Noteworthy changes in version 2.5.19 (2026-04-24)
- New and extended features:
- gpg: New option --use-ocb-sym. [rGccdcdfbb37]
- gpg: New options --show-[only-]session-hash. [rGecd0f7afa1]
- gpgsm: Allow cipher mode to be part of the algo given to the --cipher-algo option. [T3979]
- gpgsm: Emit more details when failing to check a crlDP. [T8221]
- agent: Improve pinentry behavior and texts in smartcard context. [T6425]
- dirmngr: New keyword "clear" for --keyserver. [rG2ab4cba36c]
- Bug fixes:
- gpg: Fix edge case in --refresh-keys. [T8197]
- gpg: Don't call gcry_kdf_derive with empty passphrase. [T7739]
- gpgsm: Skip the optional PKCS#12 PBES2 keyLength parameter to allow import of recently issued certificates by the German Telekom. [rGc8c9604bba]
- gpgsm: Fix a bug so that a certificate can be signed using a different algo. [rG66fdafab3c]
- gpgsm: Make GCM fully compliant in de-vs mode. [rG04fd775fce]
- gpgsm: Add a certificate chain check for de-vs compliance. [T8188]
- gpgsm: Show rsaPSS certificates as de-vs compliant in listings. [T8222]
- agent: Rework the trustlist reading code to finally allow a trustlist.txt with a missing trailing LF. [T8078]
- ssh: Fix RSA padding in signature handling. [T7882,T8202]
- gpgtar: Fix -C (--directory) to check the output directory. [T8159] (bug reported by Oleh Konko, 1seal.org)
- Other changes:
- agent: Raise an error when p >= q for RSA keys to detect incorrect generated *PGP keys. [T8171]