In T5365#144688, @gniibe wrote:If it is new, it may be the change of this commit rC8e3cd4c4677c: build: Update gpg-error.m4.
- Queries
- All Stories
- Search
- Advanced Search
- Transactions
- Transaction Logs
Feed All Stories
All Stories
All Stories
Nov 15 2021
Nov 15 2021
wrobelda added a comment to T5365: --with-libgpg-error-prefix doesn't affect gpgrt-config path detection.
We know that problematic strncmp implementation: T5443
So, I don't blame Coverity. But I think that it's better to fix strncmp implementation.
The old code using sizeof(kek_params) (which is used for log_printhex) is incorrect; the value is the size of pointer to byte. It may works for 32-bit architectures, though.
On the machine which has 8 for a pointer, it will cause accessing wrong area, when DPG_CRYPTO is enabled.
wrobelda added a comment to T5687: "/mkheader.exe: cannot execute binary file: Exec format error" when cross compiling on Windows.
I tried following the README instructions, but getting:
wrobelda added a comment to T5687: "/mkheader.exe: cannot execute binary file: Exec format error" when cross compiling on Windows.
I just read https://github.com/gpg/libgpg-error/blob/master/README#L119 and realize this is by design...
wrobelda updated the task description for T5687: "/mkheader.exe: cannot execute binary file: Exec format error" when cross compiling on Windows.
wrobelda updated the task description for T5687: "/mkheader.exe: cannot execute binary file: Exec format error" when cross compiling on Windows.
wrobelda updated the task description for T5687: "/mkheader.exe: cannot execute binary file: Exec format error" when cross compiling on Windows.
Nov 14 2021
Nov 14 2021
wrobelda updated the task description for T5687: "/mkheader.exe: cannot execute binary file: Exec format error" when cross compiling on Windows.
wrobelda updated the task description for T5687: "/mkheader.exe: cannot execute binary file: Exec format error" when cross compiling on Windows.
• werner committed rW578ea4764731: appimage: Add a --devel option to the docker build script. (authored by • werner).
appimage: Add a --devel option to the docker build script.
• werner committed rGa43efc9294d1: agent: Print the non-option warning earlier. (authored by • werner).
agent: Print the non-option warning earlier.
• werner committed rG027e34235bc5: build: Fix several "include file not found" problems (authored by • ikloecker).
build: Fix several "include file not found" problems
appimage: Fix the version extraction.
• werner committed rGbd5c775878fd: agent: Print the non-option warning earlier. (authored by • werner).
agent: Print the non-option warning earlier.
packages: Update libgpg-error to 1.43
• werner committed rW30922599b6be: appimage: Allow building a VSD version and rename AppImage name (authored by • werner).
appimage: Allow building a VSD version and rename AppImage name
appimage: Extend the AppRun
Laurent Montel <montel@kde.org> committed rLIBKLEO8938bf0a4b53: GIT_SILENT: time to increase version (authored by Laurent Montel <montel@kde.org>).
GIT_SILENT: time to increase version
Laurent Montel <montel@kde.org> committed rKLEOPATRA32a61afe6da5: GIT_SILENT: time to increase version (authored by Laurent Montel <montel@kde.org>).
GIT_SILENT: time to increase version
• werner committed rDac919c7c52b7: ids: draft-koch-openpgp-webkey-service-13.txt (authored by • werner).
ids: draft-koch-openpgp-webkey-service-13.txt
Nov 13 2021
Nov 13 2021
• werner closed T5685: Clear stale --trusted-key records from the trustdb, a subtask of T5058: Review --trusted-key, as Resolved.
Update release signing keys
Update release signing keys
• werner committed rGbc6d56282ec9: gpg: Remove stale ultimately trusted keys from the trustdb. (authored by • werner).
gpg: Remove stale ultimately trusted keys from the trustdb.
gpgconf: New command --show-configs.
• werner committed rG99ef78aa0ca7: gpg: Remove stale ultimately trusted keys from the trustdb. (authored by • werner).
gpg: Remove stale ultimately trusted keys from the trustdb.
agent,dirmngr: New option --steal-socket
keyboxd: New option --steal-socket.
agent,dirmngr: New option --steal-socket
doc: Clarify the "ntds" AKL mechanism.
• werner closed T5607: Fingerprint signing fails with 'gpg: signing failed: No secret key' as Resolved.
• werner edited projects for T5331: Possibly incompatible Ed25519 signature between other implementations and 2.3-bata, added: gnupg (gpg23); removed gnupg (gpg22).
Nov 12 2021
Nov 12 2021
doc: Clarify the "ntds" AKL mechanism.
• werner triaged T5682: ed25519 internal authenticate with openpgpcard may send long data over short apdu as High priority.
• werner added a comment to T5682: ed25519 internal authenticate with openpgpcard may send long data over short apdu.
Okay, I revisited the code:
Do not user Reiner SCT those readers are all buggy and work only on Windows - if at all. Stay away from them and get a real reader and not the incompatible broken stuff from that company. I spent way too much time trying to get those readers working. That time is better invested in support for hardware which is standard compatible or are helpful to get stuff running.
• werner added a comment to T5682: ed25519 internal authenticate with openpgpcard may send long data over short apdu.
The internal hashing of ed25519 is not used by OpenPGP but instead we pass the hash of the message to the ed25519 function and thus to the card. Pushing a message through a card is a no-go - way too slow for any normal sized message.
Some more info: OpenVPN does not care about the second reader only gnupg agent is sensitive to what is present when it is started. So a workaround that I just found is to disable the Virtual Smartcard reader first so that only the ReinerSCT smartcard reader with an OpenPGP V3.4 card is present. Make sure to open an SSH connection. Then reconnect the second reader. And reconnect to VPN. After the PIN for the OpenPGP V3.4 card is already cached and a connection to the card established I can also open more SSH connections with the second reader attached and disconnect and reconnect the VPN as I want.
Even removing the smartcard from the ReinerSCT reader and plugging it back in works and I can still authenticate with new SSH tunnels and both readers present. So it seems it is actually only important which readers are present when the agent connects for the first time.
So this is a practical woraround. Although disabling the TPM backed reader temporarily needs Admin rights and is really janky.
I am on Windows 10 21H1 and I using gnupg-w32-2.3.3_20211012 from here [1]
Together with win-gpg-agent, which extends gnupg to play nicely with Windows sockets. [2]
klali added a comment to T5682: ed25519 internal authenticate with openpgpcard may send long data over short apdu.
Since hashing happens on-card for ed25519 I'm not sure what limits gpg wants to impose, currently the data is passed straight through and scdaemon will happily try to send more than 255 bytes of data as a short apdu here. My patch is probably not correct, I assume it needs to care about cardcap.ext_lc_le and chunking as well.
scdaemon.log1 KBDownload
• werner added a comment to T5682: ed25519 internal authenticate with openpgpcard may send long data over short apdu.
That does not seem to be right. You don't need 255 bytes for an ECC key. It would be best to get scdaemon logs simialr to the gpg-agent logs. Set "debug ipc,cardio" into scdaemon.conf.
What is the rational for this change?
Under C11, it seems OK (strncmp).
https://stackoverflow.com/questions/38878195/does-this-usage-of-strncmp-contain-an-out-of-bounds-read
kbx: Avoid use of uninitialized value.
gpg: Don't use malloc for kek_params.
gpg: Avoid uninitialized revkey.fprlen.
agent: Avoid uninitialized buffer.
• gniibe committed rG50f32eb0664d: agent: Correctly free memory on error path. (authored by Jakuje).
agent: Correctly free memory on error path.
tools: Avoid memory leak from gpgspilt.
• gniibe committed rGc0b99e6dbb26: gpg-pair-tool: Fix typos in protocol description. (authored by Jakuje).
gpg-pair-tool: Fix typos in protocol description.
scd: Avoid memory leak.
I applied most of gnupg-coverity.patch.
- Part 1 is not applied; It should be handled later.
- Part 2: applied
- Part 3: applied
- Part 4: applied, but spell fixes not require ChangeLog entry
- Part 5
- ecdh part is fixed differently
- export.c part is not applied for now, because of semantics/interpretation of strncmp; POSIX says differently although it says it's ISO C standard which defines. https://pubs.opengroup.org/onlinepubs/9699919799/functions/strncmp.html
- Part 6: applied
- Part 7: applied, but empty initializer is GNU extension (or the way of C++), so first 0
- Part 8: applied
- Part 9: applied, but one more fix
• gniibe committed rEfd83c3e29744: build: Fix for configure generated files. (authored by • gniibe).
build: Fix for configure generated files.
• gniibe committed rE1e5b17f4284e: configure: Escape includedir/libdir to defer interpretation of vars. (authored by • gniibe).
configure: Escape includedir/libdir to defer interpretation of vars.
• gniibe committed rM4583ab77e5af: gpgme.pc: Fix library dependency and use of includedir, libdir. (authored by • gniibe).
gpgme.pc: Fix library dependency and use of includedir, libdir.
• gniibe committed rM1cedac2bba24: tests: Build using GPG_ERROR_MT_LIBS for thread use. (authored by • gniibe).
tests: Build using GPG_ERROR_MT_LIBS for thread use.
ntbtls.pc: Fix library dependency.
• gniibe committed rT612351adc7ca: build: Fix library dependency for ntbtls-cli test program. (authored by • gniibe).
build: Fix library dependency for ntbtls-cli test program.
Nov 11 2021
Nov 11 2021
• aheinecke committed rO76b43345cdd3: Do not abort if updating HTML Body fails (authored by • aheinecke).
Do not abort if updating HTML Body fails
Improve ReadAsPlain detection
Fix fallback logic in set_body
• aheinecke committed rOb400af8e4f7d: Avoid using bultin gettext function name (authored by • aheinecke).
Avoid using bultin gettext function name
• aheinecke committed rO7205a22c41dc: Use explicit extern declaration for opt struct (authored by • aheinecke).
Use explicit extern declaration for opt struct
Ignore deprecated copy warnings
A first version has landed.
• ikloecker committed rKLEOPATRA1875d6d383bf: Add user interface markers to some UI elements (authored by • ikloecker).
Add user interface markers to some UI elements
• ikloecker committed rKLEOPATRA2cbbadb43d3f: Fix defaulting to last used directory when importing certificates (authored by • ikloecker).
Fix defaulting to last used directory when importing certificates
• ikloecker committed rKLEOPATRA36e12fc655fe: Don't try to finish if we have to wait for more jobs (authored by • ikloecker).
Don't try to finish if we have to wait for more jobs
• ikloecker committed rKLEOPATRA5c4d3a80d5a9: Allow the export of certificate groups (authored by • ikloecker).
Allow the export of certificate groups
• ikloecker committed rKLEOPATRA532e590d4c84: Show information about new and updated groups after the import (authored by • ikloecker).
Show information about new and updated groups after the import
• ikloecker committed rKLEOPATRA906a1301fb41: Import certificate groups when importing certificates from files (authored by • ikloecker).
Import certificate groups when importing certificates from files
• ikloecker committed rKLEOPATRAe62cb2d3eb53: Rewrite the post-processing of external X.509 certificate imports (authored by • ikloecker).
Rewrite the post-processing of external X.509 certificate imports
• ikloecker committed rKLEOPATRA5381086050c5: Add protocol and type of import to the import results (authored by • ikloecker).
Add protocol and type of import to the import results
• ikloecker committed rKLEOPATRA836adc09f94f: Update the key cache after the import (authored by • ikloecker).
Update the key cache after the import
• ikloecker committed rKLEOPATRAea80bb76e708: Store jobs and ids resp. results and ids together (authored by • ikloecker).
Store jobs and ids resp. results and ids together
• ikloecker committed rKLEOPATRAfdb150a3ae0c: Remove finished jobs from idsByJob map (authored by • ikloecker).
Remove finished jobs from idsByJob map
• ikloecker committed rKLEOPATRA09c1100d4463: Set group config to use by KeyCache (authored by • ikloecker).
Set group config to use by KeyCache
• ikloecker committed rLIBKLEO37cd511569ac: Allow retrieving a group with a certain id from the cache (authored by • ikloecker).
Allow retrieving a group with a certain id from the cache
Bump library version
• ikloecker committed rLIBKLEOc7babd924cbe: Add helper for checking if a container contains a certain key (authored by • ikloecker).
Add helper for checking if a container contains a certain key
• ikloecker committed rLIBKLEOad0969fa65cc: Allow suspending the auto-refresh of the key cache (authored by • ikloecker).
Allow suspending the auto-refresh of the key cache
• ikloecker committed rLIBKLEOff118145c6cb: Add helper to get the fingerprints of a bunch of keys (authored by • ikloecker).
Add helper to get the fingerprints of a bunch of keys
• ikloecker committed rLIBKLEOf8d0029b24f9: Set group config to use by KeyCache instead of group config filename (authored by • ikloecker).
Set group config to use by KeyCache instead of group config filename
• ikloecker committed rLIBKLEO7c507f7a0cee: Get multiple keys by their fingerprints (authored by • ikloecker).
Get multiple keys by their fingerprints
• ikloecker committed rLIBKLEO33f060ac5e51: Add helper for converting a QStringList to a vector of std::strings (authored by • ikloecker).
Add helper for converting a QStringList to a vector of std::strings
• ikloecker committed rLIBKLEOee562c9f7792: Factor code reading/writing the group configuration out of KeyCache (authored by • ikloecker).
Factor code reading/writing the group configuration out of KeyCache
• aheinecke changed the status of T5681: GpgOL: Handle GPO settings for readAsPlain from Open to Testing.
Tested both with the policies key and with the normal key and with HKLM fallback. Works as expected. There was also an issue where the error handling in case setting the HTML body failed did no longer work, probably since the verification preview changes. This was fixed with 76b43345cdd3e932dae7b677e5c021ca52191f8e
Fix pcre download link