Hello GnuPG maintainers, Could you identify a maintained official Windows x64 GnuPG build suitable for offline signature verification in a restricted AppContainer context with Mandatory ASLR and rejection of images without relocation information? We need to preserve the existing protections and execution context.
The immediate task is to verify 21 detached signatures using public keys and a dedicated home directory, without private keys or automatic network key retrieval. Key-state checks, including expiry and revocation within the available offline evidence, are also needed; gpgv alone would provide only part of that coverage. Observed facts 1. On 64-bit Windows NT 10.0.26200.0, attempts to start the existing gpg.exe and gpgv.exe for --version failed in System.Diagnostics.Process.Start() using ProcessStartInfo, with Win32 error 623, ERROR_ILLEGAL_DLL_RELOCATION. The processes did not start; no GnuPG exit status or version output was produced. The gpg probe used --no-options, --homedir pointing to a dedicated empty directory, --no-autostart and --version. Shell execution was disabled; standard output/error were redirected. 2. A subsequent read-only query of the diagnostic PowerShell process returned ASLR flags 0xF: BottomUp, ForceRelocateImages, HighEntropy and DisallowStrippedImages enabled. Its token was an AppContainer token. These are measurements of the diagnostic process, not the failed child. We did not capture child-creation mitigation attributes or measure the nonexistent child, and do not assume bitwise inheritance. 3. We downloaded gnupg-w32-2.5.24_20260923.exe from the official release link and matched its SHA256 to the value on your integrity page. Static extraction of gpg.exe, gpgv.exe and eight associated DLLs yielded ten files identical in size and SHA256 to the installed copies. Both EXEs are AMD64 PE32+, have RELOCS_STRIPPED set, and have a zero base-relocation RVA and size. The eight DLLs contain relocation data. No component from the acquired package was installed or executed. This strongly supports a relocation-compatibility concern, but does not prove the exact cause of error 623. No responsible DLL has been identified. The package checksum match is not an OpenPGP signature verification; the acquired package's OpenPGP signature and Authenticode chain were not verified. Details and exact hashes are in the evidence annex. Could you clarify the following? 1. Is stripping relocation data from these two 2.5.24 EXEs intentional, and is this exact package intended to support Mandatory ASLR with rejection of stripped images? 2. Is there a maintained official build with usable base-relocation data in gpg.exe and its required DLLs, supported under these protections and AppContainer? If so, please provide the exact version, architecture, artifact URL, SHA256, signature location and published signing-key fingerprint, plus relevant build or support documentation. An optional gpgv build would be useful for partial verification, but does not replace the full key-state checks above. 3. If no such build is currently available, is there an existing issue, planned release or official test artifact addressing this requirement? We would first inspect any identified artifact statically. Retaining usable relocation data is the relevant prerequisite; a portable layout or DYNAMIC_BASE flag alone would not establish it. 4. Are there documented filesystem, configuration or component requirements for this limited offline use in AppContainer, with an explicitly writable dedicated home directory and no agent/network features needed? 5. What additional non-sensitive, read-only diagnostics would help distinguish this relocation concern from other causes of error 623, given that child launch attributes and child policy were not captured? At this stage we are requesting technical guidance and an identifiable official artifact. Our current scope permits documentary/static work; it does not permit disabling protections, patching/rebasing binaries, installing a replacement, or testing outside the approved context. Thank you for your guidance. Attached document: - EVIDENCE_C11_C13.txt — concise evidence, exact hashes and limitations. Official references: https://lists.gnupg.org/pipermail/gnupg-announce/2026q3/000516.html https://gnupg.org/download/integrity_check.html https://learn.microsoft.com/en-us/defender-endpoint/exploit-protection-reference#force-randomization-for-images-mandatory-aslr
GNUPG TECHNICAL EVIDENCE — C11-C13 Prepared: 24 October 2026 These are derived, minimized excerpts of preserved local records. C11 contains the original earlier launch-failure logs; C12 is the documentary review; C13 is package acquisition and static inspection. No new reproduction attempt was made for this draft. No application source, binary, installer, keys, personal paths or credentials are attached. A. PREVIOUS LAUNCH FAILURE (23 OCTOBER 2026) Platform recorded: Microsoft Windows NT 10.0.26200.0, 64-bit OS and host. Host: 64-bit PowerShell. Launcher: System.Diagnostics.Process.Start with ProcessStartInfo; UseShellExecute=false, CreateNoWindow=true; stdout and stderr redirected. gpg: --no-options; --homedir pointing to a dedicated empty directory; --no-autostart; --version. gpgv: --homedir pointing to that dedicated directory; --version. Both probes failed before successful process creation with Win32 error 623, ERROR_ILLEGAL_DLL_RELOCATION. No GnuPG exit code, stdout or stderr. The localized error included literal %hs placeholders; it did not identify a responsible DLL. No key import or artifact signature check was performed. B. SUBSEQUENT READ-ONLY CONTEXT MEASUREMENT (C11, 23 OCTOBER) GetProcessMitigationPolicy on the diagnostic PowerShell process returned ASLR flags 0xF (15): - EnableBottomUpRandomization=true - EnableForceRelocateImages=true - EnableHighEntropy=true - DisallowStrippedImages=true The mitigation cmdlet agreed: ForceRelocateImages, RequireInfo, BottomUp and HighEntropy were ON. Read-only token queries: primary token; TokenIsAppContainer=1; TokenHasRestrictions=1 (the token had been filtered). Configured system ASLR settings were NOTSET for those four options. No per-image policy object was returned for either executable's basename or full path. NOTSET was not interpreted as effective OFF. Scope: the diagnostic process only. The failed child did not exist to query; its launch-time mitigation attributes were not captured. Bitwise inheritance of these flags is not assumed. Policy origin was not identified. C. DOCUMENTARY REVIEW (C12, 23 OCTOBER) The consulted official pages identified GnuPG 2.5.24 and Gpg4win 5.1.1. No verifier was qualified as compatible with this exact restricted context from those documents; this is not proof that no compatible build exists. Gpg4win 5.1.1 recipe commit: d51b519782206121bdb9b02aad95e38cedafd9f5 packages/packages.list, lines 829-844, identifies the precompiled gnupg-w32-2.5.24_20260923-bin.exe package, remotely named gnupg-w32-2.5.24_20260923.exe, with the checksum below. Other components' hardening does not demonstrate that the GnuPG backend was relinked. The source reference is pinned for reproducibility, not a verified tag signature. D. OFFICIAL PACKAGE AND EXTRACTION (C13, 24 OCTOBER) File: gnupg-w32-2.5.24_20260923.exe URL: https://gnupg.org/ftp/gcrypt/binary/gnupg-w32-2.5.24_20260923.exe Size: 5804864 bytes Published and measured SHA256: ea6f9dee2cccd83287432625b8b399173805add81d27067fcaf019c0c4da1ad8 Published checksum source: https://gnupg.org/download/integrity_check.html Acquired from the exact official release link in the browser. HTTP response headers and the redirect chain were not retained. The checksum matched. Package OpenPGP signature and Authenticode chain were NOT verified; checksum matching is not described as either check. Existing 7-Zip 19.00 (x64) read the installer as an archive. Listing and extraction returned exit 0. Only ten named members were extracted as data: the two verifiers and eight associated DLLs, total 6,758,160 bytes. The installer and extracted components were not executed. The NSIS parser descriptor included BadCmd=37; full interpretation of the installer's instructions is not asserted. For these ten files, independent size/SHA256 matches to C11 and installed copies establish exact identity. This does not claim that the entire installer payload was compared. The external installer stub is x86; all ten inspected payload files are AMD64 PE32+. These are separate layers. E. SELECTED FILE HASHES AND RELOCATION DATA Every file below matched its C11 record and installed copy in size and SHA256. gpg.exe Size: 1416232 bytes SHA256: 7a334fbd16ba02af568b30cd66a89c49104b0af4c3a3556174bfd26ca2295ced Base-relocation RVA: 0; size: 0 bytes RELOCS_STRIPPED: true gpgv.exe Size: 722472 bytes SHA256: fa18faa5d476139ef4c7c87308d25cc9c16bf72bae4181e11e5d527258a32b26 Base-relocation RVA: 0; size: 0 bytes RELOCS_STRIPPED: true libassuan-9.dll Size: 170632 bytes SHA256: 479887bebb8929cc3e9cffaa4cc7140705fa2dcb57a3a5f3db90d949bf097052 Base-relocation RVA: 188416; size: 236 bytes RELOCS_STRIPPED: false libgcrypt-20.dll Size: 2260552 bytes SHA256: 46bcb9543235152192093d2aa2794c62a1b7d08b72f078a1de5d31a773041383 Base-relocation RVA: 2273280; size: 4436 bytes RELOCS_STRIPPED: false libgpg-error-0.dll Size: 258424 bytes SHA256: dd0c8cd53fcc7745da4ee3f3227dc7e2a5257e9f1f7be490f88d9ff7a9353d2f Base-relocation RVA: 270336; size: 1028 bytes RELOCS_STRIPPED: false libksba-8.dll Size: 335432 bytes SHA256: 3678c55e9c53dfe5233d4a53ed035261d2c63782b75c7356788d4e7ced7d7789 Base-relocation RVA: 348160; size: 1372 bytes RELOCS_STRIPPED: false libnpth-0.dll Size: 46384 bytes SHA256: a8e987548e4fadca5231d7b680b7e3ea898ce38850fa60cf0c3954e06d2e33ef Base-relocation RVA: 73728; size: 96 bytes RELOCS_STRIPPED: false libntbtls-0.dll Size: 115984 bytes SHA256: 85784cf5c6dd8e6ffcaaf381ccc7c91bd6d66b46f85908e78bea42fa410a3b7b Base-relocation RVA: 131072; size: 432 bytes RELOCS_STRIPPED: false libsqlite3-0.dll Size: 1286088 bytes SHA256: 9c279f1cf6638045d48168a6f27d09270e8458c9ac70bed2b95116c8a56e03d2 Base-relocation RVA: 1290240; size: 3132 bytes RELOCS_STRIPPED: false zlib1.dll Size: 145960 bytes SHA256: 1e91fcc579b66cb731815af8c4e1ab66cb115afe85b81f5727bbeb9586d2d034 Base-relocation RVA: 163840; size: 184 bytes RELOCS_STRIPPED: false Both EXEs: Machine 0x8664, OptionalHeaderMagic 0x020B, COFF Characteristics 0x022F, ImageBase 0x00400000, DllCharacteristics 0, DYNAMIC_BASE=false, HIGH_ENTROPY_VA=false. The eight DLLs contain relocation data despite DYNAMIC_BASE=false. Setting an opt-in flag alone would not create missing relocation data. Inspection was bounded PE byte parsing. No inconsistency was found in the inspected header/section/import and relocation-block checks, but this is not complete Windows-loader validation or dynamic dependency resolution. F. INTERPRETATION AND REMAINING UNCERTAINTY The two exact EXEs lack the relocation information required when stripped images are rejected. This supports a compatibility hypothesis under the diagnostic context observed, and the acquired package is not a different verifier candidate: its ten selected files are identical to those installed. The exact cause of the earlier 623 failure is NOT conclusively established. No failed-child mitigation policy, responsible DLL or file corruption was demonstrated. No new runtime test was attempted. No vendor defect or incompatibility of every official build is asserted. All 21 intended detached-signature checks remain NOT PERFORMED. No protection, installation, application source, database or VM changes were made in C11-C13. The C13 acquisition wrote only the requested download, extracted data and documentary evidence; C11-C13 original records are retained. The structured local record is retained separately; it is not attached.
_______________________________________________ Gnupg-users mailing list [email protected] https://lists.gnupg.org/mailman/listinfo/gnupg-users
