gpg2-2.2.27-150300.3.5.1 < > , ȉ bgp9|)#
KF8x):.1zQ icg5)2n8W=滾VO䇼
P0C;70R$#c;8WA!wU3nV 8Ra />vjPWҔ YV]`9)V`@u+\rx*AN *Uݵ>9JϘXa2~W{ϲ@i(( \yL) > F T, ? T d d L P \ ` y H u u u
u u u
! u # u % u ( (8 u * *P ( * ( . ( ( / 8 / f 9 0 f : 8 f > * B * F * G * u H , u I . u X / Y /, Z /x [ /| \ / u ] 1X u ^ 6 b 8j c 9 d 9 e 9 f 9 l 9 u 9 u v ; w K u x M u y OT z S S S S S S S T C gpg2 2.2.27 150300.3.5.1 File encryption, decryption, signature creation and verification utility GnuPG is a hybrid-encryption software program; it uses a combination
of symmetric-key and public-key cryptography to encrypt/decrypt
messages and/or to sign and verify them.
gpg2 provides GPGSM, gpg-agent, and a keybox library. bgs390zl36 w(SUSE Linux Enterprise 15 SUSE LLC GPL-3.0-or-later https://www.suse.com/ Productivity/Networking/Security https://www.gnupg.org linux s390x
[ -x /usr/bin/udevadm ] && /usr/bin/udevadm control --reload || :
8 i x y IP M @ Z B a ) 4 F " ; 6 * 4
S &
#5 @ u
o 55 o EG 2 ee
h F g *% ] 5 - # /
t A큤큤A큤A큤A큤A큤A큤 bgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbg__-bgbgYbgbg_bgbgYYbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgYYYYY_ ]bgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbgbg 7ef8e2439b8b51bc5612c44a5f0572f7684b1185abe3b306343d83b708ff48e1 b1860300c17c1450f29db9afbf7643f7ed67ad541058d01a629d2b0063eb78cd ee32b8f2d8d1fbea254e22711ad8f366ee3d663c3d7dc80c35700eede4b3ee73 64546df30c276b4f6d6d24bbf2303fc01170c489d69d5ce5d1842518fea8de3d 5b27e336feb0802048937645e9dd469ecf4443c1bf8332314784982a50b3151a 1a396f7aba06efef6c769338613fe3eada9582b473d3df7b5bec6ea27d16b5b7 7f553bd7928e9595071e4b283014e7250d4d831c937f853c3fbabe76883117f3 a54fcd8f156b0eae057046aacf1657f7a6513c12d4d616582f6196724be7398d e8c33d67b132c1157b8bb91761b19953a33b060e08ae8076295fc305d5719d4e 37ed44d21c0c32c065cdb67d2a06c6f7ab55f0660c73680277d85274375d62d5 488f3b1e3cd4960c09434f2fdc4f36b669ce86527fa410c53b4102611e3dd216 732811bbff2df2881c87d01a829c60b4005921622aaed742d4f786c1a8043340 96bab16ecec87317ee628ba6629a103adcd0b04de2a3faca9fdce8347c065585 cab8111feeb48f34ddc521b763ede921f08a51f5d79755d3f1aaa5e4a579a5f7 9cc33c1a3ec26ca66392c7a6f2fa5148c5b0797d5355f69be7b1ee2cc861110c 3886e3d91c5ae8c91579495fc5f1c5088aa7f8822865c5cb7c6c6170fc48390b 997051959a1d444cf2b6d5940de145b65713df233de4d40f291875651810cdfb 85ed2b83663b171562b65414383f077871289f9339c27a5e208fbfcc04c7e2c5 54d77ee91bb353c6d7d933997927092cb9b4e40b7c5e4dff05ff208f8312835e 67c9b128a8fcd514e8f4fc29fd4efc4cf5023d24b995e742a016246792cb9f1f 8781fa5e1f7422a113ccb5ebb7732935546666fab5bef7997139d91da6fa292e 138a2292355d6fad13f7c5904a86345a85e2da0c5408f410069e465f0e91384b f038f9525fa205e19477e31f57772981e87f85f7e2d84348ddadf49d3c67ba4b fd3dd5e998504628720e5047af75f2af198f016bc75ee5f8f6eabd735972cfe2 2e507b4d7501929936ce2ae872c7e78995d033c96d4304df7c73f691bfda0dae 3296cadeb96c348c61f3b0b69b8e59766b1fbab48bd38abb67ace798d8f89c65 81d3fc685437e0411bcc51cde6d95bf6c41b810ff639221cea7194b57ea95193 51dfd51b4c955304ed6e2e7dc0c1973ef07ba2d38d6a3bd1308dbaefce249e36 cea9b5471b42903ab926fde217ca84b423e8905bd3bd4ad88bdcd356e42a28ea 3b5367b76118c5ca94a566f3dcbddf0672dc729251e7829f8e2f683f562f3e6b 4c3a7d8d243e8f1026036228b13888c3075d12f23a4cc9d8eba48a1def49f8c3 2a196c18e82ef9c6e5b36c9f2290dbdaf5499e7d01aca6ef111d7f5c333e5d33 3eb46482eee09813d2f45cb369392dc7396d53f5c1b1694580024a19a1e6742b e83d5a52e0dd8d1c9690751c88056f28fffbbc004f2fea7b28bf4cea8471cf04 926eadf7ea1e7925885143847e786a3893fd07caf1c8c33ae96ae8ab98973595 ea4762bca1c48e8cf3ff515d27b81a61e9083dc78a96ae0d27febe071ed40e94 54385c2f6a5e8eefc5b89c42c85481f6faa27c975124ed315fcc522d614a945f daa215a26149058730f3b4872176b993aaac3d4a3f3b71505de12cb048d1ca06 07ecee6223ee967ad7a083467c9c91a759e8d431aac1989e7e87775cbfeb33a0 2b271f0903675bd8a86b9387c1318b3d5e613fba42bd462039f81bab9417d9d8 7023ddc73500b5ac7c140c2f1581b8e00f7669602a37c1a62a17255d3d9be55a 71abb857cdf892ae49b77f7332acf232962d148cc729e9f264c4a3c2792669f0 89e6ecc40a426a016be845f8c450bab6edb45a070dd8451d10a5a8638a52b741 20d82de3dbb976a1f2f3a42bfab5136874a32508f55a4a2ebf2f462197f564e1 ea441cf584f22765926aa3619387bd730fd2a5d7937ec3413372950c6bd43d85 894cfb7aaa5e75092ad738cd6b3cb1b2ac05c6082ae89071ef38d25558ba289e cea4b6b204d6b6701407c67ae1a1a8452e11593ea7f1e9805272f6c31c725213 97fc8122e45a2cac3f1a7708ac30cf4256cd0f19258fa56a292c206e81788126 8ea489a57edb0db9394bf2d6c0ec62205f881bb54efb919e4870209c7db01aa7 5ed1ff1e351db978cfa581c6e11278e685099a8195cbe68a7754a4165a169985 267092aca5a090b4f4b824f856b07be5f8fa96fc4d5c1d9e0e4f6f93bc780ab8 2a357d0a910db6bdb0ba1f905b887d8fa5dc52edc6cfed2523b456f99acafb2b 05cdf5a33891882a1b96e007c0ac8dc9f99592f3667f79d83904a38e38e8bbe2 bf3782730db603ef4bddba546330d7d69b211c22213adc6d3791e2a8802f35fe db9a70fce6bed52532b856323f4d4a6a47b7def90f83d145e5757c2ebf2c36ad 8d89ec6367705a10152ba4f82a0e623851beeb031d097dd47e731f692bc03574 abad0bbc97849bf71917ca59f579db0a7caea436f523ab592294b4ce80826c4b 3eeea50fdd123a14d07b0df485cf390facfc1954b0ea82c8ae0d2c175393dff9 d8b7ecd6463697591c771a71aaccdc3daac5c90325990fd491b2967396287895 d75e4557580c0f681a5507ac7b3c0e64365f8ce6d5b37dc6221964631ac69c8a 563af5e649fbe9eddc91461543dce1a2376c019afb2a8f78fc7e7d3e6e3b0453 1c44b176a46cc16b4fbd200b42c6f9d93c054fec1ec9bb3750b3e44e0d464ef5 cbc2f41b6550d1c933158caac917a3fb8b967c0a6cd10af534ad31c3b0a4f87c 2f941a1b6e5b5172fddc4ac62a112cb3d7981dbcbcc5de3f706084210e35d265 9a2898d1358e4faef974ceb3c515b214fb63e1e30c9fc75d18b4dec1e6fb1350 6fba5ee88300f8599c18bacb0b5bbf6518c16c03b536e8ee12b832fe7bc72686 bb6d9916028dd5a14e6ef45d5724ceac4906b1ed5275b6d49e9460006435afbc 9c51e8863bee4699fff0bce77ff5aad420daee802b30d92633705f509a933502 a83cde33912331f7d68cd1074997e95ce3c57c27185424cdb84d98d460a9e2dc 7bc19422e1c5031a034042ea6e6b8d5ec81857ff9ee4605e505a40105227f90e 1b745d2293bdfa5154ce1278236ac258f442caee7d328317c7e475880c261edb 0666ee848e03a48f3ea7bb008dbe9d63dfde280af82fb4412a04bf4e24cab36b a287cf68aea767b91b753716bbd2eabb1cf1869e1fc1e93f2b1a47fbf8a347e7 4357b598a7633c8bcf2cf2dcbc1f4c69371e60d7c7915a131851d8df6c95e259 190e4a4859529bd50f01d9b0f5a9cb7a4ec5661ee17dff748f625d731baafa3c bc2d6664f6276fa0a72d57633b3ae68dc7dcb677b71018bf08c8e93e509f1357 ec4a7d97de212428cd53e09e0524616f0f584528e0698203fb4d71d6c55b48c5 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 d31a714a7ab67eb95ccae12b701e74fe307d771682f8792af7ed4e1ba33074a6 b40f7806e14dd7aad5e0254c04c61bf1212de37296f1cd5782ffbc9e98cbee87 909878b98dc2eaf3b07bbe1694ecd9f0523b7a621467c508d55daf28e0408be1 f8f5f655457d1936fb1bd78389613ba3dcde225a6acde958f4a6a544e2ff337b a82146aca44c717c2155b7e5560eb08719eaf1cd327dd3ad8537a68f21a353f5 c9a46ad9116fd1a2305a84f76e3cc2a90fd9142bf4c1d0ae4706bc0e5121d9ba ff3e57801a9034287e9e724eeffa01f5175905992aa5b8103ed217896c22405b 3ac1aebfa93e4ae3e94e362bc25173e4fb788092c43e21f4608d47ad642e6966 ac8787e1c24cc908413de020eb7a59cbce4ee224c1b25d596d3b90e324853a12 6cd9cf7ddb63fc385efbaa7f7472fe6ef02c064a6e5201fcec59c7ba872df500 c9d8c6e36dcafcc1e3a6839fe7450e665afda68dd046da0002cccb8f0d542666 4f9df889a4f9fca1b0f3fb4a3525593e197b5a2e77bba95d3ee50b5c31f35f81 7e5d971e4ff1aced538c32f6e070d916f4c1cea28b9907886f59001ae40eaaa5 0bb364cf56744777f4b533520cb78d1239d2dc8a62bdebdb69aafeb4abdd0197 18ae805f31c2e9dc7dc6cba6f9da4fc7820077706743087f7b15a8f796cb8c11 cb4e884eff47c8dc04353e693dd7a7d5081359f0d34876b6f525a2c0bf874bf5 f9b8303073d207d8d550bcaf7b87855f8664db90841c5e8acb8519edbca2c739 2db833db5a522b0d80f6b4782a633011522eec873f0dcddaf83ab37ca94f437a c678a4e773d29d53496b8cf89632bbcba36b6cec688590016674fcdf0e1d394e 46bf03b1462df09f9837eea84922ad8c493d42b0a6c8af8982fa0e70f42fa009 gpg2 gpgv2 help.be.txt help.be.txt help.be.txt help.be.txt help.be.txt help.be.txt help.be.txt help.be.txt help.be.txt gpg2.1.gz gpgv2.1.gz root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root gpg2-2.2.27-150300.3.5.1.src.rpm config(gpg2) gnupg gpg gpg2 gpg2(s390-64) gpg2_signd_support newpg @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @
/bin/sh /bin/sh config(gpg2) libassuan.so.0()(64bit) libassuan.so.0(LIBASSUAN_1.0)(64bit) libassuan0 libbz2.so.1()(64bit) libc.so.6()(64bit) libc.so.6(GLIBC_2.15)(64bit) libc.so.6(GLIBC_2.17)(64bit) libc.so.6(GLIBC_2.2)(64bit) libc.so.6(GLIBC_2.25)(64bit) libc.so.6(GLIBC_2.3)(64bit) libc.so.6(GLIBC_2.3.3)(64bit) libc.so.6(GLIBC_2.3.4)(64bit) libc.so.6(GLIBC_2.4)(64bit) libc.so.6(GLIBC_2.7)(64bit) libdl.so.2()(64bit) libdl.so.2(GLIBC_2.2)(64bit) libgcrypt.so.20()(64bit) libgcrypt.so.20(GCRYPT_1.6)(64bit) libgcrypt20 libgpg-error.so.0()(64bit) libgpg-error.so.0(GPG_ERROR_1.0)(64bit) libksba libksba.so.8()(64bit) libksba.so.8(KSBA_0.9)(64bit) libnpth.so.0()(64bit) libnpth.so.0(NPTH_1.0)(64bit) libpthread.so.0()(64bit) libpthread.so.0(GLIBC_2.2)(64bit) libreadline.so.7()(64bit) libsqlite3.so.0()(64bit) libusb-1.0.so.0()(64bit) libz.so.1()(64bit) pinentry rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 2.2.27-150300.3.5.1 2.5.0 1.8.0 1.3.5 3.0.4-1 4.6.0-1 4.0-1 5.2-1 4.14.3 bK@b@`3_@_@_@_P_O@_N7_
@_^m@^^t@^ku^M#@^g@^]@]e@]@]m]5@]'$]
#\\@\@\\u*@\d\,\@[%@[@[ [@[Xf@[H@[o[oZK@Z̧@ZZ@ZZ;@Z@Z@YYYY{'@Y @Y@XX@XX @XAXs{@X_XY @X0>W@W@WWW]@W.@WWbWP W)@VV_V%@Vd#@Va@VTQ@VO @VU@U5@U'U@UU~@Uyx@UXUQ@U) U @U
@TgTD@TMT@T~@TuTa@T[bdavid.anes@suse.com meissner@suse.com pmonreal@suse.com andreas.stieger@gmx.de andreas.stieger@gmx.de andreas.stieger@gmx.de andreas.stieger@gmx.de pmonreal@suse.com andreas.stieger@gmx.de pmonrealgonzalez@suse.com andreas.stieger@gmx.de pmonrealgonzalez@suse.com pmonrealgonzalez@suse.com andreas.stieger@gmx.de fvogt@suse.com pmonrealgonzalez@suse.com pmonrealgonzalez@suse.com pmonrealgonzalez@suse.com andreas.stieger@gmx.de pmonrealgonzalez@suse.com pmonrealgonzalez@suse.com lnussel@suse.de pmonrealgonzalez@suse.com pmonrealgonzalez@suse.com jsikes@suse.de pmonrealgonzalez@suse.com pmonrealgonzalez@suse.com kbabioch@suse.de kbabioch@suse.de pmonrealgonzalez@suse.com kbabioch@suse.de pmonrealgonzalez@suse.com atoptsoglou@suse.com crrodriguez@opensuse.org kbabioch@suse.com bwiedemann@suse.com kbabioch@suse.com tchvatal@suse.com astieger@suse.com kbabioch@suse.com kbabioch@suse.com astieger@suse.com kbabioch@suse.com kbabioch@suse.com astieger@suse.com fvogt@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com marco.strigl@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com jengelh@inai.de astieger@suse.com tchvatal@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com tchvatal@suse.com astieger@suse.com astieger@suse.com pjanouch@suse.de astieger@suse.com astieger@suse.com astieger@suse.com vcizek@suse.com p.drouand@gmail.com astieger@suse.com vcizek@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com astieger@suse.com schwab@linux-m68k.org astieger@suse.com astieger@suse.com meissner@suse.com astieger@suse.com astieger@suse.com idonmez@suse.com astieger@suse.com astieger@suse.com astieger@suse.com andreas.stieger@gmx.de dev@stellardeath.org andreas.stieger@gmx.de andreas.stieger@gmx.de vcizek@suse.com vcizek@suse.com - Security fix [CVE-2022-34903, bsc#1201225]
- Vulnerable to status injection
- Added patch gnupg-CVE-2022-34903.patch - gnupg-detect_FIPS_mode.patch: use AES as default cipher instead
of 3DES if we are in FIPS mode. (bsc#1196125) - Update gpg2 for SLE15-SP3 [jsc#SLE-17559, bsc#1182572]
- Remove patches fixed upstream:
* gnupg-gpg-agent-ssh-agent.patch
* gnupg-2.2.22-fix-segv-import-keys.patch
* gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch
* gnupg-CRL-fetching-via-https.patch
* gnupg-CVE-2018-1000858.patch
* gnupg-CVE-2018-12020.patch
* gnupg-CVE-2019-13050_0_of_5.patch
* gnupg-CVE-2019-13050_1_of_5.patch
* gnupg-CVE-2019-13050_2_of_5.patch
* gnupg-CVE-2019-13050_3_of_5.patch
* gnupg-CVE-2019-13050_4_of_5.patch
* gnupg-CVE-2019-13050_5_of_5.patch
* gnupg-CVE-2019-14855.patch
- Update gpg2.keyring - GnuPG 2.2.27:
* gpgconf: Fix case with neither local nor global gpg.conf
* gpgconf: Fix description of two new options
- includes changes from 2.2.26:
* gpg: New AKL method "ntds"
* gpg: Fix --trusted-key with fingerprint arg
* scd: Fix writing of ECC keys to an OpenPGP card
* scd: Make an USB error fix specific to SPR532 readers
* dirmngr: With new LDAP keyservers store the new attributes.
Never store the useless pgpSignerID. Fix a long standing
bug storing some keys on an ldap server.
* dirmngr: Support the new Active Direcory LDAP schema for
keyservers
* dirmngr: Allow LDAP OpenPGP searches via fingerprint
* dirmngr: Do not block other threads during keyserver LDAP calls
* Support global configuration files
* Fix the iconv fallback handling to UTF-8 - GnuPG 2.2.25:
* scd: Fix regression in 2.2.24 requiring gpg --card-status
before signing or decrypting
* gpgsm: Using Libksba 1.5.0 signatures with a rarely used
combination of attributes can now be verified - GnuPG 2.2.24:
* gpg: New command --quick-revoke-sig
* gpg: Do not use weak digest algos if selected by recipient
preference during sign+encrypt
* gpg: Switch to AES256 for symmetric encryption in de-vs mode
* gpg: Silence weak digest warnings with --quiet
* gpg: Print new status line CANCELED_BY_USER for a cancel during
symmetric encryption
* gpg: Fix the encrypt+sign hash algo preference selection for
ECDSA. This is in particular needed for keys created from
existing smartcard based keys
* agent: Fix secret key import of GnuPG 2.3 generated Ed25519
keys
* agent: Keep some permissions of private-keys-v1.d
* dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and
gnutls builds
* dirmngr: Fix the pool keyserver case for a single host in the
pool
* scd: Fix the use case of verify_chv2 by CHECKPIN
* scd: Various improvements to the ccid-driver
* scd: Minor fixes for Yubikey
* gpgconf: New option --show-versions
* i18n: Complete overhaul and completion of the Italian
translation - GnuPG 2.2.23:
* gpg: fix AHEAD preference list overflow boo#1176034 / CVE-2020-25125
* gpg: fix possible segv in the key cleaning code
* gpgsm: fix a minor RFC2253 parser gub
* scdaemon: Fix a PIN verify failure on certain OpenPGP card
implementations - Fix segv importing certain keys (e.g. ed25519). [bsc#1176034]
- Add gnupg-2.2.22-fix-segv-import-keys.patch - GnuPG 2.2.22:
* gpg: Change the default key algorithm to rsa3072
* gpg: Add regular expression support for Trust Signatures on
all platforms
* gpg: Ignore --personal-digest-prefs for ECDSA keys
* gpgsm: Make rsaPSS a de-vs compliant scheme
* gpgsm: Show also the SHA256 fingerprint in key listings
* gpgsm: Do not require a default keyring for --gpgconf-list
* gpg-agent: Default to extended key format and record the
creation time of keys
Add new option --disable-extended-key-format
* gpg-agent: Support the WAYLAND_DISPLAY envvar
* gpg-agent: Allow using --gpgconf-list even if HOME does not
exist
* gpg-agent: Make the Pinentry work even if the envvar TERM is
set to the empty string
* scdaemon: Add a workaround for Gnuk tokens <= 2.15 which
wrongly incremented the error counter when using the
"verify" command of "gpg --edit-key" with only the signature
key being present
* dirmngr: Better handle systems with disabled IPv6
* gpgpslit: Install tool. It was not installed in the past to
avoid conflicts with the version installed by GnuPG 1.4
* gpgtar: Make --files-from and --null work as documented
- drop gnupg-gpgme-t-encrypt-sym.patch, upstream - Fix regression in latest gpg2 that makes gpgme fail to build [bsc#1174007]
- Add gnupg-gpgme-t-encrypt-sym.patch - GnuPG 2.2.21:
* gpg: Improve symmetric decryption speed by about 25%
* gpg: Support decryption of AEAD encrypted data packets
* gpg: Add option --no-include-key-block
* gpg: Allow for extra padding in ECDH
* gpg: Only a single pinentry is shown for symmetric encryption if
the pinentry supports this
* gpg: Print a note if no keys are given to --delete-key
* gpg,gpgsm: The ridiculous passphrase quality bar is not anymore
shown
* gpgsm: Certificates without a CRL distribution point are now
considered valid without looking up a CRL. The new option
- -enable-issuer-based-crl-check can be used to revert to the
former behaviour
* gpgsm: Support rsaPSS signature verification
* gpgsm: Unless CRL checking is disabled lookup a missing issuer
certificate using the certificate's authorityInfoAccess
* gpgsm: Print the certificate's serial number also in decimal
notation
* gpgsm: Fix possible NULL-deref in messages of --gen-key
* scd: Support the CardOS 5 based D-Trust Card 3.1
* dirmngr: Allow http URLs with "LOOKUP --url"
* wkd: Take name of sendmail from configure. Fixes an OpenBSD
specific bug - Fix warning: agent returned different signature type ssh-rsa
* The gpg-agent's ssh-agent does not handle flags in signing
requests properly [bsc#1161268, bsc#1172308]
* Add gnupg-gpg-agent-ssh-agent.patch - Fix gpgme and gpgme-qt builds on gpg2 2.2.20 update [bsc#1170811]
- Refresh patches:
* gnupg-2.2.8-files-are-digests.patch
* gnupg-add_legacy_FIPS_mode_option.patch - GnuPG 2.2.20:
* Protect the error counter against overflow to guarantee that the
tools can't be tricked into returning success after an error
* gpg: Make really sure that --verify-files always returns an error
* gpg: Fix key listing --with-secret if a pattern is given
* gpg: Fix detection of certain keys used as default-key
* gpg: Fix default-key selection when a card is available
* gpg: Fix key expiration and key usage for keys created with a
creation date of zero
* gpgsm: Fix import of some CR,LF terminated certificates
* gpg: New options --include-key-block and --auto-key-import to
allow encrypted replies after an initial signed message
* gpg: Allow the use of a fingerprint with --trusted-key
* gpg: New property "fpr" for use by --export-filter
* scdaemon: Disable the pinpad if a KDF DO is used
* dirmngr: Improve finding OCSP certificates
- drop gpg2-gcc10-build-fno-common.patch, upstream - Split dirmngr into a subpackage to avoid a hard dependency of
gpg2 on libgnutls - Fix build with GCC-10: [bsc#1160394]
* Always use EXTERN_UNLESS_MAIN_MODULE pattern
* In GCC-10, the default option -fcommon will change to -fno-common
- Add gpg2-gcc10-build-fno-common.patch - Accept key updates even without UIDs [bsc#1143158]
- Add patches:
* gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch
* gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch
* gnupg-add-test-cases-for-import-without-uid.patch - Security fix: [bsc#1157900, CVE-2019-14855, jsc#SLE-16534]
* Web of Trust forgeries using collisions in SHA-1 signatures
* Ignore all SHA-1 signatures in 3rd party key signatures.
* Forbid the creation of SHA-1 third-party key signatures.
* Add option --allow-weak-key-signatures
- Add gnupg-CVE-2019-14855.patch - update to 2.2.19:
* gpg: Fix double free when decrypting for hidden recipients
* gpg: Use auto-key-locate for encryption even for mail addressed
given with angle brackets
* gpgsm: Add special case for certain expired intermediate
certificates - Update to 2.2.18 [bsc#1157900, CVE-2019-14855]
* gpg: Changed the way keys are detected on a smartcards; this
allows the use of non-OpenPGP cards. In the case of a not very
likely regression the new option --use-only-openpgp-card is
available. [#4681]
* gpg: The commands --full-gen-key and --quick-gen-key now allow
direct key generation from supported cards. [#4681]
* gpg: Prepare against chosen-prefix SHA-1 collisions in key
signatures. This change removes all SHA-1 based key signature
newer than 2019-01-19 from the web-of-trust. Note that this
includes all key signature created with dsa1024 keys. The new
option --allow-weak-key-signatues can be used to override the new
and safer behaviour. [#4755,CVE-2019-14855]
* gpg: Improve performance for import of large keyblocks. [#4592]
* gpg: Implement a keybox compression run. [#4644]
* gpg: Show warnings from dirmngr about redirect and certificate
problems (details require --verbose as usual).
* gpg: Allow to pass the empty string for the passphrase if the
'--passphase=' syntax is used. [#4633]
* gpg: Fix printing of the KDF object attributes.
* gpg: Avoid surprises with --locate-external-key and certain
- -auto-key-locate settings. [#4662]
* gpg: Improve selection of best matching key. [#4713]
* gpg: Delete key binding signature when deletring a subkey.
[#4665,#4457]
* gpg: Fix a potential loss of key sigantures during import with
self-sigs-only active. [#4628]
* gpg: Silence "marked as ultimately trusted" diagnostics if
option --quiet is used. [#4634]
* gpg: Silence some diagnostics during in key listsing even with
option --verbose. [#4627]
* gpg, gpgsm: Change parsing of agent's pkdecrypt results. [#4652]
* gpgsm: Support AES-256 keys.
* gpgsm: Fix a bug in triggering a keybox compression run if
- -faked-system-time is used.
* dirmngr: System CA certificates are no longer used for the SKS
pool if GNUTLS instead of NTBTLS is used as TLS library. [#4594]
* dirmngr: On Windows detect usability of IPv4 and IPv6 interfaces
to avoid long timeouts. [#4165]
* scd: Fix BWI value for APDU level transfers to make Gemalto Ezio
Shield and Trustica Cryptoucan work. [#4654,#4566]
* wkd: gpg-wks-client --install-key now installs the required policy
file.
- Rebase patches:
* gnupg-2.2.8-files-are-digests.patch
* gnupg-add_legacy_FIPS_mode_option.patch - Remove self-buildrequire [bsc#1152755] - Do not recommend lang package. The lang package already has a
supplements. - Security fix: [bsc#1141093, CVE-2019-13050]
* Denial of service attacks via big keys
* Added patches:
- gnupg-CVE-2019-13050_0_of_5.patch
- gnupg-CVE-2019-13050_1_of_5.patch
- gnupg-CVE-2019-13050_2_of_5.patch
- gnupg-CVE-2019-13050_3_of_5.patch
- gnupg-CVE-2019-13050_4_of_5.patch
- gnupg-CVE-2019-13050_5_of_5.patch - Update to 2.2.17 [bsc#1141093]
* gpg: Do not try the import fallback if the options are already used.
* gpg: Fix regression in option "self-sigs-only".
* gpg: With --auto-key-retrieve prefer WKD over keyservers.
* gpg: Add "self-sigs-only" and "import-clean" to the keyserver options.
* gpg: Avoid printing false AKL error message.
* gpg: New command --locate-external-key.
* gpg: Make the get_pubkey_byname interface easier to understand.
* gpg: Fallback to import with self-sigs-only on too large keyblocks.
* gpg: New import and keyserver option "self-sigs-only"
* gpg: Make read_block in import.c more flexible.
* dirmngr: fix handling of HTTPS redirections during HKP.
* dirmngr: Avoid endless loop in case of HTTP error 503.
* dirmngr: Do not rewrite the redirection for the "openpgpkey" subdomain.
* dirmngr: Support the new WKD draft with the openpgpkey subdomain.
* wkd: Change client/server limit back to 64 KiB.
* tools: gpgconf: Killing order is children-first.
* Return better error code for some getinfo IPC commands.
* po: Update Russian translation. - Fix secure memory being disabled before fips checks in libgcrypt [boo#1137307]
* Added gnupg-2.2.16-secmem.patch - Update to 2.2.16
* gpg: Fixed i18n markup of some strings.
* gpg: Allow deletion of subkeys with --delete-[secret-]key.
* gpg: Do not bail on an invalid packet in the local keyring.
* gpg: Do not allow creation of user ids larger than our parser allows.
* gpg: Do not delete any keys if --dry-run is passed.
* gpg: Fix using --decrypt along with --use-embedded-filename.
* gpg: Improve the photo image viewer selection.
* gpg: enable OpenPGP export of cleartext keys with comments.
* gpg: Do not print a hint to use the deprecated --keyserver option.
* gpg: Change update_keysig_packet to replace SHA-1 by SHA-256.
* gpg: Use just the addrspec from the Signer's UID.
* gpg: Accept also armored data from the WKD.
* gpg: Set a limit of 5 to the number of keys imported from the WKD.
* gpg: Don't use EdDSA algo ID for ECDSA curves.
* agent: Stop scdaemon after reload when disable_scdaemon.
* agent: For SSH key, don't put NUL-byte at the end.
* agent: correct length for uri and comment on 64-bit big-endian platforms
* dirmngr: Allow for other hash algorithms than SHA-1 in OCSP.
* dirmngr: Improve domaininfo cache update algorithm.
* dirmngr: Better error code for http status 413.
* g10: Fix possible null dereference.
* g10: Fix double free when locating by mbox.
* g10: Fix symmetric cipher algo constant for ECDH.
* sm: Avoid confusing diagnostic for the default key.
* sm: Fix a warning in an es_fopencooie function.
* gpgconf: Before --launch check that the config file is fine.
* gpgconf: Support --homedir for --launch.
* build: Update m4/iconv.m4.
* doc: correct documentation for gpgconf --kill.
* scd: Add dummy option --application-priority.
* common: Fix AWK portability. - Allow coredumps in X11 desktop sessions (bsc#1124847)
gpg-agent unconditionally disables coredumps, which is not
supposed to happen in the code path that does just exec(argv[])
* Added gnupg-gpg-agent-ulimit.patch - Update to 2.2.15
* sm: Allow decryption even if expired keys are configured.
* agent: Change command KEYINFO to print ssh fingerprints with other
hash algos.
* dirmngr: Fix build problems on Solaris due to the use of reserved
symbol names.
* wkd: New commands --print-wkd-hash and --print-wkd-url for
gpg-wks-client. - Update to 2.2.14:
* gpg: Allow import of PGP desktop exported secret keys. Also avoid
importing secret keys if the secret keyblock is not valid.
* gpg: Do not error out on version 5 keys in the local keyring.
* gpg: Make invalid primary key algo obvious in key listings.
* sm: Do not mark a certificate in a key listing as de-vs compliant
if its use for a signature will not be possible.
* sm: Fix certificate creation with key on card.
* sm: Create rsa3072 bit certificates by default.
* sm: Print Yubikey attestation extensions with --dump-cert.
* agent: Fix cancellation handling for scdaemon.
* agent: Support --mode=ssh option for CLEAR_PASSPHRASE.
* scd: Fix flushing of the CA-FPR DOs in app-openpgp.
* scd: Avoid a conflict error with the "undefined" app.
* dirmngr: Add CSRF protection exception for protonmail.
* dirmngr: Fix build problems with gcc 9 in libdns.
* gpgconf: New option --show-socket for use wity --launch.
* gpgtar: Make option -C work for archive creation.
- Removed patches that are included upstream by now:
- 0001-libdns-Avoid-using-compound-literals.patch
- 0002-libdns-Avoid-using-compound-literals-2.patch
- 0003-libdns-Avoid-using-compound-literals-3.patch
- 0004-libdns-Avoid-using-compound-literals-4.patch
- 0005-libdns-Avoid-using-compound-literals-5.patch
- 0006-libdns-Avoid-using-compound-literals-6.patch
- 0007-libdns-Avoid-using-compound-literals-7.patch
- 0008-libdns-Avoid-using-compound-literals-8.patch - Fix build with gcc9 [bsc#1121223]
* Avoid using compound literals
- Upstream bug: https://dev.gnupg.org/T4367
* Added upstream patches:
- 0001-libdns-Avoid-using-compound-literals.patch
- 0002-libdns-Avoid-using-compound-literals-2.patch
- 0003-libdns-Avoid-using-compound-literals-3.patch
- 0004-libdns-Avoid-using-compound-literals-4.patch
- 0005-libdns-Avoid-using-compound-literals-5.patch
- 0006-libdns-Avoid-using-compound-literals-6.patch
- 0007-libdns-Avoid-using-compound-literals-7.patch
- 0008-libdns-Avoid-using-compound-literals-8.patch - Update to 2.2.13:
* gpg: Implement key lookup via keygrip (using the & prefix).
* gpg: Allow generating Ed25519 key from existing key.
* gpg: Emit an ERROR status line if no key was found with -k.
* gpg: Stop early when trying to create a primary Elgamal key.
* gpgsm: Print the card's key algorithms along with their keygrips
in interactive key generation.
* agent: Clear bogus pinentry cache in the error case.
* scd: Support "acknowledge button" feature.
* scd: Fix for USB INTERRUPT transfer.
* wks: Do no use compression for the the encrypted challenge and response.
Release-info: https://dev.gnupg.org/T4290
See-also: gnupg-announce/2019q1/000434.html - Security fix: [bsc#1120346, CVE-2018-1000858]
* Cross Site Request Forgery (CSRF) vulnerability in dirmngr that
can result in Attacker controlled CSRF.
* Added patches:
- gnupg-CRL-fetching-via-https.patch
- gnupg-Allow-redirection-from-https-to-http-for-CRLs.patch
- gnupg-CVE-2018-1000858.patch - Update to 2.2.12:
* tools: New commands --install-key and --remove-key for
gpg-wks-client. This allows to prepare a Web Key Directory on a
local file system for later upload to a web server.
* gpg: New --list-option "show-only-fpr-mbox". This makes the use
of the new gpg-wks-client --install-key command easier on Windows.
* gpg: Improve processing speed when --skip-verify is used.
* gpg: Fix a bug where a LF was accidentally written to the console.
* gpg: --card-status now shwos whether a card has the new KDF
feature enabled.
* agent: New runtime option --s2k-calibration=MSEC. New configure
option --with-agent-s2k-calibration=MSEC. [#3399]
* dirmngr: Try another keyserver from the pool on receiving a 502,
503, or 504 error. [#4175]
* dirmngr: Avoid possible CSRF attacks via http redirects. A HTTP
query will not anymore follow a 3xx redirect unless the Location
header gives the same host. If the host is different only the
host and port is taken from the Location header and the original
path and query parts are kept.
* dirmngr: New command FLUSHCRL to flush all CRLS from disk and
memory. [#3967] - Code no longer uses libcurl, remove from buildrequires. - Update to 2.2.11:
* gpgsm: Fix CRL loading when intermediate certicates are not yet trusted.
* gpgsm: Fix an error message about the digest algo.
* gpg: Fix a wrong warning due to new sign usage check introduced with 2.2.9.
* gpg: Print the "data source" even for an unsuccessful keyserver query.
* gpg: Do not store the TOFU trust model in the trustdb.
* scd: Fix cases of "Bad PIN" after using "forcesig".
* agent: Fix possible hang in the ssh handler.
* dirmngr: Tack the unmodified mail address to a WKD request.
* dirmngr: Tweak diagnostic about missing LDAP server file.
* dirmngr: In verbose mode print the OCSP responder id.
* dirmngr: Fix parsing of the LDAP port.
* wks: Add option --directory/-C to the server.
* wks: Add option --with-colons to the client.
* Fix EBADF when gpg et al. are called by broken CGI scripts.
* Fix some minor memory leaks and bugs. - Make package build reproducible (boo#1047218) - Update to 2.2.10:
* Refresh expired keys originating from the WKD
* Use a 256 KiB limit for a WKD imported key
* New option --known-notation
* dirmngr: Validate SRV records in WKD queries - Add basic udev rules for smartcards to be used with
scdaemon, taken from debian:
* scdaemon.udev - GnuPG 2.2.9:
* dirmngr: Fix recursive resolver mode and other bugs in the
libdns code
* dirmngr: When using libgpg-error 1.32 or later a GnuPG build
with NTBTLS support does not anymore block for dozens of
seconds before returning data.
* gpg: Fix bug in --show-keys which actually imported revocation
certificates
* gpg: Ignore too long user-ID and comment packets
* gpg: Fix crash due to bad German translation. Improved printf
format compile time check.
* gpg: Handle missing ISSUER sub packet gracefully in the presence of
the new ISSUER_FPR
* gpg: Allow decryption using several passphrases in most cases.
* gpg: Command --show-keys now enables the list options
show-unusable-uids, show-unusable-subkeys, show-notations and
show-policy-urls by default.
* gpg: Command --show-keys now prints revocation certificates.
* gpg: Add revocation reason to the "rev" and "rvs" records of the
option --with-colons. [#1173]
* gpg: Export option export-clean does now remove certain expired
subkeys; export-minimal removes all expired subkeys.
* gpg: New "usage" property for the drop-subkey filters. - Added gnupg-CVE-2018-12020.patch: Sanitize the diagnostic output of the
original file name in verbose mode (bsc#1096745, CVE-2018-12020). - Update to version 2.2.8:
* gpg: Decryption of messages not using the MDC mode will now lead to a
hard failure even if a legacy cipher algorithm was used. The option
- -ignore-mdc-error can be used to turn this failure into a warning. Take
care: Never use that option unconditionally or without a prior warning.
* gpg: The MDC encryption mode is now always used regardless of the
cipher algorithm or any preferences. For testing --rfc2440 can be
used to create a message without an MDC.
* gpg: Sanitize the diagnostic output of the original file name in
verbose mode (bsc#1096745, CVE-2018-12020)
* gpg: Detect suspicious multiple plaintext packets in a more reliable way.
* gpg: Fix the duplicate key signature detection code.
* gpg: The options --no-mdc-warn, --force-mdc, --no-force-mdc,
- -disable-mdc and --no-disable-mdc have no more effect.
* agent: Add DBUS_SESSION_BUS_ADDRESS and a few other envvars to the
list of startup environment variables.
- Refresh gnupg-2.0.18-files-are-digests.patch
to gnupg-2.2.8-files-are-digests.patch - GnuPG 2.2.7:
* gpg: New option --no-symkey-cache to disable the passphrase
cache for symmetrical en- and decryption.
* gpg: The ERRSIG status now prints the fingerprint if that is
part of the signature
* gpg: Relax emitting of FAILURE status lines
* gpg: Add a status flag to "sig" lines printed with --list-sigs
* gpg: Fix "Too many open files" when using --multifile
* ssh: Return an error for unknown ssh-agent flags
* dirmngr: Fix a CNAME problem with pools and TLS. Also use a
fixed mapping of keys.gnupg.net to sks-keyservers.net
* dirmngr: Try resurrecting dead hosts earlier (from 3h to 1.5h)
* dirmngr: Fallback to CRL if no default OCSP responder is
configured
* dirmngr: Implement CRL fetching via https. Here a redirection
to http is explictly allowed
* agent,dirmngr: New sub-command "getenv" for "getinfo" to ease
debugging - GnuPG 2.2.6:
* gpg,gpgsm: New option --request-origin to pretend requests coming
from a browser or a remote site.
* gpg: Fix race condition on trustdb.gpg updates due to too early
released lock.
* gpg: Emit FAILURE status lines in almost all cases.
* gpg: Implement --dry-run for --passwd to make checking a key's
passphrase straightforward.
* gpg: Make sure to only accept a certification capable key for key
signatures.
* gpg: Better user interaction in --card-edit for the factory-reset
sub-command.
* gpg: Improve changing key attributes in --card-edit by adding an
explicit "key-attr" sub-command.
* gpg: Print the keygrips in the --card-status.
* scd: Support KDF DO setup.
* scd: Fix suspend/resume handling in the CCID driver.
* agent: Evict cached passphrases also via a timer.
* agent: Use separate passphrase caches depending on the request
origin.
* ssh: Support signature flags.
* dirmngr: Handle failures related to missing IPv6 support
gracefully.
* Allow the use of UNC directory names as homedir. [#3818]
- Dropped gnupg-CVE-2018-9234.patch since it is included upstream - Added gnupg-CVE-2018-9234.patch: Enforce that key certification
can only be done with the master key, and not a signing subkey.
(bnc#1088255 CVE-2018-9234) - GnuPG 2.2.5:
* gpg: Allow the use of the "cv25519" and "ed25519" short names
in addition to the canonical curve names in --batch --gen-key
* gpg: Make sure to print all secret keys with option --list-only
and --decrypt
* gpg: Fix the use of future-default with --quick-add-key for
signing keys
* gpg: Select a secret key by checking availability under
gpg-agent
* gpg: Fix reversed prompt texts for --only-sign-text-ids
* gpg,gpgsm: Fix detection of bogus keybox blobs on 32 bit
systems
* gpgsm: Fix regression since 2.1 in --export-secret-key-raw
which got $d mod (q-1)$ wrong
* scd: Support the KDF Data Object of the OpenPGP card 3.3
* scd: Fix a regression in the internal CCID driver for certain
card readers
* dirmngr: Improve returned error description on failure of DNS
resolving
* wks: Implement command --install-key for gpg-wks-server. - Use %license (boo#1082318) - GnuPG 2.2.4:
* gpg: Change default preferences to prefer SHA512.
* gpg: Print a warning when more than 150 MiB are encrypted using
a cipher with 64 bit block size.
* gpg: Print a warning if the MDC feature has not been used for a
message.
* gpg: Fix regular expression of domain addresses in trust
signatures
* agent: New option --auto-expand-secmem to help with high
numbers of concurrent connections. Requires libgcrypt 1.8.2
for having an effect.
* dirmngr: Cache responses of WKD queries.
* gpgconf: Add option --status-fd.
* wks: Add commands --check and --remove-key to gpg-wks-server
* Increase the backlog parameter of the daemons to 64 and add
option --listen-backlog.
- Not enabled features:
* New configure option --enable-run-gnupg-user-socket to first
try a socket directory which is not removed by systemd at
session end. - GnuPG 2.2.3:
* dirmngr: Fix crash in case of a CRL loading error
* gpgtar: Fix wrong behaviour of --set-filename
* gpg: Silence AKL retrieval messages
* agent: Use clock or clock_gettime for calibration
* agent: Improve robustness of the shutdown pending state - GnuPG 2.2.2:
* gpg: Avoid duplicate key imports by concurrently running gpg
processes
* gpg: Fix creating on-disk subkey with on-card primary key
* gpg: Fix validity retrieval for multiple keyrings
* gpg: Fix --dry-run and import option show-only for secret keys
* gpg: Print "sec" or "sbb" for secret keys with import option
import-show
* gpg: Make import less verbose
* gpg: Add alias "Key-Grip" for parameter "Keygrip" and new
parameter "Subkey-Grip" to unattended key generation
* gpg: Improve "factory-reset" command for OpenPGP cards
* gpg: Ease switching Gnuk tokens into ECC mode by using the magic
keysize value 25519
* gpgsm: Fix --with-colon listing in crt records for fields > 12.
* gpgsm: Do not expect X.509 keyids to be unique
* agent: Fix stucked Pinentry when using --max-passphrase-days
* agent: New option --s2k-count
* dirmngr: Do not follow https-to-http redirects
* dirmngr: Reduce default LDAP timeout from 100 to 15 seconds
* gpgconf: Ignore non-installed components for commands
- -apply-profile and --apply-defaults
* Add configure option --enable-werror - GnuPG 2.2.1:
* gpg: Fix formatting of the user id in batch mode key generation
if only "name-email" is given.
* gpgv: Fix annoying "not suitable for" warnings.
* wks: Convey only the newest user id to the provider. This is
the case if different names are used with the same addr-spec.
* wks: Create a complying user id for provider policy mailbox-only.
* wks: Add workaround for posteo.de.
* scd: Fix the use of large ECC keys with an OpenPGP card.
* dirmngr: Use system provided root certificates if no specific
HKP certificates are configured. If bu - GnuPG 2.2.0:
* New long term stable branch, replacing the 2.0.x series
* gpg: Reverted change in 2.1.23 so that --no-auto-key-retrieve
is again the default boo#1054088
* Fixed a few minor bugs - GnuPG 2.1.23:
* gpg: Options --auto-key-retrieve and --auto-key-locate "local,wkd"
are now used by default. Note: this enables keyserver and Web Key
Directory operators to notice when a signature from a locally
non-available key is being verified for the first time or when
you intend to encrypt to a mail address without having the key
locally. This new behaviour will eventually make key discovery
much easier and mostly automatic. Disable this by adding
no-auto-key-retrieve
auto-key-locate local
to your gpg.conf.
* agent: Option --no-grab is now the default. The new option --grab
allows to revert this.
* gpg: New import option "show-only".
* gpg: New option --disable-dirmngr to entirely disable network
access for gpg.
* gpg,gpgsm: Tweaked DE-VS compliance behaviour.
* New configure flag --enable-all-tests to run more extensive tests
during "make check".
* gpgsm: The keygrip is now always printed in colon mode as
documented in the man page. - GnuPG 2.1.22:
* gpg: Extend command --quick-set-expire to allow for setting the
expiration time of subkeys.
* gpg: By default try to repair keys during import. New sub-option
no-repair-keys for --import-options.
* gpg,gpgsm: Improved checking and reporting of DE-VS compliance.
* gpg: New options --key-origin and --with-key-origin. Store the
time of the last key update from keyservers, WKD, or DANE.
* agent: New option --ssh-fingerprint-digest.
* dimngr: Lower timeouts on keyserver connection attempts and made
it configurable.
* dirmngr: Tor will now automatically be detected and used. The
option --no-use-tor disables Tor detection.
* dirmngr: Now detects a changed /etc/resolv.conf.
* agent,dirmngr: Initiate shutdown on removal of the GnuPG home
directory.
* gpg: Avoid caching passphrase for failed symmetric encryption.
* agent: Support for unprotected ssh keys.
* dirmngr: Fixed name resolving on systems using only v6
nameservers.
* dirmngr: Allow the use of TLS over http proxies.
* wks: New man pages for client and server. - GnuPG 2.1.21:
* modified gnupg-2.0.18-files-are-digests.patch to work with
obs-sign again bsc#1039899 - GnuPG 2.1.21:
* gpg,gpgsm: Fix corruption of old style keyring.gpg files,
regression in 2.1.20
* gpg,dirmngr: Removed the skeleton config file support
New installations no longer generate a configuration file.
In the absence of a file, SHA-2 family hashes are used.
Existing configurations are not touched.
drop gnupg-2.1.19-stronger-defaults.patch FATE#323084
* gpg: Fixed import filter property match bug.
* scd: Removed Linux support for Cardman 4040 PCMCIA reader.
* scd: Fixed some corner case bugs in resume/suspend handling.
* Many minor bug fixes and code cleanup. - GnuPG 2.1.20:
* gpg: New properties 'expired', 'revoked', and 'disabled' for the
import and export filters.
* gpg: New command --quick-set-primary-uid.
* gpg: New compliance field for the --with-colon key listing.
* gpg: Changed the key parser to generalize the processing of local
meta data packets.
* gpg: Fixed assertion failure in the TOFU trust model.
* gpg: Fixed exporting of zero length user ID packets.
* scd: Improved support for multiple readers.
* scd: Fixed timeout handling for key generation.
* agent: New option --enable-extended-key-format.
* dirmngr: Do not add a keyserver to a new dirmngr.conf. Dirmngr
uses a default keyserver.
* dimngr: Do not treat TLS warning alerts as severe error when
building with GNUTLS.
* dirmngr: Actually take /etc/hosts in account.
* wks: Fixed client problems on Windows. Published keys are now set
to world-readable.
* tests: Fixed creation of temporary directories.
* A socket directory for a non standard GNUGHOME is now created on
the fly under /run/user. Thus "gpgconf --create-socketdir" is now
optional. The use of "gpgconf --remove-socketdir" to clean up
obsolete socket directories is however recommended to avoid
cluttering /run/user with useless directories.
* Fixed build problems on some platforms. - Use stronger defaults for new users, using SHA-2 digest family
for certificates and message signatures - FATE#323084
adding gnupg-2.1.19-stronger-defaults.patch - GnuPG 2.1.19:
* gpg: Print a warning if Tor mode is requested but the Tor
daemon is not running.
* gpg: New status code DECRYPTION_KEY to print the actual private
key used for decryption.
* gpgv: New options --log-file and --debug.
* gpg-agent: Revamp the prompts to ask for card PINs.
* scd: Support for multiple card readers.
* scd: Removed option --debug-disable-ticker. Ticker is used
only when it is required to watch removal of device/card.
* scd: Improved detection of card inserting and removal.
* dirmngr: New option --disable-ipv4.
* dirmngr: New option --no-use-tor to explicitly disable the use
of Tor.
* dirmngr: The option --allow-version-check is now required even
if the option --use-tor is also used.
* dirmngr: Handle a missing nsswitch.conf gracefully.
* dirmngr: Avoid PTR lookups for keyserver pools. The are only
done for the debug command "keyserver --hosttable".
* dirmngr: Rework the internal certificate cache to support
classes of certificates. Load system provided certificates on
startup.
* Add options --tls, --no-crl, and --systrust to the "VALIDATE"
command.
* dirmngr: Add support for the ntbtls library.
* wks: Create mails with a "WKS-Phase" header. Fix detection of
Draft-2 mode.
* Many other bug fixes and new regression tests.
- dirmngr: use system certificate store - Rewrite descriptions - GnuPG 2.1.18:
* gpg: Remove bogus subkey signature while cleaning a key (with
export-clean, import-clean, or --edit-key's sub-command clean)
* gpg: Allow freezing the clock with --faked-system-time.
* gpg: New --export-option flag "backup", new --import-option flag
"restore".
* gpg-agent: Fixed long delay due to a regression in the progress
callback code.
* scd: Lots of code cleanup and internal changes.
* scd: Improved the internal CCID driver.
* dirmngr: Fixed problem with the DNS glue code (removal of the
trailing dot in domain names).
* dirmngr: Make sure that Tor is actually enabled after changing the
conf file and sending SIGHUP or "gpgconf --reload dirmngr".
* dirmngr: Fixed Tor access to IPv6 addresses. Note that current
versions of Tor may require that the flag "IPv6Traffic" is used
with the option "SocksPort" in torrc to actually allow IPv6
traffic.
* dirmngr: Fixed HKP for literally given IPv6 addresses.
* dirmngr: Enabled reverse DNS lookups via Tor.
* dirmngr: Added experimental SRV record lookup for WKD.
See commit 88dc3af3d4ae1afe1d5e136bc4c38bc4e7d4cd10 for details.
* dirmngr: For HKP use "pgpkey-hkps" and "pgpkey-hkp" in SRV record
lookups. Avoid SRV record lookup when a port is explicitly
specified. This fixes a regression from the 1.4 and 2.0 behavior.
* dirmngr: Gracefully handle a missing /etc/nsswitch.conf. Ignore
negation terms (e.g. "[!UNAVAIL=return]" instead of bailing out.
* dirmngr: Better debug output for flags "dns" and "network".
* dirmngr: On reload mark all known HKP servers alive.
* gpgconf: Allow keyword "all" for --launch, --kill, and --reload.
* tools: gpg-wks-client now ignores a missing policy file on the
server.
* Avoid unnecessary ambiguity error message in the option parsing.
* Further improvements of the regression test suite.
* Fixed building with --disable-libdns configure option.
* Fixed a crash running the tests on 32 bit architectures.
* Fixed spurious failures on BSD system in the spawn functions.
This affected for example gpg-wks-client and gpgconf. - Remove the fixme, condition around fdupes - add runtime dependency to match runtime version check for libksba - GnuPG 2.1.17:
* gpg: By default new keys expire after 2 years.
* gpg: New command --quick-set-expire to conveniently change the
expiration date of keys.
* gpg: Option and command names have been changed for easier
comprehension. The old names are still available as aliases.
* gpg: Improved the TOFU trust model.
* gpg: New option --default-new-key-algo.
* scd: Support OpenPGP card V3 for RSA.
* dirmngr: Support for the ADNS library has been removed. Now using
bundled libdns, enabling Tor support on all platforms.
New option --standard-resolver can be used to disable this code
at runtime.
* dirmngr: Lazily launch ldap reaper thread.
* tools: New options --check and --status-fd for gpg-wks-client.
* The UTF-8 byte order mark is now skipped when reading conf files.
* Fixed many bugs and regressions.
* Major improvements to the test suite. For example it is possible
to run the external test suite of GPGME. - GnuPG 2.1.16:
* gpg: New algorithm for selecting the best ranked public key when
using a mail address with -r, -R, or --locate-key.
* gpg: New option --with-tofu-info to print a new "tfs" record in
colon formatted key listings.
* gpg: New option --compliance as an alternative way to specify
options like --rfc2440, --rfc4880, et al.
* gpg: Many changes to the TOFU implementation.
* gpg: Improve usability of --quick-gen-key.
* gpg: In --verbose mode print a diagnostic when a pinentry is
launched.
* gpg: Remove code which warns for old versions of gnome-keyring.
* gpg: New option --override-session-key-fd.
* gpg: Option --output does now work with --verify.
* gpgv: New option --output to allow saving the verified data.
* gpgv: New option --enable-special-filenames.
* agent, dirmngr: New --supervised mode for use by systemd and alike.
* agent: By default listen on all available sockets using standard
names.
* agent: Invoke scdaemon with --homedir.
* dirmngr: On Linux now detects the removal of its own socket and
terminates.
* scd: Support ECC key generation.
* scd: Support more card readers.
* dirmngr: New option --allow-version-check to download a software
version database in the background.
* dirmngr: Use system provided CAs if no --hkp-cacert is given.
* dirmngr: Use a default keyserver if none is explicitly set
* gpgconf: New command --query-swdb to check software versions
against an copy of an online database.
* gpgconf: Print the socket directory with --list-dirs.
* tools: The WKS tools now support draft version -02.
* tools: Always build gpg-wks-client and install under libexec.
* tools: New option --supported for gpg-wks-client.
* The log-file option now accepts a value "socket://" to log to the
socket named "S.log" in the standard socket directory.
* Provide fake pinentries for use by tests cases of downstream
developers.
* Fixed many bugs and regressions.
* Many changes and improvements for the test suite.
- drop upstreamed patches:
* 0001-common-Follow-up-to-14479e2-fix-void-return-in-non-v.patch
* gnupg-2.1.15-bsc993324-status-output.patch - avoid mixing up status and colon line output - bsc#993324
add gnupg-2.1.15-bsc993324-status-output.patch - enable web key discovery tools - Add an explicit runtime dependency on libgcrypt >= 1.7.0 to
match runtime version check - GnuPG 2.1.15:
* gpg: Remove the --tofu-db-format option and support for the
split TOFU database.
* gpg: Add option --sender to prepare for coming features.
* gpg: Add option --input-size-hint to help progress indicators.
* gpg: Extend the PROGRESS status line with the counted unit.
* gpg: Avoid publishing the GnuPG version by default with --armor.
* gpg: Properly ignore legacy keys in the keyring cache.
* gpg: Always print fingerprint records in --with-colons mode.
* gpg: Make sure that keygrips are printed for each subkey in
- -with-colons mode.
* gpg: New import filter "drop-sig".
* gpgsm: Fix a bug in the machine-readable key listing.
* gpg,gpgsm: Block signals during keyring updates to limits the
effects of a Ctrl-C at the wrong time.
* g13: Add command --umount and other fixes for dm-crypt.
* agent: Fix regression in SIGTERM handling.
* agent: Cleanup of the ssh-agent code.
* agent: Allow import of overly long keys.
* scd: Fix problems with card removal.
* dirmngr: Remove all code for running as a system service.
* tools: Make gpg-wks-client conforming to the specs.
* tests: Improve the output of the new regression test tool.
* tests: Distribute the standalone test runner.
* tests: Run each test in a clean environment.
* Spelling and grammar fixes.
- fix build error, adding
0001-common-Follow-up-to-14479e2-fix-void-return-in-non-v.patch - GnuPG 2.1.14:
* gpg: Removed options --print-dane-records and --print-pka-records.
The new export options "export-pka" and "export-dane" can instead
be used with the export command.
* gpg: New options --import-filter and --export-filter.
* gpg: New import options "import-show" and "import-export".
* gpg: New option --no-keyring.
* gpg: New command --quick-revuid.
* gpg: New options -f/--recipient-file and -F/--hidden-recipient-file
to directly specify encryption keys.
* gpg: New option --mimemode to indicate that the content is a MIME
part. Does only enable --textmode right now.
* gpg: New option --rfc4880bis to allow experiments with proposed
changes to the current OpenPGP specs.
* gpg: Fix regression in the "fetch" sub-command of --card-edit.
* gpg: Fix regression since 2.1 in option --try-all-secrets.
* gpgv: Change default options for extra security.
* gpgsm: No more root certificates are installed by default.
* agent: "updatestartuptty" does now affect more environment
variables.
* scd: The option --homedir does now work with scdaemon.
* scd: Support some more GEMPlus card readers.
* gpgtar: Fix handling of '-' as file name.
* gpgtar: New commands --create and --extract.
* gpgconf: Tweak for --list-dirs to better support shell scripts.
* tools: Add programs gpg-wks-client and gpg-wks-server to implement
a Web Key Service. The configure option --enable-wks-tools is
required to build them; they should be considered Beta software.
* tests: Complete rework of the openpgp part of the test suite. The
test scripts have been changed from Bourne shell scripts to Scheme
programs. A customized scheme interpreter (gpgscm) is included.
This change was triggered by the need to run the test suite on
non-Unix platforms.
* The rendering of the man pages has been improved.
- drop upstream gnupg-make_--try-all-secrets_work.patch - Fix date call as the curlified parameter for sure are not parsed
correctly by escaping it with % - Fix upstream bug 1985: --try-all-secrets doesn't work when
decrypting messages encrypted with --hidden-recipient, fixes unit
tests of the duplicity package.
Adding gnupg-make_--try-all-secrets_work.patch
- record the fact that gpg-error 1.21 is required - GnuPG 2.1.13:
* gpg: New command --quick-addkey. Extend the --quick-gen-key
command.
* gpg: New --keyid-format "none" which is now also the default.
* gpg: New option --with-subkey-fingerprint.
* gpg: Include Signer's UID subpacket in signatures if the secret key
has been specified using a mail address and the new option
- -disable-signer-uid is not used.
* gpg: Allow unattended deletion of a secret key.
* gpg: Allow export of non-passphrase protected secret keys.
* gpg: New status lines KEY_CONSIDERED and NOTATION_FLAGS.
* gpg: Change status line TOFU_STATS_LONG to use '~' as
a non-breaking-space character.
* gpg: Speedup key listings in Tofu mode.
* gpg: Make sure that the current and total values of a PROGRESS
status line are small enough.
* gpgsm: Allow the use of AES192 and SERPENT ciphers.
* dirmngr: Adjust WKD lookup to current specs.
* dirmngr: Fallback to LDAP v3 if v2 is is not supported.
* gpgconf: New commands --create-socketdir and --remove-socketdir,
new option --homedir.
* If a /run/user/$UID directory exists, that directory is now used
for IPC sockets instead of the GNUPGHOME directory. This fixes
problems with NFS and too long socket names and thus avoids the
need for redirection files.
* Speedup fd closing after a fork.
- drop upstreamed gnupg-fix-signature-checking.patch - add gnupg-fix-signature-checking.patch (bsc#981020)
https://bugs.gnupg.org/gnupg/issue2351 - GnuPG 2.1.12:
* gpg: New --edit-key sub-command "change-usage" for testing
purposes.
* gpg: Out of order key-signatures are now systematically detected
and fixed by --edit-key.
* gpg: Improved detection of non-armored messages.
* gpg: Removed the extra prompt needed to create Curve25519 keys.
* gpg: Improved user ID selection for --quick-sign-key.
* gpg: Use the root CAs provided by the system with --fetch-key.
* gpg: Add support for the experimental Web Key Directory key
location service.
* gpg: Improve formatting of Tofu messages and emit new Tofu specific
status lines.
* gpgsm: Add option --pinentry-mode to support a loopback pinentry.
* gpgsm: A new pubring.kbx is now created with the header blob so
that gpg can detect that the keybox format needs to be used.
* agent: Add read support for the new private key protection format
openpgp-s2k-ocb-aes.
* agent: Add read support for the new extended private key format.
* agent: Default to --allow-loopback-pinentry and add option
- -no-allow-loopback-pinentry.
* scd: Changed to use the new libusb 1.0 API for the internal CCID
driver.
* dirmngr: The dirmngr-client does now auto-detect the PEM format.
* g13: Add experimental support for dm-crypt.
* The man pages for gpg and gpgv are now installed under the correct
name (gpg2 or gpg - depending on a configure option). - GnuPG 2.1.11:
* gpg: New command --export-ssh-key to replace the gpgkey2ssh tool.
* gpg: Allow to generate mail address only keys with --gen-key.
* gpg: "--list-options show-usage" is now the default.
* gpg: Make lookup of DNS CERT records holding an URL work.
* gpg: Emit PROGRESS status lines during key generation.
* gpg: Don't check for ambigious or non-matching key specification in
the config file or given to --encrypt-to. This feature will return
in 2.3.x.
* gpg: Lock keybox files while updating them.
* gpg: Fix possible keyring corruption. (bug#2193)
* gpg: Fix regression of "bkuptocard" sub-command in --edit-key and
remove "checkbkupkey" sub-command introduced with 2.1. (bug#2169)
* gpg: Fix internal error in gpgv when using default keyid-format.
* gpg: Fix --auto-key-retrieve to work with dirmngr.conf configured
keyservers. (bug#2147).
* agent: New option --pinentry-timeout.
* scd: Fix regression for generating RSA keys on card.
* dirmmgr: All configured keyservers are now searched.
* dirmngr: Install CA certificate for hkps.pool.sks-keyservers.net.
Use this certiticate even if --hkp-cacert is not used.
* gpgtar: Add actual encryption code. gpgtar does now fully replace
gpg-zip.
* gpgtar: Fix filename encoding problem on Windows.
* Print a warning if a GnuPG component is using an older version of
gpg-agent, dirmngr, or scdaemon.
- disable running test which no longer work
- remove 0001-gpg-Improve-the-keyblock-cache-s-transparency.patch
is now upstream
- the PIE options are implemented in the upstream build, and spec
code broke the build. The only remaining broken executable was
gpgsplit, which was removed from the package - add g13, an experimental tool for accessing encrypted storage
with with GnuPG (cards) - fix fingerprint ambiguity (bsc#958891)
* https://bugs.gnupg.org/gnupg/issue2198
* add 0001-gpg-Improve-the-keyblock-cache-s-transparency.patch - Move to pkgconfig() packaging style - GnuPG 2.1.10 adds TOFU (Trust-On-First-USe) and anonymous key
retrival via Tor.
* gpg: New trust models "tofu" and "tofu+pgp".
* gpg: New command --tofu-policy. New options --tofu-default-policy
and --tofu-db-format.
* gpg: New option --weak-digest to specify hash algorithms which
should be considered weak.
* gpg: Allow the use of multiple --default-key options; take the last
available key.
* gpg: New option --encrypt-to-default-key.
* gpg: New option --unwrap to only strip the encryption layer.
* gpg: New option --only-sign-text-ids to exclude photo IDs from key
signing.
* gpg: Check for ambigious or non-matching key specification in the
config file or given to --encrypt-to.
* gpg: Show the used card reader with --card-status.
* gpg: Print export statistics and an EXPORTED status line.
* gpg: Allow selecting subkeys by keyid in --edit-key.
* gpg: Allow updating the expiration time of multiple subkeys at
once.
* dirmngr: New option --use-tor. For full support this requires
libassuan version 2.4.2 and a patched version of libadns
(e.g. adns-1.4-g10-7 as used by the standard Windows installer).
* dirmngr: New option --nameserver to specify the nameserver used in
Tor mode.
* dirmngr: Keyservers may again be specified by IP address.
* dirmngr: Fixed problems in resolving keyserver pools.
* dirmngr: Fixed handling of premature termination of TLS streams so
that large numbers of keys can be refreshed via hkps.
* gpg: Fixed a regression in --locate-key [since 2.1.9].
* gpg: Fixed another bug for keyrings with legacy keys.
* gpgsm: Allow combinations of usage flags in --gen-key.
* Make tilde expansion work with most options.
* Many other cleanups and bug fixes. - enable tests for PPC64 again,
the problem from bsc#935887 went away - Improve upgrade to gpg2 from security:privacy w.r.t. libassuan
run-time dependencies (boo#955982) - GnuPG 2.1.9:
* gpg: Allow fetching keys via OpenPGP DANE (--auto-key-locate).\
New option --print-dane-records.
* gpg: Fix for a problem with PGP-2 keys in a keyring.
* gpg: Fail with an error instead of a warning if a modern cipher
algorithm is used without a MDC.
* agent: New option --pinentry-invisible-char.
* agent: Always do a RSA signature verification after creation.
* agent: Fix a regression in ssh-add-ing Ed25519 keys.
* agent: Fix ssh fingerprint computation for nistp384 and EdDSA.
* agent: Fix crash during passprase entry on some platforms.
* scd: Change timeout to fix problems with some 2.1 cards.
* dirmngr: Displayed name is now Key Acquirer.
* dirmngr: Add option --keyserver. Deprecate that option for gpg.
Install a dirmngr.conf file from a skeleton for new installations.
- update gnupg-add_legacy_FIPS_mode_option.patch for context change - GnuPG 2.1.8:
* gpg: Sending very large keys to the keyservers works again.
* gpg: Validity strings in key listings are now again translatable.
* gpg: Emit FAILURE status lines to help GPGME.
* gpg: Does not anymore link to Libksba to reduce dependencies.
* gpgsm: Export of secret keys via Assuan is now possible.
* agent: Raise the maximum passphrase length from 100 to 255 bytes.
* agent: Fix regression using EdDSA keys with ssh.
* Does not anymore use a build timestamp by default.
* The fallback encoding for broken locale settings changed
from Latin-1 to UTF-8.
* Many code cleanups and improved internal documentation.
* Various minor bug fixes. - GnuPG 2.1.7:
* gpg: Support encryption with Curve25519 if Libgcrypt 1.7 is used.
* gpg: In the --edit-key menu: Removed the need for "toggle", changed
how secret keys are indicated, new commands "fpr *" and "grip".
* gpg: More fixes related to legacy keys in a keyring.
* gpgv: Does now also work with a "trustedkeys.kbx" file.
* scd: Support some feature from the OpenPGP card 3.0 specs.
* scd: Improved ECC support
* agent: New option --force for the DELETE_KEY command.
* Dropped deprecated gpgsm-gencert.sh
* Various other bug fixes. - do not run checks on ppc64 for now - GnuPG 2.1.6:
* agent: New option --verify for the PASSWD command.
* gpgsm: Add command option "offline" as an alternative to
- -disable-dirmngr.
* gpg: Do not prompt multiple times for a password in pinentry
loopback mode.
* Allow the use of debug category names with --debug.
* Using gpg-agent and gpg/gpgsm with different locales will now show
the correct translations in Pinentry.
* gpg: Improve speed of --list-sigs and --check-sigs.
* gpg: Make --list-options show-sig-subpackets work again.
* gpg: Fix an export problem for old keyrings with PGP-2 keys.
* scd: Support PIN-pads on more readers.
* dirmngr: Properly cleanup zombie LDAP helper processes and avoid
hangs on dirmngr shutdown.
* Various other bug fixes.
- remove documentation make workaround, fixed upstream - Enable workaround for missing dependencies everywhere - fix build with openSUSE 13.2 and earlier, call make to
compensate for incorrect documentation dependencies. - GnuPG 2.1.5:
* Support for an external passphrase cache.
* Support for the forthcoming version 3 OpenPGP smartcard.
* Manuals now show the actual used file names.
* Prepared for improved integration with Emacs.
* Code cleanups and minor bug fixes. - info deinstall needs to be in %preun - update to 2.1.4:
* gpg: Add command --quick-adduid to non-interacitivly add a new
user id to an existing key.
* gpg: Do no enable honor-keyserver-url by default. Make it work
if enabled.
* gpg: Display the serial number in the --card-staus output again.
* agent: Support for external password managers.
Add option --no-allow-external-cache.
* scdaemon: Improved handling of extended APDUs.
* Make HTTP proxies work again.
* All network access including DNS as been moved to Dirmngr.
* Allow building without LDAP support.
* Fixed lots of smaller bugs. - update to 2.1.3:
* gpg: LDAP keyservers are now supported by 2.1.
* gpg: New option --with-icao-spelling.
* gpg: New option --print-pka-records. Changed the PKA method to
use CERT records and hashed names.
* gpg: New command --list-gcrypt-config. New parameter "curve"
for --list-config.
* gpg: Print a NEWSIG status line like gpgsm always did.
* gpg: Print MPI values with --list-packets and --verbose.
* gpg: Write correct MPI lengths with ECC keys.
* gpg: Skip legacy PGP-2 keys while searching.
(drop 0001-gpg-Skip-legacy-keys-while-searching-keyrings.patch
now upstream)
* gpg: Improved searching for mail addresses when using a keybox.
* gpgsm: Changed default algos to AES-128 and SHA-256.
* gpgtar: Fixed extracting files with sizes of a multiple of 512.
* dirmngr: Fixed SNI handling for hkps pools.
(drop hkps-fix-host-name-verification-when-using-pools.patch
now upstream)
* dirmngr: extra-certs and trusted-certs are now always loaded
from the sysconfig dir instead of the homedir.
* Fixed possible problems due to compiler optimization, two minor
regressions, and other bugs.
- refreshed for context changes:
* gnupg-2.0.18-files-are-digests.patch
* gnupg-add_legacy_FIPS_mode_option.patch - Add hkps-fix-host-name-verification-when-using-pools.patch to
fix hkps support w/ pools. Upstream commit dc10d46. - Ensure secure memory can be used with default 64k memlock limit
Fixes [boo#915931], removes gnupg-large_keys.patch
- Removed gnupg-remove_development_version_warning.patch, obsolete
- Removed gnupg-2.0.4-install_tools.diff, replaced by spec install
- Removed autoconf requirement and autoreconf calls thus obsoleted - Fix invalid packet read error when reading keyrings [boo#914625]
add 0001-gpg-Skip-legacy-keys-while-searching-keyrings.patch - update to 2.1.2:
* gpg: The parameter 'Passphrase' for batch key generation works
again.
* gpg: Using a passphrase option in batch mode now has the
expected effect on --quick-gen-key.
* gpg: Improved reporting of unsupported PGP-2 keys.
* gpg: Added support for algo names when generating keys using
- -command-fd.
* gpg: Fixed DoS based on bogus and overlong key packets.
* agent: When setting --default-cache-ttl the value
for --max-cache-ttl is adjusted to be not lower than the former.
* agent: Fixed problems with the new --extra-socket.
* agent: Made --allow-loopback-pinentry changeable with gpgconf.
* agent: Fixed importing of unprotected openpgp keys.
* agent: Now tries to use a fallback pinentry if the standard
pinentry is not installed.
* scd: Added support for ECDH.
* Fixed several bugs related to bogus keyrings and improved some
other code.
- in gnupg-2.0.18-files-are-digests.patch, change buffer_to_u32 to
buf32_to_u32 from host2net.h to match upstream changes
- now requires automake 1.14 - update to 2.1.1:
* gpg: Detect faulty use of --verify on detached signatures.
* gpg: New import option "keep-ownertrust".
* gpg: New sub-command "factory-reset" for --card-edit.
* gpg: A stub key for smartcards is now created by --card-status.
* gpg: Fixed regression in --refresh-keys.
* gpg: Fixed regresion in %g and %p codes for --sig-notation.
* gpg: Fixed best matching hash algo detection for ECDSA and EdDSA.
* gpg: Improved perceived speed of secret key listisngs.
* gpg: Print number of skipped PGP-2 keys on import.
* gpg: Removed the option aliases --throw-keyid and --notation-data;
use --throw-keyids and --set-notation instead.
* gpg: New import option "keep-ownertrust".
* gpg: Skip too large keys during import.
* gpg,gpgsm: New option --no-autostart to avoid starting gpg-agent or
dirmngr.
* gpg-agent: New option --extra-socket to provide a restricted
command set for use with remote clients.
* gpgconf --kill does not anymore start a service only to kill it.
* gpg-pconnect-agent: Add convenience option --uiserver.
* More translations (but most of them are not complete).
* To support remotely mounted home directories, the IPC sockets may
now be redirected. This feature requires Libassuan 2.2.0.
* Improved portability and the usual bunch of bug fixes.
- removed patch not part of upstream release:
gnupg-2.1.0-boo-907198-openpgp_oid_to_str-buffer-overflow.patch
- refresh for context changes:
gnupg-2.0.18-files-are-digests.patch
gnupg-2.0.4-install_tools.diff
- refresh for upstream code changes:
gnupg-add_legacy_FIPS_mode_option.patch
gnupg-detect_FIPS_mode.patch (MD5 removed) - Support for large RSA keys
This involves compiling with --enable-large-rsa and
- -enable-large-secmem, as well as patching the number
of secmem bytes and IPC bytes to slightly larger values.
See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739424
* added gnupg-large_keys.patch - update build requirement versions that changed with 2.1.0 - fix buffer overflow in OID to string conversion function
[boo#907198], adding
gnupg-2.1.0-boo-907198-openpgp_oid_to_str-buffer-overflow.patch - obsolete dirmngr (shipped with gpg since 2.1.0)
- spec cleanup after previous update
- get rid of "THIS IS A DEVELOPMENT VERSION" warning
http://lists.gnupg.org/pipermail/gnupg-devel/2014-November/029065.html
* added gnupg-remove_development_version_warning.patch - upgrade to 2.1.0 (modern)
- The file "secring.gpg" is not anymore used to store the secret
keys. Merging of secret keys is now supported.
- All support for PGP-2 keys has been removed for security reasons.
- The standard key generation interface is now much leaner. This
will help a new user to quickly generate a suitable key.
- Support for Elliptic Curve Cryptography (ECC) is now available.
- Commands to create and sign keys from the command line without any
extra prompts are now available.
- The Pinentry may now show the new passphrase entry and the
passphrase confirmation entry in one dialog.
- There is no more need to manually start the gpg-agent. It is now
started by any part of GnuPG as needed.
- Problems with importing keys with the same long key id have been
addressed.
- The Dirmngr is now part of GnuPG proper and also takes care of
accessing keyserver.
- Keyserver pools are now handled in a smarter way.
- A new format for locally storing the public keys is now used.
This considerable speeds up operations on large keyrings.
- Revocation certificates are now created by default.
- Card support has been updated, new readers and token types are
supported.
- The format of the key listing has been changed to better identify
the properties of a key.
- The gpg-agent may now be used on Windows as a Pageant replacement
for Putty in the same way it is used for years on Unix as
ssh-agent replacement.
- Creation of X.509 certificates has been improved. It is now also
possible to export them directly in PKCS#8 and PEM format for use
on TLS servers.
- dropped patches:
* gnupg-2.0.20-automake113.diff
* gnupg-2.0.18-tmpdir.diff (socket is created in homedir now)
- refresh most of the remaining patches
- added new BuildRequires: gnutls-devel, pkg-config, npth-devel /bin/sh gpg s390zl36 1658152915
! " # % & ' ( ) + , - . / 0 1 2 3 4 5 6 7 8 9 : ; @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n q r s t u v w x y z { | } ~ 2.2.27-150300.3.5.1 2.2.27 1.4.9 2.2.27-150300.3.5.1 2.2.27-150300.3.5.1 1.4.9
gnupg gpgconf.conf g13 gpg gpg-agent gpg-connect-agent gpg-wks-server gpg-zip gpg2 gpgconf gpgparsemail gpgscm gpgsm gpgsplit gpgtar gpgv gpgv2 kbxutil scdaemon watchgnupg 60-scdaemon.rules gpg-check-pattern gpg-preset-passphrase gpg-protect-tool gpg-wks-client addgnupghome applygnupgdefaults g13-syshelp gpg2 AUTHORS ChangeLog DCO DETAILS FAQ HACKING KEYSERVER NEWS OpenPGP README THANKS TODO TRANSLATE examples Automatic.prf README VS-NfD.prf debug.prf pwpattern.list scd-event systemd-user README gpg-agent-browser.socket gpg-agent-extra.socket gpg-agent-ssh.socket gpg-agent.service gpg-agent.socket trustlist.txt gnupg distsigkey.gpg help.be.txt help.ca.txt help.cs.txt help.da.txt help.de.txt help.el.txt help.eo.txt help.es.txt help.et.txt help.fi.txt help.fr.txt help.gl.txt help.hu.txt help.id.txt help.it.txt help.ja.txt help.nb.txt help.pl.txt help.pt.txt help.pt_BR.txt help.ro.txt help.ru.txt help.sk.txt help.sv.txt help.tr.txt help.txt help.zh_CN.txt help.zh_TW.txt sks-keyservers.netCA.pem gnupg.info-1.gz gnupg.info-2.gz gnupg.info.gz gpg2 COPYING COPYING.CC0 COPYING.GPL2 COPYING.LGPL21 COPYING.LGPL3 COPYING.other gpg-agent.1.gz gpg-connect-agent.1.gz gpg-preset-passphrase.1.gz gpg-wks-client.1.gz gpg-wks-server.1.gz gpg.1.gz gpg2.1.gz gpgconf.1.gz gpgparsemail.1.gz gpgsm.1.gz gpgtar.1.gz gpgv.1.gz gpgv2.1.gz scdaemon.1.gz symcryptrun.1.gz watchgnupg.1.gz gnupg.7.gz addgnupghome.8.gz applygnupgdefaults.8.gz /etc/ /etc/gnupg/ /usr/bin/ /usr/lib/udev/rules.d/ /usr/lib64/ /usr/sbin/ /usr/share/doc/packages/ /usr/share/doc/packages/gpg2/ /usr/share/doc/packages/gpg2/examples/ /usr/share/doc/packages/gpg2/examples/systemd-user/ /usr/share/ /usr/share/gnupg/ /usr/share/info/ /usr/share/licenses/ /usr/share/licenses/gpg2/ /usr/share/man/man1/ /usr/share/man/man7/ /usr/share/man/man8/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:24602/SUSE_SLE-15-SP3_Update/d1f10472daedffd219248235939d6a76-gpg2.SUSE_SLE-15-SP3_Update drpm xz 5 s390x-suse-linux
directory ASCII text ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=f0e85597b26881bbdfb37ac3c44903c2a3542cb8, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=ba4a191ac2b009cda1d62b7b79591a678d550424, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=d9927e387099e18cae6c83c9db9ec0b972078c05, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=736fa70eabd30ba4a26fd47451f283ec9a51eb75, for GNU/Linux 3.2.0, stripped POSIX shell script, ASCII text executable ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=62b09b2a85da4a62295f4e93ab41008ae843bb8d, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=221f3bfb3ede85882ad0be48564331610a64e834, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=fe91dc3dbbbe0204bb5eb1726fcd5a8cdb9a76af, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=c7dbbb4b613b64dbf152f0303e80975e20b5bd1c, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=139bdd3c8b14b51f16a6344807326f8d6152c557, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=96034833f5b3bac44c30dcd2b8fb78f67a016294, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=fd292fa9989f759b2ec3f0c903cb3dfc07883b02, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=3fd066d48df91f02f7b275afcbf08acfd3d67af5, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=5879a2df7693cac73b0b7837fc0f4f4620b7ee3b, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=f1b149c635026d49c0d33289d3d378f4e4af9367, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=4855019cedee01f27194940ea6a83f22d83f8b25, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=3c99049181a10d5416674d14ae44b6638b1d56da, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=38e3e77911124333e3072956d8c4cac7b9219a02, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=1bf00d9edbd3575d4ecaaf4b69c4b79ed4ffb376, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=fac99cad76033697ffb7e00fe3056fb14c10870c, for GNU/Linux 3.2.0, stripped ELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=ae1a4557c44549691fcace449de9c988c806bebf, for GNU/Linux 3.2.0, stripped UTF-8 Unicode text troff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix) troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix) & 5 A B T ` c p
R R R R R R R R
R
R R R R R R R R R R R R R R R R R
R R
R R R R R R R R R R R R R R R R
R
R R R R R R R R R R R R R
R
R R R R R R R R R R
R R R R R R
R R "R R R R R R R R R R R R
R
R R R R R R R R
R R R R R
R R
R R R R R R R R R R R R R
R
R R R R R R R R R R R R R R
R
R R R R R R "R R R R R R R
R
R R R R R R R R R R
R
R R R R "R R R R R R R R R
R
R R R R R R R R R R R R R R R R R
R
R R R R R R R R R R R R !R R R R
R R R R R
R
R R R R R R R R R R R
R
R R R R R R R R R R R R R
R R
R R R R R R R R R R R R R
R
R R R R R R R R R R R R R R R
R
R R R R R R R 1WlQk2N_ dirmngr 2.2.27 utf-8 e3e2042374bbe51d9503c0d400ad1ed5c5826f1366d1b094812cd83ee78abd00 ? 7zXZ
! t/op] "k%H g,#˪!U`RP :.K/#1ISs xXuhG' {=FݴL (Piksܵy?U$E }
ٲ/X_9vm$zxbn (ͫr}B Q!~m '
DΪ"1_iKjۋ
g:1pR`%f[4 @7etʒz!{fLc6q E7H誥wb+0vci\^$>x_pT
sbz4^IȊM
orۼ KOfO"(?4::8T6-`S] g/Ax{0)}PE#SQN]&nL\_;M=b F0DEѺR3mmJu HOX\ փPFu:[ lҒ~z_uYVX\abn
~76#;>)6<+ԡlP73Jix(/5Gor/J=o+SKB%be^)GOkw%ͻ59&-z??_)HmO'wÔ{,9MgDo15_@Dz^1
`XFCϽ-=vIJq,\MF3B4z]TV!=We), ]H i~$ =1hU t[PU湐Pt&0l Z&6E6t+%z(+R+,/ 7pFIuR=uSvҫl V^R\h>٭߁5{O⨮r:ޘ%01[_uw>0/@D-H#["19R!++_5-QuZ!R9$/o{!2(Q˷B4eԛڇe̍ @RȒb;{z'
gTPj ]4{̛ژF54v/5âB1_fe=諫}w\ |(CyaepJ?]yBkXBr:ߢQ-kY6 l 9(>!gԅa>]= >yӞEmͅ%n\rET#R=aMdFC-I >)䠿lP` > č&-0) Wf-Ln*w7^fl'Fc {Zn
l݁Q_*+=`|ND.HbXZ < (WЂ>!ُ/{/ MW -o@i"ٟ'
fiD%),k!lEF) D& {v/F[96c&Avل&决+?/9Oh5_fml[]<@%[p_Ɉk:[oILUPzV{佣gޱ&A!^]g2-
23]SG FbO6T)nG&|~~xRXQ̼ah@ 0]7 状a&[
ZK%J4dhKĸ4tjYaFeO_#=M/ < TNcgLT˒ ej1L|
餵 zL8kt'x\=ٮ\)>ۃ䖹6춒LJ \P
7v3xa8j'-}(}~WhՔ@O+%c[\ Ib3vfS->d (
d+:@ Қ !2GQe Ѣ_/q>O ڼq'5@%rəV3sC/®}4+2<'
?+u qFp\Oς PR)A oz4#:BGVM"E8s[_?5O.\`q7qv["*a8;$ ȍD {=ΉM\gUt j*9 ߏB#sD ^eiXs[4n{ 5,0Tcٰ9;5r-Y\ 챚A+>-Y.S^`6W(qz#.#
{=Pũ7$BƔjlk O(;<WirP#ر-|Fq EK:9p#X1aşH =Pq?-fD&͒amoUPP1Ґ#8"4*)sHM{kY,H?4?Ji2յuvW2Г-P7}u|D}]q Q}WWA6..6 ހyh?`fg|Yt1t5jvP :06Υo>D4h-| 7QӍH^8krbs{hQ{N߉B^,|gU)dgͽƘ^;:mo`}!:uʊ5Ҁ+R[5zMڒXv{#g#FUt1
\p1'GPn
ܑdX"\U;Bsxx3Tgռ`9lg6R'QڧD[x-S~t$([xq\)Ȗ6%(pÌ+?D]DT)F=ш'E<@ TK(j:u%] -Q'cգD\Ay^>Q%=AI ќ6IC q VhYmo?oXg5m_+fW; ۽Snwsꊯ0s=u[ OxY]˒4b3I@\ xwlqakaj֯>NK8+)ƻUM5Ij ^~WBc9+QW3^դWGt.}ZRذ~戍t۰sl|m
-PASiXu[Jgڠ=c7=\? e):z-̒w<Ġ54l&z 3u^^A 8ca+QWGx'QJ=/Z
a
I$i+;;䙸3曩֛G!f1L fEWs "h/~SKBD5uhwg
/ϩ8\Q:uϖ3SɁ咭51 u6fm)ˈ
;ʭ
0 N{ծBvjf\?VO% T9ÿ1_i
E ҸA(ԩxe甆kWnQ6) ft-}͊>NgB}
S]pؓ_BHz]5H߀N#K pՇ^^!=zg 2XI,Ѝ
O#橧uT)L=agȻl>DOo+ʗNgYh zyY=Q[fZXNs2PFaSϾ
XӂUA`>P4R7ȅL"jdxEpT~ S cNUHț'xa ~iPjQ YTkJϺHh@>Dc q6nރ B[1)ohG Ű v\an/ XX2@nb4*PFzNy.NX/ Dԙ ==h; B̽u {K\bd1%d 뱍JXd0ټ;
~y_Eku`kUŨ0G7K9sD1CBl202Bz1
B뀍J1(BvNr;$
Os?duk XOj_ս)@D 7{:5gm &p tIle
EM0i ñ[q¹wͻ6# e6{| w/&h
ge! 7aWZ?O%l8kn7UVS!P-YF
n]$paK Muϔ<^/$E%"w/tD
to\Y-z Zlϟ O9$x/镜G`* KxJ^\, l$ u7"!Ϥʊ
Q *zW:e1B!Tfu6B?ŀ>[v shp%bcEGC ,c*VTMmbl#_s
F3f7j&Ss MH7'lpx&t]{=D(gũ,@v1YΜIkC&mЁ7,S4ybM+Iu۔Yr[#I^뱤4 ސ`Yƌ`&͐MՔ6{=6 N*[>.&\>:~S8}WaQ؉`
&]PLzsJFL+ 74=sR t_~'^ "( bpH
r눨[_8Pt|iBwC>)EVirM)B53Q5cRV_k4} $& kXk%^p !~WŌ$KNJҽ7 5RSǠ6,#jcgZEOӫ4sosrAvLB{Fb^#)-SؕW;@>0myӝ,6)LT"yq*h Ð,촻fo^-C
4 v&E0ݐQJȗj' _aΏ~gv8* !_El:6v9`bR O3 mCec? (4zjnm9CKy \ |e.u(
ű Bl:`?dgZP-H 7Oo5ZG"mq;Sr>" zbXTCK"RDy9TKq6Ad@bGN 2r w +$2c
6#pd$Jüt9@_ z휀] mʧR8+jL
KHDsօ82_ \DihtyV=V,eAj.NRj/ u8p M+wgmV3+QA -kGqdG$jSgJ+VJq_d h9| 'lUQ9Q* K1G Vblu$1D19z?AAZmP=r#p
mUMk;lMd8-z;Rx`RrdR1 .z! ?1A
Rs3&5A}vDno\. y5ʸUF9n4]~ h0 +9{ֶ:&!8lP1( vB C+ Urxt,k-+i `vb{?Qi(ϵ*QD*}9PH٧HFTǫIq %EߊT63~X1Q-U"|C$:r45<r8Fls B3] \Yߪ)z(+&,eW'NnɔCX%oV'3;8u#@QJhբV\g^ N,>ܔITq>exꠋ'$ ,),Hrz*1Yt1>5ࢇڡϕ| !4
b7Ka"x Wb~UfDĦaht,O3OВ8o^`C<o +R::e PWp-^ iϛ&}ϱo cbf3
\{1zkRN9J|HKiB0{aڀP 0^0As S$X|"ȣ\g38νfƪ(Y7Z1N2Toեb(ç%d ۚVaOv|vt\h]i
+_ֳh<{V8$ӹiDbgrs/E:((B|ՈO%q'44{Qf-Zp Tzꃧ +{+KH \`a T ) #==$qgn#ٖ ٧ANƐuP-cQ
GBD65/ K6 ?o 8x9#)Ύ.D9_uh[3ug^}oXOhk<نε qC.53Iꜘ`Tgf0ߖ2pč1X ~^ Qb [Rڗ 5O 9 4z6,7^`q2 M<F=[tVq]sj6kQ ~#A #~p2WPLcHjowiۙo l1ˎ ;iOd<[Z^!~wR[xef f,W)>^}3_Z\ @d@'vJzp'vB~^fY ӿD@ Qš$Y$ o!c0
U5:P^i/^R2`-W ݇l
19V2* uCcc0Ѐk+ gSi`(3.%ǟl[7xRq)Kr6Ir,rF
z9PcM_O!^2;
:B s]@gt5mP$,y~}T̀ZIA
yʄhO/2yo^%HXk%[@I5z2-zhQr5IU_\2K5ė oK+F"z5 Wr枸t܀l;104&oP5ZS8)/GVAO1+Lv~H.W/L8KI7(XU5P¹ X$.wOPL 2uFb .D& yh: 8Xs{<0pOaE- A%"~~ϹuN_ PG?+zT
k7rZ˹}JGg NvHW=Sטͫ,{P1rO2HBl1fzrufM^)Qk(te {C{j8jc ND"SWƊ@.[zя *7<(LHb0Vr a\q(B-@.2tP5t+X $ҔVf<`O} ĸ447Wpd{%Pڍ2kT>_AKBi<Pyk
E_u\~2ԂS@ӦVCM??Aη
\dZ6OPi< 5H .qX̸_z>Gxo
4tXoS:} DC2>F-y~7Ζ8o v鄎=ت0oA~H&'p5-]LLid'N>TP#]X]b@J:I*2*! $S2f
*+·F~uIE*kdp) i
N#٩bPG6* P@N0w*埨g@ ]pUsh[&&< 5ߗ|}SSӏp5݉0 BSM[k?a펠r5EdM1MB |eнvנg,hy ʕ[1k\ =B΄.j*{惧|"L7~t()i 癄e;A2ԪBMֽ|Or@s1A<
cޫǥ1g G zs;3.݇Cwջ#QƷLE
.8XfT|Nq\|969Pl]jPbͽm܀ǦhRJ
;
=HU<'q) X`\ @7(vVĵb uЪXϽ(dZ(֍7Ll0j5z4
֞( geŅHu ._KV`=uai,Y)u0ӫ%貘p]^U#e50Bp8bWG= ;$&@`+HLan,NACV,1UNrӨbW͇;E 0uR]lwΤWOi7Bk9P n#hRcŪ5y
x03\'ط# {GN&CǙ/(
2Ƞ>Q""ʺ} F|&B&P9^= aB4ԧVaF9ljk!u=Iyx=|+.NDZ6+H^pD=Wh e zG6Wnʅom
ۊZV0&q#ƅz Pwôf rϑd;VooTY[ҹ}{Q=G0|rwvH ^6!䶂o esḼVc}/`<4q1gȣ^} m<6m\E;--T|9{^2DAx@߁[LGJe$H͎#\)Y4V>oVO-q b!@D&Վ JErQ g
mAxh;=]頋3^|V=0A .Jf_@raބMgͼdq͗QeD!yn25ذջ=RXCΕM{ jTdL̢V#SX+iT ߁+yk!ĵ4)? ȵ0&9Z(4nUPIe֎ ]E> IuZVw^ByLUUy$]5P w6ODyͲ
q_
OHuh:ƳѼTVHdLmWy=f槮m=)(M\V[ʚ_ɍB?VA%2MPv{0|\M #]!^tLF~DFMO]y2
G{qAX7>Alc!vf=6 )7?ޖl$,Y&j4vwe8)= HJ& ` &:7ʛR2
?1,P4?oŧ qaΌxdiJZ&&)2[AY-C6.磷솕[ H3%w%$ !V@}pز `X%<r1N)ap'0
iҶlLr dnP Mq\l&z(oN/*w3ـ#&bvٛ먍^pb: H7 ׆*WG h6w\>b72 Je!e$]EB7Ŀ7_#%/.hk Ƙ%˖RwP= ~# R#ތB7gh
Xi]t䴤vʢx toq-gviI뀟ԣNu[7]$Av?} ̊5}ݥ'_<ƌ=e'd +"ۇ;onl2G,ާִTxPDl3wD Pө{" Tp[x cbz=Qu8)p,!~jxGw܉0 ce0`E콀M m/Խ3d1Ui>T<Lvk$BM{R%O)Af9\IBjEP\ʞܶiJٮU;
U^<
g**qF4܁ޞxx{QBE:736(*̃{Ӷ!JN!1dW)_| n|OA m ZL>#:FvDz]kEE#_ lyt \^}Ƅ@|j͑*ﴐlÄ/3j&JxcpQZuӰ-ݞ ϵ^!yV+Ek \[!{̾:pAatG"" *y^v
xRdؾQcl!.(4&jz⸇ LJv}36BVp=Xiv#Tyxa]:0HH58Fike$2d|y
R%Y6HY|ޕOo6?Ƶխ?)SrV%gRmSkg\YϓKg<-R
f."7H(3/o rjKHBh
mIi7;L]xRz'Lj&rƇQY(R@c|n
4^D!)C!'NB#w[W1R{ʓh].t q s2
U5 "Ȧ̔&x%Oσjxw7ׇ ev~k5+鿷zSQ L K zmiH"+
AGh -q}X+~3n<#FTj(-
-FO=oyUWp"ԲRgpnޢ|1|N]ݕ+1L՚,. }`chF+*Sbf j3 NUjRÌ J6䅟C~@53i @ +`8 ITLi>yO*5!OPqn&2 eOeA$~vF$j p$6eYﺻԁ,Iߜ.&67DI hz.k; 2;5,?V/
|YMA%>0̦fGK 3喡] m2ZVв5kǜ ?HaYI]W&) \ fModר]KWwv(y27 =
\#hNuv;`5 # gg;@b'
P0 I7m s#ccXz]`K} AZ"3njݤA0 cޘ78 wOڗJMʈ;ɨuOi)n
![V n"%O/
^p_$. Mb Gd zQі0 斄v`ŬI .DWHm
ؼ
hD_bWd]C#ךk"'2m"%5 LyObێMK,]NM_a'Nl.Ț
r(2kã\ #`16ld ;: oJ@17w@dGْ 0*H_H|q8QXJ_.Dh0 p(M:aCuP" mD T`~fbCU 2RYyQKd\-!' N aRsVV!=R*(Zs%f[5
/G
X#I,Uju#"%)l&vJ(2ޥ>$x"[@x
Qٯ[wmd&iw! azmqSIg"PvS552rà>Z:(Ԣ,3 1D`lS"U e|v3}`&;'eUt3h]v`-Pg],eLI3}T|22h tm @ {Q"`/gJ{ ?= .Gۘ7Q͍@֔$ ,ܷ% yPӨ&kӌtP&@'K Ϻ*̗?FJmfC'߲$
9s>g+P2ɰxXM
VhK.V3v}zD뚋:- F.C{#h{\Kd8N=ksM>j k 99 w5-A+Fl{{.er^$tDv;ȴc[ qFgG.H; "SQaP+KtqnYO;4"?8#J_!@gUU' OQm|#G i :]$A-<|l>rmOW ( Ϛ1:߹Z0z ni,a c]q;tZH`*ؿL^6~͂"S?
Om\a\$ v7x F
TNN+9w91 ܷw5+D5 `__ [<ӃQ8w03k' Q{ th ; $6ܤ4 ;5% 0}nG
H`LRKUߐ /#5Y:#7.^'whLxlIu -ĝ!*
R%<aLe-.1d h ek=@uPָ `pw7=;a.+[מroPQU5jk1,+m z)`]묚iNJUO=lȗ%iAc`
K8 |Hi[{G?L
9 Fѭ! ~uvhVA>ķm vdKTվ Y[܅Q8wq+|M]GF7[#~
g'(v?Ȟvf7/X
xO?kd)%(4ƒLVjFCr?
yVRqH|%jҜ̢]:O 3F
冀K!!wI:!-!o HU=fjv\~; ɳ@WhLv_ePl* ]KɔBQIsorOtqiYk%ǁӑ eiEw*q'Y:ǚHk /Yanj1rtKlg c4-@ +) 9^Vf,b @nt}/ c$vE(%"1קƗpftl;&>M"hd3u
7I* * ).KNZ<8m4>!Kj:ߍNI' dHo~뎝"
Ǹ9н-L| p\v$k$tQ(( v§ƏV
hum49ҪƟmq[ ے7&Xk:_hScQkkI kB'yʅ7 ]VHp 0F0v]EHsqDĖO!BI@AVZq,n!F˼լפDw]l@,u /@MlcuMed+'-$֣P|`~ o;xطCǡE;1 tn!`tpL 3oٯ嚠No; rZFFJ'L8 GSN"~8qVz9 J @/@ᱰ3rBGTq~Wx0"6~dH,'ѨX;Hʘ1-8'.N@ګ
R\X v6^S
FHxss[>+{{RDѽ1a md
)Co 9 'ܺ5>< #Thmn/~^X~d
dɨG6
h>"EtS+7ű.nqVXJg6|j2*o;xcXJkoL sPf0X'$}/MH ȑ2 {kʸ/( ؽ nryvN?d ͣطO Z#
8,da8 `H7mm<.RY!8}u;.r!:k@4|#MB|.ړHs])@IRM[B% )W6 .zwJBwE{Bglp% p42!/t VW"yZq:Um4+
ˇ}+̩~( {zuE̫ކ5ZXbpR)q 5K{a)PQ2&TP?a?ŝ(8Vh;с
ȴ'd.}aCDz=_hr8v:s/.P5u!nHNe`RbܽzQdU(Z]?風1`LO8(ޓ H$ D[l"m ъ8* p
JigSp*~%A]|Y6Y0nw'G29 Fzp ^]=XNO߃
O?1ɞ+@k0P 6$HvJr
X4S7.3d.j'Q@-MEDI٭H4'}*&ov= 0ruV(G(dO0?
"+pZRu v
}hzx;Wj)&;V揨9X8+uΐ" 4PC {*7?p 4m fkYAT +ݠ}83-]ķvPU,N9`f%mM!?RCeWU*``2M̕/˂W9mCv;kmӿ%e1Y IeahǸcN\#M0q`;pbރ0x=m]'x %}3bBJ0: :"cC8"s>S_ 7+g}3}WR &u8](
˥43XkO
ҵV)FAg\{L\c}nk [Z] B27O;0G_Z]Gk1zxc}#ݾgw=U~2;>Z Ίq(|C L-?'%NNH͋P+#u LB?1G3 y
S>C.3:/)o|b_sܜKEFDh
H$67Lu
FgB(SeI6ߢN$uLAkQ| NJ&tAN~aG>
)νC^B5
OE= ǒM|l lpF[b!+ھp:loώ#mq?BVC\ md pbXz6csz-,f- 9/ ^P1mP$:Kǔȷf9a#3qD|8jrO0 퐵R2,+fLv4E LS<[rs}
C*A+SSMkb#% orzϡɯgolqnQG 3wAyp/G<;~AR=9#K8"7Z1b$582-Jk!%-! MNɼdX^s^" <)hs
)2%+ T
Fyt'pE Foc{g=wȎqVAaɰQZ@9|ևQ:X<@M#Bs}ݙ1I4aphOu` G,'HA@#6C5\ A \A\
E@a'3>}'@{8v E{!TJWb2
t]N
|π7rg!g3Vt!D6+[q8$jJ=-l V91q L6yc?)'j𭣵x^1p4zufXcjV>h|J 5{D=[\q#S~JmP !5ĨL㶏.c
Bq& DNx@gW}Ii˛:oy 7o^! _-],kmj2qmpW.]
lRm 8}"8O=OuvHBNu^9v2|mJ[{t7Tp/\%\#:(kȼ$6;i
"%V IKe
>e̪ JgMFa Lnfj"NaB2v89oy|a!Kvax귨kXwI]}YlŐw 3a|C!c) +*E G붌w,#6t
l+_vb~I̠r,Z0@$'I :!a) -q|~vUԔ)#AxEn:
yqљ!0Yt@K +*[ח\iWt'=8_\BD_WZ2vwq Q[{V:y=pcdUӷ ELb~=)X|E.'o -= kita F<2sQ2jx`~(72Ɵߨ͢cd*YVFLM+[g84*D_Js>jnܛܠf; aQfNMZ2SES {9E-O \̿T\yw+H\[wJw6JZ@I.Hbd֏P)fFE(9FYϏvAl7⻢\D0̏P]*mt08%:$y~aHa"߯G@!KtOP. 6+Lƈ XX1/_/
S 9N;j_aH䭧\>͈ZcT1fHE--H۔ .Dlwk좡Qh.0_ɤ tkB ?;_D}1rZ>2Ӣ4Qy}S9XPC^ u,E-ڜ
_Z ?(stVXqw2ݿO2{W?k`-p;>qMb j y]X'nٔ ݦRB 06 db JÏ tXIjЪLJyŽA
sǃZyCUq, 4y]ʬꤧ7)歳:=+eL'z0JihCZył,`!9lf',iROM|ɯձg{3f8JhsؚuGtIJlX7r86CMD3ݽ
՟!i pmICvX0tsf1pk3 f3 Z|)݈u</^Nw"9fDTT눉`_ p6v7c/oҎiv{鱳=U LWɧ?[=; d\zkNQ)?6*tGV:T֛fjS0*=xMguXQ
RȯHvvdb{LiÕR'93+ T=@& Gf`+9ӯX6ο$^&sU1Fh4t .
"zjLU"gAd_/_ޚ \fy>ν[RJ+(h;g `wV, 1Vђ 5emC/y?jH
+j [ %q#evT /Njˡ0V!P1} fݯ(=.Nz_3iX9h 61TiMw⸡Th<ǎmO^2I_qq98.G) 7Þ!^ד+Fo`bz!B? MhZ"p.qpnBv/#3r@Bj0ڀ7E
Brz:
tg̪\tjy!I? J]wg
O,ҲTҨ nbqk6 aJ7 B:~ޯ/
X{ٿ@#HFV_ovi%@xm*=ҰY ؖ%T{n[8@V%u4X rDIn^y^XBv'ň
q%zBe9C6t-++>0G
X[k;hfPiO4/غ5z2)虅ʸ:]tי߄\.5Ծt&rzZ)6gX{G6ou-s|I^ e OAYx.Yڔ{[#ku饃bB_o`l0}\, wη*:%~uV>+&:T,voMzjͭū^/.^W?d:Kd !IQ1?Ϙo LҭR@
G"?~ pC`dVK.*M_ZB^1V$
<͟Gg!.LY%ʢfhE$8~^Xl 76Yz+߃81Gsd8N9
B{1,N82żͺ $+κ`αsӶ'u2*q<6~W^j}θ̻*1^ͫW,mVcõ"|Dǩ͖ͪVWć q.u/W;ZH7s6 /1-\S08\>}D`o[RE
h%>į2U^$rjV+@ tI8BZZ eb.ՄV4{ջCBdCu \L9
YZ