#gnupg

Zero days since it turned out that #GnuPG has arbitrarily changed behavior between versions in the name of "safe default", and required you to pass an additional option to make it behave properly in the rare cases it matters. Of course we still need to support old versions and alternative implementations without that option. And of course there is no clean way of checking whether it's available or not. https://bugs.gentoo.org/983021 #OpenPGP #GPG #Gentoo

I'm glad I switched #HardenedBSD away from #GnuPG to #OpenSSH based (detached) signatures. Not saying there's zero bugs in OpenSSH, but it seems to me (with zero factual research) OpenSSH has a better overall security posture than the alternatives. #infosec #gpg

Apparently the so-called "schism" in #OpenPGP is over. Context: In 2022, an email to the IETF OpenPGP working group list, titled "a new draft overlapping the WG draft", noted that one implementation (GnuPG) seemed to reject the draft that is now RFC 9580: https://mailarchive.ietf.org/arch/msg/openpgp/PWp3ZcZ_qnDNLhuT-zR7gA2ddeg/ Today, the author of #GnuPG signaled on the IETF list that he intends to implement support for RFC 9580 and draft-ietf-openpgp-nist-bp-comp: https://mailarchive.ietf.org/arch/msg/openpgp/B7ytSFXTVW84UfFd4cCW-DXhpAA/ As I see it, this is great news for OpenPGP!

#GnuPG 2.4.9-freepg-1 has been released.

It contains backported bugfixes from upstream GnuPG 2.5.x, plus all the previous FreePG patches.

Since 31st of December last year, upstream GnuPG is no longer providing bugfix releases for the 2.4.x branch, in an attempt to encourage people to upgrade to 2.5.x. The FreePG project considers the 2.5.x branch to be experimental, primarily due to its use of non-OpenPGP algorithms by default, and is continuing to support 2.4.x by porting bugfixes from the 2.5.x and 2.2.x branches, which are both still maintained upstream.

Release Notes Noteworthy changes in version 2.4.9-freepg-1 (2026-07-02)

• Backported several bugfixes from 2.5:

  • dirmngr: Fix a call of calloc.
  • agent: Fix the regression in pkdecrypt with TPM RSA.
  • tpm: Fix possible buffer overflow in PKDECRYPT
  • gpg: Fix armor parsing when no CRC is found.
  • gpg: Fix armored input parsing.
  • gpg: Fix handling with no CRC armor.
  • gpgsm: Require a minimum tag length for GCM decryption.
  • gpg: Fix edge case in --refresh-keys

• Fixed several tests introduced by the "tests: add test cases for import without uid" patch.

https://gitlab.com/freepg/gnupg/-/releases/gnupg-2.4.9-freepg-1

News from #sydbox git: Starting next release, we're going to be signing binary releases with #OpenBSD signify rather than #GnuPG. To enable practical signing in #Exherbo #Gitlab CI, I wrote an #ISC licensed, pure portable #POSIX shell implementation of #OpenBSD signify. signify.sh has no external dependencies and runs with PATH=. It has unit tests embedded which may be run with --test option: https://gitlab.exherbo.org/sydbox/sydbox/-/raw/next/dev/signify.sh #exherbo #linux #security