agent: Make --allow-mark-trusted the default.

* agent/gpg-agent.c (opts, main): Add option --no-allow-mark-trusted.
Put this option into the gpgconf-list.
(main): Enable opt.allow_mark_trusted by default.
* tools/gpgconf-comp.c (gc_options_gpg_agent): Replace
allow-mark-trusted by no-allow-mark-trusted.

* agent/trustlist.c (agent_marktrusted): Always set the "relax" flag.

--

These changes have been in effect for the Gpg4win Windows version
since 2011-01-24 and thus first released with Gpg4win 2.1.0.  Given
the current state of PKIX it does not make any sense to lure the Unix
user into false security by making it harder to trust self-signed or
CAcert certificates.

Signed-off-by: Werner Koch <wk@gnupg.org>
(cherry picked from commit 90b419f3e9d05e509348d047e05fcc79e87be6cf)

Resolved conflicts:
	NEWS
	agent/gpg-agent.c

1 files changed, 8 insertions, 2 deletions

diff --git a/NEWS b/NEWS
index 0c02a902e..2efc395b5 100644
--- a/NEWS
+++ b/NEWS
@@ -6,8 +6,14 @@ Noteworthy changes in version 2.1.0-betaN (unreleased)
 
  * The GNU Pth library has been replaced by the new nPth library.
 
- * New option --enable-putty-support to allow gpg-agent to act as a
-   Pageant replacement including full smartcard support.
+ * By default the users are now asked via the Pinentry whether they
+   trust an X.509 root key.  To prohibit interactive marking of such
+   keys, the new option --no-allow-mark-trusted may be used.
+
+ * The included ssh agent does now support ECDSA keys.
+
+ * The new option --enable-putty-support allows gpg-agent on Windows
+   to act as a Pageant replacement with full smartcard support.
 
  * Removed support for the original HKP keyserver which is not anymore
    used by any site.