Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-12 Thread Werner Koch 
On Tue, 11 Nov 2014 21:00, [email protected] said:

> I really have no rush with this. Just debugging for others and happily using 
> the stable branch.

Thanks for explaining.

> I can dig into this myself at some point. It’s also possible whoever
> is maintaining the homebrew repo for gnupg might solve the issue and
> push an update there.

It seems that there is a conflict between different build systems.
Which is not not surprising.


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-11 Thread Ville Määttä 
No worries on my part.

> it seems to install software in versioned directories.

Exactly, under /usr/local… and without messing with the system installed 
binaries or libraries. Some things, like openssl libraries, it will not link 
automatically to avoid some issues with system provided libraries, but most 
things are then symlinked to the usual places to provide the brew installed 
binaries, etc.

> I guess it is missing a dependency tracker and
> thus when installing Libgcrypt an older (but sufficient) version of
> libgpg-error gets installed alongside.

It actually tracks dependencies very well… for anything installed and built 
with Homebrew. It’s a bit like speedo.mk for everything, or the missing apt-get 
for Mac, some things are “bottled” binaries, some things it’ll build for you, 
in any case pulling any dependencies as needed.

In this case when trying to build a tarred source brew is not in the picture at 
all and all dependency handling is manual / left for the source configure 
scripts. And things don’t quite work although the configure script gives an OK 
on the pre-make checklist.

I really have no rush with this. Just debugging for others and happily using 
the stable branch.

I can dig into this myself at some point. It’s also possible whoever is 
maintaining the homebrew repo for gnupg might solve the issue and push an 
update there.

-- 
Ville

On 11 Nov 2014, at 21:04, Werner Koch  wrote:

> On Tue, 11 Nov 2014 15:59, [email protected] said:
> 
>> I don’t have CFLAGS set to anything. Mac OS X 10.9 and using homebrew
>> for most things. The only thing I do is run ./configure && make in the
>> untarred gnupg-2.1.0. I wouldn’t be surprised if there’s something
> 
> I don't know any details about homebrew but it seems to install software
> in versioned directories. I guess it is missing a dependency tracker and
> thus when installing Libgcrypt an older (but sufficient) version of
> libgpg-error gets installed alongside.  GnuPG does not pick up that one
> but a different installation of libgpg-error and thus you run into these
> problems.
> 
> May some someone with more OS X experience look at the problem?
> 
> 
> Salam-Shalom,
> 
>   Werner
> 
> -- 
> Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
> 



signature.asc
Description: Message signed with OpenPGP using GPGMail
___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-11 Thread Werner Koch 
On Tue, 11 Nov 2014 15:59, [email protected] said:

> I don’t have CFLAGS set to anything. Mac OS X 10.9 and using homebrew
> for most things. The only thing I do is run ./configure && make in the
> untarred gnupg-2.1.0. I wouldn’t be surprised if there’s something

I don't know any details about homebrew but it seems to install software
in versioned directories. I guess it is missing a dependency tracker and
thus when installing Libgcrypt an older (but sufficient) version of
libgpg-error gets installed alongside.  GnuPG does not pick up that one
but a different installation of libgpg-error and thus you run into these
problems.

May some someone with more OS X experience look at the problem?


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-11 Thread Ville Määttä 
Hi,

That’s somehow just the result of running ./configure. Running a fresh (fresh 
untarred source, no speedo runs) configure reported this for me:

…
configure: checking for libraries
checking for gpg-error-config... /usr/local/bin/gpg-error-config
checking for GPG Error - version >= 1.15... yes (1.17)
checking for libgcrypt-config...
…

That’s a homebrew installed /usr/local/Cellar/libgpg-error/1.17.

I don’t have CFLAGS set to anything. Mac OS X 10.9 and using homebrew for most 
things. The only thing I do is run ./configure && make in the untarred 
gnupg-2.1.0. I wouldn’t be surprised if there’s something special in the system 
but I’m not consciously doing anything other that the usual make routine.

I also just did a fresh run of speedo.mk and in that case got the same error as 
Nicholas originally reported (“_default_errsource”).

-- 
Ville

On 11 Nov 2014, at 11:28, Werner Koch  wrote:

> Hi,
> 
> On Thu,  6 Nov 2014 15:22, [email protected] said:
> 
>>> gcc -I/usr/local/Cellar/libgcrypt/1.6.2/include
> ! >> -I/usr/local/Cellar/libgpg-error/1.13/include
>>> -I/usr/local/Cellar/libassuan/2.1.2/include
> ! >> -I/usr/local/Cellar/libgpg-error/1.13/include
>>> -I/usr/local/Cellar/libksba/1.3.1/include
> ! >> -I/usr/local/Cellar/libgpg-error/1.16/include -g -O2 -Wall
>>> -Wno-pointer-sign -Wpointer-arith -o t-sexputil t-sexputil.o
>>> libcommon.a ../gl/libgnu.a -L/usr/local/Cellar/libgcrypt/1.6.2/lib
> ! >> -lgcrypt -L/usr/local/Cellar/libgpg-error/1.13/lib -lgpg-error
>>> -L/usr/local/Cellar/libassuan/2.1.2/lib -lassuan
> ! >> -L/usr/local/Cellar/libgpg-error/1.13/lib -lgpg-error
> ! >> -L/usr/local/Cellar/libgpg-error/1.17/lib -lgpg-error -liconv
> 
> I do not known your build setup, but how did you manage to include 2
> different versions of libgpg-error - something most be broken in your
> setup. Custom CFLAGS set?  A messed up stow(1) tree?
> 
> 
> Shalom-Salam,
> 
>   Werner
> 
> 
> 
> -- 
> Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
> 



signature.asc
Description: Message signed with OpenPGP using GPGMail
___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-11 Thread Werner Koch 
Hi,

On Thu,  6 Nov 2014 15:22, [email protected] said:

  >> gcc -I/usr/local/Cellar/libgcrypt/1.6.2/include
! >> -I/usr/local/Cellar/libgpg-error/1.13/include
  >> -I/usr/local/Cellar/libassuan/2.1.2/include
! >> -I/usr/local/Cellar/libgpg-error/1.13/include
  >> -I/usr/local/Cellar/libksba/1.3.1/include
! >> -I/usr/local/Cellar/libgpg-error/1.16/include -g -O2 -Wall
  >> -Wno-pointer-sign -Wpointer-arith -o t-sexputil t-sexputil.o
  >> libcommon.a ../gl/libgnu.a -L/usr/local/Cellar/libgcrypt/1.6.2/lib
! >> -lgcrypt -L/usr/local/Cellar/libgpg-error/1.13/lib -lgpg-error
  >> -L/usr/local/Cellar/libassuan/2.1.2/lib -lassuan
! >> -L/usr/local/Cellar/libgpg-error/1.13/lib -lgpg-error
! >> -L/usr/local/Cellar/libgpg-error/1.17/lib -lgpg-error -liconv

I do not known your build setup, but how did you manage to include 2
different versions of libgpg-error - something most be broken in your
setup. Custom CFLAGS set?  A messed up stow(1) tree?


Shalom-Salam,

   Werner



-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-10 Thread Simon Nicolussi 
I wrote:
> I've attached an exemplary signature file (named gnupg-2.1.0.tar.bz2.sig
> for your convenience) that demonstrates the problem:

Addendum: I noticed that GnuPG releases and git tags are signed with the
same key. Abusing the latter, I'm able to generate far smaller signature
files. The date is now also correct (although the time is still off):
> $ echo evil stuff > gnupg-2.1.0.tar.bz2
> $ gpg2 --verify gnupg-2.1.0.tar.bz2.sig
> gpg: Signature made Wed Nov  5 15:30:17 2014 CET using RSA key ID 4F25E3B6
> gpg: Good signature from "Werner Koch (dist sig)" [full]

As the generated signature file was even smaller than the original one,
I padded it to full length with a private/experimental packet (tag 60):
> $ wc -c gnupg-2.1.0.tar.bz2.sig{,.orig}
> 861 gnupg-2.1.0.tar.bz2.sig
> 861 gnupg-2.1.0.tar.bz2.sig.orig

-- 
Simon Nicolussi 
http{s,}://{www.,}sinic.name/


gnupg-2.1.0.tar.bz2.sig
Description: Binary data


pgpcHWKEss1cn.pgp
Description: PGP signature
___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: Detached signature ambiguity (was: [Announce] GnuPG 2.1.0 "modern" released)

2014-11-10 Thread Nicholas Cole 
On Mon, Nov 10, 2014 at 11:59 AM, Peter Lebbing  wrote:
> On 10/11/14 12:02, Nicholas Cole wrote:
>> So the confusion is
>> that you have one single command that deals with verifying both a
>> detached signature and with a file that contains a signature?
>
> Yes.
>
>> Is the best fix for this to introduce two new commands
>
> That seems extreme. Although you could add commands that make it
> explicit what you want, removing the existing, ambiguous one would cause
> massive breakage of deployed scripts. Werner is always very cautious
> about doing that.
>
> Maybe this avenue of thought can help come up with a good solution. When
> people verify a detached signature, they usually have two files named:
>
> file.ext
> file.ext.sig
>
> If GnuPG encounters this situation, but file.ext.sig is not a detached
> signature, it could display a big fat warning:
>
> WARNING: file.ext.sig is NOT a detached signature; the file file.ext is
> NOT VERIFIED!

Yes, Werner is very good at not breaking things that don't need to be
broken.  But in fact, it is the fact that scripts depend on this that
made me think that this might be a case where things *should* get
broken, because this is actually a serious security flaw, and the
scripts in question need fixing.  In many cases, no one is going to be
around to read the warning you suggest.

Just a thought.

N.

___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Detached signature ambiguity (was: [Announce] GnuPG 2.1.0 "modern" released)

2014-11-10 Thread Peter Lebbing 
On 10/11/14 12:02, Nicholas Cole wrote:
> So the confusion is
> that you have one single command that deals with verifying both a
> detached signature and with a file that contains a signature?

Yes.

> Is the best fix for this to introduce two new commands

That seems extreme. Although you could add commands that make it
explicit what you want, removing the existing, ambiguous one would cause
massive breakage of deployed scripts. Werner is always very cautious
about doing that.

Maybe this avenue of thought can help come up with a good solution. When
people verify a detached signature, they usually have two files named:

file.ext
file.ext.sig

If GnuPG encounters this situation, but file.ext.sig is not a detached
signature, it could display a big fat warning:

WARNING: file.ext.sig is NOT a detached signature; the file file.ext is
NOT VERIFIED!

This does create some related issues:

gnupg_2.1.0.tar.bz2
gnupg-2.1.0.tar.bz2.sig

or

gnupg_2,1.0.tar.bz2.sig

These files can trick people into thinking they have the same filename.
This suggests this is either not foolproof or you need normalisation.
The extent of normalisation seems to make this unattainable. And
combining Unicode characters make matters even worse.

So it definitely has problems. But it might help think of the most
proper solution.

Peter.

-- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at 

___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-10 Thread Nicholas Cole 
On Fri, Nov 7, 2014 at 9:21 PM, Simon Nicolussi  wrote:
> The announcement read:
>> If you already have a version of GnuPG installed, you can simply
>> verify the supplied signature.  For example to verify the signature
>> of the file gnupg-2.1.0.tar.bz2 you would use this command:
>>
>>   gpg --verify gnupg-2.1.0.tar.bz2.sig
>
> Invoking GnuPG that way is insecure without knowing the contents of the
> signature file. An attacker could have replaced it by something that's
> not, in fact, a detached signature.
>
> I've attached an exemplary signature file (named gnupg-2.1.0.tar.bz2.sig
> for your convenience) that demonstrates the problem:
>> $ echo evil stuff > gnupg-2.1.0.tar.bz2
>> $ gpg2 --verify gnupg-2.1.0.tar.bz2.sig
>> gpg: Signature made Fri Oct 31 07:55:15 2014 CET using RSA key ID 4F25E3B6
>> gpg: Good signature from "Werner Koch (dist sig)" [full]
>
> Future announcements should call --verify with two files as arguments;
> the same goes for https://www.gnupg.org/download/integrity_check.html:
>>   gpg --verify gnupg-2.1.0.tar.bz2.sig gnupg-2.1.0.tar.bz2.sig

Is the point that you can have a signed file that makes you THINK you
have verified a file when in fact you haven't?  So the confusion is
that you have one single command that deals with verifying both a
detached signature and with a file that contains a signature?

Is the best fix for this to introduce two new commands

--verify-detached (requires two arguments)

and

--verify-file

and then to make everything that simply calls the old command --verify
break?  Or is that too radical?


N.

___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-10 Thread Werner Koch 
On Fri,  7 Nov 2014 22:21, [email protected] said:

> Invoking GnuPG that way is insecure without knowing the contents of the
> signature file. An attacker could have replaced it by something that's
> not, in fact, a detached signature.

I guess that this bug exists at least since 1.0.4 and I consider this a
serious flaw.  I am thinking about a proper solution which limts
breakage.

As a quick minimal fix I changed the instructions on the website.


Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-10 Thread Werner Koch 
On Sun,  9 Nov 2014 06:46, [email protected] said:
> Not really; every time I do some operation requiring a passphrase, GnuPG
> 2.1 aborts because it can't find a pinentry.

Hey, it is a wiki - feel free to put in your solution - in case it is
different than mine.


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-09 Thread Kristian Fiskerstrand 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

On 11/10/2014 12:57 AM, MFPA wrote:
> Hi
> 
> 
> On Thursday 6 November 2014 at 9:01:51 AM, in 
> , Werner Koch wrote:
> 
> 
>> This is an experimental installer for Windows including GPA as
>> graphical key manager and GpgEX as an Explorer extension.  Please
>> de-install an already installed Gpg4win version before trying
>> this installer.  This binary version has not been tested very
>> well, thus it is likely that you will run into problems.
> 
> 
> The issue I have encountered (on Windows XP) is not being able to
> add a Curve 25519 encryption subkey. The option is available, but
> fails:-
> 

For OpenPGP Curve25519 is only defined[0] for signatures,
certificates, authentication using the Ed25519 scheme. For encryption
the only valid options are those found in RFC6637[1].

References:
[0] http://www.ietf.org/id/draft-koch-eddsa-for-openpgp-01.txt
[1] http://tools.ietf.org/rfc/rfc6637.txt
- -- 
- 
Kristian Fiskerstrand
Blog: http://blog.sumptuouscapital.com
Twitter: @krifisk
- 
Public OpenPGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
- 
Ubi mel ibi apes
Where there's honey, there are bees
-BEGIN PGP SIGNATURE-

iQIcBAEBCgAGBQJUYCICAAoJEPw7F94F4Tag0rsP/2I0roSh+4UbtJrTkPW28dA8
F2Nc6qwsXGMI0ZS+8i6uWA3RvaMsTlxaszR7Gi+mko5MGPU3/xFpyj08iT0fb3wp
9K5x2Yzf4x+oAF+cI3XybMaQvteXR0iX7t2ilYPURVoQNJP0R4LfxDvox7VIrJRZ
8YEJRdNmTVDKnFzK+N5xV60cHNgMvhJgF+kgOhMw1dHStps4k3JV/6ETFoRIdmpW
e+BqXfrkBl8W7yXubgng5ZubF5belWcPExMLb8qqKNwvHnJwnKfDfvkkqB90uK8h
2VSQweQIf2BqMor0WHxsRfNj7dNNAcRNg36f+t+an0w4v7oA/poYTeT0EAdyJpBZ
Q2ldWORP+wdaxJuBdVHlvYKJqSEboDUZcuJLD3MU4YHoL+a8y3Ij14IpMmQ73UoD
EpqbN5v5q9zaA8/pQvCdJzkb0OoLSkOZHaWwnDtsrHbR2/BfsJXVMRyU0UhtT6aH
pt9ikrQcuxFHNZ0CTPp7XdjSU6KZ67YazN8f1w1jcmffrNdReCX1a2HUkJQ1cAEB
pQa7/Yfp4Y3NG5tim4v8OpHX2CHYuzxfRMzyOTTfuj96RB9Lpnzw/9GuiRW/iY3k
6PAiURGw4graoDz9kmamr5BrCt0rkZdInBu08ZconZNqzzh17isAJnGvD3/arQwL
gphzOUPSSBZoF4Wu/iXO
=65fL
-END PGP SIGNATURE-

___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-09 Thread MFPA 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Hi


On Monday 10 November 2014 at 2:09:31 AM, in
, Murphy wrote:


> It generated fine in Linux.

It did in Windows for a main key, and for a signing subkey. And I now
know it can't generate me a Curve 25519 encryption subkey because the
format is not yet finalised and will be added in a later GnuPG
version. [0]

[0] 

- --
Best regards

MFPAmailto:[email protected]

Puns are bad but poetry is verse.
-BEGIN PGP SIGNATURE-

iQF8BAEBCgBmBQJUYCq6XxSAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRCM0FFN0VDQTlBOEM4QjMwMjZBNUEwRjU2
QjdDNzRDRUIzMUYyNUYwAAoJEGt8dM6zHyXwcI8IAID0f+DRK6J7BcyDhxxIjKRF
q44UEy7xvGI1VoXX2b+gQdSjHR+o6JOL1qN705vpmPzIhHsLQGH0slfo33369PiV
i7TXEE+SMc+tM4ayUIqekz79cBKxjMye5TWU6Mr8WL+ByoovorfR2V9MmViQIE23
XiGW+HSEQYL40GwqQknJrrIpzJf2BtwumoGwW7ZvocmDOAcavLIMrLjjxJjpC9+Q
51w9ptDzJpooTBQ3kM6El3saDg32oWhrXJnT7Jvp3+Rn92kbJyNhm+gCkR0FRWd7
5pQPWej19q5PBjUkd4PagqnPZAMh9VHXigT6B/TenM2doJjiVnD2trurFSoJTB4=
=RPVm
-END PGP SIGNATURE-


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-09 Thread MFPA 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Hi


On Monday 10 November 2014 at 2:25:13 AM, in
, Kristian Fiskerstrand
wrote:


> For OpenPGP Curve25519 is only defined[0] for
> signatures, certificates, authentication using the
> Ed25519 scheme. For encryption the only valid options
> are those found in RFC6637[1].

Thanks. That lead me to re-read "What’s new in GnuPG 2.1" [2] and
spot, in reference to Curve 25519, the wording "The format for an
encryption key has not yet been finalized and will be added to GnuPG
in one of the next point releases."

[2] 

- --
Best regards

MFPAmailto:[email protected]

You can't build a reputation on what you are going to do
-BEGIN PGP SIGNATURE-

iQF8BAEBCgBmBQJUYCesXxSAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRCM0FFN0VDQTlBOEM4QjMwMjZBNUEwRjU2
QjdDNzRDRUIzMUYyNUYwAAoJEGt8dM6zHyXwRoYIAI6RIoxX4ih8k9NDCU6aPfbr
TqhpE4ec+aNJ1rpaRRm4Oa7AXIovdolrffbG7SJAl03ueryScWUOzj96dm2DKjhK
vtM67hZI+KgfMKfl+H2mra9jERJ5vz5KJba0Xsg13NA/0J9rfQdKJIXlTEGDrsbg
4j8fYHFXsmgEzdMNQwB0bOIQcQNAV+zFBdTuGQtwMS7ZfkJbDThP+I3uH2XPFiyb
7iVW3Y3rZYz/vmXaKytSsYmtbaKfp44IcRHKYS0GgC9mF/a1BJbHO2hn/hm17Xf3
lsLv/tAbnX2iH33HZdDOVQavOWC3puUQvT24uh6Om73PcQwXdFlhJh1a5vB7bgo=
=Fxxw
-END PGP SIGNATURE-


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-09 Thread Murphy 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

ok - found the same issue with gpg2 --expert --edit myKey

gpg> addkey
Please select what kind of key you want:
   (3) DSA (sign only)
   (4) RSA (sign only)
   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
  (12) ECC (encrypt only)
  (13) Existing key
Your selection? 12
Please select which elliptic curve you want:
   (1) Curve 25519
   (2) NIST P-256
   (3) NIST P-384
   (4) NIST P-521
   (5) Brainpool P-256
   (6) Brainpool P-384
   (7) Brainpool P-512
Your selection? 1
gpg: WARNING: Curve25519 is not yet part of the OpenPGP standard.
Use this curve anyway? (y/N) y
Please specify how long the key should be valid.
 0 = key does not expire
= key expires in n days
  w = key expires in n weeks
  m = key expires in n months
  y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y
Really create? (y/N) y
We need to generate a lot of random bytes. It is a good idea to perform
some other action (type on the keyboard, move the mouse, utilize the
disks) during the prime generation; this gives the random number
generator a better chance to gain enough entropy.
gpg: agent_genkey failed: Unknown elliptic curve
gpg: Key generation failed: Unknown elliptic curve

So Linux has the same bug.
-BEGIN PGP SIGNATURE-
Version: GnuPG v1

iJwEAQECAAYFAlRgJUUACgkQUVKxkWZz2Q0/JAP+JoqE96OHIxvjq1bZWAcGn8Ce
ZRiw55CzVLHLIg+6XQSujdIdH6onxUhzuP79wcq1ibvfF9GYkfBQgpvDoTj+0T3z
n6Yd2Ua0ou1mLSHHNj4my4vJmV1gYD3Ef0ilZ1TJzdNuHG9k7+myI5Q6lfgul2lz
ZoTptmcNqjWqoQjT6BM=
=ADLB
-END PGP SIGNATURE-

___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-09 Thread MFPA 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Hi


On Monday 10 November 2014 at 1:54:47 AM, in
, Murphy wrote:


> Interesting.  That curve doesn't show in the linux
> build.  And neither does option 12 in the 'select what
> kind of key you want' menu


Sorry, I was not clear enough in my description.

I created a main key first (tested with RSA main key and also with a
couple of the ECC curves). Then I added subkeys via the --edit-key
dialogue (addkey). (In that dialogue there is an option 12.) I can ask
GnuPG to generate a curve 25519 encryption subkey. But (sub)key
generation fails. However, it will generate a curve 25519 signing
subkey.



> snad@snad:~$ gpg2 --expert --full-gen-key
> gpg (GnuPG) 2.1.0; Copyright (C) 2014 Free Software Foundation, Inc.
> This is free software: you are free to change and redistribute it.
> There is NO WARRANTY, to the extent permitted by law.
>
> Please select what kind of key you want:
>(1) RSA and RSA (default)
>(2) DSA and Elgamal
>(3) DSA (sign only)
>(4) RSA (sign only)
>(7) DSA (set your own capabilities)
>(8) RSA (set your own capabilities)
>(9) ECC and ECC
>   (10) ECC (sign only)
>   (11) ECC (set your own capabilities)
> Your selection? 9

I see curve 25519 if I go via option 11 at that point. It can be
selected and will create a main key.



- --
Best regards

MFPAmailto:[email protected]

CAUTION! - Beware of Warnings!
-BEGIN PGP SIGNATURE-

iQF8BAEBCgBmBQJUYCSfXxSAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRCM0FFN0VDQTlBOEM4QjMwMjZBNUEwRjU2
QjdDNzRDRUIzMUYyNUYwAAoJEGt8dM6zHyXwrgYH/1shOUrHiunFjBxAMuyLX9qB
gW+y9rWmzLhyanHZjn9+TfbNz89Rywg5VitupV8DaY0IUwnx0RnWyqybP7DCci/W
NGNbxeL+UXWq1a0E4PWuZb/x8P44HoAEBoQsAAWhR30aZb856m/VjcnqQfoIOF04
KY0VGHwtl+2DU6b90aJ0/BsOrMpOKpdc+nDUGKlji+puYLgfKIfqvy0DZj/EkwiE
XspdfKiDsF6TVk17lPDrozkk/lbT7TkNod1P1cxLaXrCwhpUBKOwOpYqI3JIV6Ec
3Mq7zwc+YBaCY9/Esi82QINsWsFMT8rw/2o7pK/ZplppGC51bJbrEWWpugXONBQ=
=owMr
-END PGP SIGNATURE-


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-09 Thread Murphy 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Ah, found it under (11) ECC (set your own capabilities)

  (11) ECC (set your own capabilities)
Your selection? 11

Possible actions for a ECDSA key: Sign Certify Authenticate
Current allowed actions: Sign Certify

   (S) Toggle the sign capability
   (A) Toggle the authenticate capability
   (Q) Finished

Your selection? q
Please select which elliptic curve you want:
   (1) Curve 25519
   (2) NIST P-256
   (3) NIST P-384
   (4) NIST P-521
   (5) Brainpool P-256
   (6) Brainpool P-384
   (7) Brainpool P-512
Your selection? 1
gpg: WARNING: Curve25519 is not yet part of the OpenPGP standard.
Use this curve anyway? (y/N) y

It generated fine in Linux.
-BEGIN PGP SIGNATURE-
Version: GnuPG v1

iJwEAQECAAYFAlRgHlsACgkQUVKxkWZz2Q0ftwQAir36kUJq9lF7I0RM+GzyBG6u
QIIAVnSivug7PP1Z/TidsFl+ITR4MG5zESud54ZcByqz92k0zzchbShpVDU+39yD
Vlxx6jIfKSnQgSNd2ZufLxo6cOmpd3Erex4d8ATrlrCGRHpllHHbFsImNHoxuqyv
H/wcIg3pSV3FQLmkuD4=
=Rt4/
-END PGP SIGNATURE-

___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-09 Thread Murphy 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Interesting.  That curve doesn't show in the linux build.  And neither
does option 12 in the 'select what kind of key you want' menu

snad@snad:~$ gpg2 --expert --full-gen-key
gpg (GnuPG) 2.1.0; Copyright (C) 2014 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Please select what kind of key you want:
   (1) RSA and RSA (default)
   (2) DSA and Elgamal
   (3) DSA (sign only)
   (4) RSA (sign only)
   (7) DSA (set your own capabilities)
   (8) RSA (set your own capabilities)
   (9) ECC and ECC
  (10) ECC (sign only)
  (11) ECC (set your own capabilities)
Your selection? 9
Please select which elliptic curve you want:
   (2) NIST P-256
   (3) NIST P-384
   (4) NIST P-521
   (5) Brainpool P-256
   (6) Brainpool P-384
   (7) Brainpool P-512
Your selection?
-BEGIN PGP SIGNATURE-
Version: GnuPG v1

iJwEAQECAAYFAlRgGt8ACgkQUVKxkWZz2Q3a4AP+Ohz0LGNy39O2/nase4NcDPmT
k1h+EAYat08S6rV254LUT6qJV0pb4/np59PRa7M6l658YxJeg0cyhOw0IZ+LOjXH
noCZAGKPtJEq+ynruybz3K69JR5bDd8YcPBUQaO+RDnQozRd/nvbCdwklfPS/c+l
3wlmNIbCCIWONijgYmw=
=tw1d
-END PGP SIGNATURE-

___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-09 Thread MFPA 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Hi


On Thursday 6 November 2014 at 9:01:51 AM, in
, Werner Koch wrote:


> This is an experimental installer for Windows including
> GPA as graphical key manager and GpgEX as an Explorer
> extension.  Please de-install an already installed
> Gpg4win version before trying this installer.  This
> binary version has not been tested very well, thus it
> is likely that you will run into problems.


The issue I have encountered (on Windows XP) is not being able to add
a Curve 25519 encryption subkey. The option is available, but fails:-


   Your selection? 12
   Please select which elliptic curve you want:
  (1) Curve 25519
  (2) NIST P-256
  (3) NIST P-384
  (4) NIST P-521
  (5) Brainpool P-256
  (6) Brainpool P-384
  (7) Brainpool P-512
   Your selection? 1
   gpg: WARNING: Curve25519 is not yet part of the OpenPGP standard.
   Use this curve anyway? (y/N) y
   Please specify how long the key should be valid.
 0 = key does not expire
= key expires in n days
  w = key expires in n weeks
  m = key expires in n months
  y = key expires in n years
   Key is valid for? (0)
   Key does not expire at all
   Is this correct? (y/N) y
   Really create? (y/N) y
   We need to generate a lot of random bytes. It is a good idea to perform
   some other action (type on the keyboard, move the mouse, utilize the
   disks) during the prime generation; this gives the random number
   generator a better chance to gain enough entropy.
   gpg: agent_genkey failed: Unknown elliptic curve
   gpg: Key generation failed: Unknown elliptic curve


- --
Best regards

MFPAmailto:[email protected]

The greater the power, the more dangerous the abuse.
-BEGIN PGP SIGNATURE-

iPQEAQEKAF4FAlRf/2tXFIAALgAgaXNzdWVyLWZwckBub3RhdGlvbnMub3Bl
bnBncC5maWZ0aGhvcnNlbWFuLm5ldEJBMjM5QjQ2ODFGMUVGOTUxOEU2QkQ0NjQ0
N0VDQTAzAAoJEKipC46tDG5pmlMD/RNJhby5o/Cv11C0O0R0FLMeNPmXYlslEiE3
sE5qdJ1DZYt/WPrYKVZ3jrSrjFfRWlQ/LlRAsbtu6OhVH4y7Pa0teqNh2xmK1lyH
bGeqX0LJtKxf26+wnuwTbP5caj2GB2SgVrSJdmFfUSH91vkLIZebHOhcloZ4kppI
r0e/M6fC
=C1Vm
-END PGP SIGNATURE-


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-09 Thread Simon Nicolussi 
Peter Lebbing wrote:
> On 07/11/14 22:21, Simon Nicolussi wrote:
> > gpg --verify gnupg-2.1.0.tar.bz2.sig gnupg-2.1.0.tar.bz2.sig
> 
> However, here's a small mistake. This should read:
> 
> gpg --verify gnupg-2.1.0.tar.bz2.sig gnupg-2.1.0.tar.bz2

Oops, right. I originally used a more concise brace expansion (i.e.,
gnupg-2.1.0.tar.bz2{.sig,}), but changed my mind the instant before
sending. Sorry, I should have proofread my message a second time.

-- 
Simon Nicolussi 
http{s,}://{www.,}sinic.name/


pgprA3RSjOQ6d.pgp
Description: PGP signature
___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-09 Thread Peter Lebbing 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On 07/11/14 22:21, Simon Nicolussi wrote:
> Invoking GnuPG that way is insecure without knowing the contents of the 
> signature file. An attacker could have replaced it by something that's not,
> in fact, a detached signature.

Oops! Very nice find, kudos!

> Future announcements should call --verify with two files as arguments; the
> same goes for https://www.gnupg.org/download/integrity_check.html:
>> gpg --verify gnupg-2.1.0.tar.bz2.sig gnupg-2.1.0.tar.bz2.sig

However, here's a small mistake. This should read:

gpg --verify gnupg-2.1.0.tar.bz2.sig gnupg-2.1.0.tar.bz2

For people not acquainted with this syntax: when --verify has multiple
arguments, the first one is the detached signature and the remaining arguments
are the signed files.

And finally, there is another little thing wrong with the announcement:

> GnuPG 2.1.0 may be downloaded from one of the GnuPG mirror sites or direct
> from its primary FTP server.  The list of mirrors can be found at
> https://gnupg.org/mirrors.html .  Note that GnuPG is not available at
> ftp.gnu.org.

That is the list of WWW mirrors. It seems more useful to link to
https://gnupg.org/download/mirrors.html .

HTH,

Peter.

- -- 
I use the GNU Privacy Guard (GnuPG) in combination with Enigmail.
You can send me encrypted mail if you want some privacy.
My key is available at 

___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-08 Thread Robert J. Hansen 
> Does the method I proposed on wiki.gnupg.org work for you?  that is 
> installing it in the HOME directory with PATH and LD_LIBRARY_PATH
> set accordingly?

Not really; every time I do some operation requiring a passphrase, GnuPG
2.1 aborts because it can't find a pinentry.

___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-07 Thread Werner Koch 
On Thu,  6 Nov 2014 20:58, [email protected] said:

> Is there any guidance as to how to install this on Fedora 20?  gnupg2 is

Does the method I proposed on wiki.gnupg.org work for you?  that is
installing it in the HOME directory with PATH and LD_LIBRARY_PATH set
accordingly?

> The timing of GnuPG 2.1 is a little unfortunate: we're already past the
> beta freeze and final freeze is coming up in just a few days.  It's

Dame as with Debian.  However the Debian folks are still working on
installing 2.0 by default.

> shift from 2.0 to 2.1 outside of a major release, meaning Fedora users
> will be left using 2.0 for six months or so.

Well, that is early when thinking in Debian time spans ;-)


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Michael Richardson 

Werner Koch  wrote:
>> Werner Koch  wrote: > - All support for PGP-2 keys has
>> been removed for security reasons.
>> 
>> Does this mean that documents signed decades ago with PGP2 can no
>> longer be verified?

> Right.  It is anyway useless because you have to assume that such
> signatures are broken.  If you want to decrypt you should have 1.4

I agree that one's confidence in that content should be suspect, but the
value is not zero.  I am happy that you have removed the support,
btw. Simpler code is important.

>   There is one use case where PGP-2 keys may still be required: For
> existing encrypted data.  We suggest to keep a version of GnuPG 1.4
> around which still has support for these keys (it might be required to
> use the `--allow-weak-digest-algos' option).  A better solution is to
> re-encrypt the data using a modern key.

Yes, that was idea too -- just use 1.4.
And one can't re-encrypt data signed by another.

In many cases, in my archives, I have email that is clear signed, which was
then encrypted, and stored that way.

-- 
]   Never tell me the odds! | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works| network architect  [ 
] [email protected]  http://www.sandelman.ca/|   ruby on rails[ 




pgpxyAsFJlM_e.pgp
Description: PGP signature
___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Michael Richardson 

Werner Koch  wrote:
>   - All support for PGP-2 keys has been removed for security reasons.

Does this mean that documents signed decades ago with PGP2 can no longer
be verified?

If so, I guess this is a reason to keep GPG classic around for verification
purposes only.

-- 
]   Never tell me the odds! | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works| network architect  [ 
] [email protected]  http://www.sandelman.ca/|   ruby on rails[ 



pgpWBpGjrKqLy.pgp
Description: PGP signature
___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Robert J. Hansen 

You may not install "modern" (2.1) and "stable" (2.0) at the same
time.  However, it is possible to install "classic" (1.4) along with
any of the other versions.


Is there any guidance as to how to install this on Fedora 20?  gnupg2 is
a protected package there: it literally cannot be removed without
completely breaking the system.  (The cause of the total-breakage: yum,
the Fedora package manager, has gnupg2 as a dependency.)

The timing of GnuPG 2.1 is a little unfortunate: we're already past the
beta freeze and final freeze is coming up in just a few days.  It's
unlikely GnuPG 2.1 will make it into Fedora 21, and I doubt Fedora will
shift from 2.0 to 2.1 outside of a major release, meaning Fedora users
will be left using 2.0 for six months or so.

In the grand scheme of things this is an annoyance more than anything
else... but still, an annoyance.  :)

___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Ville Määttä 
Yeah, OS X. I’m sorry, I’m sure this is drowning to all the discussion on this 
thread, I didn’t think too much about the subject. I was replying to Nicholas’ 
reported issues with building on OS X. My aim was to expand on Nicholas’ report 
with the info that it’s failing with that error yes, but before that it’s 
failing linking to version 0.13 of libgpg_error whereas I have 0.16 and 0.17 
available. As I see it this feels like a ./configure fail on the dependency.

-- 
Ville

On 6 Nov 2014, at 18:48, Werner Koch  wrote:

> On Thu,  6 Nov 2014 15:14, [email protected] said:
> 
>> Undefined symbols for architecture x86_64:
>>  "_default_errsource", referenced from:
> 
> OS X ?
> 
> Such a problem has already bee posted today.  I have no access to OS X
> and thus can't help much.
> 
> 
> Shalom-Salam,
> 
>   Werner
> 
> -- 
> Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.
> 



signature.asc
Description: Message signed with OpenPGP using GPGMail
___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Werner Koch 
On Thu,  6 Nov 2014 15:01, [email protected] said:
> Werner Koch  wrote:
> >   - All support for PGP-2 keys has been removed for security reasons.
>
> Does this mean that documents signed decades ago with PGP2 can no longer
> be verified?

Right.  It is anyway useless because you have to assume that such
signatures are broken.  If you want to decrypt you should have 1.4
versions somewhere.  See the whats-new-in-2.1 article:

1.2 Removal of PGP-2 support


  Some algorithms and parts of the protocols as used by the 20 years old
  [PGP-2] software are meanwhile considered unsafe.  In particular the
  baked in use of the [MD5] hash algorithm limits the security of PGP-2
  keys to non-acceptable rate.  Technically those PGP-2 keys are called
  version 3 keys (v3) and are easily identified by a shorter fingerprint
  which is commonly presented as 16 separate double hex digits.

  With GnuPG 2.1 all support for those keys has gone.  If they are in an
  existing keyring they will eventually be removed.  If GnuPG encounters
  such a key on import it will not be imported due to the not anymore
  implemented v3 key format.  Removing the v3 key support also reduces
  complexity of the code and is thus better than to keep on handling
  them with a specific error message.

  There is one use case where PGP-2 keys may still be required: For
  existing encrypted data.  We suggest to keep a version of GnuPG 1.4
  around which still has support for these keys (it might be required to
  use the `--allow-weak-digest-algos' option).  A better solution is to
  re-encrypt the data using a modern key.



Salam-Shalom,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Werner Koch 
On Thu,  6 Nov 2014 15:14, [email protected] said:

> Undefined symbols for architecture x86_64:
>   "_default_errsource", referenced from:

OS X ?

Such a problem has already bee posted today.  I have no access to OS X
and thus can't help much.


Shalom-Salam,

   Werner

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Ville Määttä 
Ok I did distclean and here’s the results of speedo for me. Again, libgpg-error 
version 0.13 seems to be on the wish list:

ld: warning: ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
directory not found for option '-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
  CCLD   t-convert
  CCLD   t-percent
  CCLD   t-gettime
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
  CCLD   t-sysutils
  CCLD   t-sexputil
  CCLD   t-session-env
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
Undefined symbols for architecture x86_64:
  "_default_errsource", referenced from:
  _parse_ber_header in libcommon.a(libcommon_a-tlv.o)
  _parse_sexp in libcommon.a(libcommon_a-tlv.o)
ld: symbol(s) not found for architecture x86_64
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make[5]: *** [t-sexputil] Error 1
make[5]: *** Waiting for unfinished jobs
  CCLD   t-openpgp-oid
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
make[4]: *** [all] Error 2
make[3]: *** [all-recursive] Error 1
make[2]: *** [all] Error 2
make[1]: *** 
[/Users/vmaatta/Downloads/gnupg-2.1.0/PLAY/stamps/stamp-gnupg-02-make] Error 2
make: *** [native] Error 2

On 6 Nov 2014, at 16:14, Ville Määttä  wrote:

> [shell quote]
> 
> gcc -I/usr/local/Cellar/libgcrypt/1.6.2/include 
> -I/usr/local/Cellar/libgpg-error/1.13/include 
> -I/usr/local/Cellar/libassuan/2.1.2/include 
> -I/usr/local/Cellar/libgpg-error/1.13/include 
> -I/usr/local/Cellar/libksba/1.3.1/include 
> -I/usr/local/Cellar/libgpg-error/1.16/include -g -O2 -Wall -Wno-pointer-sign 
> -Wpointer-arith   -o t-sexputil t-sexputil.o libcommon.a ../gl/libgnu.a 
> -L/usr/local/Cellar/libgcrypt/1.6.2/lib -lgcrypt 
> -L/usr/local/Cellar/libgpg-error/1.13/lib -lgpg-error 
> -L/usr/local/Cellar/libassuan/2.1.2/lib -lassuan 
> -L/usr/local/Cellar/libgpg-error/1.13/lib -lgpg-error 
> -L/usr/local/Cellar/libgpg-error/1.17/lib -lgpg-error  -liconv 
> ld: warning: directory not found for option 
> '-L/usr/local/Cellar/libgpg-error/1.13/lib'
> ld: warning: directory not found for option 
> '-L/usr/local/Cellar/libgpg-error/1.13/lib'
> Undefined symbols for architecture x86_64:
>  "_default_errsource", referenced from:
>  _parse_ber_header in libcommon.a(libcommon_a-tlv.o)
>  _parse_sexp in libcommon.a(libcommon_a-tlv.o)
> ld: symbol(s) not found for architecture x86_64
> clang: error: linker command failed with exit code 1 (use -v to see 
> invocation)
> make[3]: *** [t-sexputil] Error 1
> make[2]: *** [all] Error 2
> make[1]: *** [all-recursive] Error 1
> make: *** [all] Error 2
> 
> [/shell quote]

-- 
Ville

On 6 Nov 2014, at 16:09, Werner Koch  wrote:

>> Undefined symbols for architecture x86_64:
>> 
>>  "_default_errsource", referenced from:
> 
> 
>> make[5]: *** [t-sexputil] Error 1
> 
> default_errsource is defined by init.c which is included in libcommon.a
> which in turn is part of the objects linked to t-sexputil.  Thus there
> should be no problems.  Someone (but not me) needs to have a look at the
> build log.



signature.asc
Description: Message signed with OpenPGP using GPGMail
___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Ville Määttä 
Hi,

I can’t use speedo.mk as I get "GnuPG has already been build[sic] in-source”. 
I’m not going to replace 2.0 at this time so I won’t remove it. With just 
‘make’ I get an error on linking libgpg-error. I happen to have versions 0.16 
and 0.17 but not 0.13 under the referenced path.

[shell quote]

gcc -I/usr/local/Cellar/libgcrypt/1.6.2/include 
-I/usr/local/Cellar/libgpg-error/1.13/include 
-I/usr/local/Cellar/libassuan/2.1.2/include 
-I/usr/local/Cellar/libgpg-error/1.13/include 
-I/usr/local/Cellar/libksba/1.3.1/include 
-I/usr/local/Cellar/libgpg-error/1.16/include -g -O2 -Wall -Wno-pointer-sign 
-Wpointer-arith   -o t-sexputil t-sexputil.o libcommon.a ../gl/libgnu.a 
-L/usr/local/Cellar/libgcrypt/1.6.2/lib -lgcrypt 
-L/usr/local/Cellar/libgpg-error/1.13/lib -lgpg-error 
-L/usr/local/Cellar/libassuan/2.1.2/lib -lassuan 
-L/usr/local/Cellar/libgpg-error/1.13/lib -lgpg-error 
-L/usr/local/Cellar/libgpg-error/1.17/lib -lgpg-error  -liconv 
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
ld: warning: directory not found for option 
'-L/usr/local/Cellar/libgpg-error/1.13/lib'
Undefined symbols for architecture x86_64:
  "_default_errsource", referenced from:
  _parse_ber_header in libcommon.a(libcommon_a-tlv.o)
  _parse_sexp in libcommon.a(libcommon_a-tlv.o)
ld: symbol(s) not found for architecture x86_64
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make[3]: *** [t-sexputil] Error 1
make[2]: *** [all] Error 2
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2

[/shell quote]

-- 
Ville

On 6 Nov 2014, at 13:18, Nicholas Cole  wrote:

> Hi Werner,
> 
> Building on OS X using
> 
> make -f build-aux/speedo.mk native INSTALL_DIR=/usr/local
> 
> gets what looks like most of the way and then fails with the error
> shown below.  Am I the only person experiencing this, or are others
> hitting the same problem?
> 
> Best wishes,
> 
> N.
> 
> 
> 
> Undefined symbols for architecture x86_64:
> 
>  "_default_errsource", referenced from:
> 
>  _parse_ber_header in libcommon.a(libcommon_a-tlv.o)
> 
>  _parse_sexp in libcommon.a(libcommon_a-tlv.o)
> 
> ld: symbol(s) not found for architecture x86_64
> 
> clang: error: linker command failed with exit code 1 (use -v to see 
> invocation)
> 
> make[5]: *** [t-sexputil] Error 1
> 
> make[5]: *** Waiting for unfinished jobs
> 
> make[4]: *** [all] Error 2
> 
> make[3]: *** [all-recursive] Error 1
> 
> make[2]: *** [all] Error 2
> 
> make[1]: *** 
> [/Users/nicholas/Downloads/gnupg-2.1.0/PLAY/stamps/stamp-gnupg-02-make]
> Error 2
> 
> make: *** [native] Error 2
> 
> On Thu, Nov 6, 2014 at 9:01 AM, Werner Koch  wrote:
>> Hello!
>> 
>> The GnuPG Project is pleased to announce the availability of a
>> new release: Version 2.1.0.
>> 
>> The GNU Privacy Guard (GnuPG) is a complete and free implementation of
>> the OpenPGP standard as defined by RFC-4880 and better known as PGP.
>> 
>> GnuPG, also known as GPG, allows to encrypt and sign data and
>> communication, features a versatile key management system as well as
>> access modules for public key directories.  GnuPG itself is a command
>> line tool with features for easy integration with other applications.
>> A wealth of frontend applications and libraries making use of GnuPG
>> are available.  Since version 2 GnuPG provides support for S/MIME and
>> Secure Shell in addition to OpenPGP.
>> 
>> GnuPG is Free Software (meaning that it respects your freedom). It can
>> be freely used, modified and distributed under the terms of the GNU
>> General Public License.
>> 
>> Three different versions of GnuPG are actively maintained:
>> 
>> - GnuPG "modern" (2.1) is the latest development with a lot of new
>>  features.  This announcement is about the first release of this
>>  version.
>> 
>> - GnuPG "stable" (2.0) is the current stable version for general use.
>>  This is what most users are currently using.
>> 
>> - GnuPG "classic" (1.4) is the old standalone version which is most
>>  suitable for older or embedded platforms.
>> 
>> You may not install "modern" (2.1) and "stable" (2.0) at the same
>> time.  However, it is possible to install "classic" (1.4) along with
>> any of the other versions.
>> 
>> 
>> What's New in GnuPG-2.1
>> ===
>> 
>>  - The file "secring.gpg" is not anymore used to store the secret
>>keys.  Merging of secret keys is now supported.
>> 
>>  - All support for PGP-2 keys has been removed for security reasons.
>> 
>>  - The standard key generation interface is now much leaner.  This
>>will help a new user to quickly generate a suitable key.
>> 
>>  - Support for Elliptic Curve Cryptography (ECC) is now available.
>> 
>>  - Commands to create and sign keys from the command line without any
>>extra prompts are now available.
>> 
>>  - The Pinentry may now show the new passphrase entry and the
>>passphrase confirmation entry in one dialog.
>> 
>>  - There is no more need

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Werner Koch 
On Thu,  6 Nov 2014 12:18, [email protected] said:

> make -f build-aux/speedo.mk native INSTALL_DIR=/usr/local

Actually is is INSTALL_PREFIX - I posted a wrong name once.

> gets what looks like most of the way and then fails with the error
> shown below.  Am I the only person experiencing this, or are others

According a another OS X developer, the last beta worked just fine.

> Undefined symbols for architecture x86_64:
>
>   "_default_errsource", referenced from:


> make[5]: *** [t-sexputil] Error 1

default_errsource is defined by init.c which is included in libcommon.a
which in turn is part of the objects linked to t-sexputil.  Thus there
should be no problems.  Someone (but not me) needs to have a look at the
build log.


Shalom-Salam,

   Werner


p.s.
I removed gnupg-devel@ becuase I do think it makes sense to
cross-post.

-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.


___
Gnupg-users mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnupg-users

Re: [Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Nicholas Cole 
Hi Werner,

Building on OS X using

make -f build-aux/speedo.mk native INSTALL_DIR=/usr/local

gets what looks like most of the way and then fails with the error
shown below.  Am I the only person experiencing this, or are others
hitting the same problem?

Best wishes,

N.



Undefined symbols for architecture x86_64:

  "_default_errsource", referenced from:

  _parse_ber_header in libcommon.a(libcommon_a-tlv.o)

  _parse_sexp in libcommon.a(libcommon_a-tlv.o)

ld: symbol(s) not found for architecture x86_64

clang: error: linker command failed with exit code 1 (use -v to see invocation)

make[5]: *** [t-sexputil] Error 1

make[5]: *** Waiting for unfinished jobs

make[4]: *** [all] Error 2

make[3]: *** [all-recursive] Error 1

make[2]: *** [all] Error 2

make[1]: *** 
[/Users/nicholas/Downloads/gnupg-2.1.0/PLAY/stamps/stamp-gnupg-02-make]
Error 2

make: *** [native] Error 2

On Thu, Nov 6, 2014 at 9:01 AM, Werner Koch  wrote:
> Hello!
>
> The GnuPG Project is pleased to announce the availability of a
> new release: Version 2.1.0.
>
> The GNU Privacy Guard (GnuPG) is a complete and free implementation of
> the OpenPGP standard as defined by RFC-4880 and better known as PGP.
>
> GnuPG, also known as GPG, allows to encrypt and sign data and
> communication, features a versatile key management system as well as
> access modules for public key directories.  GnuPG itself is a command
> line tool with features for easy integration with other applications.
> A wealth of frontend applications and libraries making use of GnuPG
> are available.  Since version 2 GnuPG provides support for S/MIME and
> Secure Shell in addition to OpenPGP.
>
> GnuPG is Free Software (meaning that it respects your freedom). It can
> be freely used, modified and distributed under the terms of the GNU
> General Public License.
>
> Three different versions of GnuPG are actively maintained:
>
> - GnuPG "modern" (2.1) is the latest development with a lot of new
>   features.  This announcement is about the first release of this
>   version.
>
> - GnuPG "stable" (2.0) is the current stable version for general use.
>   This is what most users are currently using.
>
> - GnuPG "classic" (1.4) is the old standalone version which is most
>   suitable for older or embedded platforms.
>
> You may not install "modern" (2.1) and "stable" (2.0) at the same
> time.  However, it is possible to install "classic" (1.4) along with
> any of the other versions.
>
>
> What's New in GnuPG-2.1
> ===
>
>   - The file "secring.gpg" is not anymore used to store the secret
> keys.  Merging of secret keys is now supported.
>
>   - All support for PGP-2 keys has been removed for security reasons.
>
>   - The standard key generation interface is now much leaner.  This
> will help a new user to quickly generate a suitable key.
>
>   - Support for Elliptic Curve Cryptography (ECC) is now available.
>
>   - Commands to create and sign keys from the command line without any
> extra prompts are now available.
>
>   - The Pinentry may now show the new passphrase entry and the
> passphrase confirmation entry in one dialog.
>
>   - There is no more need to manually start the gpg-agent.  It is now
> started by any part of GnuPG as needed.
>
>   - Problems with importing keys with the same long key id have been
> addressed.
>
>   - The Dirmngr is now part of GnuPG proper and also takes care of
> accessing keyserver.
>
>   - Keyserver pools are now handled in a smarter way.
>
>   - A new format for locally storing the public keys is now used.
> This considerable speeds up operations on large keyrings.
>
>   - Revocation certificates are now created by default.
>
>   - Card support has been updated, new readers and token types are
> supported.
>
>   - The format of the key listing has been changed to better identify
> the properties of a key.
>
>   - The gpg-agent may now be used on Windows as a Pageant replacement
> for Putty in the same way it is used for years on Unix as
> ssh-agent replacement.
>
>   - Creation of X.509 certificates has been improved.  It is now also
> possible to export them directly in PKCS#8 and PEM format for use
> on TLS servers.
>
> A detailed description of the changes can be found at
> https://gnupg.org/faq/whats-new-in-2.1.html .
>
>
> Getting the Software
> 
>
> Please follow the instructions found at https://gnupg.org/download/ or
> read on:
>
> GnuPG 2.1.0 may be downloaded from one of the GnuPG mirror sites or
> direct from its primary FTP server.  The list of mirrors can be found
> at https://gnupg.org/mirrors.html .  Note that GnuPG is not available
> at ftp.gnu.org.
>
> On ftp.gnupg.org you find these files:
>
>  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-2.1.0.tar.bz2  (3039k)
>  ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-2.1.0.tar.bz2.sig
>
> This is the GnuPG 2.1 source code compressed using BZIP2 and its
> OpenPGP signature.
>
>

[Announce] GnuPG 2.1.0 "modern" released

2014-11-06 Thread Werner Koch 
Hello!

The GnuPG Project is pleased to announce the availability of a
new release: Version 2.1.0.

The GNU Privacy Guard (GnuPG) is a complete and free implementation of
the OpenPGP standard as defined by RFC-4880 and better known as PGP.

GnuPG, also known as GPG, allows to encrypt and sign data and
communication, features a versatile key management system as well as
access modules for public key directories.  GnuPG itself is a command
line tool with features for easy integration with other applications.
A wealth of frontend applications and libraries making use of GnuPG
are available.  Since version 2 GnuPG provides support for S/MIME and
Secure Shell in addition to OpenPGP.

GnuPG is Free Software (meaning that it respects your freedom). It can
be freely used, modified and distributed under the terms of the GNU
General Public License.

Three different versions of GnuPG are actively maintained:

- GnuPG "modern" (2.1) is the latest development with a lot of new
  features.  This announcement is about the first release of this
  version.

- GnuPG "stable" (2.0) is the current stable version for general use.
  This is what most users are currently using.

- GnuPG "classic" (1.4) is the old standalone version which is most
  suitable for older or embedded platforms.

You may not install "modern" (2.1) and "stable" (2.0) at the same
time.  However, it is possible to install "classic" (1.4) along with
any of the other versions.


What's New in GnuPG-2.1
===

  - The file "secring.gpg" is not anymore used to store the secret
keys.  Merging of secret keys is now supported.

  - All support for PGP-2 keys has been removed for security reasons.

  - The standard key generation interface is now much leaner.  This
will help a new user to quickly generate a suitable key.

  - Support for Elliptic Curve Cryptography (ECC) is now available.

  - Commands to create and sign keys from the command line without any
extra prompts are now available.

  - The Pinentry may now show the new passphrase entry and the
passphrase confirmation entry in one dialog.

  - There is no more need to manually start the gpg-agent.  It is now
started by any part of GnuPG as needed.

  - Problems with importing keys with the same long key id have been
addressed.

  - The Dirmngr is now part of GnuPG proper and also takes care of
accessing keyserver.

  - Keyserver pools are now handled in a smarter way.

  - A new format for locally storing the public keys is now used.
This considerable speeds up operations on large keyrings.

  - Revocation certificates are now created by default.

  - Card support has been updated, new readers and token types are
supported.

  - The format of the key listing has been changed to better identify
the properties of a key.

  - The gpg-agent may now be used on Windows as a Pageant replacement
for Putty in the same way it is used for years on Unix as
ssh-agent replacement.

  - Creation of X.509 certificates has been improved.  It is now also
possible to export them directly in PKCS#8 and PEM format for use
on TLS servers.

A detailed description of the changes can be found at
https://gnupg.org/faq/whats-new-in-2.1.html .


Getting the Software


Please follow the instructions found at https://gnupg.org/download/ or
read on:

GnuPG 2.1.0 may be downloaded from one of the GnuPG mirror sites or
direct from its primary FTP server.  The list of mirrors can be found
at https://gnupg.org/mirrors.html .  Note that GnuPG is not available
at ftp.gnu.org.

On ftp.gnupg.org you find these files:

 ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-2.1.0.tar.bz2  (3039k)
 ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-2.1.0.tar.bz2.sig

This is the GnuPG 2.1 source code compressed using BZIP2 and its
OpenPGP signature.

 ftp://ftp.gnupg.org/gcrypt/binary/gnupg-w32-2.1.0_20141105.exe  (6225k)
 ftp://ftp.gnupg.org/gcrypt/binary/gnupg-w32-2.1.0_20141105.exe.sig

This is an experimental installer for Windows including GPA as
graphical key manager and GpgEX as an Explorer extension.  Please
de-install an already installed Gpg4win version before trying this
installer.  This binary version has not been tested very well, thus it
is likely that you will run into problems.  The complete source code
for the software included in this installer is in the same directory;
use the suffix ".tar.xz" instead of ".exe".

Although several beta versions have been released over the course of
the last years, no extensive public field test has been done.  Thus it
is likely that bugs will show up.  Please check the mailing list
archives and the new wiki https://wiki.gnupg.org for latest
information on known problems and workaround.


Checking the Integrity
==

In order to check that the version of GnuPG which you are going to
install is an original and unmodified one, you can do it in one of
the following ways:

 * If you already have a version of GnuPG