2021-06-10  Werner Koch  <wk@gnupg.org>

	Release 2.2.28.
	+ commit 9f6076868ecd313e832c112ea79cfcffed3dc342


	gpg: Partial fix for Unicode problem in output files.
	+ commit 845711d1420cc01289c15ba49deb03200a5cd102
	* g10/openfile.c (overwrite_filep): Use gnupg_access.

	scd: Fix serial number detection for Yubikey 5.
	+ commit c2f02797cdefdce5afd8b29bb8e51d4515a70a96
	* scd/app.c (app_new_register): Handle serial number correctly.

2021-06-09  Werner Koch  <wk@gnupg.org>

	gpgtar,w32: Fix file size computation.
	+ commit 198b240b195596974e8b61e2b79fb6e8dc78f89a
	* tools/gpgtar-create.c (fillup_entry_w32): Move parentheses.

	sm: New option --ldapserver as an alias for --keyserver.
	+ commit d6df1bf84969bf5f5781e33bc1c2f6cb2aee0093
	* sm/gpgsm.c (opts): Add option --ldapserver and make --keyserver an
	alias.

	dirmngr: Allow to pass no filter args to dirmngr_ldap.
	+ commit f6e45671aa26f3e7abb968a876de7bbdb4fca3f1
	* dirmngr/dirmngr_ldap.c (main): Handle no args case.

2021-06-08  Werner Koch  <wk@gnupg.org>

	w32: Change spawn functions to use Unicode version of CreateProcess.
	+ commit 7a98e45e74ec2883c24689964d6119796da0969f
	* common/exechelp-w32.c (gnupg_spawn_process): Change to use
	CreateProcessW.
	(gnupg_spawn_process_fd): Ditto.
	(gnupg_spawn_process_detached): Ditto.
	* g10/exec.c (w32_system): Ditto.

2021-06-08  Andre Heinecke  <aheinecke@gnupg.org>

	common,w32: Breakaway detached childs when in job.
	+ commit f20e9a464487443552b6cbdf918c6448d3cb643f
	* common/exechelp-w32.c (gnupg_spawn_process_detached): Add
	CREATE_BREAKAWAY_FROM_JOB creation flag if required.

2021-06-08  Werner Koch  <wk@gnupg.org>

	w32: Always use Unicode for console input and output.
	+ commit b912f07cdf00043b97fca54e4113fab277726e03
	* common/init.c (_init_common_subsystems) [W32]: Set the codepage to
	UTF-8 for input and putput.  Switch gettext to UTF-8.
	* g10/gpg.c (utf8_strings) [W32]: Make sure this is always set.

	w32: Free memory allocated by new function w32_write_console.
	+ commit ebdb62a98a6e917bafb795b5f50483a95790e739
	* common/ttyio.c (w32_write_console): Free buffer.

	common,w32: Allow Unicode input and output with the console.
	+ commit 90aadf69f730ff1bd053abcd6cc8bc67518ecf4b
	* common/ttyio.c (do_get) [W32]: Use ReadConsoleW.
	(w32_write_console): New.
	(tty_printf, tty_fprintf) [W32]: Use new function.

	common: Re-indent ttyio.c and remove EMX, RISCOS, and CE support.
	+ commit 521e176a605e6b6229825761906005b05608daf5
	* common/ttyio.c: Remove cruft like EMX and RISCOS support.  Translate
	a few strings.  Re-indent.

	common: Rename w32-misc.c to w32-cmdline.c.
	+ commit d7d9a5ba3cbf9cf7e22a8871474032b525825eed
	* common/w32-misc.c: Rename to ....
	* common/w32-cmdline.c: this.
	* common/Makefile.am: Adjust.

	common,w32: Implement globing of command line args.
	+ commit 09f49b4c9aae46c40a189b1270e215bc978dbc3c
	* common/w32-misc.c [W32]: Include windows.h
	(struct add_arg_s): New.
	(add_arg): New.
	(glob_arg): New.
	(parse_cmdstring): Add arg argvflags and set it.
	(w32_parse_commandline): Add arg r_itemsalloced.  Add globing.

	* common/init.c (prepare_w32_commandline): Mark glob created items as
	leaked.

	* common/t-w32-cmdline.c : Include windows.h
	(test_all): Add simple glob test for Unix.
	(main): Add manual test mode for Windows.

	* common/xasprintf.c (xtryreallocarray): New.

	common,w32: Refine the command line parsing for \ in quotes.
	+ commit 4d6807b215e7541fd52caf7e4adc40d77670f99f
	* common/t-w32-cmdline.c (test_all): Add new test cases.
	* common/w32-misc.c (strip_one_arg): Add arg endquote.
	(parse_cmdstring): Take care of backslashes in quotes.

	common: First take on handling Unicode command line args.
	+ commit 90ddd1cf13cd6bb88d5bb8c1846d7297ca8ac81c
	* common/w32-misc.c: New.
	* common/t-w32-cmdline.c: New.
	* common/init.c: Include w32help.h.
	(prepare_w32_commandline): New.
	(_init_common_subsystems) [W32]: Call prepare_w32_commandline.

	* common/Makefile.am (common_sources) [W32]: Add w32-misc.c
	(module_tests): Add t-w32-cmdline
	(t_w32_cmdline_LDADD): New.

	gpg: Prepare for globing with UTF-8.
	+ commit 1f59c4c8e2cfa2b111f0798212546864668383f9
	* g10/gpg.c (_dowildcard): Remove.
	(my_strusage): Enable wildcards using our new system.

	dirmngr: Rewrite the LDAP wrapper tool.
	+ commit 39815c023f0371dea01f7c51469b19c06ad18718
	* dirmngr/ldap-misc.c: New.
	* dirmngr/ldap-misc.h: New.
	* dirmngr/ks-engine-ldap.c: Include ldap-misc.h.
	(ldap_err_to_gpg_err, ldap_to_gpg_err): Move to ldap-misc.c.
	* dirmngr/ldap-wrapper.c (ldap_wrapper): Print list of args in debug
	mode.
	* dirmngr/server.c (lookup_cert_by_pattern): Handle GPG_ERR_NOT_FOUND
	the saqme as GPG_ERR_NO_DATA.
	* dirmngr/ldap.c (run_ldap_wrapper): Add args tls_mode and ntds.
	Remove arg url.  Adjust for changes in dirmngr_ldap.
	(url_fetch_ldap): Remove args host and port.  Parse the URL and use
	these values to call run_ldap_wrapper.
	(attr_fetch_ldap): Pass tls flags to run_ldap_wrapper.
	(rfc2254_need_escape, rfc2254_escape): New.
	(extfilt_need_escape, extfilt_escape): New.
	(parse_one_pattern): Rename to ...
	(make_one_filter): this.  Change for new dirmngr_ldap calling
	convention.  Make issuer DN searching partly work.
	(escape4url, make_url): Remove.
	(start_cert_fetch_ldap): Change for new dirmngr_ldap calling
	convention.
	* dirmngr/dirmngr_ldap.c: Major rewrite.

	* dirmngr/t-ldap-misc.c: New.
	* dirmngr/t-support.h (DIM, DIMof): New.
	* dirmngr/Makefile.am (dirmngr_ldap_SOURCES): Add ldap-misc.c
	(module_tests) [USE_LDAP]: Add t-ldap-misc.
	(t_ldap_parse_uri_SOURCES): Ditto.
	(t_ldap_misc_SOURCES): New.

2021-06-08  NIIBE Yutaka  <gniibe@fsij.org>

	agent: Appropriate error code for importing key with no passwd.
	+ commit 2f98d8a0f92dc991bff406e159690a111202fcb4
	* agent/cvt-openpgp.c (convert_from_openpgp_main): Return
	GPG_ERR_BAD_SECKEY.

2021-06-04  Werner Koch  <wk@gnupg.org>

	dirmngr: Remove useless code.
	+ commit 8bd5172539e1399b407aa2a9d56fa51b8e040ae3
	* dirmngr/ks-engine-ldap.c (my_ldap_connect): Remove the
	password_param thing because we set the password directly without an
	intermediate var.

2021-06-02  Werner Koch  <wk@gnupg.org>

	sm: Support AES-GCM decryption.
	+ commit b722fd755c77cbba12478f6de8913c73213d78ee
	* sm/gpgsm.c (main): Use gpgrt_fcancel on decryption error if gpgrt
	supports this.
	* sm/decrypt.c (decrypt_gcm_filter): New.
	(gpgsm_decrypt): Use this filter if requested.  Check authtag.
	* common/compliance.c (gnupg_cipher_is_allowed): Allow GCM for gpgsm
	in consumer (decrypt) de-vs mode.

2021-05-28  Werner Koch  <wk@gnupg.org>

	gpgconf: Make runtime changes with different homedir work.
	+ commit c8f0b02936c73b6ef3c99a1bea9ae63f74da0768
	* tools/gpgconf-comp.c (dirmngr_runtime_change): Pass --homedir
	first.  Remove unused variable.

	dirmngr: Fix default port for our redefinition of ldaps.
	+ commit 8de9d54ac83fa20cb52b847b643311841be4d6dc
	* dirmngr/server.c (make_keyserver_item): Fix default port for ldaps.
	Move a tmpstr out of the blocks.
	* dirmngr/ks-engine-ldap.c (my_ldap_connect): Improve diagnostics.

2021-05-27  NIIBE Yutaka  <gniibe@fsij.org>

	build: _DARWIN_C_SOURCE should be 1.
	+ commit 40b2890b4349781ddb0330193aed0286b1d23dad
	* configure.ac (*-apple-darwin*): Set _DARWIN_C_SOURCE 1.

2021-05-26  Werner Koch  <wk@gnupg.org>

	dirmngr: Use --ldaptimeout for OpenPGP LDAP keyservers.
	+ commit 317d5947b84ae2707e46b89fb0d8318c07174e13
	* dirmngr/ks-engine-ldap.c (my_ldap_connect): Use LDAP_OPT_TIMEOUT.

	* dirmngr/dirmngr.c (main): Move --ldaptimeout setting to ...
	(parse_rereadable_options): here.

	dirmngr: New option --ldapserver.
	+ commit ff17aee5d10c8c5ab902253fb4332001c3fc3701
	* dirmngr/dirmngr.c (opts): Add option --ldapserver.
	(ldapserver_list_needs_reset): New var.
	(parse_rereadable_options): Implement option.
	(main): Ignore dirmngr_ldapservers.conf if no --ldapserver is used.

	* dirmngr/server.c (cmd_ldapserver): Add option --clear and list
	configured servers if none are given.

	dirmngr: Allow for non-URL specified ldap keyservers.
	+ commit 2b4cddf9086faaf5b35f64a7db97a5ce8804c05b
	* dirmngr/server.c (cmd_ldapserver): Strip an optional prefix.
	(make_keyserver_item): Handle non-URL ldap specs.
	* dirmngr/dirmngr.h (struct ldap_server_s): Add fields starttls,
	ldap_over_tls, and ntds.

	* dirmngr/ldapserver.c (ldapserver_parse_one): Add for an empty host
	string.  Improve error messages for the non-file case.  Support flags.
	* dirmngr/ks-action.c (ks_action_help): Handle non-URL ldap specs.
	(ks_action_search, ks_action_get, ks_action_put): Ditto.
	* dirmngr/ks-engine-ldap.c: Include ldapserver.h.
	(ks_ldap_help): Handle non-URL ldap specs.
	(my_ldap_connect): Add args r_host and r_use_tls.  Rewrite to support
	URLs and non-URL specified keyservers.
	(ks_ldap_get): Adjust for changes in my_ldap_connect.
	(ks_ldap_search): Ditto.
	(ks_ldap_put): Ditto.

	gpg,sm: Simplify keyserver spec parsing.
	+ commit 9f586700ec4ceac97fd47cd799878a8847342ffa
	* common/keyserver.h: Remove.
	* sm/gpgsm.h (struct keyserver_spec): Remove.
	(opt): Change keyserver to a strlist_t.
	* sm/gpgsm.c (keyserver_list_free): Remove.
	(parse_keyserver_line): Remove.
	(main): Store keyserver in an strlist.
	* sm/call-dirmngr.c (prepare_dirmngr): Adjust for the strlist.  Avoid
	an ambiguity in dirmngr by adding a prefix if needed.

	* g10/options.h (struct keyserver_spec): Move definition from
	keyserver.h to here.  Remove most fields.
	* g10/keyserver.c (free_keyserver_spec): Adjust.
	(cmp_keyserver_spec): Adjust.
	(parse_keyserver_uri): Simplify.
	(keyidlist): Remove fakev3 arg which does not make any sense because
	we don't even support v3 keys.

	dirmngr: Support pseudo URI scheme "opaque".
	+ commit 72124fadafde153f8ac89a70202006d831829d06
	* dirmngr/http.h (HTTP_PARSE_NO_SCHEME_CHECK): New.
	* dirmngr/http.c (http_parse_uri): Use this flag.  Change all callers
	to use the new macro for better readability.
	(do_parse_uri): Add pseudo scheme "opaque".
	(uri_query_value): New.

2021-05-21  NIIBE Yutaka  <gniibe@fsij.org>

	scd: Release memory for RDRNAME.
	+ commit 5be0d075b1ad03a46a6169bf16cd3ee6102e1358
	* scd/apdu.c (apdu_close_reader): Free RDRNAME field.

2021-05-20  Jakub Jelen  <jjelen@redhat.com>

	scd: avoid memory leaks.
	+ commit 678e1b20d3531e642fa8871ea56c6c7d5c208fbe
	* scd/app-p15.c (send_certinfo): free labelbuf
	  (do_sign): goto leave instead of return
	* scd/command.c (cmd_genkey): goto leave instead of return

	common: Avoid double-free.
	+ commit 4dc4b025d6dd194a96b11ccfd64d763d2c902a91
	* common/name-value.c (do_nvc_parse): reset to null after ownership
	change

2021-05-19  Ineiev  <ineiev@gnu.org>

	po: Update Russian translation.
	+ commit 17b7048732e265450323cc3e01a48c9d492edf0c


2021-05-19  Werner Koch  <wk@gnupg.org>

	dirmngr: For KS_SEARCH return the fingerprint also with LDAP.
	+ commit f0e538619d5079fcd87c31e853e6deb28564a321
	* dirmngr/ks-engine-ldap.c (extract_keys): Return the fingerprint if
	available.
	(ks_ldap_search): Ditto.
	(extract_keys): Make sure to free the ldap values also in corner
	cases.
	(my_ldap_value_free): New.
	(ks_ldap_get): Ditto.
	(ks_ldap_search): Ditto.
	(my_ldap_connect): Ditto.

2021-05-18  Werner Koch  <wk@gnupg.org>

	gpg: Fix sending an OpenPGP key with umlaut to an LDAP keyserver.
	+ commit 7bf8530e75d05a712d00a333d59b0a8cf663b9cb
	* g10/call-dirmngr.c (record_output): Rewrite.

2021-05-18  Ingo Klöcker  <dev@ingo-kloecker.de>

	scd:p15: Fix logic for appending product name to MANUFACTURER.
	+ commit aa6288140481bccc366e87fcdc6781dc82d0af31
	* scd/app-p15.c (do_getattr): Append product name to MANUFACTURER if
	manufacturer_id does not already contain a bracket and if we have a
	product name.

2021-05-17  Werner Koch  <wk@gnupg.org>

	gpg: Use a more descriptive prompt for symmetric decryption.
	+ commit 03f83bcda5d1f8d8246bcc1afc603b7f74d0626b
	* g10/keydb.h (GETPASSWORD_FLAG_SYMDECRYPT): New.
	(passphrase_to_dek_ext): Remove this obsolete prototype.
	* g10/passphrase.c (passphrase_get): Add arg flags.  Use new flag
	value.
	(passphrase_to_dek): Add arg flags and pass it on.
	* g10/mainproc.c (proc_symkey_enc): Use new flag.

	sm: Ask for the password for password based decryption (pwri)
	+ commit 50ea1b67e8260aaebbeba0c4cd73e21443a74636
	* sm/decrypt.c (pwri_decrypt): Add arg ctrl.  Ask for passphrase.

	* sm/export.c (export_p12): Mark string as translatable.
	* sm/import.c (parse_p12): Ditto.

	sm: Support decryption of password based encryption (pwri)
	+ commit 6f31acac767f2ec67729c0491f29061b26fe14b9
	* sm/decrypt.c (string_from_gcry_buffer): New.
	(pwri_parse_pbkdf2): New.
	(pwri_decrypt): New.
	(prepare_decryption): Support pwri.
	(gpgsm_decrypt): Test for PWRI.  Move IS_DE_VS flag to DFPARM.

	* common/sexputil.c (cipher_mode_to_string): New.

	dirmngr: LDAP search by a mailbox now ignores revoked keys.
	+ commit b6f8cd7eef4b00a2c6ccaac743382f1dd83bde6a
	* dirmngr/ks-engine-ldap.c (keyspec_to_ldap_filter): Ignore revoked
	and disable keys in mail mode.

2021-05-07  NIIBE Yutaka  <gniibe@fsij.org>

	scd,pcsc: Use a single context.
	+ commit 987b8168602286d06debbbc8d4deebd35f454e29
	* scd/apdu.c (pcsc): New variable.
	(struct reader_table_s): Remove pcsc.context from member.
	(pcsc_get_status, connect_pcsc_card): Use pcsc.context.
	(close_pcsc_reader): Release pcsc.context here with reference count.
	(apdu_open_one_reader): Move API loading to ...
	(pcsc_init): new.
	(apdu_open_one_reader): Remove.
	(apdu_open_reader): Call open_pcsc_reader instead of
	apdu_open_one_reader.
	(open_pcsc_reader): Call pcsc_init if needed.  Call close_pcsc_reader
	instead of pcsc_release_context.  Make reader parsing more robust.
	(apdu_init): Initialize pcsc.count and pcsc.context.

2021-05-04  Werner Koch  <wk@gnupg.org>

	gpg: Allow ECDH with a smartcard returning just the x-coordinate.
	+ commit b203325ce112c223a5164081cecd14744a01ff69
	* g10/ecdh.c (pk_ecdh_encrypt_with_shared_point): Factor extraction
	part out to  ...
	(extract_secret_x): new.  Allow for x-only coordinate.
	(pk_ecdh_encrypt_with_shared_point): Change arg shared_mpi
	to (shared,nshared).  Move param check to the top.  Add extra safety
	check.
	(pk_ecdh_decrypt): Adjust for change.
	* g10/pkglue.c (get_data_from_sexp): New.
	(pk_encrypt): Use it for "s" and adjusted for changed
	pk_ecdh_encrypt_with_shared_point.
	* g10/pubkey-enc.c (get_it): Remove conversion to an MPI and call
	pk_ecdh_decrypt with the frame buffer.

	scd: Fix possible PC/SC removed card problem.
	+ commit 9d83bfb639680d3bc756fcfe2b7f83b18bed8dff
	* scd/apdu.c (pcsc_cancel): New.
	(pcsc_init): Load new function.
	(connect_pcsc_card): Use it after a removed card error.

	scd: Add string for another PC/SC error code.
	+ commit a475bb725be7e275a06e0625b0088f607f36634c
	* scd/apdu.c (PCSC_E_NO_READERS_AVAILABLE): New.
	(pcsc_error_string): Add a description for this.
	* scd/scdaemon.c (scd_kick_the_loop): Fix diagnostic.

2021-05-04  Kirill Elagin  <kirelagin@gmail.com>

	scd: Fix unblock PIN by a Reset Code with KDF.
	+ commit 6c4216094ef4771d1d5011b7aee35f241e3bcc4d
	* scd/app-openpgp.c (do_change_pin): Use correct CHVNO=1 for
	pin2hash_if_kdf, for user's PIN.

2021-05-04  Werner Koch  <wk@gnupg.org>

	gpg: Fix mailbox based search via AKL keyserver method.
	+ commit 22fe23f46d3179cb0a68f58bf6f722b89c0c4d9c
	* g10/keyserver.c (keyserver_import_name): Rename to ...
	(keyserver_import_mbox): this.  And use mail search mode.
	* g10/getkey.c (get_pubkey_byname): Change the two callers.

	gpg: Auto import keys specified with --trusted-keys.
	+ commit e7251be84c797ddbc3f0a5212886761666e3aa33
	* g10/getkey.c (get_pubkey_with_ldap_fallback): New.
	* g10/trustdb.c (verify_own_keys): Use it.

	(cherry picked from commit 100037ac0f558e8959fc065d4703c85c2962489e)

	gpg: Allow decryption w/o public key but with correct card inserted.
	+ commit e53f6037283e1a4f18b1c5d66d2678888c701cea
	* agent/command.c (cmd_readkey): Add option --no-data and special
	handling for $SIGNKEYID and $AUTHKEYID.
	* g10/call-agent.c (agent_scd_getattr): Create shadow keys for KEY-FPR
	output.
	* g10/skclist.c (enum_secret_keys): Automagically get a missing public
	key for the current card.

	agent: Silence error messages for READKEY --card.
	+ commit aa612d752ebb1851f23184df084aed5314b72e3a
	* agent/command.c (cmd_readkey): Test for shadow key before creating
	it.

	(cherry picked from commit 8f2c9cb73538baab7da8107f2cceb2f6fc49642a)

2021-05-03  Werner Koch  <wk@gnupg.org>

	gpg: Allow fingerprint based lookup with --locate-external-key.
	+ commit 2af217ecd7e4242be2b35bc0085eccaf13cc2027
	* g10/keyserver.c (keyserver_import_fprint_ntds): New.
	* g10/getkey.c (get_pubkey_byname): Detect an attempt to search by
	fingerprint in no_local mode.

	gpg: Lookup a missing public key of the current card via LDAP.
	+ commit b59af0e2a05a3714b0bcbe7e775c6ffacfbc7119
	* g10/getkey.c (get_seckey_default_or_card): Lookup a missing public
	key from the current card via LDAP.
	* g10/call-dirmngr.c: Include keyserver-intetnal.h.
	(gpg_dirmngr_ks_get): Rename arg quick into flags.  Take care of the
	new LDAP flag.
	* g10/keyserver-internal.h (KEYSERVER_IMPORT_FLAG_QUICK): New.
	Replace the use of the value 1 for the former quick arg.
	(KEYSERVER_IMPORT_FLAG_LDAP): New.
	* g10/keyserver.c (keyserver_get_chunk): Increase the reserved line
	length.
	* dirmngr/ks-action.c (ks_action_get): Add arg ldap_only.
	* dirmngr/server.c (cmd_ks_get): Add option --ldap.

	scd: Add option --info to emit KEYPAIRINFO by readkey command.
	+ commit b8df8321e1ef38147f42af1166d2c60805f88b9c
	* scd/command.c (do_readkey): Implement this.
	* scd/app-help.c (app_help_get_keygrip_string_pk): Make HEXKEYGRIP
	parm optional.  Add arg R_ALGOSTR.

2021-05-03  NIIBE Yutaka  <gniibe@fsij.org>

	common: Fix gnupg_wait_processes, by skipping invalid PID.
	+ commit c2ba6bea4ce81a066765c285c4b7c1dc6d39f144
	* common/exechelp-posix.c (gnupg_wait_processes): Skip invalid PID.

2021-05-03  Werner Koch  <wk@gnupg.org>

	agent: Skip unknown unknown ssh curves seen on cards.
	+ commit bbf4bd3bfcb51e9d91e08ceefba3ff016bae50ff
	* agent/command-ssh.c (ssh_handler_request_identities): Skip unknown
	curves.

2021-04-29  Werner Koch  <wk@gnupg.org>

	gpgconf: Do not i18n an empty string to the PO files meta data.
	+ commit a456303ae306fbfda0cf89ff41678d50c24bf6fc
	* tools/gpgconf-comp.c (my_dgettext): Ignore empty strings.

	scd: New option --pcsc-shared.
	+ commit 5eec40f3d82777b4fb807a9bf1b71422a8caa2f9
	* scd/scdaemon.h (opt): Add field opcsc_shared.
	* scd/scdaemon.c (opcscShared): New.
	(opts): Add "--pcsc-shared".
	(main): Set flag.
	* scd/apdu.c (connect_pcsc_card): Use it.
	(pcsc_get_status): Take flag in account.
	* scd/app-openpgp.c (verify_chv2): Do not auto verify chv1 in shared
	mode.

	scd: Rewrite READKEY to allow for compressed points.
	+ commit 96577e2e46e4c5b66a2685cb605e07be0a6a09a5
	* scd/app-help.c (app_help_pubkey_from_cert): New.  Taken from 2.3.
	* scd/command.c (cmd_readkey): Rewrite using new helper.

	common: Extend the openpgp_curve_to_oid function.
	+ commit 5b8593135fa6e88ecc459444ec19b9a824f12a15
	* common/openpgp-oid.c (openpgp_curve_to_oid): Add optional arg R_NBITS.
	Change all callers.

	common: New module to compute openpgp fingerprints.
	+ commit f3c98b8cb5adcac17043fa6066b73bd08c8ef41a
	* common/openpgp-fpr.c: New.
	* common/Makefile.am (common_sources): Add it.

	common: New function to uncompress an ECC public key.
	+ commit c825117c5fa562fced0d3cafc22fd878cf615b42
	* common/sexputil.c (ec2os): New.
	(uncompress_ecc_q_in_canon_sexp): New.

	* common/t-sexputil.c (fail2): new.
	(test_ecc_uncompress): New.
	(main): Run new test.

	common: New function cmp_canon_sexp.
	+ commit 473e649ea1a69e82b7f99a17fbff4d641936c61c
	* common/sexputil.c (cmp_canon_sexp): New.
	(cmp_canon_sexp_def_tcmp): New.
	* common/t-sexputil.c (test_cmp_canon_sexp): Add a simple test.

	scd: New function send_keyinfo to assist in backporting.
	+ commit 0eed0ced9bcd3c14621076d26cf4d9f809e1873c
	* scd/command.c (send_keyinfo): New.

	scd: Minor changes to assist in backporting from 2.3.
	+ commit 3db99b8861a7544efee13be45d14bbac63c0c868
	* scd/command.c (send_status_direct): Return an error code.
	* scd/app-common.h (APP_LEARN_FLAG_REREAD): New.

	scd: Extend an internal function to also return the algo.
	+ commit 72a7d45a230bf28e2ba7e8a57b702c98998ea0a3
	* scd/app-help.c (app_help_get_keygrip_string_pk): Add optional arg
	r_algo.  Change all callers.
	(app_help_get_keygrip_string): Ditto.

	scd: New function for iso7816 PSO_CSV.
	+ commit 91dd74f3d7e3630bb7f298fe4d392f8a6cef9acb
	* scd/iso7816.c (iso7816_pso_csv): New.

	scd: Extend iso7816_select_path.
	+ commit 855d14d390e8dd8464f2f38187dbccb19a13e815
	* scd/iso7816.c (iso7816_select_path): Add arg top_fd.
	* scd/app-nks.c (do_readkey): Adjust for this change
	(select_ef_by_path: Ditto.

	* common/tlv.h: Include membuf.h.

	scd: Add new status codes.
	+ commit 3ce69d8387925d444d529ce0bb5beed9e880aad7
	* scd/apdu.h (SW_SM_NOT_SUP, SW_CC_NOT_SUP, SW_FILE_STRUCT)
	(SW_NO_CURRENT_EF): New.
	* scd/apdu.c (apdu_strerror): Map them to strings.
	* scd/iso7816.c (map_sw): ... and to gpg-error.

	scd: Extend ISO binary and record reading functions.
	+ commit ec9e8e0d6a1fe47dbf42652c4246e1c34fdf0288
	* scd/iso7816.c (iso7816_read_binary_ext): Add optional arg r_sw and
	change callers.
	(iso7816_read_record): Factor all code out to ...
	(iso7816_read_record_ext): New.

2021-04-13  Werner Koch  <wk@gnupg.org>

	gpg: Do not use self-sigs-only for LDAP keyserver imports.
	+ commit 1303b0ed84da57b48d88343ab43f83546e508aba
	* dirmngr/ks-engine-ldap.c (ks_ldap_get): Print a SOURCE status.
	* g10/options.h (opts): New field expl_import_self_sigs_only.
	* g10/import.c (parse_import_options): Set it.
	* g10/keyserver.c (keyserver_get_chunk): Add special options for LDAP.

2021-04-08  NIIBE Yutaka  <gniibe@fsij.org>

	scd: Fix CCID driver for SCM SPR332/SPR532.
	+ commit f8ae51977ce4079d638d1ae2f3dd1da41c02a6d7
	* scd/ccid-driver.c (ccid_vendor_specific_pinpad_setup): New.
	(ccid_vendor_specific_setup): Only send CLEAR_HALT.
	(ccid_transceive_secure): Each time, use send_escape_cmd.

2021-04-06  Werner Koch  <wk@gnupg.org>

	gpg: Fix new pseudo option compliance_de_vs.
	+ commit 18551c6dc2c33f856d05053b27a1210c4c607cef
	* g10/gpg.c (gpgconf_list): Take opt.compliance also in account.

2021-04-01  Werner Koch  <wk@gnupg.org>

	common: Make the compliance check more robust.
	+ commit 8ef0f53cb0014026d0d58b8de2133310d96bc1e3
	* common/compliance.c (get_compliance_cache): New.
	(gnupg_rng_is_compliant): Use per mode cache.
	(gnupg_gcrypt_is_compliant): Ditto.

	gpgconf: Return a new pseudo option compliance_de_vs.
	+ commit 9feffc03f36499162342609897484b4b32fd53a7
	* tools/gpgconf-comp.c (gc_options_gpg): Add "compliance_de_vs".
	* g10/gpg.c (gpgconf_list): Return that pseudo option.

2021-03-26  Werner Koch  <wk@gnupg.org>
	    cbiedl@gnupg.com

	gpgconf: Fix argv overflow if --homedir is used.
	+ commit a50093893cd100c74a32cbacc749aab582154625
	* tools/gpgconf-comp.c (gc_component_launch): Fix crash due to too
	small array.

2021-03-11  Werner Koch  <wk@gnupg.org>

	gpg: New option --force-sign-key.
	+ commit 87d7b7e07565bdba9e9e8b8698f7094046d4f762
	* g10/gpg.c (oForceSignKey,opts): New option "--force-sign-key".
	(main): Set it.
	* g10/options.h (opt): New flag flags.force_sign_key.
	* g10/keyedit.c (sign_uids): Use new flag.

2021-03-02  Werner Koch  <wk@gnupg.org>

	sm: Do away with the locked flag in keydb.c.
	+ commit f3e68e39da7609f594572833528a0f2b9c20bf2d
	* sm/keydb.c (struct keydb_handle): Remove field locked.
	(keydb_lock): Remove use of locked flag.
	(lock_all): Ditto.
	(unlock_all): Ditto.
	(keydb_set_flags): Use dotlock_is_locked instead of the locked flag.
	(keydb_insert_cert): Ditto.
	(keydb_delete): Ditto.
	(keydb_search): s/keydb_lock/lock_all/.
	(keydb_set_cert_flags): Ditto.
	(keydb_clear_some_cert_flags): Ditto.

	* sm/keydb.c (maybe_create_keybox): s/access/gnupg_access/.

	common: New function dotlock_is_locked.
	+ commit 67b82a9c607e1488972a85a30015f48c68245af0
	* common/dotlock.c (dotlock_is_locked): New.
	(dotlock_take): Set locked flag also in disabled mode.  No more
	warning if the lock has already been taken.
	(dotlock_release): Clear locked flag also in disabled mode.  No more
	warning if the lock has not been taken.

	sm: Lock kbx files also before a search.
	+ commit 677245ba0e7d6c0bc85ac998f47e3f220b736840
	* sm/keydb.c (keydb_search): Lock files.

	sm: On Windows close the kbx files at several places.
	+ commit 2b9ae79ad81a0d3eff011fabe6629e371cd7c5b4
	* kbx/keybox-search.c (keybox_search_reset) [W32]: Always close.

	* kbx/keybox-init.c (keybox_close_all_files): New.
	* sm/keydb.c (keydb_close_all_files): New.
	* sm/call-dirmngr.c (gpgsm_dirmngr_isvalid): Call new function.
	(gpgsm_dirmngr_lookup): Ditto.
	(gpgsm_dirmngr_run_command): Ditto.

	sm: Remove unused function.
	+ commit c99f3599d80d351dda1400314b43ea8ccdcc7b7d
	* sm/keydb.c (keydb_insert_cert): Remove.
	* kbx/keybox-update.c (keybox_update_cert): Remove stub.

2021-03-01  Nicolas Fella via Gnupg-devel  <gnupg-devel@gnupg.org>

	gpg: Keep temp files when opening images via xdg-open.
	+ commit 0441ed6e1c1d7eac81bfbec6ce51f319d9d20eb7
	* g10/photoid.c (get_default_photo_command): Change parameter for
	xdg-open.

2021-03-01  Werner Koch  <wk@gnupg.org>

	sm: Silence some other pkcs#12 import prattle.
	+ commit e5af401fc4c3294de9a4f10630b200185329230b
	* sm/minip12.c (parse_bag_data): Print a regular log_info only in
	verbose mode.

2021-02-24  Werner Koch  <wk@gnupg.org>

	sm: Silence some output on --quiet.
	+ commit bcdbf0fcf3c1c210504cbed53f524704747deaaa
	* sm/encrypt.c (gpgsm_encrypt): Take care of --quiet.
	* sm/gpgsm.c: Include minip12.h.
	(set_debug): Call p12_set_verbosity.
	* sm/import.c (parse_p12): Dump keygrip only in debug mode.
	* sm/minip12.c (opt_verbose, p12_set_verbosity): New.
	(parse_bag_encrypted_data): Print info messages only in verbose mode.

2021-02-19  Werner Koch  <wk@gnupg.org>

	scd: Change parameters of readkey fucntion pointer.
	+ commit 41979ed7308ef3ab1c877d3f110ce9b61eb17bec
	* scd/app-common.h (APP_READKEY_FLAG_ADVANCED): New.
	(struct app_ctx_s): Replace param advanced by flags in readkey.
	Change all users.

	scd: Pass ctrl parameter to more app functions.
	+ commit 669786cf646d8636de85a3cb8b3aa83ba709d207
	* scd/app-common.h (struct app_ctx_s): Add parameter ctrl to function
	pointers for readkey, setattr, sign, auth, decipher, and check_pin.

	scd: Detect Yubikey and provide nicer display-s/n.
	+ commit f8588369bcb0e66118725793b53e871ce2acb10d
	* scd/app-common.h (struct app_ctx_s): Rename unused field
	card_version to cardversion.
	* scd/app.c (app_new_register): Add code rom 2.3 to detect the Yubikey
	and set cardversion.
	(app_get_dispserialno): New.
	* scd/app-openpgp.c (do_getattr): Use app_get_dispserialno.

	scd: Change the apptype from a string to an enum.
	+ commit 43b3ec5aee40172890c077485e438d2d4994d81d
	* scd/app-common.h (cardtype_t): New.
	(apptype_t): New.
	(struct app_ctx_s): Change type of field apptype.  Add fields
	appversion and cardtype.  Adjust all app-*.c for the new type.
	* scd/app.c (supported_app_list): New.
	(strapptype): New.
	(apptype_from_name): New.
	(app_dump_state): Use strapptype.
	(app_write_learn_status): Ditto.
	(app_getattr): Ditto.
	(check_conflict): Use apptype_from_name and integer comparison.
	* scd/app-openpgp.c: Replace app->card_version by app->appversion.

	scd: Add some compatibility code for easier backporting.
	+ commit 6380126b31aacb2e8ad3aae4866d4d384186bf97
	* scd/app-common.h (APP_WRITEKEY_FLAG_FORCE): New.
	(APP_READKEY_FLAG_INFO): New.
	(APP_LEARN_FLAG_KEYPAIRINFO): New.
	(APP_LEARN_FLAG_MULTI): New.
	(struct app_ctx_s): New forward declaration.
	(struct app_ctx_s): Add members prep_reselect, reselect, and
	with_keygrip.
	(KEYGRIP_ACTION_SEND_DATA): New.
	(KEYGRIP_ACTION_WRITE_STATUS): New.
	(KEYGRIP_ACTION_LOOKUP): New.
	(APP_CARD): New macro.
	* scd/scdaemon.h: Include app-common.h and remove from all other
	files.
	(app_t): Move typedef to ...
	* scd/app-common.h: here.

2021-02-17  Werner Koch  <wk@gnupg.org>

	dirmngr: Support new gpgNtds parameter in LDAP keyserver URLs.
	+ commit 55f46b33df08e8e0ea520ade5f73b321bc01d705
	* dirmngr/ldap-parse-uri.c (ldap_parse_uri): Support a new gpgNtds
	extension.
	* dirmngr/ks-engine-ldap.c (my_ldap_connect): Do ldap_init always with
	hostname - which is NULL and thus the same if not given.  Fix minor
	error in error code handling.

	dirmngr: Rewrite a weird function by straighter code.
	+ commit cdc828f6902667196eb3870f9287045afe7144d5
	* dirmngr/ldap-parse-uri.c (ldap_uri_p): Use ascii-memcasecmp.

2021-01-28  Werner Koch  <wk@gnupg.org>

	Include the library version in the compliance checks.
	+ commit 6e258babe7ccc52a7fb621339c2e2fc5f0f23bc9
	* common/compliance.c (gnupg_gcrypt_is_compliant): New.
	(gnupg_rng_is_compliant): Also check library version.
	* g10/mainproc.c (proc_encrypted): Use new function.
	(check_sig_and_print): Ditto.
	* sm/decrypt.c (gpgsm_decrypt): Ditto.
	* sm/encrypt.c (gpgsm_encrypt): Ditto.
	* sm/verify.c (gpgsm_verify): Ditto

2021-01-27  Werner Koch  <wk@gnupg.org>

	gpg: Fix ugly error message for an unknown symkey algorithm.
	+ commit 9037be5f40da409a7734a2672e64345472f294fc
	* g10/mainproc.c (proc_symkey_enc): Do not continue with an unknown
	algorithm.

2021-01-11  Werner Koch  <wk@gnupg.org>

	Release 2.2.27.
	+ commit 0c103cde00098bdf1cec8f27e764300d192210e4


	gpg,w32: Fix gnupg_remove.
	+ commit 3901c1a8c59a436ea4509d5aaebbecc5a0268391
	* common/sysutils.c (map_w32_to_errno): New.
	(gnupg_w32_set_errno): New.
	(gnupg_remove) [w32]: Set ERRNO

2021-01-08  Werner Koch  <wk@gnupg.org>

	gpg: Fix --gpgconf-list case with no conf files at all.
	+ commit 9f37d3e6f307a9460c0a356afa1f8b991c527d6c
	* g10/gpg.c (get_default_configname): Remove unused function.
	(main): Provide a proper filename to gpgconf_list.

2021-01-07  Werner Koch  <wk@gnupg.org>

	gpgconf: Fix description of two new options.
	+ commit ff30fcd3dc78c00ed87ce6bd3414b828bdf51e84
	* tools/gpgconf-comp.c: Fix auto-key-import and include-key-block.

2020-12-30  Werner Koch  <wk@gnupg.org>

	wkd: Minor permission fix for created files.
	+ commit fdc54850263b2b888398f95be7816134b45a60d3
	* tools/wks-util.c (wks_cmd_install_key): Don't set u+x on the file.
	(ensure_policy_file): No need to make the policy file group writable.

2020-12-23  Werner Koch  <wk@gnupg.org>

	gpg: Initialize a variable even in a never used code path.
	+ commit 83e875a2d1e7560b9626266373c89e6e6eb7cb50
	* g10/sign.c (write_signature_packets): Init ERR.

2020-12-21  Werner Koch  <wk@gnupg.org>

	Release 2.2.26.
	+ commit c77bb1a750f0e2d6538d23fdc0af0e3ff3d56781


	common: Remove superfluous debug output from dotlock.c.
	+ commit 323a69ef65e0d48fb9d038ecca01a70688ad3325
	* common/dotlock.c (dotlock_create_unix): Remove debug output.

	doc: Explain LDAP keyserver parameters.
	+ commit 261fb98c6f034f3f96abee79ea73febd115420ae


	common: Fix the "ignore" meta command in argparse.c.
	+ commit 09dc59f6d43f5e81781429913b8f377581825be0
	* src/argparse.c (gnupg_argparse): Factor some code out to ...
	(prepare_arg_return): new.
	(gnupg_argparse): No missing arg error in ignore sections.
	* common/sysutils.c: Include pwd.h.
	(gnupg_getusername): New.

2020-12-18  Werner Koch  <wk@gnupg.org>

	gpg: Fix --trusted-key with fingerprint arg.
	+ commit 8a2e5025eb0f9537a4e776cf2886771a507121f1
	* g10/trustdb.c (tdb_register_trusted_key): Take care of that
	other constant.

	dirmngr: Do not block threads in LDAP keyserver calls.
	+ commit 15bfd189c07ef0f1bb94db0aee9ad26441ddc494
	* dirmngr/ks-engine-ldap.c: Wrap some ldap calls.

	dirmngr: Fix backport of the new option parser from 2.3.
	+ commit 9b886adba4f83ca462f8015060bcea8a7ceb6bb0
	* dirmngr/dirmngr.c (main) <aGPGConfList>: Re-introduce
	gpgconf-dirmngr.conf.

2020-12-17  Werner Koch  <wk@gnupg.org>

	gpg: New AKL method "ntds"
	+ commit 559efd23e936536435a42646b62fe8c4f8585d38
	* dirmngr/ks-engine-ldap.c (keyspec_to_ldap_filter): Change the new
	support for KEYDB_SEARCH_MODE_MAIL.
	(ks_ldap_get): Add a debug.
	* g10/options.h (AKL_NTDS): New.
	* g10/keyserver.c (keyserver_import_ntds): New.
	(keyserver_get_chunk): Allow KEYDB_SEARCH_MODE_MAIL.
	* g10/getkey.c (parse_auto_key_locate): Support "ntds".
	(get_pubkey_byname): Ditto.

	dirmngr: Support "ldap:///" for the current AD user.
	+ commit 776bef74c778c6740a6aac8a05801a958868346d
	* dirmngr/http.h (struct parsed_uri_s): Add field ad_current.
	* dirmngr/ldap-parse-uri.c (ldap_parse_uri): Set it.
	* dirmngr/ks-engine-ldap.c (my_ldap_connect): Take care of ad_current.

	dirmngr: Allow LDAP searches via fingerprint.
	+ commit c75fd75532905a2922288e0e8ac01fcd0226fc52
	* dirmngr/ks-engine-ldap.c (keyspec_to_ldap_filter): Add arg
	serverinfo and allow searching by fingerprint.
	(ks_ldap_get, ks_ldap_search): First connect then create teh filter.

	dirmngr: Store all version 2 schema attributes.
	+ commit c28cb5282b149f1e34df6f923e88e1998a60cc4a
	* g10/call-dirmngr.c (ks_put_inq_cb): Emit "fpr" records.
	* dirmngr/ks-engine-ldap.c (extract_attributes): Add args
	extract-state and schemav2.  Add data for the new schema version.
	remove the legacy code to handle UIDs in the "pub" line.
	(ks_ldap_put): Set new attributes for NTDS use the fingerprint as CN.


	This is a backport from 2.3

	dirmngr: Support the new Active Directory schema.
	+ commit ac8ece92662d83b79b03a369df07362d320fd118
	* dirmngr/ks-engine-ldap.c (SERVERINFO_): New constants.
	(my_ldap_connect): Relace args pgpkeyattrp and real_ldapp by a new
	serverinfo arg.  Set the new info flags.
	(ks_ldap_get): Adjust for change.
	(ks_ldap_search): Ditto.
	(ks_ldap_put): Ditto.  Replace xmalloc by xtrymalloc.  Change the DN
	for use with NTDS (aka Active Directory).

	dirmngr: Do not store the useless pgpSignerID in the LDAP.
	+ commit 0e88c73bc94fbca224f06d95bb024030bb3a73bb
	* dirmngr/ks-engine-ldap.c (extract_attributes): Do not store the
	pgpSignerID.
	* g10/call-dirmngr.c (ks_put_inq_cb): Do not emit sig records.

	dirmngr: Fix adding keys to an LDAP server.
	+ commit e47de853820000ddf383e7b790fbc435e3378d66
	* dirmngr/ks-engine-ldap.c (ks_ldap_put): Extract attribites into
	addlist.

2020-12-16  NIIBE Yutaka  <gniibe@fsij.org>

	scd:ccid: Call libusb_clear_halt in ccid_vendor_specific_setup.
	+ commit 3c55e15cee4bfed6ef96fbc97a0d2f00afceebe3
	* scd/ccid-driver.c (ccid_vendor_specific_setup): Only for SPR532,
	call libusb_clear_halt.

	scd:ccid: Revert the addition of libusb_clear_halt for EP_INTR.
	+ commit 585cfca0a60bd910012a8a2218f74889840b2546
	* scd/ccid-driver.c (ccid_setup_intr): Don't call libusb_clear_halt.

2020-12-07  NIIBE Yutaka  <gniibe@fsij.org>

	scd:openpgp: Fix writing ECC key to card.
	+ commit 5a03bf61304d0c2c8b4df53a1a7680cd0eb91cb1
	* scd/app-openpgp.c (build_privkey_template): Adding another argument
	of ecc_d_fixed_len to handle variable-size MPI.

2020-12-04  Werner Koch  <wk@gnupg.org>

	Backport of the new option parser from 2.3.
	+ commit a028f24136a062f55408a5fec84c6d31201b2143
	* configure.ac (GPGRT_ENABLE_ARGPARSE_MACROS): Define.
	* common/argparse.c, common/argparse.h: Rewrite.
	* tests/gpgscm/main.c: Switch to the new option parser.

	* g10/gpg.c: Switch to the new option parser and enable a global conf
	file.
	* g10/gpgv.c: Ditto.
	* agent/gpg-agent.c: Ditto.
	* agent/preset-passphrase.c: Ditto.
	* agent/protect-tool.c: Ditto.
	* scd/scdaemon.c: Ditto.
	* dirmngr/dirmngr.c: Ditto.
	* dirmngr/dirmngr_ldap.c: Ditto
	* dirmngr/dirmngr-client.c: Ditto.
	* kbx/kbxutil.c: Ditto.
	* tools/gpg-card.c: Ditto.
	* tools/gpg-check-pattern.c: Ditto.
	* tools/gpg-connect-agent.c: Ditto.
	* tools/gpg-pair-tool.c: Ditto.
	* tools/gpg-wks-client.c: Ditto.
	* tools/gpg-wks-server.c: Ditto.
	* tools/gpgconf.c: Ditto.
	* tools/gpgsplit.c: Ditto.
	* tools/gpgtar.c: Ditto.
	* g13/g13.c: Ditto.
	* g13/g13-syshelp.c: Ditto.  Do not force verbose mode.
	* sm/gpgsm.c: Ditto. Add option --no-options.

2020-12-02  Werner Koch  <wk@gnupg.org>

	kbx: Better error message in case of a crippled Libgcrypt.
	+ commit acafa695e1e7998b892a6a621ef06d57bbc82722
	* kbx/keybox-openpgp.c (keygrip_from_keyparm): Detect missing curve.

2020-12-01  Jens Meißner  <meissner@b1-systems.de>

	doc: Add parameters for batch generation of ECC keys.
	+ commit a3f95a29b97d603c606936620e4638cc6db10ec9
	* doc/gpg.texi: Add parameters for batch generation of ECC keys.

2020-11-27  NIIBE Yutaka  <gniibe@fsij.org>

	common: Fix fallback handling to utf-8.
	+ commit 7d7a50ba7231bd4432b1254c7067a7f287890632
	* common/utf8conv.c (handle_iconv_error): Set NO_TRANSLATION.

2020-11-23  Werner Koch  <wk@gnupg.org>

	Release 2.2.25.
	+ commit 40f75823d25548abbc52dd6121963a55d99b1230


2020-11-19  Werner Koch  <wk@gnupg.org>

	gpgconf: Also print revision of libksba.
	+ commit 6594dc31f58916b6f8b31de070e85d56221e3b94
	* dirmngr/dirmngr.c (get_revision_from_blurb): Fix detection of empty
	string.
	(gpgconf_versions): Print ksba revision.

2020-11-19  Jakub Bogusz  <qboosh@pld-linux.org>

	po: Update Polish translation.
	+ commit f7cbf68fdd1e42cdbabec7e06f2149f6b3f1d1dc


2020-11-19  NIIBE Yutaka  <gniibe@fsij.org>

	scd:openpgp: Public keys should be available for check_keyidstr.
	+ commit 84020385be19556800b22cc5b0ce098acd424298
	* scd/app-openpgp.c (check_keyidstr): Call get_public_key.

2020-11-17  Werner Koch  <wk@gnupg.org>

	Release 2.2.24.
	+ commit 5751c48035764d938ae0459fcecd37194133bfb7

