29 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 31 11:26:08 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 31 Jul 2017 11:26:08 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.22-2-g4ad5bc1
Message-ID: <E1dc6xl-0002Rf-Qy@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  4ad5bc1b6d72483123963c894ee1412b2ceb99b4 (commit)
      from  dd56bc411e40f31ee42effa0d6496bfdc3bef59e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 4ad5bc1b6d72483123963c894ee1412b2ceb99b4
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 31 11:20:47 2017 +0200

    Explain the "server is older than xxx warning".
    
    * g10/call-agent.c (warn_version_mismatch): Print a note on how to
    restart the servers.
    * g10/call-dirmngr.c (warn_version_mismatch): Ditto.
    * sm/call-agent.c (warn_version_mismatch): Ditto.
    * sm/call-dirmngr.c (warn_version_mismatch): Ditto.
    --
    
    We should move this fucntion to common.  However, the status output
    functions are different and would need to be streamlined too.
    
    GnuPG-bug-id: 3117
    Debian-bug-id: 860745
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/g10/call-agent.c b/g10/call-agent.c
index 1ce6641..545b244 100644
--- a/g10/call-agent.c
+++ b/g10/call-agent.c
@@ -209,6 +209,13 @@ warn_version_mismatch (assuan_context_t ctx, const char *servername, int mode)
       else
         {
           log_info (_("WARNING: %s\n"), warn);
+          if (!opt.quiet)
+            {
+              log_info (_("Note: Outdated servers may lack important"
+                          " security fixes.\n"));
+              log_info (_("Note: Use the command \"%s\" to restart them.\n"),
+                        "gpgconf --kill all");
+            }
           write_status_strings (STATUS_WARNING, "server_version_mismatch 0",
                                 " ", warn, NULL);
           xfree (warn);
diff --git a/g10/call-dirmngr.c b/g10/call-dirmngr.c
index 9bae59f..362731e 100644
--- a/g10/call-dirmngr.c
+++ b/g10/call-dirmngr.c
@@ -157,6 +157,14 @@ warn_version_mismatch (assuan_context_t ctx, const char *servername)
       else
         {
           log_info (_("WARNING: %s\n"), warn);
+          if (!opt.quiet)
+            {
+              log_info (_("Note: Outdated servers may lack important"
+                          " security fixes.\n"));
+              log_info (_("Note: Use the command \"%s\" to restart them.\n"),
+                        "gpgconf --kill all");
+            }
+
           write_status_strings (STATUS_WARNING, "server_version_mismatch 0",
                                 " ", warn, NULL);
           xfree (warn);
diff --git a/sm/call-agent.c b/sm/call-agent.c
index ba8fb12..772c9c3 100644
--- a/sm/call-agent.c
+++ b/sm/call-agent.c
@@ -108,6 +108,13 @@ warn_version_mismatch (ctrl_t ctrl, assuan_context_t ctx,
       else
         {
           log_info (_("WARNING: %s\n"), warn);
+          if (!opt.quiet)
+            {
+              log_info (_("Note: Outdated servers may lack important"
+                          " security fixes.\n"));
+              log_info (_("Note: Use the command \"%s\" to restart them.\n"),
+                        "gpgconf --kill all");
+            }
           gpgsm_status2 (ctrl, STATUS_WARNING, "server_version_mismatch 0",
                          warn, NULL);
           xfree (warn);
diff --git a/sm/call-dirmngr.c b/sm/call-dirmngr.c
index 5ee15b7..9301940 100644
--- a/sm/call-dirmngr.c
+++ b/sm/call-dirmngr.c
@@ -175,6 +175,13 @@ warn_version_mismatch (ctrl_t ctrl, assuan_context_t ctx,
       else
         {
           log_info (_("WARNING: %s\n"), warn);
+          if (!opt.quiet)
+            {
+              log_info (_("Note: Outdated servers may lack important"
+                          " security fixes.\n"));
+              log_info (_("Note: Use the command \"%s\" to restart them.\n"),
+                        "gpgconf --kill all");
+            }
           gpgsm_status2 (ctrl, STATUS_WARNING, "server_version_mismatch 0",
                          warn, NULL);
           xfree (warn);

-----------------------------------------------------------------------

Summary of changes:
 g10/call-agent.c   | 7 +++++++
 g10/call-dirmngr.c | 8 ++++++++
 sm/call-agent.c    | 7 +++++++
 sm/call-dirmngr.c  | 7 +++++++
 4 files changed, 29 insertions(+)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 31 13:18:11 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 31 Jul 2017 13:18:11 +0200
Subject: [git] GnuPG - branch, master, updated. gnupg-2.1.22-3-g482fd57
Message-ID: <E1dc8iC-0001rv-1o@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GNU Privacy Guard".

The branch, master has been updated
       via  482fd5758c1b7e1b33c4cb50656e586a3ae16815 (commit)
      from  4ad5bc1b6d72483123963c894ee1412b2ceb99b4 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 482fd5758c1b7e1b33c4cb50656e586a3ae16815
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 31 13:12:37 2017 +0200

    dirmngr,w32: Fix http connection timeout problem.
    
    * dirmngr/http.c (connect_with_timeout) [W32]: Take care of EAGAIN.
    --
    
    GnuPG-bug-id: 3319
    Signed-off-by: Werner Koch <wk at gnupg.org>

diff --git a/dirmngr/http.c b/dirmngr/http.c
index 0bedba0..8e778df 100644
--- a/dirmngr/http.c
+++ b/dirmngr/http.c
@@ -2750,7 +2750,11 @@ connect_with_timeout (assuan_fd_t sock,
       return 0; /* Success.  */
     }
   err = gpg_err_make (default_errsource, gpg_err_code_from_syserror ());
-  if (gpg_err_code (err) != GPG_ERR_EINPROGRESS)
+  if (gpg_err_code (err) != GPG_ERR_EINPROGRESS
+#ifdef HAVE_W32_SYSTEM
+      && gpg_err_code (err) != GPG_ERR_EAGAIN
+#endif
+      )
     {
       RESTORE_BLOCKING ();
       return err;

-----------------------------------------------------------------------

Summary of changes:
 dirmngr/http.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)


hooks/post-receive
-- 
The GNU Privacy Guard
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 31 17:08:27 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 31 Jul 2017 17:08:27 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. 713d1b397374c78c7a199fc1c4c75bd2d8f0d7bb
Message-ID: <E1dcCJ1-0003yK-7v@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  713d1b397374c78c7a199fc1c4c75bd2d8f0d7bb (commit)
      from  420cda13f3d2d3391a22fb452f0fca1b6b0791c7 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 713d1b397374c78c7a199fc1c4c75bd2d8f0d7bb
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 31 17:03:22 2017 +0200

    swdb: Uploaded a new 2.1.22 Windows installer

diff --git a/web/index.org b/web/index.org
index 17d3131..42c0491 100644
--- a/web/index.org
+++ b/web/index.org
@@ -93,11 +93,15 @@ The latest release news:\\
 A new version of GnuPG has been released.  Read the full [[https://lists.gnupg.org/pipermail/gnupg-announce/2017q3/000411.html][announcement
 mail]] for details.
 
+Update 2017-07-31: We fixed a problem with keyserver access in the
+Windows version.  A fixed installer has been uploaded; see the
+[[download/index.org::#binary][download]] page.
+
 ** GnuPG 1.4.22 released (2017-07-19)
 
 Although GnuPG 1.4 is of limited use today we did a maintenance
 release to address the recently published local side channel attack
-CVE-2017-7526.  See the [[../../download/index.org][download]] section on how to get this version.
+CVE-2017-7526.  See the [[download/index.org][download]] section on how to get this version.
 
 ** Libgcrypt 1.8.0 released (2017-07-18)
 
@@ -175,7 +179,7 @@ We are pleased to announce the availability of Libgcrypt version
 
 After 14 years is was time to bump up the version of [[file:software/pinentry/index.org][Pinentry]] to 1.0.
 This new release fixes a couple of minor bugs and introduces features
-to better diagnose problems.  See the [[../../download/index.org::pinentry][download]] section on how to get
+to better diagnose problems.  See the [[download/index.org::pinentry][download]] section on how to get
 Pinentry.
 
 ** GPA 0.9.10 released (2016-11-19)
diff --git a/web/swdb.mac b/web/swdb.mac
index 6ea2f34..2e05b52 100644
--- a/web/swdb.mac
+++ b/web/swdb.mac
@@ -26,11 +26,11 @@
 #+macro: gnupg21_size 6377k
 #+macro: gnupg21_sha1 706b806f7d8d328b4ffa67954c613fdd3dfed1b9
 #+macro: gnupg21_sha2 46716faf9e1b92cfca86609f3bfffbf5bb4b6804df90dc853ff7061cfcfb4ad7
-#+macro: gnupg21_w32_ver  2.1.22_20170728
-#+macro: gnupg21_w32_date 2017-07-28
+#+macro: gnupg21_w32_ver  2.1.22_20170731
+#+macro: gnupg21_w32_date 2017-07-31
 #+macro: gnupg21_w32_size 3791k
-#+macro: gnupg21_w32_sha1 9e517a550da5619445be6820a614faf3e1bb5a46
-#+macro: gnupg21_w32_sha2 c5e65b55fed2b6f3e04565391a0ba1027acf32e5d9d61b1fec032b01b4e76a58
+#+macro: gnupg21_w32_sha1 9f3cf4aa96aedbc9411107e47c7f893691deb365
+#+macro: gnupg21_w32_sha2 0b5f30ab359478f2f3b7210cda926506e69f8dd0a3a6e4e9711b92f19f72a895
 
 
 #

-----------------------------------------------------------------------

Summary of changes:
 web/index.org | 8 ++++++--
 web/swdb.mac  | 8 ++++----
 2 files changed, 10 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org



From cvs at cvs.gnupg.org  Mon Jul 31 17:15:16 2017
From: cvs at cvs.gnupg.org (by Werner Koch)
Date: Mon, 31 Jul 2017 17:15:16 +0200
Subject: [git] gnupg-doc - branch, master,
 updated. ddb59c1fb16aeeb177561dae785450d52ae9107e
Message-ID: <E1dcCPc-000567-P3@lists.gnupg.org>

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "The GnuPG website and other docs".

The branch, master has been updated
       via  ddb59c1fb16aeeb177561dae785450d52ae9107e (commit)
      from  713d1b397374c78c7a199fc1c4c75bd2d8f0d7bb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ddb59c1fb16aeeb177561dae785450d52ae9107e
Author: Werner Koch <wk at gnupg.org>
Date:   Mon Jul 31 17:10:11 2017 +0200

    web: Fix links in last commit
    
    We need to use the ../../ kludge - should be fixed in the elisp code.

diff --git a/web/index.org b/web/index.org
index 42c0491..0b92c52 100644
--- a/web/index.org
+++ b/web/index.org
@@ -94,14 +94,14 @@ A new version of GnuPG has been released.  Read the full [[https://lists.gnupg.o
 mail]] for details.
 
 Update 2017-07-31: We fixed a problem with keyserver access in the
-Windows version.  A fixed installer has been uploaded; see the
-[[download/index.org::#binary][download]] page.
+Windows versions.  A fixed installer has been uploaded; the [[../../download/index.org::binary][download]]
+section has the links.
 
 ** GnuPG 1.4.22 released (2017-07-19)
 
 Although GnuPG 1.4 is of limited use today we did a maintenance
 release to address the recently published local side channel attack
-CVE-2017-7526.  See the [[download/index.org][download]] section on how to get this version.
+CVE-2017-7526.  See the [[../../download/index.org][download]] section on how to get this version.
 
 ** Libgcrypt 1.8.0 released (2017-07-18)
 
@@ -179,7 +179,7 @@ We are pleased to announce the availability of Libgcrypt version
 
 After 14 years is was time to bump up the version of [[file:software/pinentry/index.org][Pinentry]] to 1.0.
 This new release fixes a couple of minor bugs and introduces features
-to better diagnose problems.  See the [[download/index.org::pinentry][download]] section on how to get
+to better diagnose problems.  See the [[../../download/index.org::pinentry][download]] section on how to get
 Pinentry.
 
 ** GPA 0.9.10 released (2016-11-19)

-----------------------------------------------------------------------

Summary of changes:
 web/index.org | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)


hooks/post-receive
-- 
The GnuPG website and other docs
http://git.gnupg.org