From ralph at ml.seichter.de Thu Jun 1 09:16:58 2023 From: ralph at ml.seichter.de (Ralph Seichter) Date: Thu, 01 Jun 2023 09:16:58 +0200 Subject: [Announce] GnuPG for OS X 2.4.2 Message-ID: <87y1l3zm6t.fsf@ra.horus-it.com> GnuPG for OS X / macOS release 2.4.2 is now available for download via https://sourceforge.net/p/gpgosx/docu/Download/ . This release also includes updates for several library dependencies. The disk image signature key is available via public keyservers, and it can also be downloaded from https://www.seichter.de/pgp/gpgosx-signing.asc . pub ed25519/FD56297D9833FF7F 2022-07-07 [SC] [expires: 2027-07-06] Key fingerprint = EAB0 FE4F F793 D9E7 028E C8E2 FD56 297D 9833 FF7F uid [ultimate] Ralph Seichter (GnuPG for OS X signing key) GnuPG 2.4.x is installed in /usr/local/gnupg-2.4 instead of the formerly hardcoded directory /usr/local/gnupg-2.2. This enables installing both stable and LTS releases of GnuPG for OS X side by side, for advanced users' needs. The one caveat is that the latest installation will replace existing soft links in /usr/local/{bin,lib}. Please use absolute paths like /usr/local/gnupg-2.2/bin/gpg2 if necessary. Enjoy. -Ralph From patrick at enigmail.net Sun Jun 11 12:13:29 2023 From: patrick at enigmail.net (Patrick Brunschwig) Date: Sun, 11 Jun 2023 12:13:29 +0200 Subject: Save the Date: OpenPGP Summit 2024 Message-ID: Hello everyone This is a pre-announcement for the next OpenPGP Email Summit, which will either be in Frankfurt or Berlin on June 7./8., 2024 The meeting will happen on Friday and Saturday. If there is interest, we will have the option to add an informal hacking day before or after the event, that is on Thursday and/or Sunday. I created a poll to find out if either option is interesting for some of you. Please fill in the poll by no later than 2023-06-18. https://www.surveymonkey.com/r/CXMRF5K The invitation with more details will follow in Q1 2024. All details of the summit will be available on the following wiki page: https://wiki.gnupg.org/OpenPGPEmailSummit202406 -Patrick -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 834 bytes Desc: OpenPGP digital signature URL: From nathbappai at gmail.com Mon Jun 12 06:42:02 2023 From: nathbappai at gmail.com (Biswapriyo Nath) Date: Mon, 12 Jun 2023 10:12:02 +0530 Subject: [PATCH] w32: Fix clang compiler error with function pointer In-Reply-To: References: <20230530180244.2004-1-nathbappai@gmail.com> <6476C052.2080709@gmail.com> <6476D4B1.8000508@gmail.com> Message-ID: Any comment on this patch? Is it possible to add the patch please? From wk at gnupg.org Mon Jun 12 09:08:23 2023 From: wk at gnupg.org (Werner Koch) Date: Mon, 12 Jun 2023 09:08:23 +0200 Subject: [PATCH] w32: Fix clang compiler error with function pointer In-Reply-To: (Biswapriyo Nath via Gnupg-devel's message of "Mon, 12 Jun 2023 10:12:02 +0530") References: <20230530180244.2004-1-nathbappai@gmail.com> <6476C052.2080709@gmail.com> <6476D4B1.8000508@gmail.com> Message-ID: <87sfaxtaxk.fsf@wheatstone.g10code.de> On Mon, 12 Jun 2023 10:12, Biswapriyo Nath said: > Any comment on this patch? Is it possible to add the patch please? I see no reason to work around a clang oddity for a Windows target. We have a well working toolchain and that is what you should use. Salam-Shalom, Werner -- The pioneers of a warless world are the youth that refuse military service. - A. Einstein -------------- next part -------------- A non-text attachment was scrubbed... Name: openpgp-digital-signature.asc Type: application/pgp-signature Size: 227 bytes Desc: not available URL: From fweimer at redhat.com Mon Jun 12 11:04:00 2023 From: fweimer at redhat.com (Florian Weimer) Date: Mon, 12 Jun 2023 11:04:00 +0200 Subject: [PATCH] w32: Fix clang compiler error with function pointer In-Reply-To: <87sfaxtaxk.fsf@wheatstone.g10code.de> (Werner Koch via Gnupg-devel's message of "Mon, 12 Jun 2023 09:08:23 +0200") References: <20230530180244.2004-1-nathbappai@gmail.com> <6476C052.2080709@gmail.com> <6476D4B1.8000508@gmail.com> <87sfaxtaxk.fsf@wheatstone.g10code.de> Message-ID: <87fs6x59xb.fsf@oldenburg3.str.redhat.com> * Werner Koch via Gnupg-devel: > On Mon, 12 Jun 2023 10:12, Biswapriyo Nath said: >> Any comment on this patch? Is it possible to add the patch please? > > I see no reason to work around a clang oddity for a Windows target. We > have a well working toolchain and that is what you should use. GCC will eventually make this change as well (although probably not in GCC 14). This hasn't been valid C for decades. Thanks, Florian From James.Bottomley at HansenPartnership.com Thu Jun 15 21:01:53 2023 From: James.Bottomley at HansenPartnership.com (James Bottomley) Date: Thu, 15 Jun 2023 15:01:53 -0400 Subject: [PATCH GnuPG 0/9] Fix TPM support tests In-Reply-To: <20230615-tpm-wip-v1-0-ad33636ba211@kernel.org> References: <20230615-tpm-wip-v1-0-ad33636ba211@kernel.org> Message-ID: On Thu, 2023-06-15 at 16:22 +0200, Maxime Ripard wrote: > Hi, > > This is a series meant to fix the various issues currently found when > running the TPM tests. > > See: > https://dev.gnupg.org/T6052 > https://bugzilla.redhat.com/show_bug.cgi?id=2089075 > > It looks like it's not being run on a regular basis and thus the > tests have been broken in various small ways that probably crept in > over the years. I can try to help, although, to be honest, I had no idea there were any TPM tests ... > > This series fixes some of the issues, but the tests still do not run > properly with the following error: > > Making check in tpm2dtests > make[2]: Entering directory '/var/home/max/gnupg2/gnupg- > 2.4.2/tests/tpm2dtests' > LC_ALL=C EXEEXT= > PATH="../gpgscm:/var/home/max/.cache/cabal//bin:/var/home/max/.local/ > share/cargo/bin:/var/home/max/.local/bin:/var/home/max/.local/share/f > latpak/exports/bin:/var/lib/flatpak/exports/bin:/usr/local/sbin:/usr/ > local/bin:/usr/sbin:/usr/bin:/sbin:/bin" > abs_top_srcdir="/var/home/max/gnupg2/gnupg-2.4.2" > objdir="/var/home/max/gnupg2/gnupg-2.4.2" TSS2_LOG=all+DEBUG > TSS2_LOGFILE=tss2.log TPMSERVER="" SWTPM="/bin/swtpm" SWTPM_IOCTL="" > GNUPG_BUILD_ROOT="/var/home/max/gnupg2/gnupg-2.4.2" > GNUPG_IN_TEST_SUITE=fact GPGSCM_PATH="/var/home/max/gnupg2/gnupg- > 2.4.2/tests/gpgscm" TPM2TOOLS_TCTI="swtpm:host=localhost,port=2321" > /var/home/max/gnupg2/gnupg-2.4.2/tests/gpgscm/gpgscm \ > ? /var/home/max/gnupg2/gnupg-2.4.2/tests/tpm2dtests/run-tests.scm? But now I try to run it with make -C tests/tpm2dtests, it fails with: make: Entering directory '/home/jejb/git/gnupg/tests/tpm2dtests' LC_ALL=C EXEEXT= PATH="../gpgscm:/home/jejb/.cargo/bin:/home/jejb/bin:/usr/local/bin:/bi n:/usr/bin:/sbin:/usr/sbin:/usr/local/sbin:/usr/etc:/etc:/home/jejb/and roid/android-sdk-linux_x86/platform-tools:/home/jejb/android/android- sdk-linux_x86/tools" abs_top_srcdir="/home/jejb/git/gnupg" objdir="/home/jejb/git/gnupg" TPMSERVER="/usr/lib/ibmtss/tpm_server" SWTPM="" SWTPM_IOCTL="" GNUPG_BUILD_ROOT="/home/jejb/git/gnupg/tests" GNUPG_IN_TEST_SUITE=fact GPGSCM_PATH="/home/jejb/git/gnupg/tests/gpgscm" /home/jejb/git/gnupg/tests/gpgscm/gpgscm \ /home/jejb/git/gnupg/tests/tpm2dtests/run-tests.scm /home/jejb/git/gnupg/tests/tpm2dtests/run-tests.scm:30: not enough arguments, missing: (path . args) > PASS: tests/tpm2dtests/setup.scm > creating TPM? rsa2048? key > keytotpm failed: Secret key is available. My best guess for this would be a TPM communications failure. I only ever tested this on a real TPM or a VM with an emulated TPM device and using the IBM tss. I didn't actually ever test on a socsim connection (although there's no reason at all why it shouldn't work). Regards, James From James.Bottomley at HansenPartnership.com Mon Jun 19 17:49:15 2023 From: James.Bottomley at HansenPartnership.com (James Bottomley) Date: Mon, 19 Jun 2023 11:49:15 -0400 Subject: [PATCH GnuPG 0/9] Fix TPM support tests In-Reply-To: <6iltjjmzxoyrv3qtxltfn6c45k35yutryobetnwgijfynsvhe5@iqda7qt2qvix> References: <20230615-tpm-wip-v1-0-ad33636ba211@kernel.org> <6iltjjmzxoyrv3qtxltfn6c45k35yutryobetnwgijfynsvhe5@iqda7qt2qvix> Message-ID: On Sun, 2023-06-18 at 16:36 +0200, Maxime Ripard wrote: > [...] > > > This series fixes some of the issues, but the tests still do not > > > runproperly with the following error: > > > > > > Making check in tpm2dtests > > > make[2]: Entering directory '/var/home/max/gnupg2/gnupg- > > > 2.4.2/tests/tpm2dtests' > > > LC_ALL=C EXEEXT= > > > PATH="../gpgscm:/var/home/max/.cache/cabal//bin:/var/home/max/.lo > > > cal/ > > > share/cargo/bin:/var/home/max/.local/bin:/var/home/max/.local/sha > > > re/f > > > latpak/exports/bin:/var/lib/flatpak/exports/bin:/usr/local/sbin:/ > > > usr/ > > > local/bin:/usr/sbin:/usr/bin:/sbin:/bin" > > > abs_top_srcdir="/var/home/max/gnupg2/gnupg-2.4.2" > > > objdir="/var/home/max/gnupg2/gnupg-2.4.2" TSS2_LOG=all+DEBUG > > > TSS2_LOGFILE=tss2.log TPMSERVER="" SWTPM="/bin/swtpm" > > > SWTPM_IOCTL="" > > > GNUPG_BUILD_ROOT="/var/home/max/gnupg2/gnupg-2.4.2" > > > GNUPG_IN_TEST_SUITE=fact GPGSCM_PATH="/var/home/max/gnupg2/gnupg- > > > 2.4.2/tests/gpgscm" > > > TPM2TOOLS_TCTI="swtpm:host=localhost,port=2321" > > > /var/home/max/gnupg2/gnupg-2.4.2/tests/gpgscm/gpgscm \ > > > ? /var/home/max/gnupg2/gnupg-2.4.2/tests/tpm2dtests/run- > > > tests.scm? > > > > But now I try to run it with make -C tests/tpm2dtests, it fails > > with: > > > > make: Entering directory '/home/jejb/git/gnupg/tests/tpm2dtests' > > LC_ALL=C EXEEXT= > > PATH="../gpgscm:/home/jejb/.cargo/bin:/home/jejb/bin:/usr/local/bin > > :/bi > > n:/usr/bin:/sbin:/usr/sbin:/usr/local/sbin:/usr/etc:/etc:/home/jejb > > /and > > roid/android-sdk-linux_x86/platform- > > tools:/home/jejb/android/android- > > sdk-linux_x86/tools" abs_top_srcdir="/home/jejb/git/gnupg" > > objdir="/home/jejb/git/gnupg" > > TPMSERVER="/usr/lib/ibmtss/tpm_server" > > SWTPM="" SWTPM_IOCTL="" > > GNUPG_BUILD_ROOT="/home/jejb/git/gnupg/tests" > > GNUPG_IN_TEST_SUITE=fact > > GPGSCM_PATH="/home/jejb/git/gnupg/tests/gpgscm" > > /home/jejb/git/gnupg/tests/gpgscm/gpgscm \ > > ? /home/jejb/git/gnupg/tests/tpm2dtests/run-tests.scm? > > /home/jejb/git/gnupg/tests/tpm2dtests/run-tests.scm:30: not enough > > arguments, missing: (path . args) > > The patches in this series should solve this. Even with the patches, I'm now getting a different error: jejb at lingrow:~/git/gnupg> make -C tests/tpm2dtests check make: Entering directory '/home/jejb/git/gnupg/tests/tpm2dtests' LC_ALL=C EXEEXT= PATH="../gpgscm:/home/jejb/.cargo/bin:/home/jejb/bin:/usr/local/bin:/bi n:/usr/bin:/sbin:/usr/sbin:/usr/local/sbin:/usr/etc:/etc:/home/jejb/and roid/android-sdk-linux_x86/platform-tools:/home/jejb/android/android- sdk-linux_x86/tools" abs_top_srcdir="/home/jejb/git/gnupg" objdir="/home/jejb/git/gnupg" TPMSERVER="/usr/lib/ibmtss/tpm_server" SWTPM="" SWTPM_IOCTL="" GNUPG_BUILD_ROOT="/home/jejb/git/gnupg/tests" GNUPG_IN_TEST_SUITE=fact GPGSCM_PATH="/home/jejb/git/gnupg/tests/gpgscm" /home/jejb/git/gnupg/tests/gpgscm/gpgscm \ /home/jejb/git/gnupg/tests/tpm2dtests/run-tests.scm 0: tests.scm:121: (throw (:stderr result)) 1: defs.scm:148: (call-popen `(,(tool-hardcoded 'gpgconf) ,@(if *win32* (list '--build-prefix (getenv "objdir")) '()) , at args) input) 2: defs.scm:146: (gpg-conf' "" args) 3: # 4: defs.scm:189: (apply gpg-conf '(--list-components)) FAIL: tests/openpgp/setup.scm Setup failed. make: *** [Makefile:632: xcheck] Error 1 make: Leaving directory '/home/jejb/git/gnupg/tests/tpm2dtests' I know this means something is missing from the setup, but I can't figure out what. James -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 228 bytes Desc: This is a digitally signed message part URL: From James.Bottomley at HansenPartnership.com Tue Jun 20 04:32:33 2023 From: James.Bottomley at HansenPartnership.com (James Bottomley) Date: Mon, 19 Jun 2023 22:32:33 -0400 Subject: [PATCH GnuPG 0/9] Fix TPM support tests In-Reply-To: References: <20230615-tpm-wip-v1-0-ad33636ba211@kernel.org> <6iltjjmzxoyrv3qtxltfn6c45k35yutryobetnwgijfynsvhe5@iqda7qt2qvix> Message-ID: On Mon, 2023-06-19 at 18:22 +0200, Maxime Ripard wrote: > On Mon, Jun 19, 2023 at 11:49:15AM -0400, James Bottomley wrote: > > On Sun, 2023-06-18 at 16:36 +0200, Maxime Ripard wrote: > > > > > [...] > > > > > This series fixes some of the issues, but the tests still do > > > > > not > > > > > runproperly with the following error: > > > > > > > > > > Making check in tpm2dtests > > > > > make[2]: Entering directory '/var/home/max/gnupg2/gnupg- > > > > > 2.4.2/tests/tpm2dtests' > > > > > LC_ALL=C EXEEXT= > > > > > PATH="../gpgscm:/var/home/max/.cache/cabal//bin:/var/home/max > > > > > /.lo > > > > > cal/ > > > > > share/cargo/bin:/var/home/max/.local/bin:/var/home/max/.local > > > > > /sha > > > > > re/f > > > > > latpak/exports/bin:/var/lib/flatpak/exports/bin:/usr/local/sb > > > > > in:/ > > > > > usr/ > > > > > local/bin:/usr/sbin:/usr/bin:/sbin:/bin" > > > > > abs_top_srcdir="/var/home/max/gnupg2/gnupg-2.4.2" > > > > > objdir="/var/home/max/gnupg2/gnupg-2.4.2" TSS2_LOG=all+DEBUG > > > > > TSS2_LOGFILE=tss2.log TPMSERVER="" SWTPM="/bin/swtpm" > > > > > SWTPM_IOCTL="" > > > > > GNUPG_BUILD_ROOT="/var/home/max/gnupg2/gnupg-2.4.2" > > > > > GNUPG_IN_TEST_SUITE=fact > > > > > GPGSCM_PATH="/var/home/max/gnupg2/gnupg- > > > > > 2.4.2/tests/gpgscm" > > > > > TPM2TOOLS_TCTI="swtpm:host=localhost,port=2321" > > > > > /var/home/max/gnupg2/gnupg-2.4.2/tests/gpgscm/gpgscm \ > > > > > ? /var/home/max/gnupg2/gnupg-2.4.2/tests/tpm2dtests/run- > > > > > tests.scm? > > > > > > > > But now I try to run it with make -C tests/tpm2dtests, it fails > > > > with: > > > > > > > > make: Entering directory > > > > '/home/jejb/git/gnupg/tests/tpm2dtests' > > > > LC_ALL=C EXEEXT= > > > > PATH="../gpgscm:/home/jejb/.cargo/bin:/home/jejb/bin:/usr/local > > > > /bin > > > > :/bi > > > > n:/usr/bin:/sbin:/usr/sbin:/usr/local/sbin:/usr/etc:/etc:/home/ > > > > jejb > > > > /and > > > > roid/android-sdk-linux_x86/platform- > > > > tools:/home/jejb/android/android- > > > > sdk-linux_x86/tools" abs_top_srcdir="/home/jejb/git/gnupg" > > > > objdir="/home/jejb/git/gnupg" > > > > TPMSERVER="/usr/lib/ibmtss/tpm_server" > > > > SWTPM="" SWTPM_IOCTL="" > > > > GNUPG_BUILD_ROOT="/home/jejb/git/gnupg/tests" > > > > GNUPG_IN_TEST_SUITE=fact > > > > GPGSCM_PATH="/home/jejb/git/gnupg/tests/gpgscm" > > > > /home/jejb/git/gnupg/tests/gpgscm/gpgscm \ > > > > ? /home/jejb/git/gnupg/tests/tpm2dtests/run-tests.scm? > > > > /home/jejb/git/gnupg/tests/tpm2dtests/run-tests.scm:30: not > > > > enough > > > > arguments, missing: (path . args) > > > > > > The patches in this series should solve this. > > > > Even with the patches, I'm now getting a different error: > > > > jejb at lingrow:~/git/gnupg> make -C tests/tpm2dtests check > > make: Entering directory '/home/jejb/git/gnupg/tests/tpm2dtests' > > LC_ALL=C EXEEXT= > > PATH="../gpgscm:/home/jejb/.cargo/bin:/home/jejb/bin:/usr/local/bin > > :/bi > > n:/usr/bin:/sbin:/usr/sbin:/usr/local/sbin:/usr/etc:/etc:/home/jejb > > /and > > roid/android-sdk-linux_x86/platform- > > tools:/home/jejb/android/android- > > sdk-linux_x86/tools" abs_top_srcdir="/home/jejb/git/gnupg" > > objdir="/home/jejb/git/gnupg" > > TPMSERVER="/usr/lib/ibmtss/tpm_server" > > SWTPM="" SWTPM_IOCTL="" > > GNUPG_BUILD_ROOT="/home/jejb/git/gnupg/tests" > > GNUPG_IN_TEST_SUITE=fact > > GPGSCM_PATH="/home/jejb/git/gnupg/tests/gpgscm" > > /home/jejb/git/gnupg/tests/gpgscm/gpgscm \ > > ? /home/jejb/git/gnupg/tests/tpm2dtests/run-tests.scm? > > > > 0: tests.scm:121: (throw (:stderr result)) > > 1: defs.scm:148: (call-popen `(,(tool-hardcoded 'gpgconf) ,@(if > > *win32* > > (list '--build-prefix (getenv "objdir")) '()) , at args) input) > > 2: defs.scm:146: (gpg-conf' "" args) > > 3: # > > 4: defs.scm:189: (apply gpg-conf '(--list-components)) > > FAIL: tests/openpgp/setup.scm > > Setup failed. > > make: *** [Makefile:632: xcheck] Error 1 > > make: Leaving directory '/home/jejb/git/gnupg/tests/tpm2dtests' > > > > I know this means something is missing from the setup, but I can't > > figure out what. > > I got it to build and run on a Fedora 38 system using: > > ./autogen.sh > ./configure --sysconfdir=/etc --enable-maintainer-mode > make > make -C tests/tpm2dtests check Oh, right, you alter a Makefile.am so I have to re-run autoreconf. I think I'm getting a different failure now, but it's actually because keytotpm really isn't working in gpg current (so the tests are correctly failing). The problem is this commit: 2783b786a ("agent: Do not overwrite a key file by a shadow key file.") because the KEYTOTPM agent command relies on overwriting the real key with a shadowed TPM key. This is my hack to fix it and now I have all the TPM tests passing (still using the ibmswtpm2 because the other one isn't building on opensuse). I think the hack is actually the best way because the corresponding KEYTOCARD would delete the key as well before rescanning the card. James --- diff --git a/agent/divert-tpm2.c b/agent/divert-tpm2.c index b2f884f93..2a4d0a352 100644 --- a/agent/divert-tpm2.c +++ b/agent/divert-tpm2.c @@ -40,11 +40,18 @@ agent_write_tpm2_shadow_key (ctrl_t ctrl, const unsigned char *grip, gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, pkbuf, len); gcry_sexp_release (s_pkey); + err = agent_delete_key (ctrl, NULL, grip, 1, 0); + if (err) + { + log_error ("failed to delete unshadowed key: %s\n", gpg_strerror (err)); + /* try to overwrite anyway */ + } + err = agent_shadow_key_type (pkbuf, shadow_info, "tpm2-v1", &shdkey); xfree (pkbuf); if (err) { - log_error ("shadowing the key failed: %s\n", gpg_strerror (err)); + log_error ("shadowing the tpm key failed: %s\n", gpg_strerror (err)); return err; } -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 228 bytes Desc: This is a digitally signed message part URL: From wk at gnupg.org Tue Jun 20 08:13:54 2023 From: wk at gnupg.org (Werner Koch) Date: Tue, 20 Jun 2023 08:13:54 +0200 Subject: [PATCH GnuPG 0/9] Fix TPM support tests In-Reply-To: (James Bottomley via Gnupg-devel's message of "Mon, 19 Jun 2023 22:32:33 -0400") References: <20230615-tpm-wip-v1-0-ad33636ba211@kernel.org> <6iltjjmzxoyrv3qtxltfn6c45k35yutryobetnwgijfynsvhe5@iqda7qt2qvix> Message-ID: <87r0q6oe3h.fsf@wheatstone.g10code.de> On Mon, 19 Jun 2023 22:32, James Bottomley said: > on opensuse). I think the hack is actually the best way because the > corresponding KEYTOCARD would delete the key as well before rescanning > the card. I agree for the TPM. For keytocard with smartcards it is common not to do a "save" and thus keep the original on-disk key. This allows to copy a key to several cards as a backup. Shalom-Salam, Werner -- The pioneers of a warless world are the youth that refuse military service. - A. Einstein -------------- next part -------------- A non-text attachment was scrubbed... Name: openpgp-digital-signature.asc Type: application/pgp-signature Size: 227 bytes Desc: not available URL: From James.Bottomley at HansenPartnership.com Tue Jun 20 15:10:22 2023 From: James.Bottomley at HansenPartnership.com (James Bottomley) Date: Tue, 20 Jun 2023 09:10:22 -0400 Subject: [PATCH GnuPG 0/9] Fix TPM support tests In-Reply-To: <87r0q6oe3h.fsf@wheatstone.g10code.de> References: <20230615-tpm-wip-v1-0-ad33636ba211@kernel.org> <6iltjjmzxoyrv3qtxltfn6c45k35yutryobetnwgijfynsvhe5@iqda7qt2qvix> <87r0q6oe3h.fsf@wheatstone.g10code.de> Message-ID: <1abc66f29cd46c44113c40d4ff01419bcc062179.camel@HansenPartnership.com> On Tue, 2023-06-20 at 08:13 +0200, Werner Koch via Gnupg-devel wrote: > On Mon, 19 Jun 2023 22:32, James Bottomley said: > > on opensuse).? I think the hack is actually the best way because > > the corresponding KEYTOCARD would delete the key as well before > > rescanning the card. > > I agree for the TPM.? For keytocard with smartcards it is common not > to do a "save" and thus keep the original on-disk key.? This allows > to copy a key to several cards as a backup. OK, I'll try to package this up as a patch. I'm still a bit worried about the error handling: if agent_shadow_key_type() fails and the user does a quit with save, we'll have deleted the private key. Is there some way to force an abort without saving? James -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 228 bytes Desc: This is a digitally signed message part URL: From James.Bottomley at HansenPartnership.com Fri Jun 23 19:48:20 2023 From: James.Bottomley at HansenPartnership.com (James Bottomley) Date: Fri, 23 Jun 2023 13:48:20 -0400 Subject: [PATCH GnuPG 8/9] tests: tpm2d: Set TPM2TOOLS_TCTI if we're using SWTPM In-Reply-To: <20230615-tpm-wip-v1-8-ad33636ba211@kernel.org> References: <20230615-tpm-wip-v1-0-ad33636ba211@kernel.org> <20230615-tpm-wip-v1-8-ad33636ba211@kernel.org> Message-ID: <4ab38753b855ee3dc7ec6ee504d73586a6960976.camel@HansenPartnership.com> On Thu, 2023-06-15 at 16:22 +0200, Maxime Ripard wrote: > The TPM2TOOLS_TCTI is used to control the location of the TPM with > Intel's TSS. Let's set it according to our setup of swtpm so that we > can find it properly. This Shouldn't be necessary. The Intel TSS wrapper (int tpm2d/intel- tss.h:TSS_Create) has code to shim the TPM_INTERFACE_TYPE and make it work. I know it's working in openssl_tpm2_engine, but I haven't yet been able to find a build system to get gnupg working again with the Intel TSS. One of the problems I've been having is that swtpm is now terminally broken on openSUSE, which is why I've been using ibmswtpm2: https://build.opensuse.org/package/show/security/swtpm https://build.opensuse.org/package/show/security/ibmswtpm2 I'd suggest trying to get the Intel TSS working with ibmswtpm2 based tests first and then trying to extend to swtpm (so you know the problem is in the swtpm connection layer). Regards, James From James.Bottomley at HansenPartnership.com Fri Jun 23 23:05:37 2023 From: James.Bottomley at HansenPartnership.com (James Bottomley) Date: Fri, 23 Jun 2023 17:05:37 -0400 Subject: [PATCH GnuPG 0/9] Fix TPM support tests In-Reply-To: <1abc66f29cd46c44113c40d4ff01419bcc062179.camel@HansenPartnership.com> References: <20230615-tpm-wip-v1-0-ad33636ba211@kernel.org> <6iltjjmzxoyrv3qtxltfn6c45k35yutryobetnwgijfynsvhe5@iqda7qt2qvix> <87r0q6oe3h.fsf@wheatstone.g10code.de> <1abc66f29cd46c44113c40d4ff01419bcc062179.camel@HansenPartnership.com> Message-ID: On Tue, 2023-06-20 at 09:10 -0400, James Bottomley via Gnupg-devel wrote: > On Tue, 2023-06-20 at 08:13 +0200, Werner Koch via Gnupg-devel wrote: > > On Mon, 19 Jun 2023 22:32, James Bottomley said: > > > on opensuse).? I think the hack is actually the best way because > > > the corresponding KEYTOCARD would delete the key as well before > > > rescanning the card. > > > > I agree for the TPM.? For keytocard with smartcards it is common > > not > > to do a "save" and thus keep the original on-disk key.? This allows > > to copy a key to several cards as a backup. > > OK, I'll try to package this up as a patch.? I'm still a bit worried > about the error handling: if agent_shadow_key_type() fails and the > user does a quit with save, we'll have deleted the private key.? Is > there some way to force an abort without saving? OK, this is what I came up with. The error handling tries to rewrite the secret key if something goes wrong with the shadow write, which at least attempts to put stuff back, but I'd still prefer some ability not to delete it in the first place. James -----8>8>8><8<8<8---- From: James Bottomley Subject: [PATCH] agent: fix tpm2d key to tpm handling commit: 2783b786a ("agent: Do not overwrite a key file by a shadow key file.") broke keytotpm because you can no longer overwrite a non-shadowed secret key, now you must first delete it. Fix KEYTOTPM by deleting the key before writing it. Signed-off-by: James Bottomley --- agent/divert-tpm2.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/agent/divert-tpm2.c b/agent/divert-tpm2.c index b2f884f93..64a66f5a5 100644 --- a/agent/divert-tpm2.c +++ b/agent/divert-tpm2.c @@ -28,7 +28,7 @@ static gpg_error_t agent_write_tpm2_shadow_key (ctrl_t ctrl, const unsigned char *grip, unsigned char *shadow_info) { - gpg_error_t err; + gpg_error_t err, err1; unsigned char *shdkey; unsigned char *pkbuf; size_t len; @@ -38,14 +38,20 @@ agent_write_tpm2_shadow_key (ctrl_t ctrl, const unsigned char *grip, len = gcry_sexp_sprint(s_pkey, GCRYSEXP_FMT_CANON, NULL, 0); pkbuf = xtrymalloc (len); gcry_sexp_sprint (s_pkey, GCRYSEXP_FMT_CANON, pkbuf, len); - gcry_sexp_release (s_pkey); err = agent_shadow_key_type (pkbuf, shadow_info, "tpm2-v1", &shdkey); xfree (pkbuf); if (err) { - log_error ("shadowing the key failed: %s\n", gpg_strerror (err)); - return err; + log_error ("shadowing the tpm key failed: %s\n", gpg_strerror (err)); + goto out_free; + } + + err = agent_delete_key (ctrl, NULL, grip, 1, 0); + if (err) + { + log_error ("failed to delete unshadowed key: %s\n", gpg_strerror (err)); + goto out_free; } len = gcry_sexp_canon_len (shdkey, 0, NULL, NULL); @@ -53,9 +59,22 @@ agent_write_tpm2_shadow_key (ctrl_t ctrl, const unsigned char *grip, NULL, NULL, NULL, 0); xfree (shdkey); if (err) - log_error ("error writing key: %s\n", gpg_strerror (err)); + { + log_error ("error writing key: %s\n", gpg_strerror (err)); + + err1 = agent_write_private_key (grip, shdkey, len, 1 /*force*/, + NULL, NULL, NULL, 0); + if (err1) + { + log_error ("error trying to restore private key: %s\n", + gpg_strerror (err1)); + } + } + out_free: + gcry_sexp_release (s_pkey); return err; + } int -- 2.35.3 -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 228 bytes Desc: This is a digitally signed message part URL: From James.Bottomley at HansenPartnership.com Fri Jun 23 23:08:14 2023 From: James.Bottomley at HansenPartnership.com (James Bottomley) Date: Fri, 23 Jun 2023 17:08:14 -0400 Subject: [PATCH GnuPG 8/9] tests: tpm2d: Set TPM2TOOLS_TCTI if we're using SWTPM In-Reply-To: <4ab38753b855ee3dc7ec6ee504d73586a6960976.camel@HansenPartnership.com> References: <20230615-tpm-wip-v1-0-ad33636ba211@kernel.org> <20230615-tpm-wip-v1-8-ad33636ba211@kernel.org> <4ab38753b855ee3dc7ec6ee504d73586a6960976.camel@HansenPartnership.com> Message-ID: On Fri, 2023-06-23 at 13:48 -0400, James Bottomley via Gnupg-devel wrote: [...] > I'd suggest trying to get the Intel TSS working with ibmswtpm2 based > tests first and then trying to extend to swtpm (so you know the > problem is in the swtpm connection layer). Actually, I have this working now as well (using patches 1-3 from your series and the latest fix I posted) with all tests passing, so I can confirm your problem is something in the swtpm setup. Regards, James From heiko at schaefer.name Sat Jun 24 12:21:12 2023 From: heiko at schaefer.name (=?UTF-8?Q?Heiko_Sch=c3=a4fer?=) Date: Sat, 24 Jun 2023 12:21:12 +0200 Subject: Typo in scd/app-piv.c comment Message-ID: <1daa3241-a0cc-b361-7d2e-d54918689427@schaefer.name> I found a minor typo in app-piv.c: diff --git a/scd/app-piv.c b/scd/app-piv.c index a51ac31ec..d2c25c8e5 100644 --- a/scd/app-piv.c +++ b/scd/app-piv.c @@ -1039,7 +1039,7 @@ do_setattr (app_t app, ctrl_t ctrl, const char *name, ???? int special;?????????????? /* Special mode to use for thus NAME.? */ ?? } table[] = { ???? /* Authenticate using the PIV Card Application Administration Key -???? * (0x0B).? Note that Yubico calls this key the "management key" +???? * (0x9B).? Note that Yubico calls this key the "management key" ????? * which we don't do because that term is too similar to "Cert ????? * Management Key" (0x9D).? */ ???? { "AUTH-ADM-KEY", 0x0000, 0x0000, 1 }, From heiko at schaefer.name Sat Jun 24 13:47:53 2023 From: heiko at schaefer.name (Heiko Schaefer) Date: Sat, 24 Jun 2023 13:47:53 +0200 Subject: [PATCH] scd:piv: Fix auth_adm_key. Message-ID: <20230624114753.3339110-1-heiko@schaefer.name> * scd/app-piv.c (auth_adm_key): Fix wrong byte in command. -- The second command sent contained an incorrect value (compare "Special Publication 800-73-4", A.2 "Mutual Authentication of Client Application and Card Application"). Authentication against the YubiKey PIV application works without this patch. However, with other PIV implementations (like https://github.com/arekinath/PivApplet and https://github.com/canokeys/canokey-core), authentication only succeeds with this patch. --- scd/app-piv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scd/app-piv.c b/scd/app-piv.c index a51ac31ec..67c00a108 100644 --- a/scd/app-piv.c +++ b/scd/app-piv.c @@ -928,7 +928,7 @@ auth_adm_key (app_t app, const unsigned char *value, size_t valuelen) tmpl[12] = 0x81; tmpl[13] = 8; gcry_create_nonce (tmpl+14, 8); - tmpl[22] = 0x80; + tmpl[22] = 0x82; tmpl[23] = 0; tmpllen = 24; xfree (outdata); -- 2.41.0 From James.Bottomley at HansenPartnership.com Sun Jun 25 17:41:01 2023 From: James.Bottomley at HansenPartnership.com (James Bottomley) Date: Sun, 25 Jun 2023 11:41:01 -0400 Subject: [PATCH GnuPG 8/9] tests: tpm2d: Set TPM2TOOLS_TCTI if we're using SWTPM In-Reply-To: References: <20230615-tpm-wip-v1-0-ad33636ba211@kernel.org> <20230615-tpm-wip-v1-8-ad33636ba211@kernel.org> <4ab38753b855ee3dc7ec6ee504d73586a6960976.camel@HansenPartnership.com> Message-ID: <38fe582f3efb101fe93145cd94e93f0f3f9ee441.camel@HansenPartnership.com> On Fri, 2023-06-23 at 17:08 -0400, James Bottomley via Gnupg-devel wrote: > On Fri, 2023-06-23 at 13:48 -0400, James Bottomley via Gnupg-devel > wrote: > [...] > > I'd suggest trying to get the Intel TSS working with ibmswtpm2 > > based tests first and then trying to extend to swtpm (so you know > > the problem is in the swtpm connection layer). > > Actually, I have this working now as well (using patches 1-3 from > yourseries and the latest fix I posted) with all tests passing, so I > can confirm your problem is something in the swtpm setup. Sorry for the delay, but this has been quite a saga. I've fixed the Leap builds of swtpm 0.8.0 so I could check it: https://build.opensuse.org/package/show/home:jejb1:Tumbleweed/swtpm Then I tried to plug it back into openssl_tpm2_engine (which was the master for the current gpg test rig). When I finally got this working, I remember why I abandoned swtpm in the first place (before the openSUSE builds stopped working): it's failing several tests in my suite, all to do with elliptic curves. This time around I actually dug into these and determined that several of the failures are openssl related: it has a strange idea of how you sign certificates with curves of under 256 bits. Apparently swtpm enables P-192 and Brainpool 224, which no other TPM I've ever seen does, but these curves trigger the openssl failure. The final EC failure looks to be internal to swtpm itself: it can't handle curves that are parametrised rather than named. However, although this last may be fatal for openssl_tpm2_engine, it's not a problem for gnupg because it doesn't ever use parametrised curves. So the final fix is to drop this patch in favour of the one below (the connection setting in intel-tss.h is overriding your environment variable) and all the tests actually pass. However, I really think for testing you should be using ibmswtpm2 https://github.com/kgoldman/ibmswtpm2 It is a faithful port of the MS standard TPM2 reference implementation https://github.com/microsoft/ms-tpm-20-ref it only enables TCG mandated curves and it works for parametrised EC curves. Swtpm seems to have deviated significantly from the reference implementation which is why it's having the problems I outlined ... I'm sure it will get fixed eventually, but a test suite needs a reliable base to run on top of, which is why it should be using the reference implementation. Regards, James --- diff --git a/tpm2d/intel-tss.h b/tpm2d/intel-tss.h index 615f81e2f..53da5cee2 100644 --- a/tpm2d/intel-tss.h +++ b/tpm2d/intel-tss.h @@ -285,9 +285,15 @@ TSS_Create(TSS_CONTEXT **tssContext) */ if (intType) { - if (strcmp("socsim", intType) == 0) { - tctildr = "mssim"; - } + if (strcmp("socsim", intType) == 0) + { + char *swtpm = getenv("SWTPM"); + + if (!swtpm || strlen(swtpm) == 0) + tctildr = "mssim"; + else + tctildr = "swtpm"; + } else if (strcmp("dev", intType) == 0) { tctildr = "device"; From gniibe at fsij.org Tue Jun 27 08:50:07 2023 From: gniibe at fsij.org (NIIBE Yutaka) Date: Tue, 27 Jun 2023 15:50:07 +0900 Subject: [PATCH] scd:piv: Fix auth_adm_key. In-Reply-To: <20230624114753.3339110-1-heiko@schaefer.name> References: <20230624114753.3339110-1-heiko@schaefer.name> Message-ID: <87zg4l1js0.fsf@akagi.fsij.org> Hello, Heiko Schaefer wrote: > The second command sent contained an incorrect value (compare "Special > Publication 800-73-4", A.2 "Mutual Authentication of Client Application > and Card Application"). Thank you, applied to master (the fix of comment as well for the PIV authentication key). I will backport to 2.4. -- From jernej.jakob at gmail.com Thu Jun 29 23:41:41 2023 From: jernej.jakob at gmail.com (Jernej Jakob) Date: Thu, 29 Jun 2023 23:41:41 +0200 Subject: [PATCH scute] Add configure enable argument to build tests Message-ID: <20230629234114.38bb2c5a@gentoo.home> * configure.ac: - remove always-true RUN_TESTS - add enable argument 'tests' (default = yes) - set conditional BUILD_TESTS * Makefile.am: - rename RUN_TESTS to BUILD_TESTS Signed-off-by: Jernej Jakob --- Makefile.am | 2 +- configure.ac | 14 ++++++++------ 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/Makefile.am b/Makefile.am index a20f1bc..58a6641 100644 --- a/Makefile.am +++ b/Makefile.am @@ -26,7 +26,7 @@ AUTOMAKE_OPTIONS = dist-bzip2 no-dist-gzip EXTRA_DIST = autogen.sh README.GIT VERSION -if RUN_TESTS +if BUILD_TESTS tests = tests else tests = diff --git a/configure.ac b/configure.ac index c3d58cf..a4754c5 100644 --- a/configure.ac +++ b/configure.ac @@ -202,7 +202,14 @@ AC_ARG_ENABLE([doc], AS_HELP_STRING([--disable-doc], build_doc=$enableval, build_doc=yes) AM_CONDITIONAL([BUILD_DOC], [test "x$build_doc" != xno && test "x$have_doc_tools" = xyes]) - +# +# Option to build tests +# +build_tests=yes +AC_ARG_ENABLE([tests], AS_HELP_STRING([--disable-tests], + [do not build tests]), + build_tests=$enableval, build_tests=yes) +AM_CONDITIONAL([BUILD_TESTS], [test "x$build_tests" = xyes ]) AC_SUBST(LIBSCUTE_LT_CURRENT) AC_SUBST(LIBSCUTE_LT_AGE) @@ -298,11 +305,6 @@ AC_C_INLINE # Checks for library functions. AC_CHECK_FUNCS([ttyname localtime_r timegm stpcpy]) -# Test if tests can be run -ok=yes -AM_CONDITIONAL(RUN_TESTS, test "$ok" = "yes") - - AH_BOTTOM([ /* Prefix all estream functions. */ #define _ESTREAM_EXT_SYM_PREFIX _scute_ -- 2.39.3 -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 228 bytes Desc: OpenPGP digital signature URL: From wk at gnupg.org Fri Jun 30 16:31:29 2023 From: wk at gnupg.org (Werner Koch) Date: Fri, 30 Jun 2023 16:31:29 +0200 Subject: [PATCH scute] Add configure enable argument to build tests In-Reply-To: <20230629234114.38bb2c5a@gentoo.home> (Jernej Jakob via Gnupg-devel's message of "Thu, 29 Jun 2023 23:41:41 +0200") References: <20230629234114.38bb2c5a@gentoo.home> Message-ID: <87cz1dggxq.fsf@wheatstone.g10code.de> Hi, please provide a description of your patch and why you need this. Also check doc/HACKING please. Shalom-Salam, Werner -- The pioneers of a warless world are the youth that refuse military service. - A. Einstein -------------- next part -------------- A non-text attachment was scrubbed... Name: openpgp-digital-signature.asc Type: application/pgp-signature Size: 227 bytes Desc: not available URL: From jernej.jakob at gmail.com Fri Jun 30 17:17:46 2023 From: jernej.jakob at gmail.com (Jernej Jakob) Date: Fri, 30 Jun 2023 17:17:46 +0200 Subject: [PATCH scute] Add configure enable argument to build tests In-Reply-To: <87cz1dggxq.fsf@wheatstone.g10code.de> References: <20230629234114.38bb2c5a@gentoo.home> <87cz1dggxq.fsf@wheatstone.g10code.de> Message-ID: <20230630171746.61a06019@gentoo.home> On Fri, 30 Jun 2023 16:31:29 +0200 Werner Koch wrote: > Hi, > > please provide a description of your patch and why you need this. Also > check doc/HACKING please. I've created a Gentoo ebuild for scute built from the latest master commit. Since Gentoo provides a boolean "test" USE flag the tests should not be built or run when that flag is off. When it's on they should be built and run of course. You can see my ebuild that includes the patch I sent here: https://github.com/jjakob/gentoo-overlay/blob/master/app-crypt/scute/scute-1.7.0_p20230424.ebuild Regarding doc/HACKING, I already read it before submitting the patches, is there a particular problem in them that I need to fix? > > > Shalom-Salam, > > Werner > -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 228 bytes Desc: OpenPGP digital signature URL: