Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
summaryrefslogtreecommitdiff
path: root/app-crypt/gnupg/files
diff options
context:
space:
mode:
Diffstat (limited to 'app-crypt/gnupg/files')
-rw-r--r--app-crypt/gnupg/files/README-systemd67
-rw-r--r--app-crypt/gnupg/files/dirmngr.service8
-rw-r--r--app-crypt/gnupg/files/dirmngr.socket11
-rw-r--r--app-crypt/gnupg/files/gnupg-2.2.42-bug923248-insecure-backup.patch292
-rw-r--r--app-crypt/gnupg/files/gnupg-2.2.42-dirmngr-proxy.patch156
-rw-r--r--app-crypt/gnupg/files/gnupg-2.2.42-gpgme-tests.patch39
-rw-r--r--app-crypt/gnupg/files/gnupg-2.3.7-yubikey-workaround-fix.patch53
-rw-r--r--app-crypt/gnupg/files/gnupg-2.4.4-dirmngr-proxy.patch202
-rw-r--r--app-crypt/gnupg/files/gpg-agent-browser.socket13
-rw-r--r--app-crypt/gnupg/files/gpg-agent-extra.socket13
-rw-r--r--app-crypt/gnupg/files/gpg-agent-ssh.socket13
-rw-r--r--app-crypt/gnupg/files/gpg-agent.service8
-rw-r--r--app-crypt/gnupg/files/gpg-agent.socket12
13 files changed, 834 insertions, 53 deletions
diff --git a/app-crypt/gnupg/files/README-systemd b/app-crypt/gnupg/files/README-systemd
new file mode 100644
index 000000000000..cc38fd66ab57
--- /dev/null
+++ b/app-crypt/gnupg/files/README-systemd
@@ -0,0 +1,67 @@
+Socket-activated dirmngr and gpg-agent with systemd
+===================================================
+
+When used on a GNU/Linux system supervised by systemd, you can ensure
+that the GnuPG daemons dirmngr and gpg-agent are launched
+automatically the first time they're needed, and shut down cleanly at
+session logout. This is done by enabling user services via
+socket-activation.
+
+System distributors
+-------------------
+
+The *.service and *.socket files (from this directory) should be
+placed in /usr/lib/systemd/user/ alongside other user-session services
+and sockets.
+
+To enable socket-activated dirmngr for all accounts on the system,
+use:
+
+ systemctl --user --global enable dirmngr.socket
+
+To enable socket-activated gpg-agent for all accounts on the system,
+use:
+
+ systemctl --user --global enable gpg-agent.socket
+
+Additionally, you can enable socket-activated gpg-agent ssh-agent
+emulation for all accounts on the system with:
+
+ systemctl --user --global enable gpg-agent-ssh.socket
+
+You can also enable restricted ("--extra-socket"-style) gpg-agent
+sockets for all accounts on the system with:
+
+ systemctl --user --global enable gpg-agent-extra.socket
+
+Individual users
+----------------
+
+A user on a system with systemd where this has not been installed
+system-wide can place these files in ~/.config/systemd/user/ to make
+them available.
+
+If a given service isn't installed system-wide, or if it's installed
+system-wide but not globally enabled, individual users will still need
+to enable them. For example, to enable socket-activated dirmngr for
+all future sessions:
+
+ systemctl --user enable dirmngr.socket
+
+To enable socket-activated gpg-agent with ssh support, do:
+
+ systemctl --user enable gpg-agent.socket gpg-agent-ssh.socket
+
+These changes won't take effect until your next login after you've
+fully logged out (be sure to terminate any running daemons before
+logging out).
+
+If you'd rather try a socket-activated GnuPG daemon in an
+already-running session without logging out (with or without enabling
+it for all future sessions), kill any existing daemon and start the
+user socket directly. For example, to set up socket-activated dirmgnr
+in the current session:
+
+ gpgconf --kill dirmngr
+ systemctl --user start dirmngr.socket
+
diff --git a/app-crypt/gnupg/files/dirmngr.service b/app-crypt/gnupg/files/dirmngr.service
new file mode 100644
index 000000000000..3c060cde5d87
--- /dev/null
+++ b/app-crypt/gnupg/files/dirmngr.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=GnuPG network certificate management daemon
+Documentation=man:dirmngr(8)
+Requires=dirmngr.socket
+
+[Service]
+ExecStart=/usr/bin/dirmngr --supervised
+ExecReload=/usr/bin/gpgconf --reload dirmngr
diff --git a/app-crypt/gnupg/files/dirmngr.socket b/app-crypt/gnupg/files/dirmngr.socket
new file mode 100644
index 000000000000..ebabf896ab43
--- /dev/null
+++ b/app-crypt/gnupg/files/dirmngr.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=GnuPG network certificate management daemon
+Documentation=man:dirmngr(8)
+
+[Socket]
+ListenStream=%t/gnupg/S.dirmngr
+SocketMode=0600
+DirectoryMode=0700
+
+[Install]
+WantedBy=sockets.target
diff --git a/app-crypt/gnupg/files/gnupg-2.2.42-bug923248-insecure-backup.patch b/app-crypt/gnupg/files/gnupg-2.2.42-bug923248-insecure-backup.patch
new file mode 100644
index 000000000000..76d6d94c40b1
--- /dev/null
+++ b/app-crypt/gnupg/files/gnupg-2.2.42-bug923248-insecure-backup.patch
@@ -0,0 +1,292 @@
+https://bugs.gentoo.org/923248
+https://dev.gnupg.org/T6944
+https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=3b69d8bf7146b8d10737d0cfea9c97affc60ad73
+
+From 3b69d8bf7146b8d10737d0cfea9c97affc60ad73 Mon Sep 17 00:00:00 2001
+From: Werner Koch <wk@gnupg.org>
+Date: Wed, 24 Jan 2024 11:29:24 +0100
+Subject: [PATCH] gpg: Fix leftover unprotected card backup key.
+
+* agent/command.c (cmd_learn): Add option --reallyforce.
+* agent/findkey.c (agent_write_private_key): Implement reallyforce.
+Also add arg reallyforce and pass it along the call chain.
+
+* g10/call-agent.c (agent_scd_learn): Pass --reallyforce with a
+special force value.
+* g10/keygen.c (card_store_key_with_backup): Use that force value.
+--
+
+This was a regression in 2.2.42. We took the easy path to fix it by
+getting the behaviour back to what we did prior to 2.2.42. With GnuPG
+2.4.4 we use an entire different and safer approach by introducing an
+ephemeral private key store.
+
+GnuPG-bug-id: 6944
+--- a/agent/agent.h
++++ b/agent/agent.h
+@@ -422,7 +422,8 @@ void start_command_handler_ssh (ctrl_t, gnupg_fd_t);
+ gpg_error_t agent_modify_description (const char *in, const char *comment,
+ const gcry_sexp_t key, char **result);
+ int agent_write_private_key (const unsigned char *grip,
+- const void *buffer, size_t length, int force,
++ const void *buffer, size_t length,
++ int force, int reallyforce,
+ const char *serialno, const char *keyref,
+ const char *dispserialno, time_t timestamp);
+ gpg_error_t agent_key_from_file (ctrl_t ctrl,
+@@ -548,6 +549,7 @@ gpg_error_t s2k_hash_passphrase (const char *passphrase, int hashalgo,
+ gpg_error_t agent_write_shadow_key (const unsigned char *grip,
+ const char *serialno, const char *keyid,
+ const unsigned char *pkbuf, int force,
++ int reallyforce,
+ const char *dispserialno);
+
+
+@@ -628,7 +630,8 @@ void agent_card_killscd (void);
+
+
+ /*-- learncard.c --*/
+-int agent_handle_learn (ctrl_t ctrl, int send, void *assuan_context, int force);
++int agent_handle_learn (ctrl_t ctrl, int send, void *assuan_context,
++ int force, int reallyforce);
+
+
+ /*-- cvt-openpgp.c --*/
+--- a/agent/command-ssh.c
++++ b/agent/command-ssh.c
+@@ -2499,7 +2499,7 @@ card_key_available (ctrl_t ctrl, gcry_sexp_t *r_pk, char **cardsn)
+
+ /* (Shadow)-key is not available in our key storage. */
+ agent_card_getattr (ctrl, "$DISPSERIALNO", &dispserialno);
+- err = agent_write_shadow_key (grip, serialno, authkeyid, pkbuf, 0,
++ err = agent_write_shadow_key (grip, serialno, authkeyid, pkbuf, 0, 0,
+ dispserialno);
+ xfree (dispserialno);
+ if (err)
+@@ -3159,7 +3159,7 @@ ssh_identity_register (ctrl_t ctrl, ssh_key_type_spec_t *spec,
+
+ /* Store this key to our key storage. We do not store a creation
+ * timestamp because we simply do not know. */
+- err = agent_write_private_key (key_grip_raw, buffer, buffer_n, 0,
++ err = agent_write_private_key (key_grip_raw, buffer, buffer_n, 0, 0,
+ NULL, NULL, NULL, 0);
+ if (err)
+ goto out;
+--- a/agent/command.c
++++ b/agent/command.c
+@@ -1042,7 +1042,7 @@ cmd_readkey (assuan_context_t ctx, char *line)
+ /* Shadow-key is or is not available in our key storage. In
+ * any case we need to check whether we need to update with
+ * a new display-s/n or whatever. */
+- rc = agent_write_shadow_key (grip, serialno, keyid, pkbuf, 0,
++ rc = agent_write_shadow_key (grip, serialno, keyid, pkbuf, 0, 0,
+ dispserialno);
+ if (rc)
+ goto leave;
+@@ -1855,16 +1855,18 @@ cmd_learn (assuan_context_t ctx, char *line)
+ {
+ ctrl_t ctrl = assuan_get_pointer (ctx);
+ gpg_error_t err;
+- int send, sendinfo, force;
++ int send, sendinfo, force, reallyforce;
+
+ send = has_option (line, "--send");
+ sendinfo = send? 1 : has_option (line, "--sendinfo");
+ force = has_option (line, "--force");
++ reallyforce = has_option (line, "--reallyforce");
+
+ if (ctrl->restricted)
+ return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));
+
+- err = agent_handle_learn (ctrl, send, sendinfo? ctx : NULL, force);
++ err = agent_handle_learn (ctrl, send, sendinfo? ctx : NULL,
++ force, reallyforce);
+ return leave_cmd (ctx, err);
+ }
+
+@@ -2427,11 +2429,11 @@ cmd_import_key (assuan_context_t ctx, char *line)
+ err = agent_protect (key, passphrase, &finalkey, &finalkeylen,
+ ctrl->s2k_count);
+ if (!err)
+- err = agent_write_private_key (grip, finalkey, finalkeylen, force,
++ err = agent_write_private_key (grip, finalkey, finalkeylen, force, 0,
+ NULL, NULL, NULL, opt_timestamp);
+ }
+ else
+- err = agent_write_private_key (grip, key, realkeylen, force,
++ err = agent_write_private_key (grip, key, realkeylen, force, 0,
+ NULL, NULL, NULL, opt_timestamp);
+
+ leave:
+--- a/agent/cvt-openpgp.c
++++ b/agent/cvt-openpgp.c
+@@ -1070,7 +1070,7 @@ convert_from_openpgp_native (ctrl_t ctrl,
+ &protectedkey, &protectedkeylen,
+ ctrl->s2k_count))
+ agent_write_private_key (grip, protectedkey, protectedkeylen,
+- 1/*force*/, NULL, NULL, NULL, 0);
++ 1/*force*/, 0, NULL, NULL, NULL, 0);
+ xfree (protectedkey);
+ }
+ else
+@@ -1079,7 +1079,7 @@ convert_from_openpgp_native (ctrl_t ctrl,
+ agent_write_private_key (grip,
+ *r_key,
+ gcry_sexp_canon_len (*r_key, 0, NULL,NULL),
+- 1/*force*/, NULL, NULL, NULL, 0);
++ 1/*force*/, 0, NULL, NULL, NULL, 0);
+ }
+ }
+
+--- a/agent/findkey.c
++++ b/agent/findkey.c
+@@ -82,7 +82,8 @@ fname_from_keygrip (const unsigned char *grip, int for_new)
+ * recorded as creation date. */
+ int
+ agent_write_private_key (const unsigned char *grip,
+- const void *buffer, size_t length, int force,
++ const void *buffer, size_t length,
++ int force, int reallyforce,
+ const char *serialno, const char *keyref,
+ const char *dispserialno,
+ time_t timestamp)
+@@ -165,10 +166,13 @@ agent_write_private_key (const unsigned char *grip,
+ /* Check that we do not update a regular key with a shadow key. */
+ if (is_regular && gpg_err_code (is_shadowed_key (key)) == GPG_ERR_TRUE)
+ {
+- log_info ("updating regular key file '%s'"
+- " by a shadow key inhibited\n", oldfname);
+- err = 0; /* Simply ignore the error. */
+- goto leave;
++ if (!reallyforce)
++ {
++ log_info ("updating regular key file '%s'"
++ " by a shadow key inhibited\n", oldfname);
++ err = 0; /* Simply ignore the error. */
++ goto leave;
++ }
+ }
+ /* Check that we update a regular key only in force mode. */
+ if (is_regular && !force)
+@@ -1704,12 +1708,13 @@ agent_delete_key (ctrl_t ctrl, const char *desc_text,
+ * Shadow key is created by an S-expression public key in PKBUF and
+ * card's SERIALNO and the IDSTRING. With FORCE passed as true an
+ * existing key with the given GRIP will get overwritten. If
+- * DISPSERIALNO is not NULL the human readable s/n will also be
+- * recorded in the key file. */
++ * REALLYFORCE is also true, even a private key will be overwritten by
++ * a shadown key. If DISPSERIALNO is not NULL the human readable s/n
++ * will also be recorded in the key file. */
+ gpg_error_t
+ agent_write_shadow_key (const unsigned char *grip,
+ const char *serialno, const char *keyid,
+- const unsigned char *pkbuf, int force,
++ const unsigned char *pkbuf, int force, int reallyforce,
+ const char *dispserialno)
+ {
+ gpg_error_t err;
+@@ -1737,7 +1742,7 @@ agent_write_shadow_key (const unsigned char *grip,
+ }
+
+ len = gcry_sexp_canon_len (shdkey, 0, NULL, NULL);
+- err = agent_write_private_key (grip, shdkey, len, force,
++ err = agent_write_private_key (grip, shdkey, len, force, reallyforce,
+ serialno, keyid, dispserialno, 0);
+ xfree (shdkey);
+ if (err)
+--- a/agent/genkey.c
++++ b/agent/genkey.c
+@@ -69,7 +69,7 @@ store_key (gcry_sexp_t private, const char *passphrase, int force,
+ buf = p;
+ }
+
+- rc = agent_write_private_key (grip, buf, len, force,
++ rc = agent_write_private_key (grip, buf, len, force, 0,
+ NULL, NULL, NULL, timestamp);
+ xfree (buf);
+ return rc;
+--- a/agent/learncard.c
++++ b/agent/learncard.c
+@@ -297,9 +297,12 @@ send_cert_back (ctrl_t ctrl, const char *id, void *assuan_context)
+ }
+
+ /* Perform the learn operation. If ASSUAN_CONTEXT is not NULL and
+- SEND is true all new certificates are send back via Assuan. */
++ SEND is true all new certificates are send back via Assuan. If
++ REALLYFORCE is true a private key will be overwritten by a stub
++ key. */
+ int
+-agent_handle_learn (ctrl_t ctrl, int send, void *assuan_context, int force)
++agent_handle_learn (ctrl_t ctrl, int send, void *assuan_context,
++ int force, int reallyforce)
+ {
+ int rc;
+ struct kpinfo_cb_parm_s parm;
+@@ -414,7 +417,7 @@ agent_handle_learn (ctrl_t ctrl, int send, void *assuan_context, int force)
+
+ agent_card_getattr (ctrl, "$DISPSERIALNO", &dispserialno);
+ rc = agent_write_shadow_key (grip, serialno, item->id, pubkey,
+- force, dispserialno);
++ force, reallyforce, dispserialno);
+ xfree (dispserialno);
+ }
+ xfree (pubkey);
+--- a/agent/protect-tool.c
++++ b/agent/protect-tool.c
+@@ -807,13 +807,15 @@ agent_askpin (ctrl_t ctrl,
+ * to stdout. */
+ int
+ agent_write_private_key (const unsigned char *grip,
+- const void *buffer, size_t length, int force,
++ const void *buffer, size_t length,
++ int force, int reallyforce,
+ const char *serialno, const char *keyref,
+ const char *dispserialno, time_t timestamp)
+ {
+ char hexgrip[40+4+1];
+ char *p;
+
++ (void)reallyforce;
+ (void)force;
+ (void)timestamp;
+ (void)serialno;
+--- a/g10/call-agent.c
++++ b/g10/call-agent.c
+@@ -745,6 +745,11 @@ learn_status_cb (void *opaque, const char *line)
+ * card-util.c
+ * keyedit_menu
+ * card_store_key_with_backup (Woth force to remove secret key data)
++ *
++ * If force has the value 2 the --reallyforce option is also used.
++ * This is to make sure the sshadow key overwrites the private key.
++ * Note that this option is gnupg 2.2 specific because since 2.4.4 an
++ * ephemeral private key store is used instead.
+ */
+ int
+ agent_scd_learn (struct agent_card_info_s *info, int force)
+@@ -764,6 +769,7 @@ agent_scd_learn (struct agent_card_info_s *info, int force)
+
+ parm.ctx = agent_ctx;
+ rc = assuan_transact (agent_ctx,
++ force == 2? "LEARN --sendinfo --force --reallyforce" :
+ force ? "LEARN --sendinfo --force" : "LEARN --sendinfo",
+ dummy_data_cb, NULL, default_inq_cb, &parm,
+ learn_status_cb, info);
+--- a/g10/keygen.c
++++ b/g10/keygen.c
+@@ -5201,8 +5201,11 @@ card_store_key_with_backup (ctrl_t ctrl, PKT_public_key *sub_psk,
+ if (err)
+ log_error ("writing card key to backup file: %s\n", gpg_strerror (err));
+ else
+- /* Remove secret key data in agent side. */
+- agent_scd_learn (NULL, 1);
++ {
++ /* Remove secret key data in agent side. We use force 2 here to
++ * allow overwriting of the temporary private key. */
++ agent_scd_learn (NULL, 2);
++ }
+
+ leave:
+ xfree (ecdh_param_str);
+--
+2.30.2
diff --git a/app-crypt/gnupg/files/gnupg-2.2.42-dirmngr-proxy.patch b/app-crypt/gnupg/files/gnupg-2.2.42-dirmngr-proxy.patch
new file mode 100644
index 000000000000..21be675adef4
--- /dev/null
+++ b/app-crypt/gnupg/files/gnupg-2.2.42-dirmngr-proxy.patch
@@ -0,0 +1,156 @@
+https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=d6c428699db7aa20f8b6ca9fe83197a0314b7e91
+https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=c33c4fdf10b7ed9e03f2afe988d93f3085b727aa
+https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=41c022072599bc3f12f659e962653548cd86fa3a
+
+From d6c428699db7aa20f8b6ca9fe83197a0314b7e91 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Thu, 15 Feb 2024 15:38:34 +0900
+Subject: [PATCH] dirmngr: Fix proxy with TLS.
+
+* dirmngr/http.c (proxy_get_token, run_proxy_connect): Always
+available regardless of USE_TLS.
+(send_request): Remove USE_TLS.
+
+--
+
+Since quite some time building w/o TLS won't work.
+
+GnuPG-bug-id: 6997
+--- a/dirmngr/http.c
++++ b/dirmngr/http.c
+@@ -2498,9 +2498,7 @@ proxy_get_token (proxy_info_t proxy, const char *inputstring)
+ }
+
+
+-
+ /* Use the CONNECT method to proxy our TLS stream. */
+-#ifdef USE_TLS
+ static gpg_error_t
+ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ const char *httphost, const char *server,
+@@ -2709,7 +2707,6 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ xfree (tmpstr);
+ return err;
+ }
+-#endif /*USE_TLS*/
+
+
+ /* Make a request string using a standard proxy. On success the
+@@ -2866,7 +2863,6 @@ send_request (http_t hd, const char *httphost, const char *auth,
+ goto leave;
+ }
+
+-#if USE_TLS
+ if (use_http_proxy && hd->uri->use_tls)
+ {
+ err = run_proxy_connect (hd, proxy, httphost, server, port);
+@@ -2878,7 +2874,6 @@ send_request (http_t hd, const char *httphost, const char *auth,
+ * clear the flag to indicate this. */
+ use_http_proxy = 0;
+ }
+-#endif /* USE_TLS */
+
+ #if HTTP_USE_NTBTLS
+ err = run_ntbtls_handshake (hd);
+--
+2.30.2
+
+From c33c4fdf10b7ed9e03f2afe988d93f3085b727aa Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Fri, 16 Feb 2024 11:31:37 +0900
+Subject: [PATCH] dirmngr: Fix the regression of use of proxy for TLS
+ connection.
+
+* dirmngr/http.c (run_proxy_connect): Don't set keep_alive, since it
+causes resource leak of FP_WRITE.
+Don't try to read response body to fix the hang.
+
+--
+
+GnuPG-bug-id: 6997
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+--- a/dirmngr/http.c
++++ b/dirmngr/http.c
+@@ -2520,6 +2520,7 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ * RFC-4559 - SPNEGO-based Kerberos and NTLM HTTP Authentication
+ */
+ auth_basic = !!proxy->uri->auth;
++ hd->keep_alive = 0;
+
+ /* For basic authentication we need to send just one request. */
+ if (auth_basic
+@@ -2541,13 +2542,12 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ httphost ? httphost : server,
+ port,
+ authhdr ? authhdr : "",
+- auth_basic? "" : "Connection: keep-alive\r\n");
++ hd->keep_alive? "Connection: keep-alive\r\n" : "");
+ if (!request)
+ {
+ err = gpg_error_from_syserror ();
+ goto leave;
+ }
+- hd->keep_alive = !auth_basic; /* We may need to send more requests. */
+
+ if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP))
+ log_debug_with_string (request, "http.c:proxy:request:");
+@@ -2574,16 +2574,6 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ if (err)
+ goto leave;
+
+- {
+- unsigned long count = 0;
+-
+- while (es_getc (hd->fp_read) != EOF)
+- count++;
+- if (opt_debug)
+- log_debug ("http.c:proxy_connect: skipped %lu bytes of response-body\n",
+- count);
+- }
+-
+ /* Reset state. */
+ es_clearerr (hd->fp_read);
+ ((cookie_t)(hd->read_cookie))->up_to_empty_line = 1;
+--
+2.30.2
+
+From 41c022072599bc3f12f659e962653548cd86fa3a Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Fri, 16 Feb 2024 16:24:26 +0900
+Subject: [PATCH] dirmngr: Fix keep-alive flag handling.
+
+* dirmngr/http.c (run_proxy_connect): Set KEEP_ALIVE if not Basic
+Authentication. Fix resource leak of FP_WRITE.
+
+--
+
+GnuPG-bug-id: 6997
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+--- a/dirmngr/http.c
++++ b/dirmngr/http.c
+@@ -2520,7 +2520,7 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ * RFC-4559 - SPNEGO-based Kerberos and NTLM HTTP Authentication
+ */
+ auth_basic = !!proxy->uri->auth;
+- hd->keep_alive = 0;
++ hd->keep_alive = !auth_basic; /* We may need to send more requests. */
+
+ /* For basic authentication we need to send just one request. */
+ if (auth_basic
+@@ -2684,6 +2684,14 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ }
+
+ leave:
++ if (hd->keep_alive)
++ {
++ es_fclose (hd->fp_write);
++ hd->fp_write = NULL;
++ /* The close has released the cookie and thus we better set it
++ * to NULL. */
++ hd->write_cookie = NULL;
++ }
+ /* Restore flags, destroy stream, reset state. */
+ hd->flags = saved_flags;
+ es_fclose (hd->fp_read);
+--
+2.30.2
diff --git a/app-crypt/gnupg/files/gnupg-2.2.42-gpgme-tests.patch b/app-crypt/gnupg/files/gnupg-2.2.42-gpgme-tests.patch
new file mode 100644
index 000000000000..f10154b303e5
--- /dev/null
+++ b/app-crypt/gnupg/files/gnupg-2.2.42-gpgme-tests.patch
@@ -0,0 +1,39 @@
+https://bugs.gentoo.org/924386
+https://dev.gnupg.org/T7003
+https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=f50c543326c2eea6b40f548d61cf3a66a077bf54
+
+From f50c543326c2eea6b40f548d61cf3a66a077bf54 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Fri, 1 Mar 2024 13:59:43 +0900
+Subject: [PATCH] agent: Allow simple KEYINFO command when restricted.
+
+* agent/command.c (cmd_keyinfo): Only forbid list command.
+
+--
+
+GnuPG-bug-id: 7003
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+--- a/agent/command.c
++++ b/agent/command.c
+@@ -1282,9 +1282,6 @@ cmd_keyinfo (assuan_context_t ctx, char *line)
+ char hexgrip[41];
+ int disabled, ttl, confirm, is_ssh;
+
+- if (ctrl->restricted)
+- return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));
+-
+ if (has_option (line, "--ssh-list"))
+ list_mode = 2;
+ else
+@@ -1333,6 +1330,9 @@ cmd_keyinfo (assuan_context_t ctx, char *line)
+ char *dirname;
+ gnupg_dirent_t dir_entry;
+
++ if (ctrl->restricted)
++ return leave_cmd (ctx, gpg_error (GPG_ERR_FORBIDDEN));
++
+ dirname = make_filename_try (gnupg_homedir (),
+ GNUPG_PRIVATE_KEYS_DIR, NULL);
+ if (!dirname)
+--
+2.30.2
diff --git a/app-crypt/gnupg/files/gnupg-2.3.7-yubikey-workaround-fix.patch b/app-crypt/gnupg/files/gnupg-2.3.7-yubikey-workaround-fix.patch
deleted file mode 100644
index 94062c885b5b..000000000000
--- a/app-crypt/gnupg/files/gnupg-2.3.7-yubikey-workaround-fix.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=f34b9147eb3070bce80d53febaa564164cd6c977
-
-From f34b9147eb3070bce80d53febaa564164cd6c977 Mon Sep 17 00:00:00 2001
-From: NIIBE Yutaka <gniibe@fsij.org>
-Date: Wed, 13 Jul 2022 10:40:55 +0900
-Subject: [PATCH] scd:openpgp: Fix workaround for Yubikey heuristics.
-
-* scd/app-openpgp.c (parse_algorithm_attribute): Handle the case
-of firmware 5.4, too.
-
---
-
-GnuPG-bug-id: 6070
-Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
---- a/scd/app-openpgp.c
-+++ b/scd/app-openpgp.c
-@@ -6259,15 +6259,28 @@ parse_algorithm_attribute (app_t app, int keyno)
- app->app_local->keyattr[keyno].ecc.algo = *buffer;
- app->app_local->keyattr[keyno].ecc.flags = 0;
-
-- if (APP_CARD(app)->cardtype == CARDTYPE_YUBIKEY
-- || buffer[buflen-1] == 0x00 || buffer[buflen-1] == 0xff)
-- { /* Found "pubkey required"-byte for private key template. */
-- oidlen--;
-- if (buffer[buflen-1] == 0xff)
-- app->app_local->keyattr[keyno].ecc.flags |= ECC_FLAG_PUBKEY;
-+ if (APP_CARD(app)->cardtype == CARDTYPE_YUBIKEY)
-+ {
-+ /* Yubikey implementations vary.
-+ * Firmware version 5.2 returns "pubkey required"-byte with
-+ * 0x00, but after removal and second time insertion, it
-+ * returns bogus value there.
-+ * Firmware version 5.4 returns none.
-+ */
-+ curve = ecc_curve (buffer + 1, oidlen);
-+ if (!curve)
-+ curve = ecc_curve (buffer + 1, oidlen - 1);
-+ }
-+ else
-+ {
-+ if (buffer[buflen-1] == 0x00 || buffer[buflen-1] == 0xff)
-+ { /* Found "pubkey required"-byte for private key template. */
-+ oidlen--;
-+ if (buffer[buflen-1] == 0xff)
-+ app->app_local->keyattr[keyno].ecc.flags |= ECC_FLAG_PUBKEY;
-+ }
-+ curve = ecc_curve (buffer + 1, oidlen);
- }
--
-- curve = ecc_curve (buffer + 1, oidlen);
-
- if (!curve)
- {
diff --git a/app-crypt/gnupg/files/gnupg-2.4.4-dirmngr-proxy.patch b/app-crypt/gnupg/files/gnupg-2.4.4-dirmngr-proxy.patch
new file mode 100644
index 000000000000..686a3aadc8dd
--- /dev/null
+++ b/app-crypt/gnupg/files/gnupg-2.4.4-dirmngr-proxy.patch
@@ -0,0 +1,202 @@
+https://bugs.gentoo.org/924606
+https://dev.gnupg.org/T6997
+https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=04cbc3074aa98660b513a80f623a7e9f0702c7c9
+https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=848546b05ab0ff6abd47724ecfab73bf32dd4c01
+https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=2810b934647edd483996bee1f5f9256a162b2705
+
+From 6236978d78886cbb476ed9fbc49ff99c7582b2d7 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Thu, 15 Feb 2024 15:38:34 +0900
+Subject: [PATCH 1/3] dirmngr: Fix proxy with TLS.
+
+* dirmngr/http.c (proxy_get_token, run_proxy_connect): Always
+available regardless of USE_TLS.
+(run_proxy_connect): Use log_debug_string.
+(send_request): Remove USE_TLS.
+
+--
+
+Since the commit of
+
+ 1009e4e5f71347a1fe194e59a9d88c8034a67016
+
+Building with TLS library is mandatory.
+
+GnuPG-bug-id: 6997
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+---
+ dirmngr/http.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/dirmngr/http.c b/dirmngr/http.c
+index 4899a5d55..10eecfdb0 100644
+--- a/dirmngr/http.c
++++ b/dirmngr/http.c
+@@ -2362,7 +2362,6 @@ run_gnutls_handshake (http_t hd, const char *server)
+ * NULL, decode the string and use this as input from teh server. On
+ * success the final output token is stored at PROXY->OUTTOKEN and
+ * OUTTOKLEN. IF the authentication succeeded OUTTOKLEN is zero. */
+-#ifdef USE_TLS
+ static gpg_error_t
+ proxy_get_token (proxy_info_t proxy, const char *inputstring)
+ {
+@@ -2530,11 +2529,9 @@ proxy_get_token (proxy_info_t proxy, const char *inputstring)
+
+ #endif /*!HAVE_W32_SYSTEM*/
+ }
+-#endif /*USE_TLS*/
+
+
+ /* Use the CONNECT method to proxy our TLS stream. */
+-#ifdef USE_TLS
+ static gpg_error_t
+ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ const char *httphost, const char *server,
+@@ -2586,7 +2583,7 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ hd->keep_alive = !auth_basic; /* We may need to send more requests. */
+
+ if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP))
+- log_debug_with_string (request, "http.c:proxy:request:");
++ log_debug_string (request, "http.c:proxy:request:");
+
+ if (!hd->fp_write)
+ {
+@@ -2743,7 +2740,6 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ xfree (tmpstr);
+ return err;
+ }
+-#endif /*USE_TLS*/
+
+
+ /* Make a request string using a standard proxy. On success the
+@@ -2903,7 +2899,6 @@ send_request (ctrl_t ctrl,
+ goto leave;
+ }
+
+-#if USE_TLS
+ if (use_http_proxy && hd->uri->use_tls)
+ {
+ err = run_proxy_connect (hd, proxy, httphost, server, port);
+@@ -2915,7 +2910,6 @@ send_request (ctrl_t ctrl,
+ * clear the flag to indicate this. */
+ use_http_proxy = 0;
+ }
+-#endif /* USE_TLS */
+
+ #if HTTP_USE_NTBTLS
+ err = run_ntbtls_handshake (hd);
+--
+2.43.2
+
+From 68650eb6999e674fd2f1c78f47b68d3cd1d37ff0 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Fri, 16 Feb 2024 11:31:37 +0900
+Subject: [PATCH 2/3] dirmngr: Fix the regression of use of proxy for TLS
+ connection.
+
+* dirmngr/http.c (run_proxy_connect): Don't set keep_alive, since it
+causes resource leak of FP_WRITE.
+Don't try to read response body to fix the hang.
+
+--
+
+GnuPG-bug-id: 6997
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+---
+ dirmngr/http.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/dirmngr/http.c b/dirmngr/http.c
+index 10eecfdb0..7ce01bacd 100644
+--- a/dirmngr/http.c
++++ b/dirmngr/http.c
+@@ -2553,6 +2553,7 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ * RFC-4559 - SPNEGO-based Kerberos and NTLM HTTP Authentication
+ */
+ auth_basic = !!proxy->uri->auth;
++ hd->keep_alive = 0;
+
+ /* For basic authentication we need to send just one request. */
+ if (auth_basic
+@@ -2574,13 +2575,12 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ httphost ? httphost : server,
+ port,
+ authhdr ? authhdr : "",
+- auth_basic? "" : "Connection: keep-alive\r\n");
++ hd->keep_alive? "Connection: keep-alive\r\n" : "");
+ if (!request)
+ {
+ err = gpg_error_from_syserror ();
+ goto leave;
+ }
+- hd->keep_alive = !auth_basic; /* We may need to send more requests. */
+
+ if (opt_debug || (hd->flags & HTTP_FLAG_LOG_RESP))
+ log_debug_string (request, "http.c:proxy:request:");
+@@ -2607,16 +2607,6 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ if (err)
+ goto leave;
+
+- {
+- unsigned long count = 0;
+-
+- while (es_getc (hd->fp_read) != EOF)
+- count++;
+- if (opt_debug)
+- log_debug ("http.c:proxy_connect: skipped %lu bytes of response-body\n",
+- count);
+- }
+-
+ /* Reset state. */
+ es_clearerr (hd->fp_read);
+ ((cookie_t)(hd->read_cookie))->up_to_empty_line = 1;
+--
+2.43.2
+
+From 7c7cbd94549d08780fc3767d6de8336b3f44e7d7 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gniibe@fsij.org>
+Date: Fri, 16 Feb 2024 16:24:26 +0900
+Subject: [PATCH 3/3] dirmngr: Fix keep-alive flag handling.
+
+* dirmngr/http.c (run_proxy_connect): Set KEEP_ALIVE if not Basic
+Authentication. Fix resource leak of FP_WRITE.
+
+--
+
+GnuPG-bug-id: 6997
+Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>
+---
+ dirmngr/http.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/dirmngr/http.c b/dirmngr/http.c
+index 7ce01bacd..da0c89ae5 100644
+--- a/dirmngr/http.c
++++ b/dirmngr/http.c
+@@ -2553,7 +2553,7 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ * RFC-4559 - SPNEGO-based Kerberos and NTLM HTTP Authentication
+ */
+ auth_basic = !!proxy->uri->auth;
+- hd->keep_alive = 0;
++ hd->keep_alive = !auth_basic; /* We may need to send more requests. */
+
+ /* For basic authentication we need to send just one request. */
+ if (auth_basic
+@@ -2717,6 +2717,14 @@ run_proxy_connect (http_t hd, proxy_info_t proxy,
+ }
+
+ leave:
++ if (hd->keep_alive)
++ {
++ es_fclose (hd->fp_write);
++ hd->fp_write = NULL;
++ /* The close has released the cookie and thus we better set it
++ * to NULL. */
++ hd->write_cookie = NULL;
++ }
+ /* Restore flags, destroy stream, reset state. */
+ hd->flags = saved_flags;
+ es_fclose (hd->fp_read);
+--
+2.43.2
+
diff --git a/app-crypt/gnupg/files/gpg-agent-browser.socket b/app-crypt/gnupg/files/gpg-agent-browser.socket
new file mode 100644
index 000000000000..bc8d344e1f2d
--- /dev/null
+++ b/app-crypt/gnupg/files/gpg-agent-browser.socket
@@ -0,0 +1,13 @@
+[Unit]
+Description=GnuPG cryptographic agent and passphrase cache (access for web browsers)
+Documentation=man:gpg-agent(1)
+
+[Socket]
+ListenStream=%t/gnupg/S.gpg-agent.browser
+FileDescriptorName=browser
+Service=gpg-agent.service
+SocketMode=0600
+DirectoryMode=0700
+
+[Install]
+WantedBy=sockets.target
diff --git a/app-crypt/gnupg/files/gpg-agent-extra.socket b/app-crypt/gnupg/files/gpg-agent-extra.socket
new file mode 100644
index 000000000000..5b87d09dfa2a
--- /dev/null
+++ b/app-crypt/gnupg/files/gpg-agent-extra.socket
@@ -0,0 +1,13 @@
+[Unit]
+Description=GnuPG cryptographic agent and passphrase cache (restricted)
+Documentation=man:gpg-agent(1)
+
+[Socket]
+ListenStream=%t/gnupg/S.gpg-agent.extra
+FileDescriptorName=extra
+Service=gpg-agent.service
+SocketMode=0600
+DirectoryMode=0700
+
+[Install]
+WantedBy=sockets.target
diff --git a/app-crypt/gnupg/files/gpg-agent-ssh.socket b/app-crypt/gnupg/files/gpg-agent-ssh.socket
new file mode 100644
index 000000000000..798c1d967595
--- /dev/null
+++ b/app-crypt/gnupg/files/gpg-agent-ssh.socket
@@ -0,0 +1,13 @@
+[Unit]
+Description=GnuPG cryptographic agent (ssh-agent emulation)
+Documentation=man:gpg-agent(1) man:ssh-add(1) man:ssh-agent(1) man:ssh(1)
+
+[Socket]
+ListenStream=%t/gnupg/S.gpg-agent.ssh
+FileDescriptorName=ssh
+Service=gpg-agent.service
+SocketMode=0600
+DirectoryMode=0700
+
+[Install]
+WantedBy=sockets.target
diff --git a/app-crypt/gnupg/files/gpg-agent.service b/app-crypt/gnupg/files/gpg-agent.service
new file mode 100644
index 000000000000..a050fccdc527
--- /dev/null
+++ b/app-crypt/gnupg/files/gpg-agent.service
@@ -0,0 +1,8 @@
+[Unit]
+Description=GnuPG cryptographic agent and passphrase cache
+Documentation=man:gpg-agent(1)
+Requires=gpg-agent.socket
+
+[Service]
+ExecStart=/usr/bin/gpg-agent --supervised
+ExecReload=/usr/bin/gpgconf --reload gpg-agent
diff --git a/app-crypt/gnupg/files/gpg-agent.socket b/app-crypt/gnupg/files/gpg-agent.socket
new file mode 100644
index 000000000000..4257c2c80f18
--- /dev/null
+++ b/app-crypt/gnupg/files/gpg-agent.socket
@@ -0,0 +1,12 @@
+[Unit]
+Description=GnuPG cryptographic agent and passphrase cache
+Documentation=man:gpg-agent(1)
+
+[Socket]
+ListenStream=%t/gnupg/S.gpg-agent
+FileDescriptorName=std
+SocketMode=0600
+DirectoryMode=0700
+
+[Install]
+WantedBy=sockets.target