[Announce] GnuPG 2.5.21 released (Werner Koch)

Tue Jul 14 00:30:31 CEST 2026

There appears to be a regression from 2.5.20: a decryption filename is passed when decrypting a file, which doesn't seem to preserve the file mode under some circumstances. The particular circumstance is that I call the decryption twice on the same input. The first time, I provide the entire input to be decrypted, and get a satisfactory response from gpg. The second call, to test a failure condition, makes the same call again, but doesn't provide the input data. In this case gpg returns an exit code of 2 (expected) but resets the file mode of the output file to 0100644, where it had originally been set to 0100700. Under 2.5.20, the mode of the file wasn't changed. So the behaviour has changed between 2.5.20 and 2.5.21: is there a good reason for this regression, or should an issue be raised? In case it is helpful, I show below some relevant messages from gpg and the test harness for both cases.
Kind regards,
Vinay Sajip
Results with 2.5.21:

# Issue --list-config to get version
gpg2 --status-fd 2 --no-tty --no-verbose --fixed-list-mode --batch --with-colons --homedir /tmp/keys-o279dt6b --list-config --with-colons
# Chunk read from gpg:
b'cfg:version:2.5.21\ncfg:pubkey:1;8;16;17;18;19;22\ncfg:pubkeyname:RSA;Kyber;ELG;DSA;ECDH;ECDSA;EDDSA\ncfg:cipher:1;2;3;4;7;8;9;10;11;12;13\ncfg:ciphername:IDEA;3DES;CAST5;BLOWFISH;AES;AES192;AES256;TWOFISH;CAMELLIA128;CAMELLIA192;CAMELLIA256\ncfg:digest:2;3;8;9'
# Set mode of output file to 0100700
# Print mode and filename
Setting mode to 0o100700
Decrypting to: '/tmp/pygpg-test-gi5r5i66.dec'
# First decryption call, all data provided
gpg2 --pinentry-mode loopback --status-fd 2 --no-tty --no-verbose --fixed-list-mode --batch --with-colons --homedir /tmp/keys-o279dt6b --passphrase-fd 0 --debug-quick-random --decrypt --yes --output /tmp/pygpg-test-gi5r5i66.dec
[GNUPG:] ENC_TO 5B4383C7F494798C 16 0
[GNUPG:] ENC_TO 855C4BBE6268DE68 16 0
[GNUPG:] KEY_CONSIDERED C374DE3046D96CDB36368AC34EA7B9009176963B 0
gpg: encrypted with elg2048 key, ID 855C4BBE6268DE68, created 2026-07-13
      "Barbara Brown (A test user (insecure!)) <barbara.brown at beta.com>"
[GNUPG:] KEY_CONSIDERED 2C671107DCCB8D91E3A1D7F42DFD6E3937922755 0
gpg: encrypted with elg2048 key, ID 5B4383C7F494798C, created 2026-07-13
      "Andrew Able (A test user (insecure!)) <andrew.able at alpha.com>"
[GNUPG:] KEY_CONSIDERED 2C671107DCCB8D91E3A1D7F42DFD6E3937922755 0
[GNUPG:] KEY_CONSIDERED C374DE3046D96CDB36368AC34EA7B9009176963B 0
[GNUPG:] KEY_CONSIDERED C374DE3046D96CDB36368AC34EA7B9009176963B 0
[GNUPG:] DECRYPTION_KEY 493F33691752246E2EB3CA24855C4BBE6268DE68 C374DE3046D96CDB36368AC34EA7B9009176963B u
[GNUPG:] NO_SECKEY 5B4383C7F494798C
[GNUPG:] BEGIN_DECRYPTION
[GNUPG:] DECRYPTION_INFO 0 9 2 0
[GNUPG:] PLAINTEXT 62 1783966624
[GNUPG:] PLAINTEXT_LENGTH 13
[GNUPG:] DECRYPTION_OKAY
[GNUPG:] GOODMDC
[GNUPG:] END_DECRYPTION
# Second decryption call, don't provide encrypted data (to test error condition)
gpg2 --pinentry-mode loopback --status-fd 2 --no-tty --no-verbose --fixed-list-mode --batch --with-colons --homedir /tmp/keys-o279dt6b --passphrase-fd 0 --debug-quick-random --decrypt --yes --output /tmp/pygpg-test-gi5r5i66.dec
[GNUPG:] NODATA 2
[GNUPG:] FAILURE decrypt 4294967295
gpg: decrypt_message failed: Unknown system error
# Message from test harness
gpg returned a non-zero error code: 2
# Mode of decryption output changed!
Mode changed for /tmp/pygpg-test-gi5r5i66.dec: 0o100664 vs. 0o100700

Results with 2.5.20:

# Issue --list-config to get version
gpg2 --status-fd 2 --no-tty --no-verbose --fixed-list-mode --batch --with-colons --homedir /tmp/keys-_cyzu8yh --list-config --with-colons
# Chunk read from gpg:
b'cfg:version:2.5.20\ncfg:pubkey:1;8;16;17;18;19;22\ncfg:pubkeyname:RSA;Kyber;ELG;DSA;ECDH;ECDSA;EDDSA\ncfg:cipher:1;2;3;4;7;8;9;10;11;12;13\ncfg:ciphername:IDEA;3DES;CAST5;BLOWFISH;AES;AES192;AES256;TWOFISH;CAMELLIA128;CAMELLIA192;CAMELLIA256\ncfg:digest:2;3;8;9'
# Set mode of output file to 0100700
# Print mode and filename
Setting mode to 0o100700
Decrypting to: '/tmp/pygpg-test-k9qni_nf.dec'
# First decryption call, all data provided
gpg2 --pinentry-mode loopback --status-fd 2 --no-tty --no-verbose --fixed-list-mode --batch --with-colons --homedir /tmp/keys-_cyzu8yh --passphrase-fd 0 --debug-quick-random --decrypt --yes --output /tmp/pygpg-test-k9qni_nf.dec
[GNUPG:] ENC_TO 7E265E8E78FAABE4 16 0
[GNUPG:] ENC_TO BC4907D9EA72A531 16 0
[GNUPG:] KEY_CONSIDERED 1B20FE90ADACD65EB49B83F92BA447C36E27A956 0
gpg: encrypted with elg2048 key, ID BC4907D9EA72A531, created 2026-07-13
      "Barbara Brown (A test user (insecure!)) <barbara.brown at beta.com>"
[GNUPG:] KEY_CONSIDERED 5B2F6F9C0E80D37C639FB4669941678A4D185900 0
gpg: encrypted with elg2048 key, ID 7E265E8E78FAABE4, created 2026-07-13
      "Andrew Able (A test user (insecure!)) <andrew.able at alpha.com>"
[GNUPG:] KEY_CONSIDERED 5B2F6F9C0E80D37C639FB4669941678A4D185900 0
[GNUPG:] KEY_CONSIDERED 1B20FE90ADACD65EB49B83F92BA447C36E27A956 0
[GNUPG:] KEY_CONSIDERED 1B20FE90ADACD65EB49B83F92BA447C36E27A956 0
[GNUPG:] DECRYPTION_KEY FAA65753EE4B871BCC824B6ABC4907D9EA72A531 1B20FE90ADACD65EB49B83F92BA447C36E27A956 u
[GNUPG:] NO_SECKEY 7E265E8E78FAABE4
[GNUPG:] BEGIN_DECRYPTION
[GNUPG:] DECRYPTION_INFO 0 9 2 0
[GNUPG:] PLAINTEXT 62 1783980806
[GNUPG:] PLAINTEXT_LENGTH 13
[GNUPG:] DECRYPTION_OKAY
[GNUPG:] GOODMDC
[GNUPG:] END_DECRYPTION
# Second decryption call, don't provide encrypted data (to test error condition)
gpg2 --pinentry-mode loopback --status-fd 2 --no-tty --no-verbose --fixed-list-mode --batch --with-colons --homedir /tmp/keys-_cyzu8yh --passphrase-fd 0 --debug-quick-random --decrypt --yes --output /tmp/pygpg-test-k9qni_nf.dec
[GNUPG:] NODATA 2
[GNUPG:] FAILURE decrypt 4294967295
# Message from test harness
gpg: decrypt_message failed: Unknown system error
# Message from test harness
gpg returned a non-zero error code: 2
# No more output, as mode didn't change.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20260713/a4efdf68/attachment.html>