e04faea002
- Applied spec-cleaner
- Refreshed patches
- Update to version 2.2.8:
* gpg: Decryption of messages not using the MDC mode will now lead to a
hard failure even if a legacy cipher algorithm was used. The option
--ignore-mdc-error can be used to turn this failure into a warning. Take
care: Never use that option unconditionally or without a prior warning.
* gpg: The MDC encryption mode is now always used regardless of the
cipher algorithm or any preferences. For testing --rfc2440 can be
used to create a message without an MDC.
* gpg: Sanitize the diagnostic output of the original file name in
verbose mode.
* gpg: Detect suspicious multiple plaintext packets in a more reliable way.
* gpg: Fix the duplicate key signature detection code.
* gpg: The options --no-mdc-warn, --force-mdc, --no-force-mdc,
--disable-mdc and --no-disable-mdc have no more effect.
* agent: Add DBUS_SESSION_BUS_ADDRESS and a few other envvars to the
list of startup environment variables.
OBS-URL: https://build.opensuse.org/request/show/615233
OBS-URL: https://build.opensuse.org/package/show/Base:System/gpg2?expand=0&rev=198
69 lines
2.5 KiB
Diff
69 lines
2.5 KiB
Diff
---
|
|
doc/gpg.texi | 18 ++++++++++++++++++
|
|
g10/gpg.c | 9 +++++++++
|
|
2 files changed, 27 insertions(+)
|
|
|
|
Index: gnupg-2.2.8/doc/gpg.texi
|
|
===================================================================
|
|
--- gnupg-2.2.8.orig/doc/gpg.texi
|
|
+++ gnupg-2.2.8/doc/gpg.texi
|
|
@@ -2076,6 +2076,24 @@ implies, this option is for experts only
|
|
understand the implications of what it allows you to do, leave this
|
|
off. @option{--no-expert} disables this option.
|
|
|
|
+@item --set-legacy-fips
|
|
+@itemx --set-legacy-fips
|
|
+@opindex set-legacy-fips
|
|
+Enable legacy support even when the libgcrypt library is in FIPS 140-2
|
|
+mode. The legacy mode of libgcrypt allows the use of all ciphers,
|
|
+including non-approved ciphers. This mode is needed when for legacy
|
|
+reasons a message must be encrypted or decrypted. Legacy reasons for
|
|
+decryptions include the decryption of old messages created with a
|
|
+public key that use cipher settings which do not meet FIPS 140-2
|
|
+requirements. Legacy reasons for encryption include the encryption
|
|
+of messages with a recipients public key where the recipient is not
|
|
+bound to FIPS 140-2 regulation and therefore provided a key using
|
|
+non-approved ciphers. Although the legacy mode is a violation of strict
|
|
+FIPS 140-2 rule interpretations, it is wise to use this mode or
|
|
+either not being able to access old messages or not being able
|
|
+to create encrypted messages to a recipient that is not adhering
|
|
+to FIPS 140-2 rules.
|
|
+
|
|
@end table
|
|
|
|
|
|
Index: gnupg-2.2.8/g10/gpg.c
|
|
===================================================================
|
|
--- gnupg-2.2.8.orig/g10/gpg.c
|
|
+++ gnupg-2.2.8/g10/gpg.c
|
|
@@ -421,6 +421,7 @@ enum cmd_and_opt_values
|
|
oKeyOrigin,
|
|
oRequestOrigin,
|
|
oNoSymkeyCache,
|
|
+ oSetLegacyFips,
|
|
|
|
oNoop
|
|
};
|
|
@@ -864,6 +865,7 @@ static ARGPARSE_OPTS opts[] = {
|
|
ARGPARSE_s_n (oAllowMultipleMessages, "allow-multiple-messages", "@"),
|
|
ARGPARSE_s_n (oNoAllowMultipleMessages, "no-allow-multiple-messages", "@"),
|
|
ARGPARSE_s_n (oAllowWeakDigestAlgos, "allow-weak-digest-algos", "@"),
|
|
+ ARGPARSE_s_n (oSetLegacyFips, "set-legacy-fips", "@"),
|
|
|
|
ARGPARSE_s_s (oDefaultNewKeyAlgo, "default-new-key-algo", "@"),
|
|
|
|
@@ -3566,6 +3568,13 @@ main (int argc, char **argv)
|
|
opt.def_new_key_algo = pargs.r.ret_str;
|
|
break;
|
|
|
|
+ case oSetLegacyFips:
|
|
+ if(gcry_fips_mode_active())
|
|
+ gcry_control (GCRYCTL_INACTIVATE_FIPS_FLAG, "Enable legacy support in FIPS 140-2 mode");
|
|
+ else
|
|
+ log_info ("Command set-legacy-fips ignored as libgcrypt is not in FIPS mode\n");
|
|
+ break;
|
|
+
|
|
case oNoop: break;
|
|
|
|
default:
|