gmane.comp.encryption.gpg.devel

Python bindings for GnuPG

Bernhard Reiter — 2012-05-11T21:17:57

For those of you seeking to use GnuPG from Python, there is an overview at

  http://wiki.python.org/moin/GnuPrivacyGuard

I've just overhauled it.
My recommendation currently is to use James Henstridge's PyGPGME.
As it is actively maintained and even supports Python 3 and 2 since March.

An interesting approach is W. Trevor King's pgp-mime which uses pyassuan 
to speak to gpgme-tool. Haven't tried it. 

Happy Hacking,
Bernhard

Re: pinentry-qt4 breaks Alt+Tab window switching in KDE

Maciej Sitarz — 2012-05-12T11:15:17

Please disregard my previous comment about pinentry-qt4 from Fedora not
working on Arch. It is working (forgot to add full path to binary, I ran
Arch's binary instead).

I decided to run some more tests... I tried to rule out the qt installed
on Arch. So I copied Qt libraries from Fedora to Arch and run few test
scenarios (all tests run on Arch):

Libs/Bins used                                   Result:
Qt(Arch) + pinentry-qt4(Arch)                    "No Windows" message
Qt(Arch) + pinentry-qt4(patched)                 OK
Qt(Arch) + pinentry-qt4(Fedora)                  OK
Qt(Fedora) + pinentry-qt4(Arch)                  "No Windows" message
Qt(Fedora) + pinentry-qt4(patched)               OK
Qt(Fedora) + pinentry-qt4(Fedora)                OK


Qt(Arch) - Arch system qt libs
Qt(Fedora) - binary qt libs taken from fedora
pinentry-qt4(Arch) - Arch system pinentry-qt4 bin
pinentry-qt4(Fedora) - binary qt libs taken from fedora
pinentry-qt4(patched) - pinentry-qt4 bin with my patch applied


All this makes me think pinentry-qt has a bug which is fixed in Fedora.
I checked Fedora's build and they apply only one patch[1].
I saw it before, but description didn't seem related to my issue. I gave
it a surprisingly it works!

Andre please give it a try and confirm.

[1]
http://pkgs.fedoraproject.org/gitweb/?p=pinentry.git;a=blob_plain;f=0001-Fix-qt4-pinentry-window-created-in-the-background.patch;hb=HEAD

Re: pinentry-qt4 breaks Alt+Tab window switching in KDE

Maciej Sitarz — 2012-05-12T10:14:06

W dniu 06.05.2012 19:11, Andre Heinecke pisze:

Maybe it's because version differences between our systems? I've
upgraded my system, now I have qt 4.8.1 and kdebase-lib 4.8.3,
recompiled pinentry-qt4 and the fix still works.


I just changed the call order to match with the confirm dialog call
order, as confirm dialog works properly.


Using "-g" also works for me.

I did one more test, I've got Fedora 16 (qt-4.8.1-5.fc16.x86_64
kdelibs-4.8.3-1.fc16.x86_64 pinentry-qt-0.8.1-4.fc16.x86_64) and
pinentry works there. I checked the patches which Fedora devs use to
compile pinentry but nothing special[1].

I thought why try to run pinentry-qt4 from Fedora on Arch (both systems
up to date so there's no much lib differences).
I copied pinentry-qt4 and one missing library (libtinfo.so.5), after
that I tried the test command[2]. After using it I got "*** No Windows
***" Window. So looks like the problem is not in pinentry-qt4 but in
some other libs (qt probably?).

[1] http://pkgs.fedoraproject.org/gitweb/?p=pinentry.git
[2] echo getpin | LD_LIBRARY_PATH=./ ./pinentry-qt4

Regards

Re: npth-0.90 build report

Werner Koch — 2012-05-12T08:19:53

On Fri, 11 May 2012 21:38, lists< at >openorbit.org said:

Thanks for that offer.  However, I already implemented it using
gettimeofday:

  int
  npth_clock_gettime (struct timespec *ts)
  {
  #if defined(CLOCK_REALTIME) && HAVE_CLOCK_GETTIME
    return clock_gettime (CLOCK_REALTIME, ts);
  #elif HAVE_GETTIMEOFDAY
    {
      struct timeval tv;
  
      if (gettimeofday (&tv, NULL))
        return -1;
      ts->tv_sec = tv.tv_sec;
      ts->tv_nsec = tv.tv_usec * 1000;
      return 0;
    }
  #else
    /* FIXME: fall back on time() with seconds resolution.  */
  # error clock_gettime not available - please provide a fallback.
  #endif
  }

The gotcha was that HAVE_CLOCK_GETTIME alone was not sufficient, a test
for the CLOCK_REALTIME macro was also required.  It would be better to
do the test for CLOCK_REALTIME while testing for clock_gettime, but
well, this was easier.


Salam-Shalom,

   Werner

Re: npth-0.90 build report

Mattias Holm — 2012-05-11T19:38:19

I decided to publish some code I wrote earlier at github. It implements clock_gettime for OS X / darwin. I kindly offer it using a dual GPL v2 or LGPL v3 or later license. This may be interesting for the npth library that failed building due to this function being missing on darwin.

It is available at https://github.com/kinslayer/darwin-posix-rt

If you want to can clean it up and make a patch with #ifdef __APPLE__ guards, would this be OK?


Kind regards,
Mattias

Re: npth-0.90 build report

Werner Koch — 2012-05-09T18:53:57

On Tue,  8 May 2012 16:07, beebe< at >math.utah.edu said:


Fixed by using an emulation.  At least it provides a guarantee that the
timeout value will not change.  Setting the siganl mask is of course not
race free.


Very likely also fixed.



Fixed.  We need to add -D_POSIX_C_SOURCE=200112L when building the tests.


Also fixed 0 I hope.  In case it still gives error we can simply removfe
the debugging code.


I still need to look at it.


The test program did not emit an exit code, thus it is possibly fixed
now.



Fixed.  But there may be other errors.

I like to write some regression tests before I do a new release.  If you
want to test my fixes now, I can send you a tarball.


Shalom-Salam,

   Werner

Re: npth-0.90 build report

Werner Koch — 2012-05-09T08:42:29

On Tue,  8 May 2012 16:07, beebe< at >math.utah.edu said:

Thanks for that quick testing.

The missing pselect on OpenBSD and derivatives is a pity. I wonder why
an OS claiming to head for best security does not support this
straightforward function which helps to avoid a race condition.  I guess
we need to provide a replacement and warn that that it is open to race
conditions.

I'll look into the other problems.


Salam-Shalom,

   Werner

npth-0.90 build report

Nelson H. F. Beebe — 2012-05-08T14:07:01

This morning, I successfully built npth-0.90 on about 80% of the 25 or
so flavors of Unix in our test lab.  There were, however, some
glitches that I could overcome, some machines on which a successful
build has not been possible, and one machine on which the build
succeeds, but the test fails.

When I attempted manual rebuilds after automated procedures failed,
I set PATH to a minimal list, such as /bin:/usr/bin.

Here is a summary of problems:

------------------------------------------------------------------------

Solaris 10 (SPARC, x86, x86_64) and 11 (x86_64):

Undefinedfirst referenced
 symbol      in file
accept                              ../src/.libs/libnpth.so
recvmsg                             ../src/.libs/libnpth.so
sendmsg                             ../src/.libs/libnpth.so
connect                             ../src/.libs/libnpth.so

    Need LIBS=-lsocket to resolve symbols.  With that addition,
    the build completes and the tests pass.

------------------------------------------------------------------------

OpenBSD 4.9 and 5.1 x86:

../src/.libs/libnpth.so.0.1: undefined reference to `pselect'

    We keep a directory with the output of nm on all of the
    libraries in the system, including those in the /usr/local
    tree.  None contains the symbol pselect.

------------------------------------------------------------------------

MirBSD 10 x86:

../src/.libs/libnpth.so.0.1: undefined reference to `pselect'

    As with its OpenBSD relatives, there is no pselect on this system.

------------------------------------------------------------------------

GNU/Linux Fedora 14 x86:

    A build with CC=cc succeeds, and passes the tests.

    However, a build with CC=c99 fails like this:

c99 -DHAVE_CONFIG_H -I. -I..  -I../src   -g -O2 -MT t-mutex.o -MD -MP -MF \
    .deps/t-mutex.Tpo -c -o t-mutex.o t-mutex.c
In file included from t-mutex.c:1:0:
../src/npth.h:219:60: warning: 'struct timespec' declared inside parameter list
../src/npth.h:275:26: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'npth_rwlock_t'
../src/npth.h:280:39: error: expected ')' before '*' token
../src/npth.h:282:44: error: expected ')' before '*' token
../src/npth.h:286:39: error: expected ')' before '*' token
../src/npth.h:287:44: error: expected ')' before '*' token
../src/npth.h:303:17: warning: 'struct timespec' declared inside parameter list
../src/npth.h:347:17: warning: 'struct timespec' declared inside parameter list
../src/npth.h:361:32: warning: 'struct timespec' declared inside parameter list

    On other systems, builds with CC=c99 failed as well, with reports like this:

../src/npth.h:219:60: warning: 'struct timespec' declared inside parameter list [enabled by default]
../src/npth.h:275:1: error: unknown type name 'pthread_rwlock_t'
../src/npth.h:283:22: warning: 'struct timespec' declared inside parameter list [enabled by default]
../src/npth.h:288:22: warning: 'struct timespec' declared inside parameter list [enabled by default]
../src/npth.h:303:17: warning: 'struct timespec' declared inside parameter list [enabled by default]
../src/npth.h:347:17: warning: 'struct timespec' declared inside parameter list [enabled by default]
../src/npth.h:361:32: warning: 'struct timespec' declared inside parameter list [enabled by default]

../src/npth.h:219: warning: "struct timespec" declared inside parameter list
../src/npth.h:275: error: parse error before "npth_rwlock_t"
../src/npth.h:275: warning: type defaults to `int' in declaration of `npth_rwlock_t'
../src/npth.h:275: warning: data definition has no type or storage class
../src/npth.h:280: error: parse error before '*' token
../src/npth.h:282: error: parse error before '*' token
../src/npth.h:286: error: parse error before '*' token
../src/npth.h:287: error: parse error before '*' token
../src/npth.h:303: warning: "struct timespec" declared inside parameter list
../src/npth.h:347: warning: "struct timespec" declared inside parameter list
../src/npth.h:361: warning: "struct timespec" declared inside parameter list

"npth.c", line 104: warning: implicit function declaration: usleep
"npth.c", line 154: undefined symbol: __FUNCTION__
"npth.c", line 154: warning: improper pointer/integer combination: arg #1
...many more like that...

------------------------------------------------------------------------

Mac OS X PowerPC and x86_64:

libtool: compile:  gcc -DHAVE_CONFIG_H -I. -I.. -g -O2 -MT npth.lo \
    -MD -MP -MF .deps/npth.Tpo -c npth.c  -fno-common -DPIC -o .libs/npth.o
npth.c: In function 'npth_clock_gettime':
npth.c:594: error: 'CLOCK_REALTIME' undeclared (first use in this function)
npth.c:594: error: (Each undeclared identifier is reported only once
npth.c:594: error: for each function it appears in.)

------------------------------------------------------------------------

GNU/Linux Gentoo SPARC:

Build succeeds, but test fails:

FAIL: t-mutex
======================================
1 of 1 test failed
Please report to gnupg-devel< at >gnupg.org
======================================

------------------------------------------------------------------------

SGI IRIX 6.5 MIPS R10000:

/bin/ksh ../libtool --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I. -I.. \
    -g -O2 -MT npth.lo -MD -MP -MF .deps/npth.Tpo -c -o npth.lo npth.c
libtool: compile:  gcc -DHAVE_CONFIG_H -I. -I.. -g -O2 -MT npth.lo -MD -MP -MF \
    .deps/npth.Tpo -c npth.c  -DPIC -o .libs/npth.o
In file included from npth.c:40:
npth.h:342: error: syntax error before "socklen_t"
npth.h:343: error: syntax error before "socklen_t"
npth.c:479: error: syntax error before "socklen_t"
npth.c: In function `npth_connect':
npth.c:484: error: `s' undeclared (first use in this function)
npth.c:484: error: (Each undeclared identifier is reported only once
npth.c:484: error: for each function it appears in.)
npth.c:484: error: `addr' undeclared (first use in this function)
npth.c:484: error: `addrlen' undeclared (first use in this function)
npth.c: At top level:
npth.c:491: error: syntax error before "socklen_t"
npth.c: In function `npth_accept':
npth.c:496: error: `s' undeclared (first use in this function)
npth.c:496: error: `addr' undeclared (first use in this function)
npth.c:496: error: `addrlen' undeclared (first use in this function)

    The type socklen_t is not defined in /usr/include/*.h or /usr/include/*/*.h
    on this system.

------------------------------------------------------------------------

-------------------------------------------------------------------------------
- Nelson H. F. Beebe                    Tel: +1 801 581 5254                  -
- University of Utah                    FAX: +1 801 581 4148                  -
- Department of Mathematics, 110 LCB    Internet e-mail: beebe< at >math.utah.edu  -
- 155 S 1400 E RM 233                       beebe< at >acm.org  beebe< at >computer.org -
- Salt Lake City, UT 84112-0090, USA    URL: http://www.math.utah.edu/~beebe/ -
-------------------------------------------------------------------------------

[Announce] nPth - The New GNU Portable Threads Library

Werner Koch — 2012-05-08T10:39:49

Hi!

We are pleased to announce the first tarball release of the
New GNU Portable Threads Library: nPth version 0.90.

nPth is a non-preemptive threads implementation using an API very similar
to the one known from GNU Pth.  It has been designed as a replacement of
GNU Pth for non-ancient operating systems.  In contrast to GNU Pth is is
based on the system's standard threads implementation.  Thus nPth allows
the use of libraries which are not compatible to GNU Pth.

GNU Pth is often used to provide a co-routine based framework.  GnuPG-2
makes heavy use of this concept for good audibility, general security
concerns, and ease of implementation.  However, GNU Pth has the drawback
that ugly hacks are required to work with libraries which are not GNU
Pth aware.

The nPth tarball and its signature are available as

  ftp://ftp.gnupg.org/gcrypt/npth/npth-0.90.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/npth/npth-0.90.tar.bz2.sig

and at all GnuPG mirrors.  See the included README file and the npth.h
header for documentation.  Bug reports and requests for help should be
send to the gnupg-devel mailing list at gnupg.org.  nPth is available
under the terms of the LGPLv3+ or the GPLv2+.  The GIT repository is at
git://git.gnupg.org/npth.git .

The current development version of GnuPG (2.1) has already been migrated
to nPth and thus the next beta release will require it.  Obviously we
expect to fix some portability problems before we can release 1.0.  On
common Linux and kFreeBSD systems and even on Android, nPth should build
and work fine.

Background: When porting GnuPG-2 to Windows in 2004, we had the need for
a replacement of GNU Pth, which is not available for native Windows.  We
came up with an emulation based on the native Windows thread system.
Experience since then showed that such an emulation is a solid way to
provide a co-routine based framework.  Given that thread implementations
(in particular pthreads) are now in common use on all platforms, there
is not must justification left for not using them: Without considering
the GnuPG packages, Debian has only two packages requiring GNU Pth
(zhcon and jabberd14 - the latter even seems not in wide use anymore).

Many thanks to Ralf S. Engelschall for his excellent GNU PTH library,
which served GnuPG very well for many years.


Happy hacking,

  Marcus and Werner

Re: pinentry-qt4 breaks Alt+Tab window switching in KDE

Andre Heinecke — 2012-05-06T17:11:17

Hi,

On Thursday 03 May 2012 17:00:40 Werner Koch wrote:
Just tried it.
I could reproduce this problem with KDE 4.4.5 and Qt 4.6.3.
But this Patch did not fix the Problem for me.
After applying the patch I still get the "*** No Windows ***" Window.

As far as I can tell, the patch just changes the call order bit and the 
showEvent code should not be causing problems as long as this is not caused by 
a qt bug (which I doubt). 

For me the problem looks much more related to grabbing. If I 
use pinentry-qt without global grab (echo getpin | ./pinentry-qt4 -g) the 
alt+tab works afterwards.

Regards,
Andre

Re: pinentry-qt4 breaks Alt+Tab window switching in KDE

Werner Koch — 2012-05-03T15:00:40

On Sun,  8 Apr 2012 12:29, macieksitarz< at >wp.pl said:


Did anyone else tested this patch in the meantime?  Does it break
something?


Shalom-Salam,

   Werner

Re: [PATCH] simplify ldap URL construction

Werner Koch — 2012-04-26T17:21:02

On Thu, 26 Apr 2012 15:57, jim< at >meyering.net said:


We have a simple stpcpy replacement in common/stringhelp.h.  Adding
stpncpy is straightforward.

For historic reasons GnuPG does not use gnulib properly.  I also don't
care about performance on platforms which don't support a certain new
function; the simple replacements do their job.


Salam-Shalom,

   Werner

Re: [PATCH] simplify ldap URL construction

Jim Meyering — 2012-04-26T13:57:20

gnulib's stpcpy module is also good to use, since some systems lack it:

[from doc/posix-functions/stpcpy.texi]

  This function is missing on some platforms:

    AIX 4.3.2
    Cygwin 1.5.x
    HP-UX 11
    IRIX 6.5
    Interix 3.5.
    MSVC 9
    Minix 3.1.8
    NetBSD 5.0
    OSF/1 5.1
    OpenBSD 3.8
    Solaris 10
    mingw

[PATCH] sm/certreqgen-ui.c

NIIBE Yutaka — 2012-04-26T00:55:48

Hello, 

While trying to use gpgsm --gen-key, I found two mistakes.

diff --git a/sm/certreqgen-ui.c b/sm/certreqgen-ui.c
index 236d53b..41492f5 100644
--- a/sm/certreqgen-ui.c
+++ b/sm/certreqgen-ui.c
< at >< at > -339,12 +339,12 < at >< at > gpgsm_gencertreq_tty (ctrl_t ctrl, estream_t output_stream)
   /* DNS names.  */
   tty_printf (_("Enter DNS names"));
   tty_printf (_(" (optional; end with an empty line):\n"));
-  ask_mb_lines (&mb_email, "Name-DNS: ");
+  ask_mb_lines (&mb_dns, "Name-DNS: ");
 
   /* URIs.  */
   tty_printf (_("Enter URIs"));
   tty_printf (_(" (optional; end with an empty line):\n"));
-  ask_mb_lines (&mb_email, "Name-URI: ");
+  ask_mb_lines (&mb_uri, "Name-URI: ");
 
 
   /* Want a self-signed certificate?  */

Re: [PATCH] simplify ldap URL construction

Jim Meyering — 2012-04-25T18:44:15

Good catch.

But gnupg uses gnulib, and there's a stpncpy module to ensure
that it's available.

Re: [PATCH] simplify ldap URL construction

Werner Koch — 2012-04-25T18:37:29

On Wed, 25 Apr 2012 17:44, jim< at >meyering.net said:


Well, stpncpy is not portable.  However it looks very useful.


Shalom-Salam,

   Werner

[PATCH] simplify ldap URL construction

Jim Meyering — 2012-04-25T15:44:46

* dirmngr/ldap-url.c (ldap_charray2str): Remove unwarranted uses of
strncpy, and simplify.
---
Looking at the other strncpy uses, I found these two and saw that they
are unnecessary, since we know in each case that the specified length
is also the length of the source string.  Using stpcpy makes it
simpler/clearer.

 dirmngr/ldap-url.c |    9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/dirmngr/ldap-url.c b/dirmngr/ldap-url.c
index 7b27a30..47441b1 100644
--- a/dirmngr/ldap-url.c
+++ b/dirmngr/ldap-url.c
< at >< at > -342,16 +342,11 < at >< at > char * ldap_charray2str( char **a, const char *sep )
 p = s;
 for ( v = a; *v != NULL; v++ ) {
 if ( v != a ) {
-strncpy( p, sep, slen );
-p += slen;
+p = stpncpy( p, sep, slen );
 }
-
-len = strlen( *v );
-strncpy( p, *v, len );
-p += len;
+p = stpcpy( p, *v );
 }

-*p = '\0';
 return s;
 }

--
1.7.10.335.g879d8

[PATCH 1] remove doubled words in a comment

Jim Meyering — 2012-04-25T15:40:48

---
 common/gettime.h |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/common/gettime.h b/common/gettime.h
index 4199369..bc914ad 100644
--- a/common/gettime.h
+++ b/common/gettime.h
< at >< at > -1,5 +1,5 < at >< at >
 /* gettime.h - Wrapper for time functions
- * Copyright (C) 2010 Free Software Foundation, Inc.
+ * Copyright (C) 2010, 2012 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
< at >< at > -24,8 +24,8 < at >< at >
 #include <gpg-error.h> /* We need gpg_error_t. */


-/* A type to hold the ISO time.  Note that this this is the same as
-   the the KSBA type ksba_isotime_t. */
+/* A type to hold the ISO time.  Note that this is the same as
+   the KSBA type ksba_isotime_t. */
 typedef char gnupg_isotime_t[16];

 time_t gnupg_get_time (void);
--
1.7.10.335.g879d8

[PATCH] avoid buffer strncpy-induced buffer overrun

Jim Meyering — 2012-04-25T15:42:53

* dirmngr/crlcache.c (open_dir): Ensure that both this_update
and next_update member strings are NUL-terminated.
---
this_update and next_update are sometimes expected to
be NUL-terminated strings, we must ensure it here.
Otherwise, the readers may access beyond the end of those buffers.

 dirmngr/crlcache.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/dirmngr/crlcache.c b/dirmngr/crlcache.c
index edf3837..768d446 100644
--- a/dirmngr/crlcache.c
+++ b/dirmngr/crlcache.c
< at >< at > -587,8 +587,14 < at >< at > open_dir (crl_cache_t *r_cache)
                 case 2: entry->issuer_hash = p; break;
                 case 3: entry->issuer = unpercent_string (p); break;
                 case 4: entry->url = unpercent_string (p); break;
-                case 5: strncpy (entry->this_update, p, 15); break;
-                case 6: strncpy (entry->next_update, p, 15); break;
+                case 5:
+  strncpy (entry->this_update, p, 15);
+  entry->this_update[15] = 0;
+  break;
+                case 6:
+  strncpy (entry->next_update, p, 15);
+  entry->next_update[15] = 0;
+  break;
                 case 7: entry->dbfile_hash = p; break;
                 case 8: if (*p) entry->crl_number = p; break;
                 case 9:
--
1.7.10.335.g879d8

Re: [PATCH] tools/gpgsm-gencert.sh

Werner Koch — 2012-04-25T07:08:04

On Wed, 25 Apr 2012 05:21, gniibe< at >fsij.org said:


Right.  For the Windows port I had to write in C (with better error
reporting):  gpgsm --gen-key


{ } does not work with old shells.


Salam-Shalom,

   Werner

Re: [PATCH] tools/gpgsm-gencert.sh

NIIBE Yutaka — 2012-04-25T03:21:26

Sorry, my bug report is incomplete.

I noticed that gpgsm-gencert.sh is deprecated, so it would
be irrelevant now.

I found that it doesn't work well with bash version 4.1.5 either.

In a different environment, I ran this script to create CSR and it
went well last year.  In the previous mail, I thought it's because of
shell difference, but this is wrong.


Anyway, I believe that this fix is correct.