gnupg2 (2.4.5-3) [PTS] [DDPO]

OLD: VCS is behind the version in the archive: 2.2.44-1 < 2.4.5-3.

Git: https://salsa.debian.org/debian/gnupg2.git
JSON
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: debian/unstable
Path: debian/changelog
Repo size: 81727488
Browser: https://salsa.debian.org/debian/gnupg2
Last scan: 2024-09-16 21:16:14+00
Next scan: 2024-09-22 20:49:00+00
Merge requests: 1
CI pipeline status: success

Debian changelog in Git:

gnupg2 (2.2.44-1) unstable; urgency=medium

  * New upstream version.
    + Refresh patches, drop cherry-picked one.
    + Drop outdated libassuan.m4. Closes: #1081866

 -- Andreas Metzler <ametzler@debian.org>  Sun, 15 Sep 2024 13:45:10 +0200

This branch is 30 commits ahead of tag debian/2.2.43-8

Git log:

commit 306f1250d22771a3a229bc1db25f682985e468c6
Author: Andreas Metzler <ametzler@bebt.de>
Date:   Mon Sep 16 18:29:37 2024 +0200

    Add bug closer

commit 953f236edec2dac73ffc3f951b58ce6d4c9d62e0
Author: Andreas Metzler <ametzler@bebt.de>
Date:   Sun Sep 15 13:45:28 2024 +0200

    Document changes

commit c7b113a0c09a03d856eca3e846bb64ec59e60fb7
Author: Andreas Metzler <ametzler@bebt.de>
Date:   Sun Sep 15 13:36:20 2024 +0200

    Drop outdated libassuan.m4

commit b543a5458065b49b42c9168e5eae182b12ec456b
Author: Andreas Metzler <ametzler@bebt.de>
Date:   Sun Sep 15 13:24:02 2024 +0200

    Refresh patches, drop cherry-picked one

commit 5a9311e46107f591f34d40679eed5362c243b5e8
Merge: 9e369fb74 2bb3d7bab
Author: Andreas Metzler <ametzler@bebt.de>
Date:   Sun Sep 15 13:04:36 2024 +0200

    Update upstream source from tag 'upstream/2.2.44'
    
    Update to upstream version '2.2.44'
    with Debian dir c83b24b39e9e0826a6a84a29afa5b664a938a680

commit 2bb3d7bab032264e8b0cd1e70a8e34f7eb7c70c4
Merge: f85d326a4 148a25f3d
Author: Andreas Metzler <ametzler@bebt.de>
Date:   Sun Sep 15 13:04:17 2024 +0200

    New upstream version 2.2.44

commit 148a25f3de8faed9b7fd692cfc358ff08caed300
Author: Werner Koch <wk@gnupg.org>
Date:   Mon Aug 12 16:42:19 2024 +0200

    Release 2.2.44

commit 377d28e1dbf5525016f53463e1cdf8b855b0be5e
Author: Werner Koch <wk@gnupg.org>
Date:   Mon Aug 12 17:11:35 2024 +0200

    speedo,w32: Add extra flags for gpgrt and fix SO name of libassuan.
    
    --
    
    Due to the recently introduced use of STARTUPINFOEXW in gpgrt we now
    need at least Windows Vista.  Version 8 of Mingw defaults to XP SP2
    which requires us to explicit override that default.
    
    The SO number of libassuan needs an update too.
    
    (cherry picked from commit d56b63a66181b4f029e91dcea095e9eb149895b7)

commit cf21e473a54466b12f34b35ad6d40dad8d74de93
Author: Werner Koch <wk@gnupg.org>
Date:   Thu Jul 4 17:17:13 2024 +0200

    gpgconf: Print the full commit id.
    
    * autogen.sh: Update to version 2024-07-04 from libgpg-error.
    * configure.ac (BUILD_REVISION): Rename the ac_define by
    BUILD_COMMITID.
    * tools/gpgconf.c (show_version_gnupg): Use it here.
    --
    
    (cherry picked from commit 736579331b14035db5b857812d18b493678f7769)

commit ce73691bd3f7f1bc19a45298d2dccfa584dc6d81
Author: Werner Koch <wk@gnupg.org>
Date:   Mon Aug 12 16:31:04 2024 +0200

    po: msgmerge
    
    --

commit 99e1eae0511c1bdc009458fffb2882b302a0a1db
Author: Werner Koch <wk@gnupg.org>
Date:   Mon Aug 12 16:45:46 2024 +0200

    po: Add German translation for a new string.
    
    --

commit 861dc01994b01b5700d2a5ae9eb7e0299181d390
Author: Werner Koch <wk@gnupg.org>
Date:   Mon Aug 12 14:50:08 2024 +0200

    gpg: Improve decryption diagnostic for an ADSK key.
    
    * g10/keydb.h (GET_PUBKEYBLOCK_FLAG_ADSK): New constant.
    * g10/packet.h (PUBKEY_USAGE_XENC_MASK): New constant.
    * g10/pubkey-enc.c (get_it): Print a note if an ADSK key was used.
    Use the new get_pubkeyblock flag.
    * g10/getkey.c (struct getkey_ctx_s): Add field allow_adsk.
    (get_pubkeyblock): Factor all code out to ...
    (get_pubkeyblock_ext): new.
    (finish_lookup): Add new arg allow_adsk and make use of it.
    --
    
    This patch solves two purposes:
    - We write a note that the ADSK key was used for decryption
    - We avoid running into a
      "oops: public key not found for preference check\n"
      due to ADSK keys.  The error is mostly harmless but lets gpg return
      with an exit code of 2.
    
    Backported-from-master: 882ab7fef9bf4440900c32d7463469307224f11a

commit 6f78219d0f4f8e10484ced3d46f19aa088fe64e5
Author: Andre Heinecke <aheinecke@gnupg.org>
Date:   Thu Aug 8 15:18:07 2024 +0200

    speedo,w32: Update libassuan dll name in wxs
    
    * build-aux/speedo/w32/wixlib.wxs: Update name and UID for
    libassuan

commit 80f25fab900b2b5a8efe93a39c3f46e915b51374
Author: Werner Koch <wk@gnupg.org>
Date:   Thu Aug 8 17:13:47 2024 +0200

    agent: Fix an unitialized variable in an error path.
    
    * agent/findkey.c (agent_write_private_key): Init FP.
    --
    
    With
    Fixes-commit: 3b69d8bf7146b8d10737d0cfea9c97affc60ad73
    we took a shortcut but forgot to init FP which is usually set after
    the new check.  At least in the AppImage this always triggered a segv
    and gpg or Kleopatra had to restart the agent.  Not a problem in 2.4
    becuase this code is a hack we don't need in 2.4 due to that new
    ephemeral key storing feature.
    
    GnuPG-bug-id: 6944

commit 62bd291dcc6d3120a28a2a2ce1bf1bd7c2b750dd
Author: Werner Koch <wk@gnupg.org>
Date:   Thu Aug 8 15:57:23 2024 +0200

    common: Allow building with libgpg-error < 1.47
    
    * common/util.h (GPG_ERR_BAD_RESET_CODE): New replacement.
    (GPG_ERR_NO_RESET_CODE): New.
    (GPG_ERR_BAD_PUK): New.
    --
    
    But as least 1.38 is required.  Tested with 1.42

commit bc150995e44cc7552c693277abd9f858be47cc11
Author: Werner Koch <wk@gnupg.org>
Date:   Thu Aug 8 14:20:44 2024 +0200

    common: Add missing file to repo
    
    --
    Fixes-commit: 0dcd1504babb4b98898f7bd738d7aaa1e4a73a05

commit 0dcd1504babb4b98898f7bd738d7aaa1e4a73a05
Author: Werner Koch <wk@gnupg.org>
Date:   Tue Aug 6 17:51:01 2024 +0200

    sm: More improvements for PKCS#12 parsing for latest IVBB changes.
    
    * common/tlv.h (TLV_PARSER_FLAG_T5793): New.
    (tlv_parser_new): New macro.  Rename function with an underscore.
    (tlv_next_with_flag): New.
    * common/tlv-parser.c (struct tlv_parser_s): Remove const from buffer.
    Add fields crammed, lasttlv, and origoff.  Remove bufferlist ands ist
    definition.
    (dump_to_file): New but disabled debug helper.
    (parse_tag): Print more info on error.
    (_tlv_parser_new): Add args lasttlv and LNO.  Take a copy of the data.
    (_tlv_parser_release): Free the copy of the buffer and return the
    recorded TLV object from tlv_parser_new.
    (_tlv_peek, tlv_parser_peek, _tlv_parser_peek_null): Remove.
    (_tlv_push): Record crammed length.
    (_tlv_pop): Restore crammed length.
    (_tlv_parser_next): Add arg flags.  More debug output.  Handle cramming
    here.  Take care of cramming here.
    (tlv_expect_object): Simplify to adjust for changes in _tlv_parser_next.
    (tlv_expect_octet_string): Remove arg encapsulates.  Adjust for
    changes in _tlv_parser_next.  Change all allers.
    (tlv_expect_null): New.
    (cram_octet_string): Rewrite.
    (need_octet_string_cramming): Remove.
    
    * sm/minip12.c (dump_to_file): New.  Enable in debug mode and if an
    envvar ist set.  Replace all explict but disabled dumping to call this
    function.
    (parse_bag_encrypted_data): Replace tlv_peek_null and a peeking for an
    optional SET by non-peeking code.
    (parse_cert_bag): Ditto.
    (parse_shrouded_key_bag): Replace tlv_peek_null by non-peeking code.
    (parse_bag_encrypted_data): Use the new TLV_PARSER_FLAG_T5793 to
    enable the Mozilla workaround.
    (parse_bag_encrypted_data): Replace the 'renewed_tlv' code by the new
    tlv_parser_release semantics.
    (parse_shrouded_key_bag): Ditto.
    (parse_shrouded_key_bag): Create a new context instead of using the
    former encapsulated mechanism for tlv_expect_octet_string.
    (parse_bag_data): Ditto.
    (p12_parse): Ditto.
    
    * common/tlv-parser.c: New
    * common/Makefile.am: Add new file.
    --
    
    GnuPG-bug-id: 7213
    Backported-from-master: 690fd61a0cf2b4b51ee64811656692eb644d2918
    
    This backport required to introduce the new tlv-parser.c file and
    remove most source copied stuff from minip12.c.  Thus the above
    ChangeList is not fully correct.

commit 1d0874c3d2c964edc4803f26b665343e0feb0d88
Author: Werner Koch <wk@gnupg.org>
Date:   Wed Aug 7 11:20:59 2024 +0200

    scd: New getinfo subcommand "manufacturer"
    
    * scd/command.c (cmd_getinfo): Add subcommand "manufacturer".
    * scd/app-openpgp.c (get_manufacturer): Rename to ...
    (app_openpgp_manufacturer): this and make global.
    --
    
    Example:
    
      $ gpg-connect-agent 'scd getinfo manufacturer 42' /bye
      D Magrathea
      OK
    
    Backported-from-master: a8cef7ebc2b8c3aa1477b61fecfaa8e5d63446d7

commit dfc400a2d9058a153b24d327d96f25ff02498dc1
Author: Werner Koch <wk@gnupg.org>
Date:   Thu Aug 1 12:14:01 2024 +0200

    doc: Fix URL to the OpenPGP card specs
    
    --

commit e208ccc66c3432183eaa38e9d70ac288d7ba492c
Author: Werner Koch <wk@gnupg.org>
Date:   Mon Jun 24 11:49:05 2024 +0200

    gpg: Rename recently added import option no-seckeys to only-pubkeys.
    
    * g10/import.c (parse_import_options): Rename option.
    * g10/options.h (IMPORT_NO_SECKEY): Rename to IMPORT_ONLY_PUBKEYS.
    Change all users.
    --
    
    GnuPG-bug-id: 7146

commit 7788aba7d86493c42617445f6d2344afdc332af5
Author: Werner Koch <wk@gnupg.org>
Date:   Tue Jun 11 15:52:07 2024 +0200

    gpg: Add --import-option "no-seckeys".
    
    * g10/import.c (parse_import_options): Add "no-seckeys".
    --
    
    GnuPG-bug-id: 7146

commit c489bf7e7e9fa96db46544edc2ae8bb59f0d340f
Author: Werner Koch <wk@gnupg.org>
Date:   Tue Jun 11 12:41:51 2024 +0200

    gpg: Do not bail out on secret keys with an unknown algo
    
    * g10/getkey.c (lookup): Skip keys with unknown algos.
    --
    
    If the local store has private keys with an algorithm not supported by
    thi version of gpg, gpg used to bail out.  Thus decryption of proper
    messages was not possible.  This fix skips such secret keys.

commit 1d91252205a21fc1a42e7a55a49421e50bb70f05
Author: Werner Koch <wk@gnupg.org>
Date:   Wed Jun 5 10:00:05 2024 +0200

    gpg: Do not show RENC if no key capabilities are found for a key.
    
    * g10/packet.h (PUBKEY_USAGE_BASIC_MASK): New.
    * g10/getkey.c (merge_selfsigs_subkey): Mask the default.
    (merge_selfsigs_main): Ditto.
    --

commit bc43812358ede31e2ef089e97740af6ae9754f62
Author: Jakub Jelen <jjelen@redhat.com>
Date:   Tue May 28 17:15:03 2024 +0200

    gpgsm: Avoid double free when checking rsaPSS signatures.
    
    * sm/certcheck.c (gpgsm_check_cms_signature): Do not free s_sig on
    error. Its owned and freed by the caller.
    
    --
    This is part of
    GnuPG-bug-id: 7129
    Signed-off-by: Jakub Jelen <jjelen@redhat.com>
    Fixes-commit: 969abcf40cdfc65f3ee859c5e62889e1a8ccde91
    (cherry picked from commit dcb0b6fd4822107d68bcb046d4d0650d02c82522)

commit a1f85fdc40e4ebb0bc59fa72104a2297ad427c10
Author: Jakub Jelen <jjelen@redhat.com>
Date:   Tue May 28 16:50:59 2024 +0200

    agent: Avoid uninitialized access in GENKEY command on parameter error.
    
    * agent/command.c (cmd_genkey): Moved init_membuf to the top.
    --
    
    Signed-off-by: Jakub Jelen <jjelen@redhat.com>
    
    This is part of
    GnuPG-bug-id: 7129
    
    (cherry picked from commit 379fc5569d604c4a7b5f12b2bbfc4106893c2a9e)

commit ebf9e3b824f8a024f5b9c56caca60bb4ee9ff361
Author: Werner Koch <wk@gnupg.org>
Date:   Tue May 28 13:54:57 2024 +0200

    wks: Make sure that ERR is always initialized.
    
    * tools/wks-util.c (install_key_from_spec_file): Initialize ERR in case
    the loop is never run.
    --
    
    This is part of
    GnuPG-bug-id: 7129
    Co-authored-by: Jakub Jelen <jjelen@redhat.com>
    
    (cherry picked from commit 021c27510b52f86a95ae70b5f4ed5d2c3886c3e8)

commit bb57c808b2ad2d064ef9dd5a69ca94f6e6f7a763
Author: NIIBE Yutaka <gniibe@fsij.org>
Date:   Thu May 16 10:28:38 2024 +0900

    scd:openpgp: Fix PIN pin2hash_if_kdf.
    
    * scd/app-openpgp.c (pin2hash_if_kdf): DEK had been changed to pointer
    to allocated memory, so, we need to use DEKLEN for the length.
    
    --
    
    GnuPG-bug-id: 7121
    Fixes-commit: 20e85585ed20af67ce68e637ea5c3637615ba2e9
    Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>

commit 97b37db144da6c9278786d51a233716e78c1f12c
Author: Werner Koch <wk@gnupg.org>
Date:   Mon May 6 14:34:48 2024 +0200

    gpg,gpgsm: Remove compatibility_flags allow-ecc-encr and vsd-allow-encr.
    
    * g10/options.h (COMPAT_VSD_ALLOW_OCB): Remove.
    * g10/gpg.c (compatibility_flags): Remove "vsd-allow_ocb".
    (main): Alwas set CO_EXTRA_INFO_VSD_ALLOW_OCB.
    * g10/keygen.c (keygen_set_std_prefs): Always set OCB feature flag.
    * g10/encrypt.c (use_aead): Always OCB also in de-vs mode.
    * sm/gpgsm.h (COMPAT_ALLOW_ECC_ENCR): Remove.
    * sm/gpgsm.c (compatibility_flags): Remove "allow-ecc-encr".
    * sm/encrypt.c (encrypt_dek): Always allow ecc encryption.
    * sm/certreqgen.c (proc_parameters): Likewise.
    --
    
    Both feature are meanwhile approved in de-vs mode thus there is no
    more need for the flags.

commit 6228bb0012572d4cd44cd1a1237cf236607c8c04
Author: Werner Koch <wk@gnupg.org>
Date:   Mon Apr 22 08:04:27 2024 +0200

    tests: Avoid new C23 keyword true.
    
    * tests/asschk.c (eval_boolean): s/true/tru/
    --
    
    GnuPG-bug-is: 7093

commit 7ed15f7548b401cd1c32fdc2ae5d0460c60ae41e
Author: Werner Koch <wk@gnupg.org>
Date:   Tue Apr 16 11:45:35 2024 +0200

    Post release updates
    
    --