Marcus Meissner
0f5ef67105
- Rebased patches:
* gnupg-add_legacy_FIPS_mode_option.patch
- Removed patches (already upstream):
* gnupg-tests-Fix-tests-gpgme-for-in-source-tree-builds.patch
- Don't ship systemd examples, as they are removed from upstream
release tarball.
- Update to 2.4.1:
* If the ~/.gnupg directory does not exist, the keyboxd is now
automagically enabled.
* gpg: New option --add-desig-revoker.
* gpg: New option --assert-signer.
* gpg: New command --quick-add-adsk and other ADSK features.
* gpg: New list-option "show-unusable-sigs". Also show
"[self-signature]" instead of the user-id in key signature
listings.
* gpg: For symmetric encryption the default S2K hash is now SHA256.
* gpg: Detect already compressed data also when using a pipe. Also
detect JPEG and PNG file formats.
* gpg: New subcommand "openpgp" for --card-edit.
* gpgsm: Verification of detached signatures does now strip trailing
zeroes from the input if --assume-binary is used.
* gpgsm: Non-armored detached signature are now created without
using indefinite form length octets. This improves compatibility
with some PDF signature verification software.
* gpgtar: Emit progress status lines in create mode.
* dirmngr: The LDAP modifyTimestamp is now returned by some
keyserver commands.
* ssh: Allow specification of the order keys are presented to ssh.
See the man page entry for --enable-ssh-support.
* gpg: Make list-options "show-sig-subpackets" work again.
OBS-URL: https://build.opensuse.org/request/show/1083567
OBS-URL: https://build.opensuse.org/package/show/Base:System/gpg2?expand=0&rev=284
69 lines
2.5 KiB
Diff
69 lines
2.5 KiB
Diff
---
|
|
doc/gpg.texi | 18 ++++++++++++++++++
|
|
g10/gpg.c | 9 +++++++++
|
|
2 files changed, 27 insertions(+)
|
|
|
|
Index: gnupg-2.4.1/doc/gpg.texi
|
|
===================================================================
|
|
--- gnupg-2.4.1.orig/doc/gpg.texi
|
|
+++ gnupg-2.4.1/doc/gpg.texi
|
|
@@ -2285,6 +2285,24 @@ implies, this option is for experts only
|
|
understand the implications of what it allows you to do, leave this
|
|
off. @option{--no-expert} disables this option.
|
|
|
|
+@item --set-legacy-fips
|
|
+@itemx --set-legacy-fips
|
|
+@opindex set-legacy-fips
|
|
+Enable legacy support even when the libgcrypt library is in FIPS 140-2
|
|
+mode. The legacy mode of libgcrypt allows the use of all ciphers,
|
|
+including non-approved ciphers. This mode is needed when for legacy
|
|
+reasons a message must be encrypted or decrypted. Legacy reasons for
|
|
+decryptions include the decryption of old messages created with a
|
|
+public key that use cipher settings which do not meet FIPS 140-2
|
|
+requirements. Legacy reasons for encryption include the encryption
|
|
+of messages with a recipients public key where the recipient is not
|
|
+bound to FIPS 140-2 regulation and therefore provided a key using
|
|
+non-approved ciphers. Although the legacy mode is a violation of strict
|
|
+FIPS 140-2 rule interpretations, it is wise to use this mode or
|
|
+either not being able to access old messages or not being able
|
|
+to create encrypted messages to a recipient that is not adhering
|
|
+to FIPS 140-2 rules.
|
|
+
|
|
@end table
|
|
|
|
|
|
Index: gnupg-2.4.1/g10/gpg.c
|
|
===================================================================
|
|
--- gnupg-2.4.1.orig/g10/gpg.c
|
|
+++ gnupg-2.4.1/g10/gpg.c
|
|
@@ -444,6 +444,7 @@ enum cmd_and_opt_values
|
|
oForceSignKey,
|
|
oForbidGenKey,
|
|
oRequireCompliance,
|
|
+ oSetLegacyFips,
|
|
oCompatibilityFlags,
|
|
oAddDesigRevoker,
|
|
oAssertSigner,
|
|
@@ -978,6 +979,7 @@ static gpgrt_opt_t opts[] = {
|
|
ARGPARSE_s_s (oNoop, "personal-aead-preferences","@"),
|
|
ARGPARSE_s_n (oNoop, "rfc4880bis", "@"),
|
|
ARGPARSE_s_n (oNoop, "override-compliance-check", "@"),
|
|
+ ARGPARSE_s_n (oSetLegacyFips, "set-legacy-fips", "@"),
|
|
|
|
|
|
ARGPARSE_group (302, N_(
|
|
@@ -3743,6 +3745,13 @@ main (int argc, char **argv)
|
|
add_to_strlist (&opt.assert_signer_list, pargs.r.ret_str);
|
|
break;
|
|
|
|
+ case oSetLegacyFips:
|
|
+ if(gcry_fips_mode_active())
|
|
+ gcry_control (GCRYCTL_INACTIVATE_FIPS_FLAG,
|
|
+ "Enable legacy support in FIPS 140-2 mode");
|
|
+ else
|
|
+ log_info ("Command set-legacy-fips ignored as libgcrypt is not in FIPS mode\n");
|
|
+ break;
|
|
|
|
case oNoop: break;
|
|
|