Adding debian version 2.2.27-2+deb11u2.debian/2.2.27-2+deb11u2debian

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

3 files changed, 176 insertions, 0 deletions

diff --git a/debian/patches/from-master/gpg-change-agent-spawn-2019-07-24-v2.patch b/debian/patches/from-master/gpg-change-agent-spawn-2019-07-24-v2.patch
new file mode 100644
index 0000000..849e985
--- /dev/null
+++ b/debian/patches/from-master/gpg-change-agent-spawn-2019-07-24-v2.patch
@@ -0,0 +1,50 @@
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Thu, 22 Oct 2020 11:32:00 +0900
+Subject: buildd: sbuild randomly fails to sign changes file despite valid
+ signature keys
+Forwarded: https://dev.gnupg.org/rGb1c56cf9e2bb51abfd47747128bd2a6285ed1623
+
+---
+ common/asshelp.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+diff --git a/common/asshelp.c b/common/asshelp.c
+index d87017e..9f269ab 100644
+--- a/common/asshelp.c
++++ b/common/asshelp.c
+@@ -477,8 +477,18 @@ start_new_gpg_agent (assuan_context_t *r_ctx,
+       if (!(err = lock_spawning (&lock, gnupg_homedir (), "agent", verbose))
+           && assuan_socket_connect (ctx, sockname, 0, 0))
+         {
++#ifdef HAVE_W32_SYSTEM
+           err = gnupg_spawn_process_detached (program? program : agent_program,
+                                               argv, NULL);
++#else
++          pid_t pid;
++
++          err = gnupg_spawn_process_fd (program? program : agent_program,
++                                        argv, -1, -1, -1, &pid);
++          if (!err)
++            err = gnupg_wait_process (program? program : agent_program,
++                                      pid, 1, NULL);
++#endif
+           if (err)
+             log_error ("failed to start agent '%s': %s\n",
+                        agent_program, gpg_strerror (err));
+@@ -612,7 +622,16 @@ start_new_dirmngr (assuan_context_t *r_ctx,
+       if (!(err = lock_spawning (&lock, gnupg_homedir (), "dirmngr", verbose))
+           && assuan_socket_connect (ctx, sockname, 0, 0))
+         {
++#ifdef HAVE_W32_SYSTEM
+           err = gnupg_spawn_process_detached (dirmngr_program, argv, NULL);
++#else
++          pid_t pid;
++
++          err = gnupg_spawn_process_fd (dirmngr_program, argv,
++                                        -1, -1, -1, &pid);
++          if (!err)
++            err = gnupg_wait_process (dirmngr_program, pid, 1, NULL);
++#endif
+           if (err)
+             log_error ("failed to start the dirmngr '%s': %s\n",
+                        dirmngr_program, gpg_strerror (err));
diff --git a/debian/patches/from-master/gpg-default-to-3072-bit-keys.patch b/debian/patches/from-master/gpg-default-to-3072-bit-keys.patch
new file mode 100644
index 0000000..54b4292
--- /dev/null
+++ b/debian/patches/from-master/gpg-default-to-3072-bit-keys.patch
@@ -0,0 +1,91 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Thu, 7 Sep 2017 18:41:10 -0400
+Subject: gpg: default to 3072-bit keys.
+
+* agent/command.c (hlp_genkey): update help text to suggest the use of
+3072 bits.
+* doc/wks.texi: Make example match default generation.
+* g10/keygen.c (gen_elg): update default from 2048 to 3072.
+* g10/keyid.c (pubkey_string): update comment so that first example
+is the default 3072-bit RSA.
+
+--
+
+3072-bit RSA is widely considered to be 128-bit-equivalent security.
+This is a sensible default in 2017.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+
+(cherry picked from commit 909fbca19678e6e36968607e8a2348381da39d8c)
+---
+ agent/command.c | 2 +-
+ doc/wks.texi    | 4 ++--
+ g10/keygen.c    | 2 +-
+ g10/keyid.c     | 4 ++--
+ 4 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/agent/command.c b/agent/command.c
+index 8642498..f94e770 100644
+--- a/agent/command.c
++++ b/agent/command.c
+@@ -843,7 +843,7 @@ static const char hlp_genkey[] =
+   "\n"
+   "  C: GENKEY\n"
+   "  S: INQUIRE KEYPARAM\n"
+-  "  C: D (genkey (rsa (nbits  2048)))\n"
++  "  C: D (genkey (rsa (nbits 3072)))\n"
+   "  C: END\n"
+   "  S: D (public-key\n"
+   "  S: D   (rsa (n 326487324683264) (e 10001)))\n"
+diff --git a/doc/wks.texi b/doc/wks.texi
+index 119e31c..ae6c310 100644
+--- a/doc/wks.texi
++++ b/doc/wks.texi
+@@ -412,10 +412,10 @@ the submission address:
+ The output of the last command looks similar to this:
+ 
+ @example
+-  sec   rsa2048 2016-08-30 [SC]
++  sec   rsa3072 2016-08-30 [SC]
+         C0FCF8642D830C53246211400346653590B3795B
+   uid           [ultimate] key-submission@@example.net
+-  ssb   rsa2048 2016-08-30 [E]
++  ssb   rsa3072 2016-08-30 [E]
+ @end example
+ 
+ Take the fingerprint from that output and manually publish the key:
+diff --git a/g10/keygen.c b/g10/keygen.c
+index d50acf8..79d4579 100644
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -1436,7 +1436,7 @@ gen_elg (int algo, unsigned int nbits, KBNODE pub_root,
+ 
+   if (nbits < 1024)
+     {
+-      nbits = 2048;
++      nbits = 3072;
+       log_info (_("keysize invalid; using %u bits\n"), nbits );
+     }
+   else if (nbits > 4096)
+diff --git a/g10/keyid.c b/g10/keyid.c
+index 69d85da..2987287 100644
+--- a/g10/keyid.c
++++ b/g10/keyid.c
+@@ -73,7 +73,7 @@ pubkey_letter( int algo )
+    is copied to the supplied buffer up a length of BUFSIZE-1.
+    Examples for the output are:
+ 
+-   "rsa2048"  - RSA with 2048 bit
++   "rsa3072"  - RSA with 3072 bit
+    "elg1024"  - Elgamal with 1024 bit
+    "ed25519"  - ECC using the curve Ed25519.
+    "E_1.2.3.4"  - ECC using the unsupported curve with OID "1.2.3.4".
+@@ -83,7 +83,7 @@ pubkey_letter( int algo )
+    If the option --legacy-list-mode is active, the output use the
+    legacy format:
+ 
+-   "2048R" - RSA with 2048 bit
++   "3072R" - RSA with 3072 bit
+    "1024g" - Elgamal with 1024 bit
+    "256E"  - ECDSA using a curve with 256 bit
+ 
diff --git a/debian/patches/from-master/gpg-default-to-AES-256.patch b/debian/patches/from-master/gpg-default-to-AES-256.patch
new file mode 100644
index 0000000..d131f6a
--- /dev/null
+++ b/debian/patches/from-master/gpg-default-to-AES-256.patch
@@ -0,0 +1,35 @@
+From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+Date: Thu, 7 Sep 2017 19:04:00 -0400
+Subject: gpg: default to AES-256.
+
+* g10/main.h (DEFAULT_CIPHER_ALGO): Prefer AES256 by default.
+
+--
+
+It's 2017, and pretty much everyone has AES-256 available.  Symmetric
+crypto is also rarely the bottleneck (asymmetric crypto is much more
+expensive).  AES-256 provides some level of protection against
+large-scale decryption efforts, and longer key lengths provide a hedge
+against unforseen cryptanalysis.
+
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+(cherry picked from commit 73ff075204df09db5248170a049f06498cdbb7aa)
+---
+ g10/main.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/g10/main.h b/g10/main.h
+index 68360e2..1983e42 100644
+--- a/g10/main.h
++++ b/g10/main.h
+@@ -31,7 +31,9 @@
+    (i.e. uncompressed) rather than 1 (zip).  However, the real world
+    issues of speed and size come into play here. */
+ 
+-#if GPG_USE_AES128
++#if GPG_USE_AES256
++# define DEFAULT_CIPHER_ALGO     CIPHER_ALGO_AES256
++#elif GPG_USE_AES128
+ # define DEFAULT_CIPHER_ALGO     CIPHER_ALGO_AES
+ #elif GPG_USE_CAST5
+ # define DEFAULT_CIPHER_ALGO     CIPHER_ALGO_CAST5