Note that, we cannot use enum values in CPP constant expression like:

# if GPG_ERR_SOURCE_DEFAULT != GPG_ERR_SOURCE_KEYBOX

That's because CPP has no way to know enum values.

Here is a PAM module, which interact a spawned process using authproto protocol of xsecurelock.

Checking musl internal, it seems that we can detect a single threaded application by:
https://git.musl-libc.org/cgit/musl/tree/src/internal/libc.h#n22

Could you please check what pkg-config --cflags ncurses returns?
In my environment (of Debian), it returns:

Here is a list of possible issues:

Pushed the fix for GPG_ERR_INV_ENGINE.

gpgsm may emit S IMPORT_PROBLEM 1 (with no fingerprint information) when it cannot find valid fingerprint.
I think that this case should be handled correctly by GPGME, not returning GPG_ERR_INV_ENGINE.

It's not yet pushed, because it requires new release of libgpg-error (for T6112: libgpg-error,w32: bidirectional Pipe support for estream).

I encountered this issue of struct stat when compiling for x86_64 of Windows.
I'm considering this patch:

diff --git a/common/sysutils.c b/common/sysutils.c
index c30f9a0ce..bbed309a8 100644
--- a/common/sysutils.c
+++ b/common/sysutils.c
@@ -1237,10 +1237,20 @@ int
 gnupg_stat (const char *name, struct stat *statbuf)
 {
 # ifdef HAVE_W32_SYSTEM
+#  if __MINGW32_MAJOR_VERSION > 3
+    /* mingw.org's MinGW */
+#   define STRUCT_STAT _stat
+#  elif defined(_USE_32BIT_TIME_T)
+    /* MinGW64 for i686 */
+#   define STRUCT_STAT _stat32
+#  else
+    /* MinGW64 for x86_64 */
+#   define STRUCT_STAT _stat64i32
+#  endif
   if (any8bitchar (name))
     {
       wchar_t *wname;
-      struct _stat32 st32;
+      struct STRUCT_STAT st32;
       int ret;

Thank you for reporting, and sorry for late handling of this report.

Push the change.

Thank you for your report. Next time, please include information of your target and configuration in the report.

To identify/locate the issue, you can try command line:

In the situation of a certificate about to be expired in the cache:

TLS 1.3 requires much changes for NTBTLS.

Applied to master and 1.10 branch.

T6142 was solved by rejecting expired root certificate.

I realized that some AEAD cipher (including GCM) allows arbitrary length for IV.
But it's not good for the API of setup_geniv and geniv.

rejecting an intermediate certificate too.

Pushed the change of mine to master, since I can confirm that it results validate_cert_chain working better, because of put_cert's rejecting an intermediate certificate too.

I pushed the change with documentation.

I pushed the changes. It also cares about the case for --cflags.

@orbea Thank you for your suggestions.

Thank you @dkg for the analysis. Unfortunately, the certificate cache is hashed by SHA-1 FPR, so, I think that it is a bit difficult to implement moving certs "front" / "back".

I think that for GnuPG 2.3.7 or later, you can add "Prompt: no" in your private key, which helps your interactions.
https://dev.gnupg.org/source/gnupg/browse/master/agent/keyformat.txt$138?as=source&blame=off

Fixed in 1.2.1.

Fixed in 1.2.1.

Fixed in 1.2.1.

I wrote a simple testusb.c if monitoring USB devices works:

#include <stdlib.h>
#include <libusb.h>
#include <poll.h>
#include <stdio.h>

What I learned today:

• libusb backend for Linux does:
  • scanning devices, it uses hotplug feature
  • hotplug feature uses udev_monitor_new_from_netlink and udev_monitor_receive_device, which are available in libudev (it communicates udev through AF_NETLINK socket)
  • libudev differs in Devuan
    • Distributions with systemd, libudev nowadays includes static-libsystemd
    • In Devuan, it is included in eudev : https://git.devuan.org/devuan/eudev
  • At initialization, hotplug feature spawns linux_udev_event_thread_main (its name is {libusb_event})
    • It is this thread, which receives information of device insertion/removal

Original pkg-config supports PKG_CONFIG_SYSTEM_LIBRARY_PATH (default is determined by build time, and overridden by environment var), PKG_CONFIG_SYSTEM_INCLUDE_PATH as well.

In libusb (1.0.26), I found this:

diff --git a/libusb/os/linux_udev.c b/libusb/os/linux_udev.c
index 9ec9eb17..66e27244 100644
--- a/libusb/os/linux_udev.c
+++ b/libusb/os/linux_udev.c
@@ -194,9 +194,11 @@ static void *linux_udev_event_thread_main(void *arg)
 		}
 		if (fds[1].revents) {
 			usbi_mutex_static_lock(&linux_hotplug_lock);
-			udev_dev = udev_monitor_receive_device(udev_monitor);
-			if (udev_dev)
-				udev_hotplug_event(udev_dev);
+			do {
+				udev_dev = udev_monitor_receive_device(udev_monitor);
+				if (udev_dev)
+					udev_hotplug_event(udev_dev);
+			} while (udev_dev);
 			usbi_mutex_static_unlock(&linux_hotplug_lock);
 		}
 	}

I tested with a self-signed one.

I can successfully sign with LibreOffice Writer (using Brainpool with Yubikey). I need to do:

• Tools
  • Optoins
    • LibreOffice - Security - Certificate Path
      • Select the profile of "firefox:default-esr" for NSS certificate directory

gpg-error-config and its relatives (libassuan-config, included) were written before pkg-config. The support of cross build, multiarch, and multilib by those are quite limited (and sometimes wrong). Basically, those scripts are deprecated, but it has been kept for backward compatibility.

Experimental branches:
https://dev.gnupg.org/source/libgcrypt/history/t4873/
https://dev.gnupg.org/source/ntbtls/history/t4873/

Thank you for your log.