diff options
| -rw-r--r-- | NEWS | 10 | ||||
| -rw-r--r-- | agent/gpg-agent.c | 13 | ||||
| -rw-r--r-- | agent/trustlist.c | 3 | ||||
| -rw-r--r-- | tools/gpgconf-comp.c | 4 |
4 files changed, 20 insertions, 10 deletions
@@ -6,8 +6,14 @@ Noteworthy changes in version 2.1.0-betaN (unreleased) * The GNU Pth library has been replaced by the new nPth library. - * New option --enable-putty-support to allow gpg-agent to act as a - Pageant replacement including full smartcard support. + * By default the users are now asked via the Pinentry whether they + trust an X.509 root key. To prohibit interactive marking of such + keys, the new option --no-allow-mark-trusted may be used. + + * The included ssh agent does now support ECDSA keys. + + * The new option --enable-putty-support allows gpg-agent on Windows + to act as a Pageant replacement with full smartcard support. * Removed support for the original HKP keyserver which is not anymore used by any site. diff --git a/agent/gpg-agent.c b/agent/gpg-agent.c index 25750f288..87915d67e 100644 --- a/agent/gpg-agent.c +++ b/agent/gpg-agent.c @@ -116,6 +116,7 @@ enum cmd_and_opt_values oIgnoreCacheForSigning, oAllowMarkTrusted, + oNoAllowMarkTrusted, oAllowPresetPassphrase, oAllowLoopbackPinentry, oKeepTTY, @@ -137,8 +138,8 @@ static ARGPARSE_OPTS opts[] = { { 301, NULL, 0, N_("@Options:\n ") }, - { oServer, "server", 0, N_("run in server mode (foreground)") }, { oDaemon, "daemon", 0, N_("run in daemon mode (background)") }, + { oServer, "server", 0, N_("run in server mode (foreground)") }, { oVerbose, "verbose", 0, N_("verbose") }, { oQuiet, "quiet", 0, N_("be somewhat more quiet") }, { oSh, "sh", 0, N_("sh-style command output") }, @@ -191,8 +192,9 @@ static ARGPARSE_OPTS opts[] = { { oIgnoreCacheForSigning, "ignore-cache-for-signing", 0, N_("do not use the PIN cache when signing")}, - { oAllowMarkTrusted, "allow-mark-trusted", 0, - N_("allow clients to mark keys as \"trusted\"")}, + { oNoAllowMarkTrusted, "no-allow-mark-trusted", 0, + N_("disallow clients to mark keys as \"trusted\"")}, + { oAllowMarkTrusted, "allow-mark-trusted", 0, "@"}, { oAllowPresetPassphrase, "allow-preset-passphrase", 0, N_("allow presetting passphrase")}, { oAllowLoopbackPinentry, "allow-loopback-pinentry", 0, @@ -523,7 +525,7 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread) opt.max_passphrase_days = MAX_PASSPHRASE_DAYS; opt.enable_passhrase_history = 0; opt.ignore_cache_for_signing = 0; - opt.allow_mark_trusted = 0; + opt.allow_mark_trusted = 1; opt.disable_scdaemon = 0; disable_check_own_socket = 0; return 1; @@ -583,6 +585,7 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread) case oIgnoreCacheForSigning: opt.ignore_cache_for_signing = 1; break; case oAllowMarkTrusted: opt.allow_mark_trusted = 1; break; + case oNoAllowMarkTrusted: opt.allow_mark_trusted = 0; break; case oAllowPresetPassphrase: opt.allow_preset_passphrase = 1; break; @@ -1008,7 +1011,7 @@ main (int argc, char **argv ) GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME); es_printf ("ignore-cache-for-signing:%lu:\n", GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME); - es_printf ("allow-mark-trusted:%lu:\n", + es_printf ("no-allow-mark-trusted:%lu:\n", GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME); es_printf ("disable-scdaemon:%lu:\n", GC_OPT_FLAG_NONE|GC_OPT_FLAG_RUNTIME); diff --git a/agent/trustlist.c b/agent/trustlist.c index 7829f01c8..e8f8fff39 100644 --- a/agent/trustlist.c +++ b/agent/trustlist.c @@ -774,7 +774,8 @@ agent_marktrusted (ctrl_t ctrl, const char *name, const char *fpr, int flag) } else es_fputs (nameformatted, fp); - es_fprintf (fp, "\n%s%s %c\n", yes_i_trust?"":"!", fprformatted, flag); + es_fprintf (fp, "\n%s%s %c%s\n", yes_i_trust?"":"!", fprformatted, flag, + flag == 'S'? " relax":""); if (es_ferror (fp)) err = gpg_error_from_syserror (); diff --git a/tools/gpgconf-comp.c b/tools/gpgconf-comp.c index e97c7bd51..490699439 100644 --- a/tools/gpgconf-comp.c +++ b/tools/gpgconf-comp.c @@ -542,8 +542,8 @@ static gc_option_t gc_options_gpg_agent[] = { "ignore-cache-for-signing", GC_OPT_FLAG_RUNTIME, GC_LEVEL_BASIC, "gnupg", "do not use the PIN cache when signing", GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT }, - { "allow-mark-trusted", GC_OPT_FLAG_RUNTIME, - GC_LEVEL_ADVANCED, "gnupg", "allow clients to mark keys as \"trusted\"", + { "no-allow-mark-trusted", GC_OPT_FLAG_RUNTIME, + GC_LEVEL_ADVANCED, "gnupg", "disallow clients to mark keys as \"trusted\"", GC_ARG_TYPE_NONE, GC_BACKEND_GPG_AGENT }, { "no-grab", GC_OPT_FLAG_RUNTIME, GC_LEVEL_EXPERT, "gnupg", "do not grab keyboard and mouse", |