Imported Upstream version 2.2.31upstream/2.2.31

56 files changed, 669 insertions, 484 deletions

diff --git a/ChangeLog b/ChangeLog
index 3b689ff..c5227ee 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,70 @@
+2021-09-15  Werner Koch  <wk@gnupg.org>
+
+	Release 2.2.31.
+	+ commit ecf4c2f611238799a3af6369a64e418a77ab9dd6
+
+
+2021-09-14  Werner Koch  <wk@gnupg.org>
+
+	scd: Remove context reference counting from pc/sc.
+	+ commit 67e1834ad402e86906429ba0e2bf7ebd72de2450
+	* scd/apdu.c (pcsc): Add flag context_valid, remove count.
+	(close_pcsc_reader): Use new flag instead of looking at magic context
+	value.
+	(pcsc_init): Set new flag.
+	(open_pcsc_reader): Use new flag.
+	(apdu_init): Clear new flag.
+
+	* scd/apdu.c: Remove assert.h.  Replace all assert by log_assert.
+
+2021-09-13  Werner Koch  <wk@gnupg.org>
+
+	common: New envvar GNUPG_EXEC_DEBUG_FLAGS.
+	+ commit 117afec018911a3b0187f15c8559f811a72ddb79
+	* common/exechelp-w32.c (gnupg_spawn_process_detached): Silence
+	breakaway messages and turn them again into debug messages.
+
+2021-09-08  Werner Koch  <wk@gnupg.org>
+
+	scd: Support PC/SC for "getinfo reader_list".
+	+ commit f32994b0bf07d62bf596cc8bb6ec3c3a5f133ac4
+	* scd/apdu.c: Include membuf.h.
+	(pcsc): Add reader_list field.
+	(open_pcsc_reader): Fill that field.
+	(apdu_get_reader_list): New.
+	* scd/command.c: Remove header ccid-driver.h.
+	(pretty_assuan_send_data): New.
+	(cmd_getinfo): Print all reader names.
+
+2021-09-07  Werner Koch  <wk@gnupg.org>
+
+	scd: Fix possible assertion in close_pcsc_reader.
+	+ commit 192113552faa98f40cc91fe014ec55861474626c
+	* scd/apdu.c (close_pcsc_reader): Don't ref-count if the context is
+	invalid.
+	(open_pcsc_reader): Compare the context against -1 which is our
+	indicator for an invalid context.
+
+	agent: Fix segv in GET_PASSPHRASE (regression)
+	+ commit 4b2cfec2dc2fd524a4fed6c17bb11e6a7baf15f2
+	* agent/command.c (cmd_get_passphrase): Do not deref PI.  PI is always
+	NULL.
+
+2021-08-27  NIIBE Yutaka  <gniibe@fsij.org>
+
+	common: Fix put_membuf.
+	+ commit 7e431e009e479e63f0996a612e12fb9d8b209ab9
+	* common/membuf.c (put_membuf): Allow NULL for the second arg.
+
+	build: Fix removal of AC_TYPE_SIGNAL.
+	+ commit 0ca84cbdf0a5a956f4de80f874f8a3b495cfab20
+	* configure.ac: AC_TYPE_SIGNAL is still needed.
+
+	common: Fix get_signal_name for GNU/Linux.
+	+ commit d5f9481186eaf2ff28d7ab04fd36f0bbd1c9714d
+	* common/signal.c (get_signal_name): Use sigdescr_np if available.
+	* configure.ac: Check the function.
+
 2021-08-26  Werner Koch  <wk@gnupg.org>
 
 	Release 2.2.30.
diff --git a/NEWS b/NEWS
index 7081e49..c1e7d5d 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,16 @@
+Noteworthy changes in version 2.2.31 (2021-09-15)
+-------------------------------------------------
+
+  * agent: Fix a regression in GET_PASSPHRASE.  [#5577]
+
+  * scd: Fix an assertion failure in close_pcsc_reader.  [67e1834ad4]
+
+  * scd: Add support for PC/SC in "GETINFO reader_list".
+
+  Release-info: https://dev.gnupg.org/T5571
+  See-also: gnupg-announce/2021q3/000464.html
+
+
 Noteworthy changes in version 2.2.30 (2021-08-26)
 -------------------------------------------------
 
@@ -21,7 +34,7 @@ Noteworthy changes in version 2.2.30 (2021-08-26)
   * Under Windows use LOCAL_APPDATA for the socket directory.  [#5537]
 
   Release-info: https://dev.gnupg.org/T5519
-  See-also: gnupg-announce/2021q3/000462.html
+  See-also: gnupg-announce/2021q3/000463.html
 
 
 Noteworthy changes in version 2.2.29 (2021-07-04)
diff --git a/VERSION b/VERSION
index b570265..ad4c063 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.2.30
+2.2.31
diff --git a/agent/command.c b/agent/command.c
index 0c8a9ff..e22e2fa 100644
--- a/agent/command.c
+++ b/agent/command.c
@@ -1689,7 +1689,7 @@ cmd_get_passphrase (assuan_context_t ctx, char *line)
                                  opt_qualbar, cacheid, CACHE_MODE_USER, NULL);
       xfree (entry_errtext);
       entry_errtext = NULL;
-      is_generated = !!(pi->status & PINENTRY_STATUS_PASSWORD_GENERATED);
+      is_generated = 0;
 
       if (!rc)
         {
diff --git a/common/exechelp-w32.c b/common/exechelp-w32.c
index 4581ca8..bdbea31 100644
--- a/common/exechelp-w32.c
+++ b/common/exechelp-w32.c
@@ -893,10 +893,14 @@ gnupg_spawn_process_detached (const char *pgmname, const char *argv[],
   BOOL in_job = FALSE;
   gpg_err_code_t ec;
   int rc;
+  int jobdebug;
 
   /* We don't use ENVP.  */
   (void)envp;
 
+  cmdline = getenv ("GNUPG_EXEC_DEBUG_FLAGS");
+  jobdebug = (cmdline && (atoi (cmdline) & 1));
+
   if ((ec = gnupg_access (pgmname, X_OK)))
     return gpg_err_make (default_errsource, ec);
 
@@ -945,24 +949,32 @@ gnupg_spawn_process_detached (const char *pgmname, const char *argv[],
       else if ((info.BasicLimitInformation.LimitFlags &
                 JOB_OBJECT_LIMIT_BREAKAWAY_OK))
         {
-          log_info ("Using CREATE_BREAKAWAY_FROM_JOB flag\n");
+          if (jobdebug)
+            log_debug ("Using CREATE_BREAKAWAY_FROM_JOB flag\n");
           cr_flags |= CREATE_BREAKAWAY_FROM_JOB;
         }
       else if ((info.BasicLimitInformation.LimitFlags &
                 JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK))
         {
           /* The child process should automatically detach from the job. */
-          log_info ("Not using CREATE_BREAKAWAY_FROM_JOB flag; "
-                     "JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK is set\n");
+          if (jobdebug)
+            log_debug ("Not using CREATE_BREAKAWAY_FROM_JOB flag; "
+                       "JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK is set\n");
         }
       else
         {
           /* It seems that the child process must remain in the job.
            * This is not necessarily an error, although it can cause premature
            * termination of the child process when the job is closed. */
-          log_info ("Not using CREATE_BREAKAWAY_FROM_JOB flag\n");
+          if (jobdebug)
+            log_debug ("Not using CREATE_BREAKAWAY_FROM_JOB flag\n");
         }
     }
+  else
+    {
+      if (jobdebug)
+        log_debug ("Process is not in a Job\n");
+    }
 
   /*   log_debug ("CreateProcess(detached), path='%s' cmdline='%s'\n", */
   /*              pgmname, cmdline); */
diff --git a/common/membuf.c b/common/membuf.c
index 18a971d..009fbc3 100644
--- a/common/membuf.c
+++ b/common/membuf.c
@@ -111,7 +111,10 @@ put_membuf (membuf_t *mb, const void *buf, size_t len)
         }
       mb->buf = p;
     }
-  memcpy (mb->buf + mb->len, buf, len);
+  if (buf)
+    memcpy (mb->buf + mb->len, buf, len);
+  else
+    memset (mb->buf + mb->len, 0, len);
   mb->len += len;
 }
 
diff --git a/common/signal.c b/common/signal.c
index ccfa8e6..92925fd 100644
--- a/common/signal.c
+++ b/common/signal.c
@@ -87,7 +87,9 @@ get_signal_name( int signum )
 {
   /* Note that we can't use strsignal(), because it is not
      reentrant. */
-#if HAVE_DECL_SYS_SIGLIST && defined(NSIG)
+#if HAVE_SIGDESCR_NP
+  return sigdescr_np (signum);
+#elif HAVE_DECL_SYS_SIGLIST && defined(NSIG)
   return (signum >= 0 && signum < NSIG) ? sys_siglist[signum] : "?";
 #else
   return NULL;
diff --git a/config.h.in b/config.h.in
index 455f465..b4187e5 100644
--- a/config.h.in
+++ b/config.h.in
@@ -441,6 +441,9 @@
 /* Define to 1 if you have the `sigaction' function. */
 #undef HAVE_SIGACTION
 
+/* Define to 1 if you have the `sigdescr_np' function. */
+#undef HAVE_SIGDESCR_NP
+
 /* Define to 1 if you have the <signal.h> header file. */
 #undef HAVE_SIGNAL_H
 
diff --git a/configure b/configure
index e429440..2fefdd7 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for gnupg 2.2.30.
+# Generated by GNU Autoconf 2.69 for gnupg 2.2.31.
 #
 # Report bugs to <https://bugs.gnupg.org>.
 #
@@ -580,8 +580,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='gnupg'
 PACKAGE_TARNAME='gnupg'
-PACKAGE_VERSION='2.2.30'
-PACKAGE_STRING='gnupg 2.2.30'
+PACKAGE_VERSION='2.2.31'
+PACKAGE_STRING='gnupg 2.2.31'
 PACKAGE_BUGREPORT='https://bugs.gnupg.org'
 PACKAGE_URL=''
 
@@ -1535,7 +1535,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures gnupg 2.2.30 to adapt to many kinds of systems.
+\`configure' configures gnupg 2.2.31 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1606,7 +1606,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of gnupg 2.2.30:";;
+     short | recursive ) echo "Configuration of gnupg 2.2.31:";;
    esac
   cat <<\_ACEOF
 
@@ -1822,7 +1822,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-gnupg configure 2.2.30
+gnupg configure 2.2.31
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2531,7 +2531,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by gnupg $as_me 2.2.30, which was
+It was created by gnupg $as_me 2.2.31, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -3430,7 +3430,7 @@ fi
 
 # Define the identity of the package.
  PACKAGE='gnupg'
- VERSION='2.2.30'
+ VERSION='2.2.31'
 
 
 cat >>confdefs.h <<_ACEOF
@@ -13761,6 +13761,17 @@ cat >>confdefs.h <<_ACEOF
 _ACEOF
 
 
+for ac_func in sigdescr_np
+do :
+  ac_fn_c_check_func "$LINENO" "sigdescr_np" "ac_cv_func_sigdescr_np"
+if test "x$ac_cv_func_sigdescr_np" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_SIGDESCR_NP 1
+_ACEOF
+
+fi
+done
+
 ac_fn_c_check_decl "$LINENO" "sys_siglist" "ac_cv_have_decl_sys_siglist" "#include <signal.h>
 /* NetBSD declares sys_siglist in unistd.h.  */
 #ifdef HAVE_UNISTD_H
@@ -16026,7 +16037,7 @@ fi
 #
 # Provide information about the build.
 #
-BUILD_REVISION="d583e750a"
+BUILD_REVISION="ecf4c2f61"
 
 
 cat >>confdefs.h <<_ACEOF
@@ -16035,7 +16046,7 @@ _ACEOF
 
 
 BUILD_VERSION=`echo "$VERSION" | sed 's/\([0-9.]*\).*/\1./'`
-BUILD_VERSION="${BUILD_VERSION}54659"
+BUILD_VERSION="${BUILD_VERSION}60660"
 BUILD_FILEVERSION=`echo "${BUILD_VERSION}" | tr . ,`
 
 
@@ -16895,7 +16906,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by gnupg $as_me 2.2.30, which was
+This file was extended by gnupg $as_me 2.2.31, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -16961,7 +16972,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-gnupg config.status 2.2.30
+gnupg config.status 2.2.31
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
@@ -17981,7 +17992,7 @@ fi
 echo "
         GnuPG v${VERSION} has been configured as follows:
 
-        Revision:  d583e750a  (54659)
+        Revision:  ecf4c2f61  (60660)
         Platform:  $PRINTABLE_OS_NAME ($host)
 
         OpenPGP:   $build_gpg
diff --git a/configure.ac b/configure.ac
index 82b4735..6e6d0e0 100644
--- a/configure.ac
+++ b/configure.ac
@@ -29,7 +29,7 @@ min_automake_version="1.14"
 m4_define([mym4_package],[gnupg])
 m4_define([mym4_major], [2])
 m4_define([mym4_minor], [2])
-m4_define([mym4_micro], [30])
+m4_define([mym4_micro], [31])
 
 # To start a new development series, i.e a new major or minor number
 # you need to mark an arbitrary commit before the first beta release
@@ -1352,6 +1352,7 @@ AC_C_VOLATILE
 AC_TYPE_SIZE_T
 AC_TYPE_MODE_T
 AC_TYPE_SIGNAL
+AC_CHECK_FUNCS([sigdescr_np])
 AC_DECL_SYS_SIGLIST
 
 gl_HEADER_SYS_SOCKET
diff --git a/doc/defsincdate b/doc/defsincdate
index 0499b74..c723478 100644
--- a/doc/defsincdate
+++ b/doc/defsincdate
@@ -1 +1 @@
-1629469364
+1631202333
diff --git a/doc/gnupg-card-architecture.pdf b/doc/gnupg-card-architecture.pdf
index 1b049e8..b3a38c6 100644
--- a/doc/gnupg-card-architecture.pdf
+++ b/doc/gnupg-card-architecture.pdf
diff --git a/doc/gnupg-module-overview.pdf b/doc/gnupg-module-overview.pdf
index 6e1c24d..71411d3 100644
--- a/doc/gnupg-module-overview.pdf
+++ b/doc/gnupg-module-overview.pdf
@@ -344,8 +344,8 @@ endobj
 17 0 obj
 <<
 /Title (��
-/CreationDate (D:20210826182250)
-/ModDate (D:20210826182250)
+/CreationDate (D:20210915165557)
+/ModDate (D:20210915165557)
 /Producer (https://imagemagick.org)
 >>
 endobj
diff --git a/doc/gnupg-module-overview.png b/doc/gnupg-module-overview.png
index e153ade..583d412 100644
--- a/doc/gnupg-module-overview.png
+++ b/doc/gnupg-module-overview.png
diff --git a/doc/gnupg.info b/doc/gnupg.info
index 2ea3772..69d4c72 100644
--- a/doc/gnupg.info
+++ b/doc/gnupg.info
@@ -1,7 +1,7 @@
 This is gnupg.info, produced by makeinfo version 6.5 from gnupg.texi.
 
-This is the 'The GNU Privacy Guard Manual' (version 2.2.30-beta2, August
-2021).
+This is the 'The GNU Privacy Guard Manual' (version 2.2.31-beta7,
+September 2021).
 
    (C) 2002, 2004, 2005, 2006, 2007, 2010 Free Software Foundation, Inc.
 (C) 2013, 2014, 2015 Werner Koch.
@@ -23,201 +23,201 @@ END-INFO-DIR-ENTRY
 
 
 Indirect:
-gnupg.info-1: 989
-gnupg.info-2: 303649
+gnupg.info-1: 992
+gnupg.info-2: 301013
 
 Tag Table:
 (Indirect)
-Node: Top989
-Node: Installation2915
-Node: Invoking GPG-AGENT5264
+Node: Top992
+Node: Installation2921
+Node: Invoking GPG-AGENT5270
 Node: Agent Commands7030
 Node: Agent Options8834
 Ref: option --options9114
 Ref: option --homedir9440
-Ref: option --log-file14481
-Ref: option --no-allow-mark-trusted14854
-Ref: option --allow-preset-passphrase15058
-Ref: option --no-allow-loopback-pinentry15211
-Ref: option --extra-socket23564
-Ref: option --enable-ssh-support25030
-Ref: option --ssh-fingerprint-digest27367
-Node: Agent Configuration29024
-Node: Agent Signals34422
-Node: Agent Examples35882
-Node: Agent Protocol36449
-Node: Agent PKDECRYPT38603
-Node: Agent PKSIGN40515
-Node: Agent GENKEY42819
-Node: Agent IMPORT44716
-Node: Agent EXPORT45160
-Node: Agent ISTRUSTED45375
-Node: Agent GET_PASSPHRASE47750
-Node: Agent CLEAR_PASSPHRASE50191
-Node: Agent PRESET_PASSPHRASE50582
-Node: Agent GET_CONFIRMATION51420
-Node: Agent HAVEKEY52092
-Node: Agent LEARN52724
-Node: Agent PASSWD53022
-Node: Agent UPDATESTARTUPTTY53488
-Node: Agent GETEVENTCOUNTER53966
-Node: Agent GETINFO54768
-Node: Agent OPTION55472
-Node: Invoking DIRMNGR58530
-Node: Dirmngr Commands59428
-Node: Dirmngr Options61881
-Ref: Dirmngr Options-Footnote-179036
-Node: Dirmngr Configuration79171
-Node: Dirmngr Signals82301
-Node: Dirmngr Examples83329
-Node: Dirmngr Protocol84011
-Node: Dirmngr LOOKUP84661
-Node: Dirmngr ISVALID86032
-Node: Dirmngr CHECKCRL88605
-Node: Dirmngr CHECKOCSP89662
-Node: Dirmngr CACHECERT90968
-Node: Dirmngr VALIDATE91807
-Node: Invoking GPG92375
-Node: GPG Commands93605
-Node: General GPG Commands94499
-Node: Operational GPG Commands95188
-Ref: option --export-ownertrust112490
-Node: OpenPGP Key Management114603
-Node: GPG Options136564
-Node: GPG Configuration Options137897
-Ref: gpg-option --options151398
-Ref: trust-model-tofu155966
-Node: GPG Key related Options176146
-Node: GPG Input and Output181342
-Node: OpenPGP Options195046
-Node: Compliance Options199774
-Node: GPG Esoteric Options202925
-Ref: GPG Esoteric Options-Footnote-1230034
-Node: Deprecated Options230188
-Node: GPG Configuration231691
-Node: GPG Examples237161
-Node: Unattended Usage of GPG245971
-Node: Programmatic use of GnuPG246602
-Node: Ephemeral home directories247153
-Node: The quick key manipulation interface248460
-Node: Unattended GPG key generation249047
-Node: Invoking GPGSM258366
-Node: GPGSM Commands259235
-Node: General GPGSM Commands259673
-Node: Operational GPGSM Commands260361
-Node: Certificate Management262395
-Node: GPGSM Options267371
-Node: Configuration Options267945
-Ref: gpgsm-option --options268214
-Node: Certificate Options271494
-Ref: gpgsm-option --validation-model275098
-Node: Input and Output276078
-Ref: option --p12-charset276661
-Ref: gpgsm-option --with-key-data277905
-Ref: gpgsm-option --with-validation278179
-Node: CMS Options279057
-Node: Esoteric Options280077
-Node: GPGSM Configuration285504
-Node: GPGSM Examples291172
-Node: Unattended Usage291369
-Node: Automated signature checking291960
-Node: CSR and certificate creation293783
-Node: GPGSM Protocol298729
-Node: GPGSM ENCRYPT299985
-Node: GPGSM DECRYPT303649
-Node: GPGSM SIGN304485
-Node: GPGSM VERIFY305941
-Node: GPGSM GENKEY306457
-Node: GPGSM LISTKEYS307472
-Ref: gpgsm-cmd listkeys307631
-Node: GPGSM EXPORT308384
-Node: GPGSM IMPORT309348
-Node: GPGSM DELETE310089
-Node: GPGSM GETAUDITLOG310596
-Ref: gpgsm-cmd getauditlog310765
-Node: GPGSM GETINFO311109
-Node: GPGSM OPTION311958
-Node: Invoking SCDAEMON315311
-Node: Scdaemon Commands315985
-Node: Scdaemon Options317113
-Node: Card applications326463
-Node: OpenPGP Card327128
-Node: NKS Card327601
-Node: DINSIG Card327927
-Node: PKCS#15 Card328303
-Node: Geldkarte Card328573
-Node: SmartCard-HSM328964
-Node: Undefined Card329560
-Node: Scdaemon Configuration329973
-Node: Scdaemon Examples331011
-Node: Scdaemon Protocol331194
-Node: Scdaemon SERIALNO332713
-Node: Scdaemon LEARN333559
-Node: Scdaemon READCERT334406
-Node: Scdaemon READKEY334808
-Node: Scdaemon PKSIGN335094
-Node: Scdaemon PKDECRYPT335820
-Node: Scdaemon GETATTR336570
-Node: Scdaemon SETATTR336772
-Node: Scdaemon WRITEKEY336977
-Node: Scdaemon GENKEY337679
-Node: Scdaemon RANDOM337882
-Node: Scdaemon PASSWD338105
-Node: Scdaemon CHECKPIN338496
-Node: Scdaemon RESTART339499
-Node: Scdaemon APDU340032
-Node: Specify a User ID341005
-Ref: how-to-specify-a-user-id341163
-Node: Trust Values346021
-Ref: trust-values346150
-Node: Helper Tools346755
-Node: watchgnupg347607
-Ref: option watchgnupg --tcp348429
-Node: gpgv350007
-Node: addgnupghome355206
-Node: gpgconf355902
-Ref: gpgconf-Footnote-1358089
-Node: Invoking gpgconf358387
-Node: Format conventions364972
-Node: Listing components370303
-Node: Checking programs372386
-Node: Listing options375124
-Node: Changing options382620
-Node: Listing global options384322
-Node: Querying versions386093
-Node: Files used by gpgconf388791
-Node: applygnupgdefaults389267
-Node: gpg-preset-passphrase390011
-Node: Invoking gpg-preset-passphrase391046
-Node: gpg-connect-agent392448
-Node: Invoking gpg-connect-agent393162
-Node: Controlling gpg-connect-agent396708
-Node: dirmngr-client403181
-Node: gpgparsemail406532
-Node: gpgtar406845
-Node: gpg-check-pattern410804
-Node: Web Key Service413106
-Node: gpg-wks-client413419
-Node: gpg-wks-server418584
-Node: Howtos423941
-Node: Howto Create a Server Cert424213
-Node: System Notes432626
-Node: W32 Notes433837
-Node: Debugging434259
-Node: Debugging Tools435087
-Node: kbxutil435367
-Node: Debugging Hints436898
-Node: Common Problems438029
-Node: Architecture Details443266
-Node: Component interaction443576
-Ref: fig:moduleoverview443762
-Node: GnuPG-1 and GnuPG-2443869
-Ref: fig:cardarchitecture444159
-Node: Copying444274
-Node: Contributors481798
-Node: Glossary488053
-Node: Option Index490572
-Node: Environment Index570427
-Node: Index575874
+Ref: option --log-file14478
+Ref: option --no-allow-mark-trusted14851
+Ref: option --allow-preset-passphrase15055
+Ref: option --no-allow-loopback-pinentry15208
+Ref: option --extra-socket23572
+Ref: option --enable-ssh-support25038
+Ref: option --ssh-fingerprint-digest27375
+Node: Agent Configuration29032
+Node: Agent Signals34457
+Node: Agent Examples35917
+Node: Agent Protocol36484
+Node: Agent PKDECRYPT38638
+Node: Agent PKSIGN40550
+Node: Agent GENKEY42854
+Node: Agent IMPORT44751
+Node: Agent EXPORT45195
+Node: Agent ISTRUSTED45410
+Node: Agent GET_PASSPHRASE47785
+Node: Agent CLEAR_PASSPHRASE50226
+Node: Agent PRESET_PASSPHRASE50617
+Node: Agent GET_CONFIRMATION51455
+Node: Agent HAVEKEY52127
+Node: Agent LEARN52759
+Node: Agent PASSWD53057
+Node: Agent UPDATESTARTUPTTY53523
+Node: Agent GETEVENTCOUNTER54001
+Node: Agent GETINFO54803
+Node: Agent OPTION55507
+Node: Invoking DIRMNGR58565
+Node: Dirmngr Commands59463
+Node: Dirmngr Options61916
+Ref: Dirmngr Options-Footnote-179071
+Node: Dirmngr Configuration79206
+Node: Dirmngr Signals82336
+Node: Dirmngr Examples83364
+Node: Dirmngr Protocol84046
+Node: Dirmngr LOOKUP84696
+Node: Dirmngr ISVALID86067
+Node: Dirmngr CHECKCRL88640
+Node: Dirmngr CHECKOCSP89697
+Node: Dirmngr CACHECERT91003
+Node: Dirmngr VALIDATE91842
+Node: Invoking GPG92410
+Node: GPG Commands93640
+Node: General GPG Commands94534
+Node: Operational GPG Commands95223
+Ref: option --export-ownertrust112524
+Node: OpenPGP Key Management114637
+Node: GPG Options136596
+Node: GPG Configuration Options137929
+Ref: gpg-option --options151464
+Ref: trust-model-tofu156032
+Node: GPG Key related Options176209
+Node: GPG Input and Output181405
+Node: OpenPGP Options195109
+Node: Compliance Options199837
+Node: GPG Esoteric Options202988
+Ref: GPG Esoteric Options-Footnote-1230058
+Node: Deprecated Options230212
+Node: GPG Configuration231715
+Node: GPG Examples237196
+Node: Unattended Usage of GPG246006
+Node: Programmatic use of GnuPG246637
+Node: Ephemeral home directories247188
+Node: The quick key manipulation interface248495
+Node: Unattended GPG key generation249082
+Node: Invoking GPGSM258401
+Node: GPGSM Commands259270
+Node: General GPGSM Commands259708
+Node: Operational GPGSM Commands260396
+Node: Certificate Management262430
+Node: GPGSM Options267406
+Node: Configuration Options267980
+Ref: gpgsm-option --options268249
+Node: Certificate Options271523
+Ref: gpgsm-option --validation-model275127
+Node: Input and Output276107
+Ref: option --p12-charset276690
+Ref: gpgsm-option --with-key-data277934
+Ref: gpgsm-option --with-validation278208
+Node: CMS Options279086
+Node: Esoteric Options280106
+Node: GPGSM Configuration285533
+Node: GPGSM Examples291208
+Node: Unattended Usage291405
+Node: Automated signature checking291996
+Node: CSR and certificate creation293819
+Node: GPGSM Protocol298765
+Node: GPGSM ENCRYPT301013
+Node: GPGSM DECRYPT303688
+Node: GPGSM SIGN304524
+Node: GPGSM VERIFY305980
+Node: GPGSM GENKEY306496
+Node: GPGSM LISTKEYS307511
+Ref: gpgsm-cmd listkeys307670
+Node: GPGSM EXPORT308423
+Node: GPGSM IMPORT309387
+Node: GPGSM DELETE310128
+Node: GPGSM GETAUDITLOG310635
+Ref: gpgsm-cmd getauditlog310804
+Node: GPGSM GETINFO311148
+Node: GPGSM OPTION311997
+Node: Invoking SCDAEMON315350
+Node: Scdaemon Commands316024
+Node: Scdaemon Options317152
+Node: Card applications326499
+Node: OpenPGP Card327164
+Node: NKS Card327637
+Node: DINSIG Card327963
+Node: PKCS#15 Card328339
+Node: Geldkarte Card328609
+Node: SmartCard-HSM329000
+Node: Undefined Card329596
+Node: Scdaemon Configuration330009
+Node: Scdaemon Examples331047
+Node: Scdaemon Protocol331230
+Node: Scdaemon SERIALNO332757
+Node: Scdaemon LEARN333603
+Node: Scdaemon READCERT334450
+Node: Scdaemon READKEY334852
+Node: Scdaemon PKSIGN335138
+Node: Scdaemon PKDECRYPT335864
+Node: Scdaemon GETATTR336614
+Node: Scdaemon SETATTR336816
+Node: Scdaemon WRITEKEY337021
+Node: Scdaemon GENKEY337723
+Node: Scdaemon RANDOM337926
+Node: Scdaemon PASSWD338149
+Node: Scdaemon CHECKPIN338540
+Node: Scdaemon RESTART339543
+Node: Scdaemon APDU340076
+Node: Specify a User ID341049
+Ref: how-to-specify-a-user-id341207
+Node: Trust Values346065
+Ref: trust-values346194
+Node: Helper Tools346799
+Node: watchgnupg347651
+Ref: option watchgnupg --tcp348473
+Node: gpgv350051
+Node: addgnupghome355247
+Node: gpgconf355943
+Ref: gpgconf-Footnote-1358130
+Node: Invoking gpgconf358428
+Node: Format conventions365010
+Node: Listing components370341
+Node: Checking programs372424
+Node: Listing options375162
+Node: Changing options382658
+Node: Listing global options384360
+Node: Querying versions386131
+Node: Files used by gpgconf388829
+Node: applygnupgdefaults389305
+Node: gpg-preset-passphrase390049
+Node: Invoking gpg-preset-passphrase391084
+Node: gpg-connect-agent392486
+Node: Invoking gpg-connect-agent393200
+Node: Controlling gpg-connect-agent396743
+Node: dirmngr-client403216
+Node: gpgparsemail406567
+Node: gpgtar406880
+Node: gpg-check-pattern410839
+Node: Web Key Service413141
+Node: gpg-wks-client413454
+Node: gpg-wks-server418619
+Node: Howtos423976
+Node: Howto Create a Server Cert424248
+Node: System Notes432661
+Node: W32 Notes433872
+Node: Debugging434294
+Node: Debugging Tools435122
+Node: kbxutil435402
+Node: Debugging Hints436933
+Node: Common Problems438064
+Node: Architecture Details443287
+Node: Component interaction443597
+Ref: fig:moduleoverview443783
+Node: GnuPG-1 and GnuPG-2443890
+Ref: fig:cardarchitecture444180
+Node: Copying444295
+Node: Contributors481819
+Node: Glossary488074
+Node: Option Index490593
+Node: Environment Index570448
+Node: Index575895
 
 End Tag Table
diff --git a/doc/gnupg.info-1 b/doc/gnupg.info-1
index 70cd733..1339aef 100644
--- a/doc/gnupg.info-1
+++ b/doc/gnupg.info-1
@@ -1,7 +1,7 @@
 This is gnupg.info, produced by makeinfo version 6.5 from gnupg.texi.
 
-This is the 'The GNU Privacy Guard Manual' (version 2.2.30-beta2, August
-2021).
+This is the 'The GNU Privacy Guard Manual' (version 2.2.31-beta7,
+September 2021).
 
    (C) 2002, 2004, 2005, 2006, 2007, 2010 Free Software Foundation, Inc.
 (C) 2013, 2014, 2015 Werner Koch.
@@ -27,8 +27,8 @@ File: gnupg.info,  Node: Top,  Next: Installation,  Up: (dir)
 Using the GNU Privacy Guard
 ***************************
 
-This is the 'The GNU Privacy Guard Manual' (version 2.2.30-beta2, August
-2021).
+This is the 'The GNU Privacy Guard Manual' (version 2.2.31-beta7,
+September 2021).
 
    (C) 2002, 2004, 2005, 2006, 2007, 2010 Free Software Foundation, Inc.
 (C) 2013, 2014, 2015 Werner Koch.
@@ -160,8 +160,8 @@ required.
 under the default filename (which is system dependent) or use the option
 'pinentry-program' to specify the full name of that program.  It is
 often useful to install a symbolic link from the actual used pinentry
-(e.g.  '/usr/local/bin/pinentry-gtk') to the expected one (e.g.
-'/usr/local/bin/pinentry').
+(e.g.  'INSTDIR/bin/pinentry-gtk') to the expected one (e.g.
+'INSTDIR/bin/pinentry').
 
 *Note Option Index::, for an index to 'GPG-AGENT''s commands and
 options.
@@ -257,7 +257,7 @@ the two leading dashes, in the configuration file.
      directory; or, if 'gpgconf.exe' has been installed directly below a
      directory named 'bin', its parent directory.  You also need to make
      sure that the following directories exist and are writable:
-     'ROOT/home' for the GnuPG home and 'ROOT/usr/local/var/cache/gnupg'
+     'ROOT/home' for the GnuPG home and 'ROOTAPPDATA/GNU/cache/gnupg'
      for internal cache files.
 
 '-v'
@@ -468,10 +468,10 @@ the two leading dashes, in the configuration file.
      entering a new passphrase matching one of these pattern a warning
      will be displayed.  If FILE does not contain any slashes and does
      not start with "~/" it is searched in the system configuration
-     directory ('/etc/gnupg').  The default is not to use any pattern
-     file.  The second version of this option is only used when creating
-     a new symmetric key to allow the use of different patterns for such
-     passphrases.
+     directory ('APPDATA/GNU/etc/gnupg').  The default is not to use any
+     pattern file.  The second version of this option is only used when
+     creating a new symmetric key to allow the use of different patterns
+     for such passphrases.
 
      Security note: It is known that checking a passphrase against a
      list of pattern or even against a complete dictionary is not very
@@ -747,8 +747,9 @@ agent.  By default they may all be found in the current home directory
      changed inadvertently.
 
      As a special feature a line 'include-default' will include a global
-     list of trusted certificates (e.g.  '/etc/gnupg/trustlist.txt').
-     This global list is also used if the local list is not available.
+     list of trusted certificates (e.g.
+     'APPDATA/GNU/etc/gnupg/trustlist.txt').  This global list is also
+     used if the local list is not available.
 
      It is possible to add further flags after the 'S' for use by the
      caller:
@@ -803,9 +804,10 @@ agent.  By default they may all be found in the current home directory
      directory and take great care to keep this backup closed away.
 
    Note that on larger installations, it is useful to put predefined
-files into the directory '/etc/skel/.gnupg' so that newly created users
-start up with a working configuration.  For existing users the a small
-helper script is provided to create these files (*note addgnupghome::).
+files into the directory 'APPDATA/GNU/etc/skel/.gnupg' so that newly
+created users start up with a working configuration.  For existing users
+the a small helper script is provided to create these files (*note
+addgnupghome::).
 
 
 File: gnupg.info,  Node: Agent Signals,  Next: Agent Examples,  Prev: Agent Configuration,  Up: Invoking GPG-AGENT
@@ -2659,11 +2661,11 @@ File: gnupg.info,  Node: Operational GPG Commands,  Next: OpenPGP Key Management
      not to request a confirmation.
 
 '--export'
-     Either export all keys from all keyrings (default keyrings and
-     those registered via option '--keyring'), or if at least one name
-     is given, those of the given name.  The exported keys are written
-     to STDOUT or to the file given with option '--output'.  Use
-     together with '--armor' to mail those keys.
+     Either export all keys from all keyrings (default keyring and those
+     registered via option '--keyring'), or if at least one name is
+     given, those of the given name.  The exported keys are written to
+     STDOUT or to the file given with option '--output'.  Use together
+     with '--armor' to mail those keys.
 
 '--send-keys KEYIDS'
      Similar to '--export' but sends the keys to a keyserver.
@@ -3196,10 +3198,10 @@ This section explains the main commands for key management.
           bring older keys up to date.
 
      save
-          Save all changes to the keyrings and quit.
+          Save all changes to the keyring and quit.
 
      quit
-          Quit the program without updating the keyrings.
+          Quit the program without updating the keyring.
 
      The listing shows you the key with its secondary keys and all user
      IDs.  The primary user ID is indicated by a dot, and selected keys
@@ -3545,8 +3547,8 @@ usually found in the option file.
      Add FILE to the current list of keyrings.  If FILE begins with a
      tilde and a slash, these are replaced by the $HOME directory.  If
      the filename does not contain a slash, it is assumed to be in the
-     GnuPG home directory ("~/.gnupg" if '--homedir' or $GNUPGHOME is
-     not used).
+     GnuPG home directory ("~/.gnupg" unless '--homedir' or $GNUPGHOME
+     is used).
 
      Note that this adds a keyring to the current list.  If the intent
      is to use the specified keyring alone, use '--keyring' along with
@@ -3555,16 +3557,16 @@ usually found in the option file.
      If the option '--no-keyring' has been used no keyrings will be used
      at all.
 
+'--primary-keyring FILE'
+     This is a varian of '--keyring' and designates FILE as the primary
+     public keyring.  This means that newly imported keys (via
+     '--import' or keyserver '--recv-from') will go to this keyring.
+
 '--secret-keyring FILE'
      This is an obsolete option and ignored.  All secret keys are stored
      in the 'private-keys-v1.d' directory below the GnuPG home
      directory.
 
-'--primary-keyring FILE'
-     Designate FILE as the primary public keyring.  This means that
-     newly imported keys (via '--import' or keyserver '--recv-from')
-     will go to this keyring.
-
 '--trustdb-name FILE'
      Use FILE instead of the default trustdb.  If FILE begins with a
      tilde and a slash, these are replaced by the $HOME directory.  If
@@ -3590,7 +3592,7 @@ usually found in the option file.
      directory; or, if 'gpgconf.exe' has been installed directly below a
      directory named 'bin', its parent directory.  You also need to make
      sure that the following directories exist and are writable:
-     'ROOT/home' for the GnuPG home and 'ROOT/usr/local/var/cache/gnupg'
+     'ROOT/home' for the GnuPG home and 'ROOTAPPDATA/GNU/cache/gnupg'
      for internal cache files.
 
 '--display-charset NAME'
@@ -4074,7 +4076,7 @@ usually found in the option file.
 
 '--dirmngr-program FILE'
      Specify a dirmngr program to be used for keyserver access.  The
-     default value is '/usr/local/bin/dirmngr'.
+     default value is 'INSTDIR/bin/dirmngr'.
 
 '--disable-dirmngr'
      Entirely disable the use of the Dirmngr.
@@ -5203,11 +5205,10 @@ File: gnupg.info,  Node: GPG Esoteric Options,  Next: Deprecated Options,  Prev:
      invalid.  This options allows to override this restriction.
 
 '--no-default-keyring'
-     Do not add the default keyrings to the list of keyrings.  Note that
-     GnuPG will not operate without any keyrings, so if you use this
-     option and do not provide alternate keyrings via '--keyring' or
-     '--secret-keyring', then GnuPG will still use the default public or
-     secret keyrings.
+     Do not add the default keyring to the list of keyrings.  Note that
+     GnuPG needs for almost all operations a keyring.  Thus if you use
+     this option and do not provide alternate keyrings via '--keyring',
+     then GnuPG will still use the default keyring.
 
 '--no-keyring'
      Do not use any keyring at all.  This overrides the default and all
@@ -5444,9 +5445,10 @@ directory (*note option --homedir::).
      --options::).  You should backup this file.
 
    Note that on larger installations, it is useful to put predefined
-files into the directory '/etc/skel/.gnupg' so that newly created users
-start up with a working configuration.  For existing users a small
-helper script is provided to create these files (*note addgnupghome::).
+files into the directory 'APPDATA/GNU/etc/skel/.gnupg' so that newly
+created users start up with a working configuration.  For existing users
+a small helper script is provided to create these files (*note
+addgnupghome::).
 
    For internal purposes 'gpg' creates and maintains a few other files;
 They all live in the current home directory (*note option --homedir::).
@@ -6367,7 +6369,7 @@ in the option file.
      directory; or, if 'gpgconf.exe' has been installed directly below a
      directory named 'bin', its parent directory.  You also need to make
      sure that the following directories exist and are writable:
-     'ROOT/home' for the GnuPG home and 'ROOT/usr/local/var/cache/gnupg'
+     'ROOT/home' for the GnuPG home and 'ROOTAPPDATA/GNU/cache/gnupg'
      for internal cache files.
 
 '-v'
@@ -6396,7 +6398,7 @@ in the option file.
 
 '--dirmngr-program FILE'
      Specify a dirmngr program to be used for CRL checks.  The default
-     value is '/usr/local/bin/dirmngr'.
+     value is 'INSTDIR/bin/dirmngr'.
 
 '--prefer-system-dirmngr'
      This option is obsolete and ignored.
@@ -6803,7 +6805,7 @@ home directory (*note option --homedir::).
      'trustlist.txt'.
 
      This is a global file an installed in the data directory (e.g.
-     '/usr/local/share/gnupg/qualified.txt').  GnuPG installs a suitable
+     'INSTDIR/share/gnupg/qualified.txt').  GnuPG installs a suitable
      file with root certificates as used in Germany.  As new Root-CA
      certificates may be issued over time, these entries may need to be
      updated; new distributions of this software should come with an
@@ -6830,17 +6832,18 @@ home directory (*note option --homedir::).
      localized versions use filenames like 'help.LL.txt' with LL
      denoting the locale.  GnuPG comes with a set of predefined help
      files in the data directory (e.g.
-     '/usr/local/share/gnupg/gnupg/help.de.txt') and allows overriding
-     of any help item by help files stored in the system configuration
-     directory (e.g.  '/etc/gnupg/help.de.txt').  For a reference of the
-     help file's syntax, please see the installed 'help.txt' file.
+     'INSTDIR/share/gnupg/gnupg/help.de.txt') and allows overriding of
+     any help item by help files stored in the system configuration
+     directory (e.g.  'APPDATA/GNU/etc/gnupg/help.de.txt').  For a
+     reference of the help file's syntax, please see the installed
+     'help.txt' file.
 
 'com-certs.pem'
      This file is a collection of common certificates used to populated
      a newly created 'pubring.kbx'.  An administrator may replace this
      file with a custom one.  The format is a concatenation of PEM
      encoded X.509 certificates.  This global file is installed in the
-     data directory (e.g.  '/usr/local/share/gnupg/com-certs.pem').
+     data directory (e.g.  'INSTDIR/share/gnupg/com-certs.pem').
 
    Note that on larger installations, it is useful to put predefined
 files into the directory '/etc/skel/.gnupg/' so that newly created users
@@ -7087,65 +7090,3 @@ Assuan manual for details.
 * GPGSM GETINFO::         Information about the process
 * GPGSM OPTION::          Session options.
 
-
-File: gnupg.info,  Node: GPGSM ENCRYPT,  Next: GPGSM DECRYPT,  Up: GPGSM Protocol
-
-5.6.1 Encrypting a Message
---------------------------
-
-Before encryption can be done the recipient must be set using the
-command:
-
-       RECIPIENT USERID
-
-   Set the recipient for the encryption.  USERID should be the internal
-representation of the key; the server may accept any other way of
-specification.  If this is a valid and trusted recipient the server does
-respond with OK, otherwise the return is an ERR with the reason why the
-recipient cannot be used, the encryption will then not be done for this
-recipient.  If the policy is not to encrypt at all if not all recipients
-are valid, the client has to take care of this.  All 'RECIPIENT'
-commands are cumulative until a 'RESET' or an successful 'ENCRYPT'
-command.
-
-       INPUT FD[=N] [--armor|--base64|--binary]
-
-   Set the file descriptor for the message to be encrypted to N.
-Obviously the pipe must be open at that point, the server establishes
-its own end.  If the server returns an error the client should consider
-this session failed.  If N is not given, this commands uses the last
-file descriptor passed to the application.  *Note the assuan_sendfd
-function: (assuan)fun-assuan_sendfd, on how to do descriptor passing.
-
-   The '--armor' option may be used to advise the server that the input
-data is in PEM format, '--base64' advises that a raw base-64 encoding is
-used, '--binary' advises of raw binary input (BER).  If none of these
-options is used, the server tries to figure out the used encoding, but
-this may not always be correct.
-
-       OUTPUT FD[=N] [--armor|--base64]
-
-   Set the file descriptor to be used for the output (i.e.  the
-encrypted message).  Obviously the pipe must be open at that point, the
-server establishes its own end.  If the server returns an error the
-client should consider this session failed.
-
-   The option '--armor' encodes the output in PEM format, the '--base64'
-option applies just a base-64 encoding.  No option creates binary output
-(BER).
-
-   The actual encryption is done using the command
-
-       ENCRYPT
-
-   It takes the plaintext from the 'INPUT' command, writes to the
-ciphertext to the file descriptor set with the 'OUTPUT' command, take
-the recipients from all the recipients set so far.  If this command
-fails the clients should try to delete all output currently done or
-otherwise mark it as invalid.  'GPGSM' does ensure that there will not
-be any security problem with leftover data on the output in this case.
-
-   This command should in general not fail, as all necessary checks have
-been done while setting the recipients.  The input and output pipes are
-closed.
-
diff --git a/doc/gnupg.info-2 b/doc/gnupg.info-2
index d2d8a9c..273662e 100644
--- a/doc/gnupg.info-2
+++ b/doc/gnupg.info-2
@@ -1,7 +1,7 @@
 This is gnupg.info, produced by makeinfo version 6.5 from gnupg.texi.
 
-This is the 'The GNU Privacy Guard Manual' (version 2.2.30-beta2, August
-2021).
+This is the 'The GNU Privacy Guard Manual' (version 2.2.31-beta7,
+September 2021).
 
    (C) 2002, 2004, 2005, 2006, 2007, 2010 Free Software Foundation, Inc.
 (C) 2013, 2014, 2015 Werner Koch.
@@ -22,6 +22,68 @@ START-INFO-DIR-ENTRY
 END-INFO-DIR-ENTRY
 
 
+File: gnupg.info,  Node: GPGSM ENCRYPT,  Next: GPGSM DECRYPT,  Up: GPGSM Protocol
+
+5.6.1 Encrypting a Message
+--------------------------
+
+Before encryption can be done the recipient must be set using the
+command:
+
+       RECIPIENT USERID
+
+   Set the recipient for the encryption.  USERID should be the internal
+representation of the key; the server may accept any other way of
+specification.  If this is a valid and trusted recipient the server does
+respond with OK, otherwise the return is an ERR with the reason why the
+recipient cannot be used, the encryption will then not be done for this
+recipient.  If the policy is not to encrypt at all if not all recipients
+are valid, the client has to take care of this.  All 'RECIPIENT'
+commands are cumulative until a 'RESET' or an successful 'ENCRYPT'
+command.
+
+       INPUT FD[=N] [--armor|--base64|--binary]
+
+   Set the file descriptor for the message to be encrypted to N.
+Obviously the pipe must be open at that point, the server establishes
+its own end.  If the server returns an error the client should consider
+this session failed.  If N is not given, this commands uses the last
+file descriptor passed to the application.  *Note the assuan_sendfd
+function: (assuan)fun-assuan_sendfd, on how to do descriptor passing.
+
+   The '--armor' option may be used to advise the server that the input
+data is in PEM format, '--base64' advises that a raw base-64 encoding is
+used, '--binary' advises of raw binary input (BER).  If none of these
+options is used, the server tries to figure out the used encoding, but
+this may not always be correct.
+
+       OUTPUT FD[=N] [--armor|--base64]
+
+   Set the file descriptor to be used for the output (i.e.  the
+encrypted message).  Obviously the pipe must be open at that point, the
+server establishes its own end.  If the server returns an error the
+client should consider this session failed.
+
+   The option '--armor' encodes the output in PEM format, the '--base64'
+option applies just a base-64 encoding.  No option creates binary output
+(BER).
+
+   The actual encryption is done using the command
+
+       ENCRYPT
+
+   It takes the plaintext from the 'INPUT' command, writes to the
+ciphertext to the file descriptor set with the 'OUTPUT' command, take
+the recipients from all the recipients set so far.  If this command
+fails the clients should try to delete all output currently done or
+otherwise mark it as invalid.  'GPGSM' does ensure that there will not
+be any security problem with leftover data on the output in this case.
+
+   This command should in general not fail, as all necessary checks have
+been done while setting the recipients.  The input and output pipes are
+closed.
+
+
 File: gnupg.info,  Node: GPGSM DECRYPT,  Next: GPGSM SIGN,  Prev: GPGSM ENCRYPT,  Up: GPGSM Protocol
 
 5.6.2 Decrypting a message
@@ -441,7 +503,7 @@ File: gnupg.info,  Node: Scdaemon Options,  Next: Card applications,  Prev: Scda
      directory; or, if 'gpgconf.exe' has been installed directly below a
      directory named 'bin', its parent directory.  You also need to make
      sure that the following directories exist and are writable:
-     'ROOT/home' for the GnuPG home and 'ROOT/usr/local/var/cache/gnupg'
+     'ROOT/home' for the GnuPG home and 'ROOTAPPDATA/GNU/cache/gnupg'
      for internal cache files.
 
 '-v'
@@ -776,8 +838,8 @@ much sense except for system services, but in this case no regular user
 accounts are hosted on the machine.
 
    A client connects to the SC-Daemon by connecting to the socket named
-'/usr/local/var/run/gnupg/scdaemon/socket', configuration information is
-read from /ETC/GNUPG/SCDAEMON.CONF
+'APPDATA/GNU/run/gnupg/scdaemon/socket', configuration information is
+read from APPDATA/GNU/ETC/GNUPG/SCDAEMON.CONF
 
    Each connection acts as one session, SC-Daemon takes care of
 synchronizing access to a token between sessions.
@@ -1393,7 +1455,7 @@ specified keyrings will be used together.
      directory; or, if 'gpgconf.exe' has been installed directly below a
      directory named 'bin', its parent directory.  You also need to make
      sure that the following directories exist and are writable:
-     'ROOT/home' for the GnuPG home and 'ROOT/usr/local/var/cache/gnupg'
+     'ROOT/home' for the GnuPG home and 'ROOTAPPDATA/GNU/cache/gnupg'
      for internal cache files.
 
 '--weak-digest name'
@@ -1643,7 +1705,7 @@ One of the following commands must be given:
      directory; or, if 'gpgconf.exe' has been installed directly below a
      directory named 'bin', its parent directory.  You also need to make
      sure that the following directories exist and are writable:
-     'ROOT/home' for the GnuPG home and 'ROOT/usr/local/var/cache/gnupg'
+     'ROOT/home' for the GnuPG home and 'ROOTAPPDATA/GNU/cache/gnupg'
      for internal cache files.
 
 '-n'
@@ -2431,7 +2493,7 @@ The following options may be used:
      directory; or, if 'gpgconf.exe' has been installed directly below a
      directory named 'bin', its parent directory.  You also need to make
      sure that the following directories exist and are writable:
-     'ROOT/home' for the GnuPG home and 'ROOT/usr/local/var/cache/gnupg'
+     'ROOT/home' for the GnuPG home and 'ROOTAPPDATA/GNU/cache/gnupg'
      for internal cache files.
 
 '--agent-program FILE'
@@ -3720,7 +3782,7 @@ File: gnupg.info,  Node: Common Problems,  Next: Architecture Details,  Prev: De
      Pick the key which best matches the creation time and run the
      command
 
-            /usr/local/libexec/gpg-protect-tool --p12-export \
+            INSTDIR/bin/gpg-protect-tool --p12-export \
                ~/.gnupg/private-keys-v1.d/FOO >FOO.p12
 
      (Please adjust the path to 'gpg-protect-tool' to the appropriate
@@ -3731,7 +3793,7 @@ File: gnupg.info,  Node: Common Problems,  Next: Architecture Details,  Prev: De
 
      To import the created file on the machine you use this command:
 
-            /usr/local/libexec/gpg-protect-tool --p12-import --store  FOO.p12
+            INSTDIR/bin/gpg-protect-tool --p12-import --store  FOO.p12
 
      You will be asked for the pkcs#12 passphrase and a new passphrase
      to protect the imported private key at its new location.
@@ -4721,13 +4783,13 @@ Option Index
                                                               (line 367)
 * allow-loopback-pinentry:               Agent Options.       (line 169)
 * allow-multiple-messages:               GPG Esoteric Options.
-                                                              (line 548)
+                                                              (line 547)
 * allow-non-selfsigned-uid:              GPG Esoteric Options.
                                                               (line 362)
 * allow-ocsp:                            Dirmngr Options.     (line 327)
 * allow-preset-passphrase:               Agent Options.       (line 164)
 * allow-secret-key-import:               GPG Esoteric Options.
-                                                              (line 544)
+                                                              (line 543)
 * allow-version-check:                   Dirmngr Options.     (line 138)
 * allow-weak-digest-algos:               GPG Esoteric Options.
                                                               (line 403)
@@ -4738,11 +4800,11 @@ Option Index
                                                               (line   8)
 * armor <1>:                             Input and Output.    (line   8)
 * ask-cert-expire:                       GPG Esoteric Options.
-                                                              (line 514)
+                                                              (line 513)
 * ask-cert-level:                        GPG Configuration Options.
                                                               (line 360)
 * ask-sig-expire:                        GPG Esoteric Options.
-                                                              (line 500)
+                                                              (line 499)
 * assume-armor:                          Input and Output.    (line  14)
 * assume-base64:                         Input and Output.    (line  18)
 * assume-binary:                         Input and Output.    (line  21)
@@ -4878,24 +4940,24 @@ Option Index
 * default-cache-ttl:                     Agent Options.       (line 198)
 * default-cache-ttl <1>:                 Agent Options.       (line 207)
 * default-cert-expire:                   GPG Esoteric Options.
-                                                              (line 520)
+                                                              (line 519)
 * default-cert-level:                    GPG Configuration Options.
                                                               (line 368)
 * default-key:                           GPG Configuration Options.
                                                               (line  10)
 * default-key <1>:                       Input and Output.    (line  34)
 * default-keyserver-url:                 GPG Esoteric Options.
-                                                              (line 577)
+                                                              (line 576)
 * default-new-key-algo STRING:           GPG Esoteric Options.
-                                                              (line 527)
+                                                              (line 526)
 * default-preference-list:               GPG Esoteric Options.
-                                                              (line 572)
+                                                              (line 571)
 * default-recipient:                     GPG Configuration Options.
                                                               (line  19)
 * default-recipient-self:                GPG Configuration Options.
                                                               (line  23)
 * default-sig-expire:                    GPG Esoteric Options.
-                                                              (line 506)
+                                                              (line 505)
 * delete-keys:                           Operational GPG Commands.
                                                               (line 224)
 * delete-keys <1>:                       Certificate Management.
@@ -5001,7 +5063,7 @@ Option Index
                                                               (line  69)
 * enable-putty-support:                  Agent Options.       (line 383)
 * enable-special-filenames:              GPG Esoteric Options.
-                                                              (line 559)
+                                                              (line 558)
 * enable-special-filenames <1>:          gpgv.                (line  97)
 * enable-ssh-support:                    Agent Options.       (line 383)
 * enable-trusted-cert-crl-check:         Certificate Options. (line  24)
@@ -5057,7 +5119,7 @@ Option Index
                                                               (line  60)
 * faked-system-time <2>:                 Esoteric Options.    (line  18)
 * fast-list-mode:                        GPG Esoteric Options.
-                                                              (line 455)
+                                                              (line 454)
 * fetch-crl:                             Dirmngr Commands.    (line  52)
 * fetch-keys:                            Operational GPG Commands.
                                                               (line 333)
@@ -5074,7 +5136,7 @@ Option Index
 * force-default-responder:               dirmngr-client.      (line  64)
 * force-mdc:                             OpenPGP Options.     (line  25)
 * force-sign-key:                        GPG Esoteric Options.
-                                                              (line 538)
+                                                              (line 537)
 * forget:                                Invoking gpg-preset-passphrase.
                                                               (line  26)
 * from:                                  gpg-wks-server.      (line  54)
@@ -5106,9 +5168,9 @@ Option Index
                                                               (line 750)
 * gpg-args:                              gpgtar.              (line 113)
 * gpgconf-list:                          GPG Esoteric Options.
-                                                              (line 593)
+                                                              (line 592)
 * gpgconf-test:                          GPG Esoteric Options.
-                                                              (line 597)
+                                                              (line 596)
 * grab:                                  Agent Options.       (line 145)
 * group:                                 GPG Key related Options.
                                                               (line  55)
@@ -5294,10 +5356,10 @@ Option Index
 * list-chain:                            Certificate Management.
                                                               (line  32)
 * list-config:                           GPG Esoteric Options.
-                                                              (line 582)
+                                                              (line 581)
 * list-crls:                             Dirmngr Commands.    (line  40)
 * list-gcrypt-config:                    GPG Esoteric Options.
-                                                              (line 590)
+                                                              (line 589)
 * list-keys:                             Operational GPG Commands.
                                                               (line 119)
 * list-keys <1>:                         Certificate Management.
@@ -5343,9 +5405,9 @@ Option Index
 * list-secret-keys <1>:                  Certificate Management.
                                                               (line  24)
 * list-signatures:                       GPG Esoteric Options.
-                                                              (line 443)
+                                                              (line 442)
 * list-sigs:                             GPG Esoteric Options.
-                                                              (line 444)
+                                                              (line 443)
 * listen-backlog:                        Agent Options.       (line 351)
 * listen-backlog <1>:                    Dirmngr Options.     (line 134)
 * listen-backlog <2>:                    Scdaemon Options.    (line 135)
@@ -5428,7 +5490,7 @@ Option Index
 * no-encrypt-to:                         GPG Key related Options.
                                                               (line  51)
 * no-expensive-trust-checks:             GPG Esoteric Options.
-                                                              (line 564)
+                                                              (line 563)
 * no-ext-connect:                        Invoking gpg-connect-agent.
                                                               (line  72)
 * no-grab:                               Agent Options.       (line 145)
@@ -5437,9 +5499,9 @@ Option Index
 * no-groups:                             GPG Key related Options.
                                                               (line  73)
 * no-keyring:                            GPG Esoteric Options.
-                                                              (line 431)
+                                                              (line 430)
 * no-literal:                            GPG Esoteric Options.
-                                                              (line 463)
+                                                              (line 462)
 * no-mangle-dos-filenames:               GPG Configuration Options.
                                                               (line 352)
 * no-options:                            GPG Configuration Options.
@@ -5491,7 +5553,7 @@ Option Index
 * output <4>:                            gpg-wks-client.      (line 104)
 * output <5>:                            gpg-wks-server.      (line  65)
 * override-session-key:                  GPG Esoteric Options.
-                                                              (line 487)
+                                                              (line 486)
 * p12-charset:                           Input and Output.    (line  24)
 * passphrase:                            GPG Esoteric Options.
                                                               (line 312)
@@ -5535,11 +5597,11 @@ Option Index
 * prefer-system-dirmngr:                 Configuration Options.
                                                               (line  65)
 * preserve-permissions:                  GPG Esoteric Options.
-                                                              (line 567)
+                                                              (line 566)
 * preset:                                Invoking gpg-preset-passphrase.
                                                               (line  22)
 * primary-keyring:                       GPG Configuration Options.
-                                                              (line 248)
+                                                              (line 243)
 * print-md:                              Operational GPG Commands.
                                                               (line 386)
 * q:                                     Invoking gpg-connect-agent.
@@ -5619,7 +5681,7 @@ Option Index
 * search-keys:                           Operational GPG Commands.
                                                               (line 323)
 * secret-keyring:                        GPG Configuration Options.
-                                                              (line 243)
+                                                              (line 248)
 * send:                                  gpg-wks-client.      (line  65)
 * send <1>:                              gpg-wks-server.      (line  60)
 * send-keys:                             Operational GPG Commands.
@@ -5635,7 +5697,7 @@ Option Index
                                                               (line 178)
 * set-filename <1>:                      gpgtar.              (line 104)
 * set-filesize:                          GPG Esoteric Options.
-                                                              (line 467)
+                                                              (line 466)
 * set-notation:                          GPG Esoteric Options.
                                                               (line 124)
 * set-policy-url:                        GPG Esoteric Options.
@@ -5649,7 +5711,7 @@ Option Index
 * show-photos:                           Deprecated Options.  (line   8)
 * show-policy-url:                       Deprecated Options.  (line  33)
 * show-session-key:                      GPG Esoteric Options.
-                                                              (line 471)
+                                                              (line 470)
 * shutdown:                              Dirmngr Commands.    (line  58)
 * sig-keyserver-url:                     GPG Esoteric Options.
                                                               (line 170)
@@ -5667,7 +5729,7 @@ Option Index
 * skip-hidden-recipients:                GPG Key related Options.
                                                               (line 108)
 * skip-verify:                           GPG Esoteric Options.
-                                                              (line 435)
+                                                              (line 434)
 * squid-mode:                            dirmngr-client.      (line 101)
 * ssh-fingerprint-digest:                Agent Options.       (line 431)
 * standard-resolver:                     Dirmngr Options.     (line 110)
@@ -5823,7 +5885,7 @@ Option Index
 * with-icao-spelling:                    GPG Input and Output.
                                                               (line 307)
 * with-key-data:                         GPG Esoteric Options.
-                                                              (line 439)
+                                                              (line 438)
 * with-key-data <1>:                     Input and Output.    (line  54)
 * with-key-origin:                       GPG Input and Output.
                                                               (line 315)
@@ -5850,18 +5912,18 @@ Environment Variable and File Index
 
 * Menu:
 
-* .gpg-v21-migrated:                     GPG Configuration.   (line  77)
-* ~/.gnupg:                              GPG Configuration.   (line  27)
+* .gpg-v21-migrated:                     GPG Configuration.   (line  78)
+* ~/.gnupg:                              GPG Configuration.   (line  28)
 * ASSUAN_DEBUG:                          Scdaemon Options.    (line 122)
-* COLUMNS:                               GPG Configuration.   (line 118)
-* com-certs.pem:                         GPGSM Configuration. (line  84)
+* COLUMNS:                               GPG Configuration.   (line 119)
+* com-certs.pem:                         GPGSM Configuration. (line  85)
 * dirmngr.conf:                          Dirmngr Configuration.
                                                               (line  12)
 * DISPLAY:                               GPGSM OPTION.        (line  21)
 * GNUPGHOME:                             Agent Options.       (line  17)
 * GNUPGHOME <1>:                         GPG Configuration Options.
                                                               (line 260)
-* GNUPGHOME <2>:                         GPG Configuration.   (line 106)
+* GNUPGHOME <2>:                         GPG Configuration.   (line 107)
 * GNUPGHOME <3>:                         Configuration Options.
                                                               (line  16)
 * GNUPGHOME <4>:                         Scdaemon Options.    (line  13)
@@ -5896,31 +5958,31 @@ Environment Variable and File Index
 * HKCU\Software\GNU\GnuPG:HomeDir <5>:   Invoking gpgconf.    (line 115)
 * HKCU\Software\GNU\GnuPG:HomeDir <6>:   Invoking gpg-connect-agent.
                                                               (line  21)
-* HOME:                                  GPG Configuration.   (line 103)
+* HOME:                                  GPG Configuration.   (line 104)
 * http_proxy:                            Dirmngr Options.     (line 240)
-* LANGUAGE:                              GPG Configuration.   (line 121)
+* LANGUAGE:                              GPG Configuration.   (line 122)
 * LC_CTYPE:                              GPGSM OPTION.        (line  27)
 * LC_MESSAGES:                           GPGSM OPTION.        (line  29)
-* LINES:                                 GPG Configuration.   (line 118)
-* openpgp-revocs.d:                      GPG Configuration.   (line  91)
+* LINES:                                 GPG Configuration.   (line 119)
+* openpgp-revocs.d:                      GPG Configuration.   (line  92)
 * PATH:                                  GPG Configuration Options.
                                                               (line 225)
-* PINENTRY_USER_DATA:                    GPG Configuration.   (line 113)
+* PINENTRY_USER_DATA:                    GPG Configuration.   (line 114)
 * PINENTRY_USER_DATA <1>:                GPGSM OPTION.        (line  33)
 * policies.txt:                          GPGSM Configuration. (line  18)
-* private-keys-v1.d:                     Agent Configuration. (line 104)
-* pubring.gpg:                           GPG Configuration.   (line  32)
-* pubring.kbx:                           GPG Configuration.   (line  50)
-* pubring.kbx <1>:                       GPGSM Configuration. (line 100)
+* private-keys-v1.d:                     Agent Configuration. (line 105)
+* pubring.gpg:                           GPG Configuration.   (line  33)
+* pubring.kbx:                           GPG Configuration.   (line  51)
+* pubring.kbx <1>:                       GPGSM Configuration. (line 101)
 * qualified.txt:                         GPGSM Configuration. (line  33)
-* random_seed:                           GPG Configuration.   (line  88)
-* random_seed <1>:                       GPGSM Configuration. (line 106)
-* S.gpg-agent:                           GPGSM Configuration. (line 111)
-* secring.gpg:                           GPG Configuration.   (line  69)
+* random_seed:                           GPG Configuration.   (line  89)
+* random_seed <1>:                       GPGSM Configuration. (line 107)
+* S.gpg-agent:                           GPGSM Configuration. (line 112)
+* secring.gpg:                           GPG Configuration.   (line  70)
 * SHELL:                                 Agent Options.       (line 138)
-* sshcontrol:                            Agent Configuration. (line  74)
+* sshcontrol:                            Agent Configuration. (line  75)
 * TERM:                                  GPGSM OPTION.        (line  25)
-* trustdb.gpg:                           GPG Configuration.   (line  80)
+* trustdb.gpg:                           GPG Configuration.   (line  81)
 * trustlist.txt:                         Agent Configuration. (line  20)
 * XAUTHORITY:                            GPGSM OPTION.        (line  31)
 
@@ -5950,7 +6012,7 @@ Index
 * options, GPG-AGENT command:            Invoking GPG-AGENT.   (line  6)
 * options, GPGSM command:                Invoking GPGSM.       (line  6)
 * options, SCDAEMON command:             Invoking SCDAEMON.    (line  6)
-* relax:                                 Agent Configuration.  (line 62)
+* relax:                                 Agent Configuration.  (line 63)
 * scd-event:                             Scdaemon Configuration.
                                                                (line 18)
 * SCDAEMON command options:              Invoking SCDAEMON.    (line  6)
diff --git a/doc/gpg.texi b/doc/gpg.texi
index 16b6ec7..475de18 100644
--- a/doc/gpg.texi
+++ b/doc/gpg.texi
@@ -444,7 +444,7 @@ request a confirmation.
 
 @item --export
 @opindex export
-Either export all keys from all keyrings (default keyrings and those
+Either export all keys from all keyrings (default keyring and those
 registered via option @option{--keyring}), or if at least one name is given,
 those of the given name. The exported keys are written to STDOUT or to the
 file given with option @option{--output}.  Use together with
@@ -1075,12 +1075,12 @@ signing.
 
   @item save
   @opindex keyedit:save
-  Save all changes to the keyrings and quit.
+  Save all changes to the keyring and quit.
 
   @item quit
   @opindex keyedit:quit
   Quit the program without updating the
-  keyrings.
+  keyring.
 @end table
 
 @c man:.RS
@@ -1497,7 +1497,7 @@ photo viewers use the @code{PATH} environment variable.
 Add @var{file} to the current list of keyrings. If @var{file} begins
 with a tilde and a slash, these are replaced by the $HOME directory. If
 the filename does not contain a slash, it is assumed to be in the GnuPG
-home directory ("~/.gnupg" if @option{--homedir} or $GNUPGHOME is not
+home directory ("~/.gnupg" unless @option{--homedir} or $GNUPGHOME is
 used).
 
 Note that this adds a keyring to the current list. If the intent is to
@@ -1507,18 +1507,19 @@ use the specified keyring alone, use @option{--keyring} along with
 If the option @option{--no-keyring} has been used no keyrings will
 be used at all.
 
+@item --primary-keyring @var{file}
+@opindex primary-keyring
+This is a varian of @option{--keyring} and designates @var{file} as
+the primary public keyring. This means that newly imported keys (via
+@option{--import} or keyserver @option{--recv-from}) will go to this
+keyring.
+
 
 @item --secret-keyring @var{file}
 @opindex secret-keyring
 This is an obsolete option and ignored.  All secret keys are stored in
 the @file{private-keys-v1.d} directory below the GnuPG home directory.
 
-@item --primary-keyring @var{file}
-@opindex primary-keyring
-Designate @var{file} as the primary public keyring. This means that
-newly imported keys (via @option{--import} or keyserver
-@option{--recv-from}) will go to this keyring.
-
 @item --trustdb-name @var{file}
 @opindex trustdb-name
 Use @var{file} instead of the default trustdb. If @var{file} begins
@@ -3362,11 +3363,10 @@ invalid.  This options allows to override this restriction.
 
 @item --no-default-keyring
 @opindex no-default-keyring
-Do not add the default keyrings to the list of keyrings. Note that
-GnuPG will not operate without any keyrings, so if you use this option
-and do not provide alternate keyrings via @option{--keyring} or
-@option{--secret-keyring}, then GnuPG will still use the default public or
-secret keyrings.
+Do not add the default keyring to the list of keyrings. Note that
+GnuPG needs for almost all operations a keyring. Thus if you use this
+option and do not provide alternate keyrings via @option{--keyring},
+then GnuPG will still use the default keyring.
 
 @item --no-keyring
 @opindex no-keyring
diff --git a/g10/distsigkey.gpg b/g10/distsigkey.gpg
index 47d767c..bd661d0 100644
--- a/g10/distsigkey.gpg
+++ b/g10/distsigkey.gpg
diff --git a/g10/gpg.c b/g10/gpg.c
index 632a8a5..a30ef01 100644
--- a/g10/gpg.c
+++ b/g10/gpg.c
@@ -2765,7 +2765,7 @@ main (int argc, char **argv)
             break;
 
 	  case oSecretKeyring:
-            /* Ignore this old option.  */
+	    obsolete_option (configname, pargs.lineno, "secret-keyring");
             break;
 
 	  case oNoArmor: opt.no_armor=1; opt.armor=0; break;
diff --git a/po/ca.po b/po/ca.po
index d088368..5e92b6e 100644
--- a/po/ca.po
+++ b/po/ca.po
@@ -27,7 +27,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 1.4.0\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2005-02-04 02:04+0100\n"
 "Last-Translator: Jordi Mallach <jordi@gnu.org>\n"
 "Language-Team: Catalan <ca@dodds.net>\n"
diff --git a/po/cs.po b/po/cs.po
index dcfb548..e779a4f 100644
--- a/po/cs.po
+++ b/po/cs.po
@@ -38,7 +38,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg2 2.2.22\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2020-08-31 18:53+02:00\n"
 "Last-Translator: Petr Pisar <petr.pisar@atlas.cz>\n"
 "Language-Team: Czech <gnupg-i18n@gnupg.org>\n"
diff --git a/po/da.po b/po/da.po
index ba83c99..8318be5 100644
--- a/po/da.po
+++ b/po/da.po
@@ -14,7 +14,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2017-11-02 17:39+0100\n"
 "Last-Translator: Joe Hansen <joedalton2@yahoo.dk>\n"
 "Language-Team: Danish <debian-l10n-danish@lists.debian.org>\n"
diff --git a/po/de.gmo b/po/de.gmo
index eb634af..b96b774 100644
--- a/po/de.gmo
+++ b/po/de.gmo
diff --git a/po/de.po b/po/de.po
index 98df96e..daca83f 100644
--- a/po/de.po
+++ b/po/de.po
@@ -9,8 +9,8 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg-2.1.0\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
-"PO-Revision-Date: 2021-08-26 18:07+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
+"PO-Revision-Date: 2021-09-15 16:04+0200\n"
 "Last-Translator: Werner Koch <wk@gnupg.org>\n"
 "Language-Team: German <de@li.org>\n"
 "Language: de\n"
@@ -396,22 +396,20 @@ msgid "A passphrase should contain at least %u digit or%%0Aspecial character."
 msgid_plural ""
 "A passphrase should contain at least %u digits or%%0Aspecial characters."
 msgstr[0] ""
-"Ein Passwort sollte mindestens %u Sonderzeichen oder%%0Aeine Ziffer "
-"enthalten."
+"Ein Passwort sollte mindestens %u Sonderzeichen oder eine Ziffer enthalten."
 msgstr[1] ""
-"Ein Passwort sollte mindestens %u Sonderzeichen oder%%0AZiffern enthalten."
+"Ein Passwort sollte mindestens %u Sonderzeichen oder Ziffern enthalten."
 
 #: agent/genkey.c:323
 #, c-format
 msgid "A passphrase may not be a known term or match%%0Acertain pattern."
 msgstr ""
-"Ein Passwort sollte kein bekanntes Wort sein oder%%0Anach bekannten Regeln "
+"Ein Passwort sollte kein bekanntes Wort sein oder nach bekannten Regeln "
 "aufgebaut sein."
 
 #: agent/genkey.c:338
 msgid "Warning: You have entered an insecure passphrase."
-msgstr ""
-"WARNUNG:  Sie haben ein offensichtlich unsicheres%0APasswort eingegeben."
+msgstr "WARNUNG: Sie haben ein offensichtlich unsicheres Passwort eingegeben."
 
 #: agent/genkey.c:527
 #, c-format
@@ -871,7 +869,7 @@ msgstr "Falsch"
 #, c-format
 msgid "Note: This passphrase has never been changed.%0APlease change it now."
 msgstr ""
-"Hinweis: Dieses Passwort wurde noch nie geändert/%0ABitte ändern Sie sie "
+"Hinweis: Dieses Passwort wurde noch nie geändert.%0ABitte ändern Sie es "
 "jetzt."
 
 #: agent/findkey.c:317
diff --git a/po/el.po b/po/el.po
index 5f9d977..582114d 100644
--- a/po/el.po
+++ b/po/el.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg-1.1.92\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2017-09-14 21:14+0300\n"
 "Last-Translator: Dimitris Maroulidis <dmaroulidis@dimitrismaroulidis.com>\n"
 "Language-Team: team@gnome.gr\n"
diff --git a/po/en@boldquot.gmo b/po/en@boldquot.gmo
index 1dfa6f4..45c9eeb 100644
--- a/po/en@boldquot.gmo
+++ b/po/en@boldquot.gmo
diff --git a/po/en@boldquot.po b/po/en@boldquot.po
index 69dacba..eceedb2 100644
--- a/po/en@boldquot.po
+++ b/po/en@boldquot.po
@@ -30,10 +30,10 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: GNU gnupg 2.2.30\n"
+"Project-Id-Version: GNU gnupg 2.2.31\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
-"PO-Revision-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
+"PO-Revision-Date: 2021-09-15 16:55+0200\n"
 "Last-Translator: Automatically generated\n"
 "Language-Team: none\n"
 "Language: en\n"
diff --git a/po/en@quot.gmo b/po/en@quot.gmo
index 643cdfc..6234f20 100644
--- a/po/en@quot.gmo
+++ b/po/en@quot.gmo
diff --git a/po/en@quot.po b/po/en@quot.po
index 374a409..844e92d 100644
--- a/po/en@quot.po
+++ b/po/en@quot.po
@@ -27,10 +27,10 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: GNU gnupg 2.2.30\n"
+"Project-Id-Version: GNU gnupg 2.2.31\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
-"PO-Revision-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
+"PO-Revision-Date: 2021-09-15 16:55+0200\n"
 "Last-Translator: Automatically generated\n"
 "Language-Team: none\n"
 "Language: en\n"
diff --git a/po/eo.po b/po/eo.po
index d21c9f7..1b0127a 100644
--- a/po/eo.po
+++ b/po/eo.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 1.0.6d\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2002-04-14 14:33+0100\n"
 "Last-Translator: Edmund GRIMLEY EVANS <edmundo@rano.org>\n"
 "Language-Team: Esperanto <translation-team-eo@lists.sourceforge.net>\n"
diff --git a/po/es.po b/po/es.po
index d471656..9ff14f9 100644
--- a/po/es.po
+++ b/po/es.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 2.0.9\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2018-05-25 15:44+0000\n"
 "Last-Translator: emma peel <emma.peel@riseup.net>\n"
 "Language-Team: Spanish <es@li.org>\n"
diff --git a/po/et.po b/po/et.po
index 336a30e..3f87506 100644
--- a/po/et.po
+++ b/po/et.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 1.2.2\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2004-06-17 11:04+0300\n"
 "Last-Translator: Toomas Soome <Toomas.Soome@microlink.ee>\n"
 "Language-Team: Estonian <et@li.org>\n"
diff --git a/po/fi.po b/po/fi.po
index d05b1f9..5a3d4ca 100644
--- a/po/fi.po
+++ b/po/fi.po
@@ -22,7 +22,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 1.2.2\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2004-06-16 22:40+0300\n"
 "Last-Translator: Tommi Vainikainen <Tommi.Vainikainen@iki.fi>\n"
 "Language-Team: Finnish <translation-team-fi@lists.sourceforge.net>\n"
diff --git a/po/fr.po b/po/fr.po
index bb220d1..30b7b0c 100644
--- a/po/fr.po
+++ b/po/fr.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 2.1\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2021-05-19 00:01+0200\n"
 "Last-Translator: David Prévot <david@tilapin.org>\n"
 "Language-Team: French <traduc@traduc.org>\n"
diff --git a/po/gl.po b/po/gl.po
index 61365e3..e0c2a58 100644
--- a/po/gl.po
+++ b/po/gl.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 1.2.4\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2003-12-04 11:39+0100\n"
 "Last-Translator: Jacobo Tarrio <jtarrio@trasno.net>\n"
 "Language-Team: Galician <gpul-traduccion@ceu.fi.udc.es>\n"
diff --git a/po/gnupg2.pot b/po/gnupg2.pot
index 49e7e26..2a4380f 100644
--- a/po/gnupg2.pot
+++ b/po/gnupg2.pot
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: GNU gnupg 2.2.30\n"
+"Project-Id-Version: GNU gnupg 2.2.31\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
diff --git a/po/hu.po b/po/hu.po
index 58e951a..9899c76 100644
--- a/po/hu.po
+++ b/po/hu.po
@@ -6,7 +6,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 2.2.20\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2020-06-09 23:10+0200\n"
 "Last-Translator: Nagy Ferenc László <nfl@nfllab.com>\n"
 "Language-Team: Hungarian <translation-team-hu@lists.sourceforge.net>\n"
diff --git a/po/id.po b/po/id.po
index 9901c52..7729fea 100644
--- a/po/id.po
+++ b/po/id.po
@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg-id\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2004-06-17 16:32+0700\n"
 "Last-Translator: Tedi Heriyanto <tedi_h@gmx.net>\n"
 "Language-Team: Indonesian <translation-team-id@lists.sourceforge.net>\n"
diff --git a/po/it.po b/po/it.po
index 9c23f89..d40adb9 100644
--- a/po/it.po
+++ b/po/it.po
@@ -5,7 +5,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GNU gnupg 2.2.23\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2021-05-19 00:03+0200\n"
 "Last-Translator: Denis <student@alice.it>\n"
 "Language-Team: \n"
diff --git a/po/ja.gmo b/po/ja.gmo
index 4243d01..7a0e070 100644
--- a/po/ja.gmo
+++ b/po/ja.gmo
diff --git a/po/ja.po b/po/ja.po
index 06c7428..8cec6a1 100644
--- a/po/ja.po
+++ b/po/ja.po
@@ -9,10 +9,10 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: gnupg 2.2.28\n"
+"Project-Id-Version: gnupg 2.2.30\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
-"PO-Revision-Date: 2021-06-09 09:28+0900\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
+"PO-Revision-Date: 2021-08-27 08:56+0900\n"
 "Last-Translator: NIIBE Yutaka <gniibe@fsij.org>\n"
 "Language-Team: none\n"
 "Language: ja\n"
@@ -72,7 +72,7 @@ msgstr "|pinentry-tt|パスフレーズを隠す"
 #. for generating a passphrase.
 #: agent/call-pinentry.c:1007
 msgid "Suggest"
-msgstr ""
+msgstr "提示"
 
 #. TRANSLATORS: This string is a tooltip, shown by pinentry when
 #. hovering over the generate button.  Please use an appropriate
@@ -82,23 +82,19 @@ msgstr ""
 #. will be used.  The strcmp thingy is there to detect a
 #. non-translated string.
 #: agent/call-pinentry.c:1029
-#, fuzzy
-#| msgid "pinentry.qualitybar.tooltip"
 msgid "pinentry.genpin.tooltip"
-msgstr "pinentry.qualitybar.tooltip"
+msgstr "パスフレーズを生成して提示"
 
 #: agent/call-pinentry.c:1057
 msgid "Note: The blanks are not part of the passphrase."
-msgstr ""
+msgstr "注意: ブランクはパスフレーズの一部ではありません。"
 
 #. TRANSLATORS: This is a text shown by pinentry as title of a dialog
 #. telling the user that the entered new passphrase does not satisfy
 #. the passphrase constraints.  Please keep it short.
 #: agent/call-pinentry.c:1116
-#, fuzzy
-#| msgid "Passphrase too long"
 msgid "Passphrase Not Allowed"
-msgstr "パスフレーズが長すぎます"
+msgstr "パスフレーズが認められません"
 
 #. TRANSLATORS: This string is displayed by Pinentry as the label
 #. for the quality bar.
@@ -114,7 +110,7 @@ msgstr "品質:"
 #. will be used.
 #: agent/call-pinentry.c:1204
 msgid "pinentry.qualitybar.tooltip"
-msgstr "pinentry.qualitybar.tooltip"
+msgstr "パスフレーズの品質"
 
 #: agent/call-pinentry.c:1367
 msgid ""
diff --git a/po/nb.po b/po/nb.po
index 615a9bb..6e2f36f 100644
--- a/po/nb.po
+++ b/po/nb.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GNU gnupg 2.1\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2017-11-02 17:40+0100\n"
 "Last-Translator: Åka Sikrom <a4@hush.com>\n"
 "Language-Team: Norwegian Bokmål <i18n-nb@lister.ping.uio.no>\n"
diff --git a/po/pl.po b/po/pl.po
index c443c70..febdfdc 100644
--- a/po/pl.po
+++ b/po/pl.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg-2.2.24\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2020-11-18 17:35+0100\n"
 "Last-Translator: Jakub Bogusz <qboosh@pld-linux.org>\n"
 "Language-Team: Polish <translation-team-pl@lists.sourceforge.net>\n"
diff --git a/po/pt.po b/po/pt.po
index 819989a..16f063c 100644
--- a/po/pt.po
+++ b/po/pt.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2015-02-11 19:17+0100\n"
 "Last-Translator: Pedro Morais <morais@kde.org>\n"
 "Language-Team: pt <morais@kde.org>\n"
diff --git a/po/ro.po b/po/ro.po
index 248d34d..e318a58 100644
--- a/po/ro.po
+++ b/po/ro.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 1.4.2rc1\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2017-12-19 12:30+0100\n"
 "Last-Translator: Laurentiu Buzdugan <lbuz@rolix.org>\n"
 "Language-Team: Romanian <translation-team-ro@lists.sourceforge.net>\n"
diff --git a/po/ru.po b/po/ru.po
index 23edb53..fb6e3a3 100644
--- a/po/ru.po
+++ b/po/ru.po
@@ -13,7 +13,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GnuPG 2.2.0\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2021-05-20 08:13+0200\n"
 "Last-Translator: Ineiev <ineiev@gnu.org>\n"
 "Language-Team: Russian <gnupg-ru@gnupg.org>\n"
diff --git a/po/sk.po b/po/sk.po
index da02218..48457e1 100644
--- a/po/sk.po
+++ b/po/sk.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 1.2.5\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2004-07-20 15:52+0200\n"
 "Last-Translator: Michal Majer <mmajer@econ.umb.sk>\n"
 "Language-Team: Slovak <sk-i18n@lists.linux.sk>\n"
diff --git a/po/sv.po b/po/sv.po
index 8d02f7d..9cf1980 100644
--- a/po/sv.po
+++ b/po/sv.po
@@ -24,7 +24,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg trunk\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2017-11-02 17:41+0100\n"
 "Last-Translator: Daniel Nylander <po@danielnylander.se>\n"
 "Language-Team: Swedish <tp-sv@listor.tp-sv.se>\n"
diff --git a/po/tr.po b/po/tr.po
index b20d3f2..1face3a 100644
--- a/po/tr.po
+++ b/po/tr.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: gnupg 2.0.10rc1\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2015-02-11 19:18+0100\n"
 "Last-Translator: Nilgün Belma Bugüner <nilgun@belgeler.gen.tr>\n"
 "Language-Team: Turkish\n"
diff --git a/po/uk.po b/po/uk.po
index ccaff02..07cb693 100644
--- a/po/uk.po
+++ b/po/uk.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GNU gnupg 2.1.0\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2020-08-31 11:54+0300\n"
 "Last-Translator: Yuri Chornoivan <yurchor@ukr.net>\n"
 "Language-Team: Ukrainian <kde-i18n-uk@kde.org>\n"
diff --git a/po/zh_CN.po b/po/zh_CN.po
index b3e6c34..e419973 100644
--- a/po/zh_CN.po
+++ b/po/zh_CN.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GNU gnupg 2.2.28\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2021-06-17 11:52+0900\n"
 "Last-Translator: bobwxc <bobwxc@yeah.net>\n"
 "Language-Team: None\n"
diff --git a/po/zh_TW.po b/po/zh_TW.po
index bdd7b1a..303d0ad 100644
--- a/po/zh_TW.po
+++ b/po/zh_TW.po
@@ -9,7 +9,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: GNU gnupg 2.1.0\n"
 "Report-Msgid-Bugs-To: translations@gnupg.org\n"
-"POT-Creation-Date: 2021-08-26 18:22+0200\n"
+"POT-Creation-Date: 2021-09-15 16:55+0200\n"
 "PO-Revision-Date: 2019-11-04 09:49+0100\n"
 "Last-Translator: Jedi Lin <Jedi@Jedi.org>\n"
 "Language-Team: Chinese (traditional) <zh-l10n@linux.org.tw>\n"
diff --git a/scd/apdu.c b/scd/apdu.c
index a42808c..9278b21 100644
--- a/scd/apdu.c
+++ b/scd/apdu.c
@@ -27,7 +27,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <assert.h>
 #include <signal.h>
 #ifdef USE_NPTH
 # include <unistd.h>
@@ -60,6 +59,7 @@
 #include "../common/exechelp.h"
 #endif /* GNUPG_MAJOR_VERSION != 1 */
 #include "../common/host2net.h"
+#include "../common/membuf.h"
 
 #include "iso7816.h"
 #include "apdu.h"
@@ -90,8 +90,9 @@ typedef unsigned long pcsc_dword_t;
 
 /* PC/SC context to access readers.  Shared among all readers.  */
 static struct pcsc {
-  int count;
+  unsigned int context_valid:1;
   long context;
+  char *reader_list; /* List of detected readers.  */
 } pcsc;
 
 /* A structure to collect information pertaining to one reader
@@ -814,11 +815,11 @@ static int
 close_pcsc_reader (int slot)
 {
   (void)slot;
-  log_assert (pcsc.count > 0);
-  if (--pcsc.count == 0)
+
+  if (pcsc.context_valid)
     {
       pcsc_release_context (pcsc.context);
-      pcsc.context = -1;
+      pcsc.context_valid = 0;
     }
   return 0;
 }
@@ -830,7 +831,7 @@ connect_pcsc_card (int slot)
 {
   long err;
 
-  assert (slot >= 0 && slot < MAX_READER);
+  log_assert (slot >= 0 && slot < MAX_READER);
 
   if (reader_table[slot].pcsc.card)
     return SW_HOST_ALREADY_CONNECTED;
@@ -897,7 +898,7 @@ disconnect_pcsc_card (int slot)
 {
   long err;
 
-  assert (slot >= 0 && slot < MAX_READER);
+  log_assert (slot >= 0 && slot < MAX_READER);
 
   if (!reader_table[slot].pcsc.card)
     return 0;
@@ -1174,6 +1175,7 @@ pcsc_init (void)
       pcsc_api_loaded = 1;
     }
 
+  pcsc.context_valid = 0;
   err = pcsc_establish_context (PCSC_SCOPE_SYSTEM, NULL, NULL, &pcsc.context);
   if (err)
     {
@@ -1181,7 +1183,7 @@ pcsc_init (void)
                  pcsc_error_string (err), err);
       return -1;
     }
-  pcsc.count++;
+  pcsc.context_valid = 1;
 
   return 0;
 }
@@ -1198,14 +1200,19 @@ open_pcsc_reader (const char *portstr)
   pcsc_dword_t nreader;
   char *p;
   size_t n;
+  membuf_t reader_mb;
+
+  xfree (pcsc.reader_list);
+  pcsc.reader_list = NULL;
 
-  if (pcsc.context < 0)
+  if (!pcsc.context_valid)
     if (pcsc_init () < 0)
       return -1;
 
   if (DBG_READER)
     log_debug ("open_pcsc_reader(portstr=%s)\n", portstr);
 
+
   slot = new_reader_slot ();
   if (slot == -1)
     return -1;  /* No need to cleanup here. */
@@ -1237,6 +1244,8 @@ open_pcsc_reader (const char *portstr)
       goto leave;
     }
 
+  init_membuf (&reader_mb, 256);
+
   p = list;
   while (nreader > 0)
     {
@@ -1254,11 +1263,17 @@ open_pcsc_reader (const char *portstr)
          }
 
       log_info ("detected reader '%s'\n", p);
+      put_membuf_str (&reader_mb, p);
+      put_membuf (&reader_mb, "\n", 1);
       if (!rdrname && portstr && !strncmp (p, portstr, strlen (portstr)))
         rdrname = p;
       nreader -= n + 1;
       p += n + 1;
     }
+  put_membuf (&reader_mb, "", 1);
+  pcsc.reader_list = get_membuf (&reader_mb, NULL);
+  if (!pcsc.reader_list)
+    log_error ("error allocating memory for reader list\n");
 
   if (!rdrname)
     rdrname = list;
@@ -1532,7 +1547,7 @@ reset_ccid_reader (int slot)
   if (err)
     return err;
   /* If the reset was successful, update the ATR. */
-  assert (sizeof slotp->atr >= sizeof atr);
+  log_assert (sizeof slotp->atr >= sizeof atr);
   slotp->atrlen = atrlen;
   memcpy (slotp->atr, atr, atrlen);
   dump_reader_status (slot);
@@ -2854,7 +2869,7 @@ send_le (int slot, int class, int ins, int p0, int p1,
           if (use_chaining && lc > 255)
             {
               apdu[apdulen] |= 0x10;
-              assert (use_chaining < 256);
+              log_assert (use_chaining < 256);
               lc_chunk = use_chaining;
               lc -= use_chaining;
             }
@@ -2884,7 +2899,7 @@ send_le (int slot, int class, int ins, int p0, int p1,
 
     exact_length_hack:
       /* As a safeguard don't pass any garbage to the driver.  */
-      assert (apdulen <= apdu_buffer_size);
+      log_assert (apdulen <= apdu_buffer_size);
       memset (apdu+apdulen, 0, apdu_buffer_size - apdulen);
       resultlen = result_buffer_size;
       rc = send_apdu (slot, apdu, apdulen, result, &resultlen, pininfo);
@@ -2955,7 +2970,7 @@ send_le (int slot, int class, int ins, int p0, int p1,
               xfree (result_buffer);
               return SW_HOST_OUT_OF_CORE;
             }
-          assert (resultlen < bufsize);
+          log_assert (resultlen < bufsize);
           memcpy (p, result, resultlen);
           p += resultlen;
         }
@@ -2975,7 +2990,7 @@ send_le (int slot, int class, int ins, int p0, int p1,
           apdu[apdulen++] = 0;
           apdu[apdulen++] = 0;
           apdu[apdulen++] = len;
-          assert (apdulen <= apdu_buffer_size);
+          log_assert (apdulen <= apdu_buffer_size);
           memset (apdu+apdulen, 0, apdu_buffer_size - apdulen);
           resultlen = result_buffer_size;
           rc = send_apdu (slot, apdu, apdulen, result, &resultlen, NULL);
@@ -3225,7 +3240,7 @@ apdu_send_direct (int slot, size_t extended_length,
               xfree (result_buffer);
               return SW_HOST_OUT_OF_CORE;
             }
-          assert (resultlen < bufsize);
+          log_assert (resultlen < bufsize);
           memcpy (p, result, resultlen);
           p += resultlen;
         }
@@ -3347,6 +3362,35 @@ apdu_get_reader_name (int slot)
   return reader_table[slot].rdrname;
 }
 
+
+/* Return the list of currently known readers.  Caller must free the
+ * returned value.  Might return NULL. */
+char *
+apdu_get_reader_list (void)
+{
+  membuf_t mb;
+  char *ccidlist = NULL;
+
+  init_membuf (&mb, 256);
+#ifdef HAVE_LIBUSB
+  ccidlist = ccid_get_reader_list ();
+#endif
+
+  if (ccidlist && *ccidlist)
+    put_membuf_str (&mb, ccidlist);
+  if (pcsc.reader_list && *pcsc.reader_list)
+    {
+      if (ccidlist && *ccidlist)
+        put_membuf (&mb, "\n", 1);
+      put_membuf_str (&mb, pcsc.reader_list);
+    }
+  xfree (ccidlist);
+  put_membuf (&mb, "", 1);
+
+  return get_membuf (&mb, NULL);
+}
+
+
 gpg_error_t
 apdu_init (void)
 {
@@ -3354,8 +3398,9 @@ apdu_init (void)
   gpg_error_t err;
   int i;
 
-  pcsc.count = 0;
   pcsc.context = -1;
+  pcsc.context_valid = 0;
+  pcsc.reader_list = NULL;
 
   if (npth_mutex_init (&reader_table_lock, NULL))
     goto leave;
diff --git a/scd/apdu.h b/scd/apdu.h
index a7f2b14..32b8e9e 100644
--- a/scd/apdu.h
+++ b/scd/apdu.h
@@ -151,5 +151,6 @@ int apdu_send_direct (int slot, size_t extended_length,
                       int handle_more, unsigned int *r_sw,
                       unsigned char **retbuf, size_t *retbuflen);
 const char *apdu_get_reader_name (int slot);
+char *apdu_get_reader_list (void);
 
 #endif /*APDU_H*/
diff --git a/scd/command.c b/scd/command.c
index e2debf5..fab6586 100644
--- a/scd/command.c
+++ b/scd/command.c
@@ -36,9 +36,6 @@
 #include "iso7816.h"
 #include "apdu.h" /* Required for apdu_*_reader (). */
 #include "atr.h"
-#ifdef HAVE_LIBUSB
-#include "ccid-driver.h"
-#endif
 #include "../common/asshelp.h"
 #include "../common/server-help.h"
 
@@ -1401,6 +1398,45 @@ cmd_unlock (assuan_context_t ctx, char *line)
 }
 
 
+/* Ease reading of Assuan data ;ines by sending a physical line after
+ * each LF.  */
+static gpg_error_t
+pretty_assuan_send_data (assuan_context_t ctx,
+                         const void *buffer_arg, size_t size)
+{
+  const char *buffer = buffer_arg;
+  const char *p;
+  size_t n, nbytes;
+  gpg_error_t err;
+
+  nbytes = size;
+  do
+    {
+      p = memchr (buffer, '\n', nbytes);
+      n = p ? (p - buffer) + 1 : nbytes;
+      err = assuan_send_data (ctx, buffer, n);
+      if (err)
+        {
+          /* We also set ERRNO in case this function is used by a
+           * custom estream I/O handler.  */
+          gpg_err_set_errno (EIO);
+          goto leave;
+        }
+      buffer += n;
+      nbytes -= n;
+      if (nbytes && (err=assuan_send_data (ctx, NULL, 0))) /* Flush line. */
+        {
+          gpg_err_set_errno (EIO);
+          goto leave;
+        }
+    }
+  while (nbytes);
+
+ leave:
+  return err;
+}
+
+
 static const char hlp_getinfo[] =
   "GETINFO <what>\n"
   "\n"
@@ -1418,8 +1454,7 @@ static const char hlp_getinfo[] =
   "                  'u'  Usable card present.\n"
   "                  'r'  Card removed.  A reset is necessary.\n"
   "                These flags are exclusive.\n"
-  "  reader_list - Return a list of detected card readers.  Does\n"
-  "                currently only work with the internal CCID driver.\n"
+  "  reader_list - Return a list of detected card readers.\n"
   "  deny_admin  - Returns OK if admin commands are not allowed or\n"
   "                GPG_ERR_GENERAL if admin commands are allowed.\n"
   "  app_list    - Return a list of supported applications.  One\n"
@@ -1474,14 +1509,9 @@ cmd_getinfo (assuan_context_t ctx, char *line)
     }
   else if (!strcmp (line, "reader_list"))
     {
-#ifdef HAVE_LIBUSB
-      char *s = ccid_get_reader_list ();
-#else
-      char *s = NULL;
-#endif
-
+      char *s = apdu_get_reader_list ();
       if (s)
-        rc = assuan_send_data (ctx, s, strlen (s));
+        rc = pretty_assuan_send_data (ctx, s, strlen (s));
       else
         rc = gpg_error (GPG_ERR_NO_DATA);
       xfree (s);