Initialize for gpg2

.gitignore

@@ -0,0 +1 @@
+gnupg-2.2.27.tar.bz2

.gpg2.metadata

@@ -0,0 +1 @@
+3a103b9e956aaf4608894488fe5435180a60e9d8cf7bae74233d08b33eabd163 gnupg-2.2.27.tar.bz2

gnupg-2.0.9-langinfo.patch

@@ -0,0 +1,17 @@
+# fix [bnc#305725] - non latin characters displayed incorrectly by pinentry
+---
+# jnlib/utf8conv.c |    1 +
+# 1 file changed, 1 insertion(+)
+#
+Index: gnupg-2.1.0/common/utf8conv.c
+===================================================================
+--- gnupg-2.1.0.orig/common/utf8conv.c	2014-10-11 19:45:14.000000000 +0200
++++ gnupg-2.1.0/common/utf8conv.c	2014-11-07 11:35:05.491413258 +0100
+@@ -198,6 +198,7 @@ set_native_charset (const char *newset)
+ #else /*!HAVE_W32_SYSTEM && !HAVE_ANDROID_SYSTEM*/
+ 
+ #ifdef HAVE_LANGINFO_CODESET
++	  setlocale(LC_ALL, "");
+       newset = nl_langinfo (CODESET);
+ #else /*!HAVE_LANGINFO_CODESET*/
+       /* Try to get the used charset from environment variables.  */

gnupg-2.2.16-secmem.patch

@@ -0,0 +1,35 @@
+Index: gnupg-2.2.16/g10/gpg.c
+===================================================================
+--- gnupg-2.2.16.orig/g10/gpg.c
++++ gnupg-2.2.16/g10/gpg.c
+@@ -973,7 +973,7 @@ make_libversion (const char *libname, co
+ 
+   if (maybe_setuid)
+     {
+-      gcry_control (GCRYCTL_INIT_SECMEM, 0, 0);  /* Drop setuid. */
++      gcry_control (GCRYCTL_INIT_SECMEM, 4096, 0);  /* Drop setuid. */
+       maybe_setuid = 0;
+     }
+   s = getfnc (NULL);
+@@ -1125,7 +1125,7 @@ build_list (const char *text, char lette
+   char *string;
+ 
+   if (maybe_setuid)
+-    gcry_control (GCRYCTL_INIT_SECMEM, 0, 0);  /* Drop setuid. */
++    gcry_control (GCRYCTL_INIT_SECMEM, 4096, 0);  /* Drop setuid. */
+ 
+   indent = utf8_charcount (text, -1);
+   len = 0;
+Index: gnupg-2.2.16/sm/gpgsm.c
+===================================================================
+--- gnupg-2.2.16.orig/sm/gpgsm.c
++++ gnupg-2.2.16/sm/gpgsm.c
+@@ -533,7 +533,7 @@ make_libversion (const char *libname, co
+ 
+   if (maybe_setuid)
+     {
+-      gcry_control (GCRYCTL_INIT_SECMEM, 0, 0);  /* Drop setuid. */
++      gcry_control (GCRYCTL_INIT_SECMEM, 4096, 0);  /* Drop setuid. */
+       maybe_setuid = 0;
+     }
+   s = getfnc (NULL);

gnupg-2.2.8-files-are-digests.patch

@@ -0,0 +1,200 @@
+---
+ g10/gpg.c     |    4 +++
+ g10/options.h |    1 
+ g10/sign.c    |   68 ++++++++++++++++++++++++++++++++++++++++++++++++++++------
+ 3 files changed, 67 insertions(+), 6 deletions(-)
+
+Index: gnupg-2.2.27/g10/gpg.c
+===================================================================
+--- gnupg-2.2.27.orig/g10/gpg.c
++++ gnupg-2.2.27/g10/gpg.c
+@@ -382,6 +382,7 @@ enum cmd_and_opt_values
+     oTTYtype,
+     oLCctype,
+     oLCmessages,
++	oFilesAreDigests,
+     oXauthority,
+     oGroup,
+     oUnGroup,
+@@ -838,6 +839,7 @@ static ARGPARSE_OPTS opts[] = {
+   ARGPARSE_s_s (oWeakDigest, "weak-digest","@"),
+   ARGPARSE_s_n (oUnwrap, "unwrap", "@"),
+   ARGPARSE_s_n (oOnlySignTextIDs, "only-sign-text-ids", "@"),
++  ARGPARSE_s_n (oFilesAreDigests, "files-are-digests", "@"),
+ 
+   /* Aliases.  I constantly mistype these, and assume other people do
+      as well. */
+@@ -2372,6 +2374,7 @@ main (int argc, char **argv)
+     opt.def_cert_expire = "0";
+     gnupg_set_homedir (NULL);
+     opt.passphrase_repeat = 1;
++    opt.files_are_digests=0;
+     opt.emit_version = 0;
+     opt.weak_digests = NULL;
+ 
+@@ -2944,6 +2947,7 @@ main (int argc, char **argv)
+ 	    opt.verify_options&=~VERIFY_SHOW_PHOTOS;
+ 	    break;
+ 	  case oPhotoViewer: opt.photo_viewer = pargs.r.ret_str; break;
++	  case oFilesAreDigests: opt.files_are_digests = 1; break;
+ 
+           case oDisableSignerUID: opt.flags.disable_signer_uid = 1; break;
+           case oIncludeKeyBlock:  opt.flags.include_key_block = 1; break;
+Index: gnupg-2.2.27/g10/options.h
+===================================================================
+--- gnupg-2.2.27.orig/g10/options.h
++++ gnupg-2.2.27/g10/options.h
+@@ -202,6 +202,7 @@ struct
+   int no_auto_check_trustdb;
+   int preserve_permissions;
+   int no_homedir_creation;
++  int files_are_digests;
+   struct groupitem *grouplist;
+   int mangle_dos_filenames;
+   int enable_progress_filter;
+Index: gnupg-2.2.27/g10/sign.c
+===================================================================
+--- gnupg-2.2.27.orig/g10/sign.c
++++ gnupg-2.2.27/g10/sign.c
+@@ -43,6 +43,8 @@
+ #include "../common/mbox-util.h"
+ #include "../common/compliance.h"
+ 
++#include "../common/host2net.h"
++
+ #ifdef HAVE_DOSISH_SYSTEM
+ #define LF "\r\n"
+ #else
+@@ -844,6 +846,8 @@ write_signature_packets (ctrl_t ctrl,
+       if (duration || opt.sig_policy_url
+           || opt.sig_notations || opt.sig_keyserver_url)
+         sig->version = 4;
++      else if (opt.files_are_digests)
++        sig->version = 3;
+       else
+         sig->version = pk->version;
+ 
+@@ -872,8 +876,12 @@ write_signature_packets (ctrl_t ctrl,
+         }
+       else
+         err = 0;  /* Actually never reached.  */
++      if (!opt.files_are_digests) {
+       hash_sigversion_to_magic (md, sig);
+       gcry_md_final (md);
++      } else if (sig->version >= 4) {
++          log_bug("files-are-digests doesn't work with v4 sigs\n");
++      }
+ 
+       if (!err)
+         err = do_sign (ctrl, pk, sig, md, hash_for (pk), cache_nonce, 0);
+@@ -937,6 +945,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
+     SK_LIST sk_rover = NULL;
+     int multifile = 0;
+     u32 duration=0;
++	int sigclass = 0x00;
++	u32 timestamp = 0;
+ 
+     pfx = new_progress_context ();
+     afx = new_armor_context ();
+@@ -954,7 +964,16 @@ sign_file (ctrl_t ctrl, strlist_t filena
+ 	fname = NULL;
+ 
+     if( fname && filenames->next && (!detached || encryptflag) )
+-	log_bug("multiple files can only be detached signed");
++	log_bug("multiple files can only be detached signed\n");
++
++    if (opt.files_are_digests && (multifile || !fname))
++	log_bug("files-are-digests only works with one file\n");
++    if (opt.files_are_digests && !detached)
++	log_bug("files-are-digests can only write detached signatures\n");
++    if (opt.files_are_digests && !opt.def_digest_algo)
++	log_bug("files-are-digests needs --digest-algo\n");
++    if (opt.files_are_digests && opt.textmode)
++	log_bug("files-are-digests doesn't work with --textmode\n");
+ 
+     if(encryptflag==2
+        && (rc=setup_symkey(&efx.symkey_s2k,&efx.symkey_dek)))
+@@ -975,7 +994,7 @@ sign_file (ctrl_t ctrl, strlist_t filena
+       goto leave;
+ 
+     /* prepare iobufs */
+-    if( multifile )  /* have list of filenames */
++    if( multifile || opt.files_are_digests)  /* have list of filenames */
+ 	inp = NULL; /* we do it later */
+     else {
+       inp = iobuf_open(fname);
+@@ -1124,7 +1143,7 @@ sign_file (ctrl_t ctrl, strlist_t filena
+     for (sk_rover = sk_list; sk_rover; sk_rover = sk_rover->next)
+       gcry_md_enable (mfx.md, hash_for (sk_rover->pk));
+ 
+-    if( !multifile )
++    if( !multifile && !opt.files_are_digests )
+ 	iobuf_push_filter( inp, md_filter, &mfx );
+ 
+     if( detached && !encryptflag)
+@@ -1179,6 +1198,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
+ 
+     write_status_begin_signing (mfx.md);
+ 
++    sigclass = opt.textmode && !outfile? 0x01 : 0x00;
++
+     /* Setup the inner packet. */
+     if( detached ) {
+ 	if( multifile ) {
+@@ -1219,6 +1240,45 @@ sign_file (ctrl_t ctrl, strlist_t filena
+ 	    if( opt.verbose )
+               log_printf ("\n");
+ 	}
++	else if (opt.files_are_digests) {
++	    byte *mdb, ts[5];
++	    size_t mdlen;
++	    const char *fp;
++	    int c, d;
++
++	    gcry_md_final(mfx.md);
++	    /* this assumes gcry_md_read returns the same buffer */
++	    mdb = gcry_md_read(mfx.md, opt.def_digest_algo);
++		mdlen = gcry_md_get_algo_dlen(opt.def_digest_algo);
++	    if (strlen(fname) != mdlen * 2 + 11)
++	        log_bug("digests must be %d + @ + 5 bytes\n", mdlen);
++	    d = -1;
++	    for (fp = fname ; *fp; ) {
++		c = *fp++;
++		if (c >= '0' && c <= '9')
++		    c -= '0';
++		else if (c >= 'a' && c <= 'f')
++		    c -= 'a' - 10;
++		else if (c >= 'A' && c <= 'F')
++		    c -= 'A' - 10;
++		else
++		    log_bug("filename is not hex\n");
++		if (d >= 0) {
++		    *mdb++ = d << 4 | c;
++		    c = -1;
++		    if (--mdlen == 0) {
++			mdb = ts;
++			if (*fp++ != '@')
++			    log_bug("missing time separator\n");
++		    }
++		}
++		d = c;
++	    }
++	    sigclass = ts[0];
++	    if (sigclass != 0x00 && sigclass != 0x01)
++		log_bug("bad cipher class\n");
++	    timestamp = buf32_to_u32(ts + 1);
++	}
+ 	else {
+ 	    /* read, so that the filter can calculate the digest */
+ 	    while( iobuf_get(inp) != -1 )
+@@ -1237,8 +1297,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
+ 
+     /* write the signatures */
+     rc = write_signature_packets (ctrl, sk_list, out, mfx.md,
+-                                  opt.textmode && !outfile? 0x01 : 0x00,
+-				  0, duration, detached ? 'D':'S', NULL);
++                                  sigclass,
++				  timestamp, duration, detached ? 'D':'S', NULL);
+     if( rc )
+         goto leave;
+ 

gnupg-CVE-2022-34903.patch

@@ -0,0 +1,47 @@
+From: Werner Koch <wk@gnupg.org>
+Date: Tue, 14 Jun 2022 11:33:27 +0200
+Subject: g10: Fix garbled status messages in NOTATION_DATA
+
+* g10/cpr.c (write_status_text_and_buffer): Fix off-by-one
+--
+
+Depending on the escaping and line wrapping the computed remaining
+buffer length could be wrong.  Fixed by always using a break to
+terminate the escape detection loop.  Might have happened for all
+status lines which may wrap.
+
+GnuPG-bug-id: T6027
+(cherry picked from commit 34c649b3601383cd11dbc76221747ec16fd68e1b)
+---
+ g10/cpr.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/g10/cpr.c b/g10/cpr.c
+index d502e8b..bc4b715 100644
+--- a/g10/cpr.c
++++ b/g10/cpr.c
+@@ -328,20 +328,15 @@ write_status_text_and_buffer (int no, const char *string,
+             }
+           first = 0;
+         }
+-      for (esc=0, s=buffer, n=len; n && !esc; s++, n--)
++      for (esc=0, s=buffer, n=len; n; s++, n--)
+         {
+           if (*s == '%' || *(const byte*)s <= lower_limit
+               || *(const byte*)s == 127 )
+             esc = 1;
+           if (wrap && ++count > wrap)
+-            {
+-              dowrap=1;
+-              break;
+-            }
+-        }
+-      if (esc)
+-        {
+-          s--; n++;
++            dowrap=1;
++          if (esc || dowrap)
++            break;
+         }
+       if (s != buffer)
+         es_fwrite (buffer, s-buffer, 1, statusfp);

gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch

@@ -0,0 +1,33 @@
+From f361141a44365ff7db2d2cfbf118d5b54b52c3d5 Mon Sep 17 00:00:00 2001
+From: Vincent Breitmoser <look@my.amazin.horse>
+Date: Thu, 13 Jun 2019 21:27:43 +0200
+Subject: [PATCH] gpg: accept subkeys with a good revocation but no self-sig
+ during import
+
+* g10/import.c (chk_self_sigs): Set the NODE_GOOD_SELFSIG flag when we
+encounter a valid revocation signature. This allows import of subkey
+revocation signatures, even in the absence of a corresponding subkey
+binding signature.
+
+--
+
+This fixes the remaining test in import-incomplete.scm.
+
+GnuPG-Bug-id: 4393
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ g10/import.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/g10/import.c b/g10/import.c
+index 2be214e63..ae2453803 100644
+--- a/g10/import.c
++++ b/g10/import.c
+@@ -3536,6 +3536,7 @@ chk_self_sigs (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid, int *non_self)
+                   /* It's valid, so is it newer? */
+                   if (sig->timestamp >= rsdate)
+                     {
++                      knode->flag |= NODE_GOOD_SELFSIG; /* Subkey is valid.  */
+                       if (rsnode)
+                         {
+                           /* Delete the last revocation sig since

gnupg-add-test-cases-for-import-without-uid.patch

@@ -0,0 +1,202 @@
+From 4c40bfa90bda748e5dada0bb1cc8fae14d744f07 Mon Sep 17 00:00:00 2001
+From: Vincent Breitmoser <look@my.amazin.horse>
+Date: Thu, 13 Jun 2019 21:27:41 +0200
+Subject: [PATCH] tests: add test cases for import without uid
+
+This commit adds a test case that does the following, in order:
+- Import of a primary key plus user id
+- Check that import of a subkey works, without a user id present in the
+imported key
+- Check that import of a subkey revocation works, without a user id or
+subkey binding signature present in the imported key
+- Check that import of a primary key revocation works, without a user id
+present in the imported key
+
+--
+
+Note that this test currently fails.  The following changesets will
+fix gpg so that the tests pass.
+
+GnuPG-Bug-id: 4393
+Signed-Off-By: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ tests/openpgp/Makefile.am                     |  1 +
+ tests/openpgp/import-incomplete.scm           | 68 +++++++++++++++++++
+ .../import-incomplete/primary+revocation.asc  |  9 +++
+ .../primary+subkey+sub-revocation.asc         | 10 +++
+ .../primary+subkey+sub-sig.asc                | 10 +++
+ .../import-incomplete/primary+uid-sig.asc     | 10 +++
+ .../openpgp/import-incomplete/primary+uid.asc | 10 +++
+ 7 files changed, 118 insertions(+)
+ create mode 100755 tests/openpgp/import-incomplete.scm
+ create mode 100644 tests/openpgp/import-incomplete/primary+revocation.asc
+ create mode 100644 tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
+ create mode 100644 tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
+ create mode 100644 tests/openpgp/import-incomplete/primary+uid-sig.asc
+ create mode 100644 tests/openpgp/import-incomplete/primary+uid.asc
+
+diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
+index e5be42b41..d886bc8f7 100644
+--- a/tests/openpgp/Makefile.am
++++ b/tests/openpgp/Makefile.am
+@@ -78,6 +78,7 @@ XTESTS = \
+ 	gpgv-forged-keyring.scm \
+ 	armor.scm \
+ 	import.scm \
++	import-incomplete.scm \
+ 	import-revocation-certificate.scm \
+ 	ecc.scm \
+ 	4gb-packet.scm \
+diff --git a/tests/openpgp/import-incomplete.scm b/tests/openpgp/import-incomplete.scm
+new file mode 100755
+index 000000000..727a027c6
+--- /dev/null
++++ b/tests/openpgp/import-incomplete.scm
+@@ -0,0 +1,68 @@
++#!/usr/bin/env gpgscm
++
++;; Copyright (C) 2016 g10 Code GmbH
++;;
++;; This file is part of GnuPG.
++;;
++;; GnuPG is free software; you can redistribute it and/or modify
++;; it under the terms of the GNU General Public License as published by
++;; the Free Software Foundation; either version 3 of the License, or
++;; (at your option) any later version.
++;;
++;; GnuPG is distributed in the hope that it will be useful,
++;; but WITHOUT ANY WARRANTY; without even the implied warranty of
++;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++;; GNU General Public License for more details.
++;;
++;; You should have received a copy of the GNU General Public License
++;; along with this program; if not, see <http://www.gnu.org/licenses/>.
++
++(load (in-srcdir "tests" "openpgp" "defs.scm"))
++(setup-environment)
++
++(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+uid.asc")))
++
++(info "Test import of new subkey, from a certificate without uid")
++(define keyid "573EA710367356BB")
++(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+subkey+sub-sig.asc")))
++(tr:do
++ (tr:pipe-do
++  (pipe:gpg `(--list-keys --with-colons ,keyid)))
++ (tr:call-with-content
++  (lambda (c)
++    ;; XXX we do not have a regexp library
++    (unless (any (lambda (line)
++		   (and (string-prefix? line "sub:")
++			(string-contains? line "573EA710367356BB")))
++		 (string-split-newlines c))
++	    (exit 1)))))
++
++(info "Test import of a subkey revocation, from a certificate without uid")
++(define keyid "573EA710367356BB")
++(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+subkey+sub-revocation.asc")))
++(tr:do
++ (tr:pipe-do
++  (pipe:gpg `(--list-keys --with-colons ,keyid)))
++ (tr:call-with-content
++  (lambda (c)
++    ;; XXX we do not have a regexp library
++    (unless (any (lambda (line)
++		   (and (string-prefix? line "sub:r:")
++			(string-contains? line "573EA710367356BB")))
++		 (string-split-newlines c))
++	    (exit 1)))))
++
++(info "Test import of revocation, from a certificate without uid")
++(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+revocation.asc")))
++(tr:do
++ (tr:pipe-do
++  (pipe:gpg `(--list-keys --with-colons ,keyid)))
++ (tr:call-with-content
++  (lambda (c)
++    ;; XXX we do not have a regexp library
++    (unless (any (lambda (line)
++		   (and (string-prefix? line "pub:r:")
++			(string-contains? line "0843DA969AA8DAFB")))
++		 (string-split-newlines c))
++	    (exit 1)))))
++
+diff --git a/tests/openpgp/import-incomplete/primary+revocation.asc b/tests/openpgp/import-incomplete/primary+revocation.asc
+new file mode 100644
+index 000000000..6b7b60802
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+revocation.asc
+@@ -0,0 +1,9 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: [E] primary key, revocation signature over primary (no user ID)
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN2IeAQgFggAIBYhBLRpj5W82H/gSMzKKQhD2paaqNr7BQJc2ZQZAh0AAAoJ
++EAhD2paaqNr7qAwA/2jBUpnN0BxwRO/4CrxvrLIsL+C9aSXJUOTv8XkP4lvtAQD3
++XsDFfFNgEueiTfF7HtOGt5LPmRqVvUpQSMVgJJW6CQ==
++=tM90
++-----END PGP PUBLIC KEY BLOCK-----
+diff --git a/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc b/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
+new file mode 100644
+index 000000000..83a51a549
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
+@@ -0,0 +1,10 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: [D] primary key, subkey, subkey revocation (no user ID)
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN24OARc2ZQhEgorBgEEAZdVAQUBAQdABsd5ha0AWXdXcSmfeiWIfrNcGqQK
++j++lwwWDAOlkVicDAQgHiHgEKBYIACAWIQS0aY+VvNh/4EjMyikIQ9qWmqja+wUC
++XNmnkAIdAgAKCRAIQ9qWmqja+ylaAQDmIKf86BJEq4OpDqU+V9D+wn2cyuxbyWVQ
++3r9LiL9qNwD/QAjyrhSN8L3Mfq+wdTHo5i0yB9ZCCpHLXSbhCqfWZwQ=
++=dwx2
++-----END PGP PUBLIC KEY BLOCK-----
+diff --git a/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc b/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
+new file mode 100644
+index 000000000..dc47a02d8
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
+@@ -0,0 +1,10 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: [B] primary key, subkey, subkey binding sig (no user ID)
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN24OARc2ZQhEgorBgEEAZdVAQUBAQdABsd5ha0AWXdXcSmfeiWIfrNcGqQK
++j++lwwWDAOlkVicDAQgHiHgEGBYIACAWIQS0aY+VvNh/4EjMyikIQ9qWmqja+wUC
++XNmUIQIbDAAKCRAIQ9qWmqja++vFAP98G1L+1/rWTGbsnxOAV2RocBYIroAvsbkR
++Ly6FdP8YNwEA7jOgT05CoKIe37MstpOz23mM80AK369Ca3JMmKKCQgg=
++=xuDu
++-----END PGP PUBLIC KEY BLOCK-----
+diff --git a/tests/openpgp/import-incomplete/primary+uid-sig.asc b/tests/openpgp/import-incomplete/primary+uid-sig.asc
+new file mode 100644
+index 000000000..134607d0e
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+uid-sig.asc
+@@ -0,0 +1,10 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: [C] primary key and self-sig expiring in 2024 (no user ID)
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN2IlgQTFggAPgIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgBYhBLRpj5W8
++2H/gSMzKKQhD2paaqNr7BQJc2ZR1BQkJZgHcAAoJEAhD2paaqNr79soA/0lWkUsu
++3NLwgbni6EzJxnTzgeNMpljqNpipHAwfix9hAP93AVtFdC8g7hdUZxawobl9lnSN
++9ohXOEBWvdJgVv2YAg==
++=KWIK
++-----END PGP PUBLIC KEY BLOCK-----
+diff --git a/tests/openpgp/import-incomplete/primary+uid.asc b/tests/openpgp/import-incomplete/primary+uid.asc
+new file mode 100644
+index 000000000..055f30086
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+uid.asc
+@@ -0,0 +1,10 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: [A] primary key, user ID, and self-sig expiring in 2021
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN20CHRlc3Qga2V5iJYEExYIAD4WIQS0aY+VvNh/4EjMyikIQ9qWmqja+wUC
++XNmUGQIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRAIQ9qWmqja
+++0G1AQDdQiwhXxjXLMqoth+D4SigVHTJK8ORwifzsy3UE7mPGwD/aZ67XbAF/lgI
++kv2O1Jo0u9BL9RNNF+L0DM7rAFbfMAs=
++=1eII
++-----END PGP PUBLIC KEY BLOCK-----

gnupg-add_legacy_FIPS_mode_option.patch

@@ -0,0 +1,68 @@
+---
+ doc/gpg.texi |   18 ++++++++++++++++++
+ g10/gpg.c    |    9 +++++++++
+ 2 files changed, 27 insertions(+)
+
+Index: gnupg-2.2.20/doc/gpg.texi
+===================================================================
+--- gnupg-2.2.20.orig/doc/gpg.texi
++++ gnupg-2.2.20/doc/gpg.texi
+@@ -2133,6 +2133,24 @@ implies, this option is for experts only
+ understand the implications of what it allows you to do, leave this
+ off. @option{--no-expert} disables this option.
+ 
++@item --set-legacy-fips
++@itemx --set-legacy-fips
++@opindex set-legacy-fips
++Enable legacy support even when the libgcrypt library is in FIPS 140-2
++mode. The legacy mode of libgcrypt allows the use of all ciphers,
++including non-approved ciphers. This mode is needed when for legacy
++reasons a message must be encrypted or decrypted. Legacy reasons for
++decryptions include the decryption of old messages created with a
++public key that use cipher settings which do not meet FIPS 140-2
++requirements. Legacy reasons for encryption include the encryption
++of messages with a recipients public key where the recipient is not
++bound to FIPS 140-2 regulation and therefore provided a key using
++non-approved ciphers. Although the legacy mode is a violation of strict
++FIPS 140-2 rule interpretations, it is wise to use this mode or
++either not being able to access old messages or not being able
++to create encrypted messages to a recipient that is not adhering
++to FIPS 140-2 rules.
++
+ @end table
+ 
+ 
+Index: gnupg-2.2.20/g10/gpg.c
+===================================================================
+--- gnupg-2.2.20.orig/g10/gpg.c
++++ gnupg-2.2.20/g10/gpg.c
+@@ -429,6 +429,7 @@ enum cmd_and_opt_values
+     oUseOnlyOpenPGPCard,
+     oIncludeKeyBlock,
+     oNoIncludeKeyBlock,
++    oSetLegacyFips,
+ 
+     oNoop
+   };
+@@ -874,6 +875,7 @@ static ARGPARSE_OPTS opts[] = {
+   ARGPARSE_s_n (oAllowMultipleMessages,      "allow-multiple-messages", "@"),
+   ARGPARSE_s_n (oNoAllowMultipleMessages, "no-allow-multiple-messages", "@"),
+   ARGPARSE_s_n (oAllowWeakDigestAlgos, "allow-weak-digest-algos", "@"),
++  ARGPARSE_s_n (oSetLegacyFips, "set-legacy-fips", "@"),
+ 
+   ARGPARSE_s_s (oDefaultNewKeyAlgo, "default-new-key-algo", "@"),
+ 
+@@ -3614,6 +3616,13 @@ main (int argc, char **argv)
+             opt.flags.use_only_openpgp_card = 1;
+             break;
+ 
++	  case oSetLegacyFips:
++	    if(gcry_fips_mode_active())
++	      gcry_control (GCRYCTL_INACTIVATE_FIPS_FLAG, "Enable legacy support in FIPS 140-2 mode");
++	    else
++	      log_info ("Command set-legacy-fips ignored as libgcrypt is not in FIPS mode\n");
++	    break;
++
+ 	  case oNoop: break;
+ 
+ 	  default:

gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch

@@ -0,0 +1,107 @@
+From a1db83d8a3308277f01b96833c13693bd7e13ff9 Mon Sep 17 00:00:00 2001
+From: Vincent Breitmoser <look@my.amazin.horse>
+Date: Thu, 13 Jun 2019 21:27:42 +0200
+Subject: [PATCH] gpg: allow import of previously known keys, even without UIDs
+
+* g10/import.c (import_one): Accept an incoming OpenPGP certificate that
+has no user id, as long as we already have a local variant of the cert
+that matches the primary key.
+
+--
+
+This fixes two of the three broken tests in import-incomplete.scm.
+
+GnuPG-Bug-id: 4393
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ g10/import.c | 49 +++++++++++--------------------------------------
+ 1 file changed, 11 insertions(+), 38 deletions(-)
+
+Index: gnupg-2.2.19/g10/import.c
+===================================================================
+--- gnupg-2.2.19.orig/g10/import.c
++++ gnupg-2.2.19/g10/import.c
+@@ -1792,7 +1792,6 @@ import_one_real (ctrl_t ctrl,
+   size_t an;
+   char pkstrbuf[PUBKEY_STRING_SIZE];
+   int merge_keys_done = 0;
+-  int any_filter = 0;
+   KEYDB_HANDLE hd = NULL;
+ 
+   if (r_valid)
+@@ -1829,14 +1828,6 @@ import_one_real (ctrl_t ctrl,
+       log_printf ("\n");
+     }
+ 
+-
+-  if (!uidnode )
+-    {
+-      if (!silent)
+-        log_error( _("key %s: no user ID\n"), keystr_from_pk(pk));
+-      return 0;
+-    }
+-
+   if (screener && screener (keyblock, screener_arg))
+     {
+       log_error (_("key %s: %s\n"), keystr_from_pk (pk),
+@@ -1911,17 +1902,10 @@ import_one_real (ctrl_t ctrl,
+ 	  }
+     }
+ 
+-  if (!delete_inv_parts (ctrl, keyblock, keyid, options ) )
+-    {
+-      if (!silent)
+-        {
+-          log_error( _("key %s: no valid user IDs\n"), keystr_from_pk(pk));
+-          if (!opt.quiet )
+-            log_info(_("this may be caused by a missing self-signature\n"));
+-        }
+-      stats->no_user_id++;
+-      return 0;
+-    }
++  /* Delete invalid parts, and note if we have any valid ones left.
++   * We will later abort import if this key is new but contains
++   * no valid uids.  */
++  delete_inv_parts (ctrl, keyblock, keyid, options);
+ 
+   /* Get rid of deleted nodes.  */
+   commit_kbnode (&keyblock);
+@@ -1931,24 +1915,11 @@ import_one_real (ctrl_t ctrl,
+     {
+       apply_keep_uid_filter (ctrl, keyblock, import_filter.keep_uid);
+       commit_kbnode (&keyblock);
+-      any_filter = 1;
+     }
+   if (import_filter.drop_sig)
+     {
+       apply_drop_sig_filter (ctrl, keyblock, import_filter.drop_sig);
+       commit_kbnode (&keyblock);
+-      any_filter = 1;
+-    }
+-
+-  /* If we ran any filter we need to check that at least one user id
+-   * is left in the keyring.  Note that we do not use log_error in
+-   * this case. */
+-  if (any_filter && !any_uid_left (keyblock))
+-    {
+-      if (!opt.quiet )
+-        log_info ( _("key %s: no valid user IDs\n"), keystr_from_pk (pk));
+-      stats->no_user_id++;
+-      return 0;
+     }
+ 
+   /* The keyblock is valid and ready for real import.  */
+@@ -2006,6 +1977,13 @@ import_one_real (ctrl_t ctrl,
+       err = 0;
+       stats->skipped_new_keys++;
+     }
++  else if (err && !any_uid_left (keyblock))
++    {
++      if (!silent)
++        log_info( _("key %s: new key but contains no user ID - skipped\n"), keystr(keyid));
++      err = 0;
++      stats->no_user_id++;
++    }
+   else if (err)  /* Insert this key. */
+     {
+       /* Note: ERR can only be NO_PUBKEY or UNUSABLE_PUBKEY.  */

gnupg-detect_FIPS_mode.patch

@@ -0,0 +1,44 @@
+Index: gnupg-2.2.27/g10/encrypt.c
+===================================================================
+--- gnupg-2.2.27.orig/g10/encrypt.c
++++ gnupg-2.2.27/g10/encrypt.c
+@@ -577,7 +577,8 @@ encrypt_crypt (ctrl_t ctrl, int filefd,
+          that the implementation behind any v4 key can handle 3DES. */
+       if (cfx.dek->algo == -1)
+         {
+-          cfx.dek->algo = CIPHER_ALGO_3DES;
++	  gcry_check_version (NULL);
++	  cfx.dek->algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : CIPHER_ALGO_3DES;
+         }
+ 
+       /* In case 3DES has been selected, print a warning if any key
+@@ -841,7 +842,10 @@ encrypt_filter (void *opaque, int contro
+                   /* Because 3DES is implicitly in the prefs, this can
+                      only happen if we do not have any public keys in
+                      the list.  */
+-                  efx->cfx.dek->algo = DEFAULT_CIPHER_ALGO;
++		   /* Libgcrypt manual says that gcry_version_check must be called
++		      before calling gcry_fips_mode_active. */
++		    gcry_check_version (NULL);
++		    efx->cfx.dek->algo = gcry_fips_mode_active() ? CIPHER_ALGO_AES : DEFAULT_CIPHER_ALGO;
+                 }
+ 
+               /* In case 3DES has been selected, print a warning if
+Index: gnupg-2.2.27/g10/mainproc.c
+===================================================================
+--- gnupg-2.2.27.orig/g10/mainproc.c
++++ gnupg-2.2.27/g10/mainproc.c
+@@ -953,7 +953,12 @@ proc_plaintext( CTX c, PACKET *pkt )
+          according to 2440, so hopefully it won't come up that often.
+          There is no good way to specify what algorithms to use in
+          that case, so these there are the historical answer. */
+-	gcry_md_enable (c->mfx.md, DIGEST_ALGO_RMD160);
++
++	/* Libgcrypt manual says that gcry_version_check must be called
++	   before calling gcry_fips_mode_active. */
++	gcry_check_version (NULL);
++	if( !gcry_fips_mode_active() )
++	  gcry_md_enable( c->mfx.md, DIGEST_ALGO_RMD160 );
+ 	gcry_md_enable (c->mfx.md, DIGEST_ALGO_SHA1);
+     }
+   if (DBG_HASHING)

gnupg-dirmngr-Clear-the-error-count-to-try-certificate-as-binary.patch

@@ -0,0 +1,29 @@
+From 4d19759ce5fb4962b22a8bc04c3a54e3f47d2f17 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Thu, 24 Mar 2022 13:55:32 +0900
+Subject: [PATCH] dirmngr: Clear the error count to try certificate as binary.
+
+* dirmngr/dirmngr-client.c (read_certificate): Call
+log_get_errorcount.
+
+--
+
+GnuPG-bug-id: 5531
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+---
+ dirmngr/dirmngr-client.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+Index: gnupg-2.2.27/dirmngr/dirmngr-client.c
+===================================================================
+--- gnupg-2.2.27.orig/dirmngr/dirmngr-client.c
++++ gnupg-2.2.27/dirmngr/dirmngr-client.c
+@@ -637,6 +637,8 @@ read_certificate (const char *fname, uns
+       err = read_pem_certificate (fname, rbuf, rbuflen, 1);
+       if (! err)
+         return 0;
++      /* Clear the error count to try as binary certificate.  */
++      log_get_errorcount (1);
+     }
+ 
+   fp = fname? gnupg_fopen (fname, "rb") : stdin;

gnupg-dirmngr-Suppress-error-message-on-trial-reading-as-PEM.patch

@@ -0,0 +1,67 @@
+From 25d37a0a6a9c42326777c2949054a8bd6f276f8a Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Fri, 25 Mar 2022 08:38:42 +0900
+Subject: [PATCH] dirmngr: Suppress error message on trial reading as PEM
+ format.
+
+* dirmngr/dirmngr-client.c (read_pem_certificate): Add NO_ERRMSG
+argument to suppress the error message.
+(read_certificate, squid_loop_body): Follow the change.
+
+--
+
+GnuPG-bug-id: 5531
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+---
+ dirmngr/dirmngr-client.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+Index: gnupg-2.2.27/dirmngr/dirmngr-client.c
+===================================================================
+--- gnupg-2.2.27.orig/dirmngr/dirmngr-client.c
++++ gnupg-2.2.27/dirmngr/dirmngr-client.c
+@@ -460,7 +460,8 @@ data_cb (void *opaque, const void *buffe
+    returned in an alloced buffer whose address will be returned in
+    RBUF and its length in RBUFLEN.  */
+ static gpg_error_t
+-read_pem_certificate (const char *fname, unsigned char **rbuf, size_t *rbuflen)
++read_pem_certificate (const char *fname, unsigned char **rbuf, size_t *rbuflen,
++                      int no_errmsg)
+ {
+   FILE *fp;
+   int c;
+@@ -603,7 +604,8 @@ read_pem_certificate (const char *fname,
+     }
+   else if (state != s_waitend)
+     {
+-      log_error ("no certificate or invalid encoded\n");
++      if (!no_errmsg)
++        log_error ("no certificate or invalid encoded\n");
+       xfree (buf);
+       return gpg_error (GPG_ERR_INV_ARMOR);
+     }
+@@ -626,13 +628,13 @@ read_certificate (const char *fname, uns
+   size_t nread, bufsize, buflen;
+ 
+   if (opt.pem)
+-    return read_pem_certificate (fname, rbuf, rbuflen);
++    return read_pem_certificate (fname, rbuf, rbuflen, 0);
+   else if (fname)
+     {
+       /* A filename has been given.  Let's just assume it is in PEM
+          format and decode it, and fall back to interpreting it as
+          binary certificate if that fails.  */
+-      err = read_pem_certificate (fname, rbuf, rbuflen);
++      err = read_pem_certificate (fname, rbuf, rbuflen, 1);
+       if (! err)
+         return 0;
+     }
+@@ -904,7 +906,7 @@ squid_loop_body (assuan_context_t ctx)
+   unsigned char *certbuf;
+   size_t certbuflen = 0;
+ 
+-  err = read_pem_certificate (NULL, &certbuf, &certbuflen);
++  err = read_pem_certificate (NULL, &certbuf, &certbuflen, 0);
+   if (gpg_err_code (err) == GPG_ERR_EOF)
+     return err;
+   if (err)

gnupg-dont-fail-with-seahorse-agent.patch

@@ -0,0 +1,17 @@
+---
+ g10/passphrase.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: gnupg-2.1.0/g10/passphrase.c
+===================================================================
+--- gnupg-2.1.0.orig/g10/passphrase.c	2014-11-07 16:52:11.080483153 +0100
++++ gnupg-2.1.0/g10/passphrase.c	2014-11-07 16:52:11.996494299 +0100
+@@ -71,7 +71,7 @@ encode_s2k_iterations (int iterations)
+         {
+           /* Don't print an error if an older agent is used.  */
+           if (err && gpg_err_code (err) != GPG_ERR_ASS_PARAMETER)
+-            log_error (_("problem with the agent: %s\n"), gpg_strerror (err));
++            log_info (_("problem with the agent: %s\n"), gpg_strerror (err));
+           /* Default to 65536 which we used up to 2.0.13.  */
+           return 96;
+         }

gnupg-gpg-agent-ulimit.patch

@@ -0,0 +1,35 @@
+gpg-agent is in the chain of commands in xinitrc.
+It receives a list of commands via argv[] which it is supposed to launch via exec.
+In this mode all what matters is a bunch of setenv() of gpg related variables.
+At no point it must fiddle with ulimit that was provided by its callers.
+In case of xinitrc it was most likely pam_limits which, for example, configured the coredump settings for this session.
+
+Every code path before the fork() call does no sensitive things, so coredumps do not matter.
+
+gpg-agent does fork a child in this mode.
+That child has the liberty to tweak ulimit in every way it wants.
+This is what this patch does.
+
+Without this patch, all applications launched after gpg-agent are unable to coredump, because systemd-coredump check the ulimit of the crashed process.
+As a result, crashes of desktop applications can not be debugged.
+
+References: bsc#1124847
+
+--- a/agent/gpg-agent.c
++++ b/agent/gpg-agent.c
+@@ -1049,7 +1049,6 @@ main (int argc, char **argv )
+   gcry_control (GCRYCTL_USE_SECURE_RNDPOOL);
+   gcry_set_progress_handler (agent_libgcrypt_progress_cb, NULL);
+ 
+-  disable_core_dumps ();
+ 
+   /* Set default options.  */
+   parse_rereadable_options (NULL, 0); /* Reset them to default values. */
+@@ -1738,6 +1737,7 @@ main (int argc, char **argv )
+       /*
+          This is the child
+        */
++      disable_core_dumps ();
+ 
+       initialize_modules ();
+ 

gnupg-set_umask_before_open_outfile.patch

@@ -0,0 +1,43 @@
+Index: gnupg-2.1.20/g10/plaintext.c
+===================================================================
+--- gnupg-2.1.20.orig/g10/plaintext.c	2017-04-03 17:13:56.000000000 +0200
++++ gnupg-2.1.20/g10/plaintext.c	2017-04-04 09:53:31.541145727 +0200
+@@ -24,6 +24,7 @@
+ #include <string.h>
+ #include <errno.h>
+ #include <sys/types.h>
++#include <sys/stat.h>
+ #ifdef HAVE_DOSISH_SYSTEM
+ # include <fcntl.h> /* for setmode() */
+ #endif
+@@ -38,6 +39,9 @@
+ #include "../common/status.h"
+ #include "../common/i18n.h"
+ 
++/* define safe permissions for creating plaintext files */
++#define GPG_SAFE_PERMS (S_IRUSR | S_IWUSR)
++#define GPG_SAFE_UMASK (0777 & ~GPG_SAFE_PERMS)
+ 
+ /* Get the output filename.  On success, the actual filename that is
+    used is set in *FNAMEP and a filepointer is returned in *FP.
+@@ -161,11 +165,15 @@ get_output_file (const byte *embedded_na
+       log_error (_("error creating '%s': %s\n"), fname, gpg_strerror (err));
+       goto leave;
+     }
+-  else if (!(fp = es_fopen (fname, "wb")))
+-    {
+-      err = gpg_error_from_syserror ();
+-      log_error (_("error creating '%s': %s\n"), fname, gpg_strerror (err));
+-      goto leave;
++    else {
++	mode_t saved_umask = umask(GPG_SAFE_UMASK);
++	if( !(fp = es_fopen(fname,"wb")) ) {
++		err = gpg_error_from_syserror ();
++		log_error(_("error creating `%s': %s\n"), fname, strerror(errno) );
++		umask(saved_umask);
++		goto leave;
++	}
++	umask(saved_umask);
+     }
+ #else /* __riscos__ */
+   /* If no output filename was given, i.e. we constructed it, convert

gpg2.keyring

@@ -0,0 +1,65 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBE0ti4EBCACqGtKlX9jI/enhlBdy2cyQP6Q7JoyxtaG6/ckAKWHYrqFTQk3I
+Ue8TuDrGT742XFncG9PoMBfJDUNltIPgKFn8E9tYQqAOlpSA25bOb30cA2ADkrjg
+jvDAH8cZ+fkIayWtObTxwqLfPivjFxEM//IdShFFVQj+QHmXYBJggWyEIil8Bje7
+KRw6B5ucs4qSzp5VH4CqDr9PDnLD8lBGHk0x8jpwh4V/yEODJKATY0Vj00793L8u
+qA35ZiyczUvvJSLYvf7STO943GswkxdAfqxXbYifiK2gjE/7SAmB+2jFxsonUDOB
+1BAY5s3FKqrkaxZr3BBjeuGGoCuiSX/cXRIhABEBAAG0Fldlcm5lciBLb2NoIChk
+aXN0IHNpZymJAVUEEwEIAD8CGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAFiEE
+2GkhI8QGXepeDzq1JJs50k8l47YFAl4MxBkFCRShVzYACgkQJJs50k8l47YImQf9
+HaqHWor+aSmaEwQnaAN0zRa4kPbAWya182aJtsFzLZJf6BbS0aoiMhwtREN/DMvB
+jzxARKep/cELaM+mc7oDK4mEwqSX/u6BE8D7FaNA9sut8P+4xjpoLPU+UzILMg29
+t1remjyT9rs6sbu8BqufIxueArkjoi4WCOSRiVTdw+YDd88volPkXlPfS8hg9Rct
+wZ8kEEDywa+NrxiLx+kDgDNTNdk3PJdfcnesf8S1a+KLUTNRds5+xGTYz0JSQ9BZ
+7Q9r4VQ/NL55muQZi5W7lVxdp3HxQFUNjHzzBfGtkpS4xqZpJvNjW50Wh5Vi5RYZ
+LZ3M1EuIHXHmRiY4dmqqcpkBDQRUUDsjAQgA5hBwN9F3OqKf+9mXCXUDK4lb5wMj
+dti96xG04gAn7wWo7On6c5ntriZQuRdR5GHcdw73XC6CFehHeo/eSVYiWqBNBAfE
+9UzbkES+cY+4wDzqVacqhKxd70XmHQgyK7ppRG/MwkL1UyArCGGAKN6MV/2fzO6I
+GQw3jntRue3/2PGGnGaisNAKlvttHWZ91uy4KY5fBM19uQCgZdx4v8/rP0+yQqsW
+TwJUKvymx5GIfNaCJvgF+v+aPrwspxBMf9jpHXqDXnh4Lo8C/GsQMD6GClVfQjsv
+vzUHKH2eoL4oNfku+Ua5BuAHYi+uAuzqV9TdpF9PCpQMyPfuuZclMPLdMwARAQAB
+tDJOSUlCRSBZdXRha2EgKEdudVBHIFJlbGVhc2UgS2V5KSA8Z25paWJlQGZzaWou
+b3JnPokBPAQTAQgAJgIbAwULBwgJAwQVCAkKBRYCAwEAAh4BAheABQJYDxRZBQkL
+S5A2AAoJECBxsIozvT8GvG8IAMBIlGz9voYcSSXAdQOuvz2gM2kOjvMHzN6VlS9V
+P06IjnTz2DnejFZwLmxJw8e8mZjUo0jw22uo1HREQhDrne3S1IazPMeTUCUNzpWF
+MxXNc6SAyrw9apWa8gouGUWJv3HOwVs8EFA2E9UdtDJ2uG7MY/+eC5K/aeOAyudZ
+EbvS8rgZypTFrBtBcNKUWZhz7FRn63HxEmYLE3p6I19ZDXrc1WTazF2oz18zym6c
+uURr6waRbdSemUTshpLnKCBZXzJ82bXBgXNnfdmc3gtS24ZmM3ZfK/rYztEDkiTk
+s2R1gwDwf5RtDpaf5LD2ufESdbLuT+8blAlscbgYLBcwDquZAY0EWMu6rgEMAKcz
+vM1IhpUwBpxPCNdrlMZh7XeLqKUd7hUvQ1KHOuDONxCDnfXdxGCKKI0Ds5I7Kkyp
+Wzvcl7PplRy2fYZWwcGtL+Kj01y4L2lXB/xrrVaVwRr4S0FrcbseUGYRafBpR0C1
+Yo24CL1ef4ivsfbER2SyaZ3lrT9Ccv6xfvTluhU8X+2li1ssak/Frvy02u3EORLD
+LxaaLQgANgsjnIjv/JQZ4l3xFIJT98tEoL18btg5lGrS2w4yFU1aa1SNsbp7vcu7
+wsqcJmCzX98LyG8/IBGJ5JXmZ03yzWhZ3uhhy1+Avi4GV4Mi0ADwaGMp6O63Mc3w
+SL8A/DoCKJLISOc+D5xNfw6C8sYlaOSzQfqY9l4HW/+QbJmEFL2+bnjSHb8yaVU3
+ae2IIrlNkZ5Jamp12Kq6x9Vei0xGk3gd4sqhmHhECdxoJtkX9L5gt436QxdjiTcW
+q3V+NNfq94UJu2Ej2kN0fNT0t9RU2n0P/mS0L+1gw5Ex6BX7BIzGL0bZhYomQwAR
+AQABiQHOBB8BCAA4FiEEW4DFdUKY8MtV2O1qvO9+KUsJLigFAljLwN0XDIABlKXJ
+oDwv5co7CV2OH99yPPRitrECBwAACgkQvO9+KUsJLig2Cgv/T4rXEjHwlbsuTkzp
+tgK80Dh92URzBAhPhSJ0kUz2b6y7FgVYgZ95u8elGUS4lOB0GOQSK3y4sCgldTQF
+GQpMuvNMX6oNQTv1Z/H9H7Sc6AntozKRA6LQC+7DMxjPh2DEhVLYNqi7gMXtuH8o
+Xz5+quarw/xbVmuS4UNqcxakd4A/HW6PayRhuju4+oV2+UmGU0etzGVwKSN/UicC
+3Re3mUy8SwJFQ9/3EAfiY0SGzSWH1z7bTRg9Ga2ctYDNzUpyQsgLxD6ZRHcONkOo
+GUMEQ96BeSsjT4yW9ED70CcCbhg+pMxR+lnpk4BZ4WML/plBjEb8B1YaRvhYWKd3
+OSVB/JsS6J6Q/y9TTsAJDBLAfw9h7RQKibViuVFSNftAuSdktah5mDwFnL0ZMzVS
+3tDVDa5PDqbHEhK55/5EWBg4eNbAukVZmmoLzzERGXuj+LOIRElG3/n3chy1uM73
+B6da3al4gDDNHifPsuozpkVN1EAROZx1K9hGGDZC3yFQTjsJtCRBbmRyZSBIZWlu
+ZWNrZSAoUmVsZWFzZSBTaWduaW5nIEtleSmJAdQEEwEIAD4WIQRbgMV1Qpjwy1XY
+7Wq8734pSwkuKAUCWMu6rgIbAwUJEswDAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIX
+gAAKCRC8734pSwkuKEL9DACEIL5IS9wUty62Bnwd9wK2hmwihXNkTLsOOoi8aCdO
+ywPwcIucgAcIO+c/t0lbe4y4sJ1KrKbdyOUQiJAyxobLCSV/MkhIDAmsZB1ZIpF3
+nfmNekRdCVcMpqX8jAwoBS3Q9m2UJz1LeDCLFCvLF0nbyUnqHZP19UOvxmzAyZMA
+Ub3W5y1+GMo4yA+3xSFI8ZbjzhawixCCRs69/4p+zCXR4e7LBf6koAHllD/0ZULp
+SDjF+t2IkvRrMlM+e+Mxjklinr8v1FRGzmE/kCcdHaP88+iwC2wUKOZtFs4yIBLO
+SWdQk9tLPmR8uWgNZmatRJyNvOaxd6EbK3jfckbJGFkmXjH+M9vMqFpoAewZ359F
+qjq+Us7AXLAMNUynom7IrtR5Rvsjx6RNtKQYUD6XY5rc7r9js9iGruHDAAW5lyRg
+j3wikc0IbV9L1bTsXIp29BsrU9sXUkVEp+xQJZgwqoOduoSjmOK88QdkibDqJiGF
+dzIRiXx+Nxv1Pr9L7A4/tq+YMwRfQ+WJFgkrBgEEAdpHDwEBB0DPvkeV6RzXomGF
+8jQwp0RXEt2TGFwwI7RkbpYwECY2l7QfV2VybmVyIEtvY2ggKGRpc3Qgc2lnbmlu
+ZyAyMDIwKYiaBBMWCgBCFiEEbapuZKdtKEBXG0kCUoiXuCZAOtoFAl9D7DUCGwMF
+CRKFxxEFCwkIBwIDIgIBBhUKCQgLAgQWAgMBAh4HAheAAAoJEFKIl7gmQDraea4A
+/24v8c50HSC/Basf4WlREkuzhudplo8iT0BGtTQRdGAmAP9gIZ8dBekg9PRlpe7A
+l7ErThn6owVH9szWrUt6jkKOBg==
+=h7e4
+-----END PGP PUBLIC KEY BLOCK-----

gpg2.spec

@@ -0,0 +1,192 @@
+#
+# spec file for package gpg2
+#
+# Copyright (c) 2022-2023 ZhuningOS
+#
+
+
+Name:           gpg2
+Version:        2.2.27
+Release:        150300.3.8.1
+Summary:        File encryption, decryption, signature creation and verification utility
+License:        GPL-3.0-or-later
+Group:          Productivity/Networking/Security
+URL:            https://www.gnupg.org
+Source:         ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-%{version}.tar.bz2
+Source2:        ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-%{version}.tar.bz2.sig
+# https://www.gnupg.org/signature_key.html
+Source3:        %{name}.keyring
+Source4:        scdaemon.udev
+Source99:       %{name}.changes
+Patch4:         gnupg-2.0.9-langinfo.patch
+Patch5:         gnupg-2.2.8-files-are-digests.patch
+Patch6:         gnupg-dont-fail-with-seahorse-agent.patch
+Patch8:         gnupg-set_umask_before_open_outfile.patch
+Patch9:         gnupg-detect_FIPS_mode.patch
+Patch11:        gnupg-add_legacy_FIPS_mode_option.patch
+Patch12:        gnupg-2.2.16-secmem.patch
+Patch13:        gnupg-accept_subkeys_with_a_good_revocation_but_no_self-sig_during_import.patch
+Patch14:        gnupg-add-test-cases-for-import-without-uid.patch
+Patch15:        gnupg-allow-import-of-previously-known-keys-even-without-UIDs.patch
+# PATCH-FIX-UPSTREAM boo#1201225, CVE-2022-34903 vulnerable to status injection
+Patch16:        gnupg-CVE-2022-34903.patch
+# PATCH-FIX-UPSTREAM bsc#1217212, dirmngr --validate broken for DER encoded files
+Patch17:        gnupg-dirmngr-Suppress-error-message-on-trial-reading-as-PEM.patch
+Patch18:        gnupg-dirmngr-Clear-the-error-count-to-try-certificate-as-binary.patch
+Patch1124847:   gnupg-gpg-agent-ulimit.patch
+BuildRequires:  expect
+BuildRequires:  fdupes
+BuildRequires:  libassuan-devel >= 2.5.0
+BuildRequires:  libgcrypt-devel >= 1.8.0
+BuildRequires:  libgpg-error-devel >= 1.27
+BuildRequires:  libksba-devel >= 1.3.5
+BuildRequires:  makeinfo
+BuildRequires:  npth-devel >= 1.2
+BuildRequires:  openldap2-devel
+BuildRequires:  pkgconfig
+BuildRequires:  readline-devel
+BuildRequires:  pkgconfig(bzip2)
+BuildRequires:  pkgconfig(gnutls) >= 3.0
+BuildRequires:  pkgconfig(libusb-1.0)
+BuildRequires:  pkgconfig(sqlite3) >= 3.7
+BuildRequires:  pkgconfig(zlib)
+# runtime dependency to support devel repository users - boo#955982
+Requires:       libassuan0 >= 2.5.0
+Requires:       libgcrypt20 >= 1.8.0
+Requires:       libksba >= 1.3.5
+Requires:       pinentry
+Recommends:     dirmngr = %{version}
+Provides:       gnupg = %{version}
+Provides:       gpg = 1.4.9
+Provides:       newpg
+# special feature needed for OBS signd
+Provides:       gpg2_signd_support
+Obsoletes:      gpg < 1.4.9
+
+%description
+GnuPG is a hybrid-encryption software program; it uses a combination
+of symmetric-key and public-key cryptography to encrypt/decrypt
+messages and/or to sign and verify them.
+
+gpg2 provides GPGSM, gpg-agent, and a keybox library.
+
+%package -n dirmngr
+Summary:        Keyserver, CRL, and OCSP access for GnuPG
+Group:          Productivity/Networking/Security
+
+%description -n dirmngr
+Since version  2.1 of GnuPG, dirmngr takes care of accessing the OpenPGP
+keyservers. As with previous versions it is also used as a server for managing
+and downloading certificate
+revocation lists (CRLs) for X.509 certificates, downloading X.509 certificates,
+and providing access to OCSP providers.  Dirmngr is invoked internally by gpg,
+gpgsm, or via the gpg-connect-agent tool.
+
+%lang_package
+
+%prep
+%setup -q -n gnupg-%{version}
+%patch1124847 -p1
+%patch4 -p1
+%patch5 -p1
+%patch6 -p1
+%patch8 -p1
+%patch9 -p1
+%patch11 -p1
+%patch12 -p1
+%patch13 -p1
+%patch14 -p1
+%patch15 -p1
+%patch16 -p1
+%patch17 -p1
+%patch18 -p1
+touch -d 2018-05-04 doc/gpg.texi # to compensate for patch11 in order to not have man pages and info files have the build date (boo#1047218)
+
+%build
+date=$(date -u +%%Y-%%m-%%dT%%H:%%M+0000 -r %{SOURCE99})
+%configure \
+    --libexecdir=%{_libdir} \
+    --docdir=%{_docdir}/%{name} \
+    --with-agent-pgm=%{_bindir}/gpg-agent \
+    --with-pinentry-pgm=%{_bindir}/pinentry \
+    --with-dirmngr-pgm=%{_bindir}/dirmngr \
+    --with-scdaemon-pgm=%{_bindir}/scdaemon \
+    --enable-ldap \
+    --enable-gpgsm=yes \
+    --enable-gpg \
+    --enable-gpgtar \
+    --enable-g13 \
+    --enable-large-secmem \
+    --enable-wks-tools \
+    --with-gnu-ld \
+    --with-default-trust-store-file=%{_sysconfdir}/ssl/ca-bundle.pem \
+    --enable-build-timestamp=$date \
+    --enable-gpg-is-gpg2 \
+    --enable-Werror
+
+%make_build
+
+%install
+%make_install
+mkdir -p %{buildroot}%{_sysconfdir}/gnupg/
+# bnc#391347
+install -m 644 doc/examples/gpgconf.conf %{buildroot}%{_sysconfdir}/gnupg
+# delete to prevent fdupes from creating cross-partition hardlink
+rm -rf %{buildroot}%{_docdir}/gpg2/examples/gpgconf.conf
+rm %{buildroot}%{_infodir}/dir
+# compat symlinks
+ln -sf gpg2 %{buildroot}%{_bindir}/gpg
+ln -sf gpgv2 %{buildroot}%{_bindir}/gpgv
+ln -sf gpg2.1 %{buildroot}%{_mandir}/man1/gpg.1
+ln -sf gpgv2.1 %{buildroot}%{_mandir}/man1/gpgv.1
+# fix rpmlint invalid-lc-messages-dir:
+rm -rf %{buildroot}/%{_datadir}/locale/en@{bold,}quot
+# install scdaemon to %%{_bindir} (bnc#863645)
+mv %{buildroot}%{_libdir}/scdaemon %{buildroot}%{_bindir}
+mv %{buildroot}%{_libdir}/dirmngr_ldap %{buildroot}%{_bindir}
+# install udev rules for scdaemon
+install -Dm 0644 %{SOURCE4} %{buildroot}%{_udevrulesdir}/60-scdaemon.rules
+# install legacy tools
+install -m 755 tools/gpg-zip %{buildroot}/%{_bindir}
+# install -m 755 tools/gpgsplit %%{buildroot}/%%{_bindir}
+
+%find_lang gnupg2
+%fdupes -s %{buildroot}
+
+%check
+# Run only localy, fails in OBS
+#%%if ! 0%%{?qemu_user_space_build}
+#make %%{?_smp_mflags} check
+#%%endif
+
+%post
+%udev_rules_update
+
+%files lang -f gnupg2.lang
+
+%files
+%{_infodir}/gnupg*
+%exclude %{_mandir}/*/dirmngr*%{ext_man}
+%{_mandir}/*/*%{ext_man}
+%license COPYING*
+%doc AUTHORS ChangeLog NEWS THANKS TODO doc/FAQ
+%exclude %{_docdir}/%{name}/examples/systemd-user/dirmngr.*
+%doc %{_docdir}/%{name}
+%exclude %{_bindir}/dirmngr*
+%{_bindir}/*
+%{_libdir}/[^d]*
+%{_sbindir}/addgnupghome
+%{_sbindir}/applygnupgdefaults
+%{_sbindir}/g13-syshelp
+%{_udevrulesdir}/60-scdaemon.rules
+%{_datadir}/gnupg
+%dir %{_sysconfdir}/gnupg
+%config(noreplace) %{_sysconfdir}/gnupg/gpgconf.conf
+
+%files -n dirmngr
+%license COPYING*
+%{_mandir}/*/dirmngr*%{ext_man}
+%{_docdir}/%{name}/examples/systemd-user/dirmngr.*
+%{_bindir}/dirmngr*
+
+%changelog

scdaemon.udev

@@ -0,0 +1,65 @@
+# do not edit this file, it will be overwritten on update
+
+SUBSYSTEM!="usb", GOTO="gnupg_rules_end"
+ACTION!="add", GOTO="gnupg_rules_end"
+
+# USB SmartCard Readers
+## Cherry GmbH (XX33, ST2000)
+SUBSYSTEM=="usb", ATTR{idVendor}=="046a", ATTR{idProduct}=="0005", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="046a", ATTR{idProduct}=="0010", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="046a", ATTR{idProduct}=="003e", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## SCM Microsystems, Inc (SCR331-DI, SCR335, SCR3320, SCR331, SCR3310 and SPR532)
+SUBSYSTEM=="usb", ATTR{idVendor}=="04e6", ATTR{idProduct}=="5111", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="04e6", ATTR{idProduct}=="5115", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="04e6", ATTR{idProduct}=="5116", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="04e6", ATTR{idProduct}=="5117", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="04e6", ATTR{idProduct}=="e001", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="04e6", ATTR{idProduct}=="e003", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## Omnikey AG (CardMan 3821, CardMan 6121)
+SUBSYSTEM=="usb", ATTR{idVendor}=="076b", ATTR{idProduct}=="3821", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="076b", ATTR{idProduct}=="6622", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## Gemalto
+SUBSYSTEM=="usb", ATTR{idVendor}=="08e6", ATTR{idProduct}=="3437", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="08e6", ATTR{idProduct}=="3438", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="08e6", ATTR{idProduct}=="3478", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="08e6", ATTR{idProduct}=="34c2", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="08e6", ATTR{idProduct}=="34ec", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## Reiner (SCT cyberJack)
+SUBSYSTEM=="usb", ATTR{idVendor}=="0c4b", ATTR{idProduct}=="0500", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## Kobil (KAAN)
+SUBSYSTEM=="usb", ATTR{idVendor}=="0d46", ATTR{idProduct}=="2012", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## VASCO (DIGIPASS 920)
+SUBSYSTEM=="usb", ATTR{idVendor}=="1a44", ATTR{idProduct}=="0920", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## Crypto Stick
+SUBSYSTEM=="usb", ATTR{idVendor}=="20a0", ATTR{idProduct}=="4107", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## Nitrokey
+SUBSYSTEM=="usb", ATTR{idVendor}=="20a0", ATTR{idProduct}=="4108", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="20a0", ATTR{idProduct}=="4109", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+SUBSYSTEM=="usb", ATTR{idVendor}=="20a0", ATTR{idProduct}=="4211", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## Gnuk Token
+SUBSYSTEM=="usb", ATTR{idVendor}=="234b", ATTR{idProduct}=="0000", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## Alcor Micro Corp cardreader (in ThinkPad X250)
+SUBSYSTEM=="usb", ATTR{idVendor}=="058f", ATTR{idProduct}=="9540", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## Fujitsu Siemens
+SUBSYSTEM=="usb", ATTR{idVendor}=="0bf8", ATTR{idProduct}=="1006", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## Yubico
+# Yubikey NEO OTP+CCID
+SUBSYSTEM=="usb", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0111", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+# Yubikey NEO CCID
+SUBSYSTEM=="usb", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0112", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+# Yubikey NEO U2F+CCID
+SUBSYSTEM=="usb", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0115", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+# Yubikey NEO OTP+U2F+CCID
+SUBSYSTEM=="usb", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0116", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+# Yubikey 4 CCID
+SUBSYSTEM=="usb", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0404", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+# Yubikey 4 OTP+CCID
+SUBSYSTEM=="usb", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0405", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+# Yubikey 4 U2F+CCID
+SUBSYSTEM=="usb", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0406", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+# Yubikey 4 OTP+U2F+CCID
+SUBSYSTEM=="usb", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0407", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+## Trustica Cryptoucan
+SUBSYSTEM=="usb", ATTR{idVendor}=="1fc9", ATTR{idProduct}=="81e6", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+
+LABEL="gnupg_rules_end"