Pedro Monreal Gonzalez
0b19f2992d
- GnuPG 2.3.1:
* The new configuration file common.conf is now used to enable
the use of the key database daemon with "use-keyboxd". Using
this option in gpg.conf and gpgsm.conf is supported for a
transitional period. See doc/example/common.conf for more.
* gpg: Force version 5 key creation for ed448 and cv448 algorithms.
* gpg: By default do not use the self-sigs-only option when
importing from an LDAP keyserver.
* gpg: Lookup a missing public key of the active card via LDAP.
* gpgsm: New command --show-certs.
* scd: Fix CCID driver for SCM SPR332/SPR532.
* scd: Further improvements for PKCS#15 cards.
* New configure option --with-tss to allow the selection of the
TSS library.
- Rebase patches:
* gnupg-add_legacy_FIPS_mode_option.patch
* gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch
* gnupg-dont-fail-with-seahorse-agent.patch
* gnupg-set_umask_before_open_outfile.patch
- GnuPG 2.3.0:
* A new experimental key database daemon is provided. To enable
it put "use-keyboxd" into gpg.conf and gpgsm.conf. Keys are stored
in a SQLite database and make key lookup much faster.
* New tool gpg-card as a flexible frontend for all types of
supported smartcards.
* New option --chuid for gpg, gpgsm, gpgconf, gpg-card, and
gpg-connect-agent.
* The gpg-wks-client tool is now installed under bin; a wrapper for
its old location at libexec is also installed.
OBS-URL: https://build.opensuse.org/request/show/899451
OBS-URL: https://build.opensuse.org/package/show/Base:System/gpg2?expand=0&rev=267
70 lines
2.5 KiB
Diff
70 lines
2.5 KiB
Diff
---
|
|
doc/gpg.texi | 18 ++++++++++++++++++
|
|
g10/gpg.c | 9 +++++++++
|
|
2 files changed, 27 insertions(+)
|
|
|
|
Index: gnupg-2.3.0/doc/gpg.texi
|
|
===================================================================
|
|
--- gnupg-2.3.0.orig/doc/gpg.texi
|
|
+++ gnupg-2.3.0/doc/gpg.texi
|
|
@@ -2178,6 +2178,24 @@ implies, this option is for experts only
|
|
understand the implications of what it allows you to do, leave this
|
|
off. @option{--no-expert} disables this option.
|
|
|
|
+@item --set-legacy-fips
|
|
+@itemx --set-legacy-fips
|
|
+@opindex set-legacy-fips
|
|
+Enable legacy support even when the libgcrypt library is in FIPS 140-2
|
|
+mode. The legacy mode of libgcrypt allows the use of all ciphers,
|
|
+including non-approved ciphers. This mode is needed when for legacy
|
|
+reasons a message must be encrypted or decrypted. Legacy reasons for
|
|
+decryptions include the decryption of old messages created with a
|
|
+public key that use cipher settings which do not meet FIPS 140-2
|
|
+requirements. Legacy reasons for encryption include the encryption
|
|
+of messages with a recipients public key where the recipient is not
|
|
+bound to FIPS 140-2 regulation and therefore provided a key using
|
|
+non-approved ciphers. Although the legacy mode is a violation of strict
|
|
+FIPS 140-2 rule interpretations, it is wise to use this mode or
|
|
+either not being able to access old messages or not being able
|
|
+to create encrypted messages to a recipient that is not adhering
|
|
+to FIPS 140-2 rules.
|
|
+
|
|
@end table
|
|
|
|
|
|
Index: gnupg-2.3.0/g10/gpg.c
|
|
===================================================================
|
|
--- gnupg-2.3.0.orig/g10/gpg.c
|
|
+++ gnupg-2.3.0/g10/gpg.c
|
|
@@ -437,6 +437,7 @@ enum cmd_and_opt_values
|
|
oNoIncludeKeyBlock,
|
|
oChUid,
|
|
oForceSignKey,
|
|
+ oSetLegacyFips,
|
|
|
|
oNoop
|
|
};
|
|
@@ -870,6 +871,7 @@ static gpgrt_opt_t opts[] = {
|
|
ARGPARSE_s_s (oAEADAlgo, "aead-algo", "@"),
|
|
ARGPARSE_s_s (oDigestAlgo, "digest-algo", "@"),
|
|
ARGPARSE_s_s (oCertDigestAlgo, "cert-digest-algo", "@"),
|
|
+ ARGPARSE_s_n (oSetLegacyFips, "set-legacy-fips", "@"),
|
|
|
|
|
|
ARGPARSE_header (NULL, N_("Options for unattended use")),
|
|
@@ -3688,6 +3690,14 @@ main (int argc, char **argv)
|
|
opt.flags.full_timestrings = 1;
|
|
break;
|
|
|
|
+ case oSetLegacyFips:
|
|
+ if(gcry_fips_mode_active())
|
|
+ gcry_control (GCRYCTL_INACTIVATE_FIPS_FLAG,
|
|
+ "Enable legacy support in FIPS 140-2 mode");
|
|
+ else
|
|
+ log_info ("Command set-legacy-fips ignored as libgcrypt is not in FIPS mode\n");
|
|
+ break;
|
|
+
|
|
case oNoop: break;
|
|
|
|
default:
|