Accepting request 260826 from home:vitezslav_cizek:branches:Base:System
- upgrade to 2.1.0 (modern) - The file "secring.gpg" is not anymore used to store the secret keys. Merging of secret keys is now supported. - All support for PGP-2 keys has been removed for security reasons. - The standard key generation interface is now much leaner. This will help a new user to quickly generate a suitable key. - Support for Elliptic Curve Cryptography (ECC) is now available. - Commands to create and sign keys from the command line without any extra prompts are now available. - The Pinentry may now show the new passphrase entry and the passphrase confirmation entry in one dialog. - There is no more need to manually start the gpg-agent. It is now started by any part of GnuPG as needed. - Problems with importing keys with the same long key id have been addressed. - The Dirmngr is now part of GnuPG proper and also takes care of accessing keyserver. - Keyserver pools are now handled in a smarter way. - A new format for locally storing the public keys is now used. This considerable speeds up operations on large keyrings. - Revocation certificates are now created by default. - Card support has been updated, new readers and token types are supported. - The format of the key listing has been changed to better identify the properties of a key. - The gpg-agent may now be used on Windows as a Pageant replacement for Putty in the same way it is used for years on Unix as ssh-agent replacement. - Creation of X.509 certificates has been improved. It is now also possible to export them directly in PKCS#8 and PEM format for use OBS-URL: https://build.opensuse.org/request/show/260826 OBS-URL: https://build.opensuse.org/package/show/Base:System/gpg2?expand=0&rev=79
This commit is contained in:
parent
94e5edb36b
commit
b4e8b7fb1e
@ -4,11 +4,11 @@
|
||||
g10/sign.c | 66 +++++++++++++++++++++++++++++++++++++++++++++++++++++-----
|
||||
3 files changed, 66 insertions(+), 5 deletions(-)
|
||||
|
||||
Index: gnupg-2.0.23/g10/gpg.c
|
||||
Index: gnupg-2.1.0/g10/gpg.c
|
||||
===================================================================
|
||||
--- gnupg-2.0.23.orig/g10/gpg.c 2014-06-03 22:36:44.000000000 +0100
|
||||
+++ gnupg-2.0.23/g10/gpg.c 2014-06-03 22:36:55.000000000 +0100
|
||||
@@ -345,6 +345,7 @@ enum cmd_and_opt_values
|
||||
--- gnupg-2.1.0.orig/g10/gpg.c 2014-11-07 11:35:21.599605797 +0100
|
||||
+++ gnupg-2.1.0/g10/gpg.c 2014-11-07 16:50:14.742067262 +0100
|
||||
@@ -349,6 +349,7 @@ enum cmd_and_opt_values
|
||||
oTTYtype,
|
||||
oLCctype,
|
||||
oLCmessages,
|
||||
@ -16,35 +16,35 @@ Index: gnupg-2.0.23/g10/gpg.c
|
||||
oXauthority,
|
||||
oGroup,
|
||||
oUnGroup,
|
||||
@@ -711,6 +712,7 @@ static ARGPARSE_OPTS opts[] = {
|
||||
ARGPARSE_s_s (oPersonalDigestPreferences, "personal-digest-preferences","@"),
|
||||
@@ -733,6 +734,7 @@ static ARGPARSE_OPTS opts[] = {
|
||||
ARGPARSE_s_s (oPersonalCompressPreferences,
|
||||
"personal-compress-preferences", "@"),
|
||||
ARGPARSE_s_s (oFakedSystemTime, "faked-system-time", "@"),
|
||||
+ ARGPARSE_s_n (oFilesAreDigests, "files-are-digests", "@"),
|
||||
|
||||
/* Aliases. I constantly mistype these, and assume other people do
|
||||
as well. */
|
||||
@@ -2001,6 +2003,7 @@ main (int argc, char **argv)
|
||||
opt.def_sig_expire="0";
|
||||
opt.def_cert_expire="0";
|
||||
set_homedir ( default_homedir () );
|
||||
+ opt.files_are_digests=0;
|
||||
opt.passphrase_repeat=1;
|
||||
@@ -2126,6 +2128,7 @@ main (int argc, char **argv)
|
||||
opt.def_cert_expire = "0";
|
||||
set_homedir (default_homedir ());
|
||||
opt.passphrase_repeat = 1;
|
||||
+ opt.files_are_digests=0;
|
||||
opt.emit_version = 1; /* Limit to the major number. */
|
||||
|
||||
@@ -2491,6 +2494,7 @@ main (int argc, char **argv)
|
||||
/* Check whether we have a config file on the command line. */
|
||||
@@ -2630,6 +2633,7 @@ main (int argc, char **argv)
|
||||
opt.verify_options&=~VERIFY_SHOW_PHOTOS;
|
||||
break;
|
||||
case oPhotoViewer: opt.photo_viewer = pargs.r.ret_str; break;
|
||||
case oForceV3Sigs: opt.force_v3_sigs = 1; break;
|
||||
case oNoForceV3Sigs: opt.force_v3_sigs = 0; break;
|
||||
+ case oFilesAreDigests: opt.files_are_digests = 1; break;
|
||||
case oForceV4Certs: opt.force_v4_certs = 1; break;
|
||||
case oNoForceV4Certs: opt.force_v4_certs = 0; break;
|
||||
|
||||
case oForceMDC: opt.force_mdc = 1; break;
|
||||
Index: gnupg-2.0.23/g10/options.h
|
||||
case oNoForceMDC: opt.force_mdc = 0; break;
|
||||
Index: gnupg-2.1.0/g10/options.h
|
||||
===================================================================
|
||||
--- gnupg-2.0.23.orig/g10/options.h 2014-06-03 22:36:44.000000000 +0100
|
||||
+++ gnupg-2.0.23/g10/options.h 2014-06-03 22:36:55.000000000 +0100
|
||||
@@ -198,6 +198,7 @@ struct
|
||||
--- gnupg-2.1.0.orig/g10/options.h 2014-11-07 11:35:21.599605797 +0100
|
||||
+++ gnupg-2.1.0/g10/options.h 2014-11-07 16:49:59.770885017 +0100
|
||||
@@ -193,6 +193,7 @@ struct
|
||||
int no_auto_check_trustdb;
|
||||
int preserve_permissions;
|
||||
int no_homedir_creation;
|
||||
@ -52,24 +52,24 @@ Index: gnupg-2.0.23/g10/options.h
|
||||
struct groupitem *grouplist;
|
||||
int mangle_dos_filenames;
|
||||
int enable_progress_filter;
|
||||
Index: gnupg-2.0.23/g10/sign.c
|
||||
Index: gnupg-2.1.0/g10/sign.c
|
||||
===================================================================
|
||||
--- gnupg-2.0.23.orig/g10/sign.c 2014-06-03 22:36:44.000000000 +0100
|
||||
+++ gnupg-2.0.23/g10/sign.c 2014-06-03 22:36:55.000000000 +0100
|
||||
@@ -665,8 +665,12 @@ write_signature_packets (SK_LIST sk_list
|
||||
mk_notation_policy_etc (sig, NULL, sk);
|
||||
}
|
||||
--- gnupg-2.1.0.orig/g10/sign.c 2014-11-07 11:35:21.599605797 +0100
|
||||
+++ gnupg-2.1.0/g10/sign.c 2014-11-07 17:13:40.128218081 +0100
|
||||
@@ -703,8 +703,12 @@ write_signature_packets (SK_LIST sk_list
|
||||
build_sig_subpkt_from_sig (sig);
|
||||
mk_notation_policy_etc (sig, pk, NULL);
|
||||
|
||||
+ if (!opt.files_are_digests) {
|
||||
hash_sigversion_to_magic (md, sig);
|
||||
gcry_md_final (md);
|
||||
+ } else if (sig->version >= 4) {
|
||||
+ log_bug("files-are-digests doesn't work with v4 sigs\n");
|
||||
+ }
|
||||
+ if (!opt.files_are_digests) {
|
||||
hash_sigversion_to_magic (md, sig);
|
||||
gcry_md_final (md);
|
||||
+ } else if (sig->version >= 4) {
|
||||
+ log_bug("files-are-digests doesn't work with v4 sigs\n");
|
||||
+ }
|
||||
|
||||
rc = do_sign( sk, sig, md, hash_for (sk) );
|
||||
gcry_md_close (md);
|
||||
@@ -723,6 +727,8 @@ sign_file( strlist_t filenames, int deta
|
||||
rc = do_sign (pk, sig, md, hash_for (pk), cache_nonce);
|
||||
gcry_md_close (md);
|
||||
@@ -762,6 +766,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
|
||||
SK_LIST sk_rover = NULL;
|
||||
int multifile = 0;
|
||||
u32 duration=0;
|
||||
@ -78,7 +78,7 @@ Index: gnupg-2.0.23/g10/sign.c
|
||||
|
||||
pfx = new_progress_context ();
|
||||
afx = new_armor_context ();
|
||||
@@ -739,7 +745,16 @@ sign_file( strlist_t filenames, int deta
|
||||
@@ -778,7 +784,16 @@ sign_file (ctrl_t ctrl, strlist_t filena
|
||||
fname = NULL;
|
||||
|
||||
if( fname && filenames->next && (!detached || encryptflag) )
|
||||
@ -96,7 +96,7 @@ Index: gnupg-2.0.23/g10/sign.c
|
||||
|
||||
if(encryptflag==2
|
||||
&& (rc=setup_symkey(&efx.symkey_s2k,&efx.symkey_dek)))
|
||||
@@ -767,7 +782,7 @@ sign_file( strlist_t filenames, int deta
|
||||
@@ -799,7 +814,7 @@ sign_file (ctrl_t ctrl, strlist_t filena
|
||||
goto leave;
|
||||
|
||||
/* prepare iobufs */
|
||||
@ -105,16 +105,16 @@ Index: gnupg-2.0.23/g10/sign.c
|
||||
inp = NULL; /* we do it later */
|
||||
else {
|
||||
inp = iobuf_open(fname);
|
||||
@@ -900,7 +915,7 @@ sign_file( strlist_t filenames, int deta
|
||||
gcry_md_enable (mfx.md, hash_for(sk));
|
||||
}
|
||||
@@ -938,7 +953,7 @@ sign_file (ctrl_t ctrl, strlist_t filena
|
||||
for (sk_rover = sk_list; sk_rover; sk_rover = sk_rover->next)
|
||||
gcry_md_enable (mfx.md, hash_for (sk_rover->pk));
|
||||
|
||||
- if( !multifile )
|
||||
+ if( !multifile && !opt.files_are_digests )
|
||||
iobuf_push_filter( inp, md_filter, &mfx );
|
||||
|
||||
if( detached && !encryptflag && !RFC1991 )
|
||||
@@ -955,6 +970,8 @@ sign_file( strlist_t filenames, int deta
|
||||
if( detached && !encryptflag)
|
||||
@@ -993,6 +1008,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
|
||||
|
||||
write_status_begin_signing (mfx.md);
|
||||
|
||||
@ -123,7 +123,7 @@ Index: gnupg-2.0.23/g10/sign.c
|
||||
/* Setup the inner packet. */
|
||||
if( detached ) {
|
||||
if( multifile ) {
|
||||
@@ -995,6 +1012,45 @@ sign_file( strlist_t filenames, int deta
|
||||
@@ -1033,6 +1050,45 @@ sign_file (ctrl_t ctrl, strlist_t filena
|
||||
if( opt.verbose )
|
||||
putc( '\n', stderr );
|
||||
}
|
||||
@ -169,14 +169,14 @@ Index: gnupg-2.0.23/g10/sign.c
|
||||
else {
|
||||
/* read, so that the filter can calculate the digest */
|
||||
while( iobuf_get(inp) != -1 )
|
||||
@@ -1012,8 +1068,8 @@ sign_file( strlist_t filenames, int deta
|
||||
@@ -1050,8 +1106,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
|
||||
|
||||
/* write the signatures */
|
||||
rc = write_signature_packets (sk_list, out, mfx.md,
|
||||
- opt.textmode && !outfile? 0x01 : 0x00,
|
||||
- 0, duration, detached ? 'D':'S');
|
||||
- 0, duration, detached ? 'D':'S', NULL);
|
||||
+ sigclass,
|
||||
+ timestamp, duration, detached ? 'D':'S');
|
||||
+ timestamp, duration, detached ? 'D':'S', NULL);
|
||||
if( rc )
|
||||
goto leave;
|
||||
|
||||
|
@ -1,41 +0,0 @@
|
||||
diff -rup gnupg-2.0.18.orig/agent/gpg-agent.c gnupg-2.0.18/agent/gpg-agent.c
|
||||
--- gnupg-2.0.18.orig/agent/gpg-agent.c 2011-08-04 10:57:02.000000000 +0100
|
||||
+++ gnupg-2.0.18/agent/gpg-agent.c 2011-08-06 21:01:32.000000000 +0100
|
||||
@@ -1002,6 +1002,10 @@ main (int argc, char **argv )
|
||||
gnupg_fd_t fd_ssh;
|
||||
pid_t pid;
|
||||
|
||||
+ char *tmp1, *tmp;
|
||||
+ char *tmp2 = "gpg-XXXXXX/S.gpg-agent";
|
||||
+ size_t len;
|
||||
+
|
||||
/* Remove the DISPLAY variable so that a pinentry does not
|
||||
default to a specific display. There is still a default
|
||||
display when gpg-agent was started using --display or a
|
||||
@@ -1013,13 +1017,23 @@ main (int argc, char **argv )
|
||||
unsetenv ("DISPLAY");
|
||||
#endif
|
||||
|
||||
+ if ((tmp1 = getenv("TMPDIR")) == NULL)
|
||||
+ tmp1 = "/tmp";
|
||||
+
|
||||
+ len = strlen(tmp1) + strlen(tmp2) + 10;
|
||||
+ tmp = malloc(len);
|
||||
+
|
||||
+ snprintf(tmp, len, "%s%s%s", tmp1, tmp1 && strlen(tmp1) > 0 ? "/" : "", tmp2);
|
||||
|
||||
/* Create the sockets. */
|
||||
socket_name = create_socket_name
|
||||
- ("S.gpg-agent", "/tmp/gpg-XXXXXX/S.gpg-agent");
|
||||
- if (opt.ssh_support)
|
||||
+ ("S.gpg-agent", tmp);
|
||||
+ if (opt.ssh_support) {
|
||||
+ snprintf(tmp, len, "%s%s%s.ssh", tmp1, tmp1 && strlen(tmp1) > 0 ? "/" : "", tmp2);
|
||||
socket_name_ssh = create_socket_name
|
||||
- ("S.gpg-agent.ssh", "/tmp/gpg-XXXXXX/S.gpg-agent.ssh");
|
||||
+ ("S.gpg-agent.ssh", tmp);
|
||||
+ }
|
||||
+ free(tmp);
|
||||
|
||||
fd = create_server_socket (socket_name, 0, &socket_nonce);
|
||||
if (opt.ssh_support)
|
@ -1,13 +0,0 @@
|
||||
Index: gnupg-2.0.20/tests/openpgp/Makefile.am
|
||||
===================================================================
|
||||
--- gnupg-2.0.20.orig/tests/openpgp/Makefile.am
|
||||
+++ gnupg-2.0.20/tests/openpgp/Makefile.am
|
||||
@@ -25,7 +25,7 @@ required_pgms = ../../g10/gpg2 ../../age
|
||||
|
||||
|
||||
TESTS_ENVIRONMENT = GNUPGHOME=$(abs_builddir) GPG_AGENT_INFO= LC_ALL=C \
|
||||
- ../../agent/gpg-agent --quiet --daemon sh
|
||||
+ ../../agent/gpg-agent --quiet --daemon
|
||||
|
||||
|
||||
TESTS = version.test mds.test \
|
@ -1,8 +1,8 @@
|
||||
Index: tools/Makefile.am
|
||||
===================================================================
|
||||
--- tools/Makefile.am.orig
|
||||
+++ tools/Makefile.am
|
||||
@@ -32,8 +32,8 @@ sbin_SCRIPTS = addgnupghome applygnupgde
|
||||
--- tools/Makefile.am.orig 2014-11-06 18:12:17.743916141 +0100
|
||||
+++ tools/Makefile.am 2014-11-06 18:13:17.073677366 +0100
|
||||
@@ -36,8 +36,8 @@ sbin_SCRIPTS = addgnupghome applygnupgde
|
||||
|
||||
bin_SCRIPTS = gpgsm-gencert.sh
|
||||
if HAVE_USTAR
|
||||
@ -13,20 +13,21 @@ Index: tools/Makefile.am
|
||||
endif
|
||||
|
||||
if BUILD_SYMCRYPTRUN
|
||||
@@ -51,14 +51,14 @@ endif
|
||||
|
||||
bin_PROGRAMS = gpgconf gpg-connect-agent gpgkey2ssh ${symcryptrun} ${gpgtar}
|
||||
@@ -55,7 +55,7 @@ endif
|
||||
# Fixme: We should remove the gpgkey2ssh tool.
|
||||
bin_PROGRAMS = gpgconf gpg-connect-agent ${symcryptrun}
|
||||
if !HAVE_W32_SYSTEM
|
||||
-bin_PROGRAMS += watchgnupg gpgparsemail
|
||||
+bin_PROGRAMS += watchgnupg gpgparsemail gpgsplit
|
||||
endif
|
||||
|
||||
if !DISABLE_REGEX
|
||||
libexec_PROGRAMS = gpg-check-pattern
|
||||
if !HAVE_W32CE_SYSTEM
|
||||
bin_PROGRAMS += gpgkey2ssh ${gpgtar}
|
||||
@@ -66,7 +66,7 @@ libexec_PROGRAMS = gpg-check-pattern
|
||||
endif
|
||||
|
||||
if !HAVE_W32CE_SYSTEM
|
||||
-noinst_PROGRAMS = clean-sat mk-tdata make-dns-cert gpgsplit
|
||||
+noinst_PROGRAMS = clean-sat mk-tdata make-dns-cert
|
||||
endif
|
||||
|
||||
common_libs = $(libcommon) ../jnlib/libjnlib.a ../gl/libgnu.a
|
||||
pwquery_libs = ../common/libsimple-pwquery.a
|
||||
common_libs = $(libcommon) ../gl/libgnu.a
|
||||
|
@ -3,12 +3,12 @@
|
||||
# jnlib/utf8conv.c | 1 +
|
||||
# 1 file changed, 1 insertion(+)
|
||||
#
|
||||
Index: gnupg-2.0.21/jnlib/utf8conv.c
|
||||
Index: gnupg-2.1.0/common/utf8conv.c
|
||||
===================================================================
|
||||
--- gnupg-2.0.21.orig/jnlib/utf8conv.c 2013-08-19 09:55:30.000000000 +0100
|
||||
+++ gnupg-2.0.21/jnlib/utf8conv.c 2013-08-19 18:53:22.000000000 +0100
|
||||
@@ -148,6 +148,7 @@ set_native_charset (const char *newset)
|
||||
#else /*!HAVE_W32_SYSTEM*/
|
||||
--- gnupg-2.1.0.orig/common/utf8conv.c 2014-10-11 19:45:14.000000000 +0200
|
||||
+++ gnupg-2.1.0/common/utf8conv.c 2014-11-07 11:35:05.491413258 +0100
|
||||
@@ -198,6 +198,7 @@ set_native_charset (const char *newset)
|
||||
#else /*!HAVE_W32_SYSTEM && !HAVE_ANDROID_SYSTEM*/
|
||||
|
||||
#ifdef HAVE_LANGINFO_CODESET
|
||||
+ setlocale(LC_ALL, "");
|
||||
|
3
gnupg-2.1.0.tar.bz2
Normal file
3
gnupg-2.1.0.tar.bz2
Normal file
@ -0,0 +1,3 @@
|
||||
version https://git-lfs.github.com/spec/v1
|
||||
oid sha256:16a8c3f50a15bf37d2dfb1c5e4bb3ec533e1d0b6a4043ff3680a376a3ad4058b
|
||||
size 3111585
|
BIN
gnupg-2.1.0.tar.bz2.sig
Normal file
BIN
gnupg-2.1.0.tar.bz2.sig
Normal file
Binary file not shown.
@ -3,11 +3,11 @@
|
||||
g10/gpg.c | 9 +++++++++
|
||||
2 files changed, 27 insertions(+)
|
||||
|
||||
Index: gnupg-2.0.23/doc/gpg.texi
|
||||
Index: gnupg-2.1.0/doc/gpg.texi
|
||||
===================================================================
|
||||
--- gnupg-2.0.23.orig/doc/gpg.texi 2014-06-03 22:22:56.000000000 +0100
|
||||
+++ gnupg-2.0.23/doc/gpg.texi 2014-06-03 22:25:03.000000000 +0100
|
||||
@@ -1851,6 +1851,24 @@ implies, this option is for experts only
|
||||
--- gnupg-2.1.0.orig/doc/gpg.texi 2014-11-06 18:31:32.218688065 +0100
|
||||
+++ gnupg-2.1.0/doc/gpg.texi 2014-11-06 18:31:33.871709178 +0100
|
||||
@@ -1828,6 +1828,24 @@ implies, this option is for experts only
|
||||
understand the implications of what it allows you to do, leave this
|
||||
off. @option{--no-expert} disables this option.
|
||||
|
||||
@ -32,19 +32,19 @@ Index: gnupg-2.0.23/doc/gpg.texi
|
||||
@end table
|
||||
|
||||
|
||||
Index: gnupg-2.0.23/g10/gpg.c
|
||||
Index: gnupg-2.1.0/g10/gpg.c
|
||||
===================================================================
|
||||
--- gnupg-2.0.23.orig/g10/gpg.c 2014-06-03 22:24:52.000000000 +0100
|
||||
+++ gnupg-2.0.23/g10/gpg.c 2014-06-03 22:25:56.000000000 +0100
|
||||
@@ -369,6 +369,7 @@ enum cmd_and_opt_values
|
||||
oAllowMultipleMessages,
|
||||
--- gnupg-2.1.0.orig/g10/gpg.c 2014-11-06 18:31:32.220688090 +0100
|
||||
+++ gnupg-2.1.0/g10/gpg.c 2014-11-06 18:32:03.833091859 +0100
|
||||
@@ -380,6 +380,7 @@ enum cmd_and_opt_values
|
||||
oNoAllowMultipleMessages,
|
||||
oAllowWeakDigestAlgos,
|
||||
oFakedSystemTime,
|
||||
+ oSetLegacyFips,
|
||||
|
||||
oNoop
|
||||
};
|
||||
@@ -746,6 +747,7 @@ static ARGPARSE_OPTS opts[] = {
|
||||
@@ -772,6 +773,7 @@ static ARGPARSE_OPTS opts[] = {
|
||||
ARGPARSE_s_n (oAllowMultipleMessages, "allow-multiple-messages", "@"),
|
||||
ARGPARSE_s_n (oNoAllowMultipleMessages, "no-allow-multiple-messages", "@"),
|
||||
ARGPARSE_s_n (oAllowWeakDigestAlgos, "allow-weak-digest-algos", "@"),
|
||||
@ -52,8 +52,8 @@ Index: gnupg-2.0.23/g10/gpg.c
|
||||
|
||||
/* These two are aliases to help users of the PGP command line
|
||||
product use gpg with minimal pain. Many commands are common
|
||||
@@ -2959,6 +2961,13 @@ main (int argc, char **argv)
|
||||
opt.flags.allow_weak_digest_algos = 1;
|
||||
@@ -3138,6 +3140,13 @@ main (int argc, char **argv)
|
||||
}
|
||||
break;
|
||||
|
||||
+ case oSetLegacyFips:
|
||||
|
@ -1,37 +1,24 @@
|
||||
Index: gnupg-2.0.19/g10/encode.c
|
||||
Index: gnupg-2.1.0/g10/encrypt.c
|
||||
===================================================================
|
||||
--- gnupg-2.0.19.orig/g10/encode.c 2013-03-14 14:23:58.009483967 +0100
|
||||
+++ gnupg-2.0.19/g10/encode.c 2013-03-14 15:49:50.524306304 +0100
|
||||
@@ -732,7 +732,10 @@ encrypt_filter( void *opaque, int contro
|
||||
if( efx->cfx.dek->algo == -1 ) {
|
||||
/* because 3DES is implicitly in the prefs, this can only
|
||||
* happen if we do not have any public keys in the list */
|
||||
- efx->cfx.dek->algo = DEFAULT_CIPHER_ALGO;
|
||||
--- gnupg-2.1.0.orig/g10/encrypt.c 2014-11-06 18:27:35.176659675 +0100
|
||||
+++ gnupg-2.1.0/g10/encrypt.c 2014-11-06 18:29:10.987883901 +0100
|
||||
@@ -783,7 +783,10 @@ encrypt_filter (void *opaque, int contro
|
||||
/* Because 3DES is implicitly in the prefs, this can
|
||||
only happen if we do not have any public keys in
|
||||
the list. */
|
||||
- efx->cfx.dek->algo = DEFAULT_CIPHER_ALGO;
|
||||
+ /* Libgcrypt manual says that gcry_version_check must be called
|
||||
+ before calling gcry_fips_mode_active. */
|
||||
+ gcry_check_version (NULL);
|
||||
+ efx->cfx.dek->algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : DEFAULT_CIPHER_ALGO;
|
||||
}
|
||||
|
||||
/* In case 3DES has been selected, print a warning if
|
||||
Index: gnupg-2.0.19/g10/gpg.c
|
||||
/* In case 3DES has been selected, print a warning if
|
||||
Index: gnupg-2.1.0/g10/mainproc.c
|
||||
===================================================================
|
||||
--- gnupg-2.0.19.orig/g10/gpg.c 2013-03-14 14:24:00.031545611 +0100
|
||||
+++ gnupg-2.0.19/g10/gpg.c 2013-03-14 14:24:37.495687612 +0100
|
||||
@@ -1975,7 +1975,7 @@ main (int argc, char **argv)
|
||||
opt.compress_algo = -1; /* defaults to DEFAULT_COMPRESS_ALGO */
|
||||
opt.s2k_mode = 3; /* iterated+salted */
|
||||
opt.s2k_count = 0; /* Auto-calibrate when needed. */
|
||||
- opt.s2k_cipher_algo = CIPHER_ALGO_CAST5;
|
||||
+ opt.s2k_cipher_algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : CIPHER_ALGO_CAST5;
|
||||
opt.completes_needed = 1;
|
||||
opt.marginals_needed = 3;
|
||||
opt.max_cert_depth = 5;
|
||||
Index: gnupg-2.0.19/g10/mainproc.c
|
||||
===================================================================
|
||||
--- gnupg-2.0.19.orig/g10/mainproc.c 2013-03-14 14:23:58.011484028 +0100
|
||||
+++ gnupg-2.0.19/g10/mainproc.c 2013-03-14 15:50:50.970127383 +0100
|
||||
@@ -685,9 +685,15 @@ proc_plaintext( CTX c, PACKET *pkt )
|
||||
--- gnupg-2.1.0.orig/g10/mainproc.c 2014-11-06 18:27:33.243634973 +0100
|
||||
+++ gnupg-2.1.0/g10/mainproc.c 2014-11-06 18:27:35.178659700 +0100
|
||||
@@ -690,9 +690,15 @@ proc_plaintext( CTX c, PACKET *pkt )
|
||||
often. There is no good way to specify what algorithms to
|
||||
use in that case, so these three are the historical
|
||||
answer. */
|
||||
@ -47,5 +34,5 @@ Index: gnupg-2.0.19/g10/mainproc.c
|
||||
+ if( !gcry_fips_mode_active() )
|
||||
+ gcry_md_enable( c->mfx.md, DIGEST_ALGO_MD5 );
|
||||
}
|
||||
if( opt.pgp2_workarounds && only_md5 && !opt.skip_verify ) {
|
||||
/* This is a kludge to work around a bug in pgp2. It does only
|
||||
if (opt.pgp2_workarounds && only_md5 && !opt.skip_verify
|
||||
&& opt.flags.allow_weak_digest_algos) {
|
||||
|
@ -2,11 +2,11 @@
|
||||
g10/passphrase.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
Index: gnupg-2.0.23/g10/passphrase.c
|
||||
Index: gnupg-2.1.0/g10/passphrase.c
|
||||
===================================================================
|
||||
--- gnupg-2.0.23.orig/g10/passphrase.c 2014-06-03 07:59:18.000000000 +0100
|
||||
+++ gnupg-2.0.23/g10/passphrase.c 2014-06-03 22:37:30.000000000 +0100
|
||||
@@ -72,7 +72,7 @@ encode_s2k_iterations (int iterations)
|
||||
--- gnupg-2.1.0.orig/g10/passphrase.c 2014-11-07 16:52:11.080483153 +0100
|
||||
+++ gnupg-2.1.0/g10/passphrase.c 2014-11-07 16:52:11.996494299 +0100
|
||||
@@ -71,7 +71,7 @@ encode_s2k_iterations (int iterations)
|
||||
{
|
||||
/* Don't print an error if an older agent is used. */
|
||||
if (err && gpg_err_code (err) != GPG_ERR_ASS_PARAMETER)
|
||||
|
@ -1,14 +1,14 @@
|
||||
Index: gnupg-2.0.20/g10/plaintext.c
|
||||
Index: gnupg-2.1.0/g10/plaintext.c
|
||||
===================================================================
|
||||
--- gnupg-2.0.20.orig/g10/plaintext.c 2013-05-13 14:26:49.290737159 +0200
|
||||
+++ gnupg-2.0.20/g10/plaintext.c 2013-05-13 14:43:21.740575875 +0200
|
||||
--- gnupg-2.1.0.orig/g10/plaintext.c 2014-11-07 11:35:18.100563974 +0100
|
||||
+++ gnupg-2.1.0/g10/plaintext.c 2014-11-07 16:51:59.919347340 +0100
|
||||
@@ -25,6 +25,7 @@
|
||||
#include <errno.h>
|
||||
#include <assert.h>
|
||||
#include <sys/types.h>
|
||||
+#include <sys/stat.h>
|
||||
#ifdef HAVE_DOSISH_SYSTEM
|
||||
#include <fcntl.h> /* for setmode() */
|
||||
# include <fcntl.h> /* for setmode() */
|
||||
#endif
|
||||
@@ -39,6 +40,9 @@
|
||||
#include "status.h"
|
||||
@ -18,20 +18,21 @@ Index: gnupg-2.0.20/g10/plaintext.c
|
||||
+#define GPG_SAFE_PERMS (S_IRUSR | S_IWUSR)
|
||||
+#define GPG_SAFE_UMASK (0777 & ~GPG_SAFE_PERMS)
|
||||
|
||||
/****************
|
||||
* Handle a plaintext packet. If MFX is not NULL, update the MDs
|
||||
@@ -140,10 +144,15 @@ handle_plaintext( PKT_plaintext *pt, md_
|
||||
log_error(_("error creating `%s': %s\n"), fname, strerror(errno) );
|
||||
goto leave;
|
||||
}
|
||||
- else if( !(fp = fopen(fname,"wb")) ) {
|
||||
- rc = gpg_error_from_syserror ();
|
||||
- log_error(_("error creating `%s': %s\n"), fname, strerror(errno) );
|
||||
- goto leave;
|
||||
/* Handle a plaintext packet. If MFX is not NULL, update the MDs
|
||||
* Note: We should have used the filter stuff here, but we have to add
|
||||
@@ -169,11 +173,15 @@ handle_plaintext (PKT_plaintext * pt, md
|
||||
log_error (_("error creating '%s': %s\n"), fname, gpg_strerror (err));
|
||||
goto leave;
|
||||
}
|
||||
- else if (!(fp = es_fopen (fname, "wb")))
|
||||
- {
|
||||
- err = gpg_error_from_syserror ();
|
||||
- log_error (_("error creating '%s': %s\n"), fname, gpg_strerror (err));
|
||||
- goto leave;
|
||||
+ else {
|
||||
+ mode_t saved_umask = umask(GPG_SAFE_UMASK);
|
||||
+ if( !(fp = fopen(fname,"wb")) ) {
|
||||
+ rc = gpg_error_from_syserror ();
|
||||
+ if( !(fp = es_fopen(fname,"wb")) ) {
|
||||
+ err = gpg_error_from_syserror ();
|
||||
+ log_error(_("error creating `%s': %s\n"), fname, strerror(errno) );
|
||||
+ umask(saved_umask);
|
||||
+ goto leave;
|
||||
@ -39,4 +40,4 @@ Index: gnupg-2.0.20/g10/plaintext.c
|
||||
+ umask(saved_umask);
|
||||
}
|
||||
#else /* __riscos__ */
|
||||
/* If no output filename was given, i.e. we constructed it,
|
||||
/* If no output filename was given, i.e. we constructed it, convert
|
||||
|
40
gpg2.changes
40
gpg2.changes
@ -1,3 +1,43 @@
|
||||
-------------------------------------------------------------------
|
||||
Thu Nov 6 17:32:39 UTC 2014 - vcizek@suse.com
|
||||
|
||||
- upgrade to 2.1.0 (modern)
|
||||
- The file "secring.gpg" is not anymore used to store the secret
|
||||
keys. Merging of secret keys is now supported.
|
||||
- All support for PGP-2 keys has been removed for security reasons.
|
||||
- The standard key generation interface is now much leaner. This
|
||||
will help a new user to quickly generate a suitable key.
|
||||
- Support for Elliptic Curve Cryptography (ECC) is now available.
|
||||
- Commands to create and sign keys from the command line without any
|
||||
extra prompts are now available.
|
||||
- The Pinentry may now show the new passphrase entry and the
|
||||
passphrase confirmation entry in one dialog.
|
||||
- There is no more need to manually start the gpg-agent. It is now
|
||||
started by any part of GnuPG as needed.
|
||||
- Problems with importing keys with the same long key id have been
|
||||
addressed.
|
||||
- The Dirmngr is now part of GnuPG proper and also takes care of
|
||||
accessing keyserver.
|
||||
- Keyserver pools are now handled in a smarter way.
|
||||
- A new format for locally storing the public keys is now used.
|
||||
This considerable speeds up operations on large keyrings.
|
||||
- Revocation certificates are now created by default.
|
||||
- Card support has been updated, new readers and token types are
|
||||
supported.
|
||||
- The format of the key listing has been changed to better identify
|
||||
the properties of a key.
|
||||
- The gpg-agent may now be used on Windows as a Pageant replacement
|
||||
for Putty in the same way it is used for years on Unix as
|
||||
ssh-agent replacement.
|
||||
- Creation of X.509 certificates has been improved. It is now also
|
||||
possible to export them directly in PKCS#8 and PEM format for use
|
||||
on TLS servers.
|
||||
- dropped patches:
|
||||
* gnupg-2.0.20-automake113.diff
|
||||
* gnupg-2.0.18-tmpdir.diff (socket is created in homedir now)
|
||||
- refresh most of the remaining patches
|
||||
- added new BuildRequires: gnutls-devel, pkg-config, npth-devel
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Aug 12 20:19:45 UTC 2014 - andreas.stieger@gmx.de
|
||||
|
||||
|
26
gpg2.spec
26
gpg2.spec
@ -17,7 +17,7 @@
|
||||
|
||||
|
||||
Name: gpg2
|
||||
Version: 2.0.26
|
||||
Version: 2.1.0
|
||||
Release: 0
|
||||
BuildRequires: automake >= 1.10
|
||||
BuildRequires: expect
|
||||
@ -36,11 +36,14 @@ BuildRequires: makeinfo
|
||||
BuildRequires: openldap2-devel
|
||||
BuildRequires: readline-devel
|
||||
BuildRequires: zlib-devel
|
||||
%if 0%{?suse_version} >= 1120
|
||||
BuildRequires: libpth-devel >= 1.3.7
|
||||
%else
|
||||
BuildRequires: pth >= 1.3.7
|
||||
%endif
|
||||
#% if 0%{?suse_version} >= 1120
|
||||
#BuildRequires: libpth-devel >= 1.3.7
|
||||
#% else
|
||||
#BuildRequires: pth >= 1.3.7
|
||||
#% endif
|
||||
BuildRequires: gnutls-devel
|
||||
BuildRequires: npth-devel
|
||||
BuildRequires: pkg-config
|
||||
Url: http://www.gnupg.org/aegypten2/
|
||||
PreReq: %install_info_prereq
|
||||
Requires: dirmngr
|
||||
@ -59,7 +62,7 @@ Source: ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-%{version}.tar.bz2
|
||||
Source2: ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-%{version}.tar.bz2.sig
|
||||
# https://www.gnupg.org/signature_key.html
|
||||
Source3: %{name}.keyring
|
||||
Patch1: gnupg-2.0.18-tmpdir.diff
|
||||
#Patch1: gnupg-2.0.18-tmpdir.diff
|
||||
Patch2: gnupg-2.0.4-install_tools.diff
|
||||
Patch4: gnupg-2.0.9-langinfo.patch
|
||||
Patch5: gnupg-2.0.18-files-are-digests.patch
|
||||
@ -67,7 +70,7 @@ Patch6: gnupg-dont-fail-with-seahorse-agent.patch
|
||||
Patch8: gnupg-set_umask_before_open_outfile.patch
|
||||
Patch9: gnupg-detect_FIPS_mode.patch
|
||||
# PATCH-FIX-OPENSUSE coolo@suse.de -- automake 1.13 already includes $SHELL
|
||||
Patch10: gnupg-2.0.20-automake113.diff
|
||||
#Patch10: gnupg-2.0.20-automake113.diff
|
||||
Patch11: gnupg-add_legacy_FIPS_mode_option.patch
|
||||
|
||||
BuildRoot: %{_tmppath}/%{name}-%{version}-build
|
||||
@ -79,14 +82,14 @@ gpg-agent, and a keybox library.
|
||||
%lang_package
|
||||
%prep
|
||||
%setup -q -n gnupg-%version
|
||||
%patch1 -p1
|
||||
#%patch1 -p1
|
||||
%patch2
|
||||
%patch4 -p1
|
||||
%patch5 -p1
|
||||
%patch6 -p1
|
||||
%patch8 -p1
|
||||
%patch9 -p1
|
||||
%patch10 -p1
|
||||
#%patch10 -p1
|
||||
%patch11 -p1
|
||||
|
||||
%build
|
||||
@ -134,6 +137,7 @@ rm -rf $RPM_BUILD_ROOT/%_datadir/locale/en@{bold,}quot
|
||||
install -m 644 AUTHORS COPYING ChangeLog NEWS THANKS TODO doc/FAQ $RPM_BUILD_ROOT/%{_docdir}/%{name}
|
||||
# install scdaemon to %{_bindir} (bnc#863645)
|
||||
mv %{buildroot}%{_libdir}/scdaemon %{buildroot}%{_bindir}
|
||||
mv %{buildroot}%{_libdir}/dirmngr_ldap %{buildroot}%{_bindir}
|
||||
%find_lang gnupg2
|
||||
%if 0%{?suse_version} > 1020
|
||||
%fdupes %buildroot
|
||||
@ -142,8 +146,6 @@ mv %{buildroot}%{_libdir}/scdaemon %{buildroot}%{_bindir}
|
||||
%check
|
||||
%if ! 0%{?qemu_user_space_build}
|
||||
make check
|
||||
$RPM_BUILD_ROOT/usr/bin/gpgsplit -v -p pubsplit- --uncompress <tests/openpgp/pubring.gpg
|
||||
$RPM_BUILD_ROOT/usr/bin/gpgsplit -v -p secsplit- --secret-to-public --uncompress <tests/openpgp/secring.gpg
|
||||
%endif
|
||||
|
||||
%post
|
||||
|
Loading…
Reference in New Issue
Block a user