gnupg-1.4 is not developed actively anymore, and new software expects
a modern "gpg" executable, which leads to pointless patches in the ports
tree. Move the various users of security/gnupg2 to security/gnupg and
zap patches that forced the use of "gpg2".
Crusade started by edd@ (security/gnupg maintainer), gnupg->gnupg2 test
reports from semarie@, giovanni@ and solene@, input and bulk build by
sthen@. ok sthen@ edd@ (maintainer)
Being listed as the maintainer kinda implies that I care, but I don't:
I haven't used gpg1 for years. In fact, it's been years since I think
this port ought to be removed and the tree should be moved to
security/gnupg2. But someone has to do that work.
- add `-fheinous-gnu-extensions' as seen on some other archs
- add a patch to remove the `-Wa,-mppc' flag, because clang's
integrated assembler was unhappy with it. Proposed by jca@,
instead of using `-no-integrated-as'.
OK jca@ (maintainer)
Follow the upstream recommendations for packagers and switch to
multi-packages:
devel/gettext -> devel/gettext,-runtime
devel/gettext-tools -> devel/gettext,-tools
(new) devel/gettext,-textstyle
- move to https
- use the per-project canonical homepage (reachable thru the main
- homepage; pinentry doesn't seem to have such homepage)
ok pea@ ajacoutot@
* Fix critical security bug in the RNG [CVE-2016-6313]. An attacker
who obtains 580 bytes from the standard RNG can trivially predict
the next 20 bytes of output. Problem detected by Felix Dörre and
Vladimir Klebanov, KIT.
CVE-2016-6313: * Fix critical security bug in the RNG [CVE-2016-6313].
An attacker who obtains 580 bytes from the standard RNG can trivially
predict the next 20 bytes of output. Problem detected by Felix
Dörre and Vladimir Klebanov, KIT.
Main behavior changes:
- CAST5 -> AES for symmetric encryption
- MD5 sigs rejected by default
ok danj@
* fix regression in --recv-key {multiple keys}
* cap the sizes for automatic key generation
While here, delete unneeded do-test target.
"looks ok" sthen@, ok daniel@
parsing compressed packets) and includes the patch we had for
CVE-2013-4242 (Yarom/Falkner flush+reload side-channel attack on RSA
secret keys already had a patch). Input from and ok sthen@
access violations and public keyring database corruption when importing
manipulated public keys. http://seclists.org/bugtraq/2012/Dec/151
Tweaked from a submission from David Hill.
