Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gpg2 for openSUSE:Factory checked in at 2026-10-12 22:05:14 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gpg2 (Old) and /work/SRC/openSUSE:Factory/.gpg2.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gpg2" Mon Oct 12 22:05:14 2026 rev:204 rq:1384122 version:2.5.24 Changes: -------- --- /work/SRC/openSUSE:Factory/gpg2/gpg2.changes 2026-09-04 12:37:48.807111989 +0200 +++ /work/SRC/openSUSE:Factory/.gpg2.new.3698736/gpg2.changes 2026-10-12 22:05:27.260900800 +0200 @@ -1,0 +2,44 @@ +Sun Oct 11 15:15:24 UTC 2026 - Andreas Stieger <[email protected]> + +- Update to 2.5.24: + * scd: Fix for regression in 2.5.23 related to the new Nitrokey + detection + +------------------------------------------------------------------- +Sun Oct 11 15:02:08 UTC 2026 - Andreas Stieger <[email protected]> + +- Update to 2.5.23: + * gpg: New option --allow-9980 to enable the processing of + RFC-9980 specified data structures. The use of this option is + only recommended if external policy requirements demand the use + of these governmental approved specification. PGP folks + requiring some PQC resistance should keep on using the standard + LibrePGP Kyber algorithm introduced 2 years ago + * gpg: In 9980 mode support PQC encryption using ML-KEM (aka + Kyber) with X448, X25519, Brainpool, or NIST curves as + specified by RFC-9980 et al + * gpg: In 9980 mode support ED25519 and X25519 as specified by + RFC-9580 under the names "ietf27" and "ietf27". + * gpg: Add experimental support for a --compliance=fips mode to + use GCM for bulk encryption. + * scd: Add Nitrokey 3 to pcsc-shared interference detection + * gpgsm: Fix an exploitable printf bug when using the debug + option "--debug x509" + * dirmngr: Make the LDAP upload flags also work for KS_SEARCH + * dirmngr: Fix OOB read in DNS CERT record parser + * scd: Fix OOB access in DO parsing of faulty cards + * dirmngr: Add a mitigation for badly configured web key + directories + * New option --debug-no-libgcrypt for gpg, gpgsm, and agent + This debug option is useful to avoid cluttering other debug + output with libgcrypt generated debug details + * gpg: New --list-options "debug-show-sexp" to print a secret key + as an s-expression +- drop patches due to different upstream changes: + * gnupg-add-test-cases-for-import-without-uid.patch + * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch +- Rebase patches: + * gnupg-add_legacy_FIPS_mode_option.patch + * Rebase gnupg-revert-rfc4880bis.patch + +------------------------------------------------------------------- Old: ---- gnupg-2.5.22.tar.bz2 gnupg-2.5.22.tar.bz2.sig gnupg-add-test-cases-for-import-without-uid.patch gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch New: ---- gnupg-2.5.24.tar.bz2 gnupg-2.5.24.tar.bz2.sig ----------(Old B)---------- Old:- drop patches due to different upstream changes: * gnupg-add-test-cases-for-import-without-uid.patch * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch Old: * gnupg-add-test-cases-for-import-without-uid.patch * gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch - Rebase patches: ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gpg2.spec ++++++ --- /var/tmp/diff_new_pack.tBGpQA/_old 2026-10-12 22:05:28.695959665 +0200 +++ /var/tmp/diff_new_pack.tBGpQA/_new 2026-10-12 22:05:28.697959747 +0200 @@ -18,7 +18,7 @@ Name: gpg2 -Version: 2.5.22 +Version: 2.5.24 Release: 0 Summary: File encryption, decryption, signature creation and verification utility License: GPL-3.0-or-later @@ -39,8 +39,6 @@ Patch6: gnupg-add_legacy_FIPS_mode_option.patch Patch7: gnupg-2.2.16-secmem.patch Patch8: gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch -Patch9: gnupg-add-test-cases-for-import-without-uid.patch -Patch10: gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch #PATCH-FIX-SUSE Allow 8192 bit RSA keys in keygen UI when large_rsa is set Patch11: gnupg-allow-large-rsa.patch #PATCH-FIX-SUSE Revert the rfc4880bis features default of key generation @@ -57,7 +55,7 @@ BuildRequires: pkgconfig(ksba) >= 1.6.3 BuildRequires: pkgconfig(ldap) BuildRequires: pkgconfig(libassuan) >= 3.0.0 -BuildRequires: pkgconfig(libgcrypt) >= 1.11.0 +BuildRequires: pkgconfig(libgcrypt) >= 1.12.0 BuildRequires: pkgconfig(libusb-1.0) BuildRequires: pkgconfig(npth) >= 1.2 BuildRequires: pkgconfig(readline) ++++++ gnupg-2.5.22.tar.bz2 -> gnupg-2.5.24.tar.bz2 ++++++ /work/SRC/openSUSE:Factory/gpg2/gnupg-2.5.22.tar.bz2 /work/SRC/openSUSE:Factory/.gpg2.new.3698736/gnupg-2.5.24.tar.bz2 differ: char 11, line 1 ++++++ gnupg-add_legacy_FIPS_mode_option.patch ++++++ --- /var/tmp/diff_new_pack.tBGpQA/_old 2026-10-12 22:05:28.758962249 +0200 +++ /var/tmp/diff_new_pack.tBGpQA/_new 2026-10-12 22:05:28.762962413 +0200 @@ -3,11 +3,11 @@ g10/gpg.c | 9 +++++++++ 2 files changed, 27 insertions(+) -Index: gnupg-2.5.4/doc/gpg.texi +Index: gnupg-2.5.23/doc/gpg.texi =================================================================== ---- gnupg-2.5.4.orig/doc/gpg.texi -+++ gnupg-2.5.4/doc/gpg.texi -@@ -2340,6 +2340,24 @@ implies, this option is for experts only +--- gnupg-2.5.23.orig/doc/gpg.texi ++++ gnupg-2.5.23/doc/gpg.texi +@@ -2419,6 +2419,24 @@ implies, this option is for experts only understand the implications of what it allows you to do, leave this off. @option{--no-expert} disables this option. @@ -32,11 +32,11 @@ @end table -Index: gnupg-2.5.4/g10/gpg.c +Index: gnupg-2.5.23/g10/gpg.c =================================================================== ---- gnupg-2.5.4.orig/g10/gpg.c -+++ gnupg-2.5.4/g10/gpg.c -@@ -455,6 +455,7 @@ enum cmd_and_opt_values +--- gnupg-2.5.23.orig/g10/gpg.c ++++ gnupg-2.5.23/g10/gpg.c +@@ -465,6 +465,7 @@ enum cmd_and_opt_values oForceSignKey, oForbidGenKey, oRequireCompliance, @@ -44,15 +44,15 @@ oCompatibilityFlags, oAddDesigRevoker, oAssertSigner, -@@ -907,6 +908,7 @@ static gpgrt_opt_t opts[] = { +@@ -925,6 +926,7 @@ static gpgrt_opt_t opts[] = { ARGPARSE_s_s (oCipherAlgo, "cipher-algo", "@"), ARGPARSE_s_s (oDigestAlgo, "digest-algo", "@"), ARGPARSE_s_s (oCertDigestAlgo, "cert-digest-algo", "@"), + ARGPARSE_s_n (oSetLegacyFips, "set-legacy-fips", "@"), + ARGPARSE_s_n (oAllow9980, "allow-9980", "@"), ARGPARSE_s_n (oRequirePQCEncryption, "require-pqc-encryption", "@"), ARGPARSE_s_n (oDisablePQCEncryption, "disable-pqc-encryption", "@"), - -@@ -3865,6 +3867,14 @@ main (int argc, char **argv) +@@ -3932,6 +3934,14 @@ main (int argc, char **argv) keybox_set_buffersize (pargs.r.ret_ulong, 0); break; ++++++ gnupg-revert-rfc4880bis.patch ++++++ --- /var/tmp/diff_new_pack.tBGpQA/_old 2026-10-12 22:05:28.793963685 +0200 +++ /var/tmp/diff_new_pack.tBGpQA/_new 2026-10-12 22:05:28.798963890 +0200 @@ -13,11 +13,11 @@ (read_parameter_file): Activate the v4 and v5 keywords. -- -Index: gnupg-2.5.14/g10/gpg.c +Index: gnupg-2.5.23/g10/gpg.c =================================================================== ---- gnupg-2.5.14.orig/g10/gpg.c -+++ gnupg-2.5.14/g10/gpg.c -@@ -256,6 +256,7 @@ enum cmd_and_opt_values +--- gnupg-2.5.23.orig/g10/gpg.c ++++ gnupg-2.5.23/g10/gpg.c +@@ -257,6 +257,7 @@ enum cmd_and_opt_values oGnuPG, oRFC2440, oRFC4880, @@ -25,7 +25,7 @@ oOpenPGP, oPGP7, oPGP8, -@@ -660,6 +661,7 @@ static gpgrt_opt_t opts[] = { +@@ -667,6 +668,7 @@ static gpgrt_opt_t opts[] = { ARGPARSE_s_n (oGnuPG, "no-pgp8", "@"), ARGPARSE_s_n (oRFC2440, "rfc2440", "@"), ARGPARSE_s_n (oRFC4880, "rfc4880", "@"), @@ -33,7 +33,7 @@ ARGPARSE_s_n (oOpenPGP, "openpgp", N_("use strict OpenPGP behavior")), ARGPARSE_s_n (oPGP7, "pgp6", "@"), ARGPARSE_s_n (oPGP7, "pgp7", "@"), -@@ -1016,7 +1018,6 @@ static gpgrt_opt_t opts[] = { +@@ -1027,7 +1029,6 @@ static gpgrt_opt_t opts[] = { ARGPARSE_s_n (oNoop, "no-allow-multiple-messages", "@"), ARGPARSE_s_s (oNoop, "aead-algo", "@"), ARGPARSE_s_s (oNoop, "personal-aead-preferences","@"), @@ -41,7 +41,7 @@ ARGPARSE_s_n (oNoop, "override-compliance-check", "@"), -@@ -2282,7 +2283,7 @@ static struct gnupg_compliance_option co +@@ -2301,7 +2302,7 @@ static struct gnupg_compliance_option co { { "gnupg", oGnuPG }, { "openpgp", oOpenPGP }, @@ -50,7 +50,7 @@ { "rfc4880", oRFC4880 }, { "rfc2440", oRFC2440 }, { "pgp6", oPGP7 }, -@@ -2298,8 +2299,29 @@ static struct gnupg_compliance_option co +@@ -2318,8 +2319,29 @@ static struct gnupg_compliance_option co static void set_compliance_option (enum cmd_and_opt_values option) { @@ -80,15 +80,15 @@ case oGnuPG: /* set up default options affected by policy compliance: */ opt.compliance = CO_GNUPG; -@@ -2318,6 +2340,7 @@ set_compliance_option (enum cmd_and_opt_ - opt.s2k_digest_algo = 0; +@@ -2339,6 +2361,7 @@ set_compliance_option (enum cmd_and_opt_ opt.s2k_cipher_algo = DEFAULT_CIPHER_ALGO; opt.flags.allow_old_cipher_algos = 0; + opt.flags.allow_9980 = 0; + opt.flags.rfc4880bis = 1; break; case oOpenPGP: -@@ -3110,6 +3133,7 @@ main (int argc, char **argv) +@@ -3143,6 +3166,7 @@ main (int argc, char **argv) case oOpenPGP: case oRFC2440: case oRFC4880: @@ -96,7 +96,7 @@ case oPGP7: case oPGP8: case oGnuPG: -@@ -4025,6 +4049,11 @@ main (int argc, char **argv) +@@ -4072,6 +4096,11 @@ main (int argc, char **argv) if( may_coredump && !opt.quiet ) log_info(_("WARNING: program may create a core file!\n")); @@ -108,7 +108,7 @@ if (eyes_only) { if (opt.set_filename) log_info(_("WARNING: %s overrides %s\n"), -@@ -4247,7 +4276,7 @@ main (int argc, char **argv) +@@ -4294,7 +4323,7 @@ main (int argc, char **argv) /* Check our chosen algorithms against the list of legal algorithms. */ @@ -117,11 +117,11 @@ { const char *badalg=NULL; preftype_t badtype=PREFTYPE_NONE; -Index: gnupg-2.5.14/g10/keygen.c +Index: gnupg-2.5.23/g10/keygen.c =================================================================== ---- gnupg-2.5.14.orig/g10/keygen.c -+++ gnupg-2.5.14/g10/keygen.c -@@ -492,7 +492,7 @@ keygen_set_std_prefs (const char *string +--- gnupg-2.5.23.orig/g10/keygen.c ++++ gnupg-2.5.23/g10/keygen.c +@@ -497,7 +497,7 @@ keygen_set_std_prefs (const char *string if ( !openpgp_cipher_test_algo (CIPHER_ALGO_3DES) ) strcat(dummy_string,"S2 "); /* 3DES - RFC4880 default. */ @@ -130,7 +130,7 @@ strcat(dummy_string,"A2 "); if (personal) -@@ -999,7 +999,7 @@ keygen_upd_std_prefs (PKT_signature *sig +@@ -1004,7 +1004,7 @@ keygen_upd_std_prefs (PKT_signature *sig /* Make sure that the MDC feature flag is set if needed. */ add_feature_mdc (sig,mdc_available); add_feature_aead (sig, aead_available); @@ -139,7 +139,7 @@ add_keyserver_modify (sig,ks_modify); keygen_add_keyserver_url(sig,NULL); -@@ -4150,7 +4150,10 @@ parse_key_parameter_part (ctrl_t ctrl, +@@ -4328,7 +4328,10 @@ parse_key_parameter_part (ctrl_t ctrl, } } else if (!ascii_strcasecmp (s, "v5")) @@ -151,7 +151,7 @@ else if (!ascii_strcasecmp (s, "v4")) keyversion = 4; else -@@ -4411,7 +4414,7 @@ parse_key_parameter_part (ctrl_t ctrl, +@@ -4591,7 +4594,7 @@ parse_key_parameter_part (ctrl_t ctrl, * ecdsa := Use algorithm ECDSA. * eddsa := Use algorithm EdDSA. * ecdh := Use algorithm ECDH. @@ -160,7 +160,7 @@ * * There are several defaults and fallbacks depending on the * algorithm. PART can be used to select which part of STRING is -@@ -5388,9 +5391,9 @@ read_parameter_file (ctrl_t ctrl, const +@@ -5575,9 +5578,9 @@ read_parameter_file (ctrl_t ctrl, const } } @@ -173,7 +173,7 @@ else { r = xmalloc_clear( sizeof *r + strlen( value ) ); -@@ -5485,11 +5488,14 @@ quickgen_set_para (struct para_data_s *p +@@ -5672,11 +5675,14 @@ quickgen_set_para (struct para_data_s *p r->next = para; para = r;
