FreePG Project

freepg@infosec.exchange

FreePG maintains a shared patchset for <a href="https://infosec.exchange/tags/GnuPG" class="mention hashtag" rel="tag">#GnuPG</a> downstream packagers to track, maintain, and apply commonly-used patches. The project goals are:* Minimise divergence from the IETF <a href="https://infosec.exchange/tags/OpenPGP" class="mention hashtag" rel="tag">#OpenPGP</a> specification * Support reading of LibrePGP artifacts for compatibility * Fix security issues that remain unresolved upstream * Support the maintenance needs of downstream distributions

Posts

View post
#GnuPG 2.4.9-freepg has been released. It contains all the latest bug fixes from upstream GnuPG, plus the usual FreePG patches. In addition, a fix for the default filename path traversal issue identified by #gpgfail has been backported from upstream 2.5.16 (https://gpg.fail/filename) https://gitlab.com/freepg/gnupg/-/releases/gnupg-2.4.9-freepg
View post
#GnuPG 2.5.16-freepg has been released. It contains all the latest bug fixes from upstream GnuPG, plus the usual FreePG patches. Note that the FreePG project considers the 2.5.x branch to be experimental, and does not enable non-standard OpenPGP algorithms unless “--compliance=gnupg” is explicitly set. https://gitlab.com/freepg/gnupg/-/releases/gnupg-2.5.16-freepg
View post
#GnuPG 2.5.17-freepg has been released. It contains all the latest bug fixes from upstream GnuPG, plus the usual FreePG patches. * This release contains a fix for a critical buffer overflow vulnerability in GnuPG &gt;= 2.5.13 - see upstream&#39;s release notes for full details. Note that the FreePG project considers the 2.5.x branch to be experimental, and does not enable non-standard OpenPGP algorithms unless “--compliance=gnupg” is explicitly set. https://gitlab.com/freepg/gnupg/-/...
View post
#GnuPG 2.5.18-freepg has been released. It contains all the latest bug fixes from upstream GnuPG, plus the usual FreePG patches. This release also contains fixes for additional gpg.fail issues that remain unfixed upstream: * skip trust packets during import-restore (https://gpg.fail/trust) * compat ignore truncated line (https://gpg.fail/formfeed) * fail on unprintable armor headers (https://gpg.fail/nullbyte https://gpg.fail/notdash) Note that the FreePG project considers the 2.5.x branch t...
View post
#GnuPG 2.2.53-freepg has been released. It contains all the latest bug fixes from upstream GnuPG, plus the usual FreePG patches. In addition, a fix for the default filename path traversal issue identified by #gpgfail has been backported from upstream 2.5.16 (gpg.fail/filename) https://gitlab.com/freepg/gnupg/-/releases/gnupg-2.2.53-freepg
View post
#GnuPG 2.2.54-freepg has been released. It contains all the latest bug fixes from upstream GnuPG, plus the usual FreePG patches. Release Notes ============= ## Noteworthy changes in version 2.2.54-freepg (2026-04-24) * No FreePG-specific changes. https://gitlab.com/freepg/gnupg/-/releases/gnupg-2.2.54-freepg Upstream&#39;s release notes follow. ------------- ## Noteworthy changes in version 2.2.54 (2026-04-20) * gpg: Fix an edge case in --refresh-keys. [T8197] * gpgsm: Add a certi...
View post
#GnuPG 2.5.20-freepg has been released. It contains all the latest bug fixes from upstream GnuPG, plus the usual FreePG patches. Note that the FreePG project considers the 2.5.x branch to be experimental, and does not enable non-standard OpenPGP algorithms unless “--compliance=gnupg” is explicitly set. Release notes ============= Noteworthy changes in version 2.5.20-freepg (2026-05-15) -------------------------------------------------------- * No FreePG-specific changes. https://gitlab.com...
View post
#GnuPG 2.5.21-freepg has been released. It contains all the latest bug fixes from upstream GnuPG, plus the usual FreePG patches. Note that the FreePG project considers the 2.5.x branch to be experimental, and does not enable non-standard OpenPGP algorithms unless “--compliance=gnupg” is explicitly set. Release notes ============= Noteworthy changes in version 2.5.21-freepg (2026-07-03) -------------------------------------------------------- * No FreePG-specific changes. https://gitlab.com...
View post
RE: https://mstdn.social/@GnuPG/117325390897443867 Great to see RFC9980 support (which also implies RFC9580 support) landing in #GnuPG. Congratulations to the team on their hard work! 🚀 Unlike upstream GnuPG, the FreePG project does not encourage use of &quot;LibrePGP Kyber&quot;, especially now that RFC9980 has been implemented. It is important to remember that there are no differences in the security properties between &quot;LibrePGP Kyber&quot; and RFC9980, but RFC9980 is i...
View post
#GnuPG 2.4.9-freepg-1 has been released. It contains backported bugfixes from upstream GnuPG 2.5.x, plus all the previous FreePG patches. Since 31st of December last year, upstream GnuPG is no longer providing bugfix releases for the 2.4.x branch, in an attempt to encourage people to upgrade to 2.5.x. The FreePG project considers the 2.5.x branch to be experimental, primarily due to its use of non-OpenPGP algorithms by default, and is continuing to support 2.4.x by porting bugfixes from the 2....
View post
#GnuPG 2.5.19-freepg has been released. It contains all the latest bug fixes from upstream GnuPG, plus the usual FreePG patches. Note that the FreePG project considers the 2.5.x branch to be experimental, and does not enable non-standard OpenPGP algorithms unless “--compliance=gnupg” is explicitly set. Release Notes ============= Noteworthy changes in version 2.5.19-freepg (2026-04-30) ------------------------------------------------- * No FreePG-specific changes. https://gitlab.com/freep...
View post
FreePG now has a public mailing list for general discussion and formal decision-making. Thanks to simplelists.com for their kind sponsorship! https://openpgp.simplelists.com/freepg