gmane.comp.encryption.gpg.devel

Python bindings for GnuPG

Bernhard Reiter — 2012-05-11T21:17:57

For those of you seeking to use GnuPG from Python, there is an overview at

  http://wiki.python.org/moin/GnuPrivacyGuard

I've just overhauled it.
My recommendation currently is to use James Henstridge's PyGPGME.
As it is actively maintained and even supports Python 3 and 2 since March.

An interesting approach is W. Trevor King's pgp-mime which uses pyassuan 
to speak to gpgme-tool. Haven't tried it. 

Happy Hacking,
Bernhard

npth-0.90 build report

Nelson H. F. Beebe — 2012-05-08T14:07:01

This morning, I successfully built npth-0.90 on about 80% of the 25 or
so flavors of Unix in our test lab.  There were, however, some
glitches that I could overcome, some machines on which a successful
build has not been possible, and one machine on which the build
succeeds, but the test fails.

When I attempted manual rebuilds after automated procedures failed,
I set PATH to a minimal list, such as /bin:/usr/bin.

Here is a summary of problems:

------------------------------------------------------------------------

Solaris 10 (SPARC, x86, x86_64) and 11 (x86_64):

Undefinedfirst referenced
 symbol      in file
accept                              ../src/.libs/libnpth.so
recvmsg                             ../src/.libs/libnpth.so
sendmsg                             ../src/.libs/libnpth.so
connect                             ../src/.libs/libnpth.so

    Need LIBS=-lsocket to resolve symbols.  With that addition,
    the build completes and the tests pass.

---------------------------------------

[Announce] nPth - The New GNU Portable Threads Library

Werner Koch — 2012-05-08T10:39:49

Hi!

We are pleased to announce the first tarball release of the
New GNU Portable Threads Library: nPth version 0.90.

nPth is a non-preemptive threads implementation using an API very similar
to the one known from GNU Pth.  It has been designed as a replacement of
GNU Pth for non-ancient operating systems.  In contrast to GNU Pth is is
based on the system's standard threads implementation.  Thus nPth allows
the use of libraries which are not compatible to GNU Pth.

GNU Pth is often used to provide a co-routine based framework.  GnuPG-2
makes heavy use of this concept for good audibility, general security
concerns, and ease of implementation.  However, GNU Pth has the drawback
that ugly hacks are required to work with libraries which are not GNU
Pth aware.

The nPth tarball and its signature are available as

  ftp://ftp.gnupg.org/gcrypt/npth/npth-0.90.tar.bz2
  ftp://ftp.gnupg.org/gcrypt/npth/npth-0.90.tar.bz2.sig

and at all GnuPG mirrors.  See the included README file and the npth.h
header for documentati

[PATCH] sm/certreqgen-ui.c

NIIBE Yutaka — 2012-04-26T00:55:48

Hello, 

While trying to use gpgsm --gen-key, I found two mistakes.

diff --git a/sm/certreqgen-ui.c b/sm/certreqgen-ui.c
index 236d53b..41492f5 100644
--- a/sm/certreqgen-ui.c
+++ b/sm/certreqgen-ui.c
< at >< at > -339,12 +339,12 < at >< at > gpgsm_gencertreq_tty (ctrl_t ctrl, estream_t output_stream)
   /* DNS names.  */
   tty_printf (_("Enter DNS names"));
   tty_printf (_(" (optional; end with an empty line):\n"));
-  ask_mb_lines (&mb_email, "Name-DNS: ");
+  ask_mb_lines (&mb_dns, "Name-DNS: ");
 
   /* URIs.  */
   tty_printf (_("Enter URIs"));
   tty_printf (_(" (optional; end with an empty line):\n"));
-  ask_mb_lines (&mb_email, "Name-URI: ");
+  ask_mb_lines (&mb_uri, "Name-URI: ");
 
 
   /* Want a self-signed certificate?  */

[PATCH] simplify ldap URL construction

Jim Meyering — 2012-04-25T15:44:46

* dirmngr/ldap-url.c (ldap_charray2str): Remove unwarranted uses of
strncpy, and simplify.
---
Looking at the other strncpy uses, I found these two and saw that they
are unnecessary, since we know in each case that the specified length
is also the length of the source string.  Using stpcpy makes it
simpler/clearer.

 dirmngr/ldap-url.c |    9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/dirmngr/ldap-url.c b/dirmngr/ldap-url.c
index 7b27a30..47441b1 100644
--- a/dirmngr/ldap-url.c
+++ b/dirmngr/ldap-url.c
< at >< at > -342,16 +342,11 < at >< at > char * ldap_charray2str( char **a, const char *sep )
 p = s;
 for ( v = a; *v != NULL; v++ ) {
 if ( v != a ) {
-strncpy( p, sep, slen );
-p += slen;
+p = stpncpy( p, sep, slen );
 }
-
-len = strlen( *v );
-strncpy( p, *v, len );
-p += len;
+p = stpcpy( p, *v );
 }

-*p = '\0';
 return s;
 }

--
1.7.10.335.g879d8

[PATCH 1] remove doubled words in a comment

Jim Meyering — 2012-04-25T15:40:48

---
 common/gettime.h |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/common/gettime.h b/common/gettime.h
index 4199369..bc914ad 100644
--- a/common/gettime.h
+++ b/common/gettime.h
< at >< at > -1,5 +1,5 < at >< at >
 /* gettime.h - Wrapper for time functions
- * Copyright (C) 2010 Free Software Foundation, Inc.
+ * Copyright (C) 2010, 2012 Free Software Foundation, Inc.
  *
  * This file is part of GnuPG.
  *
< at >< at > -24,8 +24,8 < at >< at >
 #include <gpg-error.h> /* We need gpg_error_t. */


-/* A type to hold the ISO time.  Note that this this is the same as
-   the the KSBA type ksba_isotime_t. */
+/* A type to hold the ISO time.  Note that this is the same as
+   the KSBA type ksba_isotime_t. */
 typedef char gnupg_isotime_t[16];

 time_t gnupg_get_time (void);
--
1.7.10.335.g879d8

[PATCH] avoid buffer strncpy-induced buffer overrun

Jim Meyering — 2012-04-25T15:42:53

* dirmngr/crlcache.c (open_dir): Ensure that both this_update
and next_update member strings are NUL-terminated.
---
this_update and next_update are sometimes expected to
be NUL-terminated strings, we must ensure it here.
Otherwise, the readers may access beyond the end of those buffers.

 dirmngr/crlcache.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/dirmngr/crlcache.c b/dirmngr/crlcache.c
index edf3837..768d446 100644
--- a/dirmngr/crlcache.c
+++ b/dirmngr/crlcache.c
< at >< at > -587,8 +587,14 < at >< at > open_dir (crl_cache_t *r_cache)
                 case 2: entry->issuer_hash = p; break;
                 case 3: entry->issuer = unpercent_string (p); break;
                 case 4: entry->url = unpercent_string (p); break;
-                case 5: strncpy (entry->this_update, p, 15); break;
-                case 6: strncpy (entry->next_update, p, 15); break;
+                case 5:
+  strncpy (entry->this_update, p, 15);
+  entry->this_update[15] = 0;
+  break;
+

[PATCH] tools/gpgsm-gencert.sh

NIIBE Yutaka — 2012-04-25T02:33:03

Hello,

gpgsm-gencert.sh doesn't work well with dash (version 0.5.7).

When URI_ADDRESSES is null, it exits without emitting
CSR.  It exits after the line:

[ -n "$URI_ADDRESSES" ] && echo "$URI_ADDRESSES"

When I change it to:

[ -n "$URI_ADDRESSES" ] && echo "$URI_ADDRESSES" || exit 0

it works.

It seems that dash's subshell with -e behavior is different.

Following is a patch to fix this problem, by not using subshell.

This works with both of dash and bash.

----------------------
diff --git a/tools/gpgsm-gencert.sh b/tools/gpgsm-gencert.sh
index b209c8e..28c3792 100755
--- a/tools/gpgsm-gencert.sh
+++ b/tools/gpgsm-gencert.sh
< at >< at > -171,7 +171,7 < at >< at > file_parameter=$(mktemp "/tmp/gpgsm.XXXXXX")
 outfile=$(mktemp "/tmp/gpgsm.XXXXXX")
 

-(
+{
 cat <<EOF
 Key-Type: $KEY_TYPE
 Key-Length: $KEY_LENGTH
< at >< at > -182,7 +182,7 < at >< at > EOF
 [ -n "$EMAIL_ADDRESSES" ] && echo "$EMAIL_ADDRESSES"
 [ -n "$DNS_ADDRESSES" ] && echo "$DNS_ADDRESSES"
 [ -n "$URI_ADDRESSES" ] && echo "$URI_ADDRESSES"
-) > "$file_parameter"
+} > "$fil

GnuPG 2.0 decryption of two PGP Message blocks in one Message

Ajay Kallur — 2012-04-24T16:13:48

Dear Developer,

Here's a peculiar scenario, I have a file which has 2 pgp messages or
blocks embedded in a single file one below the other.

Can GPG 2.0 be able to decrypt both the blocks and concatenate the messages
inside same single file?

I have attached the sample PGP file for reference and more clear picture of
the scenario.

Any help is greatly appreciated.

Thanks.

[PATCH 0/2] gitignore and string.h updates for GPGME

W. Trevor King — 2012-04-12T17:51:47

While I'm waiting for the go-ahead for more major socket changes to
GPGME, here are a few more minor cleanups.  I think I got the ChangeLog
commit message format right this time ;).


W. Trevor King (2):
  .gitignore: flesh out rules and add subdirectory-.gitignores.
  status-table.c: include string.h for strcmp.

 .gitignore                |   13 ++++++++-----
 doc/.gitignore            |    5 +++++
 lang/cl/.gitignore        |    1 +
 src/.gitignore            |    7 +++++++
 src/status-table.c        |    1 +
 tests/.gitignore          |   10 ++++++++++
 tests/gpg/.gitignore      |   30 ++++++++++++++++++++++++++++++
 tests/gpgsm/.gitignore    |   17 +++++++++++++++++
 tests/opassuan/.gitignore |    3 +++
 9 files changed, 82 insertions(+), 5 deletions(-)
 create mode 100644 doc/.gitignore
 create mode 100644 lang/cl/.gitignore
 create mode 100644 src/.gitignore
 create mode 100644 tests/.gitignore
 create mode 100644 tests/gpg/.gitignore
 create mode 100644 tests/gpgsm/.gitignore
 create mode 100644 test

Unable to compile libassuan-git

Alphazo — 2012-04-11T21:50:48

Hello,

I'm trying to maintain as much as I can the ArchLinux AUR package for
GnuPG2-git. To build the latest version libassuan>2.1 and ntph are
mandatory. Building ntph was an easy one but I'm getting an error with
libassuan-git. Can someone give me a hint?

Thanks
alphazo

.....
mv -f .deps/funopen.Tpo .deps/funopen.Plo
/bin/sh ../libtool --tag=CC   --mode=link gcc  -march=x86-64
-mtune=generic -O2 -pipe -fstack-protector --param=ssp-buffer-size=4
-D_FORTIFY_SOURCE=2 -Wall -Wcast-align -Wshadow -Wstrict-prototypes
-Wpointer-arith -fPIC -DPIC    -Wl,--version-script=./libassuan.vers
-version-info 3:0:3
-Wl,-O1,--sort-common,--as-needed,-z,relro,--hash-style=gnu -o
libassuan.la -rpath /usr/lib  libassuan_la-assuan.lo
libassuan_la-context.lo libassuan_la-system.lo libassuan_la-debug.lo
libassuan_la-conversion.lo libassuan_la-sysutils.lo
libassuan_la-client.lo libassuan_la-server.lo
libassuan_la-assuan-error.lo libassuan_la-assuan-buffer.lo
libassuan_la-assuan-handler.lo libassuan_la-assuan-inquire.lo
libassua

gnupg-2.0.19 test failures on GNU/Linux Red Hat 5.8 IA-64 (Itanium)

Nelson H. F. Beebe — 2012-04-05T15:46:39

I've just made a series of experiments with builds of gnupg-2.0.19 on
Red Hat 5.8 IA-64 (Itanium) with multiple compilers:

cc  (GCC) 4.1.2 20080704 (Red Hat 4.1.2-52)

gcc (GCC) 4.1.3 20080630 (prerelease)
gcc (GCC) 4.2.5 20090325 (prerelease)
gcc (GCC) 4.3.0 20071123 (experimental)
gcc (GCC) 4.4.6 20110301 (prerelease)
gcc (GCC) 4.5.3 20110303 (prerelease)
gcc (GCC) 4.6.1 20110429 (prerelease)
gcc (GCC) 4.7.0 20110430 (experimental)

icc (ICC) 9.1 20080314

Only the build with icc passed all of the tests, so I have
installed that one.

Builds typically look like this:

env CC=gcc-4.7 CFLAGS=-I/usr/local/include ./configure --libdir=/usr/local/lib && make all check

With the 8 different gcc versions, I get one or two test failures:

cc
3DES FAIL: conventional-mdc.test

gcc-4.1
FAIL: genkey1024.test
3DES FAIL: conventional-mdc.test

gcc-4.2
FAIL: genkey1024.test
FAIL: conventional.test

gcc-4.3
FAIL: conventional.test

gcc-4.4
FAIL: genkey1024.test

gcc-4.5
FAIL: genkey1024.te

gnupg-2.0.19: make distclean removes critical file

Nelson H. F. Beebe — 2012-04-05T12:54:20

A "make distclean" operation in gnupg-2.0.19 removes a
critical file: 

make[1]: Entering directory `/export/home/build/bare/gnupg-2.0.19/common'
test -z "audit-events.h status-codes.h" || rm -f audit-events.h status-codes.h

common/audit-events.h is part of the original distribution,
and gnupg-2.0.19 cannot be rebuilt without it.

-------------------------------------------------------------------------------
- Nelson H. F. Beebe                    Tel: +1 801 581 5254                  -
- University of Utah                    FAX: +1 801 581 4148                  -
- Department of Mathematics, 110 LCB    Internet e-mail: beebe< at >math.utah.edu  -
- 155 S 1400 E RM 233                       beebe< at >acm.org  beebe< at >computer.org -
- Salt Lake City, UT 84112-0090, USA    URL: http://www.math.utah.edu/~beebe/ -
-------------------------------------------------------------------------------

scd: a race condition between scd_command_handler and handle_tick

Niibe Yutaka — 2012-04-04T01:43:55

This is a bug report for GnuPG 2.0.19 (or 2.0.18).  I have not yet
checked if there is this bug in the development version or not.

This bug was found at "make check" of building scute 1.4.0 for Debian.
I think that it is a bug of a race condition.

Here are failure logs:

https://buildd.debian.org/status/fetch.php?pkg=scute&arch=armel&ver=1.4.0-2&stamp=1333006067
https://buildd.debian.org/status/fetch.php?pkg=scute&arch=ia64&ver=1.4.0-3&stamp=1333361223

It surely occured on other non-exotic architectures.  In fact, I
encountered on my amd64 box too (sorry, I lost the log).


NORMAL CASE:
Since the build environment doesn't have libpcsclite.so.1, pcsc daemon
wrappers fails at start up, and it results "Card error".

In the log, it's like:
-----------------------
gpg-agent[27706]: can't create directory `/home/buildd/.gnupg': No such file or directory
scdaemon[27707]: error sending PC/SC OPEN request: Broken pipe
gpg-agent[27706]: command learn failed: Card error
Skipping test because no token is present.
PAS

gnupg-2.0.19: common/estream.c mixes void and int

Nelson H. F. Beebe — 2012-03-28T16:06:23

While builds of gnupg-2.0.19 were successful on most of my roughly
25 flavors of Unix, compilations fail on two Solaris Intel systems.
The cause appears to be mixing of void and int in the file
common/estream.c in the definitions of the macros
ESTREAM_MUTEX_LOCK() .. ESTREAM_MUTEX_INITIALIZE() in
lines 177--188.

In function es_ftrylockfile() at line 2619, the value of
ESTREAM_TRYLOCK() is returned as an int, but a void cannot
be cast to an int.

Another minor problem is that configure.ac at line 1473 says

*** It is now required to build with support for the
*** GNU Portable Threads Library (Pth).

However, running 

% ./configure --help | grep pth
  --with-pth-prefix=PFX   prefix where GNU Pth is installed (optional)

says that Pth is optional.  Either it is optional, or it is
required, but only one can be true.

-------------------------------------------------------------------------------
- Nelson H. F. Beebe                    Tel: +1 801 581 5254                  -
- University of Utah

[Announce] GnuPG 2.0.19 released

Werner Koch — 2012-03-27T09:20:14

Hello!

We are pleased to announce the availability of a new stable GnuPG-2
release:  Version 2.0.19.

The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication
and data storage.  It can be used to encrypt data, create digital
signatures, help authenticating using Secure Shell and to provide a
framework for public key cryptography.  It includes an advanced key
management facility and is compliant with the OpenPGP and S/MIME
standards.

GnuPG-2 has a different architecture than GnuPG-1 (e.g. 1.4.12) in
that it splits up functionality into several modules.  However, both
versions may be installed alongside without any conflict.  In fact,
the gpg version from GnuPG-1 is able to make use of the gpg-agent as
included in GnuPG-2 and allows for seamless passphrase caching.  The
advantage of GnuPG-1 is its smaller size and the lack of dependency on
other modules at run and build time.  We will keep maintaining GnuPG-1
versions because they are very useful for small systems and for server
based application

bug tracker is down

Werner Koch — 2012-03-20T21:06:06

Hi!

Our bug tracker is currently down.  I'll fix it tomorrow.


Salam-Shalom,

   Werner

Stable GnuPG: 1.4.12 vs 2.0.18

Gaetan Bisson — 2012-03-19T06:20:14

Dear GnuPG developers,

Over at Arch Linux (see [1] and surrounding messages) we are slightly
confused by the statuses of GnuPG-1 and GnuPG-2, and more specifically
the following sentences:

"1.4.12 is the stable version of GnuPG. (2.0.18 is the unstable
development version)." [2]

"We are pleased to announce the availability of a new stable
GnuPG-2 release:  Version 2.0.18." [3]

We understand the GnuPG-2 branch is very different to GnuPG-1. Hence our
question: will you consider the GnuPG-2 branch as stable as GnuPG-1 some
day in the future, or is this already the case?

Cheers.

[1] http://mailman.archlinux.org/pipermail/arch-dev-public/2012-March/022704.html
[2] http://www.gnupg.org/download/release_notes.en.html
[3] http://lists.gnupg.org/pipermail/gnupg-announce/2011q3/000312.html

secure memory for decryption buffer

Martin Stenberg — 2012-03-16T16:31:26

Hello,

I sent a previous message (subject: gpgme not using secure memory?) to
the list but I assume it got lost in moderation (was not subscribed).

I'm writing a password manager and want it to use a gpg-encrypted file
for storing passwords. I figured that gpgme would be the right tool to
use to integrate gpg encryption/decryption in my application. However,
I'm unsure if gpgme stores decrypted data in secure memory. I don't want
passwords to be swapped to disk.

As far as I can tell from peeking at the gpgme source code, it reads
decrypted data using assuan_read_line, and I cannot find any mlock's
either in libassuan nor in gpgme.

I'm new to the gpg-related libraries so I might very well have missed
something, could someone please confirm if decrypted data can indeed be
swapped when using gpgme?

Thanks in advance!

/Martin
_______________________________________________
Gnupg-devel mailing list
Gnupg-devel< at >gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-devel

gpg-agent and AIX

Albert Chin — 2012-03-15T17:41:57

We have GnuPG 2.0.18 built on AIX. gpg-agent --help takes forever to
start. The reason is because get_max_fds() in common/exechelp.c
returns 2147483647 for max_fds. This is regardless of the limit placed
on file descriptors:
  $ limit
  cputime         unlimited
  filesize        unlimited
  datasize        unlimited
  stacksize       128MB
  coredumpsize    unlimited
  resident        unlimited
  addressspace    unlimited
  descriptors     2048

So I guess we have to come up with an alternate way to get the max_fds
on this platform?

2.1.0beta3 missing man pages?

Daniel Kahn Gillmor — 2012-03-14T06:55:09

it looks to me like the following binaries in 2.1.0beta3 don't yet have 
a manual page:

  gpg-check-pattern
  kbxutil
  g13
  gpgkey2ssh

Are there plans to document them with manual pages?

There is also a manpage for gpg-zip.1, but the tool appears to be named 
gpgtar.

Thanks (and apologies for the minor flood here, i'm trying to document 
the issues as i see them)

--dkg