Compare commits
25 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
f2a95f7a06 | ||
|
54e33cc697 | ||
|
|
a87272e0d5 | ||
|
7828eb7b24 | ||
|
|
2f367be26a | ||
|
|
ba23154c0f | ||
|
|
3bac11fe78 | ||
|
|
e891bc2f94 | ||
|
|
8e8ab75107 | ||
|
|
359527df11 | ||
|
|
fc686563fd | ||
|
|
f4e60e986b | ||
|
|
845846861c | ||
|
|
6a42ed67ff | ||
|
|
b6bf71035f | ||
|
|
bbbfb951c0 | ||
|
|
7033d05114 | ||
|
23d47e726e | ||
|
a695c22242 | ||
|
|
4857cf6a59 | ||
|
ddad4122e9 |
||
|
|
414fee6ccc | ||
|
|
33ea05e71d | ||
|
|
8821349390 | ||
|
|
2427b24bf8 |
12 changed files with 1265 additions and 826 deletions
|
|
@ -22,7 +22,7 @@ index 2b470ee21..b5a9b43ae 100644
|
|||
--- a/g10/import.c
|
||||
+++ b/g10/import.c
|
||||
@@ -1996,7 +1996,6 @@ import_one_real (ctrl_t ctrl,
|
||||
size_t an;
|
||||
int non_self_or_utk = 0;
|
||||
char pkstrbuf[PUBKEY_STRING_SIZE];
|
||||
int merge_keys_done = 0;
|
||||
- int any_filter = 0;
|
||||
|
|
|
|||
89
0018-Avoid-simple-memory-dumps-via-ptrace.patch
Normal file
89
0018-Avoid-simple-memory-dumps-via-ptrace.patch
Normal file
|
|
@ -0,0 +1,89 @@
|
|||
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
|
||||
Date: Tue, 11 Aug 2015 20:28:26 -0400
|
||||
Subject: Avoid simple memory dumps via ptrace
|
||||
|
||||
This avoids needing to setgid gpg-agent. It probably doesn't defend
|
||||
against all possible attacks, but it defends against one specific (and
|
||||
easy) one. If there are other protections we should do them too.
|
||||
|
||||
This will make it slightly harder to debug the agent because the
|
||||
normal user won't be able to attach gdb to it directly while it runs.
|
||||
|
||||
The remaining options for debugging are:
|
||||
|
||||
* launch the agent from gdb directly
|
||||
* connect gdb to a running agent as the superuser
|
||||
|
||||
Upstream bug: https://dev.gnupg.org/T1211
|
||||
---
|
||||
agent/gpg-agent.c | 8 ++++++++
|
||||
configure.ac | 2 +-
|
||||
scd/scdaemon.c | 9 +++++++++
|
||||
3 files changed, 18 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c
|
||||
index c57fafb..cbe45f0 100644
|
||||
--- a/agent/gpg-agent.c
|
||||
+++ b/agent/gpg-agent.c
|
||||
@@ -48,6 +48,9 @@
|
||||
# include <signal.h>
|
||||
#endif
|
||||
#include <npth.h>
|
||||
+#ifdef HAVE_PRCTL
|
||||
+# include <sys/prctl.h>
|
||||
+#endif
|
||||
|
||||
#define INCLUDED_BY_MAIN_MODULE 1
|
||||
#define GNUPG_COMMON_NEED_AFLOCAL
|
||||
@@ -1088,6 +1091,11 @@ main (int argc, char **argv)
|
||||
|
||||
early_system_init ();
|
||||
|
||||
+#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
|
||||
+ /* Disable ptrace on Linux without sgid bit */
|
||||
+ prctl(PR_SET_DUMPABLE, 0);
|
||||
+#endif
|
||||
+
|
||||
/* Before we do anything else we save the list of currently open
|
||||
file descriptors and the signal mask. This info is required to
|
||||
do the exec call properly. We don't need it on Windows. */
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index ac4f08c..c80bce1 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -1406,7 +1406,7 @@ AC_CHECK_FUNCS([atexit canonicalize_file_name clock_gettime ctermid \
|
||||
ftruncate funlockfile getaddrinfo getenv getpagesize \
|
||||
getpwnam getpwuid getrlimit getrusage gettimeofday \
|
||||
gmtime_r inet_ntop inet_pton isascii lstat memicmp \
|
||||
- memmove memrchr mmap nl_langinfo pipe raise rand \
|
||||
+ memmove memrchr mmap nl_langinfo pipe prctl raise rand \
|
||||
setenv setlocale setrlimit sigaction sigprocmask \
|
||||
stat stpcpy strcasecmp strerror strftime stricmp \
|
||||
strlwr strncasecmp strpbrk strsep strtol strtoul \
|
||||
diff --git a/scd/scdaemon.c b/scd/scdaemon.c
|
||||
index 1a8705b..a3af4bd 100644
|
||||
--- a/scd/scdaemon.c
|
||||
+++ b/scd/scdaemon.c
|
||||
@@ -37,6 +37,9 @@
|
||||
#include <unistd.h>
|
||||
#include <signal.h>
|
||||
#include <npth.h>
|
||||
+#ifdef HAVE_PRCTL
|
||||
+# include <sys/prctl.h>
|
||||
+#endif
|
||||
|
||||
#define INCLUDED_BY_MAIN_MODULE 1
|
||||
#define GNUPG_COMMON_NEED_AFLOCAL
|
||||
@@ -474,6 +477,12 @@ main (int argc, char **argv )
|
||||
const char *application_priority = NULL;
|
||||
|
||||
early_system_init ();
|
||||
+
|
||||
+#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
|
||||
+ /* Disable ptrace on Linux without sgid bit */
|
||||
+ prctl(PR_SET_DUMPABLE, 0);
|
||||
+#endif
|
||||
+
|
||||
gpgrt_set_strusage (my_strusage);
|
||||
gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
|
||||
/* Please note that we may running SUID(ROOT), so be very CAREFUL
|
||||
62
0029-Add-keyboxd-systemd-support.patch
Normal file
62
0029-Add-keyboxd-systemd-support.patch
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
From 3c1fc07ee28a25f32978c6e85af06edc0095593d Mon Sep 17 00:00:00 2001
|
||||
From: NIIBE Yutaka <gniibe@fsij.org>
|
||||
Date: Tue, 22 Aug 2023 15:20:54 +0900
|
||||
Subject: Add keyboxd systemd support
|
||||
|
||||
Forwarded: not-needed
|
||||
Last-Update: 2023-08-22
|
||||
---
|
||||
doc/Makefile.am | 2 ++
|
||||
doc/examples/systemd-user/keyboxd.service | 8 ++++++++
|
||||
doc/examples/systemd-user/keyboxd.socket | 11 +++++++++++
|
||||
3 files changed, 21 insertions(+)
|
||||
create mode 100644 doc/examples/systemd-user/keyboxd.service
|
||||
create mode 100644 doc/examples/systemd-user/keyboxd.socket
|
||||
|
||||
diff --git a/doc/Makefile.am b/doc/Makefile.am
|
||||
index 15127859f..db5847e2e 100644
|
||||
--- a/doc/Makefile.am
|
||||
+++ b/doc/Makefile.am
|
||||
@@ -33,6 +33,8 @@ examples = examples/README examples/scd-event examples/trustlist.txt \
|
||||
examples/systemd-user/gpg-agent-ssh.socket \
|
||||
examples/systemd-user/gpg-agent-browser.socket \
|
||||
examples/systemd-user/gpg-agent-extra.socket \
|
||||
+ examples/systemd-user/keyboxd.service \
|
||||
+ examples/systemd-user/keyboxd.socket \
|
||||
examples/pwpattern.list
|
||||
|
||||
helpfiles = help.txt help.be.txt help.ca.txt help.cs.txt \
|
||||
diff --git a/doc/examples/systemd-user/keyboxd.service b/doc/examples/systemd-user/keyboxd.service
|
||||
new file mode 100644
|
||||
index 000000000..0adc40703
|
||||
--- /dev/null
|
||||
+++ b/doc/examples/systemd-user/keyboxd.service
|
||||
@@ -0,0 +1,8 @@
|
||||
+[Unit]
|
||||
+Description=GnuPG public key management service
|
||||
+Documentation=man:keyboxd(8)
|
||||
+Requires=keyboxd.socket
|
||||
+
|
||||
+[Service]
|
||||
+ExecStart=/usr/libexec/keyboxd --supervised
|
||||
+ExecReload=/usr/bin/gpgconf --reload keyboxd
|
||||
diff --git a/doc/examples/systemd-user/keyboxd.socket b/doc/examples/systemd-user/keyboxd.socket
|
||||
new file mode 100644
|
||||
index 000000000..d4572f1b6
|
||||
--- /dev/null
|
||||
+++ b/doc/examples/systemd-user/keyboxd.socket
|
||||
@@ -0,0 +1,11 @@
|
||||
+[Unit]
|
||||
+Description=GnuPG public key management service
|
||||
+Documentation=man:keyboxd(8)
|
||||
+
|
||||
+[Socket]
|
||||
+ListenStream=%t/gnupg/S.keyboxd
|
||||
+SocketMode=0600
|
||||
+DirectoryMode=0700
|
||||
+
|
||||
+[Install]
|
||||
+WantedBy=sockets.target
|
||||
--
|
||||
2.47.2
|
||||
|
||||
80
0033-Support-large-RSA-keygen-in-non-batch-mode.patch
Normal file
80
0033-Support-large-RSA-keygen-in-non-batch-mode.patch
Normal file
|
|
@ -0,0 +1,80 @@
|
|||
From 5976b75cfd29018fa189375041ebe7d30a7a8432 Mon Sep 17 00:00:00 2001
|
||||
From: Jakub Jelen <jakuje@redhat.com>
|
||||
Date: Tue, 11 Feb 2025 14:44:23 +0100
|
||||
Subject: Support large RSA keygen in non-batch mode
|
||||
|
||||
---
|
||||
doc/gpg.texi | 11 +++++------
|
||||
g10/keygen.c | 2 +-
|
||||
tests/openpgp/quick-key-manipulation.scm | 13 +++++++++++++
|
||||
3 files changed, 19 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/doc/gpg.texi b/doc/gpg.texi
|
||||
index 9ccb74996..a11857235 100644
|
||||
--- a/doc/gpg.texi
|
||||
+++ b/doc/gpg.texi
|
||||
@@ -1543,12 +1543,11 @@ the opposite meaning. The options are:
|
||||
@itemx --disable-large-rsa
|
||||
@opindex enable-large-rsa
|
||||
@opindex disable-large-rsa
|
||||
-With --generate-key and --batch, enable the creation of RSA secret keys as
|
||||
-large as 8192 bit. Note: 8192 bit is more than is generally
|
||||
-recommended. These large keys don't significantly improve security,
|
||||
-but they are more expensive to use, and their signatures and
|
||||
-certifications are larger. This option is only available if the
|
||||
-binary was build with large-secmem support.
|
||||
+Enable the creation of RSA secret keys as large as 8192 bit.
|
||||
+Note: 8192 bit is more than is generally recommended. These large
|
||||
+keys don't significantly improve security, but they are more expensive
|
||||
+to use, and their signatures and certifications are larger. This option
|
||||
+is only available if the binary was build with large-secmem support.
|
||||
|
||||
@item --enable-dsa2
|
||||
@itemx --disable-dsa2
|
||||
diff --git a/g10/keygen.c b/g10/keygen.c
|
||||
index 5d936feab..dec517121 100644
|
||||
--- a/g10/keygen.c
|
||||
+++ b/g10/keygen.c
|
||||
@@ -3022,7 +3022,7 @@ get_keysize_range (int algo, unsigned int *min, unsigned int *max)
|
||||
|
||||
default:
|
||||
*min = opt.compliance == CO_DE_VS ? 2048: 1024;
|
||||
- *max = 4096;
|
||||
+ *max = opt.flags.large_rsa == 1 ? 8192 : 4096;
|
||||
def = 3072;
|
||||
break;
|
||||
}
|
||||
diff --git a/tests/openpgp/quick-key-manipulation.scm b/tests/openpgp/quick-key-manipulation.scm
|
||||
index 71d222a22..37ac708fc 100755
|
||||
--- a/tests/openpgp/quick-key-manipulation.scm
|
||||
+++ b/tests/openpgp/quick-key-manipulation.scm
|
||||
@@ -31,6 +31,14 @@
|
||||
`(--with-fingerprint
|
||||
--list-secret-keys ,(exact id))))))
|
||||
|
||||
+(define (count-8192-keys id)
|
||||
+ (length (filter (lambda (x) (and (string=? "sec" (car x))
|
||||
+ (string=? "8192" (caddr x))))
|
||||
+ (gpg-with-colons
|
||||
+ `(--with-fingerprint
|
||||
+ --list-secret-keys ,(exact id))))))
|
||||
+
|
||||
+(define mega "Mega <mega@invalid.example.net>")
|
||||
(define alpha "Alpha <alpha@invalid.example.net>")
|
||||
(define bravo "Bravo <bravo@invalid.example.net>")
|
||||
(define bravohash "F75B1420CC5881F4005333379355CFF5873094DE")
|
||||
@@ -54,6 +62,11 @@
|
||||
(assert (= 1 (count-uids-of-secret-key alpha)))
|
||||
(assert (not (equal? "" (:expire (assoc "pub" keyinfo)))))
|
||||
|
||||
+(info "Checking quick key generation of large RSA key...")
|
||||
+(call-check `(,@GPG --enable-large-rsa --quick-generate-key ,mega rsa8192))
|
||||
+
|
||||
+(assert (= 1 (count-8192-keys mega)))
|
||||
+
|
||||
(info "Checking that we can add a user ID...")
|
||||
|
||||
;; Make sure the key capabilities don't change when we add a user id.
|
||||
--
|
||||
2.39.5
|
||||
|
||||
716
changelog
Normal file
716
changelog
Normal file
|
|
@ -0,0 +1,716 @@
|
|||
* Wed Apr 22 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.9-7
|
||||
- Make the profile scripts more robust (RHEL-166369)
|
||||
|
||||
* Mon Apr 20 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.9-6
|
||||
- Fix path to keyboxd service (#2458494)
|
||||
|
||||
* Wed Jan 28 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.9-5
|
||||
- Fix CVE-2026-24882: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution
|
||||
|
||||
* Wed Jan 21 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.9-4
|
||||
- Unbreak Release tag to make rpminspect in gating tests happy
|
||||
|
||||
* Wed Jan 21 2026 Jakub Jelen <jjelen@redhat.com> - 2.4.9-3
|
||||
- Update split_min_version to provide clean update path from Fedora 42 (#2429875)
|
||||
|
||||
* Thu Jan 01 2026 Clemens Lang <cllang@redhat.com> - 2.4.9-1
|
||||
- New upstream release 2.4.9
|
||||
- Fixes CVE-2025-68973 (https://gpg.fail/memcpy)
|
||||
- Fixes https://gpg.fail/sha1
|
||||
- Fixes https://gpg.fail/detached
|
||||
|
||||
* Fri Jul 25 2025 Frantisek Krenzelok <fkrenzel@redhat.com> - 2.4.8-4
|
||||
- add a root certificate bundle due to changes in ca-certificates (#2380121)
|
||||
- https://fedoraproject.org/wiki/Changes/dropingOfCertPemFile
|
||||
|
||||
* Wed May 21 2025 Fabio Valentini <decathorpe@gmail.com> - 2.4.8-2
|
||||
- Split tools from monolithic gnupg2 package into subpackages
|
||||
|
||||
* Fri May 16 2025 Jakub Jelen <jjelen@redhat.com> - 2.4.8-1
|
||||
- New upstream release 2.4.8
|
||||
- Remove problematic patch breaking Poppler
|
||||
|
||||
* Wed Mar 26 2025 Jakub Jelen <jjelen@redhat.com> - 2.4.7-3
|
||||
- Pull more patches from FreePG project
|
||||
|
||||
* Thu Jan 23 2025 Jakub Jelen <jjelen@redhat.com> - 2.4.7-2
|
||||
- Regenerate patches and pull new from FreePG project
|
||||
|
||||
* Wed Jan 22 2025 Jakub Jelen <jjelen@redhat.com> - 2.4.7-1
|
||||
- New upstream release
|
||||
|
||||
* Sun Jan 12 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.5-5
|
||||
- Rebuilt for the bin-sbin merge (2nd attempt)
|
||||
|
||||
* Wed Nov 13 2024 Michael J Gruber <mjg@fedoraproject.org> - 2.4.5-4
|
||||
- rebuild against npth-1.8
|
||||
|
||||
* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.4.5-2
|
||||
- Rebuilt for the bin-sbin merge
|
||||
|
||||
* Fri Mar 08 2024 Jakub Jelen <jjelen@redhat.com> - 2.4.5-1
|
||||
- New upstream release (#2268461)
|
||||
|
||||
* Wed Feb 28 2024 Jakub Jelen <jjelen@redhat.com> - 2.4.4-1
|
||||
- Set GPG_TTY in profile.d (#2264985)
|
||||
|
||||
* Fri Jan 26 2024 Jakub Jelen <jjelen@redhat.com> - 2.4.4-1
|
||||
- New upstream release (#2260333)
|
||||
|
||||
* Fri Nov 10 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.3-4
|
||||
- Avoid creation of development versions (#2249037)
|
||||
|
||||
* Mon Nov 06 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.3-3
|
||||
- Restore systemd units and sockets (#2158627)
|
||||
|
||||
* Mon Jul 10 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.3-1
|
||||
- New upstream release (#2193503)
|
||||
|
||||
* Thu Jun 01 2023 Michael J Gruber <mjg@fedoraproject.org> - 2.4.2-2
|
||||
- fix emacs usage (rhbz#2212090)
|
||||
|
||||
* Wed May 31 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.2-1
|
||||
- New upstream release
|
||||
- Build with TPM2 support
|
||||
|
||||
* Fri Apr 28 2023 Todd Zullinger <tmz@pobox.com> - 2.4.1-1
|
||||
- update to 2.4.1 (#2193503)
|
||||
|
||||
* Fri Apr 28 2023 Todd Zullinger <tmz@pobox.com> - 2.4.0-4
|
||||
- remove %%skip_verify, brainpool signatures are supported now
|
||||
|
||||
* Fri Mar 03 2023 Jakub Jelen <jjelen@redhat.com> - 2.4.0-3
|
||||
- Revert introduction of the RFC4880bis draft into defaults
|
||||
|
||||
* Tue Dec 20 2022 Todd Zullinger <tmz@pobox.com> - 2.4.0-1
|
||||
- update to 2.4.0 (#2155170)
|
||||
|
||||
* Mon Oct 17 2022 Todd Zullinger <tmz@pobox.com> - 2.3.8-1
|
||||
- update to 2.3.8
|
||||
- BR systemd-rpm-macros for %%{_userunitdir}
|
||||
|
||||
* Mon Oct 17 2022 Todd Zullinger <tmz@pobox.com> - 2.3.7-5
|
||||
- verify upstream signatures in %%prep, unless bootstrapping
|
||||
|
||||
* Wed Oct 05 2022 Todd Zullinger <tmz@pobox.com> - 2.3.7-4
|
||||
- update BR/R versions for libassuan, libgpg-error, and libksba
|
||||
- drop with/without unversioned_gpg, last used with fedora-29
|
||||
|
||||
* Mon Aug 01 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.7-3
|
||||
- Fix yubikey 5 detection (#2107766)
|
||||
|
||||
* Tue Jul 12 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.7-1
|
||||
- New upstream release (#2106045)
|
||||
|
||||
* Mon Jul 04 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.6-2
|
||||
- Fix for CVE-2022-34903 (#2103242)
|
||||
- Fix focing AEAD through configuration files (#2093760)
|
||||
|
||||
* Mon Apr 25 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.6-1
|
||||
- New upstream release (#2078550)
|
||||
|
||||
* Mon Apr 25 2022 Jakub Jelen <jjelen@redhat.com> - 2.3.5-1
|
||||
- New upstream release (#2077616)
|
||||
|
||||
* Tue Dec 21 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.4-1
|
||||
- New upstream release (#2034437)
|
||||
|
||||
* Mon Nov 15 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.3-2
|
||||
- Fix file-is-digest patch (#2022904)
|
||||
|
||||
* Wed Oct 13 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.3-1
|
||||
- New upstream release (2013388)
|
||||
|
||||
* Wed Oct 06 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.2-3
|
||||
- Fix crash in agent when deciphering (#2009978)
|
||||
- Recommend pcsc-lite-ccid to support USB smart cards (#2007923)
|
||||
|
||||
* Mon Sep 20 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.2-2
|
||||
- Disable ccid driver to avoid clash with pcscd (#2005714)
|
||||
|
||||
* Wed Aug 25 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.2-1
|
||||
- New upstream relase (#1997276)
|
||||
|
||||
* Wed Apr 21 2021 Jakub Jelen <jjelen@redhat.com> - 2.3.1-1
|
||||
- New upstream release (#1947159)
|
||||
|
||||
* Mon Mar 29 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.27-4
|
||||
- Add a configuration to not require exclusive access to PCSC
|
||||
|
||||
* Thu Feb 18 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.27-3
|
||||
- Bump required libgpg-error version (#1930110)
|
||||
|
||||
* Tue Jan 12 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.27-1
|
||||
- New upstream release (#1909825)
|
||||
|
||||
* Mon Jan 04 2021 Jakub Jelen <jjelen@redhat.com> - 2.2.26-1
|
||||
- New upstream release (#1909825)
|
||||
|
||||
* Tue Nov 24 2020 Jakub Jelen <jjelen@redhat.com> - 2.2.25-2
|
||||
- Enable gpgtar (#1901103)
|
||||
|
||||
* Tue Nov 24 2020 Jakub Jelen <jjelen@redhat.com> - 2.2.25-1
|
||||
- Update to 2.2.25 (#1900815)
|
||||
|
||||
* Thu Nov 19 2020 Jakub Jelen <jjelen@redhat.com> - 2.2.24-1
|
||||
- Update to 2.2.24 (#1898504)
|
||||
|
||||
* Fri Sep 4 2020 Tomáš Mráz <tmraz@redhat.com> - 2.2.23-1
|
||||
- upgrade to 2.2.23
|
||||
|
||||
* Tue Jul 21 2020 Tom Stellard <tstellar@redhat.com> - 2.2.21-2
|
||||
- Use make macros
|
||||
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
|
||||
|
||||
* Mon Jul 20 2020 Tomáš Mráz <tmraz@redhat.com> - 2.2.21-1
|
||||
- upgrade to 2.2.21
|
||||
|
||||
* Mon May 4 2020 Tomáš Mráz <tmraz@redhat.com> - 2.2.20-3
|
||||
- fixes for issues found in Coverity scan
|
||||
|
||||
* Thu Apr 30 2020 Tomáš Mráz <tmraz@redhat.com> - 2.2.20-2
|
||||
- move systemd user units to _userunitdir (no activation by default)
|
||||
|
||||
* Tue Apr 14 2020 Tomáš Mráz <tmraz@redhat.com> - 2.2.20-1
|
||||
- upgrade to 2.2.20
|
||||
|
||||
* Wed Jan 29 2020 Tomáš Mráz <tmraz@redhat.com> - 2.2.19-1
|
||||
- upgrade to 2.2.19
|
||||
|
||||
* Sat Jan 4 2020 Marcel Härry <mh+fedora@scrit.ch> - 2.2.18-3
|
||||
- Add patches to be able to deal with keys without uids (#1787708)
|
||||
|
||||
* Fri Dec 6 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.18-2
|
||||
- fix abort when decrypting data with anonymous recipient (#1780057)
|
||||
|
||||
* Tue Dec 3 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.18-1
|
||||
- upgrade to 2.2.18
|
||||
|
||||
* Wed Nov 6 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.17-3
|
||||
- fix the gnupg(7) manual page (#1769072)
|
||||
|
||||
* Mon Jul 15 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.17-1
|
||||
- upgrade to 2.2.17
|
||||
|
||||
* Mon Jul 1 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.16-1
|
||||
- upgrade to 2.2.16
|
||||
|
||||
* Tue Feb 26 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.13-1
|
||||
- upgrade to 2.2.13
|
||||
|
||||
* Sun Feb 17 2019 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.2.12-3
|
||||
- Rebuild for readline 8.0
|
||||
|
||||
* Mon Feb 4 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.12-2
|
||||
- make it build with gcc-9
|
||||
|
||||
* Tue Jan 8 2019 Tomáš Mráz <tmraz@redhat.com> - 2.2.12-1
|
||||
- upgrade to 2.2.12
|
||||
|
||||
* Sat Dec 08 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 2.2.11-2
|
||||
- Provide unversioned GPG on F30+
|
||||
|
||||
* Fri Nov 30 2018 Tomáš Mráz <tmraz@redhat.com> - 2.2.11-1
|
||||
- upgrade to 2.2.11
|
||||
|
||||
* Wed Aug 1 2018 Tomáš Mráz <tmraz@redhat.com> - 2.2.9-1
|
||||
- upgrade to 2.2.9
|
||||
|
||||
* Mon Jun 11 2018 Tomáš Mráz <tmraz@redhat.com> - 2.2.8-1
|
||||
- upgrade to 2.2.8 fixing CVE 2018-12020
|
||||
|
||||
* Wed Apr 11 2018 Tomáš Mráz <tmraz@redhat.com> - 2.2.6-1
|
||||
- upgrade to 2.2.6
|
||||
|
||||
* Fri Mar 2 2018 Tomáš Mráz <tmraz@redhat.com> - 2.2.5-1
|
||||
- upgrade to 2.2.5
|
||||
|
||||
* Fri Jan 12 2018 Tomáš Mráz <tmraz@redhat.com> - 2.2.4-1
|
||||
- upgrade to 2.2.4
|
||||
|
||||
* Tue Nov 21 2017 Tomáš Mráz <tmraz@redhat.com> - 2.2.3-1
|
||||
- upgrade to 2.2.3
|
||||
|
||||
* Wed Nov 8 2017 Tomáš Mráz <tmraz@redhat.com> - 2.2.2-1
|
||||
- upgrade to 2.2.2
|
||||
|
||||
* Tue Oct 3 2017 Tomáš Mráz <tmraz@redhat.com> - 2.2.1-1
|
||||
- upgrade to 2.2.1
|
||||
|
||||
* Tue Sep 5 2017 Tomáš Mráz <tmraz@redhat.com> - 2.2.0-1
|
||||
- upgrade to 2.2.0
|
||||
|
||||
* Wed Aug 9 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.22-1
|
||||
- upgrade to 2.1.22
|
||||
|
||||
* Fri Jul 28 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.21-4
|
||||
- explictly remove gpgscm from the buildroot
|
||||
|
||||
* Tue Jul 18 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.21-3
|
||||
- rebase the insttools patch
|
||||
- enable large secure memory support
|
||||
|
||||
* Tue May 16 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.21-2
|
||||
- scdaemon is now needed by gpg
|
||||
|
||||
* Tue May 16 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.21-1
|
||||
- upgrade to 2.1.21
|
||||
|
||||
* Tue Apr 25 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.20-2
|
||||
- libdns aliasing issues fixed
|
||||
|
||||
* Mon Apr 24 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.20-1
|
||||
- upgrade to 2.1.20
|
||||
- disable bundled libdns for now (#1444352)
|
||||
|
||||
* Fri Mar 24 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.19-1
|
||||
- upgrade to 2.1.19
|
||||
- shorten time waiting on gpg-agent/dirmngr to start by exponential
|
||||
backoff (#1431749)
|
||||
|
||||
* Wed Mar 1 2017 Tomáš Mráz <tmraz@redhat.com> - 2.1.18-2
|
||||
- upgrade to 2.1.18
|
||||
|
||||
* Thu Jan 12 2017 Igor Gnatenko <ignatenko@redhat.com> - 2.1.17-2
|
||||
- Rebuild for readline 7.x
|
||||
|
||||
* Thu Dec 22 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.17-1
|
||||
- upgrade to 2.1.17
|
||||
|
||||
* Mon Nov 28 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.16-1
|
||||
- upgrade to 2.1.16
|
||||
|
||||
* Mon Aug 22 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.13-2
|
||||
- avoid using libgcrypt without initialization (#1366909)
|
||||
|
||||
* Tue Jul 12 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.13-1
|
||||
- upgrade to 2.1.13
|
||||
|
||||
* Thu May 5 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.12-1
|
||||
- upgrade to 2.1.12
|
||||
|
||||
* Tue Apr 12 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.11-4
|
||||
- make the pinentry dependency weak as for the public-key operations it
|
||||
is not needed (#1324595)
|
||||
|
||||
* Mon Mar 7 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.11-3
|
||||
- add recommends weak dependency for gnupg2-smime
|
||||
|
||||
* Sat Mar 5 2016 Peter Robinson <pbrobinson@fedoraproject.org> 2.1.11-2
|
||||
- Don't ship ChangeLog, core details already covered in NEWS
|
||||
|
||||
* Tue Feb 16 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.11-1
|
||||
- upgrade to 2.1.11
|
||||
|
||||
* Wed Jan 13 2016 Dan Horák <dan[at]danny.cz> - 2.1.10-3
|
||||
- fix the insttools patch
|
||||
|
||||
* Wed Jan 13 2016 Tomáš Mráz <tmraz@redhat.com> - 2.1.10-2
|
||||
- rebase the insttools patch needed for full gpgv1 replacement
|
||||
|
||||
* Mon Dec 7 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.10-1
|
||||
- upgrade to 2.1.10
|
||||
|
||||
* Mon Oct 12 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.9-1
|
||||
- upgrade to 2.1.9
|
||||
|
||||
* Fri Sep 11 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.8-1
|
||||
- upgrade to 2.1.8
|
||||
|
||||
* Thu Aug 13 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.7-1
|
||||
- upgrade to 2.1.7
|
||||
|
||||
* Tue Aug 11 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.6-1
|
||||
- upgrade to 2.1.6
|
||||
|
||||
* Fri Jun 12 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.5-1
|
||||
- upgrade to 2.1.5
|
||||
|
||||
* Tue May 26 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.4-2
|
||||
- use gnutls for TLS support in dirmngr (#1224816)
|
||||
|
||||
* Fri May 15 2015 Robert Scheck <robert@fedoraproject.org> - 2.1.4-1
|
||||
- upgrade to 2.1.4 (#1192353)
|
||||
|
||||
* Thu Apr 16 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.3-1
|
||||
- new upstream release fixing minor bugs
|
||||
|
||||
* Sat Feb 21 2015 Till Maas <opensource@till.name> - 2.1.2-2
|
||||
- Rebuilt for Fedora 23 Change
|
||||
https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code
|
||||
|
||||
* Wed Feb 18 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.2-1
|
||||
- new upstream release fixing two minor security issues
|
||||
|
||||
* Fri Jan 30 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.1-2
|
||||
- resolve conflict with gnupg by renaming conflicting manual page (#1187472)
|
||||
|
||||
* Thu Jan 29 2015 Tomáš Mráz <tmraz@redhat.com> - 2.1.1-1
|
||||
- new upstream release
|
||||
- this release now includes the dirmngr which is obsoleted as separate package
|
||||
|
||||
* Tue Aug 5 2014 Tomáš Mráz <tmraz@redhat.com> - 2.0.25-1
|
||||
- new upstream release fixing a minor regression introduced by the previous one
|
||||
- add --file-is-digest option needed for copr
|
||||
|
||||
* Sat Jul 12 2014 Tom Callaway <spot@fedoraproject.org> - 2.0.24-2
|
||||
- fix license handling
|
||||
|
||||
* Wed Jun 25 2014 Tomáš Mráz <tmraz@redhat.com> - 2.0.24-1
|
||||
- new upstream release fixing CVE-2014-4617
|
||||
|
||||
* Wed May 7 2014 Tomáš Mráz <tmraz@redhat.com> - 2.0.22-3
|
||||
- do not dump core if hash algorithm not available in the FIPS mode
|
||||
|
||||
* Tue Mar 4 2014 Tomáš Mráz <tmraz@redhat.com> - 2.0.22-2
|
||||
- rebuilt against new libgcrypt
|
||||
|
||||
* Tue Oct 8 2013 Tomáš Mráz <tmraz@redhat.com> - 2.0.22-1
|
||||
- new upstream release fixing CVE-2013-4402
|
||||
|
||||
* Fri Aug 23 2013 Tomáš Mráz <tmraz@redhat.com> - 2.0.21-1
|
||||
- new upstream release
|
||||
|
||||
* Wed Aug 7 2013 Tomas Mraz <tmraz@redhat.com> - 2.0.20-3
|
||||
- adjust to the unversioned docdir change (#993785)
|
||||
|
||||
* Wed May 15 2013 Tomas Mraz <tmraz@redhat.com> - 2.0.20-1
|
||||
- new upstream release
|
||||
|
||||
* Wed Jan 2 2013 Tomas Mraz <tmraz@redhat.com> - 2.0.19-7
|
||||
- fix CVE-2012-6085 - skip invalid key packets (#891142)
|
||||
|
||||
* Thu Nov 22 2012 Tomas Mraz <tmraz@redhat.com> - 2.0.19-6
|
||||
- use AES as default crypto algorithm in FIPS mode (#879047)
|
||||
|
||||
* Fri Nov 16 2012 Jamie Nguyen <jamielinux@fedoraproject.org> - 2.0.19-5
|
||||
- rebuild for <f18 (#877106)
|
||||
|
||||
* Fri Jul 27 2012 Tomas Mraz <tmraz@redhat.com> - 2.0.19-4
|
||||
- fix negated condition (#843842)
|
||||
|
||||
* Thu Jul 26 2012 Tomas Mraz <tmraz@redhat.com> - 2.0.19-3
|
||||
- add compat symlinks and provides if built on RHEL
|
||||
|
||||
* Tue Apr 24 2012 Tomas Mraz <tmraz@redhat.com> - 2.0.19-1
|
||||
- new upstream release
|
||||
- set environment in protect-tool (#548528)
|
||||
- do not reject OCSP signing certs without keyUsage (#720174)
|
||||
|
||||
* Wed Oct 12 2011 Rex Dieter <rdieter@fedoraproject.org> 2.0.18-2
|
||||
- build with --enable-standard-socket
|
||||
|
||||
* Wed Aug 17 2011 Tomas Mraz <tmraz@redhat.com> - 2.0.18-1
|
||||
- new upstream release (#728481)
|
||||
|
||||
* Mon Jul 25 2011 Tomas Mraz <tmraz@redhat.com> - 2.0.17-2
|
||||
- fix a bug that shows up with the new libgcrypt release (#725369)
|
||||
|
||||
* Thu Jan 20 2011 Tomas Mraz <tmraz@redhat.com> - 2.0.17-1
|
||||
- new upstream release (#669611)
|
||||
|
||||
* Tue Aug 17 2010 Tomas Mraz <tmraz@redhat.com> - 2.0.16-3
|
||||
- drop the provides/obsoletes for gnupg
|
||||
- drop the man page file conflicting with gnupg-1.x
|
||||
|
||||
* Fri Aug 13 2010 Tomas Mraz <tmraz@redhat.com> - 2.0.16-2
|
||||
- drop the compat symlinks as gnupg-1.x is revived
|
||||
|
||||
* Tue Jul 27 2010 Rex Dieter <rdieter@fedoraproject.org> - 2.0.16-1
|
||||
- gnupg-2.0.16
|
||||
|
||||
* Fri Jul 23 2010 Rex Dieter <rdieter@fedoraproject.org> - 2.0.14-4
|
||||
- gpgsm realloc patch (#617706)
|
||||
|
||||
* Fri Jun 18 2010 Tomas Mraz <tmraz@redhat.com> - 2.0.14-3
|
||||
- initialize small amount of secmem for list of algorithms in help (#598847)
|
||||
(necessary in the FIPS mode of libgcrypt)
|
||||
|
||||
* Tue Feb 9 2010 Tomas Mraz <tmraz@redhat.com> - 2.0.14-2
|
||||
- disable selinux support - it is too rudimentary and restrictive (#562982)
|
||||
|
||||
* Mon Jan 11 2010 Tomas Mraz <tmraz@redhat.com> - 2.0.14-1
|
||||
- new upstream version
|
||||
- fix a few tests so they do not need to execute gpg-agent
|
||||
|
||||
* Tue Dec 8 2009 Michael Schwendt <mschwendt@fedoraproject.org> - 2.0.13-4
|
||||
- Explicitly BR libassuan-static in accordance with the Packaging
|
||||
Guidelines (libassuan-devel is still static-only).
|
||||
|
||||
* Fri Oct 23 2009 Tomas Mraz <tmraz@redhat.com> - 2.0.13-3
|
||||
- drop s390 specific ifnarchs as all the previously missing dependencies
|
||||
are now there
|
||||
- split out gpgsm into a smime subpackage to reduce main package dependencies
|
||||
|
||||
* Wed Oct 21 2009 Tomas Mraz <tmraz@redhat.com> - 2.0.13-2
|
||||
- provide/obsolete gnupg-1 and add compat symlinks to be able to drop
|
||||
gnupg-1
|
||||
|
||||
* Fri Sep 04 2009 Rex Dieter <rdieter@fedoraproject.org> - 2.0.13-1
|
||||
- gnupg-2.0.13
|
||||
- Unable to use gpg-agent + input methods (#228953)
|
||||
|
||||
* Wed Jun 17 2009 Rex Dieter <rdieter@fedoraproject.org> - 2.0.12-1
|
||||
- gnupg-2.0.12
|
||||
|
||||
* Wed Mar 04 2009 Rex Dieter <rdieter@fedoraproject.org> - 2.0.11-1
|
||||
- gnupg-2.0.11
|
||||
|
||||
* Sat Jan 31 2009 Karsten Hopp <karsten@redhat.com> 2.0.10-1
|
||||
- don't require pcsc-lite-libs and libusb on mainframe where
|
||||
we don't have those packages as there's no hardware for that
|
||||
|
||||
* Tue Jan 13 2009 Rex Dieter <rdieter@fedoraproject.org> 2.0.10-1
|
||||
- gnupg-2.0.10
|
||||
|
||||
* Mon Aug 04 2008 Rex Dieter <rdieter@fedoraproject.org> 2.0.9-3
|
||||
- workaround rpm quirks
|
||||
|
||||
* Sat May 24 2008 Tom "spot" Callaway <tcallawa@redhat.com> 2.0.9-2
|
||||
- Patch from upstream to fix curl 7.18.1+ and gcc4.3+ compile error
|
||||
|
||||
* Mon May 19 2008 Tom "spot" Callaway <tcallawa@redhat.com> 2.0.9-1.1
|
||||
- minor release bump for sparc rebuild
|
||||
|
||||
* Wed Mar 26 2008 Rex Dieter <rdieter@fedoraproject.org> 2.0.9-1
|
||||
- gnupg2-2.0.9
|
||||
- drop Provides: openpgp
|
||||
- versioned Provides: gpg
|
||||
- own %%_sysconfdir/gnupg
|
||||
|
||||
* Fri Feb 08 2008 Rex Dieter <rdieter@fedoraproject.org> 2.0.8-3
|
||||
- respin (gcc43)
|
||||
|
||||
* Wed Jan 23 2008 Rex Dieter <rdieter@fedoraproject.org> 2.0.8-2
|
||||
- avoid kde-filesystem dep (#427316)
|
||||
|
||||
* Thu Dec 20 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.8-1
|
||||
- gnupg2-2.0.8
|
||||
|
||||
* Mon Dec 17 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.8-0.1.rc1
|
||||
- gnupg2-2.0.8rc1
|
||||
|
||||
* Tue Dec 04 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.7-5
|
||||
- respin for openldap
|
||||
|
||||
* Mon Nov 12 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.7-4
|
||||
- Requires: kde-filesystem (#377841)
|
||||
|
||||
* Wed Oct 03 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.7-3
|
||||
- %%build: (re)add mkdir -p $HOME/.gnupg
|
||||
|
||||
* Wed Oct 03 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.7-2
|
||||
- Requires: dirmngr (#312831)
|
||||
|
||||
* Mon Sep 10 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.7-1
|
||||
- gnupg-2.0.7
|
||||
|
||||
* Fri Aug 24 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.6-2
|
||||
- respin (libassuan)
|
||||
|
||||
* Thu Aug 16 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.6-1
|
||||
- gnupg-2.0.6
|
||||
- License: GPLv3+
|
||||
|
||||
* Thu Aug 02 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.5-4
|
||||
- License: GPLv3
|
||||
|
||||
* Mon Jul 16 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.5-3
|
||||
- 2.0.5 too many open files fix
|
||||
|
||||
* Fri Jul 06 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.5-2
|
||||
- gnupg-2.0.5
|
||||
- gpg-agent not restarted after kde session crash/killed (#196327)
|
||||
- BR: libassuan-devel > 1.0.2, libksba-devel > 1.0.2
|
||||
|
||||
* Fri May 18 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.4-1
|
||||
- gnupg-2.0.4
|
||||
|
||||
* Thu Mar 08 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.3-1
|
||||
- gnupg-2.0.3
|
||||
|
||||
* Fri Feb 02 2007 Rex Dieter <rdieter[AT]fedoraproject.org> 2.0.2-1
|
||||
- gnupg-2.0.2
|
||||
|
||||
* Wed Dec 06 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.1-2
|
||||
- CVE-2006-6235 (#219934)
|
||||
|
||||
* Wed Nov 29 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.1-1
|
||||
- gnupg-2.0.1
|
||||
- CVE-2006-6169 (#217950)
|
||||
|
||||
* Sat Nov 25 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.1-0.3.rc1
|
||||
- gnupg-2.0.1rc1
|
||||
|
||||
* Thu Nov 16 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.0-4
|
||||
- update %%description
|
||||
- drop dearmor patch
|
||||
|
||||
* Mon Nov 13 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.0-3
|
||||
- BR: libassuan-static >= 1.0.0
|
||||
|
||||
* Mon Nov 13 2006 Rex Dieter <rexdieter[AT]users.sf.net> 2.0.0-2
|
||||
- gnupg-2.0.0
|
||||
|
||||
* Fri Nov 10 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.95-3
|
||||
- upstream 64bit patch
|
||||
|
||||
* Mon Nov 06 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.95-2
|
||||
- fix (more) file conflicts with gnupg
|
||||
|
||||
* Mon Nov 06 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.95-1
|
||||
- 1.9.95
|
||||
|
||||
* Wed Oct 25 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.94-1
|
||||
- 1.9.94
|
||||
|
||||
* Wed Oct 18 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.93-1
|
||||
- 1.9.93
|
||||
|
||||
* Wed Oct 11 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.92-2
|
||||
- fix file conflicts with gnupg
|
||||
|
||||
* Wed Oct 11 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.92-1
|
||||
- 1.9.92
|
||||
|
||||
* Tue Oct 10 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.91-4
|
||||
- make check ||: (apparently checks return err even on success?)
|
||||
|
||||
* Tue Oct 10 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.91-3
|
||||
- --enable-selinux-support
|
||||
- x86_64: --disable-optimization (to avoid gpg2 segfaults), for now
|
||||
|
||||
* Thu Oct 05 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.91-1
|
||||
- 1.9.91
|
||||
|
||||
* Wed Oct 04 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.22-8
|
||||
- respin
|
||||
|
||||
* Tue Sep 26 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.90-1
|
||||
- 1.9.90 (doesn't build, not released)
|
||||
|
||||
* Mon Sep 18 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.23-1
|
||||
- 1.9.23 (doesn't build, not released)
|
||||
|
||||
* Mon Sep 18 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.22-7
|
||||
- gpg-agent-startup.sh: fix case where valid .gpg-agent-info exists
|
||||
|
||||
* Mon Sep 18 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.22-6
|
||||
- fix "syntax error in gpg-agent-startup.sh" (#206887)
|
||||
|
||||
* Thu Sep 07 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.22-3
|
||||
- fc6 respin (for libksba-1.0)
|
||||
|
||||
* Tue Aug 29 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.22-2
|
||||
- fc6 respin
|
||||
|
||||
* Fri Jul 28 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.22-1
|
||||
- 1.9.22
|
||||
|
||||
* Thu Jun 22 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.21-3
|
||||
- fix "gpg-agent not restarted after kde session crash/killed (#196327)
|
||||
|
||||
* Thu Jun 22 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.21-2
|
||||
- 1.9.21
|
||||
- omit gpg2 binary to address CVS-2006-3082 (#196190)
|
||||
|
||||
* Mon Mar 6 2006 Ville Skyttä <ville.skytta at iki.fi>> 1.9.20-3
|
||||
- Don't hardcode pcsc-lite lib name (#184123)
|
||||
|
||||
* Thu Feb 16 2006 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.20-2
|
||||
- fc4+: use /etc/kde/(env|shutdown) for scripts (#175744)
|
||||
|
||||
* Fri Feb 10 2006 Rex Dieter <rexdieter[AT]users.sf.net>
|
||||
- fc5: gcc/glibc respin
|
||||
|
||||
* Tue Dec 20 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.20-1
|
||||
- 1.9.20
|
||||
|
||||
* Thu Dec 01 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.19-8
|
||||
- include gpg-agent-(startup|shutdown) scripts (#136533)
|
||||
- BR: libksba-devel >= 1.9.12
|
||||
- %%check: be permissive about failures (for now)
|
||||
|
||||
* Wed Nov 30 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.19-3
|
||||
- BR: libksba-devel >= 1.9.13
|
||||
|
||||
* Tue Oct 11 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.19-2
|
||||
- back to BR: libksba-devel = 1.9.11
|
||||
|
||||
* Tue Oct 11 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.19-1
|
||||
- 1.9.19
|
||||
|
||||
* Fri Aug 26 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.18-9
|
||||
- configure: NEED_KSBA_VERSION=0.9.12 -> 0.9.11
|
||||
|
||||
* Fri Aug 26 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.18-7
|
||||
- re-enable 'make check', rebuild against (older) libksba-0.9.11
|
||||
|
||||
* Tue Aug 9 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.18-6
|
||||
- don't 'make check' by default (regular builds pass, but FC4/5+plague fails)
|
||||
|
||||
* Mon Aug 8 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.18-5
|
||||
- 1.9.18
|
||||
- drop pth patch (--enable-gpg build fixed)
|
||||
- update description (from README)
|
||||
|
||||
* Fri Jul 1 2005 Ville Skyttä <ville.skytta at iki.fi> - 1.9.17-1
|
||||
- 1.9.17, signal info patch applied upstream (#162264).
|
||||
- Patch to fix lvalue build error with gcc4 (upstream #485).
|
||||
- Patch scdaemon and pcsc-wrapper to load the versioned (non-devel)
|
||||
pcsc-lite lib by default.
|
||||
|
||||
* Fri May 13 2005 Michael Schwendt <mschwendt[AT]users.sf.net> - 1.9.16-3
|
||||
- Include upstream's patch for signal.c.
|
||||
|
||||
* Tue May 10 2005 Michael Schwendt <mschwendt[AT]users.sf.net> - 1.9.16-1
|
||||
- Merge changes from Rex's 1.9.16-1 (Thu Apr 21):
|
||||
- opensc support unconditional
|
||||
- remove hard-coded .gz from %%post/%%postun
|
||||
- add %%check section
|
||||
- add pth patch
|
||||
- Put back patch modified from 1.9.15-4 to make tests verbose
|
||||
and change signal.c to describe received signals better.
|
||||
|
||||
* Sun May 8 2005 Michael Schwendt <mschwendt[AT]users.sf.net>
|
||||
- Drop patch0 again.
|
||||
|
||||
* Sun May 8 2005 Michael Schwendt <mschwendt[AT]users.sf.net> - 1.9.15-4
|
||||
- Add patch0 temporarily to get some output from failing test.
|
||||
|
||||
* Sat May 7 2005 David Woodhouse <dwmw2@infradead.org> 1.9.15-3
|
||||
- Rebuild.
|
||||
|
||||
* Thu Apr 7 2005 Michael Schwendt <mschwendt[AT]users.sf.net>
|
||||
- rebuilt
|
||||
|
||||
* Tue Feb 1 2005 Michael Schwendt <mschwendt[AT]users.sf.net> - 0:1.9.15-1
|
||||
- Make install-info in scriptlets less noisy.
|
||||
|
||||
* Tue Jan 18 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.15-0.fdr.1
|
||||
- 1.9.15
|
||||
|
||||
* Fri Jan 07 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.14-0.fdr.2
|
||||
- note patch/hack to build against older ( <1.0) libgpg-error-devel
|
||||
|
||||
* Thu Jan 06 2005 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.14-0.fdr.1
|
||||
- 1.9.14
|
||||
- enable opensc support
|
||||
- BR: libassuan-devel >= 0.6.9
|
||||
|
||||
* Thu Oct 21 2004 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.11-0.fdr.4
|
||||
- remove suid.
|
||||
|
||||
* Thu Oct 21 2004 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.11-0.fdr.3
|
||||
- remove Provides: newpg
|
||||
|
||||
* Wed Oct 20 2004 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.11-0.fdr.2
|
||||
- Requires: pinentry
|
||||
- gpg2 suid
|
||||
- update description
|
||||
|
||||
* Tue Oct 19 2004 Rex Dieter <rexdieter[AT]users.sf.net> 1.9.11-0.fdr.1
|
||||
- first try
|
||||
- leave out opensc support (for now), enable --with-opensc
|
||||
|
||||
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
diff -up gnupg-2.4.7/g10/keygen.c.large-rsa gnupg-2.4.7/g10/keygen.c
|
||||
--- gnupg-2.4.7/g10/keygen.c.large-rsa 2024-11-08 09:03:38.000000000 +0100
|
||||
+++ gnupg-2.4.7/g10/keygen.c 2025-01-23 18:19:13.141959875 +0100
|
||||
@@ -2636,7 +2636,7 @@ get_keysize_range (int algo, unsigned in
|
||||
|
||||
default:
|
||||
*min = opt.compliance == CO_DE_VS ? 2048: 1024;
|
||||
- *max = 4096;
|
||||
+ *max = opt.flags.large_rsa == 1 ? 8192 : 4096;
|
||||
def = 3072;
|
||||
break;
|
||||
}
|
||||
11
gnupg-2.4.8-ca-certificates-bundle.patch
Normal file
11
gnupg-2.4.8-ca-certificates-bundle.patch
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
diff -up ./dirmngr/certcache.c.certbundle ./dirmngr/certcache.c
|
||||
--- ./dirmngr/certcache.c.certbundle 2025-07-25 09:02:24.354664993 +0200
|
||||
+++ ./dirmngr/certcache.c 2025-07-25 09:03:10.639991559 +0200
|
||||
@@ -705,6 +705,7 @@ load_certs_from_system (void)
|
||||
#ifdef DEFAULT_TRUST_STORE_FILE
|
||||
{ DEFAULT_TRUST_STORE_FILE }
|
||||
#else
|
||||
+ { "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem" },
|
||||
{ "/etc/ssl/ca-bundle.pem" },
|
||||
{ "/etc/ssl/certs/ca-certificates.crt" },
|
||||
{ "/etc/pki/tls/cert.pem" },
|
||||
62
gnupg-2.4.9-tpm2daemon.patch
Normal file
62
gnupg-2.4.9-tpm2daemon.patch
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
From 93fa34d9a346020355cd51d54102d30d4f177323 Mon Sep 17 00:00:00 2001
|
||||
From: Werner Koch <wk@gnupg.org>
|
||||
Date: Mon, 26 Jan 2026 11:13:44 +0100
|
||||
Subject: [PATCH] tpm: Fix possible buffer overflow in PKDECRYPT
|
||||
|
||||
* tpm2d/tpm2.c (tpm2_ecc_decrypt): Bail out on too long CIPHERTEXT.
|
||||
(tpm2_rsa_decrypt): Ditto.
|
||||
--
|
||||
|
||||
GnuPG-bug-id: 8045
|
||||
Co-authored-by: NIIBE Yutaka <gniibe@fsij.org>
|
||||
Reported-by: OpenAI Security Research
|
||||
---
|
||||
tpm2d/tpm2.c | 22 +++++++++++++++++++++-
|
||||
1 file changed, 21 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/tpm2d/tpm2.c b/tpm2d/tpm2.c
|
||||
index a4677fb98..282de5e5d 100644
|
||||
--- a/tpm2d/tpm2.c
|
||||
+++ b/tpm2d/tpm2.c
|
||||
@@ -951,10 +951,20 @@ tpm2_ecc_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
|
||||
size_t len;
|
||||
int ret;
|
||||
|
||||
+#if defined(TPM2_MAX_ECC_KEY_BYTES) /* Intel stack */
|
||||
+ if (ciphertext_len > 2*TPM2_MAX_ECC_KEY_BYTES + 1)
|
||||
+ return GPG_ERR_TOO_LARGE;
|
||||
+#elif defined(MAX_ECC_KEY_BYTES) /* IBM stack */
|
||||
+ if (ciphertext_len > 2*MAX_ECC_KEY_BYTES + 1)
|
||||
+ return GPG_ERR_TOO_LARGE;
|
||||
+#else
|
||||
+# error TMP2 header are not correctly installed
|
||||
+#endif
|
||||
+
|
||||
/* This isn't really a decryption per se. The ciphertext actually
|
||||
* contains an EC Point which we must multiply by the private key number.
|
||||
*
|
||||
- * The reason is to generate a diffe helman agreement on a shared
|
||||
+ * The reason is to generate a diffie-hellman agreement on a shared
|
||||
* point. This shared point is then used to generate the per
|
||||
* session encryption key.
|
||||
*/
|
||||
@@ -1010,6 +1020,16 @@ tpm2_rsa_decrypt (ctrl_t ctrl, TSS_CONTEXT *tssc, TPM_HANDLE key,
|
||||
TPM_HANDLE ah;
|
||||
char *auth;
|
||||
|
||||
+#if defined(TPM2_MAX_RSA_KEY_BYTES) /* Intel stack */
|
||||
+ if (ciphertext_len > TPM2_MAX_RSA_KEY_BYTES)
|
||||
+ return GPG_ERR_TOO_LARGE;
|
||||
+#elif defined(MAX_RSA_KEY_BYTES) /* IBM stack */
|
||||
+ if (ciphertext_len > MAX_RSA_KEY_BYTES)
|
||||
+ return GPG_ERR_TOO_LARGE;
|
||||
+#else
|
||||
+# error TMP2 header are not correctly installed
|
||||
+#endif
|
||||
+
|
||||
inScheme.scheme = TPM_ALG_RSAES;
|
||||
/*
|
||||
* apparent gcrypt error: occasionally rsa ciphertext will
|
||||
--
|
||||
2.52.0
|
||||
|
||||
3
gnupg2.csh
Normal file
3
gnupg2.csh
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
if ( $?prompt ) then
|
||||
setenv GPG_TTY `tty`
|
||||
endif
|
||||
3
gnupg2.sh
Normal file
3
gnupg2.sh
Normal file
|
|
@ -0,0 +1,3 @@
|
|||
case "$-" in *i*)
|
||||
export GPG_TTY=$(tty) ;;
|
||||
esac
|
||||
1053
gnupg2.spec
1053
gnupg2.spec
File diff suppressed because it is too large
Load diff
4
sources
4
sources
|
|
@ -1,2 +1,2 @@
|
|||
SHA512 (gnupg-2.4.7.tar.bz2) = 3e84f1679904bf0efb789df6466e468bd2be9149d52561f35e2380038133479bebf1c61ee7adf6d3564b370915f32111098c052be6e6acaf3083a807f9f36019
|
||||
SHA512 (gnupg-2.4.7.tar.bz2.sig) = b0ccf9c460605f8a1727b0c4260b0e174d4761a36ca8ab2c04bace5bf7734b4b908e4251f8c226caa1d90bf2061434d1587dc9d1966e5b0c109a3b4a017e6c7d
|
||||
SHA512 (gnupg-2.4.9.tar.bz2) = 4638016b390a0024fa0cbe14181c43a81991e4275043855397ef099b927985d175d32452fc15b06485623b9292662dd6da464b2e5def8b77b2e4e48a072ab521
|
||||
SHA512 (gnupg-2.4.9.tar.bz2.sig) = 03328ba7de3faab1aab025784ef16cc04dd34d2cc09db2c513b7e38836b8036e04d2bb3c71aa64769b5a40a7a877373ee2d11b6e2bf8b67938216277dcd18a6f
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue