summaryrefslogtreecommitdiff
path: root/NEWS
blob: 70c2773cca644a73c47bf3ae046f6c90f1261edf (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
Noteworthy changes in version 2.0.26 (2014-08-12)
-------------------------------------------------

 * gpg: Fix a regression in 2.0.24 if a subkey id is given
   to --recv-keys et al.

 * gpg: Cap attribute packets at 16MB.

 * gpgsm: Auto-create the ".gnupg" home directory in the same
   way gpg does.

 * scdaemon: Allow for certificates > 1024 when using PC/SC.


Noteworthy changes in version 2.0.25 (2014-06-30)
-------------------------------------------------

 * gpg: Fix a regression in 2.0.24 if more than one keyid is given
   to --recv-keys et al.

 * gpg: Cap RSA and Elgamal keysize at 4096 bit also for unattended
   key generation.

 * gpgsm: Fix a DISPLAY related problem with --export-secret-key-p12.

 * scdaemon: Support reader Gemalto IDBridge CT30.


Noteworthy changes in version 2.0.24 (2014-06-24)
-------------------------------------------------

 * gpg: Avoid DoS due to garbled compressed data packets. [CVE-2014-4617]

 * gpg: Screen keyserver responses to avoid importing unwanted keys
   from rogue servers.

 * gpg: The validity of user ids is now shown by default.  To revert
   this add "list-options no-show-uid-validity" to gpg.conf.

 * gpg: Print more specific reason codes with the INV_RECP status.

 * gpg: Allow loading of a cert only key to an OpenPGP card.

 * gpg-agent: Make ssh support for ECDSA keys work with Libgcrypt 1.6.


Noteworthy changes in version 2.0.23 (2014-06-03)
-------------------------------------------------

 * gpg: Reject signatures made using the MD5 hash algorithm unless the
   new option --allow-weak-digest-algos or --pgp2 are given.

 * gpg: Do not create a trustdb file if --trust-model=always is used.

 * gpg: Only the major version number is by default included in the
   armored output.

 * gpg: Print a warning if the Gnome-Keyring-Daemon intercepts the
   communication with the gpg-agent.

 * gpg: The format of the fallback key listing ("gpg KEYFILE") is now more
   aligned to the regular key listing ("gpg -k").

 * gpg: The option--show-session-key prints its output now before the
   decryption of the bulk message starts.

 * gpg: New %U expando for the photo viewer.

 * gpgsm: Improved handling of re-issued CA certificates.

 * scdaemon: Various fixes for pinpad equipped card readers.

 * Minor bug fixes.


Noteworthy changes in version 2.0.22 (2013-10-04)
-------------------------------------------------

 * Fixed possible infinite recursion in the compressed packet
   parser. [CVE-2013-4402]

 * Improved support for some card readers.

 * Prepared building with the forthcoming Libgcrypt 1.6.

 * Protect against rogue keyservers sending secret keys.


Noteworthy changes in version 2.0.21 (2013-08-19)
-------------------------------------------------

 * gpg-agent: By default the users are now asked via the Pinentry
   whether they trust an X.509 root key.  To prohibit interactive
   marking of such keys, the new option --no-allow-mark-trusted may
   be used.

 * gpg-agent: The command KEYINFO has options to add info from
   sshcontrol.

 * The included ssh agent does now support ECDSA keys.

 * The new option --enable-putty-support allows gpg-agent to act on
   Windows as a Pageant replacement with full smartcard support.

 * Support installation as portable application under Windows.


Noteworthy changes in version 2.0.20 (2013-05-10)
-------------------------------------------------

 * Decryption using smartcards keys > 3072 bit does now work.

 * New meta option ignore-invalid-option to allow using the same
   option file by other GnuPG versions.

 * gpg: The hash algorithm is now printed for sig records in key listings.

 * gpg: Skip invalid keyblock packets during import to avoid a DoS.

 * gpg: Correctly handle ports from DNS SRV records.

 * keyserver: Improve use of SRV records

 * gpg-agent: Avoid tty corruption when killing pinentry.

 * scdaemon: Improve detection of card insertion and removal.

 * scdaemon: Rename option --disable-keypad to --disable-pinpad.

 * scdaemon: Better support for CCID readers.  Now, the internal CCID
   driver supports readers without the auto configuration feature.

 * scdaemon: Add pinpad input for PC/SC, if your reader has pinpad and
   it supports variable length PIN input, and you specify
   --enable-pinpad-varlen option.

 * scdaemon: New option --enable-pinpad-varlen.

 * scdaemon: Install into libexecdir to avoid accidental execution
   from the command line.

 * Support building using w64-mingw32.

 * Assorted bug fixes.


Noteworthy changes in version 2.0.19 (2012-03-27)
-------------------------------------------------

 * GPG now accepts a space separated fingerprint as a user ID.  This
   allows to copy and paste the fingerprint from the key listing.

 * GPG now uses the longest key ID available.  Removed support for the
   original HKP keyserver which is not anymore used by any site.

 * Rebuild the trustdb after changing the option --min-cert-level.

 * Ukrainian translation.

 * Honor option --cert-digest-algo when creating a cert.

 * Emit a DECRYPTION_INFO status line.

 * Improved detection of JPEG files.


Noteworthy changes in version 2.0.18 (2011-08-04)
-------------------------------------------------

 * Bug fix for newer versions of Libgcrypt.

 * Support the SSH confirm flag and show SSH fingerprints in ssh
   related pinentries.

 * Improved dirmngr/gpgsm interaction for OCSP.

 * Allow generation of card keys up to 4096 bit.


Noteworthy changes in version 2.0.17 (2011-01-13)
-------------------------------------------------

 * Allow more hash algorithms with the OpenPGP v2 card.

 * The gpg-agent now tests for a new gpg-agent.conf on a HUP.

 * Fixed output of "gpgconf --check-options".

 * Fixed a bug where Scdaemon sends a signal to Gpg-agent running in
   non-daemon mode.

 * Fixed TTY management for pinentries and session variable update
   problem.


Noteworthy changes in version 2.0.16 (2010-07-19)
-------------------------------------------------

 * If the agent's --use-standard-socket option is active, all tools
   try to start and daemonize the agent on the fly.  In the past this
   was only supported on W32; on non-W32 systems the new configure
   option --enable-standard-socket may now be used to use this feature
   by default.

 * The gpg-agent commands KILLAGENT and RELOADAGENT are now available
   on all platforms.

 * Minor bug fixes.


Noteworthy changes in version 2.0.15 (2010-03-09)
-------------------------------------------------

 * New command --passwd for GPG.

 * Fixes a regression in 2.0.14 which prevented unprotection of new
   or changed gpg-agent passphrases.

 * Make use of libassuan 2.0 which is available as a DSO.


Noteworthy changes in version 2.0.14 (2009-12-21)
-------------------------------------------------

 * The default for --include-cert is now to include all certificates
   in the chain except for the root certificate.

 * Numerical values may now be used as an alternative to the
   debug-level keywords.

 * The GPGSM --audit-log feature is now more complete.

 * GPG now supports DNS lookups for SRV, PKA and CERT on W32.

 * New GPGSM option --ignore-cert-extension.

 * New and changed passphrases are now created with an iteration count
   requiring about 100ms of CPU work.


Noteworthy changes in version 2.0.13 (2009-09-04)
-------------------------------------------------

 * GPG now generates 2048 bit RSA keys by default.  The default hash
   algorithm preferences has changed to prefer SHA-256 over SHA-1.
   2048 bit DSA keys are now generated to use a 256 bit hash algorithm

 * The envvars XMODIFIERS, GTK_IM_MODULE and QT_IM_MODULE are now
   passed to the Pinentry to make SCIM work.

 * The GPGSM command --gen-key features a --batch mode and implements
   all features of gpgsm-gencert.sh in standard mode.

 * New option --re-import for GPGSM's IMPORT server command.

 * Enhanced writing of existing keys to OpenPGP v2 cards.

 * Add hack to the internal CCID driver to allow the use of some
   Omnikey based card readers with 2048 bit keys.

 * GPG now repeatly asks the user to insert the requested OpenPGP
   card.  This can be disabled with --limit-card-insert-tries=1.

 * Minor bug fixes.


Noteworthy changes in version 2.0.12 (2009-06-17)
-------------------------------------------------

 * GPGSM now always lists ephemeral certificates if specified by
   fingerprint or keygrip.

 * New command "KEYINFO" for GPG_AGENT.  GPGSM now also returns
   information about smartcards.

 * Made sure not to leak file descriptors if running gpg-agent with a
   command.  Restore the signal mask to solve a problem in Mono.

 * Changed order of the confirmation questions for root certificates
   and store negative answers in trustlist.txt.

 * Better synchronization of concurrent smartcard sessions.

 * Support 2048 bit OpenPGP cards.

 * Support Telesec Netkey 3 cards.

 * The gpg-protect-tool now uses gpg-agent via libassuan.  Under
   Windows the Pinentry will now be put into the foreground.

 * Changed code to avoid a possible Mac OS X system freeze.


Noteworthy changes in version 2.0.11 (2009-03-03)
-------------------------------------------------

 * Fixed a problem in SCDAEMON which caused unexpected card resets.

 * SCDAEMON is now aware of the Geldkarte.

 * The SCDAEMON option --allow-admin is now used by default.

 * GPGCONF now restarts SCdaemon if necessary.

 * The default cipher algorithm in GPGSM is now again 3DES.  This is
   due to interoperability problems with Outlook 2003 which still
   can't cope with AES.


Noteworthy changes in version 2.0.10 (2009-01-12)
-------------------------------------------------

 * [gpg] New keyserver helper gpg2keys_kdns as generic DNS CERT
   lookup.  Run with --help for a short description.  Requires the
   ADNS library.

 * [gpg] New mechanisms "local" and "nodefault" for --auto-key-locate.
   Fixed a few problems with this option.

 * [gpg] New command --locate-keys.

 * [gpg] New options --with-sig-list and --with-sig-check.

 * [gpg] The option "-sat" is no longer an alias for --clearsign.

 * [gpg] The option --fixed-list-mode is now implicitly used and obsolete.

 * [gpg] New control statement %ask-passphrase for the unattended key
   generation.

 * [gpg] The algorithm to compute the SIG_ID status has been changed.

 * [gpgsm] Now uses AES by default.

 * [gpgsm] Made --output option work with --export-secret-key-p12.

 * [gpg-agent] Terminate process if the own listening socket is not
   anymore served by ourself.

 * [scdaemon] Made it more robust on W32.

 * [gpg-connect-agent] Accept commands given as command line arguments.

 * [w32] Initialized the socket subsystem for all keyserver helpers.

 * [w32] The sysconf directory has been moved from a subdirectory of
   the installation directory to %CSIDL_COMMON_APPDATA%/GNU/etc/gnupg.

 * [w32] The gnupg2.nls directory is not anymore used.  The standard
   locale directory is now used.

 * [w32] Fixed a race condition between gpg and gpgsm in the use of
   temporary file names.

 * The gpg-preset-passphrase mechanism works again.  An arbitrary
   string may now be used for a custom cache ID.

 * Admin PINs are cached again (bug in 2.0.9).

 * Support for version 2 OpenPGP cards.

 * Libgcrypt 1.4 is now required.


Noteworthy changes in version 2.0.9 (2008-03-26)
------------------------------------------------

 * Gpgsm always tries to locate missing certificates from a running
   Dirmngr's cache.

 * Tweaks for Windows.

 * The Admin PIN for OpenPGP cards may now be entered with the pinpad.

 * Improved certificate chain construction.

 * Extended the PKITS framework.

 * Fixed a bug in the ambigious name detection.

 * Fixed possible memory corruption while importing OpenPGP keys (bug
   introduced with 2.0.8). [CVE-2008-1530]

 * Minor bug fixes.


Noteworthy changes in version 2.0.8 (2007-12-20)
------------------------------------------------

 * Enhanced gpg-connect-agent with a small scripting language.

 * New option --list-config for gpgconf.

 * Fixed a crash in gpgconf.

 * Gpg-agent now supports the passphrase quality bar of the latest
   Pinentry.

 * The envvars XAUTHORITY and PINENTRY_USER_DATA are now passed to the
   Pinentry.

 * Fixed the auto creation of the key stub for smartcards.

 * Fixed a rare bug in decryption using the OpenPGP card.

 * Creating DSA2 keys is now possible.

 * New option --extra-digest-algo for gpgsm to allow verification of
   broken signatures.

 * Allow encryption with legacy Elgamal sign+encrypt keys with option
   --rfc2440.

 * Windows is now a supported platform.

 * Made sure that under Windows the file permissions of the socket are
   taken into account.  This required a change of our socket emulation
   code and changed the IPC protocol under Windows.


Noteworthy changes in version 2.0.7 (2007-09-10)
------------------------------------------------

 * Fixed encryption problem if duplicate certificates are in the
   keybox.

 * Made it work on Windows Vista.  Note that the entire Windows port
   is still considered Beta.

 * Add new options min-passphrase-nonalpha, check-passphrase-pattern,
   enforce-passphrase-constraints and max-passphrase-days to
   gpg-agent.

 * Add command --check-components to gpgconf.  Gpgconf now uses the
   installed versions of the programs and does not anymore search via
   PATH for them.


Noteworthy changes in version 2.0.6 (2007-08-16)
------------------------------------------------

 * GPGSM does now grok --default-key.

 * GPGCONF is now aware of --default-key and --encrypt-to.

 * GPGSM does again correctly print the serial number as well the the
   various keyids.  This was broken since 2.0.4.

 * New option --validation-model and support for the chain-model.

 * Improved Windows support.


Noteworthy changes in version 2.0.5 (2007-07-05)
------------------------------------------------

 * Switched license to GPLv3.

 * Basic support for Windows.  Run "./autogen.sh --build-w32" to build
   it.  As usual the mingw cross compiling toolchain is required.

 * Fixed bug when using the --p12-charset without --armor.

 * The command --gen-key may now be used instead of the
   gpgsm-gencert.sh script.

 * Changed key generation to reveal less information about the
   machine.  Bug fixes for gpg2's card key generation.


Noteworthy changes in version 2.0.4 (2007-05-09)
------------------------------------------------

 * The server mode key listing commands are now also working for
   systems without the funopen/fopencookie API.

 * PKCS#12 import now tries several encodings in case the passphrase
   was not utf-8 encoded.  New option --p12-charset for gpgsm.

 * Improved the libgcrypt logging support in all modules.


Noteworthy changes in version 2.0.3 (2007-03-08)
------------------------------------------------

 * By default, do not allow processing multiple plaintexts in a single
   stream.  Many programs that called GnuPG were assuming that GnuPG
   did not permit this, and were thus not using the plaintext boundary
   status tags that GnuPG provides.  This change makes GnuPG reject
   such messages by default which makes those programs safe again.
   --allow-multiple-messages returns to the old behavior. [CVE-2007-1263].

 * New --verify-option show-primary-uid-only.

 * gpgconf may now reads a global configuration file to select which
   options are changeable by a frontend.  The new applygnupgdefaults
   tool may be used by an admin to set default options for all users.

 * The PIN pad of the Cherry XX44 keyboard is now supported.  The
   DINSIG and the NKS applications are now also aware of PIN pads.


Noteworthy changes in version 2.0.2 (2007-01-31)
------------------------------------------------

 * Fixed a serious and exploitable bug in processing encrypted
   packages. [CVE-2006-6235].

 * Added --passphrase-repeat to set the number of times GPG will
   prompt for a new passphrase to be repeated.  This is useful to help
   memorize a new passphrase.  The default is 1 repetition.

 * Using a PIN pad does now also work for the signing key.

 * A warning is displayed by gpg-agent if a new passphrase is too
   short.  New option --min-passphrase-len defaults to 8.

 * The status code BEGIN_SIGNING now shows the used hash algorithms.


Noteworthy changes in version 2.0.1 (2006-11-28)
------------------------------------------------

 * Experimental support for the PIN pads of the SPR 532 and the Kaan
   Advanced card readers.  Add "disable-keypad" scdaemon.conf if you
   don't want it.  Does currently only work for the OpenPGP card and
   its authentication and decrypt keys.

 * Fixed build problems on some some platforms and crashes on amd64.

 * Fixed a buffer overflow in gpg2. [bug#728,CVE-2006-6169]


Noteworthy changes in version 2.0.0 (2006-11-11)
------------------------------------------------

 * First stable version of a GnuPG integrating OpenPGP and S/MIME.


Noteworthy changes in version 1.9.95 (2006-11-06)
-------------------------------------------------

 * Minor bug fixes.


Noteworthy changes in version 1.9.94 (2006-10-24)
-------------------------------------------------

 * Keys for gpgsm may now be specified using a keygrip.  A keygrip is
   indicated by a prefixing it with an ampersand.

 * gpgconf now supports switching the CMS cipher algo (e.g. to AES).

 * New command --gpgconf-test for all major tools. This may be used to
   check whether the configuration file is sane.


Noteworthy changes in version 1.9.93 (2006-10-18)
-------------------------------------------------

 * In --with-validation mode gpgsm will now also ask whether a root
   certificate should be trusted.

 * Link to Pth only if really necessary.

 * Fixed a pubring corruption bug in gpg2 occurring when importing
   signatures or keys with insane lengths.

 * Fixed v3 keyID calculation bug in gpg2.

 * More tweaks for certificates without extensions.


Noteworthy changes in version 1.9.92 (2006-10-11)
-------------------------------------------------

 * Bug fixes.


Noteworthy changes in version 1.9.91 (2006-10-04)
-------------------------------------------------

 * New "relax" flag for trustlist.txt to allow root CA certificates
   without BasicContraints.

 * [gpg2] Removed the -k PGP 2 compatibility hack.  -k is now an
   alias for --list-keys.

 * [gpg2] Print a warning if "-sat" is used instead of "--clearsign".


Noteworthy changes in version 1.9.90 (2006-09-25)
-------------------------------------------------

 * Made readline work for gpg.

 * Cleanups und minor bug fixes.

 * Included translations from gnupg 1.4.5.


Noteworthy changes in version 1.9.23 (2006-09-18)
-------------------------------------------------

 * Regular man pages for most tools are now build directly from the
   Texinfo source.

 * The gpg code from 1.4.5 has been fully merged into this release.
   The configure option --enable-gpg is still required to build this
   gpg part.  For production use of OpenPGP the gpg version 1.4.5 is
   still recommended.  Note, that gpg will be installed under the name
   gpg2 to allow coexisting with an 1.4.x gpg.

 * API change in gpg-agent's pkdecrypt command.  Thus an older gpgsm
   may not be used with the current gpg-agent.

 * The scdaemon will now call a script on reader status changes.

 * gpgsm now allows file descriptor passing for "INPUT", "OUTPUT" and
   "MESSAGE".

 * The gpgsm server may now output a key listing to the output file
   handle. This needs to be enabled using "OPTION list-to-output=1".

 * The --output option of gpgsm has now an effect on list-keys.

 * New gpgsm commands --dump-chain and list-chain.

 * gpg-connect-agent has new options to utilize descriptor passing.

 * A global trustlist may now be used.  See doc/examples/trustlist.txt.

 * When creating a new pubring.kbx keybox common certificates are
   imported.


Noteworthy changes in version 1.9.22 (2006-07-27)
-------------------------------------------------

 * Enhanced pkcs#12 support to allow import from simple keyBags.

 * Exporting to pkcs#12 now create bag attributes so that Mozilla is
   able to import the files.

 * Fixed uploading of certain keys to the smart card.


Noteworthy changes in version 1.9.21 (2006-06-20)
-------------------------------------------------

 * New command APDU for scdaemon to allow using it for general card
   access.  Might be used through gpg-connect-agent by using the SCD
   prefix command.

 * Support for the CardMan 4040 PCMCIA reader (Linux 2.6.15 required).

 * Scdaemon does not anymore reset cards at the end of a connection.

 * Kludge to allow use of Bundesnetzagentur issued X.509 certificates.

 * Added --hash=xxx option to scdaemon's PKSIGN command.

 * Pkcs#12 files are now created with a MAC.  This is for better
   interoperability.

 * Collected bug fixes and minor other changes.


Noteworthy changes in version 1.9.20 (2005-12-20)
-------------------------------------------------

 * Importing pkcs#12 files created be recent versions of Mozilla works
   again.

 * Basic support for qualified signatures.

 * New debug tool gpgparsemail.


Noteworthy changes in version 1.9.19 (2005-09-12)
-------------------------------------------------

 * The Belgian eID card is now supported for signatures and ssh.
   Other pkcs#15 cards should work as well.

 * Fixed bug in --export-secret-key-p12 so that certificates are again
   included.


Noteworthy changes in version 1.9.18 (2005-08-01)
-------------------------------------------------

 * [gpgsm] Now allows for more than one email address as well as URIs
   and dnsNames in certificate request generation.  A keygrip may be
   given to create a request from an existing key.

 * A couple of minor bug fixes.


Noteworthy changes in version 1.9.17 (2005-06-20)
-------------------------------------------------

 * gpg-connect-agent has now features to handle Assuan INQUIRE
   commands.

 * Internal changes for OpenPGP cards. New Assuan command WRITEKEY.

 * GNU Pth is now a hard requirement.

 * [scdaemon] Support for OpenSC has been removed.  Instead a new and
   straightforward pkcs#15 modules has been written.  As of now it
   does allows only signing using TCOS cards but we are going to
   enhance it to match all the old capabilities.

 * [gpg-agent] New option --write-env-file and Assuan command
   UPDATESTARTUPTTY.

 * [gpg-agent] New option --default-cache-ttl-ssh to set the TTL for
   SSH passphrase caching independent from the other passphrases.


Noteworthy changes in version 1.9.16 (2005-04-21)
-------------------------------------------------

 * gpg-agent does now support the ssh-agent protocol and thus allows
   to use the pinentry as well as the OpenPGP smartcard with ssh.

 * New tool gpg-connect-agent as a general client for the gpg-agent.

 * New tool symcryptrun as a wrapper for certain encryption tools.

 * The gpg tool is not anymore build by default because those gpg
   versions available in the gnupg 1.4 series are far more matured.


Noteworthy changes in version 1.9.15 (2005-01-13)
-------------------------------------------------

 * Fixed passphrase caching bug.

 * Better support for CCID readers; the reader from Cherry RS 6700 USB
   does now work.


Noteworthy changes in version 1.9.14 (2004-12-22)
-------------------------------------------------

 * [gpg-agent] New option --use-standard-socket to allow the use of a
   fixed socket.  gpgsm falls back to this socket if GPG_AGENT_INFO
   has not been set.

 * Ported to MS Windows with some functional limitations.

 * New tool gpg-preset-passphrase.


Noteworthy changes in version 1.9.13 (2004-12-03)
-------------------------------------------------

 * [gpgsm] New option --prefer-system-dirmngr.

 * Minor cleanups and debugging aids.


Noteworthy changes in version 1.9.12 (2004-10-22)
-------------------------------------------------

 * [scdaemon] Partly rewrote the PC/SC code.

 * Removed the sc-investigate tool.  It is now in a separate package
   available at ftp://ftp.g10code.com/g10code/gscutils/ .

 * [gpg-agent] Fixed logging problem.


Noteworthy changes in version 1.9.11 (2004-10-01)
-------------------------------------------------

 * When using --import along with --with-validation, the imported
   certificates are validated and only imported if they are fully
   valid.

 * [gpg-agent] New option --max-cache-ttl.

 * [gpg-agent] When used without --daemon or --server, gpg-agent now
   check whether a agent is already running and usable.

 * Fixed some i18n problems.


Noteworthy changes in version 1.9.10 (2004-07-22)
-------------------------------------------------

 * Fixed a serious bug in the checking of trusted root certificates.

 * New configure option --enable-agent-pnly allows to build and
   install just the agent.

 * Fixed a problem with the log file handling.


Noteworthy changes in version 1.9.9 (2004-06-08)
------------------------------------------------

 * [gpg-agent] The new option --allow-mark-trusted is now required to
   allow gpg-agent to add a key to the trustlist.txt after user
   confirmation.

 * Creating PKCS#10 requests does now honor the key usage.


Noteworthy changes in version 1.9.8 (2004-04-29)
------------------------------------------------

 * [scdaemon] Overhauled the internal CCID driver.

 * [scdaemon] Status files named ~/.gnupg/reader_<n>.status are now
   written when using the internal CCID driver.

 * [gpgsm] New commands --dump-{,secret,external}-keys to show a very
   detailed view of the certificates.

 * The keybox gets now compressed after 3 hours and ephemeral
   stored certificates are deleted after about a day.

 * [gpg] Usability fixes for --card-edit.  Note, that this has already
   been ported back to gnupg-1.3


Noteworthy changes in version 1.9.7 (2004-04-06)
------------------------------------------------

 * Instrumented the modules for gpgconf.

 * Added support for DINSIG card applications.

 * Include the smimeCapabilities attribute with signed messages.

 * Now uses the gettext domain "gnupg2" to avoid conflicts with gnupg
   versions < 1.9.


Noteworthy changes in version 1.9.6 (2004-03-06)
------------------------------------------------

 * Code cleanups and bug fixes.


Noteworthy changes in version 1.9.5 (2004-02-21)
------------------------------------------------

 * gpg-protect-tool gets now installed into libexec as it ought to be.
   Cleaned up the build system to better comply with the coding
   standards.

 * [gpgsm] The --import command is now able to autodetect pkcs#12
   files and import secret and private keys from this file format.
   A new command --export-secret-key-p12 is provided to allow
   exporting of secret keys in PKCS\#12 format.

 * [gpgsm] The pinentry will now present a description of the key for
   whom the passphrase is requested.

 * [gpgsm] New option --with-validation to check the validity of key
   while listing it.

 * New option --debug-level={none,basic,advanced,expert,guru} to map
   the debug flags to sensitive levels on a per program base.


Noteworthy changes in version 1.9.4 (2004-01-30)
------------------------------------------------

 * Added support for the Telesec NKS 2.0 card application.

 * Added simple tool addgnupghome to create .gnupg directories from
   /etc/skel/.gnupg.

 * Various minor bug fixes and cleanups; mainly gpgsm and gpg-agent
   related.


Noteworthy changes in version 1.9.3 (2003-12-23)
------------------------------------------------

 * New gpgsm options --{enable,disable}-ocsp to validate keys using
   OCSP. This option requires a not yet released DirMngr version.
   Default is disabled.

 * The --log-file option may now be used to print logs to a socket.
   Prefix the socket name with "socket://" to enable this.  This does
   not work on all systems and falls back to stderr if there is a
   problem with the socket.

 * The options --encrypt-to and --no-encrypt-to now work the same in
   gpgsm as in gpg.  Note, they are also used in server mode.

 * Duplicated recipients are now silently removed in gpgsm.


Noteworthy changes in version 1.9.2 (2003-11-17)
------------------------------------------------

 * On card key generation is no longer done using the --gen-key
   command but from the menu provided by the new --card-edit command.

 * PINs are now properly cached and there are only 2 PINs visible.
   The 3rd PIN (CHV2) is internally syncronized with the regular PIN.

 * All kind of other internal stuff.


Noteworthy changes in version 1.9.1 (2003-09-06)
------------------------------------------------

 * Support for OpenSC is back. scdaemon supports a --disable-opensc to
   disable OpenSC use at runtime, so that PC/SC or ct-API can still be
   used directly.

 * Rudimentary support for the SCR335 smartcard reader using an
   internal driver.  Requires current libusb from CVS.

 * Bug fixes.


Noteworthy changes in version 1.9.0 (2003-08-05)
------------------------------------------------

      ====== PLEASE SEE README-alpha =======

 * gpg has been renamed to gpg2 and gpgv to gpgv2.  This is a
   temporary change to allow co-existing with stable gpg versions.

 * ~/.gnupg/gpg.conf-1.9.0 is fist tried as config file before the
   usual gpg.conf.

 * Removed the -k, -kv and -kvv commands.  -k is now an alias to
   --list-keys.  New command -K as alias for --list-secret-keys.

 * Removed --run-as-shm-coprocess feature.

 * gpg does now also use libgcrypt, libgpg-error is required.

 * New gpgsm commands --call-dirmngr and --call-protect-tool.

 * Changing a passphrase is now possible using "gpgsm --passwd"

 * The content-type attribute is now recognized and created.

 * The agent does now reread certain options on receiving a HUP.

 * The pinentry is now forked for each request so that clients with
   different environments are supported.  When running in daemon mode
   and --keep-display is not used the DISPLAY variable is ignored.

 * Merged stuff from the newpg branch and started this new
   development branch.


 Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,
           2010, 2011  Free Software Foundation, Inc.

 This file is free software; as a special exception the author gives
 unlimited permission to copy and/or distribute it, with or without
 modifications, as long as this notice is preserved.

 This file is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
 implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.