Update:
It looks like OpenSSH version 8 now supports ssh-agent's handling REQUEST_IDENTITIES.

Thank you.
I'll report the original message problem.
Applied and pushed.

Thank you. Please confirm for one message translation. Others are all good.

If it confuses users, we can apply something like this:

diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c
index 2a5087e1f..12916a64e 100644
--- a/tools/gpgconf-comp.c
+++ b/tools/gpgconf-comp.c
@@ -93,7 +93,9 @@ gc_error (int status, int errnum, const char *fmt, ...)
 /* Forward declaration.  */
 static void gpg_agent_runtime_change (int killflag);
 static void scdaemon_runtime_change (int killflag);
+#ifdef BUILD_WITH_TPM2D
 static void tpm2daemon_runtime_change (int killflag);
+#endif
 static void dirmngr_runtime_change (int killflag);
 static void keyboxd_runtime_change (int killflag);

Thank you for your confirmation. Closing.

Fixed in GnuPG 2.3.1, so, add the tag for GnuPG 2.2.

It's in 1.9 already.

it's in 2.3.

Applied.

This has been applied already.

I applied 1,2,3, and 5 in rKfbb1f303198b: Fixes for static analysis reports.

I can't see null pointer de-reference (you claimed) in [4/5].
Could you please elaborate?

IIUC, with libgcrypt in LIBGCRYPT-1.8-BRANCH (not yet released) and libgcrypt 1.9.3, the build process works well (the problem with SIP has been handled).

Updated:

diff --git a/configure.ac b/configure.ac
index 53a343b..f496729 100644
--- a/configure.ac
+++ b/configure.ac
@@ -82,6 +82,7 @@ AC_PROG_AWK
 AC_CHECK_TOOL(AR, ar, :)
 AC_USE_SYSTEM_EXTENSIONS

Fixed in rP7f7fd8bcfd74: tty: Fix error return paths and its resource leaks.

Actually, calling do_touch_file when some error(s) are not good.
Let me fix all the things.

Sorry, I was wrong. It seems that GNU C library has a feature to avoid bad truncation.

Thank you.
We also need to release memory for points.

mkheader has CFLAGS_FOR_BUILD since libassuan 2.5.4.
gost-s-box has so since libgcrypt 1.9.0.

Making this task up to HIGH priority, so that people can easily find this change in 2.3.0.

Done for gpa.
Please test.

Done for pinentry.

This task includes multiple issues: two sub-tasks and how-to-use remotely.
Two tasks had been fixed already.
The last one was documented here.
So, closing.

Thank you. Merged and pushed.

Applied and pushed.

@werner No problem. Just go ahead.

Done in 2.3.0.

Done in 2.3.0.

Done in 2.3.

Thank you.

Thank you. Applied and pushed.

Thank you. I'll take care of this.

Do we have CVE number assigned?

Thank you for your publishing your key of CB6BE1D0D7D1594A.
I applied and pushed your changes.

Thanks. Note, that the same code is in gnupg2 in common/exechelp-posix.c:736

Thank you.
Applied both to STABLE-BRANCH-2-2 and master (changing new function name).

So, in my opinion, applying the patch for ElGamal exponent blinding is enough (for now).

For DSA, I had assumed similar attack could be effective.

CC_FOR_BUILD is used for building executables for the build machine.
CC_FOR_BUILD may be different to CC (for target).