GNU Privacy Guard ทุกเวอร์ชันและเวอร์ชันเก่า

* gpg: Fix a regression in 2.5.15 which created new keys with just
the fallback preferences. [T7909]

Release-info: https://dev.gnupg.org/T7995

* gpg: New command --quick-set-ownertrust. [rG967678d972]

* gpg: Indicate disabled keys in key listings and add list option
"show-ownertrust". [rG2a0a706eb2]

* gpg: Make sure a DECRYPTION_OKAY is never issued for a bad OCB
tag. [T7042]

* gpg: Do not allow to accidently set the RENC usage. [T7072]

* gpg: Accept armored files without CRC24 checksum. [T7071]

* gpg: New --import-option "only-pubkeys". [T7146]

* gpg: Repurpose the AKL mechanism "ldap" to work like the keyserver
mechnism but only for LDAP keyservers. [rG068ebb6f1e]

* gpg: ADSKs are now configurable for new keys. [T6882]

* gpgsm: Emit user IDs with an empty Subject also in colon mode.
[T7171]

* agent: Consider an empty pattern file as valid. [rGc27534de95]

* agent: Fix error handling of READKEY. [T6012]

* agent: Avoid random errors when storing key in ephemeral mode.
[T7129, rGfdc5003956]

* agent: Make "SCD DEVINFO --watch" more robust. [T7151]

* scd: Improve KDF data object handling for OpenPGP cards. [T7058]

* scd: Avoid buffer overrun with more than 16 PC/SC readers.
[T7129, rG4c1b007035]

* scd: Fix how the scdaemon on its pipe connection finishes.
[T7160]

* gpgconf: Check readability of some files with -X and change its
output format. [rG98e287ba6d]

* gpg-mail-tube: New tool to apply PGP/MIME encryption to a mail.
[rG28a080bc9f]

* Fix some uninitialized variables and double frees in error code
paths. [T7129]

* gpg,gpgv: New option --assert-pubkey-algo. [T6946]

* gpg: Emit status lines for errors in the compression layer.
[T6977]

* gpg: Fix invocation with --trusted-keys and --no-options. [T7025]

* gpgsm: Allow for a longer salt in PKCS#12 files. [T6757]

* gpgtar: Make --status-fd=2 work on Windows. [T6961]

* scd: Support for the ACR-122U NFC reader. [rG1682ca9f01]

* scd: Suport D-TRUST ECC cards. [T7000,T7001]

* scd: Allow auto detaching of kernel drivers; can be disabled with
the new compatibility-flag ccid-no-auto-detach. [rGa1ea3b13e0]

* scd: Allow setting a PIN length of 6 also with a reset code for
openpgp cards. [T6843]

* agent: Allow GET_PASSPHRASE in restricted mode. [rGadf4db6e20]

* dirmngr: Trust system's root CAs for checking CRL issuers.
[T6963]

* dirmngr: Fix regression in 2.4.4 in fetching keys via hkps.
[T6997]

* gpg-wks-client: Make option --mirror work properly w/o specifying
domains. [rG37cc255e49]

* g13,gpg-wks-client: Allow command style options as in "g13 mount
foo". [rGa09157ccb2]

* Allow tilde expansion for the foo-program options. [T7017]

* Make the getswdb.sh tool usable outside the GnuPG tree.

Release-info: https://dev.gnupg.org/T6960

* gpg: Do not keep an unprotected smartcard backup key on disk. See
https://gnupg.org/blog/20240125-smartcard-backup-key.html for a
security advisory. [T6944]

* gpg: Allow to specify seconds since Epoch beyond 2038 on 32-bit
platforms. [T6736]

* gpg: Fix expiration time when Creation-Date is specified. [T5252]

* gpg: Add support for Subkey-Expire-Date. [rG96b69c1866]

* gpg: Add option --with-v5-fingerprint. [T6705]

* gpg: Add sub-option ignore-attributes to --import-options.
[rGd4976e35d2]

* gpg: Add --list-filter properties sig_expires/sig_expires_d.
[rGbf662d0f93af]

* gpg: Fix validity of re-imported keys. [T6399]

* gpg: Report BEGIN_ status before examining the input. [T6481]

* gpg: Don't try to compress a read-only keybox. [T6811]

* gpg: Choose key from inserted card over a non-inserted
card. [T6831]

* gpg: Allow to create revocations even with non-compliant algos.
[T6929]

* gpg: Fix regression in the Revoker keyword of the parameter file.
[T6923]

* gpg: Improve error message for expired default keys. [T4704]

* gpgsm: Add --always-trust feature. [T6559]

* gpgsm: Support ECC certificates in de-vs mode. [T6802]

* gpgsm: Major rewrite of the PKCS#12 parser. [T6536]

* gpgsm: No not show the pkcs#12 passphrase in debug output. [T6654]

* keyboxd: Timeout on failure to get the database lock. [T6838]

* agent: Update the key stubs only if really modified. [T6829]

* scd: Add support for certain Starcos 3.2 cards. [rG5304c9b080]

* scd: Add support for CardOS 5.4 cards. [rG812f988059]

* scd: Add support for D-Trust 4.1/4.4 cards. [rG0b85a9ac09]

* scd: Add support for Smartcafe Expert 7.0 cards. [T6919]

* scd: Add a length check for a new PIN. [T6843]

* tpm: Fix keytotpm handling in the agent. [rG9909f622f6]

* tpm: Fixes for the TPM test suite. [T6052]

* dirmngr: Avoid starting a second instance on Windows via GPGME
based launching. [T6833]

* dirmngr: New option --ignore-crl-extensions. [T6545]

* dirmngr: Support config value "none" to disable the default
keyserver. [T6708]

* dirmngr: Implement automatic proxy detection on Windows. [T5768]

* dirmngr: Fix handling of the HTTP Content-Length. [rGa5e33618f4]

* dirmngr: Add code to support proxy authentication using the
Negotiation method on Windows. [T6719]

* gpgconf: Add commands --lock and --unlock. [rG93b5ba38dc]

* gpgconf: Add keyword socketdir to gpgconf.ctl. [rG239c1fdc28]

* gpgconf: Adjust the -X command for the new VERSION file format.
[T6918]

* wkd: Use export-clean for gpg-wks-client's --mirror and --create
commands. [rG2c7f7a5a278c]

* wkd: Make --add-revocs the default in gpg-wks-client. New option
--no-add-revocs. [rG10c937ee68]

* Remove duplicated backslashes when setting the homedir. [T6833]

* Ignore attempts to remove the /dev/null device. [T6556]

* Improve advisory file lock retry strategy. [T3380]

* Improve the speedo build system for Unix. [T6710]

Release-info: https://dev.gnupg.org/T6578

* gpg: Set default expiration date to 3 years. [T2701]

* gpg: Add --list-filter properties "key_expires" and
"key_expires_d". [T6529]

* gpg: Emit status line and proper diagnostics for write errors.
[T6528]

* gpg: Make progress work for large files on Windows. [T6534]

* gpg: New option --no-compress as alias for -z0.

* gpgsm: Print PROGRESS status lines. Add new --input-size-hint.
[T6534]

* gpgsm: Support SENDCERT_SKI for --call-dirmngr. [rG701a8b30f0]

* gpgsm: Major rewrite of the PKCS#12 parser. [T6536]

* gpgtar: New option --no-compress.

* dirmngr: Extend the AD_QUERY command. [rG207c99567c]

* dirmngr: Disable the HTTP redirect rewriting. [T6477]

* dirmngr: New option --compatibility-flags. [rGbf04b07327]

* dirmngr: New option --ignore-crl-extensions. [T6545]

* wkd: Use export-clean for gpg-wks-client's --mirror and --create
commands. [rG2c7f7a5a27]

* wkd: Make --add-revocs the default in gpg-wks-client. New option
--no-add-revocs. [rG10c937ee68]

* scd: Make signing work for Nexus cards. [rGb83d86b988]

* scd: Fix authentication with Administration Key for PIV.
[rG25b59cf6ce]

* gpg: Print a warning if no more encryption subkeys are left over
after changing the expiration date. [rGef2c3d50fa]

* gpg: Fix searching for the ADSK key when adding an ADSK. [T6504]

* gpgsm: Speed up key listings on Windows. [rG08ff55bd44]

* gpgsm: Reduce the number of "failed to open policy file"
diagnostics. [rG68613a6a9d]

* agent: Make updating of private key files more robust and track
display S/N. [T6135]

* keyboxd: Avoid longish delays on Windows when listing keys.
[rG6944aefa3c]

* gpgtar: Emit extra status lines to help GPGME. [T6497]

* w32: Avoid using the VirtualStore. [T6403]

* If the ~/.gnupg directory does not exist, the keyboxd is now
automagically enabled. [rGd9e7488b17]

* gpg: New option --add-desig-revoker. [rG3d094e2bcf]

* gpg: New option --assert-signer. [rGc9e95b8dee]

* gpg: New command --quick-add-adsk and other ADSK features.
[T6395, https://gnupg.org/blog/20230321-adsk.html]

* gpg: New list-option "show-unusable-sigs". Also show
"[self-signature]" instead of the user-id in key signature
listings. [rG103acfe9ca]

* gpg: For symmetric encryption the default S2K hash is now SHA256.
[T6367]

* gpg: Detect already compressed data also when using a pipe. Also
detect JPEG and PNG file formats. [T6332]

* gpg: New subcommand "openpgp" for --card-edit. [T6462]

* gpgsm: Verification of detached signatures does now strip trailing
zeroes from the input if --assume-binary is used. [rG2a13f7f9dc]

* gpgsm: Non-armored detached signature are now created without
using indefinite form length octets. This improves compatibility
with some PDF signature verification software. [rG8996b0b655]

* gpgtar: Emit progress status lines in create mode. [T6363]

* dirmngr: The LDAP modifyTimestamp is now returned by some
keyserver commands. [rG56d309133f]

* ssh: Allow specification of the order keys are presented to ssh.
See the man page entry for --enable-ssh-support. [T5996, T6212]

* gpg: Make list-options "show-sig-subpackets" work again.
Fixes regression in 2.4.0. [rG5a223303d7]

* gpg: Fix the keytocard command for Yubikeys. [T6378]

* gpg: Do not continue an export after a cancel for the primary key.
[T6093]

* gpg: Replace the --override-compliance-check hack by a real fix.
[T5655]

* gpgtar: Fix decryption with input taken from stdin. [T6355]

* gpg: New command --quick-update-pref. [rGd40d23b233]

* gpg: New list-options show-pref and show-pref-verbose.
[rG811cfa34cb]

* gpg: New option --list-filter to restrict key listings like
gpg -k --list-filter 'select=revoked-f && sub/algostr=ed25519'
[rG1324dc3490]

* gpg: New --export-filter export-revocs. [rGc985b52e71]

* gpg: Also import stray revocation certificates. [rG7aaedfb107]

* gpg: Add a notation to encryption subkeys in de-vs mode. [T6279]

* gpg: Improve signature verification speed by a factor of more than
four. Double detached signing speed. [T5826]

* gpg: Allow only OCB for AEAD encryption. [rG5a2cef801d]

* gpg: Fix trusted introducer for mbox only user-ids. [T6238]

* gpg: Report an error via status-fd for receiving a key from the
agent. [T5151]

* gpg: Make --require-compliance work without the --status-fd
option. [rG2aacd843ad]

* gpg: Fix verification of cleartext signatures with overlong lines.
[T6272]

* agent: Fix import of protected OpenPGP v5 keys. [T6294]

* gpgsm: Change the default cipher algorithm from AES128 to AES256.
Also announce support for this in signatures. [rG2d8ac55d26]

* gpgsm: Always use the chain validation model if the root-CA
requests this. [rG7fa1d3cc82]

* gpgsm: Print OCSP revocation date and reason in cert listings.
[rGb6abaed2b5]

* agent: Support Win32-OpenSSH emulation by gpg-agent. [T3883]

* scd: Support the Telesec Signature Card v2.0. [T6252]

* scd: Redact --debug cardio output of a VERIFY APDU. [T5085]

* scd: Skip deleted pkcs#15 records in CARDOS 5. [rG061efac03f]

* dirmngr: Fix build with no LDAP support. [T6239]

* dirmngr: Fix verification of ECDSA signed CRLs. [rG868dabb402]

* wkd: New option --add-revocs for gpg-wks-client. [rGc3f9f2d497]

* wkd: Ignore expired user-ids in gpg-wks-client. [T6292]

* card: New commands "gpg" and "gpgsm". [rG9c4691c73e]

* gpg: Do not consider unknown public keys as non-compliant while
decrypting. [T6205]

* gpg: Avoid to emit a compliance mode line if Libgcrypt is
non-compliant. [T6221]

* gpg: Improve --edit-key setpref command to ease c+p. [rG1908fa8b83]
* gpg: Emit an ERROR status if --quick-set-primary-uid fails and
allow to pass the user ID by hash. [T6126]

* gpg: Actually show symmetric+pubkey encrypted data as de-vs
compliant. Add extra compliance checks for symkey_enc packets.
[T6119]

* gpg: In de-vs mode use SHA-256 instead of SHA-1 as implicit
preference. [T6043]

* gpgsm: Fix reporting of bad passphrase error during PKCS#11
import. [T5713,T6037]

* agent: Fix a regression in "READKEY --format=ssh". [T6012]
* agent: New option --need-attr for KEYINFO. [rG989eae648c]
* agent: New attribute "Remote-list" for use by KEYINFO.
[r1383aa4750]

* scd: Fix problem with Yubikey 5.4 firmware. [T6070]
* dirmngr: Fix CRL Distribution Point fallback to other schemes.
[rG0c8299e2b5]

* dirmngr: New LDAP server flag "areconly" (A-record-only).
[rGd65a0335e5]

* dirmngr: Fix upload of multiple keys for an LDAP server specified
using the colon format. [rG536b5cd663]

* dirmngr: Use LDAP schema v2 when a Base DN is specified. [T6047]
* dirmngr: Avoid caching expired certificates. [T6142]
* wkd: Fix path traversal attack in gpg-wks-server. Add the mail
address to the pending request data. [rG8a63a8c825,T6098]

* wkd: New command --mirror for gpg-wks-client. [T6224]
* gpg-auth: New tool for authentication. [T5862]
* New common.conf option no-autostart. [rG203dcc19eb]
* Silence warnings from AllowSetForegroundWindow unless
GNUPG_EXEC_DEBUG_FLAGS is used. [rG4ef8516a79]

* gpg: Fix possibly garbled status messages in NOTATION_DATA. This
bug could trick GPGME and other parsers to accept faked status
lines. [T6027, CVE-2022-34903]

* gpg: Look up user ID to revoke by UID hash. [T5936]

* gpg: Setup the 'usage' filter property for export. [rG7aabd94b81]

* gpg,w32: Allow Unicode filenames for iobuf_cancel. [rG4ee2009083]

* gpg: Fix reading AEAD preference. [T6019]

* gpgsm: New option --compatibility-flags. [rGf0b373cec9]

* gpgsm: Rework the PKCS#12 parser to support DFN issued keys.
[T6037]

* agent: New option --no-user-trustlist and --sys-trustlist-name.
[T5990]

* agent: Pop up dialog window for confirmation, when specified so.
[T5099]

* agent: Show "Label:" field of private key when prompt the
insertion. [T5986]

* agent: Handle USAGE information in KEYINFO. [rG295a6a7591]

* agent,ssh: Make not-inserted OpenPGP.3 keys available for SSH.
[T5996]

* agent,ssh: Support "Use-for-ssh" flag in private key. [T5985]

* agent: New field "Prompt" to prevent asking card key insertion.
[T5987]

* agent: Support --format=ssh option for READKEY. [T6012]

* agent: Add KEYATTR command. [T5988]

* agent: Flush before calling ftruncate. [T6035]

* agent: Do not consider --min-passphrase-len for the magic wand.
[rGae2f1f0785]

* kbx: Fix a race condition which results no status report. [T5948]

* scd:openpgp: Fix a segv for cards supporting unknown curves.
[T5963]

* scd:p15: Fix reading certificates without length info.

* scd:p15: Improve the displayed S/N for Technology Nexus cards.

* scd:openpgp: Add workaround for ECC attribute on Yubikey. [T5963]

* scd,piv: Fix status report of KEYPAIRINFO. [rG64c8786105]

* scd:nks: Support the Telesec ESIGN application. [T5219, T4938]

* scd: Fix use of SCardListReaders for PC/SC. [T5979]

* scd: Support automatic card selection for READCERT with keygrip.
[T6003]

* scd: Support specifying keygrip for learn command. [T6002]

* dirmngr: Fix for Windows when build against GNUTLS. [T5899]

* gpg-connect-agent: Add --unbuffered option.

* gpg-connect-agent: Add a way to cancel an INQUIRE. [T6010]

* gpgconf: New short options -V and -X