[Announce] GnuPG 2.5.21 released (Werner Koch)

[Ingo Klöcker]

On Dienstag, 14. Juli 2026 00:30:31 Mitteleuropäische Sommerzeit Vinay Sajip 
via Gnupg-devel wrote:
> There appears to be a regression from 2.5.20: a decryption filename is
> passed when decrypting a file, which doesn't seem to preserve the file mode
> under some circumstances. The particular circumstance is that I call the
> decryption twice on the same input. The first time, I provide the entire
> input to be decrypted, and get a satisfactory response from gpg. The second
> call, to test a failure condition, makes the same call again, but doesn't
> provide the input data. In this case gpg returns an exit code of 2
> (expected) but resets the file mode of the output file to 0100644, where it
> had originally been set to 0100700. Under 2.5.20, the mode of the file
> wasn't changed. So the behaviour has changed between 2.5.20 and 2.5.21: is
> there a good reason for this regression, or should an issue be raised? In
> case it is helpful, I show below some relevant messages from gpg and the
> test harness for both cases.

This is probably a side-effect of this change in 2.5.21:
   - gpg, gpgsm: Use partial file on decryption, remove on failure.
     Disable with "--compatibility-flags=no-partial-file-guard".
     [T7873]

Check if running gpg with --compatibility-flags=no-partial-file-guard works for 
you.

Regards,
Ingo
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 265 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.gnupg.org/pipermail/gnupg-devel/attachments/20260714/4abd488d/attachment-0001.sig>