diff options
Diffstat (limited to '')
| -rw-r--r-- | sm/ChangeLog-2011 | 2968 |
1 files changed, 2968 insertions, 0 deletions
diff --git a/sm/ChangeLog-2011 b/sm/ChangeLog-2011 new file mode 100644 index 0000000..4a4df86 --- /dev/null +++ b/sm/ChangeLog-2011 @@ -0,0 +1,2968 @@ +2011-12-01 Werner Koch <wk@g10code.com> + + NB: ChangeLog files are no longer manually maintained. Starting + on December 1st, 2011 we put change information only in the GIT + commit log, and generate a top-level ChangeLog file from logs at + "make dist". See doc/HACKING for details. + +2011-09-20 Werner Koch <wk@g10code.com> + + * verify.c (gpgsm_verify): s/gcry_md_start_debug/gcry_md_debug/ + in preparation for Libgcrypt 1.6. + * sign.c (gpgsm_sign): Ditto. + * certreqgen.c (create_request): Ditto. + * certcheck.c (gpgsm_check_cert_sig): Ditto. + +2011-08-10 Werner Koch <wk@g10code.com> + + * keydb.c (keydb_add_resource): Remove unsued var CREATED_FNAME. + + * gpgsm.c (main): Remove unused var FNAME. + +2011-07-21 Werner Koch <wk@g10code.com> + + * call-dirmngr.c (get_cached_cert, get_cached_cert_data_cb): New. + (gpgsm_dirmngr_isvalid): Try to get the only-valid-if-cert-valid + certificate from the dirmngr first. + +2011-06-01 Marcus Brinkmann <mb@g10code.com> + + * certreqgen.c (proc_parameters): Initialize RC. + +2011-04-25 Werner Koch <wk@g10code.com> + + * certlist.c (gpgsm_add_to_certlist): Mark classify_user_id for + use with non-OpenPGP. + (gpgsm_find_cert): Ditto. + * sign.c (get_default_signer): Ditto. + * keylist.c (list_internal_keys): Ditto. + * import.c (reimport_one): Ditto. + * export.c (gpgsm_export): Ditto. + * delete.c (delete_one): Ditto. + +2011-03-10 Werner Koch <wk@g10code.com> + + * minip12.c (oid_pkcs5PBKDF2, oid_pkcs5PBES2, oid_aes128_CBC): New. + (set_key_iv_pbes2): New. + (crypt_block): Add args IV and IVLEN. Call set_key_iv_pbes2. + (decrypt_block): Add args IV and IVLEN. + (parse_bag_encrypted_data): Hack to support PBES2 data. + (parse_bag_data): Ditto. + +2011-03-03 Werner Koch <wk@g10code.com> + + * base64.c (base64_finish_write): Do not copy to radbuf to get rid + of a faulty gcc 4.4 "used uninitialized" warning. + +2011-03-01 Werner Koch <wk@g10code.com> + + * certreqgen.c (pSERIAL, pISSUERDN, pNOTBEFORE, pNOTAFTER) + (pSIGNINGKEY, pHASHALGO): New. + (reqgen_ctrl_s): Remove field WRITER. + (read_parameters): Support new keywords. Change arg WRITER to + OUT_FP; pass that to proc_parameters. + (proc_parameters): Add arg WRITER. Check values of new keywords. + Create writer object here. Support generation of certificates. + (create_request): Take new arg SIGKEY. Allow for hash algorithms + other than SHA-1. Set serialno and other values for certificate + creation. + (gpgsm_genkey): Do not create writer object but pass output stream + to read_parameters. + * certreqgen-ui.c (gpgsm_gencertreq_tty): Ask for self-signed. + * misc.c (transform_sigval): New. + +2011-02-25 Werner Koch <wk@g10code.com> + + * certreqgen.c (create_request): Add arg SIGKEY. + +2010-11-25 Werner Koch <wk@g10code.com> + + * base64.c (gpgsm_create_writer): Remove arg FP which is not used + by any caller. Change all callers. + (struct writer_cb_parm_s): Remove field FP. + (do_putc, do_fputs): Remove and replace callers by direct calls to + es_ functions. + +2010-11-23 Werner Koch <wk@g10code.com> + + * Makefile.am (gpgsm_LDADD): Add extra_bin_ldflags. + +2010-10-08 Werner Koch <wk@g10code.com> + + * gpgsm.c: Add option --with-keygrip. + * gpgsm.h (struct opt): Add WITH_KEYGRIP. + * keylist.c (list_cert_std): Implement option. + +2010-09-16 Werner Koch <wk@g10code.com> + + * certchain.c (gpgsm_walk_cert_chain): Use GPG_ERR_MISSING_ISSUER_CERT. + (do_validate_chain): Ditto. + (gpgsm_basic_cert_check): Ditto. + * call-agent.c (learn_cb): Take care of new + GPG_ERR_MISSING_ISSUER_CERT. + * import.c (check_and_store): Ditto. + (check_and_store): Ditto. + +2010-08-16 Werner Koch <wk@g10code.com> + + * gpgsm.c (main) <aGPGConfList>: Use es_printf. + + * call-dirmngr.c (start_dirmngr_ext): Use new start_new_dirmngr + function. + + * gpgsm.c: Mark option --prefer-system-dirmngr obsolete. + (main): Enable dirmngr by default. + + * gpgsm.h (struct opt): Remove field PREFER_SYSTEM_DIRMNGR. + + * server.c (gpgsm_server): Use dirmngr_socket_name instead of the + envvar for the hello line info. + +2010-06-21 Werner Koch <wk@g10code.com> + + * minip12.c (p12_build): Change arg CERT to const void ptr. + (build_cert_sequence): Change arg CERT to const ptr. + + * gpgsm.c (main) <aExportSecretKeyP12>: Use to estream. + (open_fwrite): Removed. + + * export.c: Include minip12.h. + (popen_protect_tool): Remove. + (export_p12): Use gpg-agent directly. Change calling convention. + (gpgsm_p12_export): Adjust for that change. Change arg FP to an + estream_t. + (do_putc): Remove. Change callers to es_putc. + (do_fputs): Likewise. + (print_short_info): Remove arg FP. + * call-agent.c (gpgsm_agent_export_key): new. + +2010-06-17 Werner Koch <wk@g10code.com> + + * import.c (parse_p12): Remove arg retfp. Use the agent's new + import command. + (import_one): Adjust call to pkcs12. + (store_cert_cb, rsa_key_check): New. + (popen_protect_tool): Remove. + * minip12.c (parse_bag_encrypted_data, p12_parse): Add arg + R_BADPASS. + * call-agent.c (gpgsm_agent_ask_passphrase): New. + (gpgsm_agent_keywrap_key): New. + (struct import_key_parm_s): New. + (gpgsm_agent_import_key): New. + * minip12.c, minip12.h: Move from ../agent/. + * Makefile.am (gpgsm_SOURCES): Add them. + +2010-06-11 Marcus Brinkmann <marcus@g10code.de> + + * server.c (cmd_message) [HAVE_W32CE_SYSTEM]: Finish pipe. + +2010-06-10 Marcus Brinkmann <marcus@g10code.de> + + * server.c (SERVER_STDIN, SERVER_STDOUT): New macros. + (gpgsm_server): Use them with assuan_fdopen. + +2010-04-23 Marcus Brinkmann <marcus@g10code.de> + + * certreqgen.c (read_parameters): Use ascii_isspace instead of + spacep to stop at newline, too. + +2010-04-14 Werner Koch <wk@g10code.com> + + * gpgsm.c (main) [W32CE]: Disable dirmngr for now. + +2010-04-13 Werner Koch <wk@g10code.com> + + * sign.c (gpgsm_sign): Do not check qualified status in + no-chain-validation mode. + +2010-04-08 Werner Koch <wk@g10code.com> + + * gpgsm.c (open_es_fread): Add arg mode. + (main) <aKeygen>: Call with mode "r" instead of "rb". + +2010-04-07 Werner Koch <wk@g10code.com> + + * misc.c: Remove setenv.h. Include sysutils.h. + (setup_pinentry_env): s/setenv/gnupg_setenv/ + +2010-03-24 Werner Koch <wk@g10code.com> + + * Makefile.am (gpgsm_LDADD): Add extra_sys_libs. + +2010-03-23 Werner Koch <wk@g10code.com> + + * qualified.c (gpgsm_is_in_qualified_list): Replace rewind by + fseek+clearerr. + +2010-03-22 Werner Koch <wk@g10code.com> + + * import.c (parse_p12): Use estream functions for the tmp streams. + * export.c (export_p12): Ditto. + +2010-03-11 Werner Koch <wk@g10code.com> + + * verify.c (gpgsm_verify): Use gpgsm_es_print_name. + + * gpgsm.c: Include "asshelp.h". + (main): Remove assuan_set_assuan_log_prefix. Add + assuan_set_log_cb. + * server.c (gpgsm_server): Remove assuan_set_log_stream. + +2010-03-10 Werner Koch <wk@g10code.com> + + * Makefile.am (common_libs): Remove libjnlib.a. Change order. + + * gpgsm.h: Remove "estream.h". + +2010-03-08 Werner Koch <wk@g10code.com> + + * certreqgen.c (gpgsm_genkey): Change OUT_FP to an estream_t + OUT_STREAM. + * certreqgen-ui.c (gpgsm_gencertreq_tty): ditto. + + * server.c (cmd_genkey): Close IN_STREAM. + + * server.c (cmd_encrypt, cmd_decrypt, cmd_verify, cmd_sign): Avoid + dup call by using es_fdopen_nc. + (do_listkeys): Use es_fdopen_nc instead of dup and es_fdopen. + (cmd_export): Ditto. + (cmd_genkey): Ditto. + * export.c (popen_protect_tool): Change OUTFILE to an estream_t. + (export_p12): Change OUTFP and arg RETFP to an estream_t. + (gpgsm_p12_export): Change DATAFP to an estream_t. + (gpgsm_export): Remove arg FP. + * import.c (import_one): Change CERTFP and arg FP to an estream_t. + (popen_protect_tool): Ditto for OUTFILE. + (parse_p12): Change CERTFP to an estream_t. + * sign.c (hash_data, hash_and_copy_data): Use estream. + (gpgsm_sign): Change arg OUT_FP to an estream_t. + * verify.c (gpgsm_verify): Rename FP to IN_FP. Change FP and arg + OUT_FP to an estream_t. + (hash_data): Use estream. + * base64.c (struct reader_cb_parm_s): Change FP to an estream_t. + (gpgsm_create_reader): Ditto. + (simple_reader_cb, base64_reader_cb): Adjust accordingly. + * decrypt.c (gpgsm_decrypt): Change OUT_FP and IN_FP to an estream_t. + * encrypt.c (gpgsm_encrypt): Change OUT_FP to an estream_t. Ditto + for DATA_FD. + (encrypt_cb): Use estream. + * gpgsm.c (main) <aEncr, aVerify, aSign, aDecrypt>: Use estream + functions. + (main) <aExport, aKeygen>: Use open_es_fwrite. + +2009-12-14 Werner Koch <wk@g10code.com> + + * server.c (cmd_passwd): New. + (register_commands): Register new command. + +2009-12-10 Werner Koch <wk@g10code.com> + + * gpgsm.c: Add option --ignore-cert-extension. + * gpgsm.h (opt): Add field IGNORED_CERT_EXTENSIONS. + * certchain.c (unknown_criticals): Handle ignored extensions, + +2009-12-08 Werner Koch <wk@g10code.com> + + * keydb.c (keydb_search_kid): Fix code even that it is not used. + (classify_user_id): Adjust for change of u.kid type. + (keydb_classify_name): Replace GPG_ERR_INV_NAME by + GPG_ERR_INV_USER_ID. + (keydb_classify_name): Remove. Replace all callers by + classify_user_id. + +2009-12-08 Marcus Brinkmann <marcus@g10code.de> + + * call-dirmngr.c (start_dirmngr_ext): Convert posix fd to assuan fd. + +2009-12-03 Werner Koch <wk@g10code.com> + + * gpgsm.c (set_debug): Allow for numerical debug leveles. Print + active debug flags. + +2009-12-02 Werner Koch <wk@g10code.com> + + * verify.c (gpgsm_verify): Add audit info on hash algorithms. + + * sign.c (gpgsm_sign): Add audit log calls. + (hash_data): Return an error indicator. + +2009-12-01 Werner Koch <wk@g10code.com> + + * decrypt.c (gpgsm_decrypt): Add audit log calls. + + * gpgsm.c: New option --html-audit-log. + +2009-11-25 Marcus Brinkmann <marcus@g10code.de> + + * server.c (gpgsm_server): Use assuan_fd_t and assuan_fdopen on + fds. + +2009-11-23 Werner Koch <wk@g10code.com> + + * gpgsm.c (main) <aGpgConfList>: Add key "default_pubkey_algo". + +2009-11-10 Marcus Brinkmann <marcus@g10code.de> + + * server.c (cmd_getauditlog): Don't dup FD for es_fdopen_nc as + this leaks the FD here. + +2009-11-05 Marcus Brinkmann <marcus@g10code.de> + + * call-dirmngr.c (start_dirmngr_ext): Update use of + assuan_pipe_connect and assuan_socket_connect. + +2009-11-04 Werner Koch <wk@g10code.com> + + * certreqgen.c (proc_parameters): Change fallback key length to + 2048. + + * server.c (register_commands): Add help arg to + assuan_register_command. Provide help strings for all commands. + +2009-11-02 Marcus Brinkmann <marcus@g10code.de> + + * server.c (reset_notify, input_notify, output_notify): Update to + new assuan interface. + (register_commands): Use assuan_handler_t. + * call-agent.c (membuf_data_cb, default_inq_cb) + (inq_ciphertext_cb, scd_serialno_status_cb) + (scd_keypairinfo_status_cb, istrusted_status_cb) + (learn_status_cb, learn_cb, keyinfo_status_cb): Return gpg_error_t. + +2009-10-16 Werner Koch <wk@g10code.com> + + * gpgsm.c (default_include_certs): Change to -2. + (DEFAULT_INCLUDE_CERTS): New. + (DEFAULT_CIPHER_ALGO): New. Use instead of hardcoded "3DES". + +2009-09-30 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Remove obsolete GCRYCTL_DISABLE_INTERNAL_LOCKING. + +2009-09-23 Marcus Brinkmann <marcus@g10code.de> + + * gpgsm.c (main): Update to new assuan API. + * server.c: Include "gpgsm.h" before <assuan.h> due to check for + GPG_ERR_SOURCE_DEFAULT and assuan.h now including gpg-error.h. + (option_handler, cmd_recipient, cmd_signer, cmd_encrypt) + (cmd_decrypt, cmd_verify, cmd_sign, cmd_import, cmd_export) + (cmd_delkeys, cmd_message, cmd_listkeys, cmd_dumpkeys) + (cmd_listsecretkeys, cmd_dumpsecretkeys, cmd_genkey) + (cmd_getauditlog, cmd_getinfo): Return gpg_error_t instead of int. + (register_commands): Same for member HANDLER in table. + (gpgsm_server): Allocate assuan context before starting server. + * sm/call-dirmngr.c: + * call-dirmngr.c (prepare_dirmngr): Check for CTX and error before + setting LDAPSERVER. + (start_dirmngr_ext): Allocate assuan context before starting + server. + (inq_certificate, isvalid_status_cb, lookup_cb, lookup_status_cb) + (run_command_cb, run_command_inq_cb, run_command_status_cb): + Return gpg_error_t instead of int. + +2009-08-06 Werner Koch <wk@g10code.com> + + * sign.c (gpgsm_sign): Print INV_SNDR for a bad default key. + + * server.c (cmd_signer): Remove unneeded case for -1. Send + INV_SGNR. Use new map function. + (cmd_recipient): Use new map function. + * gpgsm.c (do_add_recipient): Use new map function for INV_RECP. + (main): Ditto. Also send INV_SGNR. + +2009-07-30 Werner Koch <wk@g10code.com> + + * call-agent.c (learn_cb): Do not store as ephemeral. + +2009-07-29 Marcus Brinkmann <marcus@g10code.com> + + * keylist.c (print_capabilities): Print a trailing colon. + +2009-07-23 Werner Koch <wk@g10code.com> + + * certchain.c (is_cert_still_valid): Emit AUDIT_CRL_CHECK. + +2009-07-07 Werner Koch <wk@g10code.com> + + * server.c (command_has_option): New. + (cmd_getinfo): Add subcommand "cmd_has_option". + (cmd_import): Implement option --re-import. + * import.c (gpgsm_import): Add arg reimport_mode. + (reimport_one): New. + + * gpgsm.h: Include session-env.h. + (opt): Add field SESSION_ENV. Remove obsolete fields. + * server.c (option_handler): Rewrite setting of option fields. + Replace strdup by xtrystrdup. + * gpgsm.c (set_opt_session_env): New. + (main): Use it for oDisplay, oTTYname, oTTYtype and oXauthority. + * call-agent.c (start_agent): Adjust start_new_gpg_agent for + changed args. + * misc.c (setup_pinentry_env): Use new session_env stuff. + +2009-07-02 Werner Koch <wk@g10code.com> + + * certreqgen-ui.c (gpgsm_gencertreq_tty): Allow using a key from a + card. + * call-agent.c (gpgsm_agent_scd_serialno) + (scd_serialno_status_cb, store_serialno): New. + (scd_keypairinfo_status_cb, gpgsm_agent_scd_keypairinfo): New. + +2009-07-01 Werner Koch <wk@g10code.com> + + * certreqgen-ui.c (check_keygrip): New. + (gpgsm_gencertreq_tty): Allow using an existing key. + + * gpgsm.c (open_es_fread): New. + (main) <aKeygen>: Implement --batch mode. + +2009-06-24 Werner Koch <wk@g10code.com> + + * call-dirmngr.c (pattern_from_strlist): Remove dead assignment of N. + * sign.c (gpgsm_sign): Remove dead assignment. + * certreqgen.c (create_request): Assign GPG_ERR_BUG to RC. + Reported by Fabian Keil. + +2009-05-27 Werner Koch <wk@g10code.com> + + * encrypt.c (encrypt_dek): Make use of make_canon_sexp. + +2009-05-18 Werner Koch <wk@g10code.com> + + * server.c (option_handler): New option "no-encrypt-to". + (cmd_encrypt): Make use of it. + + * gpgsm.c: Remove not implemented --verify-files. + +2009-04-02 Werner Koch <wk@g10code.com> + + * keylist.c (list_cert_std): Print card serial number. + +2009-04-01 Werner Koch <wk@g10code.com> + + * export.c (popen_protect_tool): Add command line option + --agent-program and pass flag bit 6. + * import.c (popen_protect_tool): Ditto. + +2009-03-26 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): s/def_digest_string/forced_digest_algo/ and + activate the --digest-algo option. + * gpgsm.h (struct opt): s/def_digest_algo/forced_digest_algo/. + * sign.c (gpgsm_sign): Implement --digest-algo. + + * sign.c (MAX_DIGEST_LEN): Change to 64. + + * call-agent.c (gpgsm_agent_marktrusted): Format the issuer name. + +2009-03-25 Werner Koch <wk@g10code.com> + + * decrypt.c (gpgsm_decrypt): Print ENC_TO and NO_SECKEY stati. + Fixes bug#1020. + * fingerprint.c (gpgsm_get_short_fingerprint): Add arg R_HIGH and + change all callers. + +2009-03-23 Werner Koch <wk@g10code.com> + + * delete.c (delete_one): Also delete ephemeral certificates if + specified uniquely. + +2009-03-20 Werner Koch <wk@g10code.com> + + * keylist.c (list_internal_keys): Set released cert to NULL. + + * call-agent.c (learn_status_cb): New. + (gpgsm_agent_learn): Use it. + (learn_cb): Send a progress for every certificate. + +2009-03-18 Werner Koch <wk@g10code.com> + + * gpgsm.h (struct opt): Move field WITH_EPHEMERAL_KEYS to struct + server_control_s. + * gpgsm.c (main): Change accordingly. + * keylist.c (list_internal_keys): Ditto. + * server.c (option_handler): Add "with-ephemeral-keys". + +2009-03-12 Werner Koch <wk@g10code.com> + + * certdump.c (gpgsm_dump_time): Remove. + * certdump.c, verify.c, certchain.c + * gpgsm.c: s/gpgsm_dump_time/dump_isotime/. + +2009-03-06 Werner Koch <wk@g10code.com> + + * call-agent.c (gpgsm_agent_keyinfo, keyinfo_status_cb): New. + * keylist.c (list_cert_colon): Print card S/N. + + * keylist.c (list_internal_keys): Always list ephemeral keys if + specified by keygrip or fingerprint. + (list_cert_raw): Always show ephemeral flag. + * export.c (gpgsm_export): Export ephemeral keys if specified by + keygrip. + +2009-02-09 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Change default cipher back to 3DES. + +2009-01-12 Werner Koch <wk@g10code.com> + + * keylist.c (print_utf8_extn_raw): Cast printf precision argument. + +2009-01-08 Werner Koch <wk@g10code.com> + + * fingerprint.c (gpgsm_get_keygrip_hexstring): Add error detection. + +2008-12-10 Werner Koch <wk@g10code.com> + + * gpgsm.c (our_cipher_test_algo): Use the GCRY constants as we now + require 1.4. + (our_md_test_algo): Ditto. Add SHA224. + (main) <aGpgConfList>: Update default cipher algo. + +2008-12-09 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Call i18n_init before init_common_subsystems. + +2008-12-05 Werner Koch <wk@g10code.com> + + * certreqgen.c (create_request): Provide a custom prompt for the + signing. + + * certdump.c (gpgsm_format_keydesc): Remove debug output. + (gpgsm_format_keydesc): Remove saving of errno as xfree is + supposed not to change it. Use the new percent_plus_escape + function which also fixes the issue that we did not escaped a + percent in the past. + +2008-11-18 Werner Koch <wk@g10code.com> + + * gpgsm.c (make_libversion): New. + (my_strusage): Use new function. + (build_lib_list): Remove. + +2008-11-13 Werner Koch <wk@g10code.com> + + * gpgsm.c: Remove all unused options. Use ARGPARSE macros. + +2008-10-28 Werner Koch <wk@g10code.com> + + * certdump.c (gpgsm_format_keydesc): Use xtryasprintf and xfree. + (gpgsm_es_print_name): Factor code out to ... + (gpgsm_es_print_name2): New function. + (gpgsm_format_name2, format_name_writer): Use estream so that it + works on all platforms. + (format_name_writer): Fix reallocation bug. + +2008-10-23 Werner Koch <wk@g10code.com> + + * import.c (popen_protect_tool): Add arg CTRL and assure that the + agent is running. Pass a value for CTRL from all caller. + * export.c (popen_protect_tool): Ditto. + +2008-10-21 Werner Koch <wk@g10code.com> + + * call-dirmngr.c (inq_certificate_parm_s): Add field CTRL. + (gpgsm_dirmngr_isvalid): Supply a value for that field. + (inq_certificate): Add inquiry ISTRUSTED. + + * call-agent.c (gpgsm_agent_istrusted): Add new optional arg + HEXFPR. Changed all callers. + +2008-10-20 Werner Koch <wk@g10code.com> + + * keydb.c (keydb_locate_writable): Mark unused arg. + (keydb_search_kid): Ditto. + (keydb_clear_some_cert_flags): Ditto. + * server.c (cmd_encrypt): Ditto. + (cmd_decrypt, cmd_verify, cmd_import, cmd_genkey): Ditto. + * call-agent.c (gpgsm_scd_pksign): Ditto. + * call-dirmngr.c (release_dirmngr, release_dirmngr2) + (run_command_cb): Ditto. + * certlist.c (gpgsm_add_cert_to_certlist): Ditto. + * certchain.c (find_up_dirmngr): Ditto. + * keylist.c (print_key_data): Ditto. + (list_cert_raw, list_cert_std): Ditto. + * qualified.c (gpgsm_is_in_qualified_list): Ditto. + + * gpgsm.c (set_binary) [!W32]: Mark unused arg. + +2008-10-17 Werner Koch <wk@g10code.com> + + * call-dirmngr.c (start_dirmngr, start_dirmngr2): Reset the lock + flag on error. + (release_dirmngr, release_dirmngr2): Replace asserts by error messages. + (gpgsm_dirmngr_lookup): Replace assert by fatal error message. + +2008-10-13 Werner Koch <wk@g10code.com> + + * gpgsm.c: Add alias --delete-keys. + +2008-09-30 Werner Koch <wk@g10code.com> + + * server.c (cmd_getinfo): New subcommand agent-check. + * call-agent.c (gpgsm_agent_send_nop): New. + +2008-09-29 Werner Koch <wk@g10code.com> + + * certcheck.c (MY_GCRY_PK_ECDSA): Remove. Change users to + GCRY_PK_ECDSA. + * gpgsm.c (MY_GCRY_PK_ECDSA): Ditto. + * sign.c (MY_GCRY_MD_SHA224): Remove change users to GCRY_MD_SHA224. + +2008-09-04 Werner Koch <wk@g10code.com> + + * certdump.c (gpgsm_format_keydesc): Work around a mingw32 bug. + +2008-09-03 Werner Koch <wk@g10code.com> + + * sign.c (MY_GCRY_MD_SHA224): New, so that we don't need libgcrypt + 1.2. + +2008-08-13 Werner Koch <wk@g10code.com> + + * keylist.c (list_cert_colon): Print 'f' for validated certs. + +2008-08-08 Marcus Brinkmann <marcus@g10code.de> + + * gpgsm.h (struct server_control_s): Remove member dirmngr_seen. + * call-dirmngr.c (dirmngr2_ctx, dirmngr_ctx_locked) + (dirmngr2_ctx_locked): New global variables. + (prepare_dirmngr): Don't check dirmngr_seen anymore. + (start_dirmngr): Move bunch of code to ... + (start_dirmngr_ext): ... this new function. + (release_dirmngr, start_dirmngr2, release_dirmngr2): New + functions. + (gpgsm_dirmngr_isvalid): Call release_dirmngr. + (gpgsm_dirmngr_lookup): Call release_dirmngr. If dirmngr_ctx is + locked, use dirmngr2_locked. + (gpgsm_dirmngr_run_command): Call release_dirmngr. + +2008-06-25 Werner Koch <wk@g10code.com> + + * sign.c (gpgsm_sign): Revamp the hash algorithm selection. + * gpgsm.h (struct certlist_s): Add field HASH_ALGO and HASH_ALGO_OID. + + * qualified.c (gpgsm_qualified_consent): Fix double free. + + * gpgsm.c (main): Change default cipher algo to AES. + + * keylist.c (print_utf8_extn_raw, print_utf8_extn): New. + (list_cert_raw, list_cert_std): Print the TeleSec restriction + extension. + +2008-06-23 Werner Koch <wk@g10code.com> + + * encrypt.c (encode_session_key): Replace xmalloc by xtrymalloc. + Use bin2hex instead of open coding the conversion. + (encrypt_dek): Init S_DATA. + +2008-06-13 Marcus Brinkmann <marcus@ulysses.g10code.com> + + * call-dirmngr.c (prepare_dirmngr): Fix error code to ignore. + +2008-06-12 Marcus Brinkmann <marcus@g10code.de> + + * gpgsm.h (struct keyserver_spec): New struct. + (opt): Add member keyserver. + * gpgsm.c (keyserver_list_free, parse_keyserver_line): New functions. + (main): Implement --keyserver option. + * call-dirmngr.c (prepare_dirmngr): Send LDAPSERVER commands. + +2008-05-20 Werner Koch <wk@g10code.com> + + * gpgsm.c (main) <aExportSecretKeyP12>: Pass FP and not stdout to + the export function. Reported by Marc Mutz. + +2008-05-06 Werner Koch <wk@g10code.com> + + * keylist.c (list_external_keys): Ignore NOT FOUND error code. + This is bug#907. + +2008-04-23 Werner Koch <wk@g10code.com> + + * certchain.c (find_up): Make correct C89 code. Declare variable + at the top of the block. Reported by Alain Guibert. + +2008-04-09 Werner Koch <wk@g10code.com> + + * verify.c (gpgsm_verify): Print the message hash values on error. + +2008-03-31 Werner Koch <wk@g10code.com> + + * call-dirmngr.c (start_dirmngr): Use log_info instead of + log_error when falling back to start dirmngr. + +2008-03-20 Werner Koch <wk@g10code.com> + + * certlist.c (gpgsm_add_to_certlist): Always save the first + subject and issuer. Initialize issuer with issuer and not with + subject. + (same_subject_issuer): Set issuer2 to issuer and not to subject. + +2008-03-17 Werner Koch <wk@g10code.com> + + * certdump.c (my_funopen_hook_size_t): New. + (format_name_writer): Use it. + +2008-03-13 Werner Koch <wk@g10code.com> + + * certdump.c (gpgsm_fpr_and_name_for_status): Fix signed/unsigned + char issue. + (gpgsm_format_keydesc): Remove superfluous test. Add expire date + to the prompt. + +2008-02-18 Werner Koch <wk@g10code.com> + + * certchain.c (gpgsm_is_root_cert): Factor code out to ... + (is_root_cert): New. Extend test for self-issued certificates + signed by other CAs. + (do_validate_chain, gpgsm_basic_cert_check) + (gpgsm_walk_cert_chain): Use it here. + + * gpgsm.c: Add option --no-common-certs-import. + + * certchain.c (find_up_dirmngr, find_up, do_validate_chain) + (check_cert_policy): Be more silent with --quiet. + + * gpgsm.c: Add option --disable-dirmngr. + * gpgsm.h (opt): Add field DISABLE_DIRMNGR. + * call-dirmngr.c (start_dirmngr): Implement option. + +2008-02-14 Werner Koch <wk@g10code.com> + + * server.c (option_handler): Add option allow-pinentry-notify. + (gpgsm_proxy_pinentry_notify): New. + * call-agent.c (default_inq_cb): New. + (gpgsm_agent_pksign, gpgsm_scd_pksign, gpgsm_agent_readkey) + (gpgsm_agent_istrusted, gpgsm_agent_marktrusted) + (gpgsm_agent_passwd, gpgsm_agent_get_confirmation): Call it. + (struct cipher_parm_s, struct genkey_parm_s): Add field CTRL. + (inq_ciphertext_cb): Test keyword and fallback to default_inq_cb. + (inq_genkey_parms): Ditto. + (start_agent): Tell agent to send us the pinentry notifications. + +2008-02-13 Werner Koch <wk@g10code.com> + + * call-dirmngr.c (gpgsm_dirmngr_lookup): Add arg CACHE_ONLY. + * keylist.c (list_external_keys): Pass false for new arg. + * certchain.c (find_up_dirmngr): New. + (find_up): Also try to read from the dirmngr cache. + (find_up, find_up_external, gpgsm_walk_cert_chain) + (gpgsm_basic_cert_check, allowed_ca): Add arg CTRL and changed all + callers. + * call-agent.c (struct learn_parm_s): Add field CTRL. + (gpgsm_agent_learn): Set it. + +2008-02-11 Werner Koch <wk@g10code.com> + + * server.c (cmd_getinfo): New. + (gpgsm_server): Register GETINFO. + +2008-01-29 Marcus Brinkmann <marcus@g10code.de> + + * keylist.c (list_internal_keys): New variable lastcert. Use it + to suppress duplicates which immediately follow each other. + +2008-01-27 Werner Koch <wk@g10code.com> + + * import.c (popen_protect_tool): Set bit 7 in the flags for + gnupg_spawn_process so that under W32 no window appears. + * export.c (popen_protect_tool): Ditto. + +2007-12-13 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Add option --extra-digest-algo. + * gpgsm.h (struct): Add EXTRA_DIGEST_ALGO. + * verify.c (gpgsm_verify): Use it. Use the hash algorithm from + the signature value. + +2007-12-11 Werner Koch <wk@g10code.com> + + * certchain.c (do_validate_chain): Log AUDIT_ROOT_TRUSTED. + + * server.c (cmd_sign, cmd_decrypt, cmd_encrypt): Start audit log. + (cmd_recipient): Start audit session. + + * gpgsm.c (main): Revamp creation of the audit log. + + * gpgsm.h (struct server_control_s): Add AGENT_SEEN and DIRMNGR_SEEN. + * call-agent.c (start_agent): Record an audit event. + * call-dirmngr.c (start_dirmngr): Ditto. Add new arg CTRL and pass + it from all callers. + (prepare_dirmngr): New helper for start_dirmngr. + + * encrypt.c (gpgsm_encrypt): Add calls to audit_log. + +2007-12-03 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Call gnupg_reopen_std. + +h2007-11-22 Werner Koch <wk@g10code.com> + + * server.c (cmd_getauditlog): New. + (register_commands): Register GETAUDITLOG. + +2007-11-19 Werner Koch <wk@g10code.com> + + * server.c (cmd_recipient, cmd_signer): Add error reason 11. + + * gpgsm.c (main): Print a warning if --audit-log is used. + +2007-11-15 Werner Koch <wk@g10code.com> + + * gpgsm.h (struct): Add XAUTHORITY and PINENTRY_USER_DATA. + * misc.c (setup_pinentry_env): Add XAUTHORITY and PINENTRY_USER_DATA. + * gpgsm.c (main): New option --xauthority. + * call-agent.c (start_agent): Adjust for changed start_new_gpg_agent. + * server.c (option_handler): Ad the new options. + +2007-11-07 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): New option --audit-log. + * server.c (option_handler): New option enable-audit-log. + (start_audit_session): New. + (cmd_verify): Create audit context. + (gpgsm_server): Release the context. + + * gpgsm.h (struct server_control_s): Add member AUDIT, include + audit.h. + * certdump.c (gpgsm_format_sn_issuer): New. + * verify.c (hash_data): Return an error code. + (gpgsm_verify): Add calls to audit_log. + + * gpgsm.c (get_status_string): Remove. + * gpgsm.h: Include status.h instead of errors.h. + +2007-10-19 Werner Koch <wk@g10code.com> + + * qualified.c (gpgsm_qualified_consent): Use i18N-swicth functions. + (gpgsm_not_qualified_warning): Ditto. + * certdump.c (gpgsm_format_keydesc): Ditto. + +2007-09-14 Werner Koch <wk@g10code.com> + + * gpgsm.c (build_lib_list): New. + (my_strusage): Print lib info. + +2007-08-24 Werner Koch <wk@g10code.com> + + * Makefile.am (common_libs): Swap libkeybox and jnlib. + +2007-08-23 Werner Koch <wk@g10code.com> + + * certlist.c (gpgsm_certs_identical_p): New. + (gpgsm_add_to_certlist): Ignore duplicate certificates in + ambigious name detection. + (gpgsm_find_cert): Ditto. + * export.c (gpgsm_p12_export): Ditto. + +2007-08-22 Werner Koch <wk@g10code.com> + + * certreqgen.c (create_request): Replace open coding by bin2hex. + + * certreqgen-ui.c (gpgsm_gencertreq_tty): Use es_fopenmem. + +2007-08-21 Werner Koch <wk@g10code.com> + + * import.c (parse_p12): Use gnupg_tmpfile. + * export.c (export_p12): Ditto. + +2007-08-20 Werner Koch <wk@g10code.com> + + * certreqgen.c (read_parameters): Change FP to an estream_t. + (gpgsm_genkey): Replace in_fd and in_stream by a estream_t. + * server.c (cmd_genkey): Adjust for that. + * certreqgen-ui.c (gpgsm_gencertreq_tty): Use es_open_memstream + instead of a temporary file. + +2007-08-14 Werner Koch <wk@g10code.com> + + * call-dirmngr.c (start_dirmngr): Use dirmngr_socket_name. change + the way infostr is xstrdupped. + + * gpgsm.c (main) [W32]: Make --prefer-system-dirmngr a dummy under + Windows. + +2007-08-13 Werner Koch <wk@g10code.com> + + * gpgsm.c (do_add_recipient): Add RECP_REQUIRED and make error + message depend on that. + (main): Add avriable RECP_REQUIRED, set ift for encryption + commands and pass it to do_add_recipient. + (our_pk_test_algo, our_cipher_test_algo, our_md_test_algo): Implement. + +2007-08-09 Werner Koch <wk@g10code.com> + + * gpgsm.c (main) [W32]: Enable CRL check by default. + (main): Update the default control structure after reading the + options. + (gpgsm_parse_validation_model, parse_validation_model): New. + (main): New option --validation-model. + * certchain.c (gpgsm_validate_chain): Implement this option. + * server.c (option_handler): Ditto. + + * certchain.c (is_cert_still_valid): Reformatted. Add arg + FORCE_OCSP. Changed callers to set this flag when using the chain + model. + +2007-08-08 Werner Koch <wk@g10code.com> + + * certdump.c (gpgsm_print_serial): Fixed brown paper bag style bugs + which prefixed the output with a 3A and cut it off at a 00. + + * keylist.c (list_cert_raw): Print the certificate ID first and + rename "Serial number" to "S/N". + (list_cert_std): Ditto. + +2007-08-07 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Allow a string for --faked-system-time. + +2007-08-06 Werner Koch <wk@g10code.com> + + Implementation of the chain model. + + * gpgsm.h (struct rootca_flags_s): Define new members VALID and + CHAIN_MODEL. + * call-agent.c (gpgsm_agent_istrusted): Mark ROOTCA_FLAGS valid. + (istrusted_status_cb): Set CHAIN_MODEL. + * certchain.c (gpgsm_validate_chain): Replace LM alias by LISTMODE + and FP by LISTFP. + (gpgsm_validate_chain): Factor some code out to ... + (check_validity_period, ask_marktrusted): .. new. + (check_validity_cm_basic, check_validity_cm_main): New. + (do_validate_chain): New with all code from gpgsm_validate_chain. + New arg ROOTCA_FLAGS. + (gpgsm_validate_chain): Provide ROOTCA_FLAGS and fallback to chain + model. Add RETFLAGS arg and changed all callers to pass NULL. Add + CHECKTIME arg and changed all callers to pass a nil value. + (has_validity_model_chain): New. + * verify.c (gpgsm_verify): Check for chain model and return as + part of the trust status. + + * gpgsm.h (VALIDATE_FLAG_NO_DIRMNGR): New. + (VALIDATE_FLAG_NO_DIRMNGR): New. + * call-dirmngr.c (gpgsm_dirmngr_isvalid): Use constant here. + +2007-08-03 Werner Koch <wk@g10code.com> + + * keylist.c (list_cert_colon): Avoid duplicate listing of kludge + uids. + + * verify.c (gpgsm_verify): Make STATUS_VERIFY return the hash and + pk algo. + * certcheck.c (gpgsm_check_cms_signature): Add arg R_PKALGO. + +2007-08-02 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Factored GC_OPT_FLAGS out to gc-opt-flags.h. + +2007-07-17 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Implement --default-key. + (main) <gpgconf-list>: Declare --default-key and --encrypt-to. + +2007-07-16 Werner Koch <wk@g10code.com> + + * server.c (cmd_message): Use gnupg_fd_t to avoid dependecy on + newer assuan versions. + +2007-07-12 Werner Koch <wk@g10code.com> + + * gpgsm.c (check_special_filename): Use translate_sys2libc_fd_int + when passing an int value. + * server.c (cmd_encrypt, cmd_decrypt, cmd_verify, cmd_import) + (cmd_export, cmd_message, cmd_genkey): Translate file descriptors. + +2007-07-05 Werner Koch <wk@g10code.com> + + * Makefile.am (common_libs): Changed order of libs. + +2007-07-04 Werner Koch <wk@g10code.com> + + * certchain.c (check_cert_policy): Remove extra checks for + GPG_ERR_NO_VALUE. They are not needed since libksba 1.0.1. + * keylist.c (print_capabilities, list_cert_raw, list_cert_std): Ditto. + * certlist.c (cert_usage_p, cert_usage_p): Ditto. + +2007-06-26 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Call gnupg_rl_initialize. + * Makefile.am (gpgsm_LDADD): Add LIBREADLINE and libgpgrl.a. + +2007-06-25 Werner Koch <wk@g10code.com> + + * gpgsm.c (check_special_filename): Use translate_sys2libc_fd and + add new arg FOR_WRITE. Change callers to pass new arg. + +2007-06-24 Werner Koch <wk@g10code.com> + + * gpgsm.c (open_es_fwrite): Avoid the dup by using the new + es_fdopen_nc(). + +2007-06-21 Werner Koch <wk@g10code.com> + + * certreqgen-ui.c: New. + * gpgsm.c (main): Let --gen-key call it. + * certreqgen.c (gpgsm_genkey): Add optional IN_STREAM arg and + adjusted caller. + + * gpgsm.h (ctrl_t): Remove. It is now declared in ../common/util.h. + + * call-agent.c (start_agent): Factored almost all code out to + ../common/asshelp.c. + +2007-06-20 Werner Koch <wk@g10code.com> + + * call-agent.c (start_agent) [W32]: Start the agent on the fly. + +2007-06-18 Marcus Brinkmann <marcus@g10code.de> + + * gpgsm.c (main): Percent escape output of --gpgconf-list. + +2007-06-14 Werner Koch <wk@g10code.com> + + * call-agent.c (start_agent): Use gnupg_module_name. + * call-dirmngr.c (start_dirmngr): Ditto. + * export.c (export_p12): Ditto. + * import.c (parse_p12): Ditto. + * gpgsm.c (run_protect_tool): Ditto. + +2007-06-12 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Replace some calls by init_common_subsystems. + (main): Use gnupg_datadir. + * qualified.c (read_list): Use gnupg-datadir. + +2007-06-11 Werner Koch <wk@g10code.com> + + * Makefile.am (common_libs): Use libcommaonstd macr. + + * gpgsm.c (main) [W32]: Call pth_init. + +2007-06-06 Werner Koch <wk@g10code.com> + + * qualified.c (gpgsm_not_qualified_warning) [!ENABLE_NLS]: Do not + define orig_codeset. + * certdump.c (gpgsm_format_keydesc) [!ENABLE_NLS]: Do not define + orig_codeset. + (format_name_writer): Define only if funopen et al is available. + + * gpgsm.c (i18n_init): Remove. + +2007-05-29 Werner Koch <wk@g10code.com> + + * export.c (gpgsm_p12_export): Print passphrase encoding info only + in PEM mode. + +2007-05-18 Marcus Brinkmann <marcus@g10code.de> + + * qualified.c (gpgsm_qualified_consent, + gpgsm_not_qualified_warning): Free ORIG_CODESET on error. + * certdump.c (gpgsm_format_keydesc): Likewise. + +2007-05-07 Werner Koch <wk@g10code.com> + + * certcheck.c (MY_GCRY_PK_ECDSA): New. + +2007-04-20 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Parameterize failed versions check messages. + +2007-04-19 Werner Koch <wk@g10code.com> + + * certcheck.c (do_encode_md): Add arg PKEY. Add support for DSA2 + and all ECDSA sizes. + (get_dsa_qbits): New. + (pk_algo_from_sexp): A key will never contain ecdsa as algorithm, + so remove that. + +2007-04-18 Werner Koch <wk@g10code.com> + + * certcheck.c (do_encode_md): Support 160 bit ECDSA. + +2007-04-13 Werner Koch <wk@g10code.com> + + * call-agent.c (start_agent): Don't use log_error when using the + fallback hack to start the agent. This is bug 782. + +2007-03-20 Werner Koch <wk@g10code.com> + + * fingerprint.c (gpgsm_get_fingerprint): Add caching. + (gpgsm_get_fingerprint_string): Use bin2hexcolon(). + (gpgsm_get_fingerprint_hexstring): Use bin2hex and allocate only + as much memory as required. + (gpgsm_get_keygrip_hexstring): Use bin2hex. + + * certchain.c (gpgsm_validate_chain): Keep track of the + certificate chain and reset the ephemeral flags. + * keydb.c (keydb_set_cert_flags): New args EPHEMERAL and MASK. + Changed caller to use a mask of ~0. Return a proper error code if + the certificate is not available. + + * gpgsm.c: Add option --p12-charset. + * gpgsm.h (struct opt): Add p12_charset. + * export.c (popen_protect_tool): Use new option. + +2007-03-19 Werner Koch <wk@g10code.com> + + Changes to let export and key listing use estream to help systems + without funopen. + + * keylist.c: Use estream in place of stdio functions. + * gpgsm.c (open_es_fwrite): New. + (main): Use it for the list commands. + * server.c (data_line_cookie_functions): New. + (data_line_cookie_write, data_line_cookie_close): New. + (do_listkeys): Use estream. + + * certdump.c (gpgsm_print_serial): Changed to use estream. + (gpgsm_print_time): Ditto. + (pretty_es_print_sexp): New. + (gpgsm_es_print_name): New. + (print_dn_part): New arg STREAM. Changed all callers. + (print_dn_parts): Ditto. + * certchain.c (gpgsm_validate_chain): Changed FP to type + estream_t. + (do_list, unknown_criticals, allowed_ca, check_cert_policy) + (is_cert_still_valid): Ditto. + + * export.c (gpgsm_export): New arg STREAM. + (do_putc, do_fputs): New. + (print_short_info): Allow printing to optional STREAM. + * server.c (cmd_export): Use stream. + * base64.c (do_putc, do_fputs): New. + (base64_writer_cb, base64_finish_write): Let them cope with an + alternate output function. + (plain_writer_cb): New. + (gpgsm_create_writer): New arg STREAM and call plain_writer_cb for + binary output to an estream. Changed call callers. + +2007-01-31 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Let --gen-key print a more informative error + message. + +2007-01-25 Werner Koch <wk@g10code.com> + + * Makefile.am (gpgsm_LDADD): Add LIBICONV. Noted by Billy Halsey. + +2007-01-05 Werner Koch <wk@g10code.com> + + * certchain.c (unknown_criticals): Add subjectAltName. + +2006-12-21 Werner Koch <wk@g10code.com> + + * gpgsm.c: Comment mtrace feature. + +2006-12-21 Marcus Brinkmann <marcus@g10code.de> + + * certchain.c (gpgsm_basic_cert_check): Release SUBJECT. + + * encrypt.c (encrypt_dek): Release S_CIPH. + +2006-12-20 Marcus Brinkmann <marcus@g10code.de> + + * server.c (gpgsm_server): Release CTRL->server_local. + + * base64.c: Add new members READER and WRITER in union U2. + (gpgsm_create_reader): Initialise CTX->u2.reader. + (gpgsm_destroy_reader): Invoke ksba_reader_release. Return early + if CTX is NULL. + (gpgsm_create_writer): Initialise CTX->u2.writer. + (gpgsm_destroy_writer): Invoke ksba_writer_release. Return early + if CTX is NULL. + +2006-12-18 Marcus Brinkmann <marcus@g10code.de> + + * fingerprint.c (gpgsm_get_fingerprint): Close MD. + +2006-11-24 Werner Koch <wk@g10code.com> + + * certdump.c (parse_dn_part): Take '#' as a special character only + at the beginning of a string. + +2006-11-21 Werner Koch <wk@g10code.com> + + * certdump.c (my_funopen_hook_ret_t): New. + (format_name_writer): Use it for the return value. + +2006-11-14 Werner Koch <wk@g10code.com> + + * server.c (skip_options): Skip leading spaces. + (has_option): Honor "--". + (cmd_export): Add option --data to do an inline export. Skip all + options. + + * certdump.c (gpgsm_fpr_and_name_for_status): New. + * verify.c (gpgsm_verify): Use it to print correct status messages. + +2006-11-11 Werner Koch <wk@g10code.com> + + * server.c (skip_options): New. + +2006-10-24 Marcus Brinkmann <marcus@g10code.de> + + * Makefile.am (AM_CFLAGS): Add $(LIBASSUAN_CFLAGS). + +2006-10-23 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Remap common cipher algo names to their OIDs. + (main): New command --gpgconf-test. + +2006-10-20 Werner Koch <wk@g10code.com> + + * keydb.c (classify_user_id): Parse keygrip for the '&' identifier. + +2006-10-18 Werner Koch <wk@g10code.com> + + * keylist.c (list_cert_raw): Also test for GPG_ERR_NO_VALUE when + testing for GPG_ERR_NO_DATA. + * certlist.c (cert_usage_p, gpgsm_find_cert): Ditto. + * certchain.c (check_cert_policy): Ditto. + + * keylist.c (list_cert_std, list_cert_raw): Print "none" for no + chain length available. + +2006-10-17 Werner Koch <wk@g10code.com> + + * gpgsm.c: No need for pth.h. + (main): or to init it. It used to be hack for W32. + + * sign.c (gpgsm_get_default_cert): Changed to return only + certificates usable for signing. + +2006-10-16 Werner Koch <wk@g10code.com> + + * certchain.c (already_asked_marktrusted) + (set_already_asked_marktrusted): New. + (gpgsm_validate_chain) <not trusted>: Keep track of certificates + we already asked for. + +2006-10-11 Werner Koch <wk@g10code.com> + + * certreqgen.c (proc_parameters, create_request): Allow for + creation directly from a card. + * call-agent.c (gpgsm_agent_readkey): New arg FROMCARD. + (gpgsm_scd_pksign): New. + +2006-10-06 Werner Koch <wk@g10code.com> + + * Makefile.am (AM_CFLAGS): Use PTH version of libassuan. + (gpgsm_LDADD): Ditto. + +2006-10-05 Werner Koch <wk@g10code.com> + + * certcheck.c (do_encode_md): Check that the has algo is valid. + +2006-10-02 Marcus Brinkmann <marcus@g10code.de> + + * server.c (register_commands): New commands DUMPKEYS and + DUMPSECRETKEYS. + (cmd_dumpkeys, cmd_dumpsecretkeys): New functions. + (option_handler): Support with-key-data option. + +2006-09-26 Werner Koch <wk@g10code.com> + + * certchain.c (gpgsm_validate_chain): More changes for the relax + feature. Use certificate reference counting instead of the old + explicit tests. Added a missing free. + +2006-09-25 Werner Koch <wk@g10code.com> + + * gpgsm.h (struct rootca_flags_s): New. + * call-agent.c (istrusted_status_cb): New. + (gpgsm_agent_istrusted): New arg ROOTCA_FLAGS. + * keylist.c (list_cert_colon): Use dummy for new arg. + * certchain.c (gpgsm_validate_chain): Make use of the relax flag + for root certificates. + (unknown_criticals): Ignore a GPG_ERR_NO_VALUE. + +2006-09-20 Werner Koch <wk@g10code.com> + + * gpgsm.c: Add alias command --dump-cert. + + * Makefile.am: Changes to allow parallel make runs. + +2006-09-18 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Use this to import standard certificates. + * keydb.c (keydb_add_resource): New arg AUTO_CREATED. + +2006-09-14 Werner Koch <wk@g10code.com> + + Replaced all call gpg_error_from_errno(errno) by + gpg_error_from_syserror(). + +2006-09-13 Werner Koch <wk@g10code.com> + + * keylist.c (list_internal_keys): Print marker line to FP and not + to stdout. + + * gpgsm.c (main): All list key list commands now make ose of + --output. Cleaned up calls to list modes. New command + --dump-chain. Renamed --list-sigs to --list-chain and added an + alias for the old one. + + * server.c (cmd_message): Changed to use assuan_command_parse_fd. + (option_handler): New option list-to-output. + (do_listkeys): Use it. + +2006-09-06 Werner Koch <wk@g10code.com> + + * gpgsm.h (OUT_OF_CORE): Removed and changed all callers to + out_of_core. + (CTRL): Removed and changed everywhere to ctrl_t. + (CERTLIST): Ditto. + + Replaced all Assuan error codes by libgpg-error codes. Removed + all map_to_assuan_status and map_assuan_err. + + * gpgsm.c (main): Call assuan_set_assuan_err_source to have Assuan + switch to gpg-error codes. + * server.c (set_error): Adjusted. + +2006-08-29 Werner Koch <wk@g10code.com> + + * call-agent.c (gpgsm_agent_pkdecrypt): Allow decryption using + complete S-expressions as implemented by the current gpg-agent. + + * gpgsm.c (main): Implement --output for encrypt, decrypt, sign + and export. + +2006-07-03 Werner Koch <wk@g10code.com> + + * certreqgen.c (proc_parameters): Print the component label of a + faulty DN. + +2006-06-26 Werner Koch <wk@g10code.com> + + * certdump.c (gpgsm_cert_log_name): New. + * certchain.c (is_cert_still_valid): Log the name of the certificate. + +2006-06-20 Werner Koch <wk@g10code.com> + + * gpgsm.c (gpgsm_init_default_ctrl): Take care of the command line + option --include-certs. + + * keylist.c (list_cert_raw): Print the certid. + +2006-05-23 Werner Koch <wk@g10code.com> + + * keydb.c (hextobyte): Deleted as it is now defined in jnlib. + + * Makefile.am (gpgsm_LDADD): Include ZLIBS. + +2006-05-19 Marcus Brinkmann <marcus@g10code.de> + + * keydb.c (keydb_insert_cert): Do not lock here, but only check if + it is locked. + (keydb_store_cert): Lock here. + + * keydb.h (keydb_delete): Accept new argument UNLOCK. + * keydb.c (keydb_delete): Likewise. Only unlock if this is set. + * delete.c (delete_one): Add new argument to invocation of + keydb_delete. + +2006-05-15 Werner Koch <wk@g10code.com> + + * keylist.c (print_names_raw): Sanitize URI. + +2006-03-21 Werner Koch <wk@g10code.com> + + * certchain.c (get_regtp_ca_info): New. + (allowed_ca): Use it. + +2006-03-20 Werner Koch <wk@g10code.com> + + * qualified.c (gpgsm_is_in_qualified_list): New optional arg COUNTRY. + +2006-02-17 Werner Koch <wk@g10code.com> + + * call-dirmngr.c (start_dirmngr): Print name of dirmngr to be started. + +2005-11-23 Werner Koch <wk@g10code.com> + + * gpgsm.h: New member QUALSIG_APPROVAL. + * sign.c (gpgsm_sign): Print a warning if a certificate is not + qualified. + * qualified.c (gpgsm_qualified_consent): Include a note that this + is not approved software. + (gpgsm_not_qualified_warning): New. + * gpgsm.c (main): Prepared to print a note whether the software + has been approved. + +2005-11-13 Werner Koch <wk@g10code.com> + + * call-agent.c (gpgsm_agent_get_confirmation): New. + + * keylist.c (list_cert_std): Print qualified status. + * qualified.c: New. + * certchain.c (gpgsm_validate_chain): Check for qualified + certificates. + + * certchain.c (gpgsm_basic_cert_check): Release keydb handle when + no-chain-validation is used. + +2005-11-11 Werner Koch <wk@g10code.com> + + * keylist.c (print_capabilities): Print is_qualified status. + +2005-10-28 Werner Koch <wk@g10code.com> + + * certdump.c (pretty_print_sexp): New. + (gpgsm_print_name2): Use it here. This allows proper printing of + DNS names as used with server certificates. + +2005-10-10 Werner Koch <wk@g10code.com> + + * keylist.c: Add pkaAdress OID as reference. + +2005-10-08 Marcus Brinkmann <marcus@g10code.de> + + * Makefile.am (gpgsm_LDADD): Add ../gl/libgnu.a after + ../common/libcommon.a. + +2005-09-13 Werner Koch <wk@g10code.com> + + * verify.c (gpgsm_verify): Print a note if the unknown algorithm + is MD2. + * sign.c (gpgsm_sign): Ditto. + * certcheck.c (gpgsm_check_cert_sig): Ditto. + +2005-09-08 Werner Koch <wk@g10code.com> + + * export.c (popen_protect_tool): Add option --have-cert. We + probably lost this option with 1.9.14 due to restructuring of + export.c. + +2005-07-21 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): New options --no-log-file and --debug-none. + + * certreqgen.c (get_parameter, get_parameter_value): Add SEQ arg + to allow enumeration. Changed all callers. + (create_request): Process DNS and URI parameters. + +2005-07-20 Werner Koch <wk@g10code.com> + + * keylist.c (email_kludge): Reworked. + + * certdump.c (gpgsm_print_serial, gpgsm_dump_serial): Cast printf + arg to unsigned. + * call-dirmngr.c (gpgsm_dirmngr_run_command): Ditto + +2005-07-19 Werner Koch <wk@g10code.com> + + * fingerprint.c (gpgsm_get_certid): Cast printf arg to unsigned. + Bug accidently introduced while solving the #$%^& gcc + signed/unsigned char* warnings. + +2005-06-15 Werner Koch <wk@g10code.com> + + * delete.c (delete_one): Changed FPR to unsigned. + * encrypt.c (encrypt_dek): Made ENCVAL unsigned. + (gpgsm_encrypt): Ditto. + * sign.c (gpgsm_sign): Made SIGVAL unsigned. + * base64.c (base64_reader_cb): Need to use some casting to get + around signed/unsigned char* warnings. + * certcheck.c (gpgsm_check_cms_signature): Ditto. + (gpgsm_create_cms_signature): Changed arg R_SIGVAL to unsigned char*. + (do_encode_md): Made NFRAME a size_t. + * certdump.c (gpgsm_print_serial): Fixed signed/unsigned warning. + (gpgsm_dump_serial): Ditto. + (gpgsm_format_serial): Ditto. + (gpgsm_dump_string): Ditto. + (gpgsm_dump_cert): Ditto. + (parse_dn_part): Ditto. + (gpgsm_print_name2): Ditto. + * keylist.c (email_kludge): Ditto. + * certreqgen.c (proc_parameters, create_request): Ditto. + (create_request): Ditto. + * call-agent.c (gpgsm_agent_pksign): Made arg R_BUF unsigned. + (struct cipher_parm_s): Made CIPHERTEXT unsigned. + (struct genkey_parm_s): Ditto. + * server.c (strcpy_escaped_plus): Made arg S signed char*. + * fingerprint.c (gpgsm_get_fingerprint): Made ARRAY unsigned. + (gpgsm_get_keygrip): Ditto. + * keydb.c (keydb_insert_cert): Made DIGEST unsigned. + (keydb_update_cert): Ditto. + (classify_user_id): Apply cast to signed/unsigned assignment. + (hextobyte): Ditto. + +2005-06-01 Werner Koch <wk@g10code.com> + + * misc.c: Include setenv.h. + +2005-04-21 Werner Koch <wk@g10code.com> + + * gpgsm.c: New options --{enable,disable}-trusted-cert-crl-check. + * certchain.c (gpgsm_validate_chain): Make use of it. + + * certchain.c (gpgsm_validate_chain): Check revocations even for + expired certificates. This is required because on signature + verification an expired key is fine whereas a revoked one is not. + +2005-04-20 Werner Koch <wk@g10code.com> + + * Makefile.am (AM_CFLAGS): Add PTH_CFLAGS as noted by several folks. + +2005-04-19 Werner Koch <wk@g10code.com> + + * certchain.c (check_cert_policy): Print the diagnostic for a open + failure of policies.txt only in verbose mode or when it is not + ENOENT. + +2005-04-17 Werner Koch <wk@g10code.com> + + * call-dirmngr.c (inq_certificate): Add new inquire SENDCERT_SKI. + * certlist.c (gpgsm_find_cert): Add new arg KEYID and implement + this filter. Changed all callers. + + * certchain.c (find_up_search_by_keyid): New helper. + (find_up): Also try using the AKI.keyIdentifier. + (find_up_external): Ditto. + +2005-04-15 Werner Koch <wk@g10code.com> + + * keylist.c (list_cert_raw): Print the subjectKeyIdentifier as + well as the keyIdentifier part of the authorityKeyIdentifier. + +2005-03-31 Werner Koch <wk@g10code.com> + + * call-dirmngr.c (start_dirmngr): Use PATHSEP_C instead of ':'. + * call-agent.c (start_agent): Ditto. + +2005-03-17 Werner Koch <wk@g10code.com> + + * certcheck.c: Fixed use of DBG_CRYPTO and DBG_X509. + + * certchain.c (gpgsm_basic_cert_check): Dump certificates after a + failed gcry_pk_verify. + (find_up): Do an external lookup also for an authorityKeyIdentifier + lookup. Factored external lookup code out to .. + (find_up_external): .. new. + +2005-03-03 Werner Koch <wk@g10code.com> + + * Makefile.am (gpgsm_LDADD): Added PTH_LIBS. Noted by Kazu Yamamoto. + +2005-01-13 Werner Koch <wk@g10code.com> + + * certreqgen.c (proc_parameters): Cast printf arg. + +2004-12-22 Werner Koch <wk@g10code.com> + + * gpgsm.c (set_binary): New. + (main, open_read, open_fwrite): Use it. + +2004-12-21 Werner Koch <wk@g10code.com> + + * gpgsm.c (main): Use default_homedir(). + (main) [W32]: Default to disabled CRL checks. + +2004-12-20 Werner Koch <wk@g10code.com> + + * call-agent.c (start_agent): Before starting a pipe server start + to connect to a server on the standard socket. Use PATHSEP + * call-dirmngr.c (start_dirmngr): Use PATHSEP. + + * import.c: Include unistd.h for dup and close. + +2004-12-18 Werner Koch <wk@g10code.com> + + * gpgsm.h (map_assuan_err): Define in terms of + map_assuan_err_with_source. + * call-agent.c (start_agent): Pass error source to + send_pinentry_environment. + +2004-12-17 Werner Koch <wk@g10code.com> + + * call-dirmngr.c (isvalid_status_cb, lookup_status_cb) + (run_command_status_cb): Return cancel status if gpgsm_status + returned an error. + + * server.c (gpgsm_status, gpgsm_status2) + (gpgsm_status_with_err_code): Return an error code. + (gpgsm_status2): Always call va_end(). + +2004-12-15 Werner Koch <wk@g10code.com> + + * call-dirmngr.c (lookup_status_cb): Send progress messages + upstream. + (isvalid_status_cb): Ditto. + (gpgsm_dirmngr_isvalid): Put CTRL into status CB parameters. + (gpgsm_dirmngr_run_command, run_command_status_cb): Pass CTRL to + status callback and handle PROGRESS. + + * misc.c (setup_pinentry_env) [W32]: Don't use it. + + * gpgsm.c (main) [W32]: Init Pth because we need it for the socket + operations and to resolve libassuan symbols. + (run_protect_tool) [W32]: Disable it. + + * Makefile.am (gpgsm_LDADD): Move LIBASSUAN_LIBS more to the end. + +2004-12-07 Werner Koch <wk@g10code.com> + + * Makefile.am (gpgsm_LDADD): Put libassuan before jnlib because + under W32 we need the w32 pth code from jnlib. + + * misc.c (setup_pinentry_env) [W32]: Disabled. + +2004-12-06 Werner Koch <wk@g10code.com> + + * gpgsm.c (run_protect_tool) [_WIN32]: Disabled. + + * import.c (popen_protect_tool): Simplified by making use of + gnupg_spawn_process. + (parse_p12): Likewise, using gnupg_wait_process. + * export.c (popen_protect_tool): Ditto. + (export_p12): Ditto. + + * keydb.c: Don't define DIRSEP_S here. + +2004-12-02 Werner Koch <wk@g10code.com> + + * certchain.c (gpgsm_basic_cert_check): Dump certs with bad + signature for debugging. + (gpgsm_validate_chain): Ditto. + +2004-11-29 Werner Koch <wk@g10code.com> + + * gpgsm.c (set_debug): Changed to use a globals DEBUG_LEVEL and + DEBUG_VALUE. + (main): Made DEBUG_LEVEL global and introduced DEBUG_VALUE. This + now allows to add debug flags on top of a debug-level setting. + +2004-11-23 Werner Koch <wk@g10code.com> + + * gpgsm.c: New option --prefer-system-dirmngr. + * call-dirmngr.c (start_dirmngr): Implement this option. + +2004-10-22 Werner Koch <wk@g10code.com> + + * certreqgen.c (gpgsm_genkey): Remove the NEW from the certificate + request PEM header. This is according to the Sphinx standard. + +2004-10-08 Moritz Schulte <moritz@g10code.com> + + * certchain.c (gpgsm_validate_chain): Do not use keydb_new() in + case the no_chain_validation-return-short-cut is used (fixes + memory leak). + +2004-10-04 Werner Koch <wk@g10code.com> + + * misc.c (setup_pinentry_env): Try hard to set a default for GPG_TTY. + +2004-09-30 Werner Koch <wk@g10code.com> + + * gpgsm.c (i18n_init): Always use LC_ALL. + + * certdump.c (gpgsm_format_name): Factored code out to .. + (gpgsm_format_name2): .. new. + (gpgsm_print_name): Factored code out to .. + (gpgsm_print_name2): .. new. + (print_dn_part): New arg TRANSLATE. Changed all callers. + (print_dn_parts): Ditto. + (gpgsm_format_keydesc): Do not translate the SUBJECT; we require + it to stay UTF-8 but we still want to filter out bad control + characters. + + * Makefile.am: Adjusted for gettext 0.14. + + * keylist.c (list_cert_colon): Make sure that the expired flag has + a higher precedence than the invalid flag. + +2004-09-29 Werner Koch <wk@g10code.com> + + * import.c (parse_p12): Write an error status line for bad + passphrases. Add new arg CTRL and changed caller. + * export.c (export_p12): Likewise. + +2004-09-14 Werner Koch <wk@g10code.com> + + * certchain.c (gpgsm_validate_chain): Give expired certificates a + higher error precedence and don't bother to check any CRL in that + case. + +2004-08-24 Werner Koch <wk@g10code.de> + + * certlist.c: Fixed typo in ocsp OID. + +2004-08-18 Werner Koch <wk@g10code.de> + + * certlist.c (gpgsm_cert_use_ocsp_p): New. + (cert_usage_p): Support it here. + * call-dirmngr.c (gpgsm_dirmngr_isvalid): Use it here. + +2004-08-17 Marcus Brinkmann <marcus@g10code.de> + + * import.c: Fix typo in last change. + +2004-08-17 Werner Koch <wk@g10code.de> + + * import.c (check_and_store): Do a full validation if + --with-validation is set. + + * certchain.c (gpgsm_basic_cert_check): Print more detailed error + messages. + + * certcheck.c (do_encode_md): Partly support DSA. Add new arg + PKALGO. Changed all callers to pass it. + (pk_algo_from_sexp): New. + +2004-08-16 Werner Koch <wk@g10code.de> + + * gpgsm.c: New option --fixed-passphrase. + * import.c (popen_protect_tool): Pass it to the protect-tool. + + * server.c (cmd_encrypt): Use DEFAULT_RECPLIST and not recplist + for encrypt-to keys. + +2004-08-06 Werner Koch <wk@g10code.com> + + * gpgsm.c: New option --with-ephemeral-keys. + * keylist.c (list_internal_keys): Set it here. + (list_cert_raw): And indicate those keys. Changed all our callers + to pass the new arg HD through. + +2004-07-23 Werner Koch <wk@g10code.de> + + * certreqgen.c (proc_parameters): Do not allow key length below + 1024. + +2004-07-22 Werner Koch <wk@g10code.de> + + * keylist.c (list_cert_raw): Print the keygrip. + +2004-07-20 Werner Koch <wk@gnupg.org> + + * certchain.c (gpgsm_validate_chain): The trust check didn't + worked anymore, probably due to the changes at 2003-03-04. Fixed. + +2004-06-06 Werner Koch <wk@gnupg.org> + + * certreqgen.c (get_parameter_uint, create_request): Create + an extension for key usage when requested. + +2004-05-12 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): Install emergency_cleanup also as an atexit + handler. + + * verify.c (gpgsm_verify): Removed the separate error code + handling for KSBA. We use shared error codes anyway. + + * export.c (export_p12): Removed debugging code. + + * encrypt.c (gpgsm_encrypt): Put the session key in to secure memory. + +2004-05-11 Werner Koch <wk@gnupg.org> + + * sign.c (gpgsm_sign): Include the error source in the final error + message. + * decrypt.c (gpgsm_decrypt): Ditto. + + * fingerprint.c (gpgsm_get_key_algo_info): New. + * sign.c (gpgsm_sign): Don't assume RSA in the status line. + * keylist.c (list_cert_colon): Really print the algorithm and key + length. + (list_cert_raw, list_cert_std): Ditto. + (list_cert_colon): Reorganized to be able to tell whether a root + certificate is trusted. + + * gpgsm.c: New option --debug-allow-core-dump. + + * gpgsm.h (opt): Add member CONFIG_FILENAME. + * gpgsm.c (main): Use it here instead of the local var. + + * server.c (gpgsm_server): Print some additional information with + the hello in verbose mode. + +2004-04-30 Werner Koch <wk@gnupg.org> + + * import.c (check_and_store): Do not update the stats for hidden + imports of issuer certs. + (popen_protect_tool): Request statusmessages from the protect-tool. + (parse_p12): Detect status messages. Add new arg STATS and update them. + (print_imported_summary): Include secret key stats. + +2004-04-28 Werner Koch <wk@gnupg.org> + + * gpgsm.c: New command --keydb-clear-some-cert-flags. + * keydb.c (keydb_clear_some_cert_flags): New. + (keydb_update_keyblock, keydb_set_flags): Change error code + CONFLICT to NOT_LOCKED. + +2004-04-26 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main) <gpgconf>: Do not use /dev/null as default config + filename. + + * call-agent.c (gpgsm_agent_pksign, gpgsm_agent_pkdecrypt) + (gpgsm_agent_genkey, gpgsm_agent_istrusted) + (gpgsm_agent_marktrusted, gpgsm_agent_havekey) + (gpgsm_agent_passwd): Add new arg CTRL and changed all callers. + (start_agent): New arg CTRL. Send progress item when starting a + new agent. + * sign.c (gpgsm_get_default_cert, get_default_signer): New arg + CTRL to be passed down to the agent function. + * decrypt.c (prepare_decryption): Ditto. + * certreqgen.c (proc_parameters, read_parameters): Ditto. + * certcheck.c (gpgsm_create_cms_signature): Ditto. + +2004-04-23 Werner Koch <wk@gnupg.org> + + * keydb.c (keydb_add_resource): Try to compress the file on init. + + * keylist.c (oidtranstbl): New. OIDs collected from several sources. + (print_name_raw, print_names_raw, list_cert_raw): New. + (gpgsm_list_keys): Check the dump mode and pass it down as + necessary. + +2004-04-22 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): New commands --dump-keys, --dump-external-keys, + --dump-secret-keys. + +2004-04-13 Werner Koch <wk@gnupg.org> + + * misc.c (setup_pinentry_env): New. + * import.c (popen_protect_tool): Call it. + * export.c (popen_protect_tool): Call it. + +2004-04-08 Werner Koch <wk@gnupg.org> + + * decrypt.c (gpgsm_decrypt): Return GPG_ERR_NO_DATA if it is not a + encrypted message. + +2004-04-07 Werner Koch <wk@gnupg.org> + + * gpgsm.c: New option --force-crl-refresh. + * call-dirmngr.c (gpgsm_dirmngr_isvalid): Pass option to dirmngr. + +2004-04-05 Werner Koch <wk@gnupg.org> + + * server.c (get_status_string): Add STATUS_NEWSIG. + * verify.c (gpgsm_verify): Print STATUS_NEWSIG for each signature. + + * certchain.c (gpgsm_validate_chain) <gpgsm_cert_use_cer_p>: Do + not just warn if a cert is not suitable; bail out immediately. + +2004-04-01 Werner Koch <wk@gnupg.org> + + * call-dirmngr.c (isvalid_status_cb): New. + (unhexify_fpr): New. Taken from ../g10/call-agent.c + (gpgsm_dirmngr_isvalid): Add new arg CTRL, changed caller to pass + it thru. Detect need to check the respondert cert and do that. + * certchain.c (gpgsm_validate_chain): Add new arg FLAGS. Changed + all callers. + +2004-03-24 Werner Koch <wk@gnupg.org> + + * sign.c (gpgsm_sign): Include a short list of capabilities. + +2004-03-17 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main) <gpgconf>: Fixed default value quoting. + +2004-03-16 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): Implemented --gpgconf-list. + +2004-03-15 Werner Koch <wk@gnupg.org> + + * keylist.c (list_cert_colon): Hack to set the expired flag. + +2004-03-09 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): Correctly intitialze USE_OCSP flag. + + * keydb.c (keydb_delete): s/GPG_ERR_CONFLICT/GPG_ERR_NOT_LOCKED/ + +2004-03-04 Werner Koch <wk@gnupg.org> + + * call-dirmngr.c (gpgsm_dirmngr_isvalid): New arg ISSUER_CERT. + + * certchain.c (is_cert_still_valid): New. Code moved from ... + (gpgsm_validate_chain): ... here because we now need to check at + two places and at a later stage, so that we can pass the issuer + cert down to the dirmngr. + +2004-03-03 Werner Koch <wk@gnupg.org> + + * call-agent.c (start_agent): Replaced pinentry setup code by a + call to a new common function. + + * certdump.c (gpgsm_format_keydesc): Make sure the string is + returned as utf-8. + + * export.c (gpgsm_export): Make sure that we don't export more + than one certificate. + +2004-03-02 Werner Koch <wk@gnupg.org> + + * export.c (create_duptable, destroy_duptable) + (insert_duptable): New. + (gpgsm_export): Avoid duplicates. + +2004-02-26 Werner Koch <wk@gnupg.org> + + * certchain.c (compare_certs): New. + (gpgsm_validate_chain): Fixed infinite certificate checks after + bad signatures. + +2004-02-24 Werner Koch <wk@gnupg.org> + + * keylist.c (list_cert_colon): Print the fingerprint as the + cert-id for root certificates. + +2004-02-21 Werner Koch <wk@gnupg.org> + + * keylist.c (list_internal_keys): Return error codes. + (list_external_keys, gpgsm_list_keys): Ditto. + * server.c (do_listkeys): Ditto. + + * gpgsm.c (main): Display a key description for --passwd. + * call-agent.c (gpgsm_agent_passwd): New arg DESC. + +2004-02-20 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): New option --debug-ignore-expiration. + * certchain.c (gpgsm_validate_chain): Use it here. + + * certlist.c (cert_usage_p): Apply extKeyUsage. + +2004-02-19 Werner Koch <wk@gnupg.org> + + * export.c (export_p12, popen_protect_tool) + (gpgsm_p12_export): New. + * gpgsm.c (main): New command --export-secret-key-p12. + +2004-02-18 Werner Koch <wk@gnupg.org> + + * gpgsm.c (set_debug): Set the new --debug-level flags. + (main): New option --gpgconf-list. + (main): Do not setup -u and -r keys when not required. + (main): Setup the used character set. + + * keydb.c (keydb_add_resource): Print a hint to start the + gpg-agent. + +2004-02-17 Werner Koch <wk@gnupg.org> + + * gpgsm.c: Fixed value parsing for --with-validation. + * call-agent.c (start_agent): Ignore an empty GPG_AGENT_INFO. + * call-dirmngr.c (start_dirmngr): Likewise for DIRMNGR_INFO. + + * gpgsm.c: New option --with-md5-fingerprint. + * keylist.c (list_cert_std): Print MD5 fpr. + + * gpgsm.c: New options --with-validation. + * server.c (option_handler): New option "with-validation". + * keylist.c (list_cert_std, list_internal_keys): New args CTRL and + WITH_VALIDATION. Changed callers to set it. + (list_external_cb, list_external_keys): Pass CTRL to the callback. + (list_cert_colon): Add arg CTRL. Check validation if requested. + * certchain.c (unknown_criticals, allowed_ca, check_cert_policy) + (gpgsm_validate_chain): New args LISTMODE and FP. + (do_list): New helper for info output. + (find_up): New arg FIND_NEXT. + (gpgsm_validate_chain): After a bad signature try again with other + CA certificates. + + * import.c (print_imported_status): New arg NEW_CERT. Print + additional STATUS_IMPORT_OK becuase that is what gpgme expects. + (check_and_store): Always call above function after import. + * server.c (get_status_string): Added STATUS_IMPORT_OK. + +2004-02-13 Werner Koch <wk@gnupg.org> + + * certcheck.c (gpgsm_create_cms_signature): Format a description + for use by the pinentry. + * decrypt.c (gpgsm_decrypt): Ditto. Free HEXKEYGRIP. + * certdump.c (format_name_cookie, format_name_writer) + (gpgsm_format_name): New. + (gpgsm_format_serial): New. + (gpgsm_format_keydesc): New. + * call-agent.c (gpgsm_agent_pksign): New arg DESC. + (gpgsm_agent_pkdecrypt): Ditto. + + * encrypt.c (init_dek): Check for too weak algorithms. + + * import.c (parse_p12, popen_protect_tool): New. + + * base64.c (gpgsm_create_reader): New arg ALLOW_MULTI_PEM. + Changed all callers. + (base64_reader_cb): Handle it here. + (gpgsm_reader_eof_seen): New. + (base64_reader_cb): Set a flag for EOF. + (simple_reader_cb): Ditto. + +2004-02-12 Werner Koch <wk@gnupg.org> + + * gpgsm.h, gpgsm.c: New option --protect-tool-program. + * gpgsm.c (run_protect_tool): Use it. + +2004-02-11 Werner Koch <wk@gnupg.org> + + * Makefile.am (AM_CPPFLAGS): Pass directory constants via -D; this + will allow to override directory names at make time. + +2004-02-02 Werner Koch <wk@gnupg.org> + + * import.c (check_and_store): Import certificates even with + missing issuer's cert. Fixed an "depending on the verbose + setting" bug. + + * certchain.c (gpgsm_validate_chain): Mark revoked certs in the + keybox. + + * keylist.c (list_cert_colon): New arg VALIDITY; use it to print a + revoked flag. + (list_internal_keys): Retrieve validity flag. + (list_external_cb): Pass 0 as validity flag. + * keydb.c (keydb_get_flags, keydb_set_flags): New. + (keydb_set_cert_flags): New. + (lock_all): Return a proper error code. + (keydb_lock): New. + (keydb_delete): Don't lock but check that it has been locked. + (keydb_update_keyblock): Ditto. + * delete.c (delete_one): Take a lock. + +2004-01-30 Werner Koch <wk@gnupg.org> + + * certchain.c (check_cert_policy): Fixed read error checking. + (check_cert_policy): With no critical policies issue only a + warning if the policy file does not exists. + + * sign.c (add_certificate_list): Decrement N for the first cert. + +2004-01-29 Werner Koch <wk@gnupg.org> + + * certdump.c (parse_dn_part): Map common OIDs to human readable + labels. Make sure that a value won't get truncated if it includes + a Nul. + +2004-01-28 Werner Koch <wk@gnupg.org> + + * certchain.c (gpgsm_validate_chain): Changed the message printed + for an untrusted root certificate. + +2004-01-27 Werner Koch <wk@gnupg.org> + + * certdump.c (parse_dn_part): Pretty print the nameDistinguisher OID. + (print_dn_part): Do not delimit multiple RDN by " + ". Handle + multi-valued RDNs in a special way, i.e. in the order specified by + the certificate. + (print_dn_parts): Simplified. + +2004-01-16 Werner Koch <wk@gnupg.org> + + * sign.c (gpgsm_sign): Print an error message on all failures. + * decrypt.c (gpgsm_decrypt): Ditto. + +2003-12-17 Werner Koch <wk@gnupg.org> + + * server.c (gpgsm_server): Add arg DEFAULT_RECPLIST. + (cmd_encrypt): Add all enrypt-to marked certs to the list. + * encrypt.c (gpgsm_encrypt): Check that real recipients are + available. + * gpgsm.c (main): Make the --encrypt-to and --no-encrypt-to + options work. Pass the list of recients to gpgsm_server. + * gpgsm.h (certlist_s): Add field IS_ENCRYPT_TO. + (opt): Add NO_ENCRYPT_TO. + * certlist.c (gpgsm_add_to_certlist): New arg IS_ENCRYPT_TO. + Changed all callers and ignore duplicate entries. + (is_cert_in_certlist): New. + (gpgsm_add_cert_to_certlist): New. + + * certdump.c (gpgsm_print_serial): Cleaned up cast use in strtoul. + (gpgsm_dump_serial): Ditto. + + * decrypt.c (gpgsm_decrypt): Replaced ERR by RC. + +2003-12-16 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): Set the prefixes for assuan logging. + + * sign.c (gpgsm_sign): Add validation checks for the default + certificate. + + * gpgsm.c: Add -k as alias for --list-keys and -K for + --list-secret-keys. + +2003-12-15 Werner Koch <wk@gnupg.org> + + * encrypt.c (init_dek): Use gry_create_nonce for the IV; there is + not need for real strong random here and it even better protect + the random bits used for the key. + +2003-12-01 Werner Koch <wk@gnupg.org> + + * gpgsm.c, gpgsm.h: New options --{enable,disable}-ocsp. + (gpgsm_init_default_ctrl): Set USE_OCSP to the default value. + * certchain.c (gpgsm_validate_chain): Handle USE_OCSP. + * call-dirmngr.c (gpgsm_dirmngr_isvalid): Add arg USE_OCSP and + proceed accordingly. + +2003-11-19 Werner Koch <wk@gnupg.org> + + * verify.c (gpgsm_verify): Use "0" instead of an empty string for + the VALIDSIG status. + +2003-11-18 Werner Koch <wk@gnupg.org> + + * verify.c (gpgsm_verify): Fixed for changes API of gcry_md_info. + + * certchain.c (unknown_criticals): Fixed an error code test. + +2003-11-12 Werner Koch <wk@gnupg.org> + + Adjusted for API changes in Libksba. + +2003-10-31 Werner Koch <wk@gnupg.org> + + * certchain.c (gpgsm_validate_chain): Changed to use ksba_isotime_t. + * verify.c (strtimestamp_r, gpgsm_verify): Ditto. + * sign.c (gpgsm_sign): Ditto. + * keylist.c (print_time, list_cert_std, list_cert_colon): Ditto. + * certdump.c (gpgsm_print_time, gpgsm_dump_time, gpgsm_dump_cert): + Ditto. + +2003-10-25 Werner Koch <wk@gnupg.org> + + * certreqgen.c (read_parameters): Fixed faulty of !spacep(). + +2003-08-20 Marcus Brinkmann <marcus@g10code.de> + + * encrypt.c (encode_session_key): Allocate enough space. Cast key + byte to unsigned char to prevent sign extension. + (encrypt_dek): Check return value before error. + +2003-08-14 Timo Schulz <twoaday@freakmail.de> + + * encrypt.c (encode_session_key): Use new Libgcrypt interface. + +2003-07-31 Werner Koch <wk@gnupg.org> + + * Makefile.am (gpgsm_LDADD): Added INTLLIBS. + +2003-07-29 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): Add secmem features and set the random seed file. + (gpgsm_exit): Update the random seed file and enable debug output. + +2003-07-27 Werner Koch <wk@gnupg.org> + + Adjusted for gcry_mpi_print and gcry_mpi_scan API change. + +2003-06-24 Werner Koch <wk@gnupg.org> + + * server.c (gpgsm_status_with_err_code): New. + * verify.c (gpgsm_verify): Use it here instead of the old + tokenizing version. + + * verify.c (strtimestamp): Renamed to strtimestamp_r + + Adjusted for changes in the libgcrypt API. Some more fixes for the + libgpg-error stuff. + +2003-06-04 Werner Koch <wk@gnupg.org> + + * call-agent.c (init_membuf,put_membuf,get_membuf): Removed. + Include new membuf header and changed used type. + + Renamed error codes from INVALID to INV and removed _ERROR suffixes. + +2003-06-03 Werner Koch <wk@gnupg.org> + + Changed all error codes in all files to the new libgpg-error scheme. + + * gpgsm.h: Include gpg-error.h . + * Makefile.am: Link with libgpg-error. + +2003-04-29 Werner Koch <wk@gnupg.org> + + * Makefile.am: Use libassuan. Don't override LDFLAGS anymore. + * server.c (register_commands): Adjust for new Assuan semantics. + +2002-12-03 Werner Koch <wk@gnupg.org> + + * call-agent.c (gpgsm_agent_passwd): New. + * gpgsm.c (main): New command --passwd and --call-protect-tool + (run_protect_tool): New. + +2002-11-25 Werner Koch <wk@gnupg.org> + + * verify.c (gpgsm_verify): Handle content-type attribute. + +2002-11-13 Werner Koch <wk@gnupg.org> + + * call-agent.c (start_agent): Try to use $GPG_TTY instead of + ttyname. Changed ttyname to test stdin becuase it can be assumed + that output redirection is more common that input redirection. + +2002-11-12 Werner Koch <wk@gnupg.org> + + * gpgsm.c: New command --call-dirmngr. + * call-dirmngr.c (gpgsm_dirmngr_run_command) + (run_command_inq_cb,run_command_cb) + (run_command_status_cb): New. + +2002-11-11 Werner Koch <wk@gnupg.org> + + * certcheck.c (gpgsm_check_cms_signature): Don't double free + s_sig but free s_pkey at leave. + +2002-11-10 Werner Koch <wk@gnupg.org> + + * gpgsm.c: Removed duplicate --list-secret-key entry. + +2002-09-19 Werner Koch <wk@gnupg.org> + + * certcheck.c (gpgsm_check_cert_sig): Add cert hash debugging. + + * certchain.c (find_up): Print info when the cert was not found + by the autorithyKeyIdentifier. + +2002-09-03 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): Disable the internal libgcrypt locking. + +2002-08-21 Werner Koch <wk@gnupg.org> + + * import.c (print_imported_summary): Cleaned up. Print new + not_imported value. + (check_and_store): Update non_imported counter. + (print_import_problem): New. + (check_and_store): Print error status message. + * server.c (get_status_string): Added STATUS_IMPORT_PROBLEM. + +2002-08-20 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): Use the log file only in server mode. + + * import.c (print_imported_summary): New. + (check_and_store): Update the counters, take new argument. + (import_one): Factored out core of gpgsm_import. + (gpgsm_import): Print counters. + (gpgsm_import_files): New. + * gpgsm.c (main): Use the new function for import. + +2002-08-19 Werner Koch <wk@gnupg.org> + + * decrypt.c (gpgsm_decrypt): Return a better error status token. + * verify.c (gpgsm_verify): Don't error on messages with no signing + time or no message digest. This is only the case for messages + without any signed attributes. + +2002-08-16 Werner Koch <wk@gnupg.org> + + * certpath.c: Renamed to .. + * certchain.c: this. Renamed all all other usages of "path" in the + context of certificates to "chain". + + * call-agent.c (learn_cb): Special treatment when the issuer + certificate is missing. + +2002-08-10 Werner Koch <wk@gnupg.org> + + * Makefile.am (INCLUDES): Add definition for localedir. + + * keylist.c (list_cert_colon): Print the short fingerprint in the + key ID field. + * fingerprint.c (gpgsm_get_short_fingerprint): New. + * verify.c (gpgsm_verify): Print more verbose info for a good + signature. + +2002-08-09 Werner Koch <wk@gnupg.org> + + * decrypt.c (prepare_decryption): Hack to detected already + unpkcsedone keys. + + * gpgsm.c (emergency_cleanup): New. + (main): Initialize the signal handler. + + * sign.c (gpgsm_sign): Reset the hash context for subsequent + signers and release it at the end. + +2002-08-05 Werner Koch <wk@gnupg.org> + + * server.c (cmd_signer): New command "SIGNER" + (register_commands): Register it. + (cmd_sign): Pass the signer list to gpgsm_sign. + * certlist.c (gpgsm_add_to_certlist): Add SECRET argument, check + for secret key if set and changed all callers. + * sign.c (gpgsm_sign): New argument SIGNERLIST and implemt + multiple signers. + * gpgsm.c (main): Support more than one -u. + + * server.c (cmd_recipient): Return reason code 1 for No_Public_Key + which is actually what gets returned from add_to_certlist. + +2002-07-26 Werner Koch <wk@gnupg.org> + + * certcheck.c (gpgsm_check_cert_sig): Implement proper cleanup. + (gpgsm_check_cms_signature): Ditto. + +2002-07-22 Werner Koch <wk@gnupg.org> + + * keydb.c (keydb_add_resource): Register a lock file. + (lock_all, unlock_all): Implemented. + + * delete.c: New. + * gpgsm.c: Made --delete-key work. + * server.c (cmd_delkeys): New. + (register_commands): New command DELKEYS. + + * decrypt.c (gpgsm_decrypt): Print a convenience note when RC2 is + used and a STATUS_ERROR with the algorithm oid. + +2002-07-03 Werner Koch <wk@gnupg.org> + + * server.c (gpgsm_status2): Insert a blank between all optional + arguments when using assuan. + * server.c (cmd_recipient): No more need for extra blank in constants. + * import.c (print_imported_status): Ditto. + * gpgsm.c (main): Ditto. + +2002-07-02 Werner Koch <wk@gnupg.org> + + * verify.c (gpgsm_verify): Extend the STATUS_BADSIG line with + the fingerprint. + + * certpath.c (check_cert_policy): Don't use log_error to print a + warning. + + * keydb.c (keydb_store_cert): Add optional ar EXISTED and changed + all callers. + * call-agent.c (learn_cb): Print info message only for real imports. + + * import.c (gpgsm_import): Moved duplicated code to ... + (check_and_store): new function. Added magic to import the entire + chain. Print status only for real imports and moved printing code + to .. + (print_imported_status): New. + + * call-dirmngr.c (gpgsm_dirmngr_isvalid): print status of dirmngr + call in very verbose mode. + + * gpgsm.c (main): Use the same error codes for STATUS_INV_RECP as + with the server mode. + +2002-06-29 Werner Koch <wk@gnupg.org> + + * gpgsm.c: New option --auto-issuer-key-retrieve. + * certpath.c (find_up): Try to retrieve an issuer key from an + external source and from the ephemeral key DB. + (find_up_store_certs_cb): New. + + * keydb.c (keydb_set_ephemeral): Does now return the old + state. Call the backend only when required. + + * call-dirmngr.c (start_dirmngr): Use GNUPG_DEFAULT_DIRMNGR. + (lookup_status_cb): Issue status only when CTRL is not NULL. + (gpgsm_dirmngr_lookup): Document that CTRL is optional. + + * call-agent.c (start_agent): Use GNUPG_DEFAULT_AGENT. + +2002-06-28 Werner Koch <wk@gnupg.org> + + * server.c (cmd_recipient): Add more reason codes. + +2002-06-27 Werner Koch <wk@gnupg.org> + + * certpath.c (gpgsm_basic_cert_check): Use + --debug-no-path-validation to also bypass this basic check. + + * gpgsm.c (main): Use GNUPG_DEFAULT_HOMEDIR constant. + + * call-agent.c (start_agent): Create and pass the list of FD to + keep in the child to assuan. + * call-dirmngr.c (start_dirmngr): Ditto. + +2002-06-26 Werner Koch <wk@gnupg.org> + + * import.c (gpgsm_import): Print an STATUS_IMPORTED. + + * gpgsm.c: --debug-no-path-validation does not take an argument. + +2002-06-25 Werner Koch <wk@gnupg.org> + + * certdump.c (print_dn_part): Always print a leading slash, + removed NEED_DELIM arg and changed caller. + + * export.c (gpgsm_export): Print LFs to FP and not stdout. + (print_short_info): Ditto. Make use of gpgsm_print_name. + + * server.c (cmd_export): Use output-fd instead of data lines; this + was actually the specified way. + +2002-06-24 Werner Koch <wk@gnupg.org> + + * gpgsm.c: Removed duped help entry for --list-keys. + + * gpgsm.c, gpgsm.h: New option --debug-no-path-validation. + + * certpath.c (gpgsm_validate_path): Use it here instead of the + debug flag hack. + + * certpath.c (check_cert_policy): Return No_Policy_Match if the + policy file could not be opened. + +2002-06-20 Werner Koch <wk@gnupg.org> + + * certlist.c (gpgsm_add_to_certlist): Fixed locating of a + certificate with the required key usage. + + * gpgsm.c (main): Fixed a segv when using --outfile without an + argument. + + * keylist.c (print_capabilities): Also check for non-repudiation + and data encipherment. + * certlist.c (cert_usage_p): Test for signing and encryption was + swapped. Add a case for certification usage, handle + non-repudiation and data encipherment. + (gpgsm_cert_use_cert_p): New. + (gpgsm_add_to_certlist): Added a CTRL argument and changed all + callers to pass it. + * certpath.c (gpgsm_validate_path): Use it here to print a status + message. Added a CTRL argument and changed all callers to pass it. + * decrypt.c (gpgsm_decrypt): Print a status message for wrong key + usage. + * verify.c (gpgsm_verify): Ditto. + * keydb.c (classify_user_id): Allow a colon delimited fingerprint. + +2002-06-19 Werner Koch <wk@gnupg.org> + + * call-agent.c (learn_cb): Use log_info instead of log_error on + successful import. + + * keydb.c (keydb_set_ephemeral): New. + (keydb_store_cert): New are ephemeral, changed all callers. + * keylist.c (list_external_cb): Store cert as ephemeral. + * export.c (gpgsm_export): Kludge to export epehmeral certificates. + + * gpgsm.c (main): New command --list-external-keys. + +2002-06-17 Werner Koch <wk@gnupg.org> + + * certreqgen.c (read_parameters): Improved error handling. + (gpgsm_genkey): Print error message. + +2002-06-13 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): New option --log-file. + +2002-06-12 Werner Koch <wk@gnupg.org> + + * call-dirmngr.c (lookup_status_cb): New. + (gpgsm_dirmngr_lookup): Use the status CB. Add new arg CTRL and + changed caller to pass it. + + * gpgsm.c (open_fwrite): New. + (main): Allow --output for --verify. + + * sign.c (hash_and_copy_data): New. + (gpgsm_sign): Implemented normal (non-detached) signatures. + * gpgsm.c (main): Ditto. + + * certpath.c (gpgsm_validate_path): Special error handling for + no policy match. + +2002-06-10 Werner Koch <wk@gnupg.org> + + * server.c (get_status_string): Add STATUS_ERROR. + + * certpath.c (gpgsm_validate_path): Tweaked the error checking to + return error codes in a more sensitive way. + * verify.c (gpgsm_verify): Send status TRUST_NEVER also for a bad + CA certificate and when the certificate has been revoked. Issue + TRUST_FULLY even when the cert has expired. Append an error token + to these status lines. Issue the new generic error status when a + cert was not found and when leaving the function. + +2002-06-04 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): New command --list-sigs + * keylist.c (list_cert_std): New. Use it whenever colon mode is + not used. + (list_cert_chain): New. + +2002-05-31 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): Don't print the "go ahead" message for an + invalid command. + +2002-05-23 Werner Koch <wk@gnupg.org> + + * import.c (gpgsm_import): Add error messages. + +2002-05-21 Werner Koch <wk@gnupg.org> + + * keylist.c (list_internal_keys): Renamed from gpgsm_list_keys. + (list_external_keys): New. + (gpgsm_list_keys): Dispatcher for above. + * call-dirmngr.c (lookup_cb,pattern_from_strlist) + (gpgsm_dirmngr_lookup): New. + * server.c (option_handler): Handle new option --list-mode. + (do_listkeys): Handle options and actually use the mode argument. + (get_status_string): New code TRUNCATED. + + * import.c (gpgsm_import): Try to identify the type of input and + handle certs-only messages. + +2002-05-14 Werner Koch <wk@gnupg.org> + + * gpgsm.c: New option --faked-system-time + * sign.c (gpgsm_sign): And use it here. + * certpath.c (gpgsm_validate_path): Ditto. + +2002-05-03 Werner Koch <wk@gnupg.org> + + * certpath.c (gpgsm_validate_path): Added EXPTIME arg and changed + all callers. + * verify.c (gpgsm_verify): Tweaked usage of log_debug and + log_error. Return EXPSIG status and add expiretime to VALIDSIG. + +2002-04-26 Werner Koch <wk@gnupg.org> + + * gpgsm.h (DBG_AGENT,DBG_AGENT_VALUE): Replaced by DBG_ASSUAN_*. + Changed all users. + + * call-agent.c (start_agent): Be more silent without -v. + * call-dirmngr.c (start_dirmngr): Ditto. + +2002-04-25 Werner Koch <wk@gnupg.org> + + * call-agent.c (start_agent): Make copies of old locales and check + for setlocale. + +2002-04-25 Marcus Brinkmann <marcus@g10code.de> + + * call-agent.c (start_agent): Fix error handling logic so the + locale is always correctly reset. + +2002-04-25 Marcus Brinkmann <marcus@g10code.de> + + * server.c (option_handler): Accept display, ttyname, ttytype, + lc_ctype and lc_messages options. + * gpgsm.c (main): Allocate memory for these options. + * gpgsm.h (struct opt): Make corresponding members non-const. + +2002-04-24 Marcus Brinkmann <marcus@g10code.de> + + * gpgsm.h (struct opt): New members display, ttyname, ttytype, + lc_ctype, lc_messages. + * gpgsm.c (enum cmd_and_opt_values): New members oDisplay, + oTTYname, oTTYtype, oLCctype, oLCmessages. + (opts): New entries for these options. + (main): Handle these new options. + * call-agent.c (start_agent): Set the various display and tty + parameter after resetting. + +2002-04-18 Werner Koch <wk@gnupg.org> + + * certreqgen.c (gpgsm_genkey): Write status output on success. + +2002-04-15 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): Check ksba version. + + * certpath.c (find_up): New to use the authorithKeyIdentifier. + Use it in all other functions to locate the signing cert.. + +2002-04-11 Werner Koch <wk@gnupg.org> + + * certlist.c (cert_usable_p): New. + (gpgsm_cert_use_sign_p,gpgsm_cert_use_encrypt_p): New. + (gpgsm_cert_use_verify_p,gpgsm_cert_use_decrypt_p): New. + (gpgsm_add_to_certlist): Check the key usage. + * sign.c (gpgsm_sign): Ditto. + * verify.c (gpgsm_verify): Print a message wehn an unsuitable + certificate was used. + * decrypt.c (gpgsm_decrypt): Ditto + * keylist.c (print_capabilities): Determine values from the cert. + +2002-03-28 Werner Koch <wk@gnupg.org> + + * keylist.c (list_cert_colon): Fixed listing of crt record; the + issuer is not at the right place. Print a chainingID. + * certpath.c (gpgsm_walk_cert_chain): Be a bit more silent on + common errors. + +2002-03-21 Werner Koch <wk@gnupg.org> + + * export.c: New. + * gpgsm.c: Add command --export. + * server.c (cmd_export): New. + +2002-03-13 Werner Koch <wk@gnupg.org> + + * decrypt.c (gpgsm_decrypt): Allow multiple recipients. + +2002-03-12 Werner Koch <wk@gnupg.org> + + * certpath.c (check_cert_policy): Print the policy list. + + * verify.c (gpgsm_verify): Detect certs-only message. + +2002-03-11 Werner Koch <wk@gnupg.org> + + * import.c (gpgsm_import): Print a notice about imported certificates + when in verbose mode. + + * gpgsm.c (main): Print INV_RECP status. + * server.c (cmd_recipient): Ditto. + + * server.c (gpgsm_status2): New. Allows for a list of strings. + (gpgsm_status): Divert to gpgsm_status2. + + * encrypt.c (gpgsm_encrypt): Don't use a default key when no + recipients are given. Print a NO_RECP status. + +2002-03-06 Werner Koch <wk@gnupg.org> + + * server.c (cmd_listkeys, cmd_listsecretkeys): Divert to + (do_listkeys): new. Add pattern parsing. + + * keylist.c (gpgsm_list_keys): Handle selection pattern. + + * gpgsm.c: New command --learn-card + * call-agent.c (learn_cb,gpgsm_agent_learn): New. + + * gpgsm.c (main): Print error messages for non-implemented commands. + + * base64.c (base64_reader_cb): Use case insensitive compare of the + Content-Type string to detect plain base-64. + +2002-03-05 Werner Koch <wk@gnupg.org> + + * gpgsm.c, gpgsm.h: Add local_user. + * sign.c (gpgsm_get_default_cert): New. + (get_default_signer): Use the new function if local_user is not + set otherwise used that value. + * encrypt.c (get_default_recipient): Removed. + (gpgsm_encrypt): Use gpgsm_get_default_cert. + + * verify.c (gpgsm_verify): Better error text for a bad signature + found by comparing the hashs. + +2002-02-27 Werner Koch <wk@gnupg.org> + + * call-dirmngr.c, call-agent.c: Add 2 more arguments to all uses + of assuan_transact. + +2002-02-25 Werner Koch <wk@gnupg.org> + + * server.c (option_handler): Allow to use -2 for "send all certs + except the root cert". + * sign.c (add_certificate_list): Implement it here. + * certpath.c (gpgsm_is_root_cert): New. + +2002-02-19 Werner Koch <wk@gnupg.org> + + * certpath.c (check_cert_policy): New. + (gpgsm_validate_path): And call it from here. + * gpgsm.c (main): New options --policy-file, + --disable-policy-checks and --enable-policy-checks. + * gpgsm.h (opt): Added policy_file, no_policy_checks. + +2002-02-18 Werner Koch <wk@gnupg.org> + + * certpath.c (gpgsm_validate_path): Ask the agent to add the + certificate into the trusted list. + * call-agent.c (gpgsm_agent_marktrusted): New. + +2002-02-07 Werner Koch <wk@gnupg.org> + + * certlist.c (gpgsm_add_to_certlist): Check that the specified + name identifies a certificate unambiguously. + (gpgsm_find_cert): Ditto. + + * server.c (cmd_listkeys): Check that the data stream is available. + (cmd_listsecretkeys): Ditto. + (has_option): New. + (cmd_sign): Fix ambiguousity in option recognition. + + * gpgsm.c (main): Enable --logger-fd. + + * encrypt.c (gpgsm_encrypt): Increased buffer size for better + performance. + + * call-agent.c (gpgsm_agent_pksign): Check the S-Exp received from + the agent. + + * keylist.c (list_cert_colon): Filter out control characters. + +2002-02-06 Werner Koch <wk@gnupg.org> + + * decrypt.c (gpgsm_decrypt): Bail out after an decryption error. + + * server.c (reset_notify): Close input and output FDs. + (cmd_encrypt,cmd_decrypt,cmd_verify,cmd_sign.cmd_import) + (cmd_genkey): Close the FDs and release the recipient list even in + the error case. + +2002-02-01 Marcus Brinkmann <marcus@g10code.de> + + * sign.c (gpgsm_sign): Do not release certificate twice. + +2002-01-29 Werner Koch <wk@gnupg.org> + + * call-agent.c (gpgsm_agent_havekey): New. + * keylist.c (list_cert_colon): New arg HAVE_SECRET, print "crs" + when we know that the secret key is available. + (gpgsm_list_keys): New arg MODE, check whether a secret key is + available. Changed all callers. + * gpgsm.c (main): New command --list-secret-keys. + * server.c (cmd_listsecretkeys): New. + (cmd_listkeys): Return secret keys with "crs" record. + +2002-01-28 Werner Koch <wk@gnupg.org> + + * certreqgen.c (create_request): Store the email address in the req. + +2002-01-25 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): Disable core dumps. + + * sign.c (add_certificate_list): New. + (gpgsm_sign): Add the certificates to the CMS object. + * certpath.c (gpgsm_walk_cert_chain): New. + * gpgsm.h (server_control_s): Add included_certs. + * gpgsm.c: Add option --include-certs. + (gpgsm_init_default_ctrl): New. + (main): Call it. + * server.c (gpgsm_server): Ditto. + (option_handler): Support --include-certs. + +2002-01-23 Werner Koch <wk@gnupg.org> + + * certpath.c (gpgsm_validate_path): Print the DN of a missing issuer. + * certdump.c (gpgsm_dump_string): New. + (print_dn): Replaced by above. + +2002-01-22 Werner Koch <wk@gnupg.org> + + * certpath.c (unknown_criticals): New. + (allowed_ca): New. + (gpgsm_validate_path): Check validity, CA attribute, path length + and unknown critical extensions. + +2002-01-21 Werner Koch <wk@gnupg.org> + + * gpgsm.c: Add option --enable-crl-checks. + + * call-agent.c (start_agent): Implemented socket based access. + * call-dirmngr.c (start_dirmngr): Ditto. + +2002-01-20 Werner Koch <wk@gnupg.org> + + * server.c (option_handler): New. + (gpgsm_server): Register it with assuan. + +2002-01-19 Werner Koch <wk@gnupg.org> + + * server.c (gpgsm_server): Use assuan_deinit_server and setup + assuan logging if enabled. + * call-agent.c (inq_ciphertext_cb): Don't show the session key in + an Assuan log file. + + * gpgsm.c (my_strusage): Take bugreport address from configure.ac + +2002-01-15 Werner Koch <wk@gnupg.org> + + * import.c (gpgsm_import): Just do a basic cert check before + storing it. + * certpath.c (gpgsm_basic_cert_check): New. + + * keydb.c (keydb_store_cert): New. + * import.c (store_cert): Removed and change all caller to use + the new function. + * verify.c (store_cert): Ditto. + + * certlist.c (gpgsm_add_to_certlist): Validate the path + + * certpath.c (gpgsm_validate_path): Check the trust list. + * call-agent.c (gpgsm_agent_istrusted): New. + +2002-01-14 Werner Koch <wk@gnupg.org> + + * call-dirmngr.c (inq_certificate): Changed for new interface semantic. + * certlist.c (gpgsm_find_cert): New. + +2002-01-13 Werner Koch <wk@gnupg.org> + + * fingerprint.c (gpgsm_get_certid): Print the serial and not the + hash after the dot. + +2002-01-11 Werner Koch <wk@gnupg.org> + + * call-dirmngr.c: New. + * certpath.c (gpgsm_validate_path): Check the CRL here. + * fingerprint.c (gpgsm_get_certid): New. + * gpgsm.c: New options --dirmngr-program and --disable-crl-checks. + +2002-01-10 Werner Koch <wk@gnupg.org> + + * base64.c (gpgsm_create_writer): Allow to set the object name + +2002-01-08 Werner Koch <wk@gnupg.org> + + * keydb.c (spacep): Removed because it is now in util.c + + * server.c (cmd_genkey): New. + * certreqgen.c: New. The parameter handling code has been taken + from gnupg/g10/keygen.c version 1.0.6. + * call-agent.c (gpgsm_agent_genkey): New. + +2002-01-02 Werner Koch <wk@gnupg.org> + + * server.c (rc_to_assuan_status): Removed and changed all callers + to use map_to_assuan_status. + +2001-12-20 Werner Koch <wk@gnupg.org> + + * verify.c (gpgsm_verify): Implemented non-detached signature + verification. Add OUT_FP arg, initialize a writer and changed all + callers. + * server.c (cmd_verify): Pass an out_fp if one has been set. + + * base64.c (base64_reader_cb): Try to detect an S/MIME body part. + + * certdump.c (print_sexp): Renamed to gpgsm_dump_serial, made + global. + (print_time): Renamed to gpgsm_dump_time, made global. + (gpgsm_dump_serial): Take a real S-Expression as argument and + print the first item. + * keylist.c (list_cert_colon): Ditto. + * keydb.c (keydb_search_issuer_sn): Ditto. + * decrypt.c (print_integer_sexp): Removed and made callers + use gpgsm_dump_serial. + * verify.c (print_time): Removed, made callers use gpgsm_dump_time. + +2001-12-19 Marcus Brinkmann <marcus@g10code.de> + + * call-agent.c (start_agent): Add new argument to assuan_pipe_connect. + +2001-12-18 Werner Koch <wk@gnupg.org> + + * verify.c (print_integer_sexp): Renamed from print_integer and + print the serial number according to the S-Exp rules. + * decrypt.c (print_integer_sexp): Ditto. + +2001-12-17 Werner Koch <wk@gnupg.org> + + * keylist.c (list_cert_colon): Changed for new return value of + get_serial. + * keydb.c (keydb_search_issuer_sn): Ditto. + * certcheck.c (gpgsm_check_cert_sig): Likewise for other S-Exp + returingin functions. + * fingerprint.c (gpgsm_get_keygrip): Ditto. + * encrypt.c (encrypt_dek): Ditto + * certcheck.c (gpgsm_check_cms_signature): Ditto + * decrypt.c (prepare_decryption): Ditto. + * call-agent.c (gpgsm_agent_pkdecrypt): Removed arg ciphertextlen, + use KsbaSexp type and calculate the length. + + * certdump.c (print_sexp): Remaned from print_integer, changed caller. + + * Makefile.am: Use the LIBGCRYPT and LIBKSBA variables. + + * fingerprint.c (gpgsm_get_keygrip): Use the new + gcry_pk_get_keygrip to calculate the grip - note the algorithm and + therefore the grip values changed. + +2001-12-15 Werner Koch <wk@gnupg.org> + + * certcheck.c (gpgsm_check_cms_signature): Removed the faked-key + kludge. + (gpgsm_create_cms_signature): Removed the commented fake key + code. This makes the function pretty simple. + + * gpgsm.c (main): Renamed the default key database to "keyring.kbx". + + * decrypt.c (gpgsm_decrypt): Write STATUS_DECRYPTION_*. + * sign.c (gpgsm_sign): Write a STATUS_SIG_CREATED. + +2001-12-14 Werner Koch <wk@gnupg.org> + + * keylist.c (list_cert_colon): Kludge to show an email address + encoded in the subject's DN. + + * verify.c (gpgsm_verify): Add hash debug helpers + * sign.c (gpgsm_sign): Ditto. + + * base64.c (base64_reader_cb): Reset the linelen when we need to + skip the line and adjusted test; I somehow forgot about DeMorgan. + + * server.c (cmd_encrypt,cmd_decrypt,cmd_sign,cmd_verify) + (cmd_import): Close the FDs on success. + (close_message_fd): New. + (input_notify): Setting autodetect_encoding to 0 after initializing + it to 0 is pretty pointless. Easy to fix. + + * gpgsm.c (main): New option --debug-wait n, so that it is + possible to attach gdb when used in server mode. + + * sign.c (get_default_signer): Use keydb_classify_name here. + +2001-12-14 Marcus Brinkmann <marcus@g10code.de> + + * call-agent.c (LINELENGTH): Removed. + (gpgsm_agent_pksign): Use ASSUAN_LINELENGTH, not LINELENGTH. + (gpgsm_agent_pkdecrypt): Likewise. + +2001-12-13 Werner Koch <wk@gnupg.org> + + * keylist.c (list_cert_colon): Print alternative names of subject + and a few other values. + +2001-12-12 Werner Koch <wk@gnupg.org> + + * gpgsm.c (main): New options --assume-{armor,base64,binary}. + * base64.c (base64_reader_cb): Fixed non-autodetection mode. + +2001-12-04 Werner Koch <wk@gnupg.org> + + * call-agent.c (read_from_agent): Check for inquire responses. + (request_reply): Handle them using a new callback arg, changed all + callers. + (gpgsm_agent_pkdecrypt): New. + +2001-11-27 Werner Koch <wk@gnupg.org> + + * base64.c: New. Changed all other functions to use this instead + of direct creation of ksba_reader/writer. + * gpgsm.c (main): Set ctrl.auto_encoding unless --no-armor is used. + +2001-11-26 Werner Koch <wk@gnupg.org> + + * gpgsm.c: New option --agent-program + * call-agent.c (start_agent): Allow to override the default path + to the agent. + + * keydb.c (keydb_add_resource): Create keybox + + * keylist.c (gpgsm_list_keys): Fixed non-server keylisting. + + * server.c (rc_to_assuan_status): New. Use it for all commands. + + + Copyright 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, + 2010, 2011 Free Software Foundation, Inc. + + This file is free software; as a special exception the author gives + unlimited permission to copy and/or distribute it, with or without + modifications, as long as this notice is preserved. + + This file is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY, to the extent permitted by law; without even the + implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. + +Local Variables: +buffer-read-only: t +End: |