开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 2

_service:extract_file:gnupg2.spec Deleted

@@ -1,164 +0,0 @@
-Name: gnupg2
-Version: 2.3.4
-Release: 1
-Summary: Utility for secure communication and data storage
-
-License: GPLv3+
-URL: https://gnupg.org/
-Source0: https://www.gnupg.org/ftp/gcrypt/gnupg/gnupg-%{version}.tar.bz2
-Source1: https://www.gnupg.org/ftp/gcrypt/gnupg/gnupg-%{version}.tar.bz2.sig
-
-Patch0:  gnupg-2.1.10-secmem.patch
-Patch1:  gnupg-2.1.1-fips-algo.patch
-Patch2:  gnupg-2.2.23-large-rsa.patch
-Patch3:  gnupg-2.2.16-ocsp-keyusage.patch
-Patch4:  gnupg-2.2.18-gpg-accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
-Patch5:  gnupg-2.2.18-gpg-allow-import-of-previously-known-keys-even-without-UI.patch
-Patch6:  gnupg-2.2.18-tests-add-test-cases-for-import-without-uid.patch
-Patch7:  gnupg-2.2.20-file-is-digest.patch
-Patch8:  gnupg-2.2.21-coverity.patch
-
-BuildRequires: gcc
-BuildRequires: zlib-devel, npth-devel, texinfo
-BuildRequires: libgpg-error-devel >= 1.38
-BuildRequires: libgcrypt-devel >= 1.9.1
-BuildRequires: libksba-devel >= 1.3.0
-BuildRequires: libassuan-devel >= 2.1.0
-# compile dirmngr module, need gnutls
-BuildRequires: gnutls-devel
-
-Requires: libgcrypt >= 1.9.1
-Requires: libgpg-error >= 1.38
-
-Recommends: pinentry
-Recommends: gnupg2-smime
-
-Provides: gpg = %{version}-%{release}
-Provides: gnupg = %{version}-%{release}
-Provides: dirmngr = %{version}-%{release}
-Provides: gnupg2-smime
-
-Obsoletes: gnupg <= 1.4.24
-Obsoletes: dirmngr < 1.2.0-1
-Obsoletes: gnupg2-smime
-
-%description
-GnuPG is a complete and free implementation of the OpenPGP standard
-as defined by RFC4880 (also known as PGP).  GnuPG enables encryption
-and signing of data and communication, and features a versatile key
-management system as well as access modules for public key
-directories.
-
-GnuPG 2.0 adds support for smart cards and S/MIME encryption and
-signing to the base GnuPG package.
-
-%package_help
-
-%prep
-%autosetup -n gnupg-%{version} -p1
-
-%global pcsclib %(basename $(ls -1 %{_libdir}/libpcsclite.so.? 2>/dev/null ) 2>/dev/null )
-
-sed -i -e 's/"libpcsclite\.so"/"%{pcsclib}"/' scd/scdaemon.c
-
-%build
-# add --disable-ccid-driver to solve #2005714
-# disable tpm2 module
-%configure \
-  --disable-gpgtar \
-  --disable-rpath \
-  --enable-g13 \
-  --disable-ccid-driver \
-  --disable-tpm2d \
-  --enable-large-secmem
-
-%make_build
-
-%install
-%make_install
-
-%find_lang %{name}
-
-mkdir -p %{buildroot}%{_sysconfdir}/gnupg
-touch %{buildroot}%{_sysconfdir}/gnupg/gpgconf.conf
-
-ln -sf gpg %{buildroot}%{_bindir}/gpg2
-ln -sf gpgv %{buildroot}%{_bindir}/gpgv2
-ln -sf gpg.1 %{buildroot}%{_mandir}/man1/gpg2.1
-ln -sf gpgv.1 %{buildroot}%{_mandir}/man1/gpgv2.1
-ln -sf gnupg.7 %{buildroot}%{_mandir}/man7/gnupg2.7
-
-rm -f %{buildroot}%{_infodir}/dir
-
-%check
-make check
-
-%files -f %{name}.lang
-%defattr(-,root,root)
-%license COPYING
-%doc README AUTHORS
-%dir %{_sysconfdir}/gnupg
-%ghost %config(noreplace) %{_sysconfdir}/gnupg/gpgconf.conf
-%{_bindir}/gpg*
-%{_bindir}/g13
-%{_bindir}/dirmngr*
-%{_bindir}/watchgnupg
-%{_bindir}/kbxutil
-%{_sbindir}/*
-%{_libexecdir}/*
-
-
-%files help
-%defattr(-,root,root)
-%doc NEWS TODO THANKS
-%{_infodir}/*info*.gz
-%{_datadir}/gnupg/
-%{_datadir}/doc/gnupg/*
-%{_mandir}/man?/*
-
-
-%changelog
-* Mon Jan 10 2022 yixiangzhike <yixiangzhike007@163.com> - 2.3.4-1
-- update to 2.3.4
-
-* Mon Aug 2 2021 yixiangzhike <zhangxingliang3@huawei.com> - 2.2.27-4
-- fix the insttools patch
-
-* Mon Jul 26 2021 zoulin <zoulin13@huawei.com> - 2.2.27-3
-- remove unnecessary BuildRequires:gdb
-
-* Wed May 26 2021 yixiangzhike <zhangxingliang3@huawei.com> - 2.2.27-2
-- add gcc to BuildRequires
-
-* Thu Jan 28 2021 yixiangzhike <zhangxingliang3@huawei.com> - 2.2.27-1
-- update to 2.2.27
-
-* Thu Sep 10 2020 zhangxingliang <zhangxingliang3@huawei.com> - 2.2.21-3
-- fix AEAD preference list overflow for CVE-2020-25125
-
-* Tue Aug 4 2020 wangchen <wangchen137@huawei.com> - 2.2.21-2
-- fix undefined shift in block_filter()
-
-* Sat Jul 25 2020 yang_zhuang_zhuang <yangzhuangzhuang1@huawei.com> - 2.2.21-1
-- update version to 2.2.21
-
-* Wed Jun 3 2020 Anakin Zhang <nbztx@126.com> - 2.2.17-7
-- fix a memory leak in g10
-
-* Wed Apr 22 2020 Anakin Zhang <nbztx@126.com> - 2.2.17-6
-- fix CVE-2019-14855
-
-* Sat Mar 14 2020 openEuler Buildteam <buildteam@openeuler.org> - 2.2.17-5
-- Add build requires of gdb
-
-* Fri Jan 10 2020 openEuler Buildteam <buildteam@openeuler.org> - 2.2.17-4
-- clean code
-
-* Fri Oct 25 2019 openEuler Buildteam <buildteam@openeuler.org> - 2.2.17-3
-- add gpg and gpgv
-
-* Thu Oct 24 2019 openEuler Buildteam <buildteam@openeuler.org> - 2.2.17-2
-- add symlinks
-
-* Thu Sep 12 2019 openEuler Buildteam <buildteam@openeuler.org> - 2.2.17-1
-- Package init

_service:tar_scm:gnupg2.spec Added

@@ -0,0 +1,176 @@
+Name: gnupg2
+Version: 2.3.6
+Release: 3
+Summary: Utility for secure communication and data storage
+
+License: GPLv3+
+URL: https://gnupg.org/
+Source0: https://www.gnupg.org/ftp/gcrypt/gnupg/gnupg-%{version}.tar.bz2
+Source1: https://www.gnupg.org/ftp/gcrypt/gnupg/gnupg-%{version}.tar.bz2.sig
+
+Patch0:  gnupg-2.1.10-secmem.patch
+Patch1:  gnupg-2.1.1-fips-algo.patch
+Patch2:  gnupg-2.2.23-large-rsa.patch
+Patch3:  gnupg-2.2.16-ocsp-keyusage.patch
+Patch4:  gnupg-2.2.18-gpg-accept-subkeys-with-a-good-revocation-but-no-self-sig.patch
+Patch5:  gnupg-2.2.18-gpg-allow-import-of-previously-known-keys-even-without-UI.patch
+Patch6:  gnupg-2.2.18-tests-add-test-cases-for-import-without-uid.patch
+Patch7:  gnupg-2.2.20-file-is-digest.patch
+Patch8:  gnupg-2.2.21-coverity.patch
+Patch9:  backport-CVE-2022-34903.patch
+
+BuildRequires: gcc
+BuildRequires: zlib-devel, npth-devel, texinfo
+BuildRequires: libgpg-error-devel >= 1.41
+BuildRequires: libgcrypt-devel >= 1.9.4
+BuildRequires: libksba-devel >= 1.3.0
+BuildRequires: libassuan-devel >= 2.1.0
+# compile dirmngr module, need gnutls
+BuildRequires: gnutls-devel
+
+Requires: libgcrypt >= 1.9.4
+Requires: libgpg-error >= 1.41
+
+Recommends: pinentry
+Recommends: gnupg2-smime
+
+Provides: gpg = %{version}-%{release}
+Provides: gnupg = %{version}-%{release}
+Provides: dirmngr = %{version}-%{release}
+Provides: gnupg2-smime
+
+Obsoletes: gnupg <= 1.4.24
+Obsoletes: dirmngr < 1.2.0-1
+Obsoletes: gnupg2-smime
+
+%description
+GnuPG is a complete and free implementation of the OpenPGP standard
+as defined by RFC4880 (also known as PGP).  GnuPG enables encryption
+and signing of data and communication, and features a versatile key
+management system as well as access modules for public key
+directories.
+
+GnuPG 2.0 adds support for smart cards and S/MIME encryption and
+signing to the base GnuPG package.
+
+%package_help
+
+%prep
+%autosetup -n gnupg-%{version} -p1
+
+%global pcsclib %(basename $(ls -1 %{_libdir}/libpcsclite.so.? 2>/dev/null ) 2>/dev/null )
+
+sed -i -e 's/"libpcsclite\.so"/"%{pcsclib}"/' scd/scdaemon.c
+
+%build
+# add --disable-ccid-driver to solve #2005714
+# disable tpm2 module
+%configure \
+  --disable-gpgtar \
+  --disable-rpath \
+  --enable-g13 \
+  --disable-ccid-driver \
+  --disable-tpm2d \
+  --enable-large-secmem
+
+%make_build
+
+%install
+%make_install
+
+%find_lang %{name}
+
+mkdir -p %{buildroot}%{_sysconfdir}/gnupg
+touch %{buildroot}%{_sysconfdir}/gnupg/gpgconf.conf
+
+ln -sf gpg %{buildroot}%{_bindir}/gpg2
+ln -sf gpgv %{buildroot}%{_bindir}/gpgv2
+ln -sf gpg.1 %{buildroot}%{_mandir}/man1/gpg2.1
+ln -sf gpgv.1 %{buildroot}%{_mandir}/man1/gpgv2.1
+ln -sf gnupg.7 %{buildroot}%{_mandir}/man7/gnupg2.7
+
+rm -f %{buildroot}%{_infodir}/dir
+
+%check
+make check
+
+%files -f %{name}.lang
+%defattr(-,root,root)
+%license COPYING
+%doc README AUTHORS
+%dir %{_sysconfdir}/gnupg
+%ghost %config(noreplace) %{_sysconfdir}/gnupg/gpgconf.conf
+%{_bindir}/gpg*
+%{_bindir}/g13
+%{_bindir}/dirmngr*
+%{_bindir}/watchgnupg
+%{_bindir}/kbxutil
+%{_sbindir}/*
+%{_libexecdir}/*
+
+
+%files help
+%defattr(-,root,root)
+%doc NEWS TODO THANKS
+%{_infodir}/*info*.gz
+%{_datadir}/gnupg/
+%{_datadir}/doc/gnupg/*
+%exclude %{_datadir}/gnupg/sks-keyservers.netCA.pem
+%{_mandir}/man?/*
+
+
+%changelog
+* Mon Aug 15 2022 yixiangzhike <yixiangzhike007@163.com> - 2.3.6-3
+- fix CVE-2022-34903
+
+* Wed Jul 6 2022 yixiangzhike <yixiangzhike007@163.com> - 2.3.6-2
+- cleanup unused patch files
+
+* Mon Jun 27 2022 yixiangzhike <yixiangzhike007@163.com> - 2.3.6-1
+- update to 2.3.6, need require new version libgpg-error(1.41) and libgcrypt(1.9.4)
+- do not provide unused sks-keyserver CA certificate
+
+* Mon Jan 10 2022 yixiangzhike <yixiangzhike007@163.com> - 2.3.4-1
+- update to 2.3.4
+
+* Mon Aug 2 2021 yixiangzhike <zhangxingliang3@huawei.com> - 2.2.27-4
+- fix the insttools patch
+
+* Mon Jul 26 2021 zoulin <zoulin13@huawei.com> - 2.2.27-3
+- remove unnecessary BuildRequires:gdb
+
+* Wed May 26 2021 yixiangzhike <zhangxingliang3@huawei.com> - 2.2.27-2
+- add gcc to BuildRequires
+
+* Thu Jan 28 2021 yixiangzhike <zhangxingliang3@huawei.com> - 2.2.27-1
+- update to 2.2.27
+
+* Thu Sep 10 2020 zhangxingliang <zhangxingliang3@huawei.com> - 2.2.21-3
+- fix AEAD preference list overflow for CVE-2020-25125
+
+* Tue Aug 4 2020 wangchen <wangchen137@huawei.com> - 2.2.21-2
+- fix undefined shift in block_filter()
+
+* Sat Jul 25 2020 yang_zhuang_zhuang <yangzhuangzhuang1@huawei.com> - 2.2.21-1
+- update version to 2.2.21
+
+* Wed Jun 3 2020 Anakin Zhang <nbztx@126.com> - 2.2.17-7
+- fix a memory leak in g10
+
+* Wed Apr 22 2020 Anakin Zhang <nbztx@126.com> - 2.2.17-6
+- fix CVE-2019-14855
+
+* Sat Mar 14 2020 openEuler Buildteam <buildteam@openeuler.org> - 2.2.17-5
+- Add build requires of gdb
+
+* Fri Jan 10 2020 openEuler Buildteam <buildteam@openeuler.org> - 2.2.17-4
+- clean code
+
+* Fri Oct 25 2019 openEuler Buildteam <buildteam@openeuler.org> - 2.2.17-3
+- add gpg and gpgv
+
+* Thu Oct 24 2019 openEuler Buildteam <buildteam@openeuler.org> - 2.2.17-2
+- add symlinks
+
+* Thu Sep 12 2019 openEuler Buildteam <buildteam@openeuler.org> - 2.2.17-1
+- Package init

_service:extract_file:common-Avoid-undefined-behavior-of-left-shift-operat.patch Deleted

@@ -1,52 +0,0 @@
-From 8abf065307ff4a7ea873fe59f76173bf17dac241 Mon Sep 17 00:00:00 2001
-From: NIIBE Yutaka <gniibe@fsij.org>
-Date: Thu, 16 Jul 2020 11:00:45 +0900
-Subject: PATCH common: Avoid undefined behavior of left shift operator.
-
-* common/iobuf.c (block_filter): Handle an error earlier.
-Make sure it's unsigned.
-
---
-
-GnuPG-bug-id: 4975
-Suggested-by: lutianxiong <lutianxiong@huawei.com>
-Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
----
- common/iobuf.c | 16 +++++++++++-----
- 1 file changed, 11 insertions(+), 5 deletions(-)
-
-diff --git a/common/iobuf.c b/common/iobuf.c
-index 43f2e10..a00ee0b 100644
---- a/common/iobuf.c
-+++ b/common/iobuf.c
-@@ -909,16 +909,22 @@ block_filter (void *opaque, int control, iobuf_t chain, byte * buffer,
- 		    }
- 		  else if (c == 255)
- 		    {
--		      a->size = iobuf_get_noeof (chain) << 24;
--		      a->size |= iobuf_get_noeof (chain) << 16;
--		      a->size |= iobuf_get_noeof (chain) << 8;
--		      if ((c = iobuf_get (chain)) == -1)
-+                      size_t len = 0;
-+                      int i;
-+
-+                      for (i = 0; i < 4; i++)
-+                        if ((c = iobuf_get (chain)) == -1)
-+                          break;
-+                        else
-+                          len = ((len << 8) | c);
-+
-+                      if (i < 4)
- 			{
- 			  log_error ("block_filter: invalid 4 byte length\n");
- 			  rc = GPG_ERR_BAD_DATA;
- 			  break;
- 			}
--		      a->size |= c;
-+                      a->size = len;
-                       a->partial = 2;
-                       if (!a->size)
-                         {
--- 
-1.8.3.1
-

_service:extract_file:fix-a-memory-leak-in-g10.patch Deleted

_service:extract_file:gnupg-2.1.1-fips-algo.patch Deleted

_service:extract_file:gnupg-2.1.10-secmem.patch Deleted

@@ -1,33 +0,0 @@
-diff -up gnupg-2.1.10/g10/gpg.c.secmem gnupg-2.1.10/g10/gpg.c
---- gnupg-2.1.10/g10/gpg.c.secmem	2015-12-04 10:53:27.000000000 +0100
-+++ gnupg-2.1.10/g10/gpg.c	2015-12-07 15:32:38.922812652 +0100
-@@ -889,7 +889,7 @@ make_libversion (const char *libname, co
- 
-   if (maybe_setuid)
-     {
--      gcry_control (GCRYCTL_INIT_SECMEM, 0, 0);  /* Drop setuid. */
-+      gcry_control (GCRYCTL_INIT_SECMEM, 4096, 0);  /* Drop setuid. */
-       maybe_setuid = 0;
-     }
-   s = getfnc (NULL);
-@@ -1041,7 +1041,7 @@ build_list (const char *text, char lette
-   char *string;
- 
-   if (maybe_setuid)
--    gcry_control (GCRYCTL_INIT_SECMEM, 0, 0);  /* Drop setuid. */
-+    gcry_control (GCRYCTL_INIT_SECMEM, 4096, 0);  /* Drop setuid. */
- 
-   indent = utf8_charcount (text, -1);
-   len = 0;
-diff -up gnupg-2.1.10/sm/gpgsm.c.secmem gnupg-2.1.10/sm/gpgsm.c
---- gnupg-2.1.10/sm/gpgsm.c.secmem	2015-11-30 17:39:52.000000000 +0100
-+++ gnupg-2.1.10/sm/gpgsm.c	2015-12-07 15:31:17.226884207 +0100
-@@ -530,7 +530,7 @@ make_libversion (const char *libname, co
- 
-   if (maybe_setuid)
-     {
--      gcry_control (GCRYCTL_INIT_SECMEM, 0, 0);  /* Drop setuid. */
-+      gcry_control (GCRYCTL_INIT_SECMEM, 4096, 0);  /* Drop setuid. */
-       maybe_setuid = 0;
-     }
-   s = getfnc (NULL);

_service:extract_file:gnupg-2.2.16-ocsp-keyusage.patch Deleted

_service:extract_file:gnupg-2.2.18-gpg-accept-subkeys-with-a-good-revocation-but-no-self-sig.patch Deleted

@@ -1,32 +0,0 @@
-From: Vincent Breitmoser <look@my.amazin.horse>
-Date: Thu, 13 Jun 2019 21:27:43 +0200
-Subject: gpg: accept subkeys with a good revocation but no self-sig during
- import
-
-* g10/import.c (chk_self_sigs): Set the NODE_GOOD_SELFSIG flag when we
-encounter a valid revocation signature. This allows import of subkey
-revocation signatures, even in the absence of a corresponding subkey
-binding signature.
-
---
-
-This fixes the remaining test in import-incomplete.scm.
-
-GnuPG-Bug-id: 4393
-Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
----
- g10/import.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/g10/import.c b/g10/import.c
-index f9acf95..9217911 100644
---- a/g10/import.c
-+++ b/g10/import.c
-@@ -3602,6 +3602,7 @@ chk_self_sigs (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid, int *non_self)
-                   /* It's valid, so is it newer? */
-                   if (sig->timestamp >= rsdate)
-                     {
-+                      knode->flag |= NODE_GOOD_SELFSIG; /* Subkey is valid.  */
-                       if (rsnode)
-                         {
-                           /* Delete the last revocation sig since

_service:extract_file:gnupg-2.2.18-gpg-allow-import-of-previously-known-keys-even-without-UI.patch Deleted

@@ -1,107 +0,0 @@
-From: Vincent Breitmoser <look@my.amazin.horse>
-Date: Thu, 13 Jun 2019 21:27:42 +0200
-Subject: gpg: allow import of previously known keys, even without UIDs
-
-* g10/import.c (import_one): Accept an incoming OpenPGP certificate that
-has no user id, as long as we already have a local variant of the cert
-that matches the primary key.
-
---
-
-This fixes two of the three broken tests in import-incomplete.scm.
-
-GnuPG-Bug-id: 4393
-Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
----
- g10/import.c | 44 +++++++++++---------------------------------
- 1 file changed, 11 insertions(+), 33 deletions(-)
-
-diff --git a/g10/import.c b/g10/import.c
-index 5d3162c..f9acf95 100644
---- a/g10/import.c
-+++ b/g10/import.c
-@@ -1788,7 +1788,6 @@ import_one_real (ctrl_t ctrl,
-   size_t an;
-   char pkstrbufPUBKEY_STRING_SIZE;
-   int merge_keys_done = 0;
--  int any_filter = 0;
-   KEYDB_HANDLE hd = NULL;
- 
-   if (r_valid)
-@@ -1825,14 +1824,6 @@ import_one_real (ctrl_t ctrl,
-       log_printf ("\n");
-     }
- 
--
--  if (!uidnode)
--    {
--      if (!silent)
--        log_error( _("key %s: no user ID\n"), keystr_from_pk(pk));
--      return 0;
--    }
--
-   if (screener && screener (keyblock, screener_arg))
-     {
-       log_error (_("key %s: %s\n"), keystr_from_pk (pk),
-@@ -1907,18 +1898,10 @@ import_one_real (ctrl_t ctrl,
- 	  }
-     }
- 
--  /* Delete invalid parts and bail out if there are no user ids left.  */
--  if (!delete_inv_parts (ctrl, keyblock, keyid, options))
--    {
--      if (!silent)
--        {
--          log_error ( _("key %s: no valid user IDs\n"), keystr_from_pk(pk));
--          if (!opt.quiet)
--            log_info(_("this may be caused by a missing self-signature\n"));
--        }
--      stats->no_user_id++;
--      return 0;
--    }
-+  /* Delete invalid parts, and note if we have any valid ones left.
-+   * We will later abort import if this key is new but contains
-+   * no valid uids.  */
-+  delete_inv_parts (ctrl, keyblock, keyid, options);
- 
-   /* Get rid of deleted nodes.  */
-   commit_kbnode (&keyblock);
-@@ -1927,24 +1911,11 @@ import_one_real (ctrl_t ctrl,
-     {
-       apply_keep_uid_filter (ctrl, keyblock, import_filter.keep_uid);
-       commit_kbnode (&keyblock);
--      any_filter = 1;
-     }
-   if (import_filter.drop_sig)
-     {
-       apply_drop_sig_filter (ctrl, keyblock, import_filter.drop_sig);
-       commit_kbnode (&keyblock);
--      any_filter = 1;
--    }
--
--  /* If we ran any filter we need to check that at least one user id
--   * is left in the keyring.  Note that we do not use log_error in
--   * this case. */
--  if (any_filter && !any_uid_left (keyblock))
--    {
--      if (!opt.quiet )
--        log_info ( _("key %s: no valid user IDs\n"), keystr_from_pk (pk));
--      stats->no_user_id++;
--      return 0;
-     }
- 
-   /* The keyblock is valid and ready for real import.  */
-@@ -2002,6 +1973,13 @@ import_one_real (ctrl_t ctrl,
-       err = 0;
-       stats->skipped_new_keys++;
-     }
-+  else if (err && !any_uid_left (keyblock))
-+    {
-+      if (!silent)
-+        log_info( _("key %s: new key but contains no user ID - skipped\n"), keystr(keyid));
-+      err = 0;
-+      stats->no_user_id++;
-+    }
-   else if (err)  /* Insert this key. */
-     {
-       /* Note: ERR can only be NO_PUBKEY or UNUSABLE_PUBKEY.  */

_service:extract_file:gnupg-2.2.18-tests-add-test-cases-for-import-without-uid.patch Deleted

@@ -1,201 +0,0 @@
-From: Vincent Breitmoser <look@my.amazin.horse>
-Date: Thu, 13 Jun 2019 21:27:41 +0200
-Subject: tests: add test cases for import without uid
-
-This commit adds a test case that does the following, in order:
-- Import of a primary key plus user id
-- Check that import of a subkey works, without a user id present in the
-imported key
-- Check that import of a subkey revocation works, without a user id or
-subkey binding signature present in the imported key
-- Check that import of a primary key revocation works, without a user id
-present in the imported key
-
---
-
-Note that this test currently fails.  The following changesets will
-fix gpg so that the tests pass.
-
-GnuPG-Bug-id: 4393
-Signed-Off-By: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
----
- tests/openpgp/Makefile.am                          |  1 +
- tests/openpgp/import-incomplete.scm                | 68 ++++++++++++++++++++++
- .../import-incomplete/primary+revocation.asc       |  9 +++
- .../primary+subkey+sub-revocation.asc              | 10 ++++
- .../import-incomplete/primary+subkey+sub-sig.asc   | 10 ++++
- .../openpgp/import-incomplete/primary+uid-sig.asc  | 10 ++++
- tests/openpgp/import-incomplete/primary+uid.asc    | 10 ++++
- 7 files changed, 118 insertions(+)
- create mode 100755 tests/openpgp/import-incomplete.scm
- create mode 100644 tests/openpgp/import-incomplete/primary+revocation.asc
- create mode 100644 tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
- create mode 100644 tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
- create mode 100644 tests/openpgp/import-incomplete/primary+uid-sig.asc
- create mode 100644 tests/openpgp/import-incomplete/primary+uid.asc
-
-diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
-index f6014c9..6423da1 100644
---- a/tests/openpgp/Makefile.am
-+++ b/tests/openpgp/Makefile.am
-@@ -78,6 +78,7 @@ XTESTS = \
- 	gpgv-forged-keyring.scm \
- 	armor.scm \
- 	import.scm \
-+	import-incomplete.scm \
- 	import-revocation-certificate.scm \
- 	ecc.scm \
- 	4gb-packet.scm \
-diff --git a/tests/openpgp/import-incomplete.scm b/tests/openpgp/import-incomplete.scm
-new file mode 100755
-index 0000000..727a027
---- /dev/null
-+++ b/tests/openpgp/import-incomplete.scm
-@@ -0,0 +1,68 @@
-+#!/usr/bin/env gpgscm
-+
-+;; Copyright (C) 2016 g10 Code GmbH
-+;;
-+;; This file is part of GnuPG.
-+;;
-+;; GnuPG is free software; you can redistribute it and/or modify
-+;; it under the terms of the GNU General Public License as published by
-+;; the Free Software Foundation; either version 3 of the License, or
-+;; (at your option) any later version.
-+;;
-+;; GnuPG is distributed in the hope that it will be useful,
-+;; but WITHOUT ANY WARRANTY; without even the implied warranty of
-+;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+;; GNU General Public License for more details.
-+;;
-+;; You should have received a copy of the GNU General Public License
-+;; along with this program; if not, see <http://www.gnu.org/licenses/>.
-+
-+(load (in-srcdir "tests" "openpgp" "defs.scm"))
-+(setup-environment)
-+
-+(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+uid.asc")))
-+
-+(info "Test import of new subkey, from a certificate without uid")
-+(define keyid "573EA710367356BB")
-+(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+subkey+sub-sig.asc")))
-+(tr:do
-+ (tr:pipe-do
-+  (pipe:gpg `(--list-keys --with-colons ,keyid)))
-+ (tr:call-with-content
-+  (lambda (c)
-+    ;; XXX we do not have a regexp library
-+    (unless (any (lambda (line)
-+		   (and (string-prefix? line "sub:")
-+			(string-contains? line "573EA710367356BB")))
-+		 (string-split-newlines c))
-+	    (exit 1)))))
-+
-+(info "Test import of a subkey revocation, from a certificate without uid")
-+(define keyid "573EA710367356BB")
-+(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+subkey+sub-revocation.asc")))
-+(tr:do
-+ (tr:pipe-do
-+  (pipe:gpg `(--list-keys --with-colons ,keyid)))
-+ (tr:call-with-content
-+  (lambda (c)
-+    ;; XXX we do not have a regexp library
-+    (unless (any (lambda (line)
-+		   (and (string-prefix? line "sub:r:")
-+			(string-contains? line "573EA710367356BB")))
-+		 (string-split-newlines c))
-+	    (exit 1)))))
-+
-+(info "Test import of revocation, from a certificate without uid")
-+(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+revocation.asc")))
-+(tr:do
-+ (tr:pipe-do
-+  (pipe:gpg `(--list-keys --with-colons ,keyid)))
-+ (tr:call-with-content
-+  (lambda (c)
-+    ;; XXX we do not have a regexp library
-+    (unless (any (lambda (line)
-+		   (and (string-prefix? line "pub:r:")
-+			(string-contains? line "0843DA969AA8DAFB")))
-+		 (string-split-newlines c))
-+	    (exit 1)))))
-+
-diff --git a/tests/openpgp/import-incomplete/primary+revocation.asc b/tests/openpgp/import-incomplete/primary+revocation.asc
-new file mode 100644
-index 0000000..6b7b608
---- /dev/null
-+++ b/tests/openpgp/import-incomplete/primary+revocation.asc
-@@ -0,0 +1,9 @@
-+-----BEGIN PGP PUBLIC KEY BLOCK-----
-+Comment: E primary key, revocation signature over primary (no user ID)
-+
-+mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
-+631VAN2IeAQgFggAIBYhBLRpj5W82H/gSMzKKQhD2paaqNr7BQJc2ZQZAh0AAAoJ
-+EAhD2paaqNr7qAwA/2jBUpnN0BxwRO/4CrxvrLIsL+C9aSXJUOTv8XkP4lvtAQD3
-+XsDFfFNgEueiTfF7HtOGt5LPmRqVvUpQSMVgJJW6CQ==
-+=tM90
-+-----END PGP PUBLIC KEY BLOCK-----
-diff --git a/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc b/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
-new file mode 100644
-index 0000000..83a51a5
---- /dev/null
-+++ b/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
-@@ -0,0 +1,10 @@
-+-----BEGIN PGP PUBLIC KEY BLOCK-----
-+Comment: D primary key, subkey, subkey revocation (no user ID)
-+
-+mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
-+631VAN24OARc2ZQhEgorBgEEAZdVAQUBAQdABsd5ha0AWXdXcSmfeiWIfrNcGqQK
-+j++lwwWDAOlkVicDAQgHiHgEKBYIACAWIQS0aY+VvNh/4EjMyikIQ9qWmqja+wUC
-+XNmnkAIdAgAKCRAIQ9qWmqja+ylaAQDmIKf86BJEq4OpDqU+V9D+wn2cyuxbyWVQ
-+3r9LiL9qNwD/QAjyrhSN8L3Mfq+wdTHo5i0yB9ZCCpHLXSbhCqfWZwQ=
-+=dwx2
-+-----END PGP PUBLIC KEY BLOCK-----
-diff --git a/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc b/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
-new file mode 100644
-index 0000000..dc47a02
---- /dev/null
-+++ b/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
-@@ -0,0 +1,10 @@
-+-----BEGIN PGP PUBLIC KEY BLOCK-----
-+Comment: B primary key, subkey, subkey binding sig (no user ID)
-+
-+mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
-+631VAN24OARc2ZQhEgorBgEEAZdVAQUBAQdABsd5ha0AWXdXcSmfeiWIfrNcGqQK
-+j++lwwWDAOlkVicDAQgHiHgEGBYIACAWIQS0aY+VvNh/4EjMyikIQ9qWmqja+wUC
-+XNmUIQIbDAAKCRAIQ9qWmqja++vFAP98G1L+1/rWTGbsnxOAV2RocBYIroAvsbkR
-+Ly6FdP8YNwEA7jOgT05CoKIe37MstpOz23mM80AK369Ca3JMmKKCQgg=
-+=xuDu
-+-----END PGP PUBLIC KEY BLOCK-----
-diff --git a/tests/openpgp/import-incomplete/primary+uid-sig.asc b/tests/openpgp/import-incomplete/primary+uid-sig.asc
-new file mode 100644
-index 0000000..134607d
---- /dev/null
-+++ b/tests/openpgp/import-incomplete/primary+uid-sig.asc
-@@ -0,0 +1,10 @@
-+-----BEGIN PGP PUBLIC KEY BLOCK-----
-+Comment: C primary key and self-sig expiring in 2024 (no user ID)
-+
-+mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
-+631VAN2IlgQTFggAPgIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgBYhBLRpj5W8
-+2H/gSMzKKQhD2paaqNr7BQJc2ZR1BQkJZgHcAAoJEAhD2paaqNr79soA/0lWkUsu
-+3NLwgbni6EzJxnTzgeNMpljqNpipHAwfix9hAP93AVtFdC8g7hdUZxawobl9lnSN
-+9ohXOEBWvdJgVv2YAg==
-+=KWIK
-+-----END PGP PUBLIC KEY BLOCK-----
-diff --git a/tests/openpgp/import-incomplete/primary+uid.asc b/tests/openpgp/import-incomplete/primary+uid.asc
-new file mode 100644
-index 0000000..055f300
---- /dev/null
-+++ b/tests/openpgp/import-incomplete/primary+uid.asc
-@@ -0,0 +1,10 @@
-+-----BEGIN PGP PUBLIC KEY BLOCK-----
-+Comment: A primary key, user ID, and self-sig expiring in 2021
-+
-+mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
-+631VAN20CHRlc3Qga2V5iJYEExYIAD4WIQS0aY+VvNh/4EjMyikIQ9qWmqja+wUC
-+XNmUGQIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRAIQ9qWmqja
-++0G1AQDdQiwhXxjXLMqoth+D4SigVHTJK8ORwifzsy3UE7mPGwD/aZ67XbAF/lgI
-+kv2O1Jo0u9BL9RNNF+L0DM7rAFbfMAs=

_service:extract_file:gnupg-2.2.20-file-is-digest.patch Deleted

@@ -1,212 +0,0 @@
-diff -up gnupg-2.2.20/g10/gpg.c.file-is-digest gnupg-2.2.20/g10/gpg.c
---- gnupg-2.2.20/g10/gpg.c.file-is-digest	2020-04-14 16:33:42.630269318 +0200
-+++ gnupg-2.2.20/g10/gpg.c	2020-04-14 16:34:46.455100086 +0200
-@@ -380,6 +380,7 @@ enum cmd_and_opt_values
-     oTTYtype,
-     oLCctype,
-     oLCmessages,
-+    oFileIsDigest,
-     oXauthority,
-     oGroup,
-     oUnGroup,
-@@ -831,6 +832,7 @@ static ARGPARSE_OPTS opts = {
-   ARGPARSE_s_s (oTempDir,  "temp-directory", "@"),
-   ARGPARSE_s_s (oExecPath, "exec-path", "@"),
-   ARGPARSE_s_n (oExpert,      "expert", "@"),
-+  ARGPARSE_s_n (oFileIsDigest, "file-is-digest", "@"),
-   ARGPARSE_s_n (oNoExpert, "no-expert", "@"),
-   ARGPARSE_s_n (oNoSecmemWarn, "no-secmem-warning", "@"),
-   ARGPARSE_s_n (oRequireSecmem, "require-secmem", "@"),
-@@ -2419,6 +2421,7 @@ main (int argc, char **argv)
-     opt.keyid_format = KF_NONE;
-     opt.def_sig_expire = "0";
-     opt.def_cert_expire = "0";
-+    opt.file_is_digest = 0;
-     opt.passphrase_repeat = 1;
-     opt.emit_version = 0;
-     opt.weak_digests = NULL;
-@@ -2997,6 +3000,7 @@ main (int argc, char **argv)
- 	  case oPhotoViewer: opt.photo_viewer = pargs.r.ret_str; break;
- 
- 	  case oForceAEAD: opt.force_aead = 1; break;
-+	  case oFileIsDigest: opt.file_is_digest = 1; break;
- 
-           case oDisableSignerUID: opt.flags.disable_signer_uid = 1; break;
-           case oIncludeKeyBlock:  opt.flags.include_key_block = 1; break;
-diff -up gnupg-2.2.20/g10/options.h.file-is-digest gnupg-2.2.20/g10/options.h
---- gnupg-2.2.20/g10/options.h.file-is-digest	2020-03-14 19:54:05.000000000 +0100
-+++ gnupg-2.2.20/g10/options.h	2020-04-14 16:33:42.634269245 +0200
-@@ -202,6 +202,7 @@ struct
-   int no_auto_check_trustdb;
-   int preserve_permissions;
-   int no_homedir_creation;
-+  int file_is_digest;
-   struct groupitem *grouplist;
-   int mangle_dos_filenames;
-   int enable_progress_filter;
-diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
---- gnupg-2.2.20/g10/sign.c.file-is-digest	2020-03-14 19:35:46.000000000 +0100
-+++ gnupg-2.2.20/g10/sign.c	2020-04-14 16:36:54.661751422 +0200
-@@ -40,6 +40,7 @@
- #include "pkglue.h"
- #include "../common/sysutils.h"
- #include "call-agent.h"
-+#include "../common/host2net.h"
- #include "../common/mbox-util.h"
- #include "../common/compliance.h"
- 
-@@ -834,6 +835,8 @@ write_signature_packets (ctrl_t ctrl,
- 
-       if (pk->version >= 5)
-         sig->version = 5;  /* Required for v5 keys.  */
-+      else if (opt.file_is_digest)
-+        sig->version = 3;
-       else
-         sig->version = 4;  /* Required.  */
- 
-@@ -860,14 +863,22 @@ write_signature_packets (ctrl_t ctrl,
-       if (gcry_md_copy (&md, hash))
-         BUG ();
- 
--      build_sig_subpkt_from_sig (sig, pk);
--      mk_notation_policy_etc (ctrl, sig, NULL, pk);
--      if (opt.flags.include_key_block && IS_SIG (sig))
--        err = mk_sig_subpkt_key_block (ctrl, sig, pk);
--      else
--        err = 0;
--      hash_sigversion_to_magic (md, sig, extrahash);
--      gcry_md_final (md);
-+      if (!opt.file_is_digest)
-+        {
-+          build_sig_subpkt_from_sig (sig, pk);
-+          mk_notation_policy_etc (ctrl, sig, NULL, pk);
-+          if (opt.flags.include_key_block && IS_SIG (sig))
-+            err = mk_sig_subpkt_key_block (ctrl, sig, pk);
-+          else
-+            err = 0;
-+
-+          hash_sigversion_to_magic (md, sig, extrahash);
-+          gcry_md_final (md);
-+        }
-+      else if (sig->version >= 4)
-+        {
-+          log_bug("file-is-digest doesn't work with v4 sigs\n");
-+        }
- 
-       if (!err)
-         err = do_sign (ctrl, pk, sig, md, hash_for (pk), cache_nonce, 0);
-@@ -924,6 +930,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
-   SK_LIST sk_rover = NULL;
-   int multifile = 0;
-   u32 duration=0;
-+  int sigclass = 0x00;
-+  u32 timestamp = 0;
-   pt_extra_hash_data_t extrahash = NULL;
- 
-   pfx = new_progress_context ();
-@@ -941,7 +949,16 @@ sign_file (ctrl_t ctrl, strlist_t filena
-     fname = NULL;
- 
-   if (fname && filenames->next && (!detached || encryptflag))
--    log_bug ("multiple files can only be detached signed");
-+    log_bug ("multiple files can only be detached signed\n");
-+
-+  if (opt.file_is_digest && (multifile || !fname))
-+    log_bug ("file-is-digest only works with one file\n");
-+  if (opt.file_is_digest && !detached)
-+    log_bug ("file-is-digest can only write detached signatures\n");
-+  if (opt.file_is_digest && !opt.def_digest_algo)
-+    log_bug ("file-is-digest needs --digest-algo\n");
-+  if (opt.file_is_digest && opt.textmode)
-+    log_bug ("file-is-digest doesn't work with --textmode\n");
- 
-   if (encryptflag == 2
-       && (rc = setup_symkey (&efx.symkey_s2k, &efx.symkey_dek)))
-@@ -962,7 +979,7 @@ sign_file (ctrl_t ctrl, strlist_t filena
-     goto leave;
- 
-   /* Prepare iobufs. */
--  if (multifile)    /* have list of filenames */
-+  if (multifile || opt.file_is_digest)  /* have list of filenames */
-     inp = NULL;     /* we do it later */
-   else
-     {
-@@ -1100,7 +1117,7 @@ sign_file (ctrl_t ctrl, strlist_t filena
-   for (sk_rover = sk_list; sk_rover; sk_rover = sk_rover->next)
-     gcry_md_enable (mfx.md, hash_for (sk_rover->pk));
- 
--  if (!multifile)
-+  if (!multifile && !opt.file_is_digest)
-     iobuf_push_filter (inp, md_filter, &mfx);
- 
-   if (detached && !encryptflag)
-@@ -1155,6 +1172,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
- 
-   write_status_begin_signing (mfx.md);
- 
-+  sigclass = opt.textmode && !outfile? 0x01 : 0x00;
-+
-   /* Setup the inner packet. */
-   if (detached)
-     {
-@@ -1195,6 +1214,49 @@ sign_file (ctrl_t ctrl, strlist_t filena
-           if (opt.verbose)
-             log_printf ("\n");
- 	}
-+      else if (opt.file_is_digest)
-+        {
-+          byte *mdb, ts5;
-+          size_t mdlen;
-+          const char *fp;
-+          int c, d;
-+      
-+          gcry_md_final(mfx.md);
-+          /* this assumes gcry_md_read returns the same buffer */
-+          mdb = gcry_md_read(mfx.md, opt.def_digest_algo);
-+          mdlen = gcry_md_get_algo_dlen(opt.def_digest_algo);
-+          if (strlen(fname) != mdlen * 2 + 11)
-+            log_bug("digests must be %zu + @ + 5 bytes\n", mdlen);
-+          d = -1;
-+          for (fp = fname ; *fp; )
-+            {
-+      	       c = *fp++;
-+      	       if (c >= '0' && c <= '9')
-+      	         c -= '0';
-+      	       else if (c >= 'a' && c <= 'f')
-+      	         c -= 'a' - 10;
-+      	       else if (c >= 'A' && c <= 'F')
-+      	         c -= 'A' - 10;
-+      	       else
-+      	         log_bug("filename is not hex\n");
-+      	       if (d >= 0)
-+                {
-+      	           *mdb++ = d << 4 | c;
-+      	           c = -1;
-+      	           if (--mdlen == 0)
-+                    {
-+      	               mdb = ts;
-+      	               if (*fp++ != '@')
-+      	                 log_bug("missing time separator\n");
-+      	             }
-+      	         }
-+      	       d = c;
-+            }
-+          sigclass = ts0;
-+          if (sigclass != 0x00 && sigclass != 0x01)
-+            log_bug("bad cipher class\n");
-+          timestamp = buf32_to_u32(ts + 1);
-+        }
-       else

_service:extract_file:gnupg-2.2.21-coverity.patch Deleted

@@ -1,240 +0,0 @@
-diff -up gnupg-2.2.21/common/server-help.c.coverity gnupg-2.2.21/common/server-help.c
---- gnupg-2.2.21/common/server-help.c.coverity 2019-02-11 10:59:34.000000000 +0100
-+++ gnupg-2.2.21/common/server-help.c  2020-07-20 17:09:57.416148768 +0200
-@@ -156,7 +156,7 @@ get_option_value (char *line, const char
-   *pend = 0;
-   *r_value = xtrystrdup (p);
-   *pend = c;
--  if (!p)
-+  if (!*r_value)
-     return my_error_from_syserror ();
-   return 0;
- }
-
-From 7a707a3eff1c3fbe17a74337776871f408377cee Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Fri, 9 Apr 2021 16:13:07 +0200
-Subject: PATCH GnuPG 03/19 g10: Fix memory leaks
-
-* g10/card-util.c (change_pin): free answer on errors
-  (ask_card_keyattr): free answer on error
-* g10/cpr.c (do_get_from_fd): free string
-* g10/gpg.c (check_permissions): free dir on weird error
-* g10/import.c (append_new_uid): release knode
-* g10/keyedit.c (menu_set_keyserver_url): free answer
-  (menu_set_keyserver_url): free user
-* g10/keygen.c (print_status_key_not_created): move allocation after
-  sanity check
-  (ask_expire_interval): free answer
-  (card_store_key_with_backup): goto leave instaed of return
-* g10/keyserver.c (parse_keyserver_uri): goto fail instead of return
-* g10/revoke.c (gen_desig_revoke): release kdbhd
-  (gen_desig_revoke): free answer
-* g10/tofu.c (ask_about_binding): free sqerr and response
-* g10/trustdb.c (ask_ownertrust): free pk
-
---
-
-Signed-off-by: Jakub Jelen <jjelen@redhat.com>
----
- g10/card-util.c | 14 +++++++++++---
- g10/cpr.c       |  6 +++++-
- g10/gpg.c       |  1 +
- g10/import.c    |  5 ++++-
- g10/keyedit.c   |  8 +++++++-
- g10/keygen.c    | 15 +++++++++++----
- g10/keyserver.c |  2 +-
- g10/revoke.c    |  6 +++++-
- g10/tofu.c      |  4 ++++
- g10/trustdb.c   |  1 +
- 10 files changed, 50 insertions(+), 12 deletions(-)
-
-diff --git a/g10/card-util.c b/g10/card-util.c
-index 36f096f06..c7df8380d 100644
---- a/g10/card-util.c
-+++ b/g10/card-util.c
-@@ -127,7 +127,7 @@ change_pin (int unblock_v2, int allow_admin)
-   else
-     for (;;)
-       {
--	char *answer;
-+	char *answer = NULL;
- 
- 	tty_printf ("\n");
- 	tty_printf ("1 - change PIN\n"
-diff --git a/g10/tofu.c b/g10/tofu.c
-index f49083844..83786a08d 100644
---- a/g10/tofu.c
-+++ b/g10/tofu.c
-@@ -1687,6 +1687,8 @@ ask_about_binding (ctrl_t ctrl,
-          GPGSQL_ARG_END);
-       if (rc)
-         {
-+          sqlite3_free (sqerr);
-+          sqerr = NULL;
-           rc = gpg_error (GPG_ERR_GENERAL);
-           break;
-         }
--- 
-2.30.2
-
-
-From 7c8048b686a6e811d0b24febf3c5e2528e7881f1 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Tue, 13 Apr 2021 16:23:31 +0200
-Subject: PATCH GnuPG 14/19 dirmgr: Avoid memory leaks
-
-* dirmngr/domaininfo.c (insert_or_update): free di_new
-
---
-
-Signed-off-by: Jakub Jelen <jjelen@redhat.com>
----
- dirmngr/domaininfo.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/dirmngr/domaininfo.c b/dirmngr/domaininfo.c
-index b41aef366..87782b4b1 100644
---- a/dirmngr/domaininfo.c
-+++ b/dirmngr/domaininfo.c
-@@ -193,6 +193,7 @@ insert_or_update (const char *domain,
-           log_error ("domaininfo: error allocating helper array: %s\n",
-                      gpg_strerror (gpg_err_code_from_syserror ()));
-           drop_extra = bucket;
-+          xfree (di_new);
-           goto leave;
-         }
-       narray = 0;
--- 
-2.30.2
-
-
-From ab3b8c53993b3305088efde756a44bac6e6492d4 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Tue, 13 Apr 2021 16:34:40 +0200
-Subject: PATCH GnuPG 15/19 scd: Avoid memory leaks and uninitialized memory
-
-* scd/app-piv.c (do_decipher): goto leave, initialize outdatalen
-
---
-
-Signed-off-by: Jakub Jelen <jjelen@redhat.com>
----
- scd/app-piv.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/scd/app-piv.c b/scd/app-piv.c
-index 143cc047a..94257f0ee 100644
---- a/scd/app-piv.c
-+++ b/scd/app-piv.c
-@@ -2483,7 +2483,7 @@ do_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
-   gpg_error_t err;
-   data_object_t dobj;
-   unsigned char *outdata = NULL;
--  size_t outdatalen;
-+  size_t outdatalen = 0;
-   const unsigned char *s;
-   size_t n;
-   int keyref, mechanism;
-@@ -2582,7 +2582,7 @@ do_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
-   /* Now verify the Application PIN.  */
-   err = verify_chv (app, ctrl, 0x80, 0, pincb, pincb_arg);
-   if (err)
--    return err;
-+    goto leave;
- 
-   /* Build the Dynamic Authentication Template.  */
-   err = concat_tlv_list (0, &apdudata, &apdudatalen,
--- 
-2.30.2
-
-
-From f182bf91443618323e34261039045a6bde269be5 Mon Sep 17 00:00:00 2001
-From: Jakub Jelen <jjelen@redhat.com>
-Date: Tue, 13 Apr 2021 16:44:48 +0200
-Subject: PATCH GnuPG 16/19 tools: Avoid memory leaks
-
-* tools/wks-util.c (wks_cmd_print_wkd_url): Free addrspec on error
-  (wks_cmd_print_wkd_hash): Free addrspec on error
-
---
-
-Signed-off-by: Jakub Jelen <jjelen@redhat.com>
----
- tools/wks-util.c | 14 ++++++++++----
- 1 file changed, 10 insertions(+), 4 deletions(-)
-
-diff --git a/tools/wks-util.c b/tools/wks-util.c
-index 516c7fe00..38dd194ff 100644
---- a/tools/wks-util.c
-+++ b/tools/wks-util.c
-@@ -1192,11 +1192,14 @@ gpg_error_t
- wks_cmd_print_wkd_hash (const char *userid)
- {
-   gpg_error_t err;
--  char *addrspec, *fname;
-+  char *addrspec = NULL, *fname;
- 
-   err = wks_fname_from_userid (userid, 1, &fname, &addrspec);
-   if (err)
--    return err;
-+    {
-+      xfree (addrspec);
-+      return err;
-+    }
- 
-   es_printf ("%s %s\n", fname, addrspec);
- 
-@@ -1211,12 +1214,15 @@ gpg_error_t
- wks_cmd_print_wkd_url (const char *userid)
- {
-   gpg_error_t err;
--  char *addrspec, *fname;
-+  char *addrspec = NULL, *fname;
-   char *domain;
- 
-   err = wks_fname_from_userid (userid, 1, &fname, &addrspec);
-   if (err)
--    return err;
-+    {

_service:extract_file:gnupg-2.2.23-insttools.patch Deleted

@@ -1,28 +0,0 @@
-diff -up gnupg-2.2.23/tools/Makefile.am.insttools gnupg-2.2.23/tools/Makefile.am
---- gnupg-2.2.23/tools/Makefile.am.insttools	2020-08-13 11:01:57.000000000 +0200
-+++ gnupg-2.2.23/tools/Makefile.am	2020-09-04 13:49:34.183246428 +0200
-@@ -35,8 +35,8 @@ AM_CFLAGS = $(LIBGCRYPT_CFLAGS) $(GPG_ER
- sbin_SCRIPTS = addgnupghome applygnupgdefaults
- 
- if HAVE_USTAR
--# bin_SCRIPTS += gpg-zip
--noinst_SCRIPTS = gpg-zip
-+bin_SCRIPTS = gpg-zip
-+#noinst_SCRIPTS = gpg-zip
- endif
- 
- if BUILD_WKS_TOOLS
-diff -up gnupg-2.2.23/tools/Makefile.in.insttools gnupg-2.2.23/tools/Makefile.in
---- gnupg-2.2.23/tools/Makefile.in.insttools	2020-09-03 17:16:55.000000000 +0200
-+++ gnupg-2.2.23/tools/Makefile.in	2020-09-04 13:49:34.183246428 +0200
-@@ -618,8 +618,8 @@ libcommontlsnpth = ../common/libcommontl
- AM_CFLAGS = $(LIBGCRYPT_CFLAGS) $(GPG_ERROR_CFLAGS) $(LIBASSUAN_CFLAGS)
- sbin_SCRIPTS = addgnupghome applygnupgdefaults
- 
--# bin_SCRIPTS += gpg-zip
--@HAVE_USTAR_TRUE@noinst_SCRIPTS = gpg-zip
-+@HAVE_USTAR_TRUE@bin_PROGRAMS += gpg-zip
-+#@HAVE_USTAR_TRUE@noinst_SCRIPTS = gpg-zip
- @BUILD_WKS_TOOLS_FALSE@gpg_wks_server = 
- @BUILD_WKS_TOOLS_TRUE@gpg_wks_server = gpg-wks-server
- common_libs = $(libcommon)

_service:extract_file:gnupg-2.2.23-large-rsa.patch Deleted

_service:tar_scm:backport-CVE-2022-34903.patch Added

@@ -0,0 +1,50 @@
+From 34c649b3601383cd11dbc76221747ec16fd68e1b Mon Sep 17 00:00:00 2001
+From: Werner Koch <wk@gnupg.org>
+Date: Tue, 14 Jun 2022 11:33:27 +0200
+Subject: PATCH g10: Fix garbled status messages in NOTATION_DATA
+
+* g10/cpr.c (write_status_text_and_buffer): Fix off-by-one
+--
+
+Depending on the escaping and line wrapping the computed remaining
+buffer length could be wrong.  Fixed by always using a break to
+terminate the escape detection loop.  Might have happened for all
+status lines which may wrap.
+
+GnuPG-bug-id: T6027
+---
+ g10/cpr.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/g10/cpr.c b/g10/cpr.c
+index 9bfdd3c34..fa8005d6f 100644
+--- a/g10/cpr.c
++++ b/g10/cpr.c
+@@ -372,20 +372,15 @@ write_status_text_and_buffer (int no, const char *string,
+             }
+           first = 0;
+         }
+-      for (esc=0, s=buffer, n=len; n && !esc; s++, n--)
++      for (esc=0, s=buffer, n=len; n; s++, n--)
+         {
+           if (*s == '%' || *(const byte*)s <= lower_limit
+               || *(const byte*)s == 127 )
+             esc = 1;
+           if (wrap && ++count > wrap)
+-            {
+-              dowrap=1;
+-              break;
+-            }
+-        }
+-      if (esc)
+-        {
+-          s--; n++;
++            dowrap=1;
++          if (esc || dowrap)
++            break;
+         }
+       if (s != buffer)
+         es_fwrite (buffer, s-buffer, 1, statusfp);
+-- 
+2.27.0
+

_service:tar_scm:gnupg-2.1.1-fips-algo.patch Added

_service:tar_scm:gnupg-2.1.10-secmem.patch Added

@@ -0,0 +1,33 @@
+diff -up gnupg-2.1.10/g10/gpg.c.secmem gnupg-2.1.10/g10/gpg.c
+--- gnupg-2.1.10/g10/gpg.c.secmem	2015-12-04 10:53:27.000000000 +0100
++++ gnupg-2.1.10/g10/gpg.c	2015-12-07 15:32:38.922812652 +0100
+@@ -889,7 +889,7 @@ make_libversion (const char *libname, co
+ 
+   if (maybe_setuid)
+     {
+-      gcry_control (GCRYCTL_INIT_SECMEM, 0, 0);  /* Drop setuid. */
++      gcry_control (GCRYCTL_INIT_SECMEM, 4096, 0);  /* Drop setuid. */
+       maybe_setuid = 0;
+     }
+   s = getfnc (NULL);
+@@ -1041,7 +1041,7 @@ build_list (const char *text, char lette
+   char *string;
+ 
+   if (maybe_setuid)
+-    gcry_control (GCRYCTL_INIT_SECMEM, 0, 0);  /* Drop setuid. */
++    gcry_control (GCRYCTL_INIT_SECMEM, 4096, 0);  /* Drop setuid. */
+ 
+   indent = utf8_charcount (text, -1);
+   len = 0;
+diff -up gnupg-2.1.10/sm/gpgsm.c.secmem gnupg-2.1.10/sm/gpgsm.c
+--- gnupg-2.1.10/sm/gpgsm.c.secmem	2015-11-30 17:39:52.000000000 +0100
++++ gnupg-2.1.10/sm/gpgsm.c	2015-12-07 15:31:17.226884207 +0100
+@@ -530,7 +530,7 @@ make_libversion (const char *libname, co
+ 
+   if (maybe_setuid)
+     {
+-      gcry_control (GCRYCTL_INIT_SECMEM, 0, 0);  /* Drop setuid. */
++      gcry_control (GCRYCTL_INIT_SECMEM, 4096, 0);  /* Drop setuid. */
+       maybe_setuid = 0;
+     }
+   s = getfnc (NULL);

_service:tar_scm:gnupg-2.2.16-ocsp-keyusage.patch Added

_service:tar_scm:gnupg-2.2.18-gpg-accept-subkeys-with-a-good-revocation-but-no-self-sig.patch Added

@@ -0,0 +1,32 @@
+From: Vincent Breitmoser <look@my.amazin.horse>
+Date: Thu, 13 Jun 2019 21:27:43 +0200
+Subject: gpg: accept subkeys with a good revocation but no self-sig during
+ import
+
+* g10/import.c (chk_self_sigs): Set the NODE_GOOD_SELFSIG flag when we
+encounter a valid revocation signature. This allows import of subkey
+revocation signatures, even in the absence of a corresponding subkey
+binding signature.
+
+--
+
+This fixes the remaining test in import-incomplete.scm.
+
+GnuPG-Bug-id: 4393
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ g10/import.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/g10/import.c b/g10/import.c
+index f9acf95..9217911 100644
+--- a/g10/import.c
++++ b/g10/import.c
+@@ -3602,6 +3602,7 @@ chk_self_sigs (ctrl_t ctrl, kbnode_t keyblock, u32 *keyid, int *non_self)
+                   /* It's valid, so is it newer? */
+                   if (sig->timestamp >= rsdate)
+                     {
++                      knode->flag |= NODE_GOOD_SELFSIG; /* Subkey is valid.  */
+                       if (rsnode)
+                         {
+                           /* Delete the last revocation sig since

_service:tar_scm:gnupg-2.2.18-gpg-allow-import-of-previously-known-keys-even-without-UI.patch Added

@@ -0,0 +1,107 @@
+From: Vincent Breitmoser <look@my.amazin.horse>
+Date: Thu, 13 Jun 2019 21:27:42 +0200
+Subject: gpg: allow import of previously known keys, even without UIDs
+
+* g10/import.c (import_one): Accept an incoming OpenPGP certificate that
+has no user id, as long as we already have a local variant of the cert
+that matches the primary key.
+
+--
+
+This fixes two of the three broken tests in import-incomplete.scm.
+
+GnuPG-Bug-id: 4393
+Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ g10/import.c | 44 +++++++++++---------------------------------
+ 1 file changed, 11 insertions(+), 33 deletions(-)
+
+diff --git a/g10/import.c b/g10/import.c
+index 5d3162c..f9acf95 100644
+--- a/g10/import.c
++++ b/g10/import.c
+@@ -1788,7 +1788,6 @@ import_one_real (ctrl_t ctrl,
+   size_t an;
+   char pkstrbufPUBKEY_STRING_SIZE;
+   int merge_keys_done = 0;
+-  int any_filter = 0;
+   KEYDB_HANDLE hd = NULL;
+ 
+   if (r_valid)
+@@ -1825,14 +1824,6 @@ import_one_real (ctrl_t ctrl,
+       log_printf ("\n");
+     }
+ 
+-
+-  if (!uidnode)
+-    {
+-      if (!silent)
+-        log_error( _("key %s: no user ID\n"), keystr_from_pk(pk));
+-      return 0;
+-    }
+-
+   if (screener && screener (keyblock, screener_arg))
+     {
+       log_error (_("key %s: %s\n"), keystr_from_pk (pk),
+@@ -1907,18 +1898,10 @@ import_one_real (ctrl_t ctrl,
+ 	  }
+     }
+ 
+-  /* Delete invalid parts and bail out if there are no user ids left.  */
+-  if (!delete_inv_parts (ctrl, keyblock, keyid, options))
+-    {
+-      if (!silent)
+-        {
+-          log_error ( _("key %s: no valid user IDs\n"), keystr_from_pk(pk));
+-          if (!opt.quiet)
+-            log_info(_("this may be caused by a missing self-signature\n"));
+-        }
+-      stats->no_user_id++;
+-      return 0;
+-    }
++  /* Delete invalid parts, and note if we have any valid ones left.
++   * We will later abort import if this key is new but contains
++   * no valid uids.  */
++  delete_inv_parts (ctrl, keyblock, keyid, options);
+ 
+   /* Get rid of deleted nodes.  */
+   commit_kbnode (&keyblock);
+@@ -1927,24 +1911,11 @@ import_one_real (ctrl_t ctrl,
+     {
+       apply_keep_uid_filter (ctrl, keyblock, import_filter.keep_uid);
+       commit_kbnode (&keyblock);
+-      any_filter = 1;
+     }
+   if (import_filter.drop_sig)
+     {
+       apply_drop_sig_filter (ctrl, keyblock, import_filter.drop_sig);
+       commit_kbnode (&keyblock);
+-      any_filter = 1;
+-    }
+-
+-  /* If we ran any filter we need to check that at least one user id
+-   * is left in the keyring.  Note that we do not use log_error in
+-   * this case. */
+-  if (any_filter && !any_uid_left (keyblock))
+-    {
+-      if (!opt.quiet )
+-        log_info ( _("key %s: no valid user IDs\n"), keystr_from_pk (pk));
+-      stats->no_user_id++;
+-      return 0;
+     }
+ 
+   /* The keyblock is valid and ready for real import.  */
+@@ -2002,6 +1973,13 @@ import_one_real (ctrl_t ctrl,
+       err = 0;
+       stats->skipped_new_keys++;
+     }
++  else if (err && !any_uid_left (keyblock))
++    {
++      if (!silent)
++        log_info( _("key %s: new key but contains no user ID - skipped\n"), keystr(keyid));
++      err = 0;
++      stats->no_user_id++;
++    }
+   else if (err)  /* Insert this key. */
+     {
+       /* Note: ERR can only be NO_PUBKEY or UNUSABLE_PUBKEY.  */

_service:tar_scm:gnupg-2.2.18-tests-add-test-cases-for-import-without-uid.patch Added

@@ -0,0 +1,201 @@
+From: Vincent Breitmoser <look@my.amazin.horse>
+Date: Thu, 13 Jun 2019 21:27:41 +0200
+Subject: tests: add test cases for import without uid
+
+This commit adds a test case that does the following, in order:
+- Import of a primary key plus user id
+- Check that import of a subkey works, without a user id present in the
+imported key
+- Check that import of a subkey revocation works, without a user id or
+subkey binding signature present in the imported key
+- Check that import of a primary key revocation works, without a user id
+present in the imported key
+
+--
+
+Note that this test currently fails.  The following changesets will
+fix gpg so that the tests pass.
+
+GnuPG-Bug-id: 4393
+Signed-Off-By: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
+---
+ tests/openpgp/Makefile.am                          |  1 +
+ tests/openpgp/import-incomplete.scm                | 68 ++++++++++++++++++++++
+ .../import-incomplete/primary+revocation.asc       |  9 +++
+ .../primary+subkey+sub-revocation.asc              | 10 ++++
+ .../import-incomplete/primary+subkey+sub-sig.asc   | 10 ++++
+ .../openpgp/import-incomplete/primary+uid-sig.asc  | 10 ++++
+ tests/openpgp/import-incomplete/primary+uid.asc    | 10 ++++
+ 7 files changed, 118 insertions(+)
+ create mode 100755 tests/openpgp/import-incomplete.scm
+ create mode 100644 tests/openpgp/import-incomplete/primary+revocation.asc
+ create mode 100644 tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
+ create mode 100644 tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
+ create mode 100644 tests/openpgp/import-incomplete/primary+uid-sig.asc
+ create mode 100644 tests/openpgp/import-incomplete/primary+uid.asc
+
+diff --git a/tests/openpgp/Makefile.am b/tests/openpgp/Makefile.am
+index f6014c9..6423da1 100644
+--- a/tests/openpgp/Makefile.am
++++ b/tests/openpgp/Makefile.am
+@@ -78,6 +78,7 @@ XTESTS = \
+ 	gpgv-forged-keyring.scm \
+ 	armor.scm \
+ 	import.scm \
++	import-incomplete.scm \
+ 	import-revocation-certificate.scm \
+ 	ecc.scm \
+ 	4gb-packet.scm \
+diff --git a/tests/openpgp/import-incomplete.scm b/tests/openpgp/import-incomplete.scm
+new file mode 100755
+index 0000000..727a027
+--- /dev/null
++++ b/tests/openpgp/import-incomplete.scm
+@@ -0,0 +1,68 @@
++#!/usr/bin/env gpgscm
++
++;; Copyright (C) 2016 g10 Code GmbH
++;;
++;; This file is part of GnuPG.
++;;
++;; GnuPG is free software; you can redistribute it and/or modify
++;; it under the terms of the GNU General Public License as published by
++;; the Free Software Foundation; either version 3 of the License, or
++;; (at your option) any later version.
++;;
++;; GnuPG is distributed in the hope that it will be useful,
++;; but WITHOUT ANY WARRANTY; without even the implied warranty of
++;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++;; GNU General Public License for more details.
++;;
++;; You should have received a copy of the GNU General Public License
++;; along with this program; if not, see <http://www.gnu.org/licenses/>.
++
++(load (in-srcdir "tests" "openpgp" "defs.scm"))
++(setup-environment)
++
++(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+uid.asc")))
++
++(info "Test import of new subkey, from a certificate without uid")
++(define keyid "573EA710367356BB")
++(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+subkey+sub-sig.asc")))
++(tr:do
++ (tr:pipe-do
++  (pipe:gpg `(--list-keys --with-colons ,keyid)))
++ (tr:call-with-content
++  (lambda (c)
++    ;; XXX we do not have a regexp library
++    (unless (any (lambda (line)
++		   (and (string-prefix? line "sub:")
++			(string-contains? line "573EA710367356BB")))
++		 (string-split-newlines c))
++	    (exit 1)))))
++
++(info "Test import of a subkey revocation, from a certificate without uid")
++(define keyid "573EA710367356BB")
++(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+subkey+sub-revocation.asc")))
++(tr:do
++ (tr:pipe-do
++  (pipe:gpg `(--list-keys --with-colons ,keyid)))
++ (tr:call-with-content
++  (lambda (c)
++    ;; XXX we do not have a regexp library
++    (unless (any (lambda (line)
++		   (and (string-prefix? line "sub:r:")
++			(string-contains? line "573EA710367356BB")))
++		 (string-split-newlines c))
++	    (exit 1)))))
++
++(info "Test import of revocation, from a certificate without uid")
++(call-check `(,(tool 'gpg) --import ,(in-srcdir "tests" "openpgp" "import-incomplete" "primary+revocation.asc")))
++(tr:do
++ (tr:pipe-do
++  (pipe:gpg `(--list-keys --with-colons ,keyid)))
++ (tr:call-with-content
++  (lambda (c)
++    ;; XXX we do not have a regexp library
++    (unless (any (lambda (line)
++		   (and (string-prefix? line "pub:r:")
++			(string-contains? line "0843DA969AA8DAFB")))
++		 (string-split-newlines c))
++	    (exit 1)))))
++
+diff --git a/tests/openpgp/import-incomplete/primary+revocation.asc b/tests/openpgp/import-incomplete/primary+revocation.asc
+new file mode 100644
+index 0000000..6b7b608
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+revocation.asc
+@@ -0,0 +1,9 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: E primary key, revocation signature over primary (no user ID)
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN2IeAQgFggAIBYhBLRpj5W82H/gSMzKKQhD2paaqNr7BQJc2ZQZAh0AAAoJ
++EAhD2paaqNr7qAwA/2jBUpnN0BxwRO/4CrxvrLIsL+C9aSXJUOTv8XkP4lvtAQD3
++XsDFfFNgEueiTfF7HtOGt5LPmRqVvUpQSMVgJJW6CQ==
++=tM90
++-----END PGP PUBLIC KEY BLOCK-----
+diff --git a/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc b/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
+new file mode 100644
+index 0000000..83a51a5
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+subkey+sub-revocation.asc
+@@ -0,0 +1,10 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: D primary key, subkey, subkey revocation (no user ID)
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN24OARc2ZQhEgorBgEEAZdVAQUBAQdABsd5ha0AWXdXcSmfeiWIfrNcGqQK
++j++lwwWDAOlkVicDAQgHiHgEKBYIACAWIQS0aY+VvNh/4EjMyikIQ9qWmqja+wUC
++XNmnkAIdAgAKCRAIQ9qWmqja+ylaAQDmIKf86BJEq4OpDqU+V9D+wn2cyuxbyWVQ
++3r9LiL9qNwD/QAjyrhSN8L3Mfq+wdTHo5i0yB9ZCCpHLXSbhCqfWZwQ=
++=dwx2
++-----END PGP PUBLIC KEY BLOCK-----
+diff --git a/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc b/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
+new file mode 100644
+index 0000000..dc47a02
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+subkey+sub-sig.asc
+@@ -0,0 +1,10 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: B primary key, subkey, subkey binding sig (no user ID)
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN24OARc2ZQhEgorBgEEAZdVAQUBAQdABsd5ha0AWXdXcSmfeiWIfrNcGqQK
++j++lwwWDAOlkVicDAQgHiHgEGBYIACAWIQS0aY+VvNh/4EjMyikIQ9qWmqja+wUC
++XNmUIQIbDAAKCRAIQ9qWmqja++vFAP98G1L+1/rWTGbsnxOAV2RocBYIroAvsbkR
++Ly6FdP8YNwEA7jOgT05CoKIe37MstpOz23mM80AK369Ca3JMmKKCQgg=
++=xuDu
++-----END PGP PUBLIC KEY BLOCK-----
+diff --git a/tests/openpgp/import-incomplete/primary+uid-sig.asc b/tests/openpgp/import-incomplete/primary+uid-sig.asc
+new file mode 100644
+index 0000000..134607d
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+uid-sig.asc
+@@ -0,0 +1,10 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: C primary key and self-sig expiring in 2024 (no user ID)
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN2IlgQTFggAPgIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgBYhBLRpj5W8
++2H/gSMzKKQhD2paaqNr7BQJc2ZR1BQkJZgHcAAoJEAhD2paaqNr79soA/0lWkUsu
++3NLwgbni6EzJxnTzgeNMpljqNpipHAwfix9hAP93AVtFdC8g7hdUZxawobl9lnSN
++9ohXOEBWvdJgVv2YAg==
++=KWIK
++-----END PGP PUBLIC KEY BLOCK-----
+diff --git a/tests/openpgp/import-incomplete/primary+uid.asc b/tests/openpgp/import-incomplete/primary+uid.asc
+new file mode 100644
+index 0000000..055f300
+--- /dev/null
++++ b/tests/openpgp/import-incomplete/primary+uid.asc
+@@ -0,0 +1,10 @@
++-----BEGIN PGP PUBLIC KEY BLOCK-----
++Comment: A primary key, user ID, and self-sig expiring in 2021
++
++mDMEXNmUGRYJKwYBBAHaRw8BAQdA75R8VlchvmEd2Iz/8l07RoKUaUPDB71Ao1zZ
++631VAN20CHRlc3Qga2V5iJYEExYIAD4WIQS0aY+VvNh/4EjMyikIQ9qWmqja+wUC
++XNmUGQIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRAIQ9qWmqja
+++0G1AQDdQiwhXxjXLMqoth+D4SigVHTJK8ORwifzsy3UE7mPGwD/aZ67XbAF/lgI
++kv2O1Jo0u9BL9RNNF+L0DM7rAFbfMAs=

_service:tar_scm:gnupg-2.2.20-file-is-digest.patch Added

@@ -0,0 +1,212 @@
+diff -up gnupg-2.2.20/g10/gpg.c.file-is-digest gnupg-2.2.20/g10/gpg.c
+--- gnupg-2.2.20/g10/gpg.c.file-is-digest	2020-04-14 16:33:42.630269318 +0200
++++ gnupg-2.2.20/g10/gpg.c	2020-04-14 16:34:46.455100086 +0200
+@@ -380,6 +380,7 @@ enum cmd_and_opt_values
+     oTTYtype,
+     oLCctype,
+     oLCmessages,
++    oFileIsDigest,
+     oXauthority,
+     oGroup,
+     oUnGroup,
+@@ -831,6 +832,7 @@ static ARGPARSE_OPTS opts = {
+   ARGPARSE_s_s (oTempDir,  "temp-directory", "@"),
+   ARGPARSE_s_s (oExecPath, "exec-path", "@"),
+   ARGPARSE_s_n (oExpert,      "expert", "@"),
++  ARGPARSE_s_n (oFileIsDigest, "file-is-digest", "@"),
+   ARGPARSE_s_n (oNoExpert, "no-expert", "@"),
+   ARGPARSE_s_n (oNoSecmemWarn, "no-secmem-warning", "@"),
+   ARGPARSE_s_n (oRequireSecmem, "require-secmem", "@"),
+@@ -2419,6 +2421,7 @@ main (int argc, char **argv)
+     opt.keyid_format = KF_NONE;
+     opt.def_sig_expire = "0";
+     opt.def_cert_expire = "0";
++    opt.file_is_digest = 0;
+     opt.passphrase_repeat = 1;
+     opt.emit_version = 0;
+     opt.weak_digests = NULL;
+@@ -2997,6 +3000,7 @@ main (int argc, char **argv)
+ 	  case oPhotoViewer: opt.photo_viewer = pargs.r.ret_str; break;
+ 
+ 	  case oForceAEAD: opt.force_aead = 1; break;
++	  case oFileIsDigest: opt.file_is_digest = 1; break;
+ 
+           case oDisableSignerUID: opt.flags.disable_signer_uid = 1; break;
+           case oIncludeKeyBlock:  opt.flags.include_key_block = 1; break;
+diff -up gnupg-2.2.20/g10/options.h.file-is-digest gnupg-2.2.20/g10/options.h
+--- gnupg-2.2.20/g10/options.h.file-is-digest	2020-03-14 19:54:05.000000000 +0100
++++ gnupg-2.2.20/g10/options.h	2020-04-14 16:33:42.634269245 +0200
+@@ -202,6 +202,7 @@ struct
+   int no_auto_check_trustdb;
+   int preserve_permissions;
+   int no_homedir_creation;
++  int file_is_digest;
+   struct groupitem *grouplist;
+   int mangle_dos_filenames;
+   int enable_progress_filter;
+diff -up gnupg-2.2.20/g10/sign.c.file-is-digest gnupg-2.2.20/g10/sign.c
+--- gnupg-2.2.20/g10/sign.c.file-is-digest	2020-03-14 19:35:46.000000000 +0100
++++ gnupg-2.2.20/g10/sign.c	2020-04-14 16:36:54.661751422 +0200
+@@ -40,6 +40,7 @@
+ #include "pkglue.h"
+ #include "../common/sysutils.h"
+ #include "call-agent.h"
++#include "../common/host2net.h"
+ #include "../common/mbox-util.h"
+ #include "../common/compliance.h"
+ 
+@@ -834,6 +835,8 @@ write_signature_packets (ctrl_t ctrl,
+ 
+       if (pk->version >= 5)
+         sig->version = 5;  /* Required for v5 keys.  */
++      else if (opt.file_is_digest)
++        sig->version = 3;
+       else
+         sig->version = 4;  /* Required.  */
+ 
+@@ -860,14 +863,22 @@ write_signature_packets (ctrl_t ctrl,
+       if (gcry_md_copy (&md, hash))
+         BUG ();
+ 
+-      build_sig_subpkt_from_sig (sig, pk);
+-      mk_notation_policy_etc (ctrl, sig, NULL, pk);
+-      if (opt.flags.include_key_block && IS_SIG (sig))
+-        err = mk_sig_subpkt_key_block (ctrl, sig, pk);
+-      else
+-        err = 0;
+-      hash_sigversion_to_magic (md, sig, extrahash);
+-      gcry_md_final (md);
++      if (!opt.file_is_digest)
++        {
++          build_sig_subpkt_from_sig (sig, pk);
++          mk_notation_policy_etc (ctrl, sig, NULL, pk);
++          if (opt.flags.include_key_block && IS_SIG (sig))
++            err = mk_sig_subpkt_key_block (ctrl, sig, pk);
++          else
++            err = 0;
++
++          hash_sigversion_to_magic (md, sig, extrahash);
++          gcry_md_final (md);
++        }
++      else if (sig->version >= 4)
++        {
++          log_bug("file-is-digest doesn't work with v4 sigs\n");
++        }
+ 
+       if (!err)
+         err = do_sign (ctrl, pk, sig, md, hash_for (pk), cache_nonce, 0);
+@@ -924,6 +930,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
+   SK_LIST sk_rover = NULL;
+   int multifile = 0;
+   u32 duration=0;
++  int sigclass = 0x00;
++  u32 timestamp = 0;
+   pt_extra_hash_data_t extrahash = NULL;
+ 
+   pfx = new_progress_context ();
+@@ -941,7 +949,16 @@ sign_file (ctrl_t ctrl, strlist_t filena
+     fname = NULL;
+ 
+   if (fname && filenames->next && (!detached || encryptflag))
+-    log_bug ("multiple files can only be detached signed");
++    log_bug ("multiple files can only be detached signed\n");
++
++  if (opt.file_is_digest && (multifile || !fname))
++    log_bug ("file-is-digest only works with one file\n");
++  if (opt.file_is_digest && !detached)
++    log_bug ("file-is-digest can only write detached signatures\n");
++  if (opt.file_is_digest && !opt.def_digest_algo)
++    log_bug ("file-is-digest needs --digest-algo\n");
++  if (opt.file_is_digest && opt.textmode)
++    log_bug ("file-is-digest doesn't work with --textmode\n");
+ 
+   if (encryptflag == 2
+       && (rc = setup_symkey (&efx.symkey_s2k, &efx.symkey_dek)))
+@@ -962,7 +979,7 @@ sign_file (ctrl_t ctrl, strlist_t filena
+     goto leave;
+ 
+   /* Prepare iobufs. */
+-  if (multifile)    /* have list of filenames */
++  if (multifile || opt.file_is_digest)  /* have list of filenames */
+     inp = NULL;     /* we do it later */
+   else
+     {
+@@ -1100,7 +1117,7 @@ sign_file (ctrl_t ctrl, strlist_t filena
+   for (sk_rover = sk_list; sk_rover; sk_rover = sk_rover->next)
+     gcry_md_enable (mfx.md, hash_for (sk_rover->pk));
+ 
+-  if (!multifile)
++  if (!multifile && !opt.file_is_digest)
+     iobuf_push_filter (inp, md_filter, &mfx);
+ 
+   if (detached && !encryptflag)
+@@ -1155,6 +1172,8 @@ sign_file (ctrl_t ctrl, strlist_t filena
+ 
+   write_status_begin_signing (mfx.md);
+ 
++  sigclass = opt.textmode && !outfile? 0x01 : 0x00;
++
+   /* Setup the inner packet. */
+   if (detached)
+     {
+@@ -1195,6 +1214,49 @@ sign_file (ctrl_t ctrl, strlist_t filena
+           if (opt.verbose)
+             log_printf ("\n");
+ 	}
++      else if (opt.file_is_digest)
++        {
++          byte *mdb, ts5;
++          size_t mdlen;
++          const char *fp;
++          int c, d;
++      
++          gcry_md_final(mfx.md);
++          /* this assumes gcry_md_read returns the same buffer */
++          mdb = gcry_md_read(mfx.md, opt.def_digest_algo);
++          mdlen = gcry_md_get_algo_dlen(opt.def_digest_algo);
++          if (strlen(fname) != mdlen * 2 + 11)
++            log_bug("digests must be %zu + @ + 5 bytes\n", mdlen);
++          d = -1;
++          for (fp = fname ; *fp; )
++            {
++      	       c = *fp++;
++      	       if (c >= '0' && c <= '9')
++      	         c -= '0';
++      	       else if (c >= 'a' && c <= 'f')
++      	         c -= 'a' - 10;
++      	       else if (c >= 'A' && c <= 'F')
++      	         c -= 'A' - 10;
++      	       else
++      	         log_bug("filename is not hex\n");
++      	       if (d >= 0)
++                {
++      	           *mdb++ = d << 4 | c;
++      	           c = -1;
++      	           if (--mdlen == 0)
++                    {
++      	               mdb = ts;
++      	               if (*fp++ != '@')
++      	                 log_bug("missing time separator\n");
++      	             }
++      	         }
++      	       d = c;
++            }
++          sigclass = ts0;
++          if (sigclass != 0x00 && sigclass != 0x01)
++            log_bug("bad cipher class\n");
++          timestamp = buf32_to_u32(ts + 1);
++        }
+       else

_service:tar_scm:gnupg-2.2.21-coverity.patch Added

@@ -0,0 +1,240 @@
+diff -up gnupg-2.2.21/common/server-help.c.coverity gnupg-2.2.21/common/server-help.c
+--- gnupg-2.2.21/common/server-help.c.coverity 2019-02-11 10:59:34.000000000 +0100
++++ gnupg-2.2.21/common/server-help.c  2020-07-20 17:09:57.416148768 +0200
+@@ -156,7 +156,7 @@ get_option_value (char *line, const char
+   *pend = 0;
+   *r_value = xtrystrdup (p);
+   *pend = c;
+-  if (!p)
++  if (!*r_value)
+     return my_error_from_syserror ();
+   return 0;
+ }
+
+From 7a707a3eff1c3fbe17a74337776871f408377cee Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Fri, 9 Apr 2021 16:13:07 +0200
+Subject: PATCH GnuPG 03/19 g10: Fix memory leaks
+
+* g10/card-util.c (change_pin): free answer on errors
+  (ask_card_keyattr): free answer on error
+* g10/cpr.c (do_get_from_fd): free string
+* g10/gpg.c (check_permissions): free dir on weird error
+* g10/import.c (append_new_uid): release knode
+* g10/keyedit.c (menu_set_keyserver_url): free answer
+  (menu_set_keyserver_url): free user
+* g10/keygen.c (print_status_key_not_created): move allocation after
+  sanity check
+  (ask_expire_interval): free answer
+  (card_store_key_with_backup): goto leave instaed of return
+* g10/keyserver.c (parse_keyserver_uri): goto fail instead of return
+* g10/revoke.c (gen_desig_revoke): release kdbhd
+  (gen_desig_revoke): free answer
+* g10/tofu.c (ask_about_binding): free sqerr and response
+* g10/trustdb.c (ask_ownertrust): free pk
+
+--
+
+Signed-off-by: Jakub Jelen <jjelen@redhat.com>
+---
+ g10/card-util.c | 14 +++++++++++---
+ g10/cpr.c       |  6 +++++-
+ g10/gpg.c       |  1 +
+ g10/import.c    |  5 ++++-
+ g10/keyedit.c   |  8 +++++++-
+ g10/keygen.c    | 15 +++++++++++----
+ g10/keyserver.c |  2 +-
+ g10/revoke.c    |  6 +++++-
+ g10/tofu.c      |  4 ++++
+ g10/trustdb.c   |  1 +
+ 10 files changed, 50 insertions(+), 12 deletions(-)
+
+diff --git a/g10/card-util.c b/g10/card-util.c
+index 36f096f06..c7df8380d 100644
+--- a/g10/card-util.c
++++ b/g10/card-util.c
+@@ -127,7 +127,7 @@ change_pin (int unblock_v2, int allow_admin)
+   else
+     for (;;)
+       {
+-	char *answer;
++	char *answer = NULL;
+ 
+ 	tty_printf ("\n");
+ 	tty_printf ("1 - change PIN\n"
+diff --git a/g10/tofu.c b/g10/tofu.c
+index f49083844..83786a08d 100644
+--- a/g10/tofu.c
++++ b/g10/tofu.c
+@@ -1687,6 +1687,8 @@ ask_about_binding (ctrl_t ctrl,
+          GPGSQL_ARG_END);
+       if (rc)
+         {
++          sqlite3_free (sqerr);
++          sqerr = NULL;
+           rc = gpg_error (GPG_ERR_GENERAL);
+           break;
+         }
+-- 
+2.30.2
+
+
+From 7c8048b686a6e811d0b24febf3c5e2528e7881f1 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Tue, 13 Apr 2021 16:23:31 +0200
+Subject: PATCH GnuPG 14/19 dirmgr: Avoid memory leaks
+
+* dirmngr/domaininfo.c (insert_or_update): free di_new
+
+--
+
+Signed-off-by: Jakub Jelen <jjelen@redhat.com>
+---
+ dirmngr/domaininfo.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/dirmngr/domaininfo.c b/dirmngr/domaininfo.c
+index b41aef366..87782b4b1 100644
+--- a/dirmngr/domaininfo.c
++++ b/dirmngr/domaininfo.c
+@@ -193,6 +193,7 @@ insert_or_update (const char *domain,
+           log_error ("domaininfo: error allocating helper array: %s\n",
+                      gpg_strerror (gpg_err_code_from_syserror ()));
+           drop_extra = bucket;
++          xfree (di_new);
+           goto leave;
+         }
+       narray = 0;
+-- 
+2.30.2
+
+
+From ab3b8c53993b3305088efde756a44bac6e6492d4 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Tue, 13 Apr 2021 16:34:40 +0200
+Subject: PATCH GnuPG 15/19 scd: Avoid memory leaks and uninitialized memory
+
+* scd/app-piv.c (do_decipher): goto leave, initialize outdatalen
+
+--
+
+Signed-off-by: Jakub Jelen <jjelen@redhat.com>
+---
+ scd/app-piv.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/scd/app-piv.c b/scd/app-piv.c
+index 143cc047a..94257f0ee 100644
+--- a/scd/app-piv.c
++++ b/scd/app-piv.c
+@@ -2483,7 +2483,7 @@ do_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
+   gpg_error_t err;
+   data_object_t dobj;
+   unsigned char *outdata = NULL;
+-  size_t outdatalen;
++  size_t outdatalen = 0;
+   const unsigned char *s;
+   size_t n;
+   int keyref, mechanism;
+@@ -2582,7 +2582,7 @@ do_decipher (app_t app, ctrl_t ctrl, const char *keyidstr,
+   /* Now verify the Application PIN.  */
+   err = verify_chv (app, ctrl, 0x80, 0, pincb, pincb_arg);
+   if (err)
+-    return err;
++    goto leave;
+ 
+   /* Build the Dynamic Authentication Template.  */
+   err = concat_tlv_list (0, &apdudata, &apdudatalen,
+-- 
+2.30.2
+
+
+From f182bf91443618323e34261039045a6bde269be5 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Tue, 13 Apr 2021 16:44:48 +0200
+Subject: PATCH GnuPG 16/19 tools: Avoid memory leaks
+
+* tools/wks-util.c (wks_cmd_print_wkd_url): Free addrspec on error
+  (wks_cmd_print_wkd_hash): Free addrspec on error
+
+--
+
+Signed-off-by: Jakub Jelen <jjelen@redhat.com>
+---
+ tools/wks-util.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/tools/wks-util.c b/tools/wks-util.c
+index 516c7fe00..38dd194ff 100644
+--- a/tools/wks-util.c
++++ b/tools/wks-util.c
+@@ -1192,11 +1192,14 @@ gpg_error_t
+ wks_cmd_print_wkd_hash (const char *userid)
+ {
+   gpg_error_t err;
+-  char *addrspec, *fname;
++  char *addrspec = NULL, *fname;
+ 
+   err = wks_fname_from_userid (userid, 1, &fname, &addrspec);
+   if (err)
+-    return err;
++    {
++      xfree (addrspec);
++      return err;
++    }
+ 
+   es_printf ("%s %s\n", fname, addrspec);
+ 
+@@ -1211,12 +1214,15 @@ gpg_error_t
+ wks_cmd_print_wkd_url (const char *userid)
+ {
+   gpg_error_t err;
+-  char *addrspec, *fname;
++  char *addrspec = NULL, *fname;
+   char *domain;
+ 
+   err = wks_fname_from_userid (userid, 1, &fname, &addrspec);
+   if (err)
+-    return err;
++    {

_service:tar_scm:gnupg-2.2.23-large-rsa.patch Added

_service Changed

_service:extract_file:gnupg-2.3.4.tar.bz2 Deleted

_service:extract_file:gnupg-2.3.4.tar.bz2.sig Deleted

_service:extract_file:gnupg2.yaml Deleted

_service:tar_scm:gnupg-2.3.6.tar.bz2 Added

_service:tar_scm:gnupg-2.3.6.tar.bz2.sig Added

_service:tar_scm:gnupg2-1643005779.d6f9ab9.tar Deleted

_service:tar_scm:gnupg2.yaml Added