Fix modes for systemd user services and sockets (#2513497)

Related: RHEL-166369

.gitignore

@@ -1,114 +1,4 @@
-gnupg-2.0.16.tar.bz2
-gnupg-2.0.16.tar.bz2.sig
-/gnupg-2.0.17.tar.bz2
-/gnupg-2.0.17.tar.bz2.sig
-/gnupg-2.0.18.tar.bz2
-/gnupg-2.0.18.tar.bz2.sig
-/gnupg-2.0.19.tar.bz2
-/gnupg-2.0.19.tar.bz2.sig
-/gnupg-2.0.20.tar.bz2
-/gnupg-2.0.20.tar.bz2.sig
-/gnupg-2.0.21.tar.bz2
-/gnupg-2.0.21.tar.bz2.sig
-/gnupg-2.0.22.tar.bz2
-/gnupg-2.0.22.tar.bz2.sig
-/gnupg-2.0.24.tar.bz2
-/gnupg-2.0.24.tar.bz2.sig
-/gnupg-2.0.25.tar.bz2
-/gnupg-2.0.25.tar.bz2.sig
-/gnupg-2.1.1.tar.bz2
-/gnupg-2.1.1.tar.bz2.sig
-/gnupg-2.1.2.tar.bz2
-/gnupg-2.1.2.tar.bz2.sig
-/gnupg-2.1.3.tar.bz2
-/gnupg-2.1.3.tar.bz2.sig
-/gnupg-2.1.4.tar.bz2
-/gnupg-2.1.4.tar.bz2.sig
-/gnupg-2.1.5.tar.bz2
-/gnupg-2.1.5.tar.bz2.sig
-/gnupg-2.1.6.tar.bz2
-/gnupg-2.1.6.tar.bz2.sig
-/gnupg-2.1.7.tar.bz2
-/gnupg-2.1.7.tar.bz2.sig
-/gnupg-2.1.8.tar.bz2
-/gnupg-2.1.8.tar.bz2.sig
-/gnupg-2.1.9.tar.bz2
-/gnupg-2.1.9.tar.bz2.sig
-/gnupg-2.1.10.tar.bz2
-/gnupg-2.1.10.tar.bz2.sig
-/gnupg-2.1.11.tar.bz2
-/gnupg-2.1.11.tar.bz2.sig
-/gnupg-2.1.12.tar.bz2
-/gnupg-2.1.12.tar.bz2.sig
-/gnupg-2.1.13.tar.bz2
-/gnupg-2.1.13.tar.bz2.sig
-/gnupg-2.1.16.tar.bz2
-/gnupg-2.1.16.tar.bz2.sig
-/gnupg-2.1.17.tar.bz2
-/gnupg-2.1.17.tar.bz2.sig
-/gnupg-2.1.18.tar.bz2
-/gnupg-2.1.18.tar.bz2.sig
-/gnupg-2.1.19.tar.bz2
-/gnupg-2.1.19.tar.bz2.sig
-/gnupg-2.1.20.tar.bz2
-/gnupg-2.1.20.tar.bz2.sig
-/gnupg-2.1.21.tar.bz2
-/gnupg-2.1.21.tar.bz2.sig
-/gnupg-2.1.22.tar.bz2
-/gnupg-2.1.22.tar.bz2.sig
-/gnupg-2.2.0.tar.bz2
-/gnupg-2.2.0.tar.bz2.sig
-/gnupg-2.2.1.tar.bz2
-/gnupg-2.2.1.tar.bz2.sig
-/gnupg-2.2.2.tar.bz2
-/gnupg-2.2.2.tar.bz2.sig
-/gnupg-2.2.3.tar.bz2
-/gnupg-2.2.3.tar.bz2.sig
-/gnupg-2.2.4.tar.bz2
-/gnupg-2.2.4.tar.bz2.sig
-/gnupg-2.2.5.tar.bz2
-/gnupg-2.2.5.tar.bz2.sig
-/gnupg-2.2.6.tar.bz2
-/gnupg-2.2.6.tar.bz2.sig
-/gnupg-2.2.8.tar.bz2
-/gnupg-2.2.8.tar.bz2.sig
-/gnupg-2.2.9.tar.bz2
-/gnupg-2.2.9.tar.bz2.sig
-/gnupg-2.2.11.tar.bz2
-/gnupg-2.2.11.tar.bz2.sig
-/gnupg-2.2.12.tar.bz2
-/gnupg-2.2.12.tar.bz2.sig
-/gnupg-2.2.13.tar.bz2
-/gnupg-2.2.13.tar.bz2.sig
-/gnupg-2.2.16.tar.bz2
-/gnupg-2.2.16.tar.bz2.sig
-/gnupg-2.2.17.tar.bz2
-/gnupg-2.2.17.tar.bz2.sig
-/gnupg-2.2.18.tar.bz2
-/gnupg-2.2.18.tar.bz2.sig
-/gnupg-2.2.19.tar.bz2
-/gnupg-2.2.19.tar.bz2.sig
-/gnupg-2.2.20.tar.bz2
-/gnupg-2.2.20.tar.bz2.sig
-/gnupg-2.2.21.tar.bz2
-/gnupg-2.2.21.tar.bz2.sig
-/gnupg-2.2.23.tar.bz2
-/gnupg-2.2.23.tar.bz2.sig
-/gnupg-2.2.24.tar.bz2
-/gnupg-2.2.24.tar.bz2.sig
-/gnupg-2.2.25.tar.bz2
-/gnupg-2.2.25.tar.bz2.sig
-/gnupg-2.2.26.tar.bz2
-/gnupg-2.2.26.tar.bz2.sig
-/gnupg-2.2.27.tar.bz2
-/gnupg-2.2.27.tar.bz2.sig
-/gnupg-2.3.0.tar.bz2
-/gnupg-2.3.0.tar.bz2.sig
-/gnupg-2.3.1.tar.bz2
-/gnupg-2.3.1.tar.bz2.sig
-/gnupg-2.3.2.tar.bz2
-/gnupg-2.3.2.tar.bz2.sig
-/gnupg-2.3.3.tar.bz2
-/gnupg-2.3.3.tar.bz2.sig
-/gnupg-2.3.4.tar.bz2
-/gnupg-2.3.4.tar.bz2.sig
+/*.rpm
+/gnupg-*.tar.bz*
+/gnupg-*/
+/results_gnupg2/

0002-gpg-accept-subkeys-with-a-good-revocation-but-no-sel.patch

@@ -1,3 +1,4 @@
+From ddf601b0b8dbc4119841f0a3d1a650966468eee2 Mon Sep 17 00:00:00 2001
 From: Vincent Breitmoser <look@my.amazin.horse>
 Date: Thu, 13 Jun 2019 21:27:43 +0200
 Subject: gpg: accept subkeys with a good revocation but no self-sig during
@@ -19,10 +20,10 @@ Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
  1 file changed, 1 insertion(+)
 
 diff --git a/g10/import.c b/g10/import.c
-index f9acf95..9217911 100644
+index dc0dc0d03..2b470ee21 100644
 --- a/g10/import.c
 +++ b/g10/import.c
-@@ -3602,6 +3602,7 @@ chk_self_sigs (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid, int *non_self)
+@@ -3888,6 +3888,7 @@ chk_self_sigs (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid, int *non_self)
                    /* It's valid, so is it newer? */
                    if (sig->timestamp >= rsdate)
                      {
@@ -30,3 +31,5 @@ index f9acf95..9217911 100644
                        if (rsnode)
                          {
                            /* Delete the last revocation sig since
+-- 
+2.43.0

0003-gpg-allow-import-of-previously-known-keys-even-witho.patch

@@ -1,3 +1,4 @@
+From 6a0b20b020d56ee020edff49cca617c45974e3d7 Mon Sep 17 00:00:00 2001
 From: Vincent Breitmoser <look@my.amazin.horse>
 Date: Thu, 13 Jun 2019 21:27:42 +0200
 Subject: gpg: allow import of previously known keys, even without UIDs
@@ -13,22 +14,22 @@ This fixes two of the three broken tests in import-incomplete.scm.
 GnuPG-Bug-id: 4393
 Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
 ---
- g10/import.c | 44 +++++++++++---------------------------------
- 1 file changed, 11 insertions(+), 33 deletions(-)
+ g10/import.c | 45 +++++++++++----------------------------------
+ 1 file changed, 11 insertions(+), 34 deletions(-)
 
 diff --git a/g10/import.c b/g10/import.c
-index 5d3162c..f9acf95 100644
+index 2b470ee21..b5a9b43ae 100644
 --- a/g10/import.c
 +++ b/g10/import.c
-@@ -1788,7 +1788,6 @@ import_one_real (ctrl_t ctrl,
-   size_t an;
+@@ -1996,7 +1996,6 @@ import_one_real (ctrl_t ctrl,
+   int non_self_or_utk = 0;
    char pkstrbuf[PUBKEY_STRING_SIZE];
    int merge_keys_done = 0;
 -  int any_filter = 0;
    KEYDB_HANDLE hd = NULL;
  
    if (r_valid)
-@@ -1825,14 +1824,6 @@ import_one_real (ctrl_t ctrl,
+@@ -2033,14 +2032,6 @@ import_one_real (ctrl_t ctrl,
        log_printf ("\n");
      }
  
@@ -43,12 +44,12 @@ index 5d3162c..f9acf95 100644
    if (screener && screener (keyblock, screener_arg))
      {
        log_error (_("key %s: %s\n"), keystr_from_pk (pk),
-@@ -1907,18 +1898,10 @@ import_one_real (ctrl_t ctrl,
+@@ -2122,18 +2113,10 @@ import_one_real (ctrl_t ctrl,
  	  }
      }
  
 -  /* Delete invalid parts and bail out if there are no user ids left.  */
--  if (!delete_inv_parts (ctrl, keyblock, keyid, options))
+-  if (!delete_inv_parts (ctrl, keyblock, keyid, options, otherrevsigs))
 -    {
 -      if (!silent)
 -        {
@@ -62,11 +63,11 @@ index 5d3162c..f9acf95 100644
 +  /* Delete invalid parts, and note if we have any valid ones left.
 +   * We will later abort import if this key is new but contains
 +   * no valid uids.  */
-+  delete_inv_parts (ctrl, keyblock, keyid, options);
++  delete_inv_parts (ctrl, keyblock, keyid, options, otherrevsigs);
  
    /* Get rid of deleted nodes.  */
    commit_kbnode (&keyblock);
-@@ -1927,24 +1911,11 @@ import_one_real (ctrl_t ctrl,
+@@ -2143,24 +2126,11 @@ import_one_real (ctrl_t ctrl,
      {
        apply_keep_uid_filter (ctrl, keyblock, import_filter.keep_uid);
        commit_kbnode (&keyblock);
@@ -91,7 +92,7 @@ index 5d3162c..f9acf95 100644
      }
  
    /* The keyblock is valid and ready for real import.  */
-@@ -2002,6 +1973,13 @@ import_one_real (ctrl_t ctrl,
+@@ -2219,6 +2189,13 @@ import_one_real (ctrl_t ctrl,
        err = 0;
        stats->skipped_new_keys++;
      }
@@ -105,3 +106,5 @@ index 5d3162c..f9acf95 100644
    else if (err)  /* Insert this key. */
      {
        /* Note: ERR can only be NO_PUBKEY or UNUSABLE_PUBKEY.  */
+-- 
+2.43.0

0004-tests-add-test-cases-for-import-without-uid.patch

@@ -1,3 +1,4 @@
+From 659ca2edbc01f11d997c5453987b0202810a5985 Mon Sep 17 00:00:00 2001
 From: Vincent Breitmoser <look@my.amazin.horse>
 Date: Thu, 13 Jun 2019 21:27:41 +0200
 Subject: tests: add test cases for import without uid
@@ -19,13 +20,13 @@ fix gpg so that the tests pass.
 GnuPG-Bug-id: 4393
 Signed-Off-By: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
 ---
- tests/openpgp/Makefile.am                          |  1 +
- tests/openpgp/import-incomplete.scm                | 68 ++++++++++++++++++++++
- .../import-incomplete/primary+revocation.asc       |  9 +++
- .../primary+subkey+sub-revocation.asc              | 10 ++++
- .../import-incomplete/primary+subkey+sub-sig.asc   | 10 ++++
- .../openpgp/import-incomplete/primary+uid-sig.asc  | 10 ++++
- tests/openpgp/import-incomplete/primary+uid.asc    | 10 ++++
+ tests/openpgp/Makefile.am                     |  1 +
+ tests/openpgp/import-incomplete.scm           | 68 +++++++++++++++++++
+ .../import-incomplete/primary+revocation.asc  |  9 +++
+ .../primary+subkey+sub-revocation.asc         | 10 +++
+ .../primary+subkey+sub-sig.asc                | 10 +++
+ .../import-incomplete/primary+uid-sig.asc     | 10 +++
+ .../openpgp/import-incomplete/primary+uid.asc | 10 +++
  7 files changed, 118 insertions(+)
  create mode 100755 tests/openpgp/import-incomplete.scm
  create mode 100644 tests/openpgp/import-incomplete/primary+revocation.asc
@@ -35,10 +36,10 @@ Signed-Off-By: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
  create mode 100644 tests/openpgp/import-incomplete/primary+uid.asc
 
 diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
-index f6014c9..6423da1 100644
+index 7998d2ab9..ea8207e28 100644
 --- a/tests/openpgp/Makefile.am
 +++ b/tests/openpgp/Makefile.am
-@@ -78,6 +78,7 @@ XTESTS = \
+@@ -81,6 +81,7 @@ XTESTS = \
  	gpgv-forged-keyring.scm \
  	armor.scm \
  	import.scm \
@@ -48,7 +49,7 @@ index f6014c9..6423da1 100644
  	4gb-packet.scm \
 diff --git a/tests/openpgp/import-incomplete.scm b/tests/openpgp/import-incomplete.scm
 new file mode 100755
-index 0000000..727a027
+index 000000000..727a027c6
 --- /dev/null
 +++ b/tests/openpgp/import-incomplete.scm
 @@ -0,0 +1,68 @@
@@ -122,7 +123,7 @@ index 0000000..727a027
 +
 diff --git a/tests/openpgp/import-incomplete/primary+revocation.asc b/tests/openpgp/import-incomplete/primary+revocation.asc
 new file mode 100644
-index 0000000..6b7b608
+index 000000000..6b7b60802
 --- /dev/null
 +++ b/tests/openpgp/import-incomplete/primary+revocation.asc
 @@ -0,0 +1,9 @@
@@ -137,7 +138,7 @@ index 0000000..6b7b608
 +-----END PGP PUBLIC KEY BLOCK-----
 diff --git a/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc b/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
 new file mode 100644
-index 0000000..83a51a5
+index 000000000..83a51a549
 --- /dev/null
 +++ b/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
 @@ -0,0 +1,10 @@
@@ -153,7 +154,7 @@ index 0000000..83a51a5
 +-----END PGP PUBLIC KEY BLOCK-----
 diff --git a/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc b/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
 new file mode 100644
-index 0000000..dc47a02
+index 000000000..dc47a02d8
 --- /dev/null
 +++ b/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
 @@ -0,0 +1,10 @@
@@ -169,7 +170,7 @@ index 0000000..dc47a02
 +-----END PGP PUBLIC KEY BLOCK-----
 diff --git a/tests/openpgp/import-incomplete/primary+uid-sig.asc b/tests/openpgp/import-incomplete/primary+uid-sig.asc
 new file mode 100644
-index 0000000..134607d
+index 000000000..134607d0e
 --- /dev/null
 +++ b/tests/openpgp/import-incomplete/primary+uid-sig.asc
 @@ -0,0 +1,10 @@
@@ -185,7 +186,7 @@ index 0000000..134607d
 +-----END PGP PUBLIC KEY BLOCK-----
 diff --git a/tests/openpgp/import-incomplete/primary+uid.asc b/tests/openpgp/import-incomplete/primary+uid.asc
 new file mode 100644
-index 0000000..055f300
+index 000000000..055f30086
 --- /dev/null
 +++ b/tests/openpgp/import-incomplete/primary+uid.asc
 @@ -0,0 +1,10 @@
@@ -199,3 +200,5 @@ index 0000000..055f300
 +kv2O1Jo0u9BL9RNNF+L0DM7rAFbfMAs=
 +=1eII
 +-----END PGP PUBLIC KEY BLOCK-----
+-- 
+2.43.0

0005-gpg-drop-import-clean-from-default-keyserver-import-.patch

@@ -0,0 +1,52 @@
+From 5b9854a16f5d8b288c33315113a02e17afc40614 Mon Sep 17 00:00:00 2001
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Mon, 15 Jul 2019 16:24:35 -0400
+Subject: gpg: drop import-clean from default keyserver import options
+
+* g10/gpg.c (main): drop IMPORT_CLEAN from the
+default opt.keyserver_options.import_options
+* doc/gpg.texi: reflect this change in the documentation
+
+Given that SELF_SIGS_ONLY is already set, it's not clear what
+additional benefit IMPORT_CLEAN provides.  Furthermore, IMPORT_CLEAN
+means that receiving an OpenPGP certificate from a keyserver will
+potentially delete data that is otherwise held in the local keyring,
+which is surprising to users who expect retrieval from the keyservers
+to be purely additive.
+
+GnuPG-Bug-Id: 4628
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ doc/gpg.texi | 2 +-
+ g10/gpg.c    | 3 +--
+ 2 files changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/doc/gpg.texi b/doc/gpg.texi
+index ec3492838..2a998ab3b 100644
+--- a/doc/gpg.texi
++++ b/doc/gpg.texi
+@@ -2176,7 +2176,7 @@ are available for all keyserver types, some common options are:
+ 
+ @end table
+ 
+-The default list of options is: "self-sigs-only, import-clean,
++The default list of options is: "self-sigs-only,
+ repair-keys, repair-pks-subkey-bug, export-attributes". However, if
+ the actual used source is an LDAP server "no-self-sigs-only" is
+ assumed unless "self-sigs-only" has been explicitly configured.
+diff --git a/g10/gpg.c b/g10/gpg.c
+index ff83d0bce..9fac3de54 100644
+--- a/g10/gpg.c
++++ b/g10/gpg.c
+@@ -2482,8 +2482,7 @@ main (int argc, char **argv)
+ 					    | IMPORT_REPAIR_PKS_SUBKEY_BUG
+                                             | IMPORT_SELF_SIGS_ONLY
+                                             | IMPORT_COLLAPSE_UIDS
+-                                            | IMPORT_COLLAPSE_SUBKEYS
+-                                            | IMPORT_CLEAN);
++                                            | IMPORT_COLLAPSE_SUBKEYS);
+     opt.keyserver_options.export_options = EXPORT_ATTRIBUTES;
+     opt.keyserver_options.options = 0;
+     opt.verify_options = (LIST_SHOW_UID_VALIDITY
+-- 
+2.43.0

0006-Do-not-use-OCB-mode-even-if-AEAD-OCB-key-preference-.patch

@@ -0,0 +1,49 @@
+From 6ee1c8b32582d78397acb00e20c92af1cfbe9249 Mon Sep 17 00:00:00 2001
+From: Andreas Metzler <ametzler@debian.org>
+Date: Thu, 9 May 2024 13:57:27 +0200
+Subject: Do not use OCB mode even if AEAD: OCB key preference is set.
+
+Origin: vendor
+Forwarded: not-needed
+Last-Update: 2024-05-09
+
+(overrideable with --force-ocb)
+---
+ g10/encrypt.c             | 6 ++++++
+ tests/openpgp/encrypt.scm | 2 +-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/g10/encrypt.c b/g10/encrypt.c
+index b335b9797..1ca89d946 100644
+--- a/g10/encrypt.c
++++ b/g10/encrypt.c
+@@ -358,6 +358,12 @@ use_aead (pk_list_t pk_list, int algo)
+         }
+       return AEAD_ALGO_OCB;
+     }
++  else
++    {
++    /* Ignore AEAD: OCB key preference unless --force-ocb is set. It is
++     * a LibrePGP feature.  */
++      return 0;
++    }
+ 
+   /* AEAD does only work with 128 bit cipher blocklength.  */
+   if (!can_use)
+diff --git a/tests/openpgp/encrypt.scm b/tests/openpgp/encrypt.scm
+index ef2f7b0bc..a44f5cad1 100755
+--- a/tests/openpgp/encrypt.scm
++++ b/tests/openpgp/encrypt.scm
+@@ -88,7 +88,7 @@
+  (lambda (source)
+    (tr:do
+     (tr:open source)
+-    (tr:gpgstatus "" `(--yes -e
++    (tr:gpgstatus "" `(--yes -e --force-ocb
+                        -r ,"patrice.lumumba"
+                        -r ,"mahsa.amini"))
+     (tr:call-with-content
+-- 
+2.43.0
+
+

0007-Revert-the-introduction-of-the-RFC4880bis-draft-into.patch

@@ -0,0 +1,201 @@
+From e8e778c6f5b82ed1364d0a123e89c6639bbaf452 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Thu, 9 Feb 2023 16:38:58 +0100
+Subject: Revert the introduction of the RFC4880bis draft into defaults
+
+This reverts commit 4583f4fe2 (gpg: Merge --rfc4880bis features into
+--gnupg, 2022-10-31).
+---
+ g10/gpg.c    | 35 ++++++++++++++++++++++++++++++++---
+ g10/keygen.c | 30 ++++++++++++++++++------------
+ 2 files changed, 50 insertions(+), 15 deletions(-)
+
+diff --git a/g10/gpg.c b/g10/gpg.c
+index 9fac3de54..25eb570ca 100644
+--- a/g10/gpg.c
++++ b/g10/gpg.c
+@@ -251,6 +251,7 @@ enum cmd_and_opt_values
+     oGnuPG,
+     oRFC2440,
+     oRFC4880,
++    oRFC4880bis,
+     oOpenPGP,
+     oPGP7,
+     oPGP8,
+@@ -643,6 +644,7 @@ static gpgrt_opt_t opts[] = {
+   ARGPARSE_s_n (oGnuPG, "no-pgp8", "@"),
+   ARGPARSE_s_n (oRFC2440, "rfc2440", "@"),
+   ARGPARSE_s_n (oRFC4880, "rfc4880", "@"),
++  ARGPARSE_s_n (oRFC4880bis, "rfc4880bis", "@"),
+   ARGPARSE_s_n (oOpenPGP, "openpgp", N_("use strict OpenPGP behavior")),
+   ARGPARSE_s_n (oPGP7, "pgp6", "@"),
+   ARGPARSE_s_n (oPGP7, "pgp7", "@"),
+@@ -991,7 +993,6 @@ static gpgrt_opt_t opts[] = {
+   ARGPARSE_s_n (oNoop, "no-allow-multiple-messages", "@"),
+   ARGPARSE_s_s (oNoop, "aead-algo", "@"),
+   ARGPARSE_s_s (oNoop, "personal-aead-preferences","@"),
+-  ARGPARSE_s_n (oNoop, "rfc4880bis", "@"),
+   ARGPARSE_s_n (oNoop, "override-compliance-check", "@"),
+ 
+ 
+@@ -2245,7 +2246,7 @@ static struct gnupg_compliance_option compliance_options[] =
+   {
+     { "gnupg",      oGnuPG },
+     { "openpgp",    oOpenPGP },
+-    { "rfc4880bis", oGnuPG },
++    { "rfc4880bis", oRFC4880bis },
+     { "rfc4880",    oRFC4880 },
+     { "rfc2440",    oRFC2440 },
+     { "pgp6",       oPGP7 },
+@@ -2261,8 +2262,28 @@ static struct gnupg_compliance_option compliance_options[] =
+ static void
+ set_compliance_option (enum cmd_and_opt_values option)
+ {
++  opt.flags.rfc4880bis = 0;  /* Clear because it is initially set.  */
++
+   switch (option)
+     {
++    case oRFC4880bis:
++      opt.flags.rfc4880bis = 1;
++      opt.compliance = CO_RFC4880;
++      opt.flags.dsa2 = 1;
++      opt.flags.require_cross_cert = 1;
++      opt.rfc2440_text = 0;
++      opt.allow_non_selfsigned_uid = 1;
++      opt.allow_freeform_uid = 1;
++      opt.escape_from = 1;
++      opt.not_dash_escaped = 0;
++      opt.def_cipher_algo = 0;
++      opt.def_digest_algo = 0;
++      opt.cert_digest_algo = 0;
++      opt.compress_algo = -1;
++      opt.s2k_mode = 3; /* iterated+salted */
++      opt.s2k_digest_algo = DIGEST_ALGO_SHA256;
++      opt.s2k_cipher_algo = CIPHER_ALGO_AES256;
++      break;
+     case oOpenPGP:
+     case oRFC4880:
+       /* This is effectively the same as RFC2440, but with
+@@ -2306,6 +2327,7 @@ set_compliance_option (enum cmd_and_opt_values option)
+     case oPGP8:  opt.compliance = CO_PGP8;  break;
+     case oGnuPG:
+       opt.compliance = CO_GNUPG;
++      opt.flags.rfc4880bis = 1;
+       break;
+ 
+     case oDE_VS:
+@@ -2508,6 +2530,7 @@ main (int argc, char **argv)
+     opt.emit_version = 0;
+     opt.weak_digests = NULL;
+     opt.compliance = CO_GNUPG;
++    opt.flags.rfc4880bis = 1;
+ 
+     /* Check special options given on the command line.  */
+     orig_argc = argc;
+@@ -3058,6 +3081,7 @@ main (int argc, char **argv)
+           case oOpenPGP:
+           case oRFC2440:
+           case oRFC4880:
++          case oRFC4880bis:
+           case oPGP7:
+           case oPGP8:
+           case oGnuPG:
+@@ -3939,6 +3963,11 @@ main (int argc, char **argv)
+     if( may_coredump && !opt.quiet )
+ 	log_info(_("WARNING: program may create a core file!\n"));
+ 
++    if (!opt.flags.rfc4880bis)
++      {
++        opt.mimemode = 0; /* This will use text mode instead.  */
++      }
++
+     if (eyes_only) {
+       if (opt.set_filename)
+ 	  log_info(_("WARNING: %s overrides %s\n"),
+@@ -4155,7 +4184,7 @@ main (int argc, char **argv)
+     /* Check our chosen algorithms against the list of legal
+        algorithms. */
+ 
+-    if(!GNUPG)
++    if(!GNUPG && !opt.flags.rfc4880bis)
+       {
+ 	const char *badalg=NULL;
+ 	preftype_t badtype=PREFTYPE_NONE;
+diff --git a/g10/keygen.c b/g10/keygen.c
+index a1143182c..a085d7559 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -421,7 +421,7 @@ keygen_set_std_prefs (const char *string,int personal)
+ 	      strcat(dummy_string,"S7 ");
+ 	    strcat(dummy_string,"S2 "); /* 3DES */
+ 
+-            if (!openpgp_aead_test_algo (AEAD_ALGO_OCB))
++            if (opt.flags.rfc4880bis && !openpgp_aead_test_algo (AEAD_ALGO_OCB))
+ 	      strcat(dummy_string,"A2 ");
+ 
+             if (personal)
+@@ -906,7 +906,7 @@ keygen_upd_std_prefs (PKT_signature *sig, void *opaque)
+   /* Make sure that the MDC feature flag is set if needed.  */
+   add_feature_mdc (sig,mdc_available);
+   add_feature_aead (sig, aead_available);
+-  add_feature_v5 (sig, 1);
++  add_feature_v5 (sig, opt.flags.rfc4880bis);
+   add_keyserver_modify (sig,ks_modify);
+   keygen_add_keyserver_url(sig,NULL);
+ 
+@@ -3597,7 +3597,10 @@ parse_key_parameter_part (ctrl_t ctrl,
+                 }
+             }
+           else if (!ascii_strcasecmp (s, "v5"))
+-            keyversion = 5;
++            {
++              if (opt.flags.rfc4880bis)
++                keyversion = 5;
++            }
+           else if (!ascii_strcasecmp (s, "v4"))
+             keyversion = 4;
+           else
+@@ -3856,7 +3859,7 @@ parse_key_parameter_part (ctrl_t ctrl,
+  *   ecdsa := Use algorithm ECDSA.
+  *   eddsa := Use algorithm EdDSA.
+  *   ecdh  := Use algorithm ECDH.
+- *   v5    := Create version 5 key
++ *   v5    := Create version 5 key (requires option --rfc4880bis)
+  *
+  * There are several defaults and fallbacks depending on the
+  * algorithm.  PART can be used to select which part of STRING is
+@@ -4825,9 +4828,9 @@ read_parameter_file (ctrl_t ctrl, const char *fname )
+ 	    }
+ 	}
+ 
+-        if ((keywords[i].key == pVERSION
+-             || keywords[i].key == pSUBVERSION))
+-          ; /* Ignore version.  */
++        if (!opt.flags.rfc4880bis && (keywords[i].key == pVERSION
++                                      || keywords[i].key == pSUBVERSION))
++          ; /* Ignore version unless --rfc4880bis is active.  */
+         else
+           {
+             r = xmalloc_clear( sizeof *r + strlen( value ) );
+@@ -4922,11 +4925,14 @@ quickgen_set_para (struct para_data_s *para, int for_subkey,
+       para = r;
+     }
+ 
+-  r = xmalloc_clear (sizeof *r + 20);
+-  r->key = for_subkey? pSUBVERSION : pVERSION;
+-  snprintf (r->u.value, 20, "%d", version);
+-  r->next = para;
+-  para = r;
++  if (opt.flags.rfc4880bis)
++    {
++      r = xmalloc_clear (sizeof *r + 20);
++      r->key = for_subkey? pSUBVERSION : pVERSION;
++      snprintf (r->u.value, 20, "%d", version);
++      r->next = para;
++      para = r;
++    }
+ 
+   if (keytime)
+     {
+-- 
+2.43.0

0008-avoid-systemd-deprecation-warning.patch

@@ -0,0 +1,40 @@
+From 241db54dcd6ce4b32e3298d49195965757e6d3ef Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Mon, 21 Aug 2023 14:22:50 +0900
+Subject: avoid-systemd-deprecation-warning
+
+---
+ agent/gpg-agent.c | 3 ---
+ dirmngr/dirmngr.c | 3 ---
+ 2 files changed, 6 deletions(-)
+
+diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
+index c4b281d63..8bcd496bf 100644
+--- a/agent/gpg-agent.c
++++ b/agent/gpg-agent.c
+@@ -1399,9 +1399,6 @@ main (int argc, char **argv)
+       agent_exit (0);
+     }
+ 
+-  if (is_supervised && !opt.quiet)
+-    log_info(_("WARNING: \"%s\" is a deprecated option\n"), "--supervised");
+-
+   if (is_supervised)
+     ;
+   else if (!opt.extra_socket)
+diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
+index f79a0f877..755572d6e 100644
+--- a/dirmngr/dirmngr.c
++++ b/dirmngr/dirmngr.c
+@@ -1332,9 +1332,6 @@ main (int argc, char **argv)
+     {
+       struct stat statbuf;
+ 
+-      if (!opt.quiet)
+-        log_info(_("WARNING: \"%s\" is a deprecated option\n"), "--supervised");
+-
+       /* In supervised mode, we expect file descriptor 3 to be an
+          already opened, listening socket.
+ 
+-- 
+2.43.0

0009-Add-systemd-support-for-keyboxd.patch

@@ -0,0 +1,145 @@
+From f0cac7a8493a3953d209f9a76fdb2564214c6e87 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Wed, 23 Aug 2023 09:26:51 +0900
+Subject: Add systemd support for keyboxd
+
+---
+ kbx/keyboxd.c | 79 +++++++++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 77 insertions(+), 2 deletions(-)
+
+diff --git a/kbx/keyboxd.c b/kbx/keyboxd.c
+index f875e115d..55e42bcdf 100644
+--- a/kbx/keyboxd.c
++++ b/kbx/keyboxd.c
+@@ -88,6 +88,7 @@ enum cmd_and_opt_values
+     oLogFile,
+     oServer,
+     oDaemon,
++    oSupervised,
+     oFakedSystemTime,
+     oListenBacklog,
+     oDisableCheckOwnSocket,
+@@ -104,6 +105,9 @@ static gpgrt_opt_t opts[] = {
+ 
+   ARGPARSE_s_n (oDaemon,  "daemon", N_("run in daemon mode (background)")),
+   ARGPARSE_s_n (oServer,  "server", N_("run in server mode (foreground)")),
++#ifndef HAVE_W32_SYSTEM
++  ARGPARSE_s_n (oSupervised,  "supervised", "@"),
++#endif
+   ARGPARSE_s_n (oNoDetach,  "no-detach", N_("do not detach from the console")),
+   ARGPARSE_s_n (oStealSocket, "steal-socket", "@"),
+   ARGPARSE_s_s (oHomedir,    "homedir",      "@"),
+@@ -209,6 +213,9 @@ static int have_homedir_inotify;
+  * reliable.  */
+ static int reliable_homedir_inotify;
+ 
++/* Flag indicating that we are in supervised mode.  */
++static int is_supervised;
++
+ /* Number of active connections.  */
+ static int active_connections;
+ 
+@@ -575,6 +582,7 @@ main (int argc, char **argv )
+         case oLogFile: logfile = pargs.r.ret_str; break;
+         case oServer: pipe_server = 1; break;
+         case oDaemon: is_daemon = 1; break;
++        case oSupervised: is_supervised = 1; break;
+         case oFakedSystemTime:
+           {
+             time_t faked_time = isotime2epoch (pargs.r.ret_str);
+@@ -643,7 +651,7 @@ main (int argc, char **argv )
+   bind_textdomain_codeset (PACKAGE_GT, "UTF-8");
+ #endif
+ 
+-  if (!pipe_server && !is_daemon && !gpgconf_list)
++  if (!pipe_server && !is_daemon && !gpgconf_list && !is_supervised)
+     {
+      /* We have been called without any command and thus we merely
+       * check whether an instance of us is already running.  We do
+@@ -716,6 +724,73 @@ main (int argc, char **argv )
+       kbxd_deinit_default_ctrl (ctrl);
+       xfree (ctrl);
+     }
++  else if (is_supervised && comopt.no_autostart)
++    {
++      log_info ("%s %s not starting in supervised mode due to no-autostart.\n",
++                gpgrt_strusage(11), gpgrt_strusage(13) );
++    }
++  else if (is_supervised)
++    {
++#ifndef HAVE_W32_SYSTEM
++      struct stat statbuf;
++
++      inhibit_socket_removal = 1;
++
++      /* In supervised mode, we expect file descriptor 3 to be an
++         already opened, listening socket.
++
++         We will also not detach from the controlling process or close
++         stderr; the supervisor should handle all of that.  */
++      if (fstat (3, &statbuf) == -1 && errno == EBADF)
++        {
++          log_error ("file descriptor 3 must be validin --supervised mode\n");
++          kbxd_exit (1);
++        }
++      socket_name = gnupg_get_socket_name (3);
++
++      /* when supervised and sending logs to stderr, the process
++         supervisor should handle log entry metadata (pid, name,
++         timestamp) */
++      if (!logfile)
++        log_set_prefix (NULL, 0);
++
++      initialize_modules ();
++
++      log_info ("%s %s starting in supervised mode.\n",
++                gpgrt_strusage(11), gpgrt_strusage(13) );
++
++#ifdef HAVE_SIGPROCMASK
++      if (startup_signal_mask_valid)
++        {
++          if (sigprocmask (SIG_SETMASK, &startup_signal_mask, NULL))
++            log_error ("error restoring signal mask: %s\n",
++                       strerror (errno));
++        }
++      else
++        log_info ("no saved signal mask\n");
++#endif /*HAVE_SIGPROCMASK*/
++
++      {
++        ctrl_t ctrl;
++
++        ctrl = xtrycalloc (1, sizeof *ctrl);
++        if (!ctrl)
++          {
++            log_error ("error allocating connection control data: %s\n",
++                       strerror (errno) );
++            kbxd_exit (1);
++          }
++        kbxd_init_default_ctrl (ctrl);
++        /* kbxd_set_database (ctrl, "pubring.kbx", 0); */
++        kbxd_set_database (ctrl, "pubring.db", 0);
++        kbxd_deinit_default_ctrl (ctrl);
++        xfree (ctrl);
++      }
++
++      handle_connections (3);
++      assuan_sock_close (3);
++#endif /*!HAVE_W32_SYSTEM*/
++    }
+   else if (!is_daemon)
+     ; /* NOTREACHED */
+   else
+@@ -1546,7 +1621,7 @@ handle_connections (gnupg_fd_t listen_fd)
+       /* Shutdown test.  */
+       if (shutdown_pending)
+         {
+-          if (!active_connections)
++          if (!active_connections || is_supervised)
+             break; /* ready */
+ 
+           /* Do not accept new connections but keep on running the
+-- 
+2.43.0
+
+

0010-Ship-sample-systemd-unit-files.patch

@@ -0,0 +1,268 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Mon, 23 Jan 2023 16:34:19 +0100
+Subject: Ship sample systemd unit files
+
+This reverts the systemd-relevant parts of upstream's
+eae28f1bd4a5632e8f8e85b7248d1c4d4a10a5ed
+
+In that commit, Werner Koch wrote:
+
+> The use of systemd is deprecated because of additional complexity
+> and the race between systemd based autolaunching and the explicit
+> gnupg based and lockfile protected autolaunching.
+
+FreePG aims to support socket-activated systemd integration for modern
+Gnu/Linux systems that use GnuPG.  That integration does not appear to
+actually have the race condition posited by Werner above, as described
+by Coelacanthus in https://dev.gnupg.org/T6336#171407
+
+GnuPG-bug-id: 6336
+---
+ doc/Makefile.am                               |  8 +++
+ doc/examples/README                           |  2 +
+ doc/examples/systemd-user/README              | 66 +++++++++++++++++++
+ doc/examples/systemd-user/dirmngr.service     |  8 +++
+ doc/examples/systemd-user/dirmngr.socket      | 11 ++++
+ .../systemd-user/gpg-agent-browser.socket     | 13 ++++
+ .../systemd-user/gpg-agent-extra.socket       | 13 ++++
+ .../systemd-user/gpg-agent-ssh.socket         | 13 ++++
+ doc/examples/systemd-user/gpg-agent.service   |  8 +++
+ doc/examples/systemd-user/gpg-agent.socket    | 12 ++++
+ 10 files changed, 154 insertions(+), 0 deletions(-)
+ create mode 100644 doc/examples/systemd-user/README
+ create mode 100644 doc/examples/systemd-user/dirmngr.service
+ create mode 100644 doc/examples/systemd-user/dirmngr.socket
+ create mode 100644 doc/examples/systemd-user/gpg-agent-browser.socket
+ create mode 100644 doc/examples/systemd-user/gpg-agent-extra.socket
+ create mode 100644 doc/examples/systemd-user/gpg-agent-ssh.socket
+ create mode 100644 doc/examples/systemd-user/gpg-agent.service
+ create mode 100644 doc/examples/systemd-user/gpg-agent.socket
+
+diff --git a/doc/Makefile.am b/doc/Makefile.am
+index de032bffc..c0e3786e1 100644
+--- a/doc/Makefile.am
++++ b/doc/Makefile.am
+@@ -25,6 +25,14 @@ examples = examples/README examples/scd-event examples/trustlist.txt	\
+            examples/qualified.txt                                       \
+ 	   examples/common.conf                                         \
+            examples/gpgconf.rnames examples/gpgconf.conf                \
++	   examples/systemd-user/README 				\
++	   examples/systemd-user/dirmngr.service 			\
++	   examples/systemd-user/dirmngr.socket				\
++	   examples/systemd-user/gpg-agent.service 			\
++	   examples/systemd-user/gpg-agent.socket 			\
++	   examples/systemd-user/gpg-agent-ssh.socket 			\
++	   examples/systemd-user/gpg-agent-browser.socket		\
++	   examples/systemd-user/gpg-agent-extra.socket 		\
+ 	   examples/pwpattern.list
+ 
+ helpfiles = help.txt help.be.txt help.ca.txt help.cs.txt		\
+diff --git a/doc/examples/README b/doc/examples/README
+index cd341ab57..67508c471 100644
+--- a/doc/examples/README
++++ b/doc/examples/README
+@@ -8,6 +8,8 @@ trustlist.txt   A list of trustworthy root certificates
+ 
+ gpgconf.conf    A sample configuration file for gpgconf.
+ 
++systemd-user    Sample files for a Linux-only init system.
++
+ qualified.txt   Sample file for qualified.txt.
+ 
+ common.conf     Sample file for common options.
+diff --git a/doc/examples/systemd-user/README b/doc/examples/systemd-user/README
+new file mode 100644
+index 000000000..43122f568
+--- /dev/null
++++ b/doc/examples/systemd-user/README
+@@ -0,0 +1,66 @@
++Socket-activated dirmngr and gpg-agent with systemd
++===================================================
++
++When used on a GNU/Linux system supervised by systemd, you can ensure
++that the GnuPG daemons dirmngr and gpg-agent are launched
++automatically the first time they're needed, and shut down cleanly at
++session logout.  This is done by enabling user services via
++socket-activation.
++
++System distributors
++-------------------
++
++The *.service and *.socket files (from this directory) should be
++placed in /usr/lib/systemd/user/ alongside other user-session services
++and sockets.
++
++To enable socket-activated dirmngr for all accounts on the system,
++use:
++
++    systemctl --user --global enable dirmngr.socket
++
++To enable socket-activated gpg-agent for all accounts on the system,
++use:
++
++    systemctl --user --global enable gpg-agent.socket
++
++Additionally, you can enable socket-activated gpg-agent ssh-agent
++emulation for all accounts on the system with:
++
++    systemctl --user --global enable gpg-agent-ssh.socket
++
++You can also enable restricted ("--extra-socket"-style) gpg-agent
++sockets for all accounts on the system with:
++
++    systemctl --user --global enable gpg-agent-extra.socket
++
++Individual users
++----------------
++
++A user on a system with systemd where this has not been installed
++system-wide can place these files in ~/.config/systemd/user/ to make
++them available.
++
++If a given service isn't installed system-wide, or if it's installed
++system-wide but not globally enabled, individual users will still need
++to enable them.  For example, to enable socket-activated dirmngr for
++all future sessions:
++
++    systemctl --user enable dirmngr.socket
++
++To enable socket-activated gpg-agent with ssh support, do:
++
++    systemctl --user enable gpg-agent.socket gpg-agent-ssh.socket
++
++These changes won't take effect until your next login after you've
++fully logged out (be sure to terminate any running daemons before
++logging out).
++
++If you'd rather try a socket-activated GnuPG daemon in an
++already-running session without logging out (with or without enabling
++it for all future sessions), kill any existing daemon and start the
++user socket directly.  For example, to set up socket-activated dirmgnr
++in the current session:
++
++    gpgconf --kill dirmngr
++    systemctl --user start dirmngr.socket
+diff --git a/doc/examples/systemd-user/dirmngr.service b/doc/examples/systemd-user/dirmngr.service
+new file mode 100644
+index 000000000..3c060cde5
+--- /dev/null
++++ b/doc/examples/systemd-user/dirmngr.service
+@@ -0,0 +1,8 @@
++[Unit]
++Description=GnuPG network certificate management daemon
++Documentation=man:dirmngr(8)
++Requires=dirmngr.socket
++
++[Service]
++ExecStart=/usr/bin/dirmngr --supervised
++ExecReload=/usr/bin/gpgconf --reload dirmngr
+diff --git a/doc/examples/systemd-user/dirmngr.socket b/doc/examples/systemd-user/dirmngr.socket
+new file mode 100644
+index 000000000..ebabf896a
+--- /dev/null
++++ b/doc/examples/systemd-user/dirmngr.socket
+@@ -0,0 +1,11 @@
++[Unit]
++Description=GnuPG network certificate management daemon
++Documentation=man:dirmngr(8)
++
++[Socket]
++ListenStream=%t/gnupg/S.dirmngr
++SocketMode=0600
++DirectoryMode=0700
++
++[Install]
++WantedBy=sockets.target
+diff --git a/doc/examples/systemd-user/gpg-agent-browser.socket b/doc/examples/systemd-user/gpg-agent-browser.socket
+new file mode 100644
+index 000000000..bc8d344e1
+--- /dev/null
++++ b/doc/examples/systemd-user/gpg-agent-browser.socket
+@@ -0,0 +1,13 @@
++[Unit]
++Description=GnuPG cryptographic agent and passphrase cache (access for web browsers)
++Documentation=man:gpg-agent(1)
++
++[Socket]
++ListenStream=%t/gnupg/S.gpg-agent.browser
++FileDescriptorName=browser
++Service=gpg-agent.service
++SocketMode=0600
++DirectoryMode=0700
++
++[Install]
++WantedBy=sockets.target
+diff --git a/doc/examples/systemd-user/gpg-agent-extra.socket b/doc/examples/systemd-user/gpg-agent-extra.socket
+new file mode 100644
+index 000000000..5b87d09df
+--- /dev/null
++++ b/doc/examples/systemd-user/gpg-agent-extra.socket
+@@ -0,0 +1,13 @@
++[Unit]
++Description=GnuPG cryptographic agent and passphrase cache (restricted)
++Documentation=man:gpg-agent(1)
++
++[Socket]
++ListenStream=%t/gnupg/S.gpg-agent.extra
++FileDescriptorName=extra
++Service=gpg-agent.service
++SocketMode=0600
++DirectoryMode=0700
++
++[Install]
++WantedBy=sockets.target
+diff --git a/doc/examples/systemd-user/gpg-agent-ssh.socket b/doc/examples/systemd-user/gpg-agent-ssh.socket
+new file mode 100644
+index 000000000..798c1d967
+--- /dev/null
++++ b/doc/examples/systemd-user/gpg-agent-ssh.socket
+@@ -0,0 +1,13 @@
++[Unit]
++Description=GnuPG cryptographic agent (ssh-agent emulation)
++Documentation=man:gpg-agent(1) man:ssh-add(1) man:ssh-agent(1) man:ssh(1)
++
++[Socket]
++ListenStream=%t/gnupg/S.gpg-agent.ssh
++FileDescriptorName=ssh
++Service=gpg-agent.service
++SocketMode=0600
++DirectoryMode=0700
++
++[Install]
++WantedBy=sockets.target
+diff --git a/doc/examples/systemd-user/gpg-agent.service b/doc/examples/systemd-user/gpg-agent.service
+new file mode 100644
+index 000000000..a050fccdc
+--- /dev/null
++++ b/doc/examples/systemd-user/gpg-agent.service
+@@ -0,0 +1,8 @@
++[Unit]
++Description=GnuPG cryptographic agent and passphrase cache
++Documentation=man:gpg-agent(1)
++Requires=gpg-agent.socket
++
++[Service]
++ExecStart=/usr/bin/gpg-agent --supervised
++ExecReload=/usr/bin/gpgconf --reload gpg-agent
+diff --git a/doc/examples/systemd-user/gpg-agent.socket b/doc/examples/systemd-user/gpg-agent.socket
+new file mode 100644
+index 000000000..4257c2c80
+--- /dev/null
++++ b/doc/examples/systemd-user/gpg-agent.socket
+@@ -0,0 +1,12 @@
++[Unit]
++Description=GnuPG cryptographic agent and passphrase cache
++Documentation=man:gpg-agent(1)
++
++[Socket]
++ListenStream=%t/gnupg/S.gpg-agent
++FileDescriptorName=std
++SocketMode=0600
++DirectoryMode=0700
++
++[Install]
++WantedBy=sockets.target
+-- 
+2.43.0
+
+

0011-el-gamal-default-to-3072-bits.patch

@@ -0,0 +1,34 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Thu, 7 Sep 2017 18:41:10 -0400
+Subject: gpg: default El Gamal to 3072-bit keys.
+
+* g10/keygen.c (gen_elg): update default from 2048 to 3072.
+
+--
+
+3072-bit El Gamal is widely considered to be 128-bit-equivalent security.
+
+While using El Gamal might be ill-advised, if you're going to use it,
+it might as well be a reasonable strength.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+
+(cherry picked from commit 909fbca19678e6e36968607e8a2348381da39d8c)
+---
+ g10/keygen.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/g10/keygen.c b/g10/keygen.c
+index b263a47..03d55be 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -1646,7 +1646,7 @@ gen_elg (int algo, unsigned int nbits, KBNODE pub_root,
+ 
+   if (nbits < 1024)
+     {
+-      nbits = 2048;
++      nbits = 3072;
+       log_info (_("keysize invalid; using %u bits\n"), nbits );
+     }
+   else if (nbits > 4096)
+

0012-gpg-default-digest-algorithm-SHA512.patch

@@ -0,0 +1,65 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Sun, 25 Dec 2022 12:08:27 +0100
+Subject: gpg: Always support and default to using SHA-512.
+
+* g10/main.h (DEFAULT_DIGEST_ALGO): Use SHA512 instead of SHA256 in
+  --gnupg mode (leave strict RFC and PGP modes alone).
+* configure.ac: Do not allow disabling sha512.
+* g10/misc.c (map_md_openpgp_to_gcry): Always support SHA512.
+
+--
+
+SHA512 is more performant on most 64-bit platforms than SHA256, and
+offers a better security margin.  It is also widely implemented.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ configure.ac | 2 +-
+ g10/main.h   | 2 +-
+ g10/misc.c   | 5 +----
+ 3 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index c80bce1..42ef43b 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -339,7 +339,7 @@ GNUPG_GPG_DISABLE_ALGO([rmd160],[RIPE-MD160 hash])
+ GNUPG_GPG_DISABLE_ALGO([sha224],[SHA-224 hash])
+ # SHA256 is a MUST algorithm for GnuPG.
+ GNUPG_GPG_DISABLE_ALGO([sha384],[SHA-384 hash])
+-GNUPG_GPG_DISABLE_ALGO([sha512],[SHA-512 hash])
++# SHA512 is a MUST algorithm for GnuPG.
+ 
+ 
+ # Allow disabling of zip support.
+diff --git a/g10/main.h b/g10/main.h
+index 2482fbd..f15d90f 100644
+--- a/g10/main.h
++++ b/g10/main.h
+@@ -41,7 +41,7 @@
+ # define DEFAULT_CIPHER_ALGO     CIPHER_ALGO_3DES
+ #endif
+ 
+-#define DEFAULT_DIGEST_ALGO     ((GNUPG)? DIGEST_ALGO_SHA256:DIGEST_ALGO_SHA1)
++#define DEFAULT_DIGEST_ALGO     ((GNUPG)? DIGEST_ALGO_SHA512:DIGEST_ALGO_SHA1)
+ #define DEFAULT_S2K_DIGEST_ALGO  DEFAULT_DIGEST_ALGO
+ #ifdef HAVE_ZIP
+ # define DEFAULT_COMPRESS_ALGO   COMPRESS_ALGO_ZIP
+diff --git a/g10/misc.c b/g10/misc.c
+index 2f4b452..0e6d9d5 100644
+--- a/g10/misc.c
++++ b/g10/misc.c
+@@ -862,11 +862,8 @@ map_md_openpgp_to_gcry (digest_algo_t algo)
+     case DIGEST_ALGO_SHA384: return 0;
+ #endif
+ 
+-#ifdef GPG_USE_SHA512
+     case DIGEST_ALGO_SHA512: return GCRY_MD_SHA512;
+-#else
+-    case DIGEST_ALGO_SHA512: return 0;
+-#endif
++
+     default: return 0;
+     }
+ }
+

0013-gpg-Prefer-SHA-512-and-SHA-384-in-personal-digest.patch

@@ -0,0 +1,47 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Wed, 3 Jan 2018 12:34:26 -0500
+Subject: gpg: Prefer SHA-512 and SHA-384 in personal-digest-preferences.
+
+* g10/keygen.c (keygen_set_std_prefs): prefer SHA-512
+and SHA-384 by default.
+
+--
+
+In 8ede3ae29a39641a2f98ad9a4cf61ea99085a892, upstream changed the
+defaults for --default-preference-list to advertise a preference for
+SHA-512, without touching --personal-digest-preferences.  This makes
+the same change for --personal-digest-preferences, since every modern
+OpenPGP library supports them all.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ g10/keygen.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/g10/keygen.c b/g10/keygen.c
+index 03d55be..d4fe7aa 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -423,16 +423,16 @@ keygen_set_std_prefs (const char *string,int personal)
+             if (personal)
+               {
+                 /* The default internal hash algo order is:
+-                 *  SHA-256, SHA-384, SHA-512, SHA-224, SHA-1.
++                 *  SHA-512, SHA-384, SHA-256, SHA-224, SHA-1.
+                  */
+-                if (!openpgp_md_test_algo (DIGEST_ALGO_SHA256))
+-                  strcat (dummy_string, "H8 ");
++                if (!openpgp_md_test_algo (DIGEST_ALGO_SHA512))
++                  strcat (dummy_string, "H10 ");
+ 
+                 if (!openpgp_md_test_algo (DIGEST_ALGO_SHA384))
+                   strcat (dummy_string, "H9 ");
+ 
+-                if (!openpgp_md_test_algo (DIGEST_ALGO_SHA512))
+-                  strcat (dummy_string, "H10 ");
++                if (!openpgp_md_test_algo (DIGEST_ALGO_SHA256))
++                  strcat (dummy_string, "H8 ");
+               }
+             else
+               {
+

0018-Avoid-simple-memory-dumps-via-ptrace.patch

@@ -0,0 +1,89 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Tue, 11 Aug 2015 20:28:26 -0400
+Subject: Avoid simple memory dumps via ptrace
+
+This avoids needing to setgid gpg-agent.  It probably doesn't defend
+against all possible attacks, but it defends against one specific (and
+easy) one.  If there are other protections we should do them too.
+
+This will make it slightly harder to debug the agent because the
+normal user won't be able to attach gdb to it directly while it runs.
+
+The remaining options for debugging are:
+
+ * launch the agent from gdb directly
+ * connect gdb to a running agent as the superuser
+
+Upstream bug: https://dev.gnupg.org/T1211
+---
+ agent/gpg-agent.c | 8 ++++++++
+ configure.ac      | 2 +-
+ scd/scdaemon.c    | 9 +++++++++
+ 3 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
+index c57fafb..cbe45f0 100644
+--- a/agent/gpg-agent.c
++++ b/agent/gpg-agent.c
+@@ -48,6 +48,9 @@
+ # include <signal.h>
+ #endif
+ #include <npth.h>
++#ifdef HAVE_PRCTL
++# include <sys/prctl.h>
++#endif
+ 
+ #define INCLUDED_BY_MAIN_MODULE 1
+ #define GNUPG_COMMON_NEED_AFLOCAL
+@@ -1088,6 +1091,11 @@ main (int argc, char **argv)
+ 
+   early_system_init ();
+ 
++#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
++  /* Disable ptrace on Linux without sgid bit */
++  prctl(PR_SET_DUMPABLE, 0);
++#endif
++
+   /* Before we do anything else we save the list of currently open
+      file descriptors and the signal mask.  This info is required to
+      do the exec call properly.  We don't need it on Windows.  */
+diff --git a/configure.ac b/configure.ac
+index ac4f08c..c80bce1 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1406,7 +1406,7 @@ AC_CHECK_FUNCS([atexit canonicalize_file_name clock_gettime ctermid  \
+                 ftruncate funlockfile getaddrinfo getenv getpagesize \
+                 getpwnam getpwuid getrlimit getrusage gettimeofday   \
+                 gmtime_r inet_ntop inet_pton isascii lstat memicmp   \
+-                memmove memrchr mmap nl_langinfo pipe raise rand     \
++                memmove memrchr mmap nl_langinfo pipe prctl raise rand \
+                 setenv setlocale setrlimit sigaction sigprocmask     \
+                 stat stpcpy strcasecmp strerror strftime stricmp     \
+                 strlwr strncasecmp strpbrk strsep strtol strtoul     \
+diff --git a/scd/scdaemon.c b/scd/scdaemon.c
+index 1a8705b..a3af4bd 100644
+--- a/scd/scdaemon.c
++++ b/scd/scdaemon.c
+@@ -37,6 +37,9 @@
+ #include <unistd.h>
+ #include <signal.h>
+ #include <npth.h>
++#ifdef HAVE_PRCTL
++# include <sys/prctl.h>
++#endif
+ 
+ #define INCLUDED_BY_MAIN_MODULE 1
+ #define GNUPG_COMMON_NEED_AFLOCAL
+@@ -474,6 +477,12 @@ main (int argc, char **argv )
+   const char *application_priority = NULL;
+ 
+   early_system_init ();
++
++#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
++  /* Disable ptrace on Linux without sgid bit */
++  prctl(PR_SET_DUMPABLE, 0);
++#endif
++
+   gpgrt_set_strusage (my_strusage);
+   gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
+   /* Please note that we may running SUID(ROOT), so be very CAREFUL

0029-Add-keyboxd-systemd-support.patch

@@ -0,0 +1,62 @@
+From 3c1fc07ee28a25f32978c6e85af06edc0095593d Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Tue, 22 Aug 2023 15:20:54 +0900
+Subject: Add keyboxd systemd support
+
+Forwarded: not-needed
+Last-Update: 2023-08-22
+---
+ doc/Makefile.am                           |  2 ++
+ doc/examples/systemd-user/keyboxd.service |  8 ++++++++
+ doc/examples/systemd-user/keyboxd.socket  | 11 +++++++++++
+ 3 files changed, 21 insertions(+)
+ create mode 100644 doc/examples/systemd-user/keyboxd.service
+ create mode 100644 doc/examples/systemd-user/keyboxd.socket
+
+diff --git a/doc/Makefile.am b/doc/Makefile.am
+index 15127859f..db5847e2e 100644
+--- a/doc/Makefile.am
++++ b/doc/Makefile.am
+@@ -33,6 +33,8 @@ examples = examples/README examples/scd-event examples/trustlist.txt	\
+ 	   examples/systemd-user/gpg-agent-ssh.socket 			\
+ 	   examples/systemd-user/gpg-agent-browser.socket		\
+ 	   examples/systemd-user/gpg-agent-extra.socket 		\
++	   examples/systemd-user/keyboxd.service			\
++	   examples/systemd-user/keyboxd.socket				\
+ 	   examples/pwpattern.list
+ 
+ helpfiles = help.txt help.be.txt help.ca.txt help.cs.txt		\
+diff --git a/doc/examples/systemd-user/keyboxd.service b/doc/examples/systemd-user/keyboxd.service
+new file mode 100644
+index 000000000..0adc40703
+--- /dev/null
++++ b/doc/examples/systemd-user/keyboxd.service
+@@ -0,0 +1,8 @@
++[Unit]
++Description=GnuPG public key management service
++Documentation=man:keyboxd(8)
++Requires=keyboxd.socket
++
++[Service]
++ExecStart=/usr/libexec/keyboxd --supervised
++ExecReload=/usr/bin/gpgconf --reload keyboxd
+diff --git a/doc/examples/systemd-user/keyboxd.socket b/doc/examples/systemd-user/keyboxd.socket
+new file mode 100644
+index 000000000..d4572f1b6
+--- /dev/null
++++ b/doc/examples/systemd-user/keyboxd.socket
+@@ -0,0 +1,11 @@
++[Unit]
++Description=GnuPG public key management service
++Documentation=man:keyboxd(8)
++
++[Socket]
++ListenStream=%t/gnupg/S.keyboxd
++SocketMode=0600
++DirectoryMode=0700
++
++[Install]
++WantedBy=sockets.target
+-- 
+2.47.2
+

0033-Support-large-RSA-keygen-in-non-batch-mode.patch

@@ -0,0 +1,80 @@
+From 5976b75cfd29018fa189375041ebe7d30a7a8432 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jakuje@redhat.com>
+Date: Tue, 11 Feb 2025 14:44:23 +0100
+Subject: Support large RSA keygen in non-batch mode
+
+---
+ doc/gpg.texi                             | 11 +++++------
+ g10/keygen.c                             |  2 +-
+ tests/openpgp/quick-key-manipulation.scm | 13 +++++++++++++
+ 3 files changed, 19 insertions(+), 7 deletions(-)
+
+diff --git a/doc/gpg.texi b/doc/gpg.texi
+index 9ccb74996..a11857235 100644
+--- a/doc/gpg.texi
++++ b/doc/gpg.texi
+@@ -1543,12 +1543,11 @@ the opposite meaning. The options are:
+ @itemx --disable-large-rsa
+ @opindex enable-large-rsa
+ @opindex disable-large-rsa
+-With --generate-key and --batch, enable the creation of RSA secret keys as
+-large as 8192 bit.  Note: 8192 bit is more than is generally
+-recommended.  These large keys don't significantly improve security,
+-but they are more expensive to use, and their signatures and
+-certifications are larger.  This option is only available if the
+-binary was build with large-secmem support.
++Enable the creation of RSA secret keys as large as 8192 bit.
++Note: 8192 bit is more than is generally recommended.  These large
++keys don't significantly improve security, but they are more expensive
++to use, and their signatures and certifications are larger.  This option
++is only available if the binary was build with large-secmem support.
+ 
+ @item --enable-dsa2
+ @itemx --disable-dsa2
+diff --git a/g10/keygen.c b/g10/keygen.c
+index 5d936feab..dec517121 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -3022,7 +3022,7 @@ get_keysize_range (int algo, unsigned int *min, unsigned int *max)
+ 
+     default:
+       *min = opt.compliance == CO_DE_VS ? 2048: 1024;
+-      *max = 4096;
++      *max = opt.flags.large_rsa == 1 ? 8192 : 4096;
+       def = 3072;
+       break;
+     }
+diff --git a/tests/openpgp/quick-key-manipulation.scm b/tests/openpgp/quick-key-manipulation.scm
+index 71d222a22..37ac708fc 100755
+--- a/tests/openpgp/quick-key-manipulation.scm
++++ b/tests/openpgp/quick-key-manipulation.scm
+@@ -31,6 +31,14 @@
+ 		   `(--with-fingerprint
+ 		     --list-secret-keys ,(exact id))))))
+ 
++(define (count-8192-keys id)
++  (length (filter (lambda (x) (and (string=? "sec" (car x))
++			   (string=? "8192" (caddr x))))
++		  (gpg-with-colons
++		   `(--with-fingerprint
++		     --list-secret-keys ,(exact id))))))
++
++(define mega "Mega <mega@invalid.example.net>")
+ (define alpha "Alpha <alpha@invalid.example.net>")
+ (define bravo "Bravo <bravo@invalid.example.net>")
+ (define bravohash "F75B1420CC5881F4005333379355CFF5873094DE")
+@@ -54,6 +62,11 @@
+ (assert (= 1 (count-uids-of-secret-key alpha)))
+ (assert (not (equal? "" (:expire (assoc "pub" keyinfo)))))
+ 
++(info "Checking quick key generation of large RSA key...")
++(call-check `(,@GPG --enable-large-rsa --quick-generate-key ,mega rsa8192))
++
++(assert (= 1 (count-8192-keys mega)))
++
+ (info "Checking that we can add a user ID...")
+ 
+ ;; Make sure the key capabilities don't change when we add a user id.
+-- 
+2.39.5
+

changelog

@@ -0,0 +1,716 @@
+* Wed Apr 22 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.9-7
+- Make the profile scripts more robust (RHEL-166369)
+
+* Mon Apr 20 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.9-6
+- Fix path to keyboxd service (#2458494)
+
+* Wed Jan 28 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.9-5
+- Fix CVE-2026-24882: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution
+
+* Wed Jan 21 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.9-4
+- Unbreak Release tag to make rpminspect in gating tests happy
+
+* Wed Jan 21 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.9-3
+- Update split_min_version to provide clean update path from Fedora 42 (#2429875)
+
+* Thu Jan 01 2026 Clemens Lang <cllang@redhat.com> - 2.4.9-1
+- New upstream release 2.4.9
+- Fixes CVE-2025-68973 (https://gpg.fail/memcpy)
+- Fixes https://gpg.fail/sha1
+- Fixes https://gpg.fail/detached
+
+* Fri Jul 25 2025 Frantisek Krenzelok <fkrenzel@redhat.com> - 2.4.8-4
+- add a root certificate bundle due to changes in ca-certificates (#2380121)
+- https://fedoraproject.org/wiki/Changes/dropingOfCertPemFile
+
+* Wed May 21 2025 Fabio Valentini <decathorpe@gmail.com> - 2.4.8-2
+- Split tools from monolithic gnupg2 package into subpackages
+
+* Fri May 16 2025 Jakub Jelen <jjelen@redhat.com> - 2.4.8-1
+- New upstream release 2.4.8
+- Remove problematic patch breaking Poppler
+
+* Wed Mar 26 2025 Jakub Jelen <jjelen@redhat.com> - 2.4.7-3
+- Pull more patches from FreePG project
+
+* Thu Jan 23 2025 Jakub Jelen <jjelen@redhat.com> - 2.4.7-2
+- Regenerate patches and pull new from FreePG project
+
+* Wed Jan 22 2025 Jakub Jelen <jjelen@redhat.com> - 2.4.7-1
+- New upstream release
+
+* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.5-5
+- Rebuilt for the bin-sbin merge (2nd attempt)
+
+* Wed Nov 13 2024 Michael J Gruber <mjg@fedoraproject.org> - 2.4.5-4
+- rebuild against npth-1.8
+
+* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.5-2
+- Rebuilt for the bin-sbin merge
+
+* Fri Mar 08 2024 Jakub Jelen <jjelen@redhat.com> - 2.4.5-1
+- New upstream release (#2268461)
+
+* Wed Feb 28 2024 Jakub Jelen <jjelen@redhat.com> - 2.4.4-1
+- Set GPG_TTY in profile.d (#2264985)
+
+* Fri Jan 26 2024 Jakub Jelen <jjelen@redhat.com> - 2.4.4-1
+- New upstream release (#2260333)
+
+* Fri Nov 10 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.3-4
+- Avoid creation of development versions (#2249037)
+
+* Mon Nov 06 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.3-3
+- Restore systemd units and sockets (#2158627)
+
+* Mon Jul 10 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.3-1
+- New upstream release (#2193503)
+
+* Thu Jun 01 2023 Michael J Gruber <mjg@fedoraproject.org> - 2.4.2-2
+- fix emacs usage (rhbz#2212090)
+
+* Wed May 31 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.2-1
+- New upstream release
+- Build with TPM2 support
+
+* Fri Apr 28 2023 Todd Zullinger <tmz@pobox.com> - 2.4.1-1
+- update to 2.4.1 (#2193503)
+
+* Fri Apr 28 2023 Todd Zullinger <tmz@pobox.com> - 2.4.0-4
+- remove %%skip_verify, brainpool signatures are supported now
+
+* Fri Mar 03 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.0-3
+- Revert introduction of the RFC4880bis draft into defaults
+
+* Tue Dec 20 2022 Todd Zullinger <tmz@pobox.com> - 2.4.0-1
+- update to 2.4.0 (#2155170)
+
+* Mon Oct 17 2022 Todd Zullinger <tmz@pobox.com> - 2.3.8-1
+- update to 2.3.8
+- BR systemd-rpm-macros for %%{_userunitdir}
+
+* Mon Oct 17 2022 Todd Zullinger <tmz@pobox.com> - 2.3.7-5
+- verify upstream signatures in %%prep, unless bootstrapping
+
+* Wed Oct 05 2022 Todd Zullinger <tmz@pobox.com> - 2.3.7-4
+- update BR/R versions for libassuan, libgpg-error, and libksba
+- drop with/without unversioned_gpg, last used with fedora-29
+
+* Mon Aug 01 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.7-3
+- Fix yubikey 5 detection (#2107766)
+
+* Tue Jul 12 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.7-1
+- New upstream release (#2106045)
+
+* Mon Jul 04 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.6-2
+- Fix for CVE-2022-34903 (#2103242)
+- Fix focing AEAD through configuration files (#2093760)
+
+* Mon Apr 25 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.6-1
+- New upstream release (#2078550)
+
+* Mon Apr 25 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.5-1
+- New upstream release (#2077616)
+
+* Tue Dec 21 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.4-1
+- New upstream release (#2034437)
+
+* Mon Nov 15 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.3-2
+- Fix file-is-digest patch (#2022904)
+
+* Wed Oct 13 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.3-1
+- New upstream release (2013388)
+
+* Wed Oct 06 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.2-3
+- Fix crash in agent when deciphering (#2009978)
+- Recommend pcsc-lite-ccid to support USB smart cards (#2007923)
+
+* Mon Sep 20 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.2-2
+- Disable ccid driver to avoid clash with pcscd (#2005714)
+
+* Wed Aug 25 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.2-1
+- New upstream relase (#1997276)
+
+* Wed Apr 21 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.1-1
+- New upstream release (#1947159)
+
+* Mon Mar 29 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.27-4
+- Add a configuration to not require exclusive access to PCSC
+
+* Thu Feb 18 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.27-3
+- Bump required libgpg-error version (#1930110)
+
+* Tue Jan 12 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.27-1
+- New upstream release (#1909825)
+
+* Mon Jan 04 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.26-1
+- New upstream release (#1909825)
+
+* Tue Nov 24 2020 Jakub Jelen <jjelen@redhat.com> - 2.2.25-2
+- Enable gpgtar (#1901103)
+
+* Tue Nov 24 2020 Jakub Jelen <jjelen@redhat.com> - 2.2.25-1
+- Update to 2.2.25 (#1900815)
+
+* Thu Nov 19 2020 Jakub Jelen <jjelen@redhat.com> - 2.2.24-1
+- Update to 2.2.24 (#1898504)
+
+* Fri Sep  4 2020 Tomáš Mráz <tmraz@redhat.com> - 2.2.23-1
+- upgrade to 2.2.23
+
+* Tue Jul 21 2020 Tom Stellard <tstellar@redhat.com> - 2.2.21-2
+- Use make macros
+- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
+
+* Mon Jul 20 2020 Tomáš Mráz <tmraz@redhat.com> - 2.2.21-1
+- upgrade to 2.2.21
+
+* Mon May  4 2020 Tomáš Mráz <tmraz@redhat.com> - 2.2.20-3
+- fixes for issues found in Coverity scan
+
+* Thu Apr 30 2020 Tomáš Mráz <tmraz@redhat.com> - 2.2.20-2
+- move systemd user units to _userunitdir (no activation by default)
+
+* Tue Apr 14 2020 Tomáš Mráz <tmraz@redhat.com> - 2.2.20-1
+- upgrade to 2.2.20
+
+* Wed Jan 29 2020 Tomáš Mráz <tmraz@redhat.com> - 2.2.19-1
+- upgrade to 2.2.19
+
+* Sat Jan  4 2020 Marcel Härry <mh+fedora@scrit.ch> - 2.2.18-3
+- Add patches to be able to deal with keys without uids (#1787708)
+
+* Fri Dec  6 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.18-2
+- fix abort when decrypting data with anonymous recipient (#1780057)
+
+* Tue Dec  3 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.18-1
+- upgrade to 2.2.18
+
+* Wed Nov  6 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.17-3
+- fix the gnupg(7) manual page (#1769072)
+
+* Mon Jul 15 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.17-1
+- upgrade to 2.2.17
+
+* Mon Jul  1 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.16-1
+- upgrade to 2.2.16
+
+* Tue Feb 26 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.13-1
+- upgrade to 2.2.13
+
+* Sun Feb 17 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.2.12-3
+- Rebuild for readline 8.0
+
+* Mon Feb  4 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.12-2
+- make it build with gcc-9
+
+* Tue Jan  8 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.12-1
+- upgrade to 2.2.12
+
+* Sat Dec 08 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.2.11-2
+- Provide unversioned GPG on F30+
+
+* Fri Nov 30 2018 Tomáš Mráz <tmraz@redhat.com> - 2.2.11-1
+- upgrade to 2.2.11
+
+* Wed Aug  1 2018 Tomáš Mráz <tmraz@redhat.com> - 2.2.9-1
+- upgrade to 2.2.9
+
+* Mon Jun 11 2018 Tomáš Mráz <tmraz@redhat.com> - 2.2.8-1
+- upgrade to 2.2.8 fixing CVE 2018-12020
+
+* Wed Apr 11 2018 Tomáš Mráz <tmraz@redhat.com> - 2.2.6-1
+- upgrade to 2.2.6
+
+* Fri Mar  2 2018 Tomáš Mráz <tmraz@redhat.com> - 2.2.5-1
+- upgrade to 2.2.5
+
+* Fri Jan 12 2018 Tomáš Mráz <tmraz@redhat.com> - 2.2.4-1
+- upgrade to 2.2.4
+
+* Tue Nov 21 2017 Tomáš Mráz <tmraz@redhat.com> - 2.2.3-1
+- upgrade to 2.2.3
+
+* Wed Nov  8 2017 Tomáš Mráz <tmraz@redhat.com> - 2.2.2-1
+- upgrade to 2.2.2
+
+* Tue Oct  3 2017 Tomáš Mráz <tmraz@redhat.com> - 2.2.1-1
+- upgrade to 2.2.1
+
+* Tue Sep  5 2017 Tomáš Mráz <tmraz@redhat.com> - 2.2.0-1
+- upgrade to 2.2.0
+
+* Wed Aug  9 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.22-1
+- upgrade to 2.1.22
+
+* Fri Jul 28 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.21-4
+- explictly remove gpgscm from the buildroot
+
+* Tue Jul 18 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.21-3
+- rebase the insttools patch
+- enable large secure memory support
+
+* Tue May 16 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.21-2
+- scdaemon is now needed by gpg
+
+* Tue May 16 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.21-1
+- upgrade to 2.1.21
+
+* Tue Apr 25 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.20-2
+- libdns aliasing issues fixed
+
+* Mon Apr 24 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.20-1
+- upgrade to 2.1.20
+- disable bundled libdns for now (#1444352)
+
+* Fri Mar 24 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.19-1
+- upgrade to 2.1.19
+- shorten time waiting on gpg-agent/dirmngr to start by exponential
+  backoff (#1431749)
+
+* Wed Mar  1 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.18-2
+- upgrade to 2.1.18
+
+* Thu Jan 12 2017 Igor Gnatenko <ignatenko@redhat.com> - 2.1.17-2
+- Rebuild for readline 7.x
+
+* Thu Dec 22 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.17-1
+- upgrade to 2.1.17
+
+* Mon Nov 28 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.16-1
+- upgrade to 2.1.16
+
+* Mon Aug 22 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.13-2
+- avoid using libgcrypt without initialization (#1366909)
+
+* Tue Jul 12 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.13-1
+- upgrade to 2.1.13
+
+* Thu May  5 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.12-1
+- upgrade to 2.1.12
+
+* Tue Apr 12 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.11-4
+- make the pinentry dependency weak as for the public-key operations it
+  is not needed (#1324595)
+
+* Mon Mar  7 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.11-3
+- add recommends weak dependency for gnupg2-smime
+
+* Sat Mar  5 2016 Peter Robinson <pbrobinson@fedoraproject.org> 2.1.11-2
+- Don't ship ChangeLog, core details already covered in NEWS
+
+* Tue Feb 16 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.11-1
+- upgrade to 2.1.11
+
+* Wed Jan 13 2016 Dan Horák <dan[at]danny.cz> - 2.1.10-3
+- fix the insttools patch
+
+* Wed Jan 13 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.10-2
+- rebase the insttools patch needed for full gpgv1 replacement
+
+* Mon Dec  7 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.10-1
+- upgrade to 2.1.10
+
+* Mon Oct 12 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.9-1
+- upgrade to 2.1.9
+
+* Fri Sep 11 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.8-1
+- upgrade to 2.1.8
+
+* Thu Aug 13 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.7-1
+- upgrade to 2.1.7
+
+* Tue Aug 11 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.6-1
+- upgrade to 2.1.6
+
+* Fri Jun 12 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.5-1
+- upgrade to 2.1.5
+
+* Tue May 26 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.4-2
+- use gnutls for TLS support in dirmngr (#1224816)
+
+* Fri May 15 2015 Robert Scheck <robert@fedoraproject.org> - 2.1.4-1
+- upgrade to 2.1.4 (#1192353)
+
+* Thu Apr 16 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.3-1
+- new upstream release fixing minor bugs
+
+* Sat Feb 21 2015 Till Maas <opensource@till.name> - 2.1.2-2
+- Rebuilt for Fedora 23 Change
+  https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
+
+* Wed Feb 18 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.2-1
+- new upstream release fixing two minor security issues
+
+* Fri Jan 30 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.1-2
+- resolve conflict with gnupg by renaming conflicting manual page (#1187472)
+
+* Thu Jan 29 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.1-1
+- new upstream release
+- this release now includes the dirmngr which is obsoleted as separate package
+
+* Tue Aug  5 2014 Tomáš Mráz <tmraz@redhat.com> - 2.0.25-1
+- new upstream release fixing a minor regression introduced by the previous one
+- add --file-is-digest option needed for copr
+
+* Sat Jul 12 2014 Tom Callaway <spot@fedoraproject.org> - 2.0.24-2
+- fix license handling
+
+* Wed Jun 25 2014 Tomáš Mráz <tmraz@redhat.com> - 2.0.24-1
+- new upstream release fixing CVE-2014-4617
+
+* Wed May  7 2014 Tomáš Mráz <tmraz@redhat.com> - 2.0.22-3
+- do not dump core if hash algorithm not available in the FIPS mode
+
+* Tue Mar  4 2014 Tomáš Mráz <tmraz@redhat.com> - 2.0.22-2
+- rebuilt against new libgcrypt
+
+* Tue Oct  8 2013 Tomáš Mráz <tmraz@redhat.com> - 2.0.22-1
+- new upstream release fixing CVE-2013-4402
+
+* Fri Aug 23 2013 Tomáš Mráz <tmraz@redhat.com> - 2.0.21-1
+- new upstream release
+
+* Wed Aug  7 2013 Tomas Mraz <tmraz@redhat.com> - 2.0.20-3
+- adjust to the unversioned docdir change (#993785)
+
+* Wed May 15 2013 Tomas Mraz <tmraz@redhat.com> - 2.0.20-1
+- new upstream release
+
+* Wed Jan  2 2013 Tomas Mraz <tmraz@redhat.com> - 2.0.19-7
+- fix CVE-2012-6085 - skip invalid key packets (#891142)
+
+* Thu Nov 22 2012 Tomas Mraz <tmraz@redhat.com> - 2.0.19-6
+- use AES as default crypto algorithm in FIPS mode (#879047)
+
+* Fri Nov 16 2012 Jamie Nguyen <jamielinux@fedoraproject.org> - 2.0.19-5
+- rebuild for <f18 (#877106)
+
+* Fri Jul 27 2012 Tomas Mraz <tmraz@redhat.com> - 2.0.19-4
+- fix negated condition (#843842)
+
+* Thu Jul 26 2012 Tomas Mraz <tmraz@redhat.com> - 2.0.19-3
+- add compat symlinks and provides if built on RHEL
+
+* Tue Apr 24 2012 Tomas Mraz <tmraz@redhat.com> - 2.0.19-1
+- new upstream release
+- set environment in protect-tool (#548528)
+- do not reject OCSP signing certs without keyUsage (#720174)
+
+* Wed Oct 12 2011 Rex Dieter <rdieter@fedoraproject.org> 2.0.18-2
+- build with --enable-standard-socket
+
+* Wed Aug 17 2011 Tomas Mraz <tmraz@redhat.com> - 2.0.18-1
+- new upstream release (#728481)
+
+* Mon Jul 25 2011 Tomas Mraz <tmraz@redhat.com> - 2.0.17-2
+- fix a bug that shows up with the new libgcrypt release (#725369)
+
+* Thu Jan 20 2011 Tomas Mraz <tmraz@redhat.com> - 2.0.17-1
+- new upstream release (#669611)
+
+* Tue Aug 17 2010 Tomas Mraz <tmraz@redhat.com> - 2.0.16-3
+- drop the provides/obsoletes for gnupg
+- drop the man page file conflicting with gnupg-1.x
+
+* Fri Aug 13 2010 Tomas Mraz <tmraz@redhat.com> - 2.0.16-2
+- drop the compat symlinks as gnupg-1.x is revived
+
+* Tue Jul 27 2010 Rex Dieter <rdieter@fedoraproject.org> - 2.0.16-1
+- gnupg-2.0.16
+
+* Fri Jul 23 2010 Rex Dieter <rdieter@fedoraproject.org> - 2.0.14-4
+- gpgsm realloc patch (#617706)
+
+* Fri Jun 18 2010 Tomas Mraz <tmraz@redhat.com> - 2.0.14-3
+- initialize small amount of secmem for list of algorithms in help (#598847)
+  (necessary in the FIPS mode of libgcrypt)
+
+* Tue Feb  9 2010 Tomas Mraz <tmraz@redhat.com> - 2.0.14-2
+- disable selinux support - it is too rudimentary and restrictive (#562982)
+
+* Mon Jan 11 2010 Tomas Mraz <tmraz@redhat.com> - 2.0.14-1
+- new upstream version
+- fix a few tests so they do not need to execute gpg-agent
+
+* Tue Dec  8 2009 Michael Schwendt <mschwendt@fedoraproject.org> - 2.0.13-4
+- Explicitly BR libassuan-static in accordance with the Packaging
+  Guidelines (libassuan-devel is still static-only).
+
+* Fri Oct 23 2009 Tomas Mraz <tmraz@redhat.com> - 2.0.13-3
+- drop s390 specific ifnarchs as all the previously missing dependencies
+  are now there
+- split out gpgsm into a smime subpackage to reduce main package dependencies
+
+* Wed Oct 21 2009 Tomas Mraz <tmraz@redhat.com> - 2.0.13-2
+- provide/obsolete gnupg-1 and add compat symlinks to be able to drop
+  gnupg-1
+
+* Fri Sep 04 2009 Rex Dieter <rdieter@fedoraproject.org> - 2.0.13-1
+- gnupg-2.0.13
+- Unable to use gpg-agent + input methods (#228953)
+
+* Wed Jun 17 2009 Rex Dieter <rdieter@fedoraproject.org> - 2.0.12-1
+- gnupg-2.0.12
+
+* Wed Mar 04 2009 Rex Dieter <rdieter@fedoraproject.org> - 2.0.11-1
+- gnupg-2.0.11
+
+* Sat Jan 31 2009 Karsten Hopp <karsten@redhat.com> 2.0.10-1
+- don't require pcsc-lite-libs and libusb on mainframe where
+  we don't have those packages as there's no hardware for that
+
+* Tue Jan 13 2009 Rex Dieter <rdieter@fedoraproject.org> 2.0.10-1
+- gnupg-2.0.10
+
+* Mon Aug 04 2008 Rex Dieter <rdieter@fedoraproject.org> 2.0.9-3
+- workaround rpm quirks
+
+* Sat May 24 2008 Tom "spot" Callaway <tcallawa@redhat.com> 2.0.9-2
+- Patch from upstream to fix curl 7.18.1+ and gcc4.3+ compile error
+
+* Mon May 19 2008 Tom "spot" Callaway <tcallawa@redhat.com> 2.0.9-1.1
+- minor release bump for sparc rebuild
+
+* Wed Mar 26 2008 Rex Dieter <rdieter@fedoraproject.org> 2.0.9-1
+- gnupg2-2.0.9
+- drop Provides: openpgp
+- versioned Provides: gpg
+- own %%_sysconfdir/gnupg
+
+* Fri Feb 08 2008 Rex Dieter <rdieter@fedoraproject.org> 2.0.8-3
+- respin (gcc43)
+
+* Wed Jan 23 2008 Rex Dieter <rdieter@fedoraproject.org> 2.0.8-2
+- avoid kde-filesystem dep (#427316)
+
+* Thu Dec 20 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.8-1
+- gnupg2-2.0.8
+
+* Mon Dec 17 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.8-0.1.rc1
+- gnupg2-2.0.8rc1
+
+* Tue Dec 04 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.7-5
+- respin for openldap
+
+* Mon Nov 12 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.7-4
+- Requires: kde-filesystem (#377841)
+
+* Wed Oct 03 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.7-3
+- %%build: (re)add mkdir -p $HOME/.gnupg
+
+* Wed Oct 03 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.7-2
+- Requires: dirmngr (#312831)
+
+* Mon Sep 10 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.7-1
+- gnupg-2.0.7
+
+* Fri Aug 24 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.6-2
+- respin (libassuan)
+
+* Thu Aug 16 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.6-1
+- gnupg-2.0.6
+- License: GPLv3+
+
+* Thu Aug 02 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.5-4
+- License: GPLv3
+
+* Mon Jul 16 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.5-3
+- 2.0.5 too many open files fix
+
+* Fri Jul 06 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.5-2
+- gnupg-2.0.5
+- gpg-agent not restarted after kde session crash/killed (#196327)
+- BR: libassuan-devel > 1.0.2, libksba-devel > 1.0.2
+
+* Fri May 18 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.4-1
+- gnupg-2.0.4
+
+* Thu Mar 08 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.3-1
+- gnupg-2.0.3
+
+* Fri Feb 02 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.2-1
+- gnupg-2.0.2
+
+* Wed Dec 06 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.1-2
+- CVE-2006-6235 (#219934)
+
+* Wed Nov 29 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.1-1
+- gnupg-2.0.1
+- CVE-2006-6169 (#217950)
+
+* Sat Nov 25 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.1-0.3.rc1
+- gnupg-2.0.1rc1
+
+* Thu Nov 16 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.0-4
+- update %%description
+- drop dearmor patch
+
+* Mon Nov 13 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.0-3
+- BR: libassuan-static >= 1.0.0
+
+* Mon Nov 13 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.0-2
+- gnupg-2.0.0
+
+* Fri Nov 10 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.95-3
+- upstream 64bit patch
+
+* Mon Nov 06 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.95-2
+- fix (more) file conflicts with gnupg
+
+* Mon Nov 06 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.95-1
+- 1.9.95
+
+* Wed Oct 25 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.94-1
+- 1.9.94
+
+* Wed Oct 18 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.93-1
+- 1.9.93
+
+* Wed Oct 11 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.92-2
+- fix file conflicts with gnupg
+
+* Wed Oct 11 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.92-1
+- 1.9.92
+
+* Tue Oct 10 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.91-4
+- make check ||: (apparently checks return err even on success?)
+
+* Tue Oct 10 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.91-3
+- --enable-selinux-support
+- x86_64: --disable-optimization (to avoid gpg2 segfaults), for now
+
+* Thu Oct 05 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.91-1
+- 1.9.91
+
+* Wed Oct 04 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.22-8
+- respin
+
+* Tue Sep 26 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.90-1
+- 1.9.90 (doesn't build, not released)
+
+* Mon Sep 18 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.23-1
+- 1.9.23 (doesn't build, not released)
+
+* Mon Sep 18 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.22-7
+- gpg-agent-startup.sh: fix case where valid .gpg-agent-info exists
+
+* Mon Sep 18 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.22-6
+- fix "syntax error in gpg-agent-startup.sh" (#206887)
+
+* Thu Sep 07 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.22-3
+- fc6 respin (for libksba-1.0)
+
+* Tue Aug 29 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.22-2
+- fc6 respin
+
+* Fri Jul 28 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.22-1
+- 1.9.22
+
+* Thu Jun 22 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.21-3
+- fix "gpg-agent not restarted after kde session crash/killed (#196327)
+
+* Thu Jun 22 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.21-2
+- 1.9.21
+- omit gpg2 binary to address CVS-2006-3082 (#196190)
+
+* Mon Mar  6 2006 Ville Skyttä <ville.skytta at iki.fi>> 1.9.20-3
+- Don't hardcode pcsc-lite lib name (#184123)
+
+* Thu Feb 16 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.20-2
+- fc4+: use /etc/kde/(env|shutdown) for scripts (#175744)
+
+* Fri Feb 10 2006 Rex Dieter <rexdieter[AT]users.sf.net>
+- fc5: gcc/glibc respin
+
+* Tue Dec 20 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.20-1
+- 1.9.20
+
+* Thu Dec 01 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.19-8
+- include gpg-agent-(startup|shutdown) scripts (#136533)
+- BR: libksba-devel >= 1.9.12
+- %%check: be permissive about failures (for now)
+
+* Wed Nov 30 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.19-3
+- BR: libksba-devel >= 1.9.13
+
+* Tue Oct 11 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.19-2
+- back to BR: libksba-devel = 1.9.11
+
+* Tue Oct 11 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.19-1
+- 1.9.19
+
+* Fri Aug 26 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.18-9
+- configure: NEED_KSBA_VERSION=0.9.12 -> 0.9.11
+
+* Fri Aug 26 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.18-7
+- re-enable 'make check', rebuild against (older) libksba-0.9.11
+
+* Tue Aug  9 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.18-6
+- don't 'make check' by default (regular builds pass, but FC4/5+plague fails)
+
+* Mon Aug  8 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.18-5
+- 1.9.18
+- drop pth patch (--enable-gpg build fixed)
+- update description (from README)
+
+* Fri Jul  1 2005 Ville Skyttä <ville.skytta at iki.fi> - 1.9.17-1
+- 1.9.17, signal info patch applied upstream (#162264).
+- Patch to fix lvalue build error with gcc4 (upstream #485).
+- Patch scdaemon and pcsc-wrapper to load the versioned (non-devel)
+  pcsc-lite lib by default.
+
+* Fri May 13 2005 Michael Schwendt <mschwendt[AT]users.sf.net> - 1.9.16-3
+- Include upstream's patch for signal.c.
+
+* Tue May 10 2005 Michael Schwendt <mschwendt[AT]users.sf.net> - 1.9.16-1
+- Merge changes from Rex's 1.9.16-1 (Thu Apr 21):
+-   opensc support unconditional
+-   remove hard-coded .gz from %%post/%%postun
+-   add %%check section
+-   add pth patch
+- Put back patch modified from 1.9.15-4 to make tests verbose
+  and change signal.c to describe received signals better.
+
+* Sun May  8 2005 Michael Schwendt <mschwendt[AT]users.sf.net>
+- Drop patch0 again.
+
+* Sun May  8 2005 Michael Schwendt <mschwendt[AT]users.sf.net> - 1.9.15-4
+- Add patch0 temporarily to get some output from failing test.
+
+* Sat May  7 2005 David Woodhouse <dwmw2@infradead.org> 1.9.15-3
+- Rebuild.
+
+* Thu Apr  7 2005 Michael Schwendt <mschwendt[AT]users.sf.net>
+- rebuilt
+
+* Tue Feb  1 2005 Michael Schwendt <mschwendt[AT]users.sf.net> - 0:1.9.15-1
+- Make install-info in scriptlets less noisy.
+
+* Tue Jan 18 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.15-0.fdr.1
+- 1.9.15
+
+* Fri Jan 07 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.14-0.fdr.2
+- note patch/hack to build against older ( <1.0) libgpg-error-devel
+
+* Thu Jan 06 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.14-0.fdr.1
+- 1.9.14
+- enable opensc support
+- BR: libassuan-devel >= 0.6.9
+
+* Thu Oct 21 2004 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.11-0.fdr.4
+- remove suid.
+
+* Thu Oct 21 2004 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.11-0.fdr.3
+- remove Provides: newpg
+
+* Wed Oct 20 2004 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.11-0.fdr.2
+- Requires: pinentry
+- gpg2 suid
+- update description
+
+* Tue Oct 19 2004 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.11-0.fdr.1
+- first try
+- leave out opensc support (for now), enable --with-opensc
+
+

gnupg-2.2.21-coverity.patch

@@ -1,240 +0,0 @@
-diff -up gnupg-2.2.21/common/server-help.c.coverity gnupg-2.2.21/common/server-help.c
---- gnupg-2.2.21/common/server-help.c.coverity 2019-02-11 10:59:34.000000000 +0100
-+++ gnupg-2.2.21/common/server-help.c  2020-07-20 17:09:57.416148768 +0200
-@@ -156,7 +156,7 @@ get_option_value (char *line, const char
-   *pend = 0;
-   *r_value = xtrystrdup (p);
-   *pend = c;
--  if (!p)
-+  if (!*r_value)
-     return my_error_from_syserror ();
-   return 0;
- }
-
-From 7a707a3eff1c3fbe17a74337776871f408377cee Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Fri, 9 Apr 2021 16:13:07 +0200
-Subject: [PATCH GnuPG 03/19] g10: Fix memory leaks
-
-* g10/card-util.c (change_pin): free answer on errors
-  (ask_card_keyattr): free answer on error
-* g10/cpr.c (do_get_from_fd): free string
-* g10/gpg.c (check_permissions): free dir on weird error
-* g10/import.c (append_new_uid): release knode
-* g10/keyedit.c (menu_set_keyserver_url): free answer
-  (menu_set_keyserver_url): free user
-* g10/keygen.c (print_status_key_not_created): move allocation after
-  sanity check
-  (ask_expire_interval): free answer
-  (card_store_key_with_backup): goto leave instaed of return
-* g10/keyserver.c (parse_keyserver_uri): goto fail instead of return
-* g10/revoke.c (gen_desig_revoke): release kdbhd
-  (gen_desig_revoke): free answer
-* g10/tofu.c (ask_about_binding): free sqerr and response
-* g10/trustdb.c (ask_ownertrust): free pk
-
---
-
-Signed-off-by: Jakub Jelen <jjelen@redhat.com>
----
- g10/card-util.c | 14 +++++++++++---
- g10/cpr.c       |  6 +++++-
- g10/gpg.c       |  1 +
- g10/import.c    |  5 ++++-
- g10/keyedit.c   |  8 +++++++-
- g10/keygen.c    | 15 +++++++++++----
- g10/keyserver.c |  2 +-
- g10/revoke.c    |  6 +++++-
- g10/tofu.c      |  4 ++++
- g10/trustdb.c   |  1 +
- 10 files changed, 50 insertions(+), 12 deletions(-)
-
-diff --git a/g10/card-util.c b/g10/card-util.c
-index 36f096f06..c7df8380d 100644
---- a/g10/card-util.c
-+++ b/g10/card-util.c
-@@ -127,7 +127,7 @@ change_pin (int unblock_v2, int allow_admin)
-   else
-     for (;;)
-       {
--	char *answer;
-+	char *answer = NULL;
- 
- 	tty_printf ("\n");
- 	tty_printf ("1 - change PIN\n"
-diff --git a/g10/tofu.c b/g10/tofu.c
-index f49083844..83786a08d 100644
---- a/g10/tofu.c
-+++ b/g10/tofu.c
-@@ -1687,6 +1687,8 @@ ask_about_binding (ctrl_t ctrl,
-          GPGSQL_ARG_END);
-       if (rc)
-         {
-+          sqlite3_free (sqerr);
-+          sqerr = NULL;
-           rc = gpg_error (GPG_ERR_GENERAL);
-           break;
-         }
--- 
-2.30.2
-
-
-From 7c8048b686a6e811d0b24febf3c5e2528e7881f1 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Tue, 13 Apr 2021 16:23:31 +0200
-Subject: [PATCH GnuPG 14/19] dirmgr: Avoid memory leaks
-
-* dirmngr/domaininfo.c (insert_or_update): free di_new
-
---
-
-Signed-off-by: Jakub Jelen <jjelen@redhat.com>
----
- dirmngr/domaininfo.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/dirmngr/domaininfo.c b/dirmngr/domaininfo.c
-index b41aef366..87782b4b1 100644
---- a/dirmngr/domaininfo.c
-+++ b/dirmngr/domaininfo.c
-@@ -193,6 +193,7 @@ insert_or_update (const char *domain,
-           log_error ("domaininfo: error allocating helper array: %s\n",
-                      gpg_strerror (gpg_err_code_from_syserror ()));
-           drop_extra = bucket;
-+          xfree (di_new);
-           goto leave;
-         }
-       narray = 0;
--- 
-2.30.2
-
-
-From ab3b8c53993b3305088efde756a44bac6e6492d4 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Tue, 13 Apr 2021 16:34:40 +0200
-Subject: [PATCH GnuPG 15/19] scd: Avoid memory leaks and uninitialized memory
-
-* scd/app-piv.c (do_decipher): goto leave, initialize outdatalen
-
---
-
-Signed-off-by: Jakub Jelen <jjelen@redhat.com>
----
- scd/app-piv.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/scd/app-piv.c b/scd/app-piv.c
-index 143cc047a..94257f0ee 100644
---- a/scd/app-piv.c
-+++ b/scd/app-piv.c
-@@ -2483,7 +2483,7 @@ do_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
-   gpg_error_t err;
-   data_object_t dobj;
-   unsigned char *outdata = NULL;
--  size_t outdatalen;
-+  size_t outdatalen = 0;
-   const unsigned char *s;
-   size_t n;
-   int keyref, mechanism;
-@@ -2582,7 +2582,7 @@ do_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
-   /* Now verify the Application PIN.  */
-   err = verify_chv (app, ctrl, 0x80, 0, pincb, pincb_arg);
-   if (err)
--    return err;
-+    goto leave;
- 
-   /* Build the Dynamic Authentication Template.  */
-   err = concat_tlv_list (0, &apdudata, &apdudatalen,
--- 
-2.30.2
-
-
-From f182bf91443618323e34261039045a6bde269be5 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Tue, 13 Apr 2021 16:44:48 +0200
-Subject: [PATCH GnuPG 16/19] tools: Avoid memory leaks
-
-* tools/wks-util.c (wks_cmd_print_wkd_url): Free addrspec on error
-  (wks_cmd_print_wkd_hash): Free addrspec on error
-
---
-
-Signed-off-by: Jakub Jelen <jjelen@redhat.com>
----
- tools/wks-util.c | 14 ++++++++++----
- 1 file changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/tools/wks-util.c b/tools/wks-util.c
-index 516c7fe00..38dd194ff 100644
---- a/tools/wks-util.c
-+++ b/tools/wks-util.c
-@@ -1192,11 +1192,14 @@ gpg_error_t
- wks_cmd_print_wkd_hash (const char *userid)
- {
-   gpg_error_t err;
--  char *addrspec, *fname;
-+  char *addrspec = NULL, *fname;
- 
-   err = wks_fname_from_userid (userid, 1, &fname, &addrspec);
-   if (err)
--    return err;
-+    {
-+      xfree (addrspec);
-+      return err;
-+    }
- 
-   es_printf ("%s %s\n", fname, addrspec);
- 
-@@ -1211,12 +1214,15 @@ gpg_error_t
- wks_cmd_print_wkd_url (const char *userid)
- {
-   gpg_error_t err;
--  char *addrspec, *fname;
-+  char *addrspec = NULL, *fname;
-   char *domain;
- 
-   err = wks_fname_from_userid (userid, 1, &fname, &addrspec);
-   if (err)
--    return err;
-+    {
-+      xfree (addrspec);
-+      return err;
-+    }
- 
-   domain = strchr (addrspec, '@');
-   if (domain)
--- 
-2.30.2
-
-
-From 600fabd8268c765d45d48873e7a8610e6dae0966 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Wed, 14 Apr 2021 15:59:12 +0200
-Subject: [PATCH GnuPG 17/19] scd: Use the same allocator to free memory
-
-* scd/command.c (cmd_getinfo): Use free instead of gcry_free to match
-  the original allocator
-
---
-
-Signed-off-by: Jakub Jelen <jjelen@redhat.com>
----
- scd/command.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/scd/command.c b/scd/command.c
-index cb0dd379a..9d85c5a41 100644
---- a/scd/command.c
-+++ b/scd/command.c
-@@ -1832,7 +1832,8 @@ cmd_getinfo (assuan_context_t ctx, char *line)
-         rc = assuan_send_data (ctx, p, strlen (p));
-       else
-         rc = gpg_error (GPG_ERR_NO_DATA);
--      xfree (p);
-+      /* allocated by scd/ccid-driver.c which is not using x*alloc/gcry_* */
-+      free (p);
-     }
-   else if (!strcmp (line, "deny_admin"))
-     rc = opt.allow_admin? gpg_error (GPG_ERR_GENERAL) : 0;
--- 
-2.30.2

gnupg-2.2.23-large-rsa.patch

@@ -1,12 +0,0 @@
-diff -up gnupg-2.2.23/g10/keygen.c.large-rsa gnupg-2.2.23/g10/keygen.c
---- gnupg-2.2.23/g10/keygen.c.large-rsa	2020-09-04 13:53:42.030486671 +0200
-+++ gnupg-2.2.23/g10/keygen.c	2020-09-04 13:55:52.896669542 +0200
-@@ -2262,7 +2262,7 @@ get_keysize_range (int algo, unsigned in
- 
-     default:
-       *min = opt.compliance == CO_DE_VS ? 2048: 1024;
--      *max = 4096;
-+      *max = opt.flags.large_rsa == 1 ? 8192 : 4096;
-       def = 3072;
-       break;
-     }

gnupg-2.3.6-status-line-injection.patch

@@ -1,50 +0,0 @@
-From 34c649b3601383cd11dbc76221747ec16fd68e1b Mon Sep 17 00:00:00 2001
-From: Werner Koch <wk@gnupg.org>
-Date: Tue, 14 Jun 2022 11:33:27 +0200
-Subject: [PATCH GnuPG] g10: Fix garbled status messages in NOTATION_DATA
-
-* g10/cpr.c (write_status_text_and_buffer): Fix off-by-one
---
-
-Depending on the escaping and line wrapping the computed remaining
-buffer length could be wrong.  Fixed by always using a break to
-terminate the escape detection loop.  Might have happened for all
-status lines which may wrap.
-
-GnuPG-bug-id: T6027
----
- g10/cpr.c | 13 ++++---------
- 1 file changed, 4 insertions(+), 9 deletions(-)
-
-diff --git a/g10/cpr.c b/g10/cpr.c
-index 9bfdd3c34..fa8005d6f 100644
---- a/g10/cpr.c
-+++ b/g10/cpr.c
-@@ -372,20 +372,15 @@ write_status_text_and_buffer (int no, const char *string,
-             }
-           first = 0;
-         }
--      for (esc=0, s=buffer, n=len; n && !esc; s++, n--)
-+      for (esc=0, s=buffer, n=len; n; s++, n--)
-         {
-           if (*s == '%' || *(const byte*)s <= lower_limit
-               || *(const byte*)s == 127 )
-             esc = 1;
-           if (wrap && ++count > wrap)
--            {
--              dowrap=1;
--              break;
--            }
--        }
--      if (esc)
--        {
--          s--; n++;
-+            dowrap=1;
-+          if (esc || dowrap)
-+            break;
-         }
-       if (s != buffer)
-         es_fwrite (buffer, s-buffer, 1, statusfp);
--- 
-2.35.3
-

gnupg-2.4.7-coverity.patch

@@ -0,0 +1,119 @@
+diff -up gnupg-2.4.7/common/server-help.c.coverity gnupg-2.4.7/common/server-help.c
+--- gnupg-2.4.7/common/server-help.c.coverity	2024-05-15 12:33:38.000000000 +0200
++++ gnupg-2.4.7/common/server-help.c	2025-01-23 19:06:59.035508041 +0100
+@@ -156,7 +156,7 @@ get_option_value (char *line, const char
+   *pend = 0;
+   *r_value = xtrystrdup (p);
+   *pend = c;
+-  if (!p)
++  if (!*r_value)
+     return my_error_from_syserror ();
+   return 0;
+ }
+diff -up gnupg-2.4.7/dirmngr/domaininfo.c.coverity gnupg-2.4.7/dirmngr/domaininfo.c
+--- gnupg-2.4.7/dirmngr/domaininfo.c.coverity	2024-05-15 12:33:38.000000000 +0200
++++ gnupg-2.4.7/dirmngr/domaininfo.c	2025-01-23 19:06:59.035508041 +0100
+@@ -194,6 +194,7 @@ insert_or_update (const char *domain,
+           log_error ("domaininfo: error allocating helper array: %s\n",
+                      gpg_strerror (gpg_err_code_from_syserror ()));
+           drop_extra = bucket;
++          xfree (di_new);
+           goto leave;
+         }
+       narray = 0;
+diff -up gnupg-2.4.7/g10/card-util.c.coverity gnupg-2.4.7/g10/card-util.c
+--- gnupg-2.4.7/g10/card-util.c.coverity	2024-05-15 12:33:38.000000000 +0200
++++ gnupg-2.4.7/g10/card-util.c	2025-01-23 19:06:59.035508041 +0100
+@@ -134,7 +134,7 @@ change_pin (int unblock_v2, int allow_ad
+   else
+     for (;;)
+       {
+-	char *answer;
++	char *answer = NULL;
+ 
+ 	tty_printf ("\n");
+ 	tty_printf ("1 - change PIN\n"
+diff -up gnupg-2.4.7/g10/tofu.c.coverity gnupg-2.4.7/g10/tofu.c
+--- gnupg-2.4.7/g10/tofu.c.coverity	2024-05-15 12:33:38.000000000 +0200
++++ gnupg-2.4.7/g10/tofu.c	2025-01-23 19:06:59.035508041 +0100
+@@ -1707,6 +1707,8 @@ ask_about_binding (ctrl_t ctrl,
+          GPGSQL_ARG_END);
+       if (rc)
+         {
++          sqlite3_free (sqerr);
++          sqerr = NULL;
+           rc = gpg_error (GPG_ERR_GENERAL);
+           break;
+         }
+diff -up gnupg-2.4.7/scd/app-piv.c.coverity gnupg-2.4.7/scd/app-piv.c
+--- gnupg-2.4.7/scd/app-piv.c.coverity	2024-05-15 12:33:38.000000000 +0200
++++ gnupg-2.4.7/scd/app-piv.c	2025-01-23 19:06:59.036508035 +0100
+@@ -2483,7 +2483,7 @@ do_decipher (app_t app, ctrl_t ctrl, con
+   gpg_error_t err;
+   data_object_t dobj;
+   unsigned char *outdata = NULL;
+-  size_t outdatalen;
++  size_t outdatalen = 0;
+   const unsigned char *s;
+   size_t n;
+   int keyref, mechanism;
+@@ -2582,7 +2582,7 @@ do_decipher (app_t app, ctrl_t ctrl, con
+   /* Now verify the Application PIN.  */
+   err = verify_chv (app, ctrl, 0x80, 0, pincb, pincb_arg);
+   if (err)
+-    return err;
++    goto leave;
+ 
+   /* Build the Dynamic Authentication Template.  */
+   err = concat_tlv_list (0, &apdudata, &apdudatalen,
+diff -up gnupg-2.4.7/scd/command.c.coverity gnupg-2.4.7/scd/command.c
+--- gnupg-2.4.7/scd/command.c.coverity	2024-09-20 12:07:25.000000000 +0200
++++ gnupg-2.4.7/scd/command.c	2025-01-23 19:06:59.036508035 +0100
+@@ -1969,7 +1969,8 @@ cmd_getinfo (assuan_context_t ctx, char
+         rc = assuan_send_data (ctx, p, strlen (p));
+       else
+         rc = gpg_error (GPG_ERR_NO_DATA);
+-      xfree (p);
++      /* allocated by scd/ccid-driver.c which is not using x*alloc/gcry_* */
++      free (p);
+     }
+   else if (!strcmp (line, "deny_admin"))
+     rc = opt.allow_admin? gpg_error (GPG_ERR_GENERAL) : 0;
+diff -up gnupg-2.4.7/tools/wks-util.c.coverity gnupg-2.4.7/tools/wks-util.c
+--- gnupg-2.4.7/tools/wks-util.c.coverity	2024-06-10 09:30:45.000000000 +0200
++++ gnupg-2.4.7/tools/wks-util.c	2025-01-23 19:06:59.036508035 +0100
+@@ -1443,11 +1443,14 @@ gpg_error_t
+ wks_cmd_print_wkd_hash (const char *userid)
+ {
+   gpg_error_t err;
+-  char *addrspec, *fname;
++  char *addrspec = NULL, *fname;
+ 
+   err = wks_fname_from_userid (userid, 1, &fname, &addrspec);
+   if (err)
+-    return err;
++    {
++      xfree (addrspec);
++      return err;
++    }
+ 
+   es_printf ("%s %s\n", fname, addrspec);
+ 
+@@ -1462,12 +1465,15 @@ gpg_error_t
+ wks_cmd_print_wkd_url (const char *userid)
+ {
+   gpg_error_t err;
+-  char *addrspec, *fname;
++  char *addrspec = NULL, *fname;
+   char *domain;
+ 
+   err = wks_fname_from_userid (userid, 1, &fname, &addrspec);
+   if (err)
+-    return err;
++    {
++      xfree (addrspec);
++      return err;
++    }
+ 
+   domain = strchr (addrspec, '@');
+   if (domain)

gnupg-2.4.7-file-is-digest.patch

@@ -1,7 +1,18 @@
-diff -up gnupg-2.2.20/g10/gpg.c.file-is-digest gnupg-2.2.20/g10/gpg.c
---- gnupg-2.2.20/g10/gpg.c.file-is-digest	2020-04-14 16:33:42.630269318 +0200
-+++ gnupg-2.2.20/g10/gpg.c	2020-04-14 16:34:46.455100086 +0200
-@@ -380,6 +380,7 @@ enum cmd_and_opt_values
+From cdd5082a9e3bdfc8de4aee4835dbdd607b4510be Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Mr=C3=A1z?= <tmraz@fedoraproject.org>
+Date: Tue, 5 Aug 2014 17:04:08 +0200
+Subject: [PATCH gnupg] add --file-is-digest option needed for copr
+
+---
+ g10/gpg.c     |  4 +++
+ g10/options.h |  1 +
+ g10/sign.c    | 93 ++++++++++++++++++++++++++++++++++++++++++++-------
+ 3 files changed, 85 insertions(+), 13 deletions(-)
+
+diff -up gnupg-2.4.7/g10/gpg.c.file-is-digest gnupg-2.4.7/g10/gpg.c
+--- gnupg-2.4.7/g10/gpg.c.file-is-digest	2025-01-23 18:11:50.417790048 +0100
++++ gnupg-2.4.7/g10/gpg.c	2025-01-23 18:11:50.419790035 +0100
+@@ -400,6 +400,7 @@ enum cmd_and_opt_values
      oTTYtype,
      oLCctype,
      oLCmessages,
@@ -9,7 +20,7 @@ diff -up gnupg-2.2.20/g10/gpg.c.file-is-digest gnupg-2.2.20/g10/gpg.c
      oXauthority,
      oGroup,
      oUnGroup,
-@@ -831,6 +832,7 @@ static ARGPARSE_OPTS opts[] = {
+@@ -666,6 +667,7 @@ static gpgrt_opt_t opts[] = {
    ARGPARSE_s_s (oTempDir,  "temp-directory", "@"),
    ARGPARSE_s_s (oExecPath, "exec-path", "@"),
    ARGPARSE_s_n (oExpert,      "expert", "@"),
@@ -17,7 +28,7 @@ diff -up gnupg-2.2.20/g10/gpg.c.file-is-digest gnupg-2.2.20/g10/gpg.c
    ARGPARSE_s_n (oNoExpert, "no-expert", "@"),
    ARGPARSE_s_n (oNoSecmemWarn, "no-secmem-warning", "@"),
    ARGPARSE_s_n (oRequireSecmem, "require-secmem", "@"),
-@@ -2419,6 +2421,7 @@ main (int argc, char **argv)
+@@ -2507,6 +2509,7 @@ main (int argc, char **argv)
      opt.keyid_format = KF_NONE;
      opt.def_sig_expire = "0";
      opt.def_cert_expire = "0";
@@ -25,7 +36,7 @@ diff -up gnupg-2.2.20/g10/gpg.c.file-is-digest gnupg-2.2.20/g10/gpg.c
      opt.passphrase_repeat = 1;
      opt.emit_version = 0;
      opt.weak_digests = NULL;
-@@ -2997,6 +3000,7 @@ main (int argc, char **argv)
+@@ -3146,6 +3149,7 @@ main (int argc, char **argv)
  	  case oPhotoViewer: opt.photo_viewer = pargs.r.ret_str; break;
  
  	  case oForceAEAD: opt.force_aead = 1; break;
@@ -33,10 +44,10 @@ diff -up gnupg-2.2.20/g10/gpg.c.file-is-digest gnupg-2.2.20/g10/gpg.c
  
            case oDisableSignerUID: opt.flags.disable_signer_uid = 1; break;
            case oIncludeKeyBlock:  opt.flags.include_key_block = 1; break;
-diff -up gnupg-2.2.20/g10/options.h.file-is-digest gnupg-2.2.20/g10/options.h
---- gnupg-2.2.20/g10/options.h.file-is-digest	2020-03-14 19:54:05.000000000 +0100
-+++ gnupg-2.2.20/g10/options.h	2020-04-14 16:33:42.634269245 +0200
-@@ -202,6 +202,7 @@ struct
+diff -up gnupg-2.4.7/g10/options.h.file-is-digest gnupg-2.4.7/g10/options.h
+--- gnupg-2.4.7/g10/options.h.file-is-digest	2024-09-20 12:07:25.000000000 +0200
++++ gnupg-2.4.7/g10/options.h	2025-01-23 18:11:50.419790035 +0100
+@@ -243,6 +243,7 @@ struct
    int no_auto_check_trustdb;
    int preserve_permissions;
    int no_homedir_creation;
@@ -44,9 +55,9 @@ diff -up gnupg-2.2.20/g10/options.h.file-is-digest gnupg-2.2.20/g10/options.h
    struct groupitem *grouplist;
    int mangle_dos_filenames;
    int enable_progress_filter;
-diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
---- gnupg-2.2.20/g10/sign.c.file-is-digest	2020-03-14 19:35:46.000000000 +0100
-+++ gnupg-2.2.20/g10/sign.c	2020-04-14 16:36:54.661751422 +0200
+diff -up gnupg-2.4.7/g10/sign.c.file-is-digest gnupg-2.4.7/g10/sign.c
+--- gnupg-2.4.7/g10/sign.c.file-is-digest	2024-05-15 12:33:38.000000000 +0200
++++ gnupg-2.4.7/g10/sign.c	2025-01-23 18:11:50.420790029 +0100
 @@ -40,6 +40,7 @@
  #include "pkglue.h"
  #include "../common/sysutils.h"
@@ -55,7 +66,7 @@ diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
  #include "../common/mbox-util.h"
  #include "../common/compliance.h"
  
-@@ -834,6 +835,8 @@ write_signature_packets (ctrl_t ctrl,
+@@ -946,6 +947,8 @@ write_signature_packets (ctrl_t ctrl,
  
        if (pk->version >= 5)
          sig->version = 5;  /* Required for v5 keys.  */
@@ -64,11 +75,11 @@ diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
        else
          sig->version = 4;  /* Required.  */
  
-@@ -860,14 +863,22 @@ write_signature_packets (ctrl_t ctrl,
+@@ -963,14 +966,22 @@ write_signature_packets (ctrl_t ctrl,
        if (gcry_md_copy (&md, hash))
          BUG ();
  
--      build_sig_subpkt_from_sig (sig, pk);
+-      build_sig_subpkt_from_sig (sig, pk, 0);
 -      mk_notation_policy_etc (ctrl, sig, NULL, pk);
 -      if (opt.flags.include_key_block && IS_SIG (sig))
 -        err = mk_sig_subpkt_key_block (ctrl, sig, pk);
@@ -78,7 +89,7 @@ diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
 -      gcry_md_final (md);
 +      if (!opt.file_is_digest)
 +        {
-+          build_sig_subpkt_from_sig (sig, pk);
++          build_sig_subpkt_from_sig (sig, pk, 0);
 +          mk_notation_policy_etc (ctrl, sig, NULL, pk);
 +          if (opt.flags.include_key_block && IS_SIG (sig))
 +            err = mk_sig_subpkt_key_block (ctrl, sig, pk);
@@ -95,7 +106,7 @@ diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
  
        if (!err)
          err = do_sign (ctrl, pk, sig, md, hash_for (pk), cache_nonce, 0);
-@@ -924,6 +930,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
+@@ -1035,6 +1046,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
    SK_LIST sk_rover = NULL;
    int multifile = 0;
    u32 duration=0;
@@ -104,7 +115,7 @@ diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
    pt_extra_hash_data_t extrahash = NULL;
  
    pfx = new_progress_context ();
-@@ -941,7 +949,16 @@ sign_file (ctrl_t ctrl, strlist_t filena
+@@ -1054,7 +1067,16 @@ sign_file (ctrl_t ctrl, strlist_t filena
      fname = NULL;
  
    if (fname && filenames->next && (!detached || encryptflag))
@@ -122,7 +133,7 @@ diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
  
    if (encryptflag == 2
        && (rc = setup_symkey (&efx.symkey_s2k, &efx.symkey_dek)))
-@@ -962,7 +979,7 @@ sign_file (ctrl_t ctrl, strlist_t filena
+@@ -1075,7 +1097,7 @@ sign_file (ctrl_t ctrl, strlist_t filena
      goto leave;
  
    /* Prepare iobufs. */
@@ -131,7 +142,7 @@ diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
      inp = NULL;     /* we do it later */
    else
      {
-@@ -1100,7 +1117,7 @@ sign_file (ctrl_t ctrl, strlist_t filena
+@@ -1230,7 +1252,7 @@ sign_file (ctrl_t ctrl, strlist_t filena
    for (sk_rover = sk_list; sk_rover; sk_rover = sk_rover->next)
      gcry_md_enable (mfx.md, hash_for (sk_rover->pk));
  
@@ -140,7 +151,7 @@ diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
      iobuf_push_filter (inp, md_filter, &mfx);
  
    if (detached && !encryptflag)
-@@ -1155,6 +1172,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
+@@ -1296,6 +1318,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
  
    write_status_begin_signing (mfx.md);
  
@@ -149,47 +160,47 @@ diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
    /* Setup the inner packet. */
    if (detached)
      {
-@@ -1195,6 +1214,49 @@ sign_file (ctrl_t ctrl, strlist_t filena
+@@ -1343,6 +1367,49 @@ sign_file (ctrl_t ctrl, strlist_t filena
            if (opt.verbose)
              log_printf ("\n");
  	}
 +      else if (opt.file_is_digest)
 +        {
-+          byte *mdb, ts[5];
++          byte *mdb, ts[5] = {0};
 +          size_t mdlen;
 +          const char *fp;
 +          int c, d;
-+      
++
 +          gcry_md_final(mfx.md);
 +          /* this assumes gcry_md_read returns the same buffer */
 +          mdb = gcry_md_read(mfx.md, opt.def_digest_algo);
 +          mdlen = gcry_md_get_algo_dlen(opt.def_digest_algo);
 +          if (strlen(fname) != mdlen * 2 + 11)
-+            log_bug("digests must be %zu + @ + 5 bytes\n", mdlen);
++            log_bug("digests must be %zu + '@' + 5 bytes\n", mdlen);
 +          d = -1;
 +          for (fp = fname ; *fp; )
 +            {
-+      	       c = *fp++;
-+      	       if (c >= '0' && c <= '9')
-+      	         c -= '0';
-+      	       else if (c >= 'a' && c <= 'f')
-+      	         c -= 'a' - 10;
-+      	       else if (c >= 'A' && c <= 'F')
-+      	         c -= 'A' - 10;
-+      	       else
-+      	         log_bug("filename is not hex\n");
-+      	       if (d >= 0)
++               c = *fp++;
++               if (c >= '0' && c <= '9')
++                 c -= '0';
++               else if (c >= 'a' && c <= 'f')
++                 c -= 'a' - 10;
++               else if (c >= 'A' && c <= 'F')
++                 c -= 'A' - 10;
++               else
++                 log_bug("filename is not hex\n");
++               if (d >= 0)
 +                {
-+      	           *mdb++ = d << 4 | c;
-+      	           c = -1;
-+      	           if (--mdlen == 0)
++                   *mdb++ = d << 4 | c;
++                   c = -1;
++                   if (--mdlen == 0)
 +                    {
-+      	               mdb = ts;
-+      	               if (*fp++ != '@')
-+      	                 log_bug("missing time separator\n");
-+      	             }
-+      	         }
-+      	       d = c;
++                       mdb = ts;
++                       if (*fp++ != '@')
++                         log_bug("missing time separator\n");
++                     }
++                 }
++               d = c;
 +            }
 +          sigclass = ts[0];
 +          if (sigclass != 0x00 && sigclass != 0x01)
@@ -199,7 +210,7 @@ diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
        else
          {
            /* Read, so that the filter can calculate the digest. */
-@@ -1213,8 +1271,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
+@@ -1364,8 +1431,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
  
    /* Write the signatures. */
    rc = write_signature_packets (ctrl, sk_list, out, mfx.md, extrahash,

gnupg-2.4.7-fips-algo.patch

@@ -1,20 +1,6 @@
-diff -up gnupg-2.1.1/g10/mainproc.c.fips gnupg-2.1.1/g10/mainproc.c
---- gnupg-2.1.1/g10/mainproc.c.fips	2015-01-29 17:19:49.266031504 +0100
-+++ gnupg-2.1.1/g10/mainproc.c	2015-01-29 17:27:13.938088122 +0100
-@@ -719,7 +719,8 @@ proc_plaintext( CTX c, PACKET *pkt )
-          according to 2440, so hopefully it won't come up that often.
-          There is no good way to specify what algorithms to use in
-          that case, so these there are the historical answer. */
--	gcry_md_enable (c->mfx.md, DIGEST_ALGO_RMD160);
-+	if (!gcry_fips_mode_active())
-+            gcry_md_enable (c->mfx.md, DIGEST_ALGO_RMD160);
- 	gcry_md_enable (c->mfx.md, DIGEST_ALGO_SHA1);
-     }
-   if (DBG_HASHING)
-diff --git a/common/t-sexputil.c b/common/t-sexputil.c
-index d75090c5b..be5eb2122 100644
---- a/common/t-sexputil.c
-+++ b/common/t-sexputil.c
+diff -up gnupg-2.4.7/common/t-sexputil.c.fips gnupg-2.4.7/common/t-sexputil.c
+--- gnupg-2.4.7/common/t-sexputil.c.fips	2024-05-15 12:33:38.000000000 +0200
++++ gnupg-2.4.7/common/t-sexputil.c	2025-01-23 18:17:28.108631306 +0100
 @@ -291,36 +291,6 @@ test_ecc_uncompress (void)
      const char *b;  /* Compressed.    */
    }
@@ -52,3 +38,16 @@ index d75090c5b..be5eb2122 100644
    { /* A key which does not require a conversion.  */
      "(public-key"
      " (ecdsa"
+diff -up gnupg-2.4.7/g10/mainproc.c.fips gnupg-2.4.7/g10/mainproc.c
+--- gnupg-2.4.7/g10/mainproc.c.fips	2024-09-20 12:07:25.000000000 +0200
++++ gnupg-2.4.7/g10/mainproc.c	2025-01-23 18:17:28.108631306 +0100
+@@ -1011,7 +1011,8 @@ proc_plaintext( CTX c, PACKET *pkt )
+          according to 2440, so hopefully it won't come up that often.
+          There is no good way to specify what algorithms to use in
+          that case, so these there are the historical answer. */
+-	gcry_md_enable (c->mfx.md, DIGEST_ALGO_RMD160);
++	if (!gcry_fips_mode_active())
++            gcry_md_enable (c->mfx.md, DIGEST_ALGO_RMD160);
+ 	gcry_md_enable (c->mfx.md, DIGEST_ALGO_SHA1);
+     }
+   if (DBG_HASHING)

gnupg-2.4.7-secmem.patch

@@ -1,7 +1,7 @@
-diff -up gnupg-2.1.10/g10/gpg.c.secmem gnupg-2.1.10/g10/gpg.c
---- gnupg-2.1.10/g10/gpg.c.secmem	2015-12-04 10:53:27.000000000 +0100
-+++ gnupg-2.1.10/g10/gpg.c	2015-12-07 15:32:38.922812652 +0100
-@@ -889,7 +889,7 @@ make_libversion (const char *libname, co
+diff -up gnupg-2.4.7/g10/gpg.c.secmem gnupg-2.4.7/g10/gpg.c
+--- gnupg-2.4.7/g10/gpg.c.secmem	2024-09-20 12:07:25.000000000 +0200
++++ gnupg-2.4.7/g10/gpg.c	2025-01-23 18:05:31.411213610 +0100
+@@ -1103,7 +1103,7 @@ make_libversion (const char *libname, co
  
    if (maybe_setuid)
      {
@@ -10,7 +10,7 @@ diff -up gnupg-2.1.10/g10/gpg.c.secmem gnupg-2.1.10/g10/gpg.c
        maybe_setuid = 0;
      }
    s = getfnc (NULL);
-@@ -1041,7 +1041,7 @@ build_list (const char *text, char lette
+@@ -1263,7 +1263,7 @@ build_list (const char *text, char lette
    char *string;
  
    if (maybe_setuid)
@@ -19,10 +19,10 @@ diff -up gnupg-2.1.10/g10/gpg.c.secmem gnupg-2.1.10/g10/gpg.c
  
    indent = utf8_charcount (text, -1);
    len = 0;
-diff -up gnupg-2.1.10/sm/gpgsm.c.secmem gnupg-2.1.10/sm/gpgsm.c
---- gnupg-2.1.10/sm/gpgsm.c.secmem	2015-11-30 17:39:52.000000000 +0100
-+++ gnupg-2.1.10/sm/gpgsm.c	2015-12-07 15:31:17.226884207 +0100
-@@ -530,7 +530,7 @@ make_libversion (const char *libname, co
+diff -up gnupg-2.4.7/sm/gpgsm.c.secmem gnupg-2.4.7/sm/gpgsm.c
+--- gnupg-2.4.7/sm/gpgsm.c.secmem	2024-09-20 12:07:25.000000000 +0200
++++ gnupg-2.4.7/sm/gpgsm.c	2025-01-23 18:05:31.411213610 +0100
+@@ -618,7 +618,7 @@ make_libversion (const char *libname, co
  
    if (maybe_setuid)
      {

gnupg-2.4.8-ca-certificates-bundle.patch

@@ -0,0 +1,11 @@
+diff -up ./dirmngr/certcache.c.certbundle ./dirmngr/certcache.c
+--- ./dirmngr/certcache.c.certbundle	2025-07-25 09:02:24.354664993 +0200
++++ ./dirmngr/certcache.c	2025-07-25 09:03:10.639991559 +0200
+@@ -705,6 +705,7 @@ load_certs_from_system (void)
+ #ifdef DEFAULT_TRUST_STORE_FILE
+     { DEFAULT_TRUST_STORE_FILE }
+ #else
++    { "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem" },
+     { "/etc/ssl/ca-bundle.pem" },
+     { "/etc/ssl/certs/ca-certificates.crt" },
+     { "/etc/pki/tls/cert.pem" },

gnupg-2.4.9-tpm2daemon.patch

@@ -0,0 +1,62 @@
+From 93fa34d9a346020355cd51d54102d30d4f177323 Mon Sep 17 00:00:00 2001
+From: Werner Koch <wk@gnupg.org>
+Date: Mon, 26 Jan 2026 11:13:44 +0100
+Subject: [PATCH] tpm: Fix possible buffer overflow in PKDECRYPT
+
+* tpm2d/tpm2.c (tpm2_ecc_decrypt): Bail out on too long CIPHERTEXT.
+(tpm2_rsa_decrypt): Ditto.
+--
+
+GnuPG-bug-id: 8045
+Co-authored-by: NIIBE Yutaka <gniibe@fsij.org>
+Reported-by: OpenAI Security Research
+---
+ tpm2d/tpm2.c | 22 +++++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/tpm2d/tpm2.c b/tpm2d/tpm2.c
+index a4677fb98..282de5e5d 100644
+--- a/tpm2d/tpm2.c
++++ b/tpm2d/tpm2.c
+@@ -951,10 +951,20 @@ tpm2_ecc_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
+   size_t len;
+   int ret;
+ 
++#if defined(TPM2_MAX_ECC_KEY_BYTES) /* Intel stack */
++  if (ciphertext_len > 2*TPM2_MAX_ECC_KEY_BYTES + 1)
++    return GPG_ERR_TOO_LARGE;
++#elif defined(MAX_ECC_KEY_BYTES)    /* IBM stack */
++  if (ciphertext_len > 2*MAX_ECC_KEY_BYTES + 1)
++    return GPG_ERR_TOO_LARGE;
++#else
++# error TMP2 header are not correctly installed
++#endif
++
+   /* This isn't really a decryption per se.  The ciphertext actually
+    * contains an EC Point which we must multiply by the private key number.
+    *
+-   * The reason is to generate a diffe helman agreement on a shared
++   * The reason is to generate a diffie-hellman agreement on a shared
+    * point.  This shared point is then used to generate the per
+    * session encryption key.
+    */
+@@ -1010,6 +1020,16 @@ tpm2_rsa_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
+   TPM_HANDLE ah;
+   char *auth;
+ 
++#if defined(TPM2_MAX_RSA_KEY_BYTES)  /* Intel stack */
++  if (ciphertext_len > TPM2_MAX_RSA_KEY_BYTES)
++    return GPG_ERR_TOO_LARGE;
++#elif defined(MAX_RSA_KEY_BYTES)     /* IBM stack */
++  if (ciphertext_len > MAX_RSA_KEY_BYTES)
++    return GPG_ERR_TOO_LARGE;
++#else
++# error TMP2 header are not correctly installed
++#endif
++
+   inScheme.scheme = TPM_ALG_RSAES;
+   /*
+    * apparent gcrypt error: occasionally rsa ciphertext will
+-- 
+2.52.0
+

gnupg2.csh

@@ -0,0 +1,3 @@
+if ( $?prompt ) then
+    setenv GPG_TTY `tty`
+endif

gnupg2.sh

@@ -0,0 +1,3 @@
+case "$-" in *i*)
+    export GPG_TTY=$(tty) ;;
+esac

signature_key.asc

@@ -0,0 +1,86 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQGNBFjLuq4BDACnM7zNSIaVMAacTwjXa5TGYe13i6ilHe4VL0NShzrgzjcQg531
+3cRgiiiNA7OSOypMqVs73Jez6ZUctn2GVsHBrS/io9NcuC9pVwf8a61WlcEa+EtB
+a3G7HlBmEWnwaUdAtWKNuAi9Xn+Ir7H2xEdksmmd5a0/QnL+sX705boVPF/tpYtb
+LGpPxa78tNrtxDkSwy8Wmi0IADYLI5yI7/yUGeJd8RSCU/fLRKC9fG7YOZRq0tsO
+MhVNWmtUjbG6e73Lu8LKnCZgs1/fC8hvPyARieSV5mdN8s1oWd7oYctfgL4uBleD
+ItAA8GhjKejutzHN8Ei/APw6AiiSyEjnPg+cTX8OgvLGJWjks0H6mPZeB1v/kGyZ
+hBS9vm540h2/MmlVN2ntiCK5TZGeSWpqddiqusfVXotMRpN4HeLKoZh4RAncaCbZ
+F/S+YLeN+kMXY4k3Fqt1fjTX6veFCbthI9pDdHzU9LfUVNp9D/5ktC/tYMORMegV
++wSMxi9G2YWKJkMAEQEAAYkBzgQfAQgAOBYhBFuAxXVCmPDLVdjtarzvfilLCS4o
+BQJYy8DdFwyAAZSlyaA8L+XKOwldjh/fcjz0YraxAgcAAAoJELzvfilLCS4oNgoL
+/0+K1xIx8JW7Lk5M6bYCvNA4fdlEcwQIT4UidJFM9m+suxYFWIGfebvHpRlEuJTg
+dBjkEit8uLAoJXU0BRkKTLrzTF+qDUE79Wfx/R+0nOgJ7aMykQOi0AvuwzMYz4dg
+xIVS2Daou4DF7bh/KF8+fqrmq8P8W1ZrkuFDanMWpHeAPx1uj2skYbo7uPqFdvlJ
+hlNHrcxlcCkjf1InAt0Xt5lMvEsCRUPf9xAH4mNEhs0lh9c+200YPRmtnLWAzc1K
+ckLIC8Q+mUR3DjZDqBlDBEPegXkrI0+MlvRA+9AnAm4YPqTMUfpZ6ZOAWeFjC/6Z
+QYxG/AdWGkb4WFindzklQfybEuiekP8vU07ACQwSwH8PYe0UCom1YrlRUjX7QLkn
+ZLWoeZg8BZy9GTM1Ut7Q1Q2uTw6mxxISuef+RFgYOHjWwLpFWZpqC88xERl7o/iz
+iERJRt/593IctbjO9wenWt2peIAwzR4nz7LqM6ZFTdRAETmcdSvYRhg2Qt8hUE47
+CbQkQW5kcmUgSGVpbmVja2UgKFJlbGVhc2UgU2lnbmluZyBLZXkpiQHUBBMBCAA+
+FiEEW4DFdUKY8MtV2O1qvO9+KUsJLigFAljLuq4CGwMFCRLMAwAFCwkIBwIGFQgJ
+CgsCBBYCAwECHgECF4AACgkQvO9+KUsJLihC/QwAhCC+SEvcFLcutgZ8HfcCtoZs
+IoVzZEy7DjqIvGgnTssD8HCLnIAHCDvnP7dJW3uMuLCdSqym3cjlEIiQMsaGywkl
+fzJISAwJrGQdWSKRd535jXpEXQlXDKal/IwMKAUt0PZtlCc9S3gwixQryxdJ28lJ
+6h2T9fVDr8ZswMmTAFG91uctfhjKOMgPt8UhSPGW484WsIsQgkbOvf+Kfswl0eHu
+ywX+pKAB5ZQ/9GVC6Ug4xfrdiJL0azJTPnvjMY5JYp6/L9RURs5hP5AnHR2j/PPo
+sAtsFCjmbRbOMiASzklnUJPbSz5kfLloDWZmrUScjbzmsXehGyt433JGyRhZJl4x
+/jPbzKhaaAHsGd+fRao6vlLOwFywDDVMp6JuyK7UeUb7I8ekTbSkGFA+l2Oa3O6/
+Y7PYhq7hwwAFuZckYI98IpHNCG1fS9W07FyKdvQbK1PbF1JFRKfsUCWYMKqDnbqE
+o5jivPEHZImw6iYhhXcyEYl8fjcb9T6/S+wOP7aviQGzBBABCAAdFiEElKXJoDwv
+5co7CV2OH99yPPRitrEFAljLv5sACgkQH99yPPRitrFw4gv/XFMFN+/LHsn9hJOP
+4rCwl1yUuxXuYmZgc0sRoY3EpeQkJVyKurQuqqKoy2VuoMiF0O1kAQmGoFtVPUk7
+b8hCoutqB5GyeyKcoLP+WINgVhB2gXg7TSp3MPLBKkgqvSDvPitgRxBqFb4LW8LJ
+bDbfwGrzIvXfDV3WvsrHVPbc2fhlWdL8d+3AE6mFiXF3eTpgmV3ApSBQV12MkkCk
+icLIPmp+ZxZON+OP52ZXkRtfMgOy4Oa/41agrViDAZdMOGeGkhPertQheQZgXzmo
+GF5Wz498HPM80Kv35X91l3iGzL+icEtO+tWea2YscsZ6qpRe2lfVPHk3B+anlmCj
+m4kM4cBd39xa4HHSVh/bRHbZNtgVr7slQCKxlHgQOGVI5vCxPCwEsgJ2KBk03Nk/
+IA9EKO+czfh3/bHW6uMbEqrYDCnt+hmzZrpKDSGcwS/KOhvMUIMlb7/8vDKum6mp
+/8xAtVZ6IAxYZNt3qg7Y7aLRtzCTyqm8rJQrZPtRaQcgLoEimDMEX0PliRYJKwYB
+BAHaRw8BAQdAz75Hlekc16JhhfI0MKdEVxLdkxhcMCO0ZG6WMBAmNpe0H1dlcm5l
+ciBLb2NoIChkaXN0IHNpZ25pbmcgMjAyMCmImgQTFgoAQhYhBG2qbmSnbShAVxtJ
+AlKIl7gmQDraBQJfQ+w1AhsDBQkShccRBQsJCAcCAyICAQYVCgkICwIEFgIDAQIe
+BwIXgAAKCRBSiJe4JkA62nmuAP9uL/HOdB0gvwWrH+FpURJLs4bnaZaPIk9ARrU0
+EXRgJgD/YCGfHQXpIPT0ZaXuwJexK04Z+qMFR/bM1q1Leo5CjgaIbQQQEQsAHRYh
+BIBhWHD1utaQMzaG0PKthaweQrNnBQJfQ/HmAAoJEPKthaweQrNnIZkA3jG6LcZv
+V/URn8Y8OJqsyYa4C3NI4nN+OhEvYhgA4PHzMnALeXIpA2gblvjFIPJPAhDBAU37
+c5PA6+6IdQQQFggAHRYhBK6oTtzwGthsRwHIXGMROuhmWH0KBQJfQ/IlAAoJEGMR
+OuhmWH0K1+MA/0uJ5AHcnSfIBEWHNJwwVVLGyrxAWtS2U+zeymp/UvlPAQDErCLZ
+l0dBiPG3vlowFx5TNep7tanBs6ZJn8F1ao1tAIkBMwQQAQgAHRYhBNhpISPEBl3q
+Xg86tSSbOdJPJeO2BQJfQ/OuAAoJECSbOdJPJeO2DVoH/0o9if66ph6FJrgr+A/W
+HNVeHxmM5tUQhpL1wpRS70SKcsJgolf5CxO5iTQf3HlZe544xGbIU/aCTJsWw9zi
+UE8KmhAtKV4eL/7oQ7xx4nxPnABLpudtM8A44nsM1x/XiYrJnnDm29QjYEGd2Hi8
+7npc7VWKzLoj+I/WcXquynJi5O9TUxW9Bknd1pjpxFkf8v+msjBzCD5VKJgr0CR8
+wA6peQBWeGZX2HacosMIZH4TfL0r0TFla6LJIkNBz9DyIm1yL4L8oRH0950hQljP
+C7TM3L7aRpX+4Kph6llFz6g7MALGFP95kyJ6o+XED9ORuuQVZMBMIkNC0tXOu10V
+bdqIdQQQFgoAHRYhBMHTS2khnkruwLocIeP9/yGORbcrBQJfQ/P8AAoJEOP9/yGO
+Rbcr3lQBAMas8Vl3Hdl3g2I283lz1uHiGvlwcnk2TLeB+U4zIwC9AQCy0nnazVNt
+VQPID1ZCMoaOX7AzOjaqQDLf4j+dVTxgBJgzBGCkgocWCSsGAQQB2kcPAQEHQJmd
+fwp8jEN5P3eEjhQiWk6zQi8utvgOvYD57XmE+H8+tCBOaWliZSBZdXRha2EgKEdu
+dVBHIFJlbGVhc2UgS2V5KYiaBBMWCgBCFiEErI4RW/c+LY1H+pkI6Y6bLRnGyL0F
+AmCkgocCGwMFCQsNBpkFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEOmO
+my0Zxsi9/4IA/1rvSr3MU+Sv4jhNDzD+CeC3gmHkPew6pi9VHEsEwdgmAQD2BtiX
+7w1sJL/CBylGWv5jxj4345mP9YfZm0RsgzPjDIh1BBAWCAAdFiEEJJyzdxdQdF1c
+3TI84mewUjZPAo0FAmFAQ54ACgkQ4mewUjZPAo1CiAD+KTT1UVdQTGHMyvHwZocS
+QjU8xhcZrTet+dvvjrE5+4MA/RBdJPZgFevUKu68NEy0Lo+RbkeCtmQJ/c8v5ieF
+vW0AiQEzBBABCAAdFiEEEkEkvTtIYq96CkLxALRevUynur4FAmFAQ7cACgkQALRe
+vUynur4kaAgAolPR8TNWVS0vXMKrr0k0l2M/8QkZTaLZx1GT9Nx1yb4WJKY7ElPM
+YkhGDxetvFBETx0pH/6R3jtj6Crmur+NKHVSRY+rCYpFPDn6ciIOryssRx2G4kCZ
+t+nFB9JyDbBOZAR8DK4pN1mAxG/yLDt4oKcUQsP2xlEFum+phxyR8KyYCpkwKRxY
+eK+6lfilQuveoUwp/Xx5wXPNUy6q4eOOovCW7gS7I7288NGHCa2ul8sD6vA9C4mM
+4Zxaole9P9wwJe1zZFtCIy88zHM9vqv+YM9DxMCaW24+rUztr7eD4bCRdG+QlSh+
+7R/TaqSxY1eAAd1J5tma9CNJO73pTKU+/JhTBGFpSqMTCSskAwMCCAEBBwIDBF6X
+D9NmUQDgiyYNbhs1DMJ14mIw812wY1HVx/4QWYWiBunhrvSFxVbzsjD7/Wv+v3bm
+MPrL+M2DLyFiSewNmcS0JEdudVBHLmNvbSAoUmVsZWFzZSBTaWduaW5nIEtleSAy
+MDIxKYiaBBMTCABCFiEEAvON/3Mf+XywOaHaVJ5pXpBboggFAmFpSqMCGwMFCQ9x
+14oFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEFSeaV6QW6IITkoA/RYa
+jaTl1eEBU/Gdm12o3jrI55N5xZK2XTqSx25clVyjAP0XwMW/Og5+ND1ri3bAqADV
+WlBDUswz8wYxsb0C4kYBkoh1BBAWCgAdFiEEbapuZKdtKEBXG0kCUoiXuCZAOtoF
+AmFpTvEACgkQUoiXuCZAOtrJQAEAh7YyykjAy/Qs1yC3ji8iBfIVnPXvblrIx3SR
+RyDwRC8BAKtZbEuKTtPlgkLUgMleTcZJ/vEhJE+GvfQ9o5gWCqEFiHUEEBYKAB0W
+IQTB00tpIZ5K7sC6HCHj/f8hjkW3KwUCYWlPWgAKCRDj/f8hjkW3Kx4eAQDp6aGS
+N/fU4xLl8RSvQUVjVA+aCTrMQR3hRwqw8liF2wEA3O3ECxz6e1+DoItYoJBBLKLw
+eiInsGZ/+h5XYrpXTgA=
+=4+Sn
+-----END PGP PUBLIC KEY BLOCK-----

sources

@@ -1,2 +1,2 @@
-SHA512 (gnupg-2.3.4.tar.bz2) = a3cf1c759512ec561c6f01cec72d533fc099dccf8c03b3a3e4a930862ae4c6815ecb856edd41884a65f058b65553cb69519e53e134d652353a7a76144bd99758
-SHA512 (gnupg-2.3.4.tar.bz2.sig) = ec098b74b860cb6f9fbaf526183b3c8bd5d5447ad5cc257cb34f7d4afe2d4f408593d966afb953100516d8496d6540b3f8ff93d82c7ef64d9387a92929f2a4d1
+SHA512 (gnupg-2.4.9.tar.bz2) = 4638016b390a0024fa0cbe14181c43a81991e4275043855397ef099b927985d175d32452fc15b06485623b9292662dd6da464b2e5def8b77b2e4e48a072ab521
+SHA512 (gnupg-2.4.9.tar.bz2.sig) = 03328ba7de3faab1aab025784ef16cc04dd34d2cc09db2c513b7e38836b8036e04d2bb3c71aa64769b5a40a7a877373ee2d11b6e2bf8b67938216277dcd18a6f