Mon, May 13
Sun, May 12
Yes, I think we should support this. Also X448. Thanks for the report and the samples.
Tue, May 7
Wed, Apr 24
Apr 2 2024
Mar 12 2024
Right. I think this task inherited the assignee from its parent task.
Mar 6 2024
I've sent you an email about it. It might have html elements due to markdown-here.
Sorry, for not following up earlier. Can you please do me a favor and run the last tests again, this time adding -v and --debug 1 to the invocation? Feel free to forward the output to my private address is that is easier (wk at gnupg.org).
Feb 27 2024
Feb 21 2024
Way to old. Does anyone still uses CAcert?
Feb 7 2024
The additional debug info are:
gpgsm: DBG: p12_parse:1998: err=0 prk=0x0000000000000000,0x0000000000000000 gpgsm: DBG: p12_parse:2006: err=0 prk=0x0000000000000000,0x0000000000000000 gpgsm: DBG: p12_parse:2021: err=0 prk=0x0000000000000000,0x0000000000000000 gpgsm: DBG: p12_parse:2054: err=0 prk=0x0000000000000000,0x0000000000000000 gpgsm: DBG: p12_parse:2061: err=0 prk=0x0000000000000000,0x0000000000000000 gpgsm: DBG: p12_parse:2069: err=0 prk=0x0000000000000000,0x0000000000000000 gpgsm: DBG: p12_parse:2081: err=0 prk=0x0000000000000000,0x0000000000000000 gpgsm: error parsing or decrypting the PKCS#12 file gpgsm: total number processed: 4 gpgsm: unchanged: 4
Feb 6 2024
Could you write a quick patch file for that? (I don't have a working source build, I am using the Fedora spec file + patches)
The old debug output is in genral okay but what I would do is to add a couple of log_debug calls like
@werner I managed to recover the old .p12 that has the error. And this is still replicable. Is there a debug flag that would be useful or can we setup some private live-debugging for this?
Feb 5 2024
I would have expected an error message right after
Feb 2 2024
Unfortunately I have deleted the .p12 with the CA chain, and I don't know how I've generated it. It also contained my production certificates so, kinda sensitive to upload here.
Okay, I push the change for the extended salt size. Regarding the import of CA certificates, I have not seen any problems. In fact it is pretty common. Did you test with with 2.4.4. A test file would be helpful.
Ok, I have tried again the series of workarounds that I initially posted on the main description, and I managed to fix it by striping the CA certificates. So the current issues here are:
- Allocated salt is too small. https://dev.gnupg.org/T6757#182217 fixes for now
- Cannot import a .p12 that includes CA certificates as well
Jan 30 2024
We got a bit further, not sure what debug level you want, guru I've found to be too excessive:
Can you please try this patch:
That is an old bug report with a couple of fixes introduced over the years. As of now we sometimes see hangs on Windows on our test VMs. The common cause here seems to be USB card reader issues. Let's close this bug and wait for another bug report with current software versions.
@werner I have just tested this, and although it fixed it for one certificate, this one in this issue still fails. Here is the new debug given
Jan 25 2024
Openssl since version 3 supports aes-gcm and aria-gcm in cms. CMS has a different wrapper for AEAD. openssl Pull Request. I created test files (nistp384 key, certificates, messages), perhaps it will be useful.
Jan 24 2024
Hidden for Gpg4win-4.3.0-beta571, too
Closing because we believe things are fixed and our test suite confirms that. Feel free to -reopen in case your own file does not import with 2.4.4.
The test file is now part of our test suite and passes.
We meanwhile have a lot of test cases in our test suite and we see no issue. Closing this bug; feel free to re-open if it is not fixed for your case in 2.4.4.
Jan 16 2024
Interesting. I need to look closer at it. I scheduled it for 2.4 but it won't be in the forthcoming 2.4.4. There are still other interesting things on the short list (e.g. timestamping support) but we may do that only in 2.6.
Jan 5 2024
Hope so too. If there was a docker image or something I would gladly test it, otherwise I'll report back as soon as a release is out
We can't test this but assume that the fix for T6752 is sufficient here.
Jan 4 2024
Note that we now have also an option instead of the workaround from 2015
Dec 16 2023
We were hoping before christmas. But it is unlikely due to some other stuff we had to do. Early Jan. Definitely a priority for us right now to get it out.
Dec 15 2023
@werner Any news on when will 2.4.4 will land? I cannot figure out how to build the project from source, and I couldn't adapt the Fedora packaging to build it either. I would like to have a way to finally sign my git commits.
Dec 12 2023
Checking if the key is not otherwise used is unrelated and should be a diifferent Task since this also relates to OpenPGP. For me this Task is about creating a similar API for gpgsm (--delete-secret-key) that we have for OpenPGP.
Dec 11 2023
As it is so complicated to check all possibilities:
Searching by keygrip is actually fast with keyboxd.
Actually prio is rather low or even Wontfix. Since it has been this way forever and no one really complained. I think deleting secret keys esp. for S/MIME where you can't just create a testing key but need to have it signed by a CA is not really there.