1 /* gpg.c - The GnuPG utility (main for gpg)
2 * Copyright (C) 1998-2011 Free Software Foundation, Inc.
3 * Copyright (C) 1997-2016 Werner Koch
4 * Copyright (C) 2015-2016 g10 Code GmbH
6 * This file is part of GnuPG.
8 * GnuPG is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
13 * GnuPG is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <https://www.gnu.org/licenses/>.
30 #include <sys/stat.h> /* for stat() */
33 #ifdef HAVE_W32_SYSTEM
34 # ifdef HAVE_WINSOCK2_H
35 # include <winsock2.h>
40 #define INCLUDED_BY_MAIN_MODULE 1
43 #include "../common/iobuf.h"
56 #include "keyserver-internal.h"
58 #include "gc-opt-flags.h"
60 #include "call-dirmngr.h"
62 #include "../common/init.h"
63 #include "../common/mbox-util.h"
64 #include "../common/shareddefs.h"
66 #if defined(HAVE_DOSISH_SYSTEM) || defined(__CYGWIN__)
67 #define MY_O_BINARY O_BINARY
77 enum cmd_and_opt_values
86 oHiddenRecipientFile = 'F',
93 oHiddenRecipient = 'R',
100 aListSecretKeys = 'K',
135 aDeleteSecretAndPublicKeys,
192 oWithSubkeyFingerprint,
246 oBZ2DecompressLowmem,
271 oSkipHiddenRecipients,
272 oNoSkipHiddenRecipients,
285 oUseEmbeddedFilename,
286 oNoUseEmbeddedFilename,
323 oEncryptToDefaultKey,
330 oAllowNonSelfsignedUID,
331 oNoAllowNonSelfsignedUID,
334 oAllowSecretKeyImport,
335 oEnableSpecialFilenames,
347 oOverrideSessionKeyFD,
357 oNoExpensiveTrustChecks,
363 oPreservePermissions,
364 oDefaultPreferenceList,
365 oDefaultKeyserverURL,
366 oPersonalCipherPreferences,
367 oPersonalDigestPreferences,
368 oPersonalCompressPreferences,
383 oNoMangleDosFilenames,
384 oEnableProgressFilter,
387 oExitOnStatusWriteError,
388 oLimitCardInsertTries,
397 oAllowMultisigVerification,
402 oAllowMultipleMessages,
403 oNoAllowMultipleMessages,
404 oAllowWeakDigestAlgos,
422 static ARGPARSE_OPTS opts[] = {
424 ARGPARSE_group (300, N_("@Commands:\n ")),
426 ARGPARSE_c (aSign, "sign", N_("make a signature")),
427 ARGPARSE_c (aClearsign, "clear-sign", N_("make a clear text signature")),
428 ARGPARSE_c (aClearsign, "clearsign", "@"),
429 ARGPARSE_c (aDetachedSign, "detach-sign", N_("make a detached signature")),
430 ARGPARSE_c (aEncr, "encrypt", N_("encrypt data")),
431 ARGPARSE_c (aEncrFiles, "encrypt-files", "@"),
432 ARGPARSE_c (aSym, "symmetric", N_("encryption only with symmetric cipher")),
433 ARGPARSE_c (aStore, "store", "@"),
434 ARGPARSE_c (aDecrypt, "decrypt", N_("decrypt data (default)")),
435 ARGPARSE_c (aDecryptFiles, "decrypt-files", "@"),
436 ARGPARSE_c (aVerify, "verify" , N_("verify a signature")),
437 ARGPARSE_c (aVerifyFiles, "verify-files" , "@" ),
438 ARGPARSE_c (aListKeys, "list-keys", N_("list keys")),
439 ARGPARSE_c (aListKeys, "list-public-keys", "@" ),
440 ARGPARSE_c (aListSigs, "list-signatures", N_("list keys and signatures")),
441 ARGPARSE_c (aListSigs, "list-sigs", "@"),
442 ARGPARSE_c (aCheckKeys, "check-signatures",
443 N_("list and check key signatures")),
444 ARGPARSE_c (aCheckKeys, "check-sigs", "@"),
445 ARGPARSE_c (oFingerprint, "fingerprint", N_("list keys and fingerprints")),
446 ARGPARSE_c (aListSecretKeys, "list-secret-keys", N_("list secret keys")),
447 ARGPARSE_c (aKeygen, "generate-key",
448 N_("generate a new key pair")),
449 ARGPARSE_c (aKeygen, "gen-key", "@"),
450 ARGPARSE_c (aQuickKeygen, "quick-generate-key" ,
451 N_("quickly generate a new key pair")),
452 ARGPARSE_c (aQuickKeygen, "quick-gen-key", "@"),
453 ARGPARSE_c (aQuickAddUid, "quick-add-uid",
454 N_("quickly add a new user-id")),
455 ARGPARSE_c (aQuickAddUid, "quick-adduid", "@"),
456 ARGPARSE_c (aQuickAddKey, "quick-add-key", "@"),
457 ARGPARSE_c (aQuickAddKey, "quick-addkey", "@"),
458 ARGPARSE_c (aQuickRevUid, "quick-revoke-uid",
459 N_("quickly revoke a user-id")),
460 ARGPARSE_c (aQuickRevUid, "quick-revuid", "@"),
461 ARGPARSE_c (aQuickSetExpire, "quick-set-expire",
462 N_("quickly set a new expiration date")),
463 ARGPARSE_c (aFullKeygen, "full-generate-key" ,
464 N_("full featured key pair generation")),
465 ARGPARSE_c (aFullKeygen, "full-gen-key", "@"),
466 ARGPARSE_c (aGenRevoke, "generate-revocation",
467 N_("generate a revocation certificate")),
468 ARGPARSE_c (aGenRevoke, "gen-revoke", "@"),
469 ARGPARSE_c (aDeleteKeys,"delete-keys",
470 N_("remove keys from the public keyring")),
471 ARGPARSE_c (aDeleteSecretKeys, "delete-secret-keys",
472 N_("remove keys from the secret keyring")),
473 ARGPARSE_c (aQuickSignKey, "quick-sign-key" ,
474 N_("quickly sign a key")),
475 ARGPARSE_c (aQuickLSignKey, "quick-lsign-key",
476 N_("quickly sign a key locally")),
477 ARGPARSE_c (aSignKey, "sign-key" ,N_("sign a key")),
478 ARGPARSE_c (aLSignKey, "lsign-key" ,N_("sign a key locally")),
479 ARGPARSE_c (aEditKey, "edit-key" ,N_("sign or edit a key")),
480 ARGPARSE_c (aEditKey, "key-edit" ,"@"),
481 ARGPARSE_c (aPasswd, "change-passphrase", N_("change a passphrase")),
482 ARGPARSE_c (aPasswd, "passwd", "@"),
483 ARGPARSE_c (aDesigRevoke, "generate-designated-revocation", "@"),
484 ARGPARSE_c (aDesigRevoke, "desig-revoke","@" ),
485 ARGPARSE_c (aExport, "export" , N_("export keys") ),
486 ARGPARSE_c (aSendKeys, "send-keys" , N_("export keys to a keyserver") ),
487 ARGPARSE_c (aRecvKeys, "receive-keys" , N_("import keys from a keyserver") ),
488 ARGPARSE_c (aRecvKeys, "recv-keys" , "@"),
489 ARGPARSE_c (aSearchKeys, "search-keys" ,
490 N_("search for keys on a keyserver") ),
491 ARGPARSE_c (aRefreshKeys, "refresh-keys",
492 N_("update all keys from a keyserver")),
493 ARGPARSE_c (aLocateKeys, "locate-keys", "@"),
494 ARGPARSE_c (aFetchKeys, "fetch-keys" , "@" ),
495 ARGPARSE_c (aExportSecret, "export-secret-keys" , "@" ),
496 ARGPARSE_c (aExportSecretSub, "export-secret-subkeys" , "@" ),
497 ARGPARSE_c (aExportSshKey, "export-ssh-key", "@" ),
498 ARGPARSE_c (aImport, "import", N_("import/merge keys")),
499 ARGPARSE_c (aFastImport, "fast-import", "@"),
500 #ifdef ENABLE_CARD_SUPPORT
501 ARGPARSE_c (aCardStatus, "card-status", N_("print the card status")),
502 ARGPARSE_c (aCardEdit, "edit-card", N_("change data on a card")),
503 ARGPARSE_c (aCardEdit, "card-edit", "@"),
504 ARGPARSE_c (aChangePIN, "change-pin", N_("change a card's PIN")),
506 ARGPARSE_c (aListConfig, "list-config", "@"),
507 ARGPARSE_c (aListGcryptConfig, "list-gcrypt-config", "@"),
508 ARGPARSE_c (aGPGConfList, "gpgconf-list", "@" ),
509 ARGPARSE_c (aGPGConfTest, "gpgconf-test", "@" ),
510 ARGPARSE_c (aListPackets, "list-packets","@"),
512 #ifndef NO_TRUST_MODELS
513 ARGPARSE_c (aExportOwnerTrust, "export-ownertrust", "@"),
514 ARGPARSE_c (aImportOwnerTrust, "import-ownertrust", "@"),
515 ARGPARSE_c (aUpdateTrustDB,"update-trustdb",
516 N_("update the trust database")),
517 ARGPARSE_c (aCheckTrustDB, "check-trustdb", "@"),
518 ARGPARSE_c (aFixTrustDB, "fix-trustdb", "@"),
521 ARGPARSE_c (aDeArmor, "dearmor", "@"),
522 ARGPARSE_c (aDeArmor, "dearmour", "@"),
523 ARGPARSE_c (aEnArmor, "enarmor", "@"),
524 ARGPARSE_c (aEnArmor, "enarmour", "@"),
525 ARGPARSE_c (aPrintMD, "print-md", N_("print message digests")),
526 ARGPARSE_c (aPrimegen, "gen-prime", "@" ),
527 ARGPARSE_c (aGenRandom,"gen-random", "@" ),
528 ARGPARSE_c (aServer, "server", N_("run in server mode")),
529 ARGPARSE_c (aTOFUPolicy, "tofu-policy",
530 N_("|VALUE|set the TOFU policy for a key")),
532 ARGPARSE_group (301, N_("@\nOptions:\n ")),
534 ARGPARSE_s_n (oArmor, "armor", N_("create ascii armored output")),
535 ARGPARSE_s_n (oArmor, "armour", "@"),
537 ARGPARSE_s_s (oRecipient, "recipient", N_("|USER-ID|encrypt for USER-ID")),
538 ARGPARSE_s_s (oHiddenRecipient, "hidden-recipient", "@"),
539 ARGPARSE_s_s (oRecipientFile, "recipient-file", "@"),
540 ARGPARSE_s_s (oHiddenRecipientFile, "hidden-recipient-file", "@"),
541 ARGPARSE_s_s (oRecipient, "remote-user", "@"), /* (old option name) */
542 ARGPARSE_s_s (oDefRecipient, "default-recipient", "@"),
543 ARGPARSE_s_n (oDefRecipientSelf, "default-recipient-self", "@"),
544 ARGPARSE_s_n (oNoDefRecipient, "no-default-recipient", "@"),
546 ARGPARSE_s_s (oTempDir, "temp-directory", "@"),
547 ARGPARSE_s_s (oExecPath, "exec-path", "@"),
548 ARGPARSE_s_s (oEncryptTo, "encrypt-to", "@"),
549 ARGPARSE_s_n (oNoEncryptTo, "no-encrypt-to", "@"),
550 ARGPARSE_s_s (oHiddenEncryptTo, "hidden-encrypt-to", "@"),
551 ARGPARSE_s_n (oEncryptToDefaultKey, "encrypt-to-default-key", "@"),
552 ARGPARSE_s_s (oLocalUser, "local-user",
553 N_("|USER-ID|use USER-ID to sign or decrypt")),
554 ARGPARSE_s_s (oSender, "sender", "@"),
556 ARGPARSE_s_s (oTrySecretKey, "try-secret-key", "@"),
558 ARGPARSE_s_i (oCompress, NULL,
559 N_("|N|set compress level to N (0 disables)")),
560 ARGPARSE_s_i (oCompressLevel, "compress-level", "@"),
561 ARGPARSE_s_i (oBZ2CompressLevel, "bzip2-compress-level", "@"),
562 ARGPARSE_s_n (oBZ2DecompressLowmem, "bzip2-decompress-lowmem", "@"),
564 ARGPARSE_s_n (oMimemode, "mimemode", "@"),
565 ARGPARSE_s_n (oTextmodeShort, NULL, "@"),
566 ARGPARSE_s_n (oTextmode, "textmode", N_("use canonical text mode")),
567 ARGPARSE_s_n (oNoTextmode, "no-textmode", "@"),
569 ARGPARSE_s_n (oExpert, "expert", "@"),
570 ARGPARSE_s_n (oNoExpert, "no-expert", "@"),
572 ARGPARSE_s_s (oDefSigExpire, "default-sig-expire", "@"),
573 ARGPARSE_s_n (oAskSigExpire, "ask-sig-expire", "@"),
574 ARGPARSE_s_n (oNoAskSigExpire, "no-ask-sig-expire", "@"),
575 ARGPARSE_s_s (oDefCertExpire, "default-cert-expire", "@"),
576 ARGPARSE_s_n (oAskCertExpire, "ask-cert-expire", "@"),
577 ARGPARSE_s_n (oNoAskCertExpire, "no-ask-cert-expire", "@"),
578 ARGPARSE_s_i (oDefCertLevel, "default-cert-level", "@"),
579 ARGPARSE_s_i (oMinCertLevel, "min-cert-level", "@"),
580 ARGPARSE_s_n (oAskCertLevel, "ask-cert-level", "@"),
581 ARGPARSE_s_n (oNoAskCertLevel, "no-ask-cert-level", "@"),
583 ARGPARSE_s_s (oOutput, "output", N_("|FILE|write output to FILE")),
584 ARGPARSE_p_u (oMaxOutput, "max-output", "@"),
585 ARGPARSE_s_s (oInputSizeHint, "input-size-hint", "@"),
587 ARGPARSE_s_n (oVerbose, "verbose", N_("verbose")),
588 ARGPARSE_s_n (oQuiet, "quiet", "@"),
589 ARGPARSE_s_n (oNoTTY, "no-tty", "@"),
591 ARGPARSE_s_n (oForceMDC, "force-mdc", "@"),
592 ARGPARSE_s_n (oNoForceMDC, "no-force-mdc", "@"),
593 ARGPARSE_s_n (oDisableMDC, "disable-mdc", "@"),
594 ARGPARSE_s_n (oNoDisableMDC, "no-disable-mdc", "@"),
596 ARGPARSE_s_n (oDisableSignerUID, "disable-signer-uid", "@"),
598 ARGPARSE_s_n (oDryRun, "dry-run", N_("do not make any changes")),
599 ARGPARSE_s_n (oInteractive, "interactive", N_("prompt before overwriting")),
601 ARGPARSE_s_n (oBatch, "batch", "@"),
602 ARGPARSE_s_n (oAnswerYes, "yes", "@"),
603 ARGPARSE_s_n (oAnswerNo, "no", "@"),
604 ARGPARSE_s_s (oKeyring, "keyring", "@"),
605 ARGPARSE_s_s (oPrimaryKeyring, "primary-keyring", "@"),
606 ARGPARSE_s_s (oSecretKeyring, "secret-keyring", "@"),
607 ARGPARSE_s_n (oShowKeyring, "show-keyring", "@"),
608 ARGPARSE_s_s (oDefaultKey, "default-key", "@"),
610 ARGPARSE_s_s (oKeyServer, "keyserver", "@"),
611 ARGPARSE_s_s (oKeyServerOptions, "keyserver-options", "@"),
612 ARGPARSE_s_s (oImportOptions, "import-options", "@"),
613 ARGPARSE_s_s (oImportFilter, "import-filter", "@"),
614 ARGPARSE_s_s (oExportOptions, "export-options", "@"),
615 ARGPARSE_s_s (oExportFilter, "export-filter", "@"),
616 ARGPARSE_s_s (oListOptions, "list-options", "@"),
617 ARGPARSE_s_s (oVerifyOptions, "verify-options", "@"),
619 ARGPARSE_s_s (oDisplayCharset, "display-charset", "@"),
620 ARGPARSE_s_s (oDisplayCharset, "charset", "@"),
621 ARGPARSE_s_s (oOptions, "options", "@"),
623 ARGPARSE_s_s (oDebug, "debug", "@"),
624 ARGPARSE_s_s (oDebugLevel, "debug-level", "@"),
625 ARGPARSE_s_n (oDebugAll, "debug-all", "@"),
626 ARGPARSE_s_n (oDebugIOLBF, "debug-iolbf", "@"),
627 ARGPARSE_s_i (oStatusFD, "status-fd", "@"),
628 ARGPARSE_s_s (oStatusFile, "status-file", "@"),
629 ARGPARSE_s_i (oAttributeFD, "attribute-fd", "@"),
630 ARGPARSE_s_s (oAttributeFile, "attribute-file", "@"),
632 ARGPARSE_s_i (oCompletesNeeded, "completes-needed", "@"),
633 ARGPARSE_s_i (oMarginalsNeeded, "marginals-needed", "@"),
634 ARGPARSE_s_i (oMaxCertDepth, "max-cert-depth", "@" ),
635 ARGPARSE_s_s (oTrustedKey, "trusted-key", "@"),
637 ARGPARSE_s_s (oLoadExtension, "load-extension", "@"), /* Dummy. */
639 ARGPARSE_s_s (oCompliance, "compliance", "@"),
640 ARGPARSE_s_n (oGnuPG, "gnupg", "@"),
641 ARGPARSE_s_n (oGnuPG, "no-pgp2", "@"),
642 ARGPARSE_s_n (oGnuPG, "no-pgp6", "@"),
643 ARGPARSE_s_n (oGnuPG, "no-pgp7", "@"),
644 ARGPARSE_s_n (oGnuPG, "no-pgp8", "@"),
645 ARGPARSE_s_n (oRFC2440, "rfc2440", "@"),
646 ARGPARSE_s_n (oRFC4880, "rfc4880", "@"),
647 ARGPARSE_s_n (oRFC4880bis, "rfc4880bis", "@"),
648 ARGPARSE_s_n (oOpenPGP, "openpgp", N_("use strict OpenPGP behavior")),
649 ARGPARSE_s_n (oPGP6, "pgp6", "@"),
650 ARGPARSE_s_n (oPGP7, "pgp7", "@"),
651 ARGPARSE_s_n (oPGP8, "pgp8", "@"),
653 ARGPARSE_s_n (oRFC2440Text, "rfc2440-text", "@"),
654 ARGPARSE_s_n (oNoRFC2440Text, "no-rfc2440-text", "@"),
655 ARGPARSE_s_i (oS2KMode, "s2k-mode", "@"),
656 ARGPARSE_s_s (oS2KDigest, "s2k-digest-algo", "@"),
657 ARGPARSE_s_s (oS2KCipher, "s2k-cipher-algo", "@"),
658 ARGPARSE_s_i (oS2KCount, "s2k-count", "@"),
659 ARGPARSE_s_s (oCipherAlgo, "cipher-algo", "@"),
660 ARGPARSE_s_s (oDigestAlgo, "digest-algo", "@"),
661 ARGPARSE_s_s (oCertDigestAlgo, "cert-digest-algo", "@"),
662 ARGPARSE_s_s (oCompressAlgo,"compress-algo", "@"),
663 ARGPARSE_s_s (oCompressAlgo, "compression-algo", "@"), /* Alias */
664 ARGPARSE_s_n (oThrowKeyids, "throw-keyids", "@"),
665 ARGPARSE_s_n (oNoThrowKeyids, "no-throw-keyids", "@"),
666 ARGPARSE_s_n (oShowPhotos, "show-photos", "@"),
667 ARGPARSE_s_n (oNoShowPhotos, "no-show-photos", "@"),
668 ARGPARSE_s_s (oPhotoViewer, "photo-viewer", "@"),
669 ARGPARSE_s_s (oSetNotation, "set-notation", "@"),
670 ARGPARSE_s_s (oSigNotation, "sig-notation", "@"),
671 ARGPARSE_s_s (oCertNotation, "cert-notation", "@"),
673 ARGPARSE_group (302, N_(
674 "@\n(See the man page for a complete listing of all commands and options)\n"
677 ARGPARSE_group (303, N_("@\nExamples:\n\n"
678 " -se -r Bob [file] sign and encrypt for user Bob\n"
679 " --clear-sign [file] make a clear text signature\n"
680 " --detach-sign [file] make a detached signature\n"
681 " --list-keys [names] show keys\n"
682 " --fingerprint [names] show fingerprints\n")),
684 /* More hidden commands and options. */
685 ARGPARSE_c (aPrintMDs, "print-mds", "@"), /* old */
686 #ifndef NO_TRUST_MODELS
687 ARGPARSE_c (aListTrustDB, "list-trustdb", "@"),
691 ARGPARSE_c (aListTrustPath, "list-trust-path", "@"), */
692 ARGPARSE_c (aDeleteSecretAndPublicKeys,
693 "delete-secret-and-public-keys", "@"),
694 ARGPARSE_c (aRebuildKeydbCaches, "rebuild-keydb-caches", "@"),
696 ARGPARSE_s_s (oPassphrase, "passphrase", "@"),
697 ARGPARSE_s_i (oPassphraseFD, "passphrase-fd", "@"),
698 ARGPARSE_s_s (oPassphraseFile, "passphrase-file", "@"),
699 ARGPARSE_s_i (oPassphraseRepeat,"passphrase-repeat", "@"),
700 ARGPARSE_s_s (oPinentryMode, "pinentry-mode", "@"),
701 ARGPARSE_s_i (oCommandFD, "command-fd", "@"),
702 ARGPARSE_s_s (oCommandFile, "command-file", "@"),
703 ARGPARSE_s_n (oQuickRandom, "debug-quick-random", "@"),
704 ARGPARSE_s_n (oNoVerbose, "no-verbose", "@"),
706 #ifndef NO_TRUST_MODELS
707 ARGPARSE_s_s (oTrustDBName, "trustdb-name", "@"),
708 ARGPARSE_s_n (oAutoCheckTrustDB, "auto-check-trustdb", "@"),
709 ARGPARSE_s_n (oNoAutoCheckTrustDB, "no-auto-check-trustdb", "@"),
710 ARGPARSE_s_s (oForceOwnertrust, "force-ownertrust", "@"),
713 ARGPARSE_s_n (oNoSecmemWarn, "no-secmem-warning", "@"),
714 ARGPARSE_s_n (oRequireSecmem, "require-secmem", "@"),
715 ARGPARSE_s_n (oNoRequireSecmem, "no-require-secmem", "@"),
716 ARGPARSE_s_n (oNoPermissionWarn, "no-permission-warning", "@"),
717 ARGPARSE_s_n (oNoMDCWarn, "no-mdc-warning", "@"),
718 ARGPARSE_s_n (oNoArmor, "no-armor", "@"),
719 ARGPARSE_s_n (oNoArmor, "no-armour", "@"),
720 ARGPARSE_s_n (oNoDefKeyring, "no-default-keyring", "@"),
721 ARGPARSE_s_n (oNoKeyring, "no-keyring", "@"),
722 ARGPARSE_s_n (oNoGreeting, "no-greeting", "@"),
723 ARGPARSE_s_n (oNoOptions, "no-options", "@"),
724 ARGPARSE_s_s (oHomedir, "homedir", "@"),
725 ARGPARSE_s_n (oNoBatch, "no-batch", "@"),
726 ARGPARSE_s_n (oWithColons, "with-colons", "@"),
727 ARGPARSE_s_n (oWithTofuInfo,"with-tofu-info", "@"),
728 ARGPARSE_s_n (oWithKeyData,"with-key-data", "@"),
729 ARGPARSE_s_n (oWithSigList,"with-sig-list", "@"),
730 ARGPARSE_s_n (oWithSigCheck,"with-sig-check", "@"),
731 ARGPARSE_c (aListKeys, "list-key", "@"), /* alias */
732 ARGPARSE_c (aListSigs, "list-sig", "@"), /* alias */
733 ARGPARSE_c (aCheckKeys, "check-sig", "@"), /* alias */
734 ARGPARSE_s_n (oSkipVerify, "skip-verify", "@"),
735 ARGPARSE_s_n (oSkipHiddenRecipients, "skip-hidden-recipients", "@"),
736 ARGPARSE_s_n (oNoSkipHiddenRecipients, "no-skip-hidden-recipients", "@"),
737 ARGPARSE_s_i (oDefCertLevel, "default-cert-check-level", "@"), /* old */
738 #ifndef NO_TRUST_MODELS
739 ARGPARSE_s_n (oAlwaysTrust, "always-trust", "@"),
741 ARGPARSE_s_s (oTrustModel, "trust-model", "@"),
742 ARGPARSE_s_s (oTOFUDefaultPolicy, "tofu-default-policy", "@"),
743 ARGPARSE_s_s (oSetFilename, "set-filename", "@"),
744 ARGPARSE_s_n (oForYourEyesOnly, "for-your-eyes-only", "@"),
745 ARGPARSE_s_n (oNoForYourEyesOnly, "no-for-your-eyes-only", "@"),
746 ARGPARSE_s_s (oSetPolicyURL, "set-policy-url", "@"),
747 ARGPARSE_s_s (oSigPolicyURL, "sig-policy-url", "@"),
748 ARGPARSE_s_s (oCertPolicyURL, "cert-policy-url", "@"),
749 ARGPARSE_s_n (oShowPolicyURL, "show-policy-url", "@"),
750 ARGPARSE_s_n (oNoShowPolicyURL, "no-show-policy-url", "@"),
751 ARGPARSE_s_s (oSigKeyserverURL, "sig-keyserver-url", "@"),
752 ARGPARSE_s_n (oShowNotation, "show-notation", "@"),
753 ARGPARSE_s_n (oNoShowNotation, "no-show-notation", "@"),
754 ARGPARSE_s_s (oComment, "comment", "@"),
755 ARGPARSE_s_n (oDefaultComment, "default-comment", "@"),
756 ARGPARSE_s_n (oNoComments, "no-comments", "@"),
757 ARGPARSE_s_n (oEmitVersion, "emit-version", "@"),
758 ARGPARSE_s_n (oNoEmitVersion, "no-emit-version", "@"),
759 ARGPARSE_s_n (oNoEmitVersion, "no-version", "@"), /* alias */
760 ARGPARSE_s_n (oNotDashEscaped, "not-dash-escaped", "@"),
761 ARGPARSE_s_n (oEscapeFrom, "escape-from-lines", "@"),
762 ARGPARSE_s_n (oNoEscapeFrom, "no-escape-from-lines", "@"),
763 ARGPARSE_s_n (oLockOnce, "lock-once", "@"),
764 ARGPARSE_s_n (oLockMultiple, "lock-multiple", "@"),
765 ARGPARSE_s_n (oLockNever, "lock-never", "@"),
766 ARGPARSE_s_i (oLoggerFD, "logger-fd", "@"),
767 ARGPARSE_s_s (oLoggerFile, "log-file", "@"),
768 ARGPARSE_s_s (oLoggerFile, "logger-file", "@"), /* 1.4 compatibility. */
769 ARGPARSE_s_n (oUseEmbeddedFilename, "use-embedded-filename", "@"),
770 ARGPARSE_s_n (oNoUseEmbeddedFilename, "no-use-embedded-filename", "@"),
771 ARGPARSE_s_n (oUtf8Strings, "utf8-strings", "@"),
772 ARGPARSE_s_n (oNoUtf8Strings, "no-utf8-strings", "@"),
773 ARGPARSE_s_n (oWithFingerprint, "with-fingerprint", "@"),
774 ARGPARSE_s_n (oWithSubkeyFingerprint, "with-subkey-fingerprint", "@"),
775 ARGPARSE_s_n (oWithSubkeyFingerprint, "with-subkey-fingerprints", "@"),
776 ARGPARSE_s_n (oWithICAOSpelling, "with-icao-spelling", "@"),
777 ARGPARSE_s_n (oWithKeygrip, "with-keygrip", "@"),
778 ARGPARSE_s_n (oWithSecret, "with-secret", "@"),
779 ARGPARSE_s_n (oWithWKDHash, "with-wkd-hash", "@"),
780 ARGPARSE_s_s (oDisableCipherAlgo, "disable-cipher-algo", "@"),
781 ARGPARSE_s_s (oDisablePubkeyAlgo, "disable-pubkey-algo", "@"),
782 ARGPARSE_s_n (oAllowNonSelfsignedUID, "allow-non-selfsigned-uid", "@"),
783 ARGPARSE_s_n (oNoAllowNonSelfsignedUID, "no-allow-non-selfsigned-uid", "@"),
784 ARGPARSE_s_n (oAllowFreeformUID, "allow-freeform-uid", "@"),
785 ARGPARSE_s_n (oNoAllowFreeformUID, "no-allow-freeform-uid", "@"),
786 ARGPARSE_s_n (oNoLiteral, "no-literal", "@"),
787 ARGPARSE_p_u (oSetFilesize, "set-filesize", "@"),
788 ARGPARSE_s_n (oFastListMode, "fast-list-mode", "@"),
789 ARGPARSE_s_n (oFixedListMode, "fixed-list-mode", "@"),
790 ARGPARSE_s_n (oLegacyListMode, "legacy-list-mode", "@"),
791 ARGPARSE_s_n (oListOnly, "list-only", "@"),
792 ARGPARSE_s_n (oPrintPKARecords, "print-pka-records", "@"),
793 ARGPARSE_s_n (oPrintDANERecords, "print-dane-records", "@"),
794 ARGPARSE_s_n (oIgnoreTimeConflict, "ignore-time-conflict", "@"),
795 ARGPARSE_s_n (oIgnoreValidFrom, "ignore-valid-from", "@"),
796 ARGPARSE_s_n (oIgnoreCrcError, "ignore-crc-error", "@"),
797 ARGPARSE_s_n (oIgnoreMDCError, "ignore-mdc-error", "@"),
798 ARGPARSE_s_n (oShowSessionKey, "show-session-key", "@"),
799 ARGPARSE_s_s (oOverrideSessionKey, "override-session-key", "@"),
800 ARGPARSE_s_i (oOverrideSessionKeyFD, "override-session-key-fd", "@"),
801 ARGPARSE_s_n (oNoRandomSeedFile, "no-random-seed-file", "@"),
802 ARGPARSE_s_n (oAutoKeyRetrieve, "auto-key-retrieve", "@"),
803 ARGPARSE_s_n (oNoAutoKeyRetrieve, "no-auto-key-retrieve", "@"),
804 ARGPARSE_s_n (oNoSigCache, "no-sig-cache", "@"),
805 ARGPARSE_s_n (oMergeOnly, "merge-only", "@" ),
806 ARGPARSE_s_n (oAllowSecretKeyImport, "allow-secret-key-import", "@"),
807 ARGPARSE_s_n (oTryAllSecrets, "try-all-secrets", "@"),
808 ARGPARSE_s_n (oEnableSpecialFilenames, "enable-special-filenames", "@"),
809 ARGPARSE_s_n (oNoExpensiveTrustChecks, "no-expensive-trust-checks", "@"),
810 ARGPARSE_s_n (oPreservePermissions, "preserve-permissions", "@"),
811 ARGPARSE_s_s (oDefaultPreferenceList, "default-preference-list", "@"),
812 ARGPARSE_s_s (oDefaultKeyserverURL, "default-keyserver-url", "@"),
813 ARGPARSE_s_s (oPersonalCipherPreferences, "personal-cipher-preferences","@"),
814 ARGPARSE_s_s (oPersonalDigestPreferences, "personal-digest-preferences","@"),
815 ARGPARSE_s_s (oPersonalCompressPreferences,
816 "personal-compress-preferences", "@"),
817 ARGPARSE_s_s (oFakedSystemTime, "faked-system-time", "@"),
818 ARGPARSE_s_s (oWeakDigest, "weak-digest","@"),
819 ARGPARSE_s_n (oUnwrap, "unwrap", "@"),
820 ARGPARSE_s_n (oOnlySignTextIDs, "only-sign-text-ids", "@"),
822 /* Aliases. I constantly mistype these, and assume other people do
824 ARGPARSE_s_s (oPersonalCipherPreferences, "personal-cipher-prefs", "@"),
825 ARGPARSE_s_s (oPersonalDigestPreferences, "personal-digest-prefs", "@"),
826 ARGPARSE_s_s (oPersonalCompressPreferences, "personal-compress-prefs", "@"),
828 ARGPARSE_s_s (oAgentProgram, "agent-program", "@"),
829 ARGPARSE_s_s (oDirmngrProgram, "dirmngr-program", "@"),
830 ARGPARSE_s_s (oDisplay, "display", "@"),
831 ARGPARSE_s_s (oTTYname, "ttyname", "@"),
832 ARGPARSE_s_s (oTTYtype, "ttytype", "@"),
833 ARGPARSE_s_s (oLCctype, "lc-ctype", "@"),
834 ARGPARSE_s_s (oLCmessages, "lc-messages","@"),
835 ARGPARSE_s_s (oXauthority, "xauthority", "@"),
836 ARGPARSE_s_s (oGroup, "group", "@"),
837 ARGPARSE_s_s (oUnGroup, "ungroup", "@"),
838 ARGPARSE_s_n (oNoGroups, "no-groups", "@"),
839 ARGPARSE_s_n (oStrict, "strict", "@"),
840 ARGPARSE_s_n (oNoStrict, "no-strict", "@"),
841 ARGPARSE_s_n (oMangleDosFilenames, "mangle-dos-filenames", "@"),
842 ARGPARSE_s_n (oNoMangleDosFilenames, "no-mangle-dos-filenames", "@"),
843 ARGPARSE_s_n (oEnableProgressFilter, "enable-progress-filter", "@"),
844 ARGPARSE_s_n (oMultifile, "multifile", "@"),
845 ARGPARSE_s_s (oKeyidFormat, "keyid-format", "@"),
846 ARGPARSE_s_n (oExitOnStatusWriteError, "exit-on-status-write-error", "@"),
847 ARGPARSE_s_i (oLimitCardInsertTries, "limit-card-insert-tries", "@"),
849 ARGPARSE_s_n (oAllowMultisigVerification,
850 "allow-multisig-verification", "@"),
851 ARGPARSE_s_n (oEnableLargeRSA, "enable-large-rsa", "@"),
852 ARGPARSE_s_n (oDisableLargeRSA, "disable-large-rsa", "@"),
853 ARGPARSE_s_n (oEnableDSA2, "enable-dsa2", "@"),
854 ARGPARSE_s_n (oDisableDSA2, "disable-dsa2", "@"),
855 ARGPARSE_s_n (oAllowMultipleMessages, "allow-multiple-messages", "@"),
856 ARGPARSE_s_n (oNoAllowMultipleMessages, "no-allow-multiple-messages", "@"),
857 ARGPARSE_s_n (oAllowWeakDigestAlgos, "allow-weak-digest-algos", "@"),
859 ARGPARSE_s_s (oDefaultNewKeyAlgo, "default-new-key-algo", "@"),
861 /* These two are aliases to help users of the PGP command line
862 product use gpg with minimal pain. Many commands are common
863 already as they seem to have borrowed commands from us. Now I'm
864 returning the favor. */
865 ARGPARSE_s_s (oLocalUser, "sign-with", "@"),
866 ARGPARSE_s_s (oRecipient, "user", "@"),
868 ARGPARSE_s_n (oRequireCrossCert, "require-backsigs", "@"),
869 ARGPARSE_s_n (oRequireCrossCert, "require-cross-certification", "@"),
870 ARGPARSE_s_n (oNoRequireCrossCert, "no-require-backsigs", "@"),
871 ARGPARSE_s_n (oNoRequireCrossCert, "no-require-cross-certification", "@"),
873 /* New options. Fixme: Should go more to the top. */
874 ARGPARSE_s_s (oAutoKeyLocate, "auto-key-locate", "@"),
875 ARGPARSE_s_n (oNoAutoKeyLocate, "no-auto-key-locate", "@"),
876 ARGPARSE_s_n (oNoAutostart, "no-autostart", "@"),
878 /* Dummy options with warnings. */
879 ARGPARSE_s_n (oUseAgent, "use-agent", "@"),
880 ARGPARSE_s_n (oNoUseAgent, "no-use-agent", "@"),
881 ARGPARSE_s_s (oGpgAgentInfo, "gpg-agent-info", "@"),
882 ARGPARSE_s_s (oReaderPort, "reader-port", "@"),
883 ARGPARSE_s_s (octapiDriver, "ctapi-driver", "@"),
884 ARGPARSE_s_s (opcscDriver, "pcsc-driver", "@"),
885 ARGPARSE_s_n (oDisableCCID, "disable-ccid", "@"),
886 ARGPARSE_s_n (oHonorHttpProxy, "honor-http-proxy", "@"),
887 ARGPARSE_s_s (oTOFUDBFormat, "tofu-db-format", "@"),
890 ARGPARSE_s_n (oNoop, "sk-comments", "@"),
891 ARGPARSE_s_n (oNoop, "no-sk-comments", "@"),
892 ARGPARSE_s_n (oNoop, "compress-keys", "@"),
893 ARGPARSE_s_n (oNoop, "compress-sigs", "@"),
894 ARGPARSE_s_n (oNoop, "force-v3-sigs", "@"),
895 ARGPARSE_s_n (oNoop, "no-force-v3-sigs", "@"),
896 ARGPARSE_s_n (oNoop, "force-v4-certs", "@"),
897 ARGPARSE_s_n (oNoop, "no-force-v4-certs", "@"),
903 /* The list of supported debug flags. */
904 static struct debug_flags_s debug_flags [] =
906 { DBG_PACKET_VALUE , "packet" },
907 { DBG_MPI_VALUE , "mpi" },
908 { DBG_CRYPTO_VALUE , "crypto" },
909 { DBG_FILTER_VALUE , "filter" },
910 { DBG_IOBUF_VALUE , "iobuf" },
911 { DBG_MEMORY_VALUE , "memory" },
912 { DBG_CACHE_VALUE , "cache" },
913 { DBG_MEMSTAT_VALUE, "memstat" },
914 { DBG_TRUST_VALUE , "trust" },
915 { DBG_HASHING_VALUE, "hashing" },
916 { DBG_IPC_VALUE , "ipc" },
917 { DBG_CLOCK_VALUE , "clock" },
918 { DBG_LOOKUP_VALUE , "lookup" },
919 { DBG_EXTPROG_VALUE, "extprog" },
924 #ifdef ENABLE_SELINUX_HACKS
925 #define ALWAYS_ADD_KEYRINGS 1
927 #define ALWAYS_ADD_KEYRINGS 0
931 int g10_errors_seen = 0;
933 static int utf8_strings = 0;
934 static int maybe_setuid = 1;
936 static char *build_list( const char *text, char letter,
937 const char *(*mapf)(int), int (*chkf)(int) );
938 static void set_cmd( enum cmd_and_opt_values *ret_cmd,
939 enum cmd_and_opt_values new_cmd );
940 static void print_mds( const char *fname, int algo );
941 static void add_notation_data( const char *string, int which );
942 static void add_policy_url( const char *string, int which );
943 static void add_keyserver_url( const char *string, int which );
944 static void emergency_cleanup (void);
945 static void read_sessionkey_from_fd (int fd);
949 make_libversion (const char *libname, const char *(*getfnc)(const char*))
956 gcry_control (GCRYCTL_INIT_SECMEM, 0, 0); /* Drop setuid. */
960 result = xmalloc (strlen (libname) + 1 + strlen (s) + 1);
961 strcpy (stpcpy (stpcpy (result, libname), " "), s);
967 build_list_pk_test_algo (int algo)
969 /* Show only one "RSA" string. If RSA_E or RSA_S is available RSA
970 is also available. */
971 if (algo == PUBKEY_ALGO_RSA_E
972 || algo == PUBKEY_ALGO_RSA_S)
973 return GPG_ERR_DIGEST_ALGO;
975 return openpgp_pk_test_algo (algo);
979 build_list_pk_algo_name (int algo)
981 return openpgp_pk_algo_name (algo);
985 build_list_cipher_test_algo (int algo)
987 return openpgp_cipher_test_algo (algo);
991 build_list_cipher_algo_name (int algo)
993 return openpgp_cipher_algo_name (algo);
997 build_list_md_test_algo (int algo)
999 /* By default we do not accept MD5 based signatures. To avoid
1000 confusion we do not announce support for it either. */
1001 if (algo == DIGEST_ALGO_MD5)
1002 return GPG_ERR_DIGEST_ALGO;
1004 return openpgp_md_test_algo (algo);
1008 build_list_md_algo_name (int algo)
1010 return openpgp_md_algo_name (algo);
1015 my_strusage( int level )
1017 static char *digests, *pubkeys, *ciphers, *zips, *ver_gcry;
1021 case 11: p = "@GPG@ (@GNUPG@)";
1023 case 13: p = VERSION; break;
1024 case 17: p = PRINTABLE_OS_NAME; break;
1025 case 19: p = _("Please report bugs to <@EMAIL@>.\n"); break;
1029 ver_gcry = make_libversion ("libgcrypt", gcry_check_version);
1033 #ifdef IS_DEVELOPMENT_VERSION
1035 p="NOTE: THIS IS A DEVELOPMENT VERSION!";
1038 p="It is only intended for test purposes and should NOT be";
1041 p="used in a production environment or with production keys!";
1047 _("Usage: @GPG@ [options] [files] (-h for help)");
1050 _("Syntax: @GPG@ [options] [files]\n"
1051 "Sign, check, encrypt or decrypt\n"
1052 "Default operation depends on the input data\n");
1055 case 31: p = "\nHome: "; break;
1057 case 32: p = gnupg_homedir (); break;
1058 #else /* __riscos__ */
1059 case 32: p = make_filename(gnupg_homedir (), NULL); break;
1060 #endif /* __riscos__ */
1061 case 33: p = _("\nSupported algorithms:\n"); break;
1064 pubkeys = build_list (_("Pubkey: "), 1,
1065 build_list_pk_algo_name,
1066 build_list_pk_test_algo );
1071 ciphers = build_list(_("Cipher: "), 'S',
1072 build_list_cipher_algo_name,
1073 build_list_cipher_test_algo );
1078 digests = build_list(_("Hash: "), 'H',
1079 build_list_md_algo_name,
1080 build_list_md_test_algo );
1085 zips = build_list(_("Compression: "),'Z',
1086 compress_algo_to_string,
1087 check_compress_algo);
1098 build_list (const char *text, char letter,
1099 const char * (*mapf)(int), int (*chkf)(int))
1108 gcry_control (GCRYCTL_INIT_SECMEM, 0, 0); /* Drop setuid. */
1110 indent = utf8_charcount (text, -1);
1112 init_membuf (&mb, 512);
1114 for (i=0; i <= 110; i++ )
1116 if (!chkf (i) && (s = mapf (i)))
1118 if (mb.len - len > 60)
1120 put_membuf_str (&mb, ",\n");
1122 for (j=0; j < indent; j++)
1123 put_membuf_str (&mb, " ");
1126 put_membuf_str (&mb, ", ");
1128 put_membuf_str (&mb, text);
1130 put_membuf_str (&mb, s);
1131 if (opt.verbose && letter)
1135 snprintf (num, sizeof num, " (%d)", i);
1137 snprintf (num, sizeof num, " (%c%d)", letter, i);
1138 put_membuf_str (&mb, num);
1143 put_membuf_str (&mb, "\n");
1144 put_membuf (&mb, "", 1);
1146 string = get_membuf (&mb, NULL);
1147 return xrealloc (string, strlen (string)+1);
1152 wrong_args( const char *text)
1154 es_fprintf (es_stderr, _("usage: %s [options] %s\n"), GPG_NAME, text);
1160 make_username( const char *string )
1164 p = xstrdup(string);
1166 p = native_to_utf8( string );
1172 set_opt_session_env (const char *name, const char *value)
1176 err = session_env_setenv (opt.session_env, name, value);
1178 log_fatal ("error setting session environment: %s\n",
1179 gpg_strerror (err));
1183 /* Setup the debugging. With a LEVEL of NULL only the active debug
1184 flags are propagated to the subsystems. With LEVEL set, a specific
1185 set of debug flags is set; thus overriding all flags already
1188 set_debug (const char *level)
1190 int numok = (level && digitp (level));
1191 int numlvl = numok? atoi (level) : 0;
1195 else if (!strcmp (level, "none") || (numok && numlvl < 1))
1197 else if (!strcmp (level, "basic") || (numok && numlvl <= 2))
1198 opt.debug = DBG_MEMSTAT_VALUE;
1199 else if (!strcmp (level, "advanced") || (numok && numlvl <= 5))
1200 opt.debug = DBG_MEMSTAT_VALUE|DBG_TRUST_VALUE|DBG_EXTPROG_VALUE;
1201 else if (!strcmp (level, "expert") || (numok && numlvl <= 8))
1202 opt.debug = (DBG_MEMSTAT_VALUE|DBG_TRUST_VALUE|DBG_EXTPROG_VALUE
1203 |DBG_CACHE_VALUE|DBG_LOOKUP|DBG_FILTER_VALUE|DBG_PACKET_VALUE);
1204 else if (!strcmp (level, "guru") || numok)
1207 /* Unless the "guru" string has been used we don't want to allow
1208 hashing debugging. The rationale is that people tend to
1209 select the highest debug value and would then clutter their
1210 disk with debug files which may reveal confidential data. */
1212 opt.debug &= ~(DBG_HASHING_VALUE);
1216 log_error (_("invalid debug-level '%s' given\n"), level);
1220 if ((opt.debug & DBG_MEMORY_VALUE))
1221 memory_debug_mode = 1;
1222 if ((opt.debug & DBG_MEMSTAT_VALUE))
1223 memory_stat_debug_mode = 1;
1225 gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 2);
1227 gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1);
1228 if ((opt.debug & DBG_IOBUF_VALUE))
1229 iobuf_debug_mode = 1;
1230 gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
1233 parse_debug_flag (NULL, &opt.debug, debug_flags);
1237 /* We set the screen dimensions for UI purposes. Do not allow screens
1238 smaller than 80x24 for the sake of simplicity. */
1240 set_screen_dimensions(void)
1242 #ifndef HAVE_W32_SYSTEM
1245 str=getenv("COLUMNS");
1247 opt.screen_columns=atoi(str);
1249 str=getenv("LINES");
1251 opt.screen_lines=atoi(str);
1254 if(opt.screen_columns<80 || opt.screen_columns>255)
1255 opt.screen_columns=80;
1257 if(opt.screen_lines<24 || opt.screen_lines>255)
1258 opt.screen_lines=24;
1262 /* Helper to open a file FNAME either for reading or writing to be
1263 used with --status-file etc functions. Not generally useful but it
1264 avoids the riscos specific functions and well some Windows people
1265 might like it too. Prints an error message and returns -1 on
1266 error. On success the file descriptor is returned. */
1268 open_info_file (const char *fname, int for_write, int binary)
1271 return riscos_fdopenfile (fname, for_write);
1272 #elif defined (ENABLE_SELINUX_HACKS)
1273 /* We can't allow these even when testing for a secured filename
1274 because files to be secured might not yet been secured. This is
1275 similar to the option file but in that case it is unlikely that
1276 sensitive information may be retrieved by means of error
1286 binary = MY_O_BINARY;
1288 /* if (is_secured_filename (fname)) */
1291 /* gpg_err_set_errno (EPERM); */
1298 fd = open (fname, O_CREAT | O_TRUNC | O_WRONLY | binary,
1299 S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
1301 fd = open (fname, O_RDONLY | binary);
1303 while (fd == -1 && errno == EINTR);
1306 log_error ( for_write? _("can't create '%s': %s\n")
1307 : _("can't open '%s': %s\n"), fname, strerror(errno));
1314 set_cmd( enum cmd_and_opt_values *ret_cmd, enum cmd_and_opt_values new_cmd )
1316 enum cmd_and_opt_values cmd = *ret_cmd;
1318 if( !cmd || cmd == new_cmd )
1320 else if( cmd == aSign && new_cmd == aEncr )
1322 else if( cmd == aEncr && new_cmd == aSign )
1324 else if( cmd == aSign && new_cmd == aSym )
1326 else if( cmd == aSym && new_cmd == aSign )
1328 else if( cmd == aSym && new_cmd == aEncr )
1330 else if( cmd == aEncr && new_cmd == aSym )
1332 else if (cmd == aSignEncr && new_cmd == aSym)
1334 else if (cmd == aSignSym && new_cmd == aEncr)
1336 else if (cmd == aEncrSym && new_cmd == aSign)
1338 else if( ( cmd == aSign && new_cmd == aClearsign )
1339 || ( cmd == aClearsign && new_cmd == aSign ) )
1342 log_error(_("conflicting commands\n"));
1351 add_group(char *string)
1354 struct groupitem *item;
1356 /* Break off the group name */
1357 name=strsep(&string,"=");
1360 log_error(_("no = sign found in group definition '%s'\n"),name);
1364 trim_trailing_ws(name,strlen(name));
1366 /* Does this group already exist? */
1367 for(item=opt.grouplist;item;item=item->next)
1368 if(strcasecmp(item->name,name)==0)
1373 item=xmalloc(sizeof(struct groupitem));
1375 item->next=opt.grouplist;
1380 /* Break apart the values */
1381 while ((value= strsep(&string," \t")))
1384 add_to_strlist2(&item->values,value,utf8_strings);
1390 rm_group(char *name)
1392 struct groupitem *item,*last=NULL;
1394 trim_trailing_ws(name,strlen(name));
1396 for(item=opt.grouplist;item;last=item,item=item->next)
1398 if(strcasecmp(item->name,name)==0)
1401 last->next=item->next;
1403 opt.grouplist=item->next;
1405 free_strlist(item->values);
1413 /* We need to check three things.
1415 0) The homedir. It must be x00, a directory, and owned by the
1418 1) The options/gpg.conf file. Okay unless it or its containing
1419 directory is group or other writable or not owned by us. Disable
1422 2) Extensions. Same as #1.
1424 Returns true if the item is unsafe. */
1426 check_permissions (const char *path, int item)
1428 #if defined(HAVE_STAT) && !defined(HAVE_DOSISH_SYSTEM)
1429 static int homedir_cache=-1;
1431 struct stat statbuf,dirbuf;
1432 int homedir=0,ret=0,checkonly=0;
1433 int perm=0,own=0,enc_dir_perm=0,enc_dir_own=0;
1435 if(opt.no_perm_warn)
1438 log_assert(item==0 || item==1 || item==2);
1440 /* extensions may attach a path */
1441 if(item==2 && path[0]!=DIRSEP_C)
1443 if(strchr(path,DIRSEP_C))
1444 tmppath=make_filename(path,NULL);
1446 tmppath=make_filename(gnupg_libdir (),path,NULL);
1449 tmppath=xstrdup(path);
1451 /* If the item is located in the homedir, but isn't the homedir,
1452 don't continue if we already checked the homedir itself. This is
1453 to avoid user confusion with an extra options file warning which
1454 could be rectified if the homedir itself had proper
1456 if(item!=0 && homedir_cache>-1
1457 && !ascii_strncasecmp (gnupg_homedir (), tmppath,
1458 strlen (gnupg_homedir ())))
1464 /* It's okay if the file or directory doesn't exist */
1465 if(stat(tmppath,&statbuf)!=0)
1471 /* Now check the enclosing directory. Theoretically, we could walk
1472 this test up to the root directory /, but for the sake of sanity,
1473 I'm stopping at one level down. */
1474 dir=make_dirname(tmppath);
1476 if(stat(dir,&dirbuf)!=0 || !S_ISDIR(dirbuf.st_mode))
1485 /* Assume failure */
1490 /* The homedir must be x00, a directory, and owned by the user. */
1492 if(S_ISDIR(statbuf.st_mode))
1494 if(statbuf.st_uid==getuid())
1496 if((statbuf.st_mode & (S_IRWXG|S_IRWXO))==0)
1507 else if(item==1 || item==2)
1509 /* The options or extension file. Okay unless it or its
1510 containing directory is group or other writable or not owned
1513 if(S_ISREG(statbuf.st_mode))
1515 if(statbuf.st_uid==getuid() || statbuf.st_uid==0)
1517 if((statbuf.st_mode & (S_IWGRP|S_IWOTH))==0)
1519 /* it's not writable, so make sure the enclosing
1520 directory is also not writable */
1521 if(dirbuf.st_uid==getuid() || dirbuf.st_uid==0)
1523 if((dirbuf.st_mode & (S_IWGRP|S_IWOTH))==0)
1533 /* it's writable, so the enclosing directory had
1534 better not let people get to it. */
1535 if(dirbuf.st_uid==getuid() || dirbuf.st_uid==0)
1537 if((dirbuf.st_mode & (S_IRWXG|S_IRWXO))==0)
1540 perm=enc_dir_perm=1; /* unclear which one to fix! */
1558 log_info(_("WARNING: unsafe ownership on"
1559 " homedir '%s'\n"),tmppath);
1561 log_info(_("WARNING: unsafe ownership on"
1562 " configuration file '%s'\n"),tmppath);
1564 log_info(_("WARNING: unsafe ownership on"
1565 " extension '%s'\n"),tmppath);
1570 log_info(_("WARNING: unsafe permissions on"
1571 " homedir '%s'\n"),tmppath);
1573 log_info(_("WARNING: unsafe permissions on"
1574 " configuration file '%s'\n"),tmppath);
1576 log_info(_("WARNING: unsafe permissions on"
1577 " extension '%s'\n"),tmppath);
1582 log_info(_("WARNING: unsafe enclosing directory ownership on"
1583 " homedir '%s'\n"),tmppath);
1585 log_info(_("WARNING: unsafe enclosing directory ownership on"
1586 " configuration file '%s'\n"),tmppath);
1588 log_info(_("WARNING: unsafe enclosing directory ownership on"
1589 " extension '%s'\n"),tmppath);
1594 log_info(_("WARNING: unsafe enclosing directory permissions on"
1595 " homedir '%s'\n"),tmppath);
1597 log_info(_("WARNING: unsafe enclosing directory permissions on"
1598 " configuration file '%s'\n"),tmppath);
1600 log_info(_("WARNING: unsafe enclosing directory permissions on"
1601 " extension '%s'\n"),tmppath);
1613 #else /*!(HAVE_STAT && !HAVE_DOSISH_SYSTEM)*/
1617 #endif /*!(HAVE_STAT && !HAVE_DOSISH_SYSTEM)*/
1621 /* Print the OpenPGP defined algo numbers. */
1623 print_algo_numbers(int (*checker)(int))
1642 print_algo_names(int (*checker)(int),const char *(*mapper)(int))
1654 es_printf ("%s",mapper(i));
1659 /* In the future, we can do all sorts of interesting configuration
1660 output here. For now, just give "group" as the Enigmail folks need
1661 it, and pubkey, cipher, hash, and compress as they may be useful
1664 list_config(char *items)
1666 int show_all = !items;
1669 struct groupitem *giter;
1672 if(!opt.with_colons)
1675 while(show_all || (name=strsep(&items," ")))
1679 if(show_all || ascii_strcasecmp(name,"group")==0)
1681 for (giter = opt.grouplist; giter; giter = giter->next)
1685 es_fprintf (es_stdout, "cfg:group:");
1686 es_write_sanitized (es_stdout, giter->name, strlen(giter->name),
1688 es_putc (':', es_stdout);
1690 for(sl=giter->values; sl; sl=sl->next)
1692 es_write_sanitized (es_stdout, sl->d, strlen (sl->d),
1704 if(show_all || ascii_strcasecmp(name,"version")==0)
1706 es_printf("cfg:version:");
1707 es_write_sanitized (es_stdout, VERSION, strlen(VERSION), ":", NULL);
1712 if(show_all || ascii_strcasecmp(name,"pubkey")==0)
1714 es_printf ("cfg:pubkey:");
1715 print_algo_numbers (build_list_pk_test_algo);
1720 if(show_all || ascii_strcasecmp(name,"pubkeyname")==0)
1722 es_printf ("cfg:pubkeyname:");
1723 print_algo_names (build_list_pk_test_algo,
1724 build_list_pk_algo_name);
1729 if(show_all || ascii_strcasecmp(name,"cipher")==0)
1731 es_printf ("cfg:cipher:");
1732 print_algo_numbers (build_list_cipher_test_algo);
1737 if (show_all || !ascii_strcasecmp (name,"ciphername"))
1739 es_printf ("cfg:ciphername:");
1740 print_algo_names (build_list_cipher_test_algo,
1741 build_list_cipher_algo_name);
1747 || ascii_strcasecmp(name,"digest")==0
1748 || ascii_strcasecmp(name,"hash")==0)
1750 es_printf ("cfg:digest:");
1751 print_algo_numbers (build_list_md_test_algo);
1757 || !ascii_strcasecmp(name,"digestname")
1758 || !ascii_strcasecmp(name,"hashname"))
1760 es_printf ("cfg:digestname:");
1761 print_algo_names (build_list_md_test_algo,
1762 build_list_md_algo_name);
1767 if(show_all || ascii_strcasecmp(name,"compress")==0)
1769 es_printf ("cfg:compress:");
1770 print_algo_numbers(check_compress_algo);
1775 if(show_all || ascii_strcasecmp (name, "compressname") == 0)
1777 es_printf ("cfg:compressname:");
1778 print_algo_names (check_compress_algo,
1779 compress_algo_to_string);
1784 if (show_all || !ascii_strcasecmp(name,"ccid-reader-id"))
1786 /* We ignore this for GnuPG 1.4 backward compatibility. */
1790 if (show_all || !ascii_strcasecmp (name,"curve"))
1792 es_printf ("cfg:curve:");
1793 for (iter=0, first=1; (s = openpgp_enum_curves (&iter)); first=0)
1794 es_printf ("%s%s", first?"":";", s);
1799 /* Curve OIDs are rarely useful and thus only printed if requested. */
1800 if (name && !ascii_strcasecmp (name,"curveoid"))
1802 es_printf ("cfg:curveoid:");
1803 for (iter=0, first=1; (s = openpgp_enum_curves (&iter)); first = 0)
1805 s = openpgp_curve_to_oid (s, NULL);
1806 es_printf ("%s%s", first?"":";", s? s:"[?]");
1816 log_error(_("unknown configuration item '%s'\n"),name);
1821 /* List options and default values in the GPG Conf format. This is a
1822 new tool distributed with gnupg 1.9.x but we also want some limited
1823 support in older gpg versions. The output is the name of the
1824 configuration file and a list of options available for editing by
1827 gpgconf_list (const char *configfile)
1829 char *configfile_esc = percent_escape (configfile, NULL);
1831 es_printf ("%s-%s.conf:%lu:\"%s\n",
1832 GPGCONF_NAME, GPG_NAME,
1833 GC_OPT_FLAG_DEFAULT,
1834 configfile_esc ? configfile_esc : "/dev/null");
1835 es_printf ("verbose:%lu:\n", GC_OPT_FLAG_NONE);
1836 es_printf ("quiet:%lu:\n", GC_OPT_FLAG_NONE);
1837 es_printf ("keyserver:%lu:\n", GC_OPT_FLAG_NONE);
1838 es_printf ("reader-port:%lu:\n", GC_OPT_FLAG_NONE);
1839 es_printf ("default-key:%lu:\n", GC_OPT_FLAG_NONE);
1840 es_printf ("encrypt-to:%lu:\n", GC_OPT_FLAG_NONE);
1841 es_printf ("try-secret-key:%lu:\n", GC_OPT_FLAG_NONE);
1842 es_printf ("auto-key-locate:%lu:\n", GC_OPT_FLAG_NONE);
1843 es_printf ("log-file:%lu:\n", GC_OPT_FLAG_NONE);
1844 es_printf ("debug-level:%lu:\"none:\n", GC_OPT_FLAG_DEFAULT);
1845 es_printf ("group:%lu:\n", GC_OPT_FLAG_NONE);
1846 es_printf ("compliance:%lu:\"%s:\n", GC_OPT_FLAG_DEFAULT, "gnupg");
1847 es_printf ("default-new-key-algo:%lu:\n", GC_OPT_FLAG_NONE);
1849 /* The next one is an info only item and should match the macros at
1850 the top of keygen.c */
1851 es_printf ("default_pubkey_algo:%lu:\"%s:\n", GC_OPT_FLAG_DEFAULT,
1852 get_default_pubkey_algo ());
1854 xfree (configfile_esc);
1859 parse_subpacket_list(char *list)
1862 byte subpackets[128],i;
1867 /* No arguments means all subpackets */
1868 memset(subpackets+1,1,sizeof(subpackets)-1);
1873 memset(subpackets,0,sizeof(subpackets));
1875 /* Merge with earlier copy */
1876 if(opt.show_subpackets)
1880 for(in=opt.show_subpackets;*in;in++)
1882 if(*in>127 || *in<1)
1885 if(!subpackets[*in])
1891 while((tok=strsep(&list," ,")))
1906 xfree(opt.show_subpackets);
1907 opt.show_subpackets=xmalloc(count+1);
1908 opt.show_subpackets[count--]=0;
1910 for(i=1;i<128 && count>=0;i++)
1912 opt.show_subpackets[count--]=i;
1919 parse_list_options(char *str)
1921 char *subpackets=""; /* something that isn't NULL */
1922 struct parse_options lopts[]=
1924 {"show-photos",LIST_SHOW_PHOTOS,NULL,
1925 N_("display photo IDs during key listings")},
1926 {"show-usage",LIST_SHOW_USAGE,NULL,
1927 N_("show key usage information during key listings")},
1928 {"show-policy-urls",LIST_SHOW_POLICY_URLS,NULL,
1929 N_("show policy URLs during signature listings")},
1930 {"show-notations",LIST_SHOW_NOTATIONS,NULL,
1931 N_("show all notations during signature listings")},
1932 {"show-std-notations",LIST_SHOW_STD_NOTATIONS,NULL,
1933 N_("show IETF standard notations during signature listings")},
1934 {"show-standard-notations",LIST_SHOW_STD_NOTATIONS,NULL,
1936 {"show-user-notations",LIST_SHOW_USER_NOTATIONS,NULL,
1937 N_("show user-supplied notations during signature listings")},
1938 {"show-keyserver-urls",LIST_SHOW_KEYSERVER_URLS,NULL,
1939 N_("show preferred keyserver URLs during signature listings")},
1940 {"show-uid-validity",LIST_SHOW_UID_VALIDITY,NULL,
1941 N_("show user ID validity during key listings")},
1942 {"show-unusable-uids",LIST_SHOW_UNUSABLE_UIDS,NULL,
1943 N_("show revoked and expired user IDs in key listings")},
1944 {"show-unusable-subkeys",LIST_SHOW_UNUSABLE_SUBKEYS,NULL,
1945 N_("show revoked and expired subkeys in key listings")},
1946 {"show-keyring",LIST_SHOW_KEYRING,NULL,
1947 N_("show the keyring name in key listings")},
1948 {"show-sig-expire",LIST_SHOW_SIG_EXPIRE,NULL,
1949 N_("show expiration dates during signature listings")},
1950 {"show-sig-subpackets",LIST_SHOW_SIG_SUBPACKETS,NULL,
1955 /* C99 allows for non-constant initializers, but we'd like to
1956 compile everywhere, so fill in the show-sig-subpackets argument
1957 here. Note that if the parse_options array changes, we'll have
1958 to change the subscript here. */
1959 lopts[13].value=&subpackets;
1961 if(parse_options(str,&opt.list_options,lopts,1))
1963 if(opt.list_options&LIST_SHOW_SIG_SUBPACKETS)
1965 /* Unset so users can pass multiple lists in. */
1966 opt.list_options&=~LIST_SHOW_SIG_SUBPACKETS;
1967 if(!parse_subpacket_list(subpackets))
1970 else if(subpackets==NULL && opt.show_subpackets)
1972 /* User did 'no-show-subpackets' */
1973 xfree(opt.show_subpackets);
1974 opt.show_subpackets=NULL;
1984 /* Collapses argc/argv into a single string that must be freed */
1986 collapse_args(int argc,char *argv[])
1989 int i,first=1,len=0;
1993 len+=strlen(argv[i])+2;
1994 str=xrealloc(str,len);
2003 strcat(str,argv[i]);
2010 #ifndef NO_TRUST_MODELS
2012 parse_trust_model(const char *model)
2014 if(ascii_strcasecmp(model,"pgp")==0)
2015 opt.trust_model=TM_PGP;
2016 else if(ascii_strcasecmp(model,"classic")==0)
2017 opt.trust_model=TM_CLASSIC;
2018 else if(ascii_strcasecmp(model,"always")==0)
2019 opt.trust_model=TM_ALWAYS;
2020 else if(ascii_strcasecmp(model,"direct")==0)
2021 opt.trust_model=TM_DIRECT;
2023 else if(ascii_strcasecmp(model,"tofu")==0)
2024 opt.trust_model=TM_TOFU;
2025 else if(ascii_strcasecmp(model,"tofu+pgp")==0)
2026 opt.trust_model=TM_TOFU_PGP;
2028 else if(ascii_strcasecmp(model,"auto")==0)
2029 opt.trust_model=TM_AUTO;
2031 log_error("unknown trust model '%s'\n",model);
2033 #endif /*NO_TRUST_MODELS*/
2037 parse_tofu_policy (const char *policystr)
2040 struct { const char *keyword; int policy; } list[] = {
2041 { "auto", TOFU_POLICY_AUTO },
2042 { "good", TOFU_POLICY_GOOD },
2043 { "unknown", TOFU_POLICY_UNKNOWN },
2044 { "bad", TOFU_POLICY_BAD },
2045 { "ask", TOFU_POLICY_ASK }
2049 if (!ascii_strcasecmp (policystr, "help"))
2051 log_info (_("valid values for option '%s':\n"), "--tofu-policy");
2052 for (i=0; i < DIM (list); i++)
2053 log_info (" %s\n", list[i].keyword);
2057 for (i=0; i < DIM (list); i++)
2058 if (!ascii_strcasecmp (policystr, list[i].keyword))
2059 return list[i].policy;
2062 log_error (_("unknown TOFU policy '%s'\n"), policystr);
2064 log_info (_("(use \"help\" to list choices)\n"));
2069 /* Parse the value of --compliance. */
2071 parse_compliance_option (const char *string)
2073 struct { const char *keyword; enum cmd_and_opt_values option; } list[] = {
2074 { "gnupg", oGnuPG },
2075 { "openpgp", oOpenPGP },
2076 { "rfc4880bis", oRFC4880bis },
2077 { "rfc4880", oRFC4880 },
2078 { "rfc2440", oRFC2440 },
2086 if (!ascii_strcasecmp (string, "help"))
2088 log_info (_("valid values for option '%s':\n"), "--compliance");
2089 for (i=0; i < DIM (list); i++)
2090 log_info (" %s\n", list[i].keyword);
2094 for (i=0; i < DIM (list); i++)
2095 if (!ascii_strcasecmp (string, list[i].keyword))
2096 return list[i].option;
2098 log_error (_("invalid value for option '%s'\n"), "--compliance");
2100 log_info (_("(use \"help\" to list choices)\n"));
2106 /* Helper to set compliance related options. This is a separte
2107 * function so that it can also be used by the --compliance option
2110 set_compliance_option (enum cmd_and_opt_values option)
2115 opt.flags.rfc4880bis = 1;
2119 /* This is effectively the same as RFC2440, but with
2120 "--enable-dsa2 --no-rfc2440-text --escape-from-lines
2121 --require-cross-certification". */
2122 opt.compliance = CO_RFC4880;
2124 opt.flags.require_cross_cert = 1;
2125 opt.rfc2440_text = 0;
2126 opt.allow_non_selfsigned_uid = 1;
2127 opt.allow_freeform_uid = 1;
2128 opt.escape_from = 1;
2129 opt.not_dash_escaped = 0;
2130 opt.def_cipher_algo = 0;
2131 opt.def_digest_algo = 0;
2132 opt.cert_digest_algo = 0;
2133 opt.compress_algo = -1;
2134 opt.s2k_mode = 3; /* iterated+salted */
2135 opt.s2k_digest_algo = DIGEST_ALGO_SHA1;
2136 opt.s2k_cipher_algo = CIPHER_ALGO_3DES;
2139 opt.compliance = CO_RFC2440;
2141 opt.rfc2440_text = 1;
2142 opt.allow_non_selfsigned_uid = 1;
2143 opt.allow_freeform_uid = 1;
2144 opt.escape_from = 0;
2145 opt.not_dash_escaped = 0;
2146 opt.def_cipher_algo = 0;
2147 opt.def_digest_algo = 0;
2148 opt.cert_digest_algo = 0;
2149 opt.compress_algo = -1;
2150 opt.s2k_mode = 3; /* iterated+salted */
2151 opt.s2k_digest_algo = DIGEST_ALGO_SHA1;
2152 opt.s2k_cipher_algo = CIPHER_ALGO_3DES;
2154 case oPGP6: opt.compliance = CO_PGP6; break;
2155 case oPGP7: opt.compliance = CO_PGP7; break;
2156 case oPGP8: opt.compliance = CO_PGP8; break;
2157 case oGnuPG: opt.compliance = CO_GNUPG; break;
2160 set_compliance_option (oOpenPGP);
2161 opt.compliance = CO_DE_VS;
2162 /* Fixme: Change other options. */
2175 /* This function called to initialized a new control object. It is
2176 assumed that this object has been zeroed out before calling this
2179 gpg_init_default_ctrl (ctrl_t ctrl)
2185 /* This function is called to deinitialize a control object. It is
2188 gpg_deinit_default_ctrl (ctrl_t ctrl)
2191 tofu_closedbs (ctrl);
2193 gpg_dirmngr_deinit_session_data (ctrl);
2198 get_default_configname (void)
2200 char *configname = NULL;
2201 char *name = xstrdup (GPG_NAME EXTSEP_S "conf-" SAFE_VERSION);
2202 char *ver = &name[strlen (GPG_NAME EXTSEP_S "conf-")];
2213 if ((tok = strrchr (ver, SAFE_VERSION_DASH)))
2215 else if ((tok = strrchr (ver, SAFE_VERSION_DOT)))
2221 configname = make_filename (gnupg_homedir (), name, NULL);
2223 while (access (configname, R_OK));
2228 configname = make_filename (gnupg_homedir (),
2229 GPG_NAME EXTSEP_S "conf", NULL);
2230 if (! access (configname, R_OK))
2232 /* Print a warning when both config files are present. */
2233 char *p = make_filename (gnupg_homedir (), "options", NULL);
2234 if (! access (p, R_OK))
2235 log_info (_("Note: old default options file '%s' ignored\n"), p);
2240 /* Use the old default only if it exists. */
2241 char *p = make_filename (gnupg_homedir (), "options", NULL);
2242 if (!access (p, R_OK))
2255 main (int argc, char **argv)
2257 ARGPARSE_ARGS pargs;
2266 strlist_t remusr = NULL;
2267 strlist_t locusr = NULL;
2268 strlist_t nrings = NULL;
2269 armor_filter_context_t *afx = NULL;
2270 int detached_sig = 0;
2271 FILE *configfp = NULL;
2272 char *configname = NULL;
2273 char *save_configname = NULL;
2274 char *default_configname = NULL;
2275 unsigned configlineno;
2276 int parse_debug = 0;
2277 int default_config = 1;
2278 int default_keyring = 1;
2281 char *logfile = NULL;
2282 int use_random_seed = 1;
2283 enum cmd_and_opt_values cmd = 0;
2284 const char *debug_level = NULL;
2285 #ifndef NO_TRUST_MODELS
2286 const char *trustdb_name = NULL;
2287 #endif /*!NO_TRUST_MODELS*/
2288 char *def_cipher_string = NULL;
2289 char *def_digest_string = NULL;
2290 char *compress_algo_string = NULL;
2291 char *cert_digest_string = NULL;
2292 char *s2k_cipher_string = NULL;
2293 char *s2k_digest_string = NULL;
2294 char *pers_cipher_list = NULL;
2295 char *pers_digest_list = NULL;
2296 char *pers_compress_list = NULL;
2300 int ovrseskeyfd = -1;
2301 int fpr_maybe_cmd = 0; /* --fingerprint maybe a command. */
2302 int any_explicit_recipient = 0;
2303 int require_secmem = 0;
2305 struct assuan_malloc_hooks malloc_hooks;
2308 static int print_dane_records;
2309 static int print_pka_records;
2314 #endif /* __riscos__ */
2316 /* Please note that we may running SUID(ROOT), so be very CAREFUL
2317 when adding any stuff between here and the call to
2318 secmem_init() somewhere after the option parsing. */
2319 early_system_init ();
2320 gnupg_reopen_std (GPG_NAME);
2322 gnupg_rl_initialize ();
2323 set_strusage (my_strusage);
2324 gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
2325 log_set_prefix (GPG_NAME, GPGRT_LOG_WITH_PREFIX);
2327 /* Make sure that our subsystems are ready. */
2329 init_common_subsystems (&argc, &argv);
2331 /* Use our own logging handler for Libcgrypt. */
2332 setup_libgcrypt_logging ();
2334 /* Put random number into secure memory */
2335 gcry_control (GCRYCTL_USE_SECURE_RNDPOOL);
2337 may_coredump = disable_core_dumps();
2339 gnupg_init_signals (0, emergency_cleanup);
2341 dotlock_create (NULL, 0); /* Register lock file cleanup. */
2344 opt.session_env = session_env_new ();
2345 if (!opt.session_env)
2346 log_fatal ("error allocating session environment block: %s\n",
2349 opt.command_fd = -1; /* no command fd */
2350 opt.compress_level = -1; /* defaults to standard compress level */
2351 opt.bz2_compress_level = -1; /* defaults to standard compress level */
2352 /* note: if you change these lines, look at oOpenPGP */
2353 opt.def_cipher_algo = 0;
2354 opt.def_digest_algo = 0;
2355 opt.cert_digest_algo = 0;
2356 opt.compress_algo = -1; /* defaults to DEFAULT_COMPRESS_ALGO */
2357 opt.s2k_mode = 3; /* iterated+salted */
2358 opt.s2k_count = 0; /* Auto-calibrate when needed. */
2359 opt.s2k_cipher_algo = DEFAULT_CIPHER_ALGO;
2360 opt.completes_needed = 1;
2361 opt.marginals_needed = 3;
2362 opt.max_cert_depth = 5;
2363 opt.escape_from = 1;
2364 opt.flags.require_cross_cert = 1;
2365 opt.import_options = 0;
2366 opt.export_options = EXPORT_ATTRIBUTES;
2367 opt.keyserver_options.import_options = IMPORT_REPAIR_PKS_SUBKEY_BUG;
2368 opt.keyserver_options.export_options = EXPORT_ATTRIBUTES;
2369 opt.keyserver_options.options = KEYSERVER_HONOR_PKA_RECORD;
2370 opt.verify_options = (LIST_SHOW_UID_VALIDITY
2371 | VERIFY_SHOW_POLICY_URLS
2372 | VERIFY_SHOW_STD_NOTATIONS
2373 | VERIFY_SHOW_KEYSERVER_URLS);
2374 opt.list_options = (LIST_SHOW_UID_VALIDITY
2376 #ifdef NO_TRUST_MODELS
2377 opt.trust_model = TM_ALWAYS;
2379 opt.trust_model = TM_AUTO;
2381 opt.tofu_default_policy = TOFU_POLICY_AUTO;
2382 opt.mangle_dos_filenames = 0;
2383 opt.min_cert_level = 2;
2384 set_screen_dimensions ();
2385 opt.keyid_format = KF_NONE;
2386 opt.def_sig_expire = "0";
2387 opt.def_cert_expire = "0";
2388 gnupg_set_homedir (NULL);
2389 opt.passphrase_repeat = 1;
2390 opt.emit_version = 0;
2391 opt.weak_digests = NULL;
2392 additional_weak_digest("MD5");
2394 /* Check whether we have a config file on the command line. */
2399 pargs.flags= (ARGPARSE_FLAG_KEEP | ARGPARSE_FLAG_NOVERSION);
2400 while( arg_parse( &pargs, opts) ) {
2401 if( pargs.r_opt == oDebug || pargs.r_opt == oDebugAll )
2403 else if (pargs.r_opt == oDebugIOLBF)
2404 es_setvbuf (es_stdout, NULL, _IOLBF, 0);
2405 else if( pargs.r_opt == oOptions ) {
2406 /* yes there is one, so we do not try the default one, but
2407 * read the option file when it is encountered at the commandline
2411 else if( pargs.r_opt == oNoOptions )
2413 default_config = 0; /* --no-options */
2414 opt.no_homedir_creation = 1;
2416 else if( pargs.r_opt == oHomedir )
2417 gnupg_set_homedir (pargs.r.ret_str);
2418 else if( pargs.r_opt == oNoPermissionWarn )
2420 else if (pargs.r_opt == oStrict )
2424 else if (pargs.r_opt == oNoStrict )
2430 #ifdef HAVE_DOSISH_SYSTEM
2431 if ( strchr (gnupg_homedir (), '\\') ) {
2432 char *d, *buf = xmalloc (strlen (gnupg_homedir ())+1);
2434 for (d=buf, s = gnupg_homedir (); *s; s++)
2436 *d++ = *s == '\\'? '/': *s;
2437 #ifdef HAVE_W32_SYSTEM
2438 if (s[1] && IsDBCSLeadByte (*s))
2443 gnupg_set_homedir (buf);
2447 /* Initialize the secure memory. */
2448 if (!gcry_control (GCRYCTL_INIT_SECMEM, SECMEM_BUFFER_SIZE, 0))
2450 #if defined(HAVE_GETUID) && defined(HAVE_GETEUID)
2451 /* There should be no way to get to this spot while still carrying
2452 setuid privs. Just in case, bomb out if we are. */
2453 if ( getuid () != geteuid () )
2458 /* Okay, we are now working under our real uid */
2460 /* malloc hooks go here ... */
2461 malloc_hooks.malloc = gcry_malloc;
2462 malloc_hooks.realloc = gcry_realloc;
2463 malloc_hooks.free = gcry_free;
2464 assuan_set_malloc_hooks (&malloc_hooks);
2465 assuan_set_gpg_err_source (GPG_ERR_SOURCE_DEFAULT);
2466 setup_libassuan_logging (&opt.debug, NULL);
2468 /* Try for a version specific config file first */
2469 default_configname = get_default_configname ();
2471 configname = xstrdup (default_configname);
2477 pargs.flags= ARGPARSE_FLAG_KEEP;
2479 /* By this point we have a homedir, and cannot change it. */
2480 check_permissions (gnupg_homedir (), 0);
2484 if(check_permissions(configname,1))
2486 /* If any options file is unsafe, then disable any external
2487 programs for keyserver calls or photo IDs. Since the
2488 external program to call is set in the options file, a
2489 unsafe options file can lead to an arbitrary program
2496 configfp = fopen( configname, "r" );
2497 if (configfp && is_secured_file (fileno (configfp)))
2501 gpg_err_set_errno (EPERM);
2504 if( default_config ) {
2506 log_info(_("Note: no default option file '%s'\n"),
2510 log_error(_("option file '%s': %s\n"),
2511 configname, strerror(errno) );
2514 xfree(configname); configname = NULL;
2516 if( parse_debug && configname )
2517 log_info(_("reading options from '%s'\n"), configname );
2521 while( optfile_parse( configfp, configname, &configlineno,
2524 switch( pargs.r_opt )
2527 case aListGcryptConfig:
2530 set_cmd (&cmd, pargs.r_opt);
2531 /* Do not register a keyring for these commands. */
2532 default_keyring = -1;
2545 #ifdef ENABLE_CARD_SUPPORT
2549 #endif /* ENABLE_CARD_SUPPORT*/
2554 case aExportSecretSub:
2566 case aUpdateTrustDB:
2568 case aListTrustPath:
2573 case aQuickLSignKey:
2581 case aQuickSetExpire:
2582 case aExportOwnerTrust:
2583 case aImportOwnerTrust:
2584 case aRebuildKeydbCaches:
2585 set_cmd (&cmd, pargs.r_opt);
2591 case aDeleteSecretKeys:
2592 case aDeleteSecretAndPublicKeys:
2595 set_cmd (&cmd, pargs.r_opt);
2599 case aDetachedSign: detached_sig = 1; set_cmd( &cmd, aSign ); break;
2601 case aDecryptFiles: multifile=1; /* fall through */
2602 case aDecrypt: set_cmd( &cmd, aDecrypt); break;
2604 case aEncrFiles: multifile=1; /* fall through */
2605 case aEncr: set_cmd( &cmd, aEncr); break;
2607 case aVerifyFiles: multifile=1; /* fall through */
2608 case aVerify: set_cmd( &cmd, aVerify); break;
2611 set_cmd (&cmd, pargs.r_opt);
2616 set_cmd (&cmd, pargs.r_opt);
2619 case oArmor: opt.armor = 1; opt.no_armor=0; break;
2620 case oOutput: opt.outfile = pargs.r.ret_str; break;
2622 case oMaxOutput: opt.max_output = pargs.r.ret_ulong; break;
2624 case oInputSizeHint:
2625 opt.input_size_hint = string_to_u64 (pargs.r.ret_str);
2628 case oQuiet: opt.quiet = 1; break;
2629 case oNoTTY: tty_no_terminal(1); break;
2630 case oDryRun: opt.dry_run = 1; break;
2631 case oInteractive: opt.interactive = 1; break;
2634 gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
2635 opt.list_options|=LIST_SHOW_UNUSABLE_UIDS;
2636 opt.list_options|=LIST_SHOW_UNUSABLE_SUBKEYS;
2644 case oUseAgent: /* Dummy. */
2648 obsolete_option (configname, configlineno, "no-use-agent");
2651 obsolete_option (configname, configlineno, "gpg-agent-info");
2654 obsolete_scdaemon_option (configname, configlineno, "reader-port");
2657 obsolete_scdaemon_option (configname, configlineno, "ctapi-driver");
2660 obsolete_scdaemon_option (configname, configlineno, "pcsc-driver");
2663 obsolete_scdaemon_option (configname, configlineno, "disable-ccid");
2665 case oHonorHttpProxy:
2666 obsolete_option (configname, configlineno, "honor-http-proxy");
2669 case oAnswerYes: opt.answer_yes = 1; break;
2670 case oAnswerNo: opt.answer_no = 1; break;
2671 case oKeyring: append_to_strlist( &nrings, pargs.r.ret_str); break;
2672 case oPrimaryKeyring:
2673 sl = append_to_strlist (&nrings, pargs.r.ret_str);
2674 sl->flags = KEYDB_RESOURCE_FLAG_PRIMARY;
2677 deprecated_warning(configname,configlineno,"--show-keyring",
2678 "--list-options ","show-keyring");
2679 opt.list_options|=LIST_SHOW_KEYRING;
2683 if (parse_debug_flag (pargs.r.ret_str, &opt.debug, debug_flags))
2685 pargs.r_opt = ARGPARSE_INVALID_ARG;
2686 pargs.err = ARGPARSE_PRINT_ERROR;
2690 case oDebugAll: opt.debug = ~0; break;
2691 case oDebugLevel: debug_level = pargs.r.ret_str; break;
2693 case oDebugIOLBF: break; /* Already set in pre-parse step. */
2696 set_status_fd ( translate_sys2libc_fd_int (pargs.r.ret_int, 1) );
2699 set_status_fd ( open_info_file (pargs.r.ret_str, 1, 0) );
2702 set_attrib_fd ( translate_sys2libc_fd_int (pargs.r.ret_int, 1) );
2704 case oAttributeFile:
2705 set_attrib_fd ( open_info_file (pargs.r.ret_str, 1, 1) );
2708 log_set_fd (translate_sys2libc_fd_int (pargs.r.ret_int, 1));
2711 logfile = pargs.r.ret_str;
2714 case oWithFingerprint:
2715 opt.with_fingerprint = 1;
2718 case oWithSubkeyFingerprint:
2719 opt.with_subkey_fingerprint = 1;
2721 case oWithICAOSpelling:
2722 opt.with_icao_spelling = 1;
2730 opt.with_keygrip = 1;
2734 opt.with_secret = 1;
2738 opt.with_wkd_hash = 1;
2741 case oSecretKeyring:
2742 /* Ignore this old option. */
2746 /* config files may not be nested (silently ignore them) */
2749 configname = xstrdup(pargs.r.ret_str);
2753 case oNoArmor: opt.no_armor=1; opt.armor=0; break;
2756 if (default_keyring > 0)
2757 default_keyring = 0;
2760 default_keyring = -1;
2763 case oNoGreeting: nogreeting = 1; break;
2766 gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
2770 gcry_control (GCRYCTL_ENABLE_QUICK_RANDOM, 0);
2772 case oEmitVersion: opt.emit_version++; break;
2773 case oNoEmitVersion: opt.emit_version=0; break;
2774 case oCompletesNeeded: opt.completes_needed = pargs.r.ret_int; break;
2775 case oMarginalsNeeded: opt.marginals_needed = pargs.r.ret_int; break;
2776 case oMaxCertDepth: opt.max_cert_depth = pargs.r.ret_int; break;
2778 #ifndef NO_TRUST_MODELS
2779 case oTrustDBName: trustdb_name = pargs.r.ret_str; break;
2781 #endif /*!NO_TRUST_MODELS*/
2783 sl = add_to_strlist (&opt.def_secret_key, pargs.r.ret_str);
2784 sl->flags = (pargs.r_opt << PK_LIST_SHIFT);
2786 sl->flags |= PK_LIST_CONFIG;
2789 if( *pargs.r.ret_str )
2791 xfree (opt.def_recipient);
2792 opt.def_recipient = make_username(pargs.r.ret_str);
2795 case oDefRecipientSelf:
2796 xfree(opt.def_recipient); opt.def_recipient = NULL;
2797 opt.def_recipient_self = 1;
2799 case oNoDefRecipient:
2800 xfree(opt.def_recipient); opt.def_recipient = NULL;
2801 opt.def_recipient_self = 0;
2803 case oNoOptions: opt.no_homedir_creation = 1; break; /* no-options */
2804 case oHomedir: break;
2805 case oNoBatch: opt.batch = 0; break;
2807 case oWithTofuInfo: opt.with_tofu_info = 1; break;
2809 case oWithKeyData: opt.with_key_data=1; /*FALLTHRU*/
2810 case oWithColons: opt.with_colons=':'; break;
2812 case oWithSigCheck: opt.check_sigs = 1; /*FALLTHRU*/
2813 case oWithSigList: opt.list_sigs = 1; break;
2815 case oSkipVerify: opt.skip_verify=1; break;
2817 case oSkipHiddenRecipients: opt.skip_hidden_recipients = 1; break;
2818 case oNoSkipHiddenRecipients: opt.skip_hidden_recipients = 0; break;
2820 case aListSecretKeys: set_cmd( &cmd, aListSecretKeys); break;
2822 #ifndef NO_TRUST_MODELS
2823 /* There are many programs (like mutt) that call gpg with
2824 --always-trust so keep this option around for a long
2826 case oAlwaysTrust: opt.trust_model=TM_ALWAYS; break;
2828 parse_trust_model(pargs.r.ret_str);
2830 #endif /*!NO_TRUST_MODELS*/
2831 case oTOFUDefaultPolicy:
2832 opt.tofu_default_policy = parse_tofu_policy (pargs.r.ret_str);
2835 obsolete_option (configname, configlineno, "tofu-db-format");
2838 case oForceOwnertrust:
2839 log_info(_("Note: %s is not for normal use!\n"),
2840 "--force-ownertrust");
2841 opt.force_ownertrust=string_to_trust_value(pargs.r.ret_str);
2842 if(opt.force_ownertrust==-1)
2844 log_error("invalid ownertrust '%s'\n",pargs.r.ret_str);
2845 opt.force_ownertrust=0;
2848 case oLoadExtension:
2849 /* Dummy so that gpg 1.4 conf files can work. Should
2850 eventually be removed. */
2854 set_compliance_option (parse_compliance_option (pargs.r.ret_str));
2864 set_compliance_option (pargs.r_opt);
2867 case oRFC2440Text: opt.rfc2440_text=1; break;
2868 case oNoRFC2440Text: opt.rfc2440_text=0; break;
2872 opt.set_filename = pargs.r.ret_str;
2874 opt.set_filename = native_to_utf8(pargs.r.ret_str);
2876 case oForYourEyesOnly: eyes_only = 1; break;
2877 case oNoForYourEyesOnly: eyes_only = 0; break;
2879 add_policy_url(pargs.r.ret_str,0);
2880 add_policy_url(pargs.r.ret_str,1);
2882 case oSigPolicyURL: add_policy_url(pargs.r.ret_str,0); break;
2883 case oCertPolicyURL: add_policy_url(pargs.r.ret_str,1); break;
2884 case oShowPolicyURL:
2885 deprecated_warning(configname,configlineno,"--show-policy-url",
2886 "--list-options ","show-policy-urls");
2887 deprecated_warning(configname,configlineno,"--show-policy-url",
2888 "--verify-options ","show-policy-urls");
2889 opt.list_options|=LIST_SHOW_POLICY_URLS;
2890 opt.verify_options|=VERIFY_SHOW_POLICY_URLS;
2892 case oNoShowPolicyURL:
2893 deprecated_warning(configname,configlineno,"--no-show-policy-url",
2894 "--list-options ","no-show-policy-urls");
2895 deprecated_warning(configname,configlineno,"--no-show-policy-url",
2896 "--verify-options ","no-show-policy-urls");
2897 opt.list_options&=~LIST_SHOW_POLICY_URLS;
2898 opt.verify_options&=~VERIFY_SHOW_POLICY_URLS;
2900 case oSigKeyserverURL: add_keyserver_url(pargs.r.ret_str,0); break;
2901 case oUseEmbeddedFilename:
2902 opt.flags.use_embedded_filename=1;
2904 case oNoUseEmbeddedFilename:
2905 opt.flags.use_embedded_filename=0;
2908 if(pargs.r.ret_str[0])
2909 append_to_strlist(&opt.comments,pargs.r.ret_str);
2911 case oDefaultComment:
2912 deprecated_warning(configname,configlineno,
2913 "--default-comment","--no-comments","");
2916 free_strlist(opt.comments);
2919 case oThrowKeyids: opt.throw_keyids = 1; break;
2920 case oNoThrowKeyids: opt.throw_keyids = 0; break;
2922 deprecated_warning(configname,configlineno,"--show-photos",
2923 "--list-options ","show-photos");
2924 deprecated_warning(configname,configlineno,"--show-photos",
2925 "--verify-options ","show-photos");
2926 opt.list_options|=LIST_SHOW_PHOTOS;
2927 opt.verify_options|=VERIFY_SHOW_PHOTOS;
2930 deprecated_warning(configname,configlineno,"--no-show-photos",
2931 "--list-options ","no-show-photos");
2932 deprecated_warning(configname,configlineno,"--no-show-photos",
2933 "--verify-options ","no-show-photos");
2934 opt.list_options&=~LIST_SHOW_PHOTOS;
2935 opt.verify_options&=~VERIFY_SHOW_PHOTOS;
2937 case oPhotoViewer: opt.photo_viewer = pargs.r.ret_str; break;
2939 case oForceMDC: opt.force_mdc = 1; break;
2940 case oNoForceMDC: opt.force_mdc = 0; break;
2941 case oDisableMDC: opt.disable_mdc = 1; break;
2942 case oNoDisableMDC: opt.disable_mdc = 0; break;
2944 case oDisableSignerUID: opt.flags.disable_signer_uid = 1; break;
2946 case oS2KMode: opt.s2k_mode = pargs.r.ret_int; break;
2947 case oS2KDigest: s2k_digest_string = xstrdup(pargs.r.ret_str); break;
2948 case oS2KCipher: s2k_cipher_string = xstrdup(pargs.r.ret_str); break;
2950 if (pargs.r.ret_int)
2951 opt.s2k_count = encode_s2k_iterations (pargs.r.ret_int);
2953 opt.s2k_count = 0; /* Auto-calibrate when needed. */
2957 case oHiddenRecipient:
2958 case oRecipientFile:
2959 case oHiddenRecipientFile:
2960 /* Store the recipient. Note that we also store the
2961 * option as private data in the flags. This is achieved
2962 * by shifting the option value to the left so to keep
2963 * enough space for the flags. */
2964 sl = add_to_strlist2( &remusr, pargs.r.ret_str, utf8_strings );
2965 sl->flags = (pargs.r_opt << PK_LIST_SHIFT);
2967 sl->flags |= PK_LIST_CONFIG;
2968 if (pargs.r_opt == oHiddenRecipient
2969 || pargs.r_opt == oHiddenRecipientFile)
2970 sl->flags |= PK_LIST_HIDDEN;
2971 if (pargs.r_opt == oRecipientFile
2972 || pargs.r_opt == oHiddenRecipientFile)
2973 sl->flags |= PK_LIST_FROM_FILE;
2974 any_explicit_recipient = 1;
2978 case oHiddenEncryptTo:
2979 /* Store an additional recipient. */
2980 sl = add_to_strlist2( &remusr, pargs.r.ret_str, utf8_strings );
2981 sl->flags = ((pargs.r_opt << PK_LIST_SHIFT) | PK_LIST_ENCRYPT_TO);
2983 sl->flags |= PK_LIST_CONFIG;
2984 if (pargs.r_opt == oHiddenEncryptTo)
2985 sl->flags |= PK_LIST_HIDDEN;
2989 opt.no_encrypt_to = 1;
2991 case oEncryptToDefaultKey:
2992 opt.encrypt_to_default_key = configfp ? 2 : 1;
2996 add_to_strlist2 (&opt.secret_keys_to_try,
2997 pargs.r.ret_str, utf8_strings);
3000 case oMimemode: opt.mimemode = opt.textmode = 1; break;
3001 case oTextmodeShort: opt.textmode = 2; break;
3002 case oTextmode: opt.textmode=1; break;
3003 case oNoTextmode: opt.textmode=opt.mimemode=0; break;
3005 case oExpert: opt.expert = 1; break;
3006 case oNoExpert: opt.expert = 0; break;
3008 if(*pargs.r.ret_str!='\0')
3010 if(parse_expire_string(pargs.r.ret_str)==(u32)-1)
3011 log_error(_("'%s' is not a valid signature expiration\n"),
3014 opt.def_sig_expire=pargs.r.ret_str;
3017 case oAskSigExpire: opt.ask_sig_expire = 1; break;
3018 case oNoAskSigExpire: opt.ask_sig_expire = 0; break;
3019 case oDefCertExpire:
3020 if(*pargs.r.ret_str!='\0')
3022 if(parse_expire_string(pargs.r.ret_str)==(u32)-1)
3023 log_error(_("'%s' is not a valid signature expiration\n"),
3026 opt.def_cert_expire=pargs.r.ret_str;
3029 case oAskCertExpire: opt.ask_cert_expire = 1; break;
3030 case oNoAskCertExpire: opt.ask_cert_expire = 0; break;
3031 case oDefCertLevel: opt.def_cert_level=pargs.r.ret_int; break;
3032 case oMinCertLevel: opt.min_cert_level=pargs.r.ret_int; break;
3033 case oAskCertLevel: opt.ask_cert_level = 1; break;
3034 case oNoAskCertLevel: opt.ask_cert_level = 0; break;
3035 case oLocalUser: /* store the local users */
3036 sl = add_to_strlist2( &locusr, pargs.r.ret_str, utf8_strings );
3037 sl->flags = (pargs.r_opt << PK_LIST_SHIFT);
3039 sl->flags |= PK_LIST_CONFIG;
3043 char *mbox = mailbox_from_userid (pargs.r.ret_str);
3045 log_error (_("\"%s\" is not a proper mail address\n"),
3049 add_to_strlist (&opt.sender_list, mbox);
3055 /* this is the -z command line option */
3056 opt.compress_level = opt.bz2_compress_level = pargs.r.ret_int;
3058 case oCompressLevel: opt.compress_level = pargs.r.ret_int; break;
3059 case oBZ2CompressLevel: opt.bz2_compress_level = pargs.r.ret_int; break;
3060 case oBZ2DecompressLowmem: opt.bz2_decompress_lowmem=1; break;
3062 set_passphrase_from_string(pargs.r.ret_str);
3065 pwfd = translate_sys2libc_fd_int (pargs.r.ret_int, 0);
3067 case oPassphraseFile:
3068 pwfd = open_info_file (pargs.r.ret_str, 0, 1);
3070 case oPassphraseRepeat:
3071 opt.passphrase_repeat = pargs.r.ret_int;
3075 opt.pinentry_mode = parse_pinentry_mode (pargs.r.ret_str);
3076 if (opt.pinentry_mode == -1)
3077 log_error (_("invalid pinentry mode '%s'\n"), pargs.r.ret_str);
3081 opt.command_fd = translate_sys2libc_fd_int (pargs.r.ret_int, 0);
3082 if (! gnupg_fd_valid (opt.command_fd))
3083 log_fatal ("command-fd is invalid: %s\n", strerror (errno));
3086 opt.command_fd = open_info_file (pargs.r.ret_str, 0, 1);
3089 def_cipher_string = xstrdup(pargs.r.ret_str);
3092 def_digest_string = xstrdup(pargs.r.ret_str);
3095 /* If it is all digits, stick a Z in front of it for
3096 later. This is for backwards compatibility with
3097 versions that took the compress algorithm number. */
3099 char *pt=pargs.r.ret_str;
3102 if (!isascii (*pt) || !isdigit (*pt))
3110 compress_algo_string=xmalloc(strlen(pargs.r.ret_str)+2);
3111 strcpy(compress_algo_string,"Z");
3112 strcat(compress_algo_string,pargs.r.ret_str);
3115 compress_algo_string = xstrdup(pargs.r.ret_str);
3118 case oCertDigestAlgo:
3119 cert_digest_string = xstrdup(pargs.r.ret_str);
3123 gcry_control (GCRYCTL_DISABLE_SECMEM_WARN);
3126 case oRequireSecmem: require_secmem=1; break;
3127 case oNoRequireSecmem: require_secmem=0; break;
3128 case oNoPermissionWarn: opt.no_perm_warn=1; break;
3129 case oNoMDCWarn: opt.no_mdc_warn=1; break;
3130 case oDisplayCharset:
3131 if( set_native_charset( pargs.r.ret_str ) )
3132 log_error(_("'%s' is not a valid character set\n"),
3135 case oNotDashEscaped: opt.not_dash_escaped = 1; break;
3136 case oEscapeFrom: opt.escape_from = 1; break;
3137 case oNoEscapeFrom: opt.escape_from = 0; break;
3138 case oLockOnce: opt.lock_once = 1; break;
3145 #else /* __riscos__ */
3146 riscos_not_implemented("lock-multiple");
3147 #endif /* __riscos__ */
3151 keyserver_spec_t keyserver;
3152 keyserver = parse_keyserver_uri (pargs.r.ret_str, 0);
3154 log_error (_("could not parse keyserver URL\n"));
3157 /* We only support a single keyserver. Later ones
3158 override earlier ones. (Since we parse the
3159 config file first and then the command line
3160 arguments, the command line takes
3163 free_keyserver_spec (opt.keyserver);
3164 opt.keyserver = keyserver;
3168 case oKeyServerOptions:
3169 if(!parse_keyserver_options(pargs.r.ret_str))
3172 log_error(_("%s:%d: invalid keyserver options\n"),
3173 configname,configlineno);
3175 log_error(_("invalid keyserver options\n"));
3178 case oImportOptions:
3179 if(!parse_import_options(pargs.r.ret_str,&opt.import_options,1))
3182 log_error(_("%s:%d: invalid import options\n"),
3183 configname,configlineno);
3185 log_error(_("invalid import options\n"));
3189 rc = parse_and_set_import_filter (pargs.r.ret_str);
3191 log_error (_("invalid filter option: %s\n"), gpg_strerror (rc));
3193 case oExportOptions:
3194 if(!parse_export_options(pargs.r.ret_str,&opt.export_options,1))
3197 log_error(_("%s:%d: invalid export options\n"),
3198 configname,configlineno);
3200 log_error(_("invalid export options\n"));
3204 rc = parse_and_set_export_filter (pargs.r.ret_str);
3206 log_error (_("invalid filter option: %s\n"), gpg_strerror (rc));
3209 if(!parse_list_options(pargs.r.ret_str))
3212 log_error(_("%s:%d: invalid list options\n"),
3213 configname,configlineno);
3215 log_error(_("invalid list options\n"));
3218 case oVerifyOptions:
3220 struct parse_options vopts[]=
3222 {"show-photos",VERIFY_SHOW_PHOTOS,NULL,
3223 N_("display photo IDs during signature verification")},
3224 {"show-policy-urls",VERIFY_SHOW_POLICY_URLS,NULL,
3225 N_("show policy URLs during signature verification")},
3226 {"show-notations",VERIFY_SHOW_NOTATIONS,NULL,
3227 N_("show all notations during signature verification")},
3228 {"show-std-notations",VERIFY_SHOW_STD_NOTATIONS,NULL,
3229 N_("show IETF standard notations during signature verification")},
3230 {"show-standard-notations",VERIFY_SHOW_STD_NOTATIONS,NULL,
3232 {"show-user-notations",VERIFY_SHOW_USER_NOTATIONS,NULL,
3233 N_("show user-supplied notations during signature verification")},
3234 {"show-keyserver-urls",VERIFY_SHOW_KEYSERVER_URLS,NULL,
3235 N_("show preferred keyserver URLs during signature verification")},
3236 {"show-uid-validity",VERIFY_SHOW_UID_VALIDITY,NULL,
3237 N_("show user ID validity during signature verification")},
3238 {"show-unusable-uids",VERIFY_SHOW_UNUSABLE_UIDS,NULL,
3239 N_("show revoked and expired user IDs in signature verification")},
3240 {"show-primary-uid-only",VERIFY_SHOW_PRIMARY_UID_ONLY,NULL,
3241 N_("show only the primary user ID in signature verification")},
3242 {"pka-lookups",VERIFY_PKA_LOOKUPS,NULL,
3243 N_("validate signatures with PKA data")},
3244 {"pka-trust-increase",VERIFY_PKA_TRUST_INCREASE,NULL,
3245 N_("elevate the trust of signatures with valid PKA data")},
3249 if(!parse_options(pargs.r.ret_str,&opt.verify_options,vopts,1))
3252 log_error(_("%s:%d: invalid verify options\n"),
3253 configname,configlineno);
3255 log_error(_("invalid verify options\n"));
3259 case oTempDir: opt.temp_dir=pargs.r.ret_str; break;
3261 if(set_exec_path(pargs.r.ret_str))
3262 log_error(_("unable to set exec-path to %s\n"),pargs.r.ret_str);
3264 opt.exec_path_set=1;
3267 add_notation_data( pargs.r.ret_str, 0 );
3268 add_notation_data( pargs.r.ret_str, 1 );
3270 case oSigNotation: add_notation_data( pargs.r.ret_str, 0 ); break;
3271 case oCertNotation: add_notation_data( pargs.r.ret_str, 1 ); break;
3273 deprecated_warning(configname,configlineno,"--show-notation",
3274 "--list-options ","show-notations");
3275 deprecated_warning(configname,configlineno,"--show-notation",
3276 "--verify-options ","show-notations");
3277 opt.list_options|=LIST_SHOW_NOTATIONS;
3278 opt.verify_options|=VERIFY_SHOW_NOTATIONS;
3280 case oNoShowNotation:
3281 deprecated_warning(configname,configlineno,"--no-show-notation",
3282 "--list-options ","no-show-notations");
3283 deprecated_warning(configname,configlineno,"--no-show-notation",
3284 "--verify-options ","no-show-notations");
3285 opt.list_options&=~LIST_SHOW_NOTATIONS;
3286 opt.verify_options&=~VERIFY_SHOW_NOTATIONS;
3288 case oUtf8Strings: utf8_strings = 1; break;
3289 case oNoUtf8Strings: utf8_strings = 0; break;
3290 case oDisableCipherAlgo:
3292 int algo = string_to_cipher_algo (pargs.r.ret_str);
3293 gcry_cipher_ctl (NULL, GCRYCTL_DISABLE_ALGO, &algo, sizeof algo);
3296 case oDisablePubkeyAlgo:
3298 int algo = gcry_pk_map_name (pargs.r.ret_str);
3299 gcry_pk_ctl (GCRYCTL_DISABLE_ALGO, &algo, sizeof algo);
3302 case oNoSigCache: opt.no_sig_cache = 1; break;
3303 case oAllowNonSelfsignedUID: opt.allow_non_selfsigned_uid = 1; break;
3304 case oNoAllowNonSelfsignedUID: opt.allow_non_selfsigned_uid=0; break;
3305 case oAllowFreeformUID: opt.allow_freeform_uid = 1; break;
3306 case oNoAllowFreeformUID: opt.allow_freeform_uid = 0; break;
3307 case oNoLiteral: opt.no_literal = 1; break;
3308 case oSetFilesize: opt.set_filesize = pargs.r.ret_ulong; break;
3309 case oFastListMode: opt.fast_list_mode = 1; break;
3310 case oFixedListMode: /* Dummy */ break;
3311 case oLegacyListMode: opt.legacy_list_mode = 1; break;
3312 case oPrintPKARecords: print_pka_records = 1; break;
3313 case oPrintDANERecords: print_dane_records = 1; break;
3314 case oListOnly: opt.list_only=1; break;
3315 case oIgnoreTimeConflict: opt.ignore_time_conflict = 1; break;
3316 case oIgnoreValidFrom: opt.ignore_valid_from = 1; break;
3317 case oIgnoreCrcError: opt.ignore_crc_error = 1; break;
3318 case oIgnoreMDCError: opt.ignore_mdc_error = 1; break;
3319 case oNoRandomSeedFile: use_random_seed = 0; break;
3320 case oAutoKeyRetrieve:
3321 case oNoAutoKeyRetrieve:
3322 if(pargs.r_opt==oAutoKeyRetrieve)
3323 opt.keyserver_options.options|=KEYSERVER_AUTO_KEY_RETRIEVE;
3325 opt.keyserver_options.options&=~KEYSERVER_AUTO_KEY_RETRIEVE;
3327 case oShowSessionKey: opt.show_session_key = 1; break;
3328 case oOverrideSessionKey:
3329 opt.override_session_key = pargs.r.ret_str;
3331 case oOverrideSessionKeyFD:
3332 ovrseskeyfd = translate_sys2libc_fd_int (pargs.r.ret_int, 0);
3335 deprecated_warning(configname,configlineno,"--merge-only",
3336 "--import-options ","merge-only");
3337 opt.import_options|=IMPORT_MERGE_ONLY;
3339 case oAllowSecretKeyImport: /* obsolete */ break;
3340 case oTryAllSecrets: opt.try_all_secrets = 1; break;
3341 case oTrustedKey: register_trusted_key( pargs.r.ret_str ); break;
3343 case oEnableSpecialFilenames:
3344 enable_special_filenames ();
3347 case oNoExpensiveTrustChecks: opt.no_expensive_trust_checks=1; break;
3348 case oAutoCheckTrustDB: opt.no_auto_check_trustdb=0; break;
3349 case oNoAutoCheckTrustDB: opt.no_auto_check_trustdb=1; break;
3350 case oPreservePermissions: opt.preserve_permissions=1; break;
3351 case oDefaultPreferenceList:
3352 opt.def_preference_list = pargs.r.ret_str;
3354 case oDefaultKeyserverURL:
3356 keyserver_spec_t keyserver;
3357 keyserver = parse_keyserver_uri (pargs.r.ret_str,1 );
3359 log_error (_("could not parse keyserver URL\n"));
3361 free_keyserver_spec (keyserver);
3363 opt.def_keyserver_url = pargs.r.ret_str;
3366 case oPersonalCipherPreferences:
3367 pers_cipher_list=pargs.r.ret_str;
3369 case oPersonalDigestPreferences:
3370 pers_digest_list=pargs.r.ret_str;
3372 case oPersonalCompressPreferences:
3373 pers_compress_list=pargs.r.ret_str;
3375 case oAgentProgram: opt.agent_program = pargs.r.ret_str; break;
3376 case oDirmngrProgram: opt.dirmngr_program = pargs.r.ret_str; break;
3378 additional_weak_digest(pargs.r.ret_str);
3381 opt.unwrap_encryption = 1;
3383 case oOnlySignTextIDs:
3384 opt.only_sign_text_ids = 1;
3388 set_opt_session_env ("DISPLAY", pargs.r.ret_str);
3391 set_opt_session_env ("GPG_TTY", pargs.r.ret_str);
3394 set_opt_session_env ("TERM", pargs.r.ret_str);
3397 set_opt_session_env ("XAUTHORITY", pargs.r.ret_str);
3400 case oLCctype: opt.lc_ctype = pargs.r.ret_str; break;
3401 case oLCmessages: opt.lc_messages = pargs.r.ret_str; break;
3403 case oGroup: add_group(pargs.r.ret_str); break;
3404 case oUnGroup: rm_group(pargs.r.ret_str); break;
3406 while(opt.grouplist)
3408 struct groupitem *iter=opt.grouplist;
3409 free_strlist(iter->values);
3410 opt.grouplist=opt.grouplist->next;
3420 case oMangleDosFilenames: opt.mangle_dos_filenames = 1; break;
3421 case oNoMangleDosFilenames: opt.mangle_dos_filenames = 0; break;
3422 case oEnableProgressFilter: opt.enable_progress_filter = 1; break;
3423 case oMultifile: multifile=1; break;
3425 if(ascii_strcasecmp(pargs.r.ret_str,"short")==0)
3426 opt.keyid_format=KF_SHORT;
3427 else if(ascii_strcasecmp(pargs.r.ret_str,"long")==0)
3428 opt.keyid_format=KF_LONG;
3429 else if(ascii_strcasecmp(pargs.r.ret_str,"0xshort")==0)
3430 opt.keyid_format=KF_0xSHORT;
3431 else if(ascii_strcasecmp(pargs.r.ret_str,"0xlong")==0)
3432 opt.keyid_format=KF_0xLONG;
3433 else if(ascii_strcasecmp(pargs.r.ret_str,"none")==0)
3434 opt.keyid_format = KF_NONE;
3436 log_error("unknown keyid-format '%s'\n",pargs.r.ret_str);
3439 case oExitOnStatusWriteError:
3440 opt.exit_on_status_write_error = 1;
3443 case oLimitCardInsertTries:
3444 opt.limit_card_insert_tries = pargs.r.ret_int;
3447 case oRequireCrossCert: opt.flags.require_cross_cert=1; break;
3448 case oNoRequireCrossCert: opt.flags.require_cross_cert=0; break;
3450 case oAutoKeyLocate:
3451 if(!parse_auto_key_locate(pargs.r.ret_str))
3454 log_error(_("%s:%d: invalid auto-key-locate list\n"),
3455 configname,configlineno);
3457 log_error(_("invalid auto-key-locate list\n"));
3460 case oNoAutoKeyLocate:
3464 case oEnableLargeRSA:
3465 #if SECMEM_BUFFER_SIZE >= 65536
3466 opt.flags.large_rsa=1;
3469 log_info("%s:%d: WARNING: gpg not built with large secure "
3470 "memory buffer. Ignoring enable-large-rsa\n",
3471 configname,configlineno);
3473 log_info("WARNING: gpg not built with large secure "
3474 "memory buffer. Ignoring --enable-large-rsa\n");
3475 #endif /* SECMEM_BUFFER_SIZE >= 65536 */
3477 case oDisableLargeRSA: opt.flags.large_rsa=0;
3480 case oEnableDSA2: opt.flags.dsa2=1; break;
3481 case oDisableDSA2: opt.flags.dsa2=0; break;
3483 case oAllowMultisigVerification:
3484 case oAllowMultipleMessages:
3485 opt.flags.allow_multiple_messages=1;
3488 case oNoAllowMultipleMessages:
3489 opt.flags.allow_multiple_messages=0;
3492 case oAllowWeakDigestAlgos:
3493 opt.flags.allow_weak_digest_algos = 1;
3496 case oFakedSystemTime:
3498 size_t len = strlen (pargs.r.ret_str);
3502 if (len > 0 && pargs.r.ret_str[len-1] == '!')
3505 pargs.r.ret_str[len-1] = '\0';
3508 faked_time = isotime2epoch (pargs.r.ret_str);
3509 if (faked_time == (time_t)(-1))
3510 faked_time = (time_t)strtoul (pargs.r.ret_str, NULL, 10);
3511 gnupg_set_time (faked_time, freeze);
3515 case oNoAutostart: opt.autostart = 0; break;
3517 case oDefaultNewKeyAlgo:
3518 opt.def_new_key_algo = pargs.r.ret_str;
3524 pargs.err = configfp? ARGPARSE_PRINT_WARNING:ARGPARSE_PRINT_ERROR;
3533 /* Remember the first config file name. */
3534 if (!save_configname)
3535 save_configname = configname;
3541 xfree(configname); configname = NULL;
3542 if (log_get_errorcount (0))
3545 /* The command --gpgconf-list is pretty simple and may be called
3546 directly after the option parsing. */
3547 if (cmd == aGPGConfList)
3549 gpgconf_list (save_configname ? save_configname : default_configname);
3552 xfree (save_configname);
3553 xfree (default_configname);
3555 if (print_dane_records)
3556 log_error ("invalid option \"%s\"; use \"%s\" instead\n",
3557 "--print-dane-records",
3558 "--export-options export-dane");
3559 if (print_pka_records)
3560 log_error ("invalid option \"%s\"; use \"%s\" instead\n",
3561 "--print-pks-records",
3562 "--export-options export-pka");
3563 if (log_get_errorcount (0))
3572 es_fprintf (es_stderr, "%s %s; %s\n",
3573 strusage(11), strusage(13), strusage(14) );
3574 es_fprintf (es_stderr, "%s\n", strusage(15) );
3576 #ifdef IS_DEVELOPMENT_VERSION
3581 if((s=strusage(25)))
3583 if((s=strusage(26)))
3585 if((s=strusage(27)))
3590 /* FIXME: We should use logging to a file only in server mode;
3591 however we have not yet implemetyed that. Thus we try to get
3592 away with --batch as indication for logging to file
3594 if (logfile && opt.batch)
3596 log_set_file (logfile);
3597 log_set_prefix (NULL, GPGRT_LOG_WITH_PREFIX | GPGRT_LOG_WITH_TIME | GPGRT_LOG_WITH_PID);
3600 if (opt.verbose > 2)
3601 log_info ("using character set '%s'\n", get_native_charset ());
3603 if( may_coredump && !opt.quiet )
3604 log_info(_("WARNING: program may create a core file!\n"));
3606 if (opt.flags.rfc4880bis)
3607 log_info ("WARNING: using experimental features from RFC4880bis!\n");
3610 opt.mimemode = 0; /* This will use text mode instead. */
3614 if (opt.set_filename)
3615 log_info(_("WARNING: %s overrides %s\n"),
3616 "--for-your-eyes-only","--set-filename");
3618 opt.set_filename="_CONSOLE";
3621 if (opt.no_literal) {
3622 log_info(_("Note: %s is not for normal use!\n"), "--no-literal");
3624 log_error(_("%s not allowed with %s!\n"),
3625 "--textmode", "--no-literal" );
3626 if (opt.set_filename)
3627 log_error(_("%s makes no sense with %s!\n"),
3628 eyes_only?"--for-your-eyes-only":"--set-filename",
3633 if (opt.set_filesize)
3634 log_info(_("Note: %s is not for normal use!\n"), "--set-filesize");
3638 if (gnupg_faked_time_p ())
3640 gnupg_isotime_t tbuf;
3642 log_info (_("WARNING: running with faked system time: "));
3643 gnupg_get_isotime (tbuf);
3644 dump_isotime (tbuf);
3648 /* Print a warning if an argument looks like an option. */
3649 if (!opt.quiet && !(pargs.flags & ARGPARSE_FLAG_STOP_SEEN))
3653 for (i=0; i < argc; i++)
3654 if (argv[i][0] == '-' && argv[i][1] == '-')
3655 log_info (_("Note: '%s' is not considered an option\n"), argv[i]);
3659 gcry_control (GCRYCTL_RESUME_SECMEM_WARN);
3661 if(require_secmem && !got_secmem)
3663 log_info(_("will not run with insecure memory due to %s\n"),
3664 "--require-secmem");
3668 set_debug (debug_level);
3670 log_clock ("start");
3672 /* Do these after the switch(), so they can override settings. */
3675 /* That does not anymore work because we have no more support
3676 for v3 signatures. */
3679 opt.ask_sig_expire=0;
3683 /* That does not anymore work because we have no more support
3684 for v3 signatures. */
3686 opt.ask_sig_expire=0;
3694 if( def_cipher_string ) {
3695 opt.def_cipher_algo = string_to_cipher_algo (def_cipher_string);
3696 xfree(def_cipher_string); def_cipher_string = NULL;
3697 if ( openpgp_cipher_test_algo (opt.def_cipher_algo) )
3698 log_error(_("selected cipher algorithm is invalid\n"));
3700 if( def_digest_string ) {
3701 opt.def_digest_algo = string_to_digest_algo (def_digest_string);
3702 xfree(def_digest_string); def_digest_string = NULL;
3703 if ( openpgp_md_test_algo (opt.def_digest_algo) )
3704 log_error(_("selected digest algorithm is invalid\n"));
3706 if( compress_algo_string ) {
3707 opt.compress_algo = string_to_compress_algo(compress_algo_string);
3708 xfree(compress_algo_string); compress_algo_string = NULL;
3709 if( check_compress_algo(opt.compress_algo) )
3710 log_error(_("selected compression algorithm is invalid\n"));
3712 if( cert_digest_string ) {
3713 opt.cert_digest_algo = string_to_digest_algo (cert_digest_string);
3714 xfree(cert_digest_string); cert_digest_string = NULL;
3715 if (openpgp_md_test_algo(opt.cert_digest_algo))
3716 log_error(_("selected certification digest algorithm is invalid\n"));
3718 if( s2k_cipher_string ) {
3719 opt.s2k_cipher_algo = string_to_cipher_algo (s2k_cipher_string);
3720 xfree(s2k_cipher_string); s2k_cipher_string = NULL;
3721 if (openpgp_cipher_test_algo (opt.s2k_cipher_algo))
3722 log_error(_("selected cipher algorithm is invalid\n"));
3724 if( s2k_digest_string ) {
3725 opt.s2k_digest_algo = string_to_digest_algo (s2k_digest_string);
3726 xfree(s2k_digest_string); s2k_digest_string = NULL;
3727 if (openpgp_md_test_algo(opt.s2k_digest_algo))
3728 log_error(_("selected digest algorithm is invalid\n"));
3730 if( opt.completes_needed < 1 )
3731 log_error(_("completes-needed must be greater than 0\n"));
3732 if( opt.marginals_needed < 2 )
3733 log_error(_("marginals-needed must be greater than 1\n"));
3734 if( opt.max_cert_depth < 1 || opt.max_cert_depth > 255 )
3735 log_error(_("max-cert-depth must be in the range from 1 to 255\n"));
3736 if(opt.def_cert_level<0 || opt.def_cert_level>3)
3737 log_error(_("invalid default-cert-level; must be 0, 1, 2, or 3\n"));
3738 if( opt.min_cert_level < 1 || opt.min_cert_level > 3 )
3739 log_error(_("invalid min-cert-level; must be 1, 2, or 3\n"));
3740 switch( opt.s2k_mode ) {
3742 log_info(_("Note: simple S2K mode (0) is strongly discouraged\n"));
3744 case 1: case 3: break;
3746 log_error(_("invalid S2K mode; must be 0, 1 or 3\n"));
3749 /* This isn't actually needed, but does serve to error out if the
3750 string is invalid. */
3751 if(opt.def_preference_list &&
3752 keygen_set_std_prefs(opt.def_preference_list,0))
3753 log_error(_("invalid default preferences\n"));
3755 if(pers_cipher_list &&
3756 keygen_set_std_prefs(pers_cipher_list,PREFTYPE_SYM))
3757 log_error(_("invalid personal cipher preferences\n"));
3759 if(pers_digest_list &&
3760 keygen_set_std_prefs(pers_digest_list,PREFTYPE_HASH))
3761 log_error(_("invalid personal digest preferences\n"));
3763 if(pers_compress_list &&
3764 keygen_set_std_prefs(pers_compress_list,PREFTYPE_ZIP))
3765 log_error(_("invalid personal compress preferences\n"));
3767 /* We don't support all possible commands with multifile yet */
3778 cmdname="--sign --encrypt";
3781 cmdname="--clear-sign";
3784 cmdname="--detach-sign";
3787 cmdname="--symmetric";
3790 cmdname="--symmetric --encrypt";
3801 log_error(_("%s does not yet work with %s\n"),cmdname,"--multifile");
3804 if( log_get_errorcount(0) )
3807 if(opt.compress_level==0)
3808 opt.compress_algo=COMPRESS_ALGO_NONE;
3810 /* Check our chosen algorithms against the list of legal
3815 const char *badalg=NULL;
3816 preftype_t badtype=PREFTYPE_NONE;
3818 if(opt.def_cipher_algo
3819 && !algo_available(PREFTYPE_SYM,opt.def_cipher_algo,NULL))
3821 badalg = openpgp_cipher_algo_name (opt.def_cipher_algo);
3822 badtype = PREFTYPE_SYM;
3824 else if(opt.def_digest_algo
3825 && !algo_available(PREFTYPE_HASH,opt.def_digest_algo,NULL))
3827 badalg = gcry_md_algo_name (opt.def_digest_algo);
3828 badtype = PREFTYPE_HASH;
3830 else if(opt.cert_digest_algo
3831 && !algo_available(PREFTYPE_HASH,opt.cert_digest_algo,NULL))
3833 badalg = gcry_md_algo_name (opt.cert_digest_algo);
3834 badtype = PREFTYPE_HASH;
3836 else if(opt.compress_algo!=-1
3837 && !algo_available(PREFTYPE_ZIP,opt.compress_algo,NULL))
3839 badalg = compress_algo_to_string(opt.compress_algo);
3840 badtype = PREFTYPE_ZIP;
3848 log_info(_("you may not use cipher algorithm '%s'"
3849 " while in %s mode\n"),
3850 badalg,compliance_option_string());
3853 log_info(_("you may not use digest algorithm '%s'"
3854 " while in %s mode\n"),
3855 badalg,compliance_option_string());
3858 log_info(_("you may not use compression algorithm '%s'"
3859 " while in %s mode\n"),
3860 badalg,compliance_option_string());
3866 compliance_failure();
3870 /* Set the random seed file. */
3871 if( use_random_seed ) {
3872 char *p = make_filename (gnupg_homedir (), "random_seed", NULL );
3873 gcry_control (GCRYCTL_SET_RANDOM_SEED_FILE, p);
3874 if (!access (p, F_OK))
3875 register_secured_file (p);
3879 /* If there is no command but the --fingerprint is given, default
3880 to the --list-keys command. */
3881 if (!cmd && fpr_maybe_cmd)
3883 set_cmd (&cmd, aListKeys);
3887 if( opt.verbose > 1 )
3888 set_packet_list_mode(1);
3890 /* Add the keyrings, but not for some special commands. We always
3891 * need to add the keyrings if we are running under SELinux, this
3892 * is so that the rings are added to the list of secured files.
3893 * We do not add any keyring if --no-keyring has been used. */
3894 if (default_keyring >= 0
3895 && (ALWAYS_ADD_KEYRINGS
3896 || (cmd != aDeArmor && cmd != aEnArmor && cmd != aGPGConfTest)))
3898 if (!nrings || default_keyring > 0) /* Add default ring. */
3899 keydb_add_resource ("pubring" EXTSEP_S GPGEXT_GPG,
3900 KEYDB_RESOURCE_FLAG_DEFAULT);
3901 for (sl = nrings; sl; sl = sl->next )
3902 keydb_add_resource (sl->d, sl->flags);
3904 FREE_STRLIST(nrings);
3906 if (opt.pinentry_mode == PINENTRY_MODE_LOOPBACK)
3907 /* In loopback mode, never ask for the password multiple
3910 opt.passphrase_repeat = 0;
3913 if (cmd == aGPGConfTest)
3917 if (pwfd != -1) /* Read the passphrase now. */
3918 read_passphrase_from_fd (pwfd);
3920 if (ovrseskeyfd != -1 ) /* Read the sessionkey now. */
3921 read_sessionkey_from_fd (ovrseskeyfd);
3923 fname = argc? *argv : NULL;
3925 if(fname && utf8_strings)
3926 opt.flags.utf8_filename=1;
3928 ctrl = xcalloc (1, sizeof *ctrl);
3929 gpg_init_default_ctrl (ctrl);
3931 #ifndef NO_TRUST_MODELS
3941 case aListGcryptConfig:
3944 case aExportOwnerTrust:
3945 rc = setup_trustdb (0, trustdb_name);
3948 rc = setup_trustdb (argc? 1:0, trustdb_name);
3951 /* If we are using TM_ALWAYS, we do not need to create the
3953 rc = setup_trustdb (opt.trust_model != TM_ALWAYS, trustdb_name);
3957 log_error (_("failed to initialize the TrustDB: %s\n"),
3959 #endif /*!NO_TRUST_MODELS*/
3968 if (!opt.quiet && any_explicit_recipient)
3969 log_info (_("WARNING: recipients (-r) given "
3970 "without using public key encryption\n"));
3977 /* Check for certain command whether we need to migrate a
3978 secring.gpg to the gpg-agent. */
3981 case aListSecretKeys:
3992 case aDeleteSecretKeys:
3993 case aDeleteSecretAndPublicKeys:
4002 case aExportSecretSub:
4007 migrate_secring (ctrl);
4010 if (opt.with_secret)
4011 migrate_secring (ctrl);
4017 /* The command dispatcher. */
4024 case aStore: /* only store the file */
4026 wrong_args("--store [filename]");
4027 if( (rc = encrypt_store(fname)) )
4029 write_status_failure ("store", rc);
4030 log_error ("storing '%s' failed: %s\n",
4031 print_fname_stdin(fname),gpg_strerror (rc) );
4034 case aSym: /* encrypt the given file only with the symmetric cipher */
4036 wrong_args("--symmetric [filename]");
4037 if( (rc = encrypt_symmetric(fname)) )
4039 write_status_failure ("symencrypt", rc);
4040 log_error (_("symmetric encryption of '%s' failed: %s\n"),
4041 print_fname_stdin(fname),gpg_strerror (rc) );
4045 case aEncr: /* encrypt the given file */
4047 encrypt_crypt_files (ctrl, argc, argv, remusr);
4051 wrong_args("--encrypt [filename]");
4052 if( (rc = encrypt_crypt (ctrl, -1, fname, remusr, 0, NULL, -1)) )
4054 write_status_failure ("encrypt", rc);
4055 log_error("%s: encryption failed: %s\n",
4056 print_fname_stdin(fname), gpg_strerror (rc) );
4062 /* This works with PGP 8 in the sense that it acts just like a
4063 symmetric message. It doesn't work at all with 2 or 6. It
4064 might work with 7, but alas, I don't have a copy to test
4067 wrong_args("--symmetric --encrypt [filename]");
4068 else if(opt.s2k_mode==0)
4069 log_error(_("you cannot use --symmetric --encrypt"
4070 " with --s2k-mode 0\n"));
4071 else if(PGP6 || PGP7)
4072 log_error(_("you cannot use --symmetric --encrypt"
4073 " while in %s mode\n"),compliance_option_string());
4076 if( (rc = encrypt_crypt (ctrl, -1, fname, remusr, 1, NULL, -1)) )
4078 write_status_failure ("encrypt", rc);
4079 log_error ("%s: encryption failed: %s\n",
4080 print_fname_stdin(fname), gpg_strerror (rc) );
4085 case aSign: /* sign the given file */
4087 if( detached_sig ) { /* sign all files */
4088 for( ; argc; argc--, argv++ )
4089 add_to_strlist( &sl, *argv );
4093 wrong_args("--sign [filename]");
4095 sl = xmalloc_clear( sizeof *sl + strlen(fname));
4096 strcpy(sl->d, fname);
4099 if ((rc = sign_file (ctrl, sl, detached_sig, locusr, 0, NULL, NULL)))
4101 write_status_failure ("sign", rc);
4102 log_error ("signing failed: %s\n", gpg_strerror (rc) );
4107 case aSignEncr: /* sign and encrypt the given file */
4109 wrong_args("--sign --encrypt [filename]");
4111 sl = xmalloc_clear( sizeof *sl + strlen(fname));
4112 strcpy(sl->d, fname);
4116 if ((rc = sign_file (ctrl, sl, detached_sig, locusr, 1, remusr, NULL)))
4118 write_status_failure ("sign-encrypt", rc);
4119 log_error("%s: sign+encrypt failed: %s\n",
4120 print_fname_stdin(fname), gpg_strerror (rc) );
4125 case aSignEncrSym: /* sign and encrypt the given file */
4127 wrong_args("--symmetric --sign --encrypt [filename]");
4128 else if(opt.s2k_mode==0)
4129 log_error(_("you cannot use --symmetric --sign --encrypt"
4130 " with --s2k-mode 0\n"));
4131 else if(PGP6 || PGP7)
4132 log_error(_("you cannot use --symmetric --sign --encrypt"
4133 " while in %s mode\n"),compliance_option_string());
4138 sl = xmalloc_clear( sizeof *sl + strlen(fname));
4139 strcpy(sl->d, fname);
4143 if ((rc = sign_file (ctrl, sl, detached_sig, locusr,
4146 write_status_failure ("sign-encrypt", rc);
4147 log_error("%s: symmetric+sign+encrypt failed: %s\n",
4148 print_fname_stdin(fname), gpg_strerror (rc) );
4154 case aSignSym: /* sign and conventionally encrypt the given file */
4156 wrong_args("--sign --symmetric [filename]");
4157 rc = sign_symencrypt_file (ctrl, fname, locusr);
4160 write_status_failure ("sign-symencrypt", rc);
4161 log_error("%s: sign+symmetric failed: %s\n",
4162 print_fname_stdin(fname), gpg_strerror (rc) );
4166 case aClearsign: /* make a clearsig */
4168 wrong_args("--clear-sign [filename]");
4169 if( (rc = clearsign_file (ctrl, fname, locusr, NULL)) )
4171 write_status_failure ("sign", rc);
4172 log_error("%s: clear-sign failed: %s\n",
4173 print_fname_stdin(fname), gpg_strerror (rc) );
4180 if ((rc = verify_files (ctrl, argc, argv)))
4181 log_error("verify files failed: %s\n", gpg_strerror (rc) );
4185 if ((rc = verify_signatures (ctrl, argc, argv)))
4186 log_error("verify signatures failed: %s\n", gpg_strerror (rc) );
4189 write_status_failure ("verify", rc);
4194 decrypt_messages (ctrl, argc, argv);
4198 wrong_args("--decrypt [filename]");
4199 if( (rc = decrypt_message (ctrl, fname) ))
4201 write_status_failure ("decrypt", rc);
4202 log_error("decrypt_message failed: %s\n", gpg_strerror (rc) );
4208 case aQuickLSignKey:
4213 wrong_args ("--quick-[l]sign-key fingerprint [userids]");
4214 fpr = *argv++; argc--;
4216 for( ; argc; argc--, argv++)
4217 append_to_strlist2 (&sl, *argv, utf8_strings);
4218 keyedit_quick_sign (ctrl, fpr, sl, locusr, (cmd == aQuickLSignKey));
4225 wrong_args("--sign-key user-id");
4229 wrong_args("--lsign-key user-id");
4235 append_to_strlist(&sl,"sign");
4236 else if(cmd==aLSignKey)
4237 append_to_strlist(&sl,"lsign");
4241 append_to_strlist( &sl, "save" );
4242 username = make_username( fname );
4243 keyedit_menu (ctrl, username, locusr, sl, 0, 0 );
4248 case aEditKey: /* Edit a key signature */
4250 wrong_args("--edit-key user-id [commands]");
4251 username = make_username( fname );
4254 for( argc--, argv++ ; argc; argc--, argv++ )
4255 append_to_strlist( &sl, *argv );
4256 keyedit_menu (ctrl, username, locusr, sl, 0, 1 );
4260 keyedit_menu (ctrl, username, locusr, NULL, 0, 1 );
4266 wrong_args("--change-passphrase <user-id>");
4269 username = make_username (fname);
4270 keyedit_passwd (ctrl, username);
4276 case aDeleteSecretKeys:
4277 case aDeleteSecretAndPublicKeys:
4279 /* I'm adding these in reverse order as add_to_strlist2
4280 reverses them again, and it's easier to understand in the
4282 for( ; argc; argc-- )
4283 add_to_strlist2( &sl, argv[argc-1], utf8_strings );
4284 delete_keys(sl,cmd==aDeleteSecretKeys,cmd==aDeleteSecretAndPublicKeys);
4294 for( ; argc; argc--, argv++ )
4295 add_to_strlist2( &sl, *argv, utf8_strings );
4296 public_key_list (ctrl, sl, 0);
4299 case aListSecretKeys:
4301 for( ; argc; argc--, argv++ )
4302 add_to_strlist2( &sl, *argv, utf8_strings );
4303 secret_key_list (ctrl, sl);
4308 for (; argc; argc--, argv++)
4309 add_to_strlist2( &sl, *argv, utf8_strings );
4310 public_key_list (ctrl, sl, 1);
4316 const char *x_algo, *x_usage, *x_expire;
4318 if (argc < 1 || argc > 4)
4319 wrong_args("--quick-generate-key USER-ID [ALGO [USAGE [EXPIRE]]]");
4320 username = make_username (fname);
4327 x_algo = *argv++; argc--;
4330 x_usage = *argv++; argc--;
4333 x_expire = *argv++; argc--;
4337 quick_generate_keypair (ctrl, username, x_algo, x_usage, x_expire);
4342 case aKeygen: /* generate a key */
4345 wrong_args("--generate-key [parameterfile]");
4346 generate_keypair (ctrl, 0, argc? *argv : NULL, NULL, 0);
4349 if (opt.command_fd != -1 && argc)
4352 wrong_args("--generate-key [parameterfile]");
4355 generate_keypair (ctrl, 0, argc? *argv : NULL, NULL, 0);
4358 wrong_args ("--generate-key");
4360 generate_keypair (ctrl, 0, NULL, NULL, 0);
4364 case aFullKeygen: /* Generate a key with all options. */
4368 wrong_args ("--full-generate-key [parameterfile]");
4369 generate_keypair (ctrl, 1, argc? *argv : NULL, NULL, 0);
4374 wrong_args("--full-generate-key");
4375 generate_keypair (ctrl, 1, NULL, NULL, 0);
4381 const char *uid, *newuid;
4384 wrong_args ("--quick-add-uid USER-ID NEW-USER-ID");
4385 uid = *argv++; argc--;
4386 newuid = *argv++; argc--;
4387 keyedit_quick_adduid (ctrl, uid, newuid);
4393 const char *x_fpr, *x_algo, *x_usage, *x_expire;
4395 if (argc < 1 || argc > 4)
4396 wrong_args ("--quick-add-key FINGERPRINT [ALGO [USAGE [EXPIRE]]]");
4397 x_fpr = *argv++; argc--;
4403 x_algo = *argv++; argc--;
4406 x_usage = *argv++; argc--;
4409 x_expire = *argv++; argc--;
4413 keyedit_quick_addkey (ctrl, x_fpr, x_algo, x_usage, x_expire);
4419 const char *uid, *uidtorev;
4422 wrong_args ("--quick-revoke-uid USER-ID USER-ID-TO-REVOKE");
4423 uid = *argv++; argc--;
4424 uidtorev = *argv++; argc--;
4425 keyedit_quick_revuid (ctrl, uid, uidtorev);
4429 case aQuickSetExpire:
4431 const char *x_fpr, *x_expire;
4434 wrong_args ("--quick-set-exipre FINGERPRINT EXPIRE");
4435 x_fpr = *argv++; argc--;
4436 x_expire = *argv++; argc--;
4437 keyedit_quick_set_expire (ctrl, x_fpr, x_expire);
4442 opt.import_options |= IMPORT_FAST;
4444 import_keys (ctrl, argc? argv:NULL, argc, NULL, opt.import_options);
4447 /* TODO: There are a number of command that use this same
4448 "make strlist, call function, report error, free strlist"
4449 pattern. Join them together here and avoid all that
4456 for( ; argc; argc--, argv++ )
4457 append_to_strlist2( &sl, *argv, utf8_strings );
4458 if( cmd == aSendKeys )
4459 rc = keyserver_export (ctrl, sl );
4460 else if( cmd == aRecvKeys )
4461 rc = keyserver_import (ctrl, sl );
4464 export_stats_t stats = export_new_stats ();
4465 rc = export_pubkeys (ctrl, sl, opt.export_options, stats);
4466 export_print_stats (stats);
4467 export_release_stats (stats);
4473 write_status_failure ("send-keys", rc);
4474 log_error(_("keyserver send failed: %s\n"),gpg_strerror (rc));
4476 else if(cmd==aRecvKeys)
4478 write_status_failure ("recv-keys", rc);
4479 log_error (_("keyserver receive failed: %s\n"),
4484 write_status_failure ("export", rc);
4485 log_error (_("key export failed: %s\n"), gpg_strerror (rc));
4493 wrong_args ("--export-ssh-key <user-id>");
4494 rc = export_ssh_key (ctrl, argv[0]);
4497 write_status_failure ("export-ssh-key", rc);
4498 log_error (_("export as ssh key failed: %s\n"), gpg_strerror (rc));
4504 for (; argc; argc--, argv++)
4505 append_to_strlist2 (&sl, *argv, utf8_strings);
4506 rc = keyserver_search (ctrl, sl);
4509 write_status_failure ("search-keys", rc);
4510 log_error (_("keyserver search failed: %s\n"), gpg_strerror (rc));
4517 for( ; argc; argc--, argv++ )
4518 append_to_strlist2( &sl, *argv, utf8_strings );
4519 rc = keyserver_refresh (ctrl, sl);
4522 write_status_failure ("refresh-keys", rc);
4523 log_error (_("keyserver refresh failed: %s\n"),gpg_strerror (rc));
4530 for( ; argc; argc--, argv++ )
4531 append_to_strlist2( &sl, *argv, utf8_strings );
4532 rc = keyserver_fetch (ctrl, sl);
4535 write_status_failure ("fetch-keys", rc);
4536 log_error ("key fetch failed: %s\n",gpg_strerror (rc));
4543 for( ; argc; argc--, argv++ )
4544 add_to_strlist2( &sl, *argv, utf8_strings );
4546 export_stats_t stats = export_new_stats ();
4547 export_seckeys (ctrl, sl, stats);
4548 export_print_stats (stats);
4549 export_release_stats (stats);
4554 case aExportSecretSub:
4556 for( ; argc; argc--, argv++ )
4557 add_to_strlist2( &sl, *argv, utf8_strings );
4559 export_stats_t stats = export_new_stats ();
4560 export_secsubkeys (ctrl, sl, stats);
4561 export_print_stats (stats);
4562 export_release_stats (stats);
4569 wrong_args("--generate-revocation user-id");
4570 username = make_username(*argv);
4571 gen_revoke( username );
4577 wrong_args ("--generate-designated-revocation user-id");
4578 username = make_username (*argv);
4579 gen_desig_revoke (ctrl, username, locusr);
4585 wrong_args("--dearmor [file]");
4586 rc = dearmor_file( argc? *argv: NULL );
4589 write_status_failure ("dearmor", rc);
4590 log_error (_("dearmoring failed: %s\n"), gpg_strerror (rc));
4596 wrong_args("--enarmor [file]");
4597 rc = enarmor_file( argc? *argv: NULL );
4600 write_status_failure ("enarmor", rc);
4601 log_error (_("enarmoring failed: %s\n"), gpg_strerror (rc));
4608 { int mode = argc < 2 ? 0 : atoi(*argv);
4610 if( mode == 1 && argc == 2 ) {
4611 mpi_print (es_stdout,
4612 generate_public_prime( atoi(argv[1]) ), 1);
4614 else if( mode == 2 && argc == 3 ) {
4615 mpi_print (es_stdout, generate_elg_prime(
4617 atoi(argv[2]), NULL,NULL ), 1);
4619 else if( mode == 3 && argc == 3 ) {
4621 mpi_print (es_stdout, generate_elg_prime(
4623 atoi(argv[2]), NULL,&factors ), 1);
4624 es_putc ('\n', es_stdout);
4625 mpi_print (es_stdout, factors[0], 1 ); /* print q */
4627 else if( mode == 4 && argc == 3 ) {
4628 MPI g = mpi_alloc(1);
4629 mpi_print (es_stdout, generate_elg_prime(
4631 atoi(argv[2]), g, NULL ), 1);
4632 es_putc ('\n', es_stdout);
4633 mpi_print (es_stdout, g, 1 );
4637 wrong_args("--gen-prime mode bits [qbits] ");
4638 es_putc ('\n', es_stdout);
4641 wrong_args("--gen-prime not yet supported ");
4646 int level = argc ? atoi(*argv):0;
4647 int count = argc > 1 ? atoi(argv[1]): 0;
4648 int endless = !count;
4650 if( argc < 1 || argc > 2 || level < 0 || level > 2 || count < 0 )
4651 wrong_args("--gen-random 0|1|2 [count]");
4653 while( endless || count ) {
4655 /* Wee need a multiple of 3, so that in case of
4656 armored output we get a correct string. No
4657 linefolding is done, as it is best to levae this to
4659 size_t n = !endless && count < 99? count : 99;
4661 p = gcry_random_bytes (n, level);
4662 #ifdef HAVE_DOSISH_SYSTEM
4663 setmode ( fileno(stdout), O_BINARY );
4666 char *tmp = make_radix64_string (p, n);
4667 es_fputs (tmp, es_stdout);
4670 es_putc ('=', es_stdout);
4672 es_putc ('=', es_stdout);
4674 es_fwrite( p, n, 1, es_stdout );
4681 es_putc ('\n', es_stdout);
4687 wrong_args("--print-md algo [files]");
4689 int all_algos = (**argv=='*' && !(*argv)[1]);
4690 int algo = all_algos? 0 : gcry_md_map_name (*argv);
4692 if( !algo && !all_algos )
4693 log_error(_("invalid hash algorithm '%s'\n"), *argv );
4697 print_mds(NULL, algo);
4699 for(; argc; argc--, argv++ )
4700 print_mds(*argv, algo);
4706 case aPrintMDs: /* old option */
4710 for(; argc; argc--, argv++ )
4715 #ifndef NO_TRUST_MODELS
4718 list_trustdb (es_stdout, NULL);
4720 for( ; argc; argc--, argv++ )
4721 list_trustdb (es_stdout, *argv );
4725 case aUpdateTrustDB:
4727 wrong_args("--update-trustdb");
4728 update_trustdb (ctrl);
4732 /* Old versions allowed for arguments - ignore them */
4733 check_trustdb (ctrl);
4737 how_to_fix_the_trustdb ();
4740 case aListTrustPath:
4742 wrong_args("--list-trust-path <user-ids>");
4743 for( ; argc; argc--, argv++ ) {
4744 username = make_username( *argv );
4745 list_trust_path( username );
4750 case aExportOwnerTrust:
4752 wrong_args("--export-ownertrust");
4753 export_ownertrust();
4756 case aImportOwnerTrust:
4758 wrong_args("--import-ownertrust [file]");
4759 import_ownertrust( argc? *argv:NULL );
4761 #endif /*!NO_TRUST_MODELS*/
4763 case aRebuildKeydbCaches:
4765 wrong_args ("--rebuild-keydb-caches");
4766 keydb_rebuild_caches (1);
4769 #ifdef ENABLE_CARD_SUPPORT
4772 wrong_args ("--card-status");
4773 card_status (es_stdout, NULL, 0);
4779 for (argc--, argv++ ; argc; argc--, argv++)
4780 append_to_strlist (&sl, *argv);
4781 card_edit (ctrl, sl);
4785 card_edit (ctrl, NULL);
4792 change_pin (atoi (*argv),1);
4794 wrong_args ("--change-pin [no]");
4796 #endif /* ENABLE_CARD_SUPPORT*/
4800 char *str=collapse_args(argc,argv);
4806 case aListGcryptConfig:
4807 /* Fixme: It would be nice to integrate that with
4808 --list-config but unfortunately there is no way yet to have
4809 libgcrypt print it to an estream for further parsing. */
4810 gcry_control (GCRYCTL_PRINT_CONFIG, stdout);
4821 wrong_args ("--tofu-policy POLICY KEYID [KEYID...]");
4823 policy = parse_tofu_policy (argv[0]);
4829 tofu_begin_batch_update (ctrl);
4831 for (i = 1; i < argc; i ++)
4833 KEYDB_SEARCH_DESC desc;
4836 rc = classify_user_id (argv[i], &desc, 0);
4839 log_error (_("error parsing key specification '%s': %s\n"),
4840 argv[i], gpg_strerror (rc));
4844 if (! (desc.mode == KEYDB_SEARCH_MODE_SHORT_KID
4845 || desc.mode == KEYDB_SEARCH_MODE_LONG_KID
4846 || desc.mode == KEYDB_SEARCH_MODE_FPR16
4847 || desc.mode == KEYDB_SEARCH_MODE_FPR20
4848 || desc.mode == KEYDB_SEARCH_MODE_FPR
4849 || desc.mode == KEYDB_SEARCH_MODE_KEYGRIP))
4851 log_error (_("'%s' does not appear to be a valid"
4852 " key ID, fingerprint or keygrip\n"),
4857 rc = keydb_search_reset (hd);
4860 /* This should not happen, thus no need to tranalate
4862 log_error ("keydb_search_reset failed: %s\n",
4867 rc = keydb_search (hd, &desc, 1, NULL);
4870 log_error (_("key \"%s\" not found: %s\n"), argv[i],
4875 rc = keydb_get_keyblock (hd, &kb);
4878 log_error (_("error reading keyblock: %s\n"),
4883 merge_keys_and_selfsig (kb);
4884 if (tofu_set_policy (ctrl, kb, policy))
4887 release_kbnode (kb);
4890 tofu_end_batch_update (ctrl);
4899 log_info (_("WARNING: no command supplied."
4900 " Trying to guess what you mean ...\n"));
4904 wrong_args("[filename]");
4905 /* Issue some output for the unix newbie */
4906 if (!fname && !opt.outfile
4907 && gnupg_isatty (fileno (stdin))
4908 && gnupg_isatty (fileno (stdout))
4909 && gnupg_isatty (fileno (stderr)))
4910 log_info(_("Go ahead and type your message ...\n"));
4912 a = iobuf_open(fname);
4913 if (a && is_secured_file (iobuf_get_fd (a)))
4917 gpg_err_set_errno (EPERM);
4920 log_error(_("can't open '%s'\n"), print_fname_stdin(fname));
4923 if( !opt.no_armor ) {
4924 if( use_armor_filter( a ) ) {
4925 afx = new_armor_context ();
4926 push_armor_filter (afx, a);
4929 if( cmd == aListPackets ) {
4931 set_packet_list_mode(1);
4933 rc = proc_packets (ctrl, NULL, a );
4936 write_status_failure ("-", rc);
4937 log_error ("processing message failed: %s\n",
4946 gpg_deinit_default_ctrl (ctrl);
4948 release_armor_context (afx);
4949 FREE_STRLIST(remusr);
4950 FREE_STRLIST(locusr);
4952 return 8; /*NEVER REACHED*/
4956 /* Note: This function is used by signal handlers!. */
4958 emergency_cleanup (void)
4960 gcry_control (GCRYCTL_TERM_SECMEM );
4967 gcry_control (GCRYCTL_UPDATE_RANDOM_SEED_FILE);
4971 if ( (opt.debug & DBG_MEMSTAT_VALUE) )
4973 keydb_dump_stats ();
4974 gcry_control (GCRYCTL_DUMP_MEMORY_STATS);
4975 gcry_control (GCRYCTL_DUMP_RANDOM_STATS);
4978 gcry_control (GCRYCTL_DUMP_SECMEM_STATS );
4980 emergency_cleanup ();
4982 rc = rc? rc : log_get_errorcount(0)? 2 : g10_errors_seen? 1 : 0;
4987 /* Pretty-print hex hashes. This assumes at least an 80-character
4988 display, but there are a few other similar assumptions in the
4991 print_hex (gcry_md_hd_t md, int algo, const char *fname)
4993 int i,n,count,indent=0;
4997 indent = es_printf("%s: ",fname);
5005 if (algo==DIGEST_ALGO_RMD160)
5006 indent += es_printf("RMD160 = ");
5008 indent += es_printf("%6s = ", gcry_md_algo_name (algo));
5014 p = gcry_md_read (md, algo);
5015 n = gcry_md_get_algo_dlen (algo);
5017 count += es_printf ("%02X",*p++);
5019 for(i=1;i<n;i++,p++)
5025 es_printf ("\n%*s",indent," ");
5029 count += es_printf(" ");
5032 count += es_printf(" ");
5040 es_printf ("\n%*s",indent," ");
5044 count += es_printf(" ");
5048 count += es_printf(" ");
5056 es_printf ("\n%*s",indent," ");
5060 count += es_printf(" ");
5064 count += es_printf("%02X",*p);
5071 print_hashline( gcry_md_hd_t md, int algo, const char *fname )
5078 for (p = fname; *p; p++ )
5080 if ( *p <= 32 || *p > 127 || *p == ':' || *p == '%' )
5081 es_printf ("%%%02X", *p );
5083 es_putc (*p, es_stdout);
5086 es_putc (':', es_stdout);
5087 es_printf ("%d:", algo);
5088 p = gcry_md_read (md, algo);
5089 n = gcry_md_get_algo_dlen (algo);
5090 for(i=0; i < n ; i++, p++ )
5091 es_printf ("%02X", *p);
5092 es_fputs (":\n", es_stdout);
5097 print_mds( const char *fname, int algo )
5111 fp = es_fopen (fname, "rb" );
5112 if (fp && is_secured_file (es_fileno (fp)))
5116 gpg_err_set_errno (EPERM);
5121 log_error("%s: %s\n", fname?fname:"[stdin]", strerror(errno) );
5125 gcry_md_open (&md, 0, 0);
5127 gcry_md_enable (md, algo);
5130 if (!gcry_md_test_algo (GCRY_MD_MD5))
5131 gcry_md_enable (md, GCRY_MD_MD5);
5132 gcry_md_enable (md, GCRY_MD_SHA1);
5133 if (!gcry_md_test_algo (GCRY_MD_RMD160))
5134 gcry_md_enable (md, GCRY_MD_RMD160);
5135 if (!gcry_md_test_algo (GCRY_MD_SHA224))
5136 gcry_md_enable (md, GCRY_MD_SHA224);
5137 if (!gcry_md_test_algo (GCRY_MD_SHA256))
5138 gcry_md_enable (md, GCRY_MD_SHA256);
5139 if (!gcry_md_test_algo (GCRY_MD_SHA384))
5140 gcry_md_enable (md, GCRY_MD_SHA384);
5141 if (!gcry_md_test_algo (GCRY_MD_SHA512))
5142 gcry_md_enable (md, GCRY_MD_SHA512);
5145 while ((n=es_fread (buf, 1, DIM(buf), fp)))
5146 gcry_md_write (md, buf, n);
5149 log_error ("%s: %s\n", fname?fname:"[stdin]", strerror(errno));
5153 if (opt.with_colons)
5156 print_hashline (md, algo, fname);
5159 if (!gcry_md_test_algo (GCRY_MD_MD5))
5160 print_hashline( md, GCRY_MD_MD5, fname );
5161 print_hashline( md, GCRY_MD_SHA1, fname );
5162 if (!gcry_md_test_algo (GCRY_MD_RMD160))
5163 print_hashline( md, GCRY_MD_RMD160, fname );
5164 if (!gcry_md_test_algo (GCRY_MD_SHA224))
5165 print_hashline (md, GCRY_MD_SHA224, fname);
5166 if (!gcry_md_test_algo (GCRY_MD_SHA256))
5167 print_hashline( md, GCRY_MD_SHA256, fname );
5168 if (!gcry_md_test_algo (GCRY_MD_SHA384))
5169 print_hashline ( md, GCRY_MD_SHA384, fname );
5170 if (!gcry_md_test_algo (GCRY_MD_SHA512))
5171 print_hashline ( md, GCRY_MD_SHA512, fname );
5177 print_hex (md, -algo, fname);
5180 if (!gcry_md_test_algo (GCRY_MD_MD5))
5181 print_hex (md, GCRY_MD_MD5, fname);
5182 print_hex (md, GCRY_MD_SHA1, fname );
5183 if (!gcry_md_test_algo (GCRY_MD_RMD160))
5184 print_hex (md, GCRY_MD_RMD160, fname );
5185 if (!gcry_md_test_algo (GCRY_MD_SHA224))
5186 print_hex (md, GCRY_MD_SHA224, fname);
5187 if (!gcry_md_test_algo (GCRY_MD_SHA256))
5188 print_hex (md, GCRY_MD_SHA256, fname );
5189 if (!gcry_md_test_algo (GCRY_MD_SHA384))
5190 print_hex (md, GCRY_MD_SHA384, fname );
5191 if (!gcry_md_test_algo (GCRY_MD_SHA512))
5192 print_hex (md, GCRY_MD_SHA512, fname );
5204 * Check the supplied name,value string and add it to the notation
5205 * data to be used for signatures. which==0 for sig notations, and 1
5206 * for cert notations.
5209 add_notation_data( const char *string, int which )
5211 struct notation *notation;
5213 notation=string_to_notation(string,utf8_strings);
5218 notation->next=opt.cert_notations;
5219 opt.cert_notations=notation;
5223 notation->next=opt.sig_notations;
5224 opt.sig_notations=notation;
5230 add_policy_url( const char *string, int which )
5232 unsigned int i,critical=0;
5241 for(i=0;i<strlen(string);i++)
5242 if( !isascii (string[i]) || iscntrl(string[i]))
5245 if(i==0 || i<strlen(string))
5248 log_error(_("the given certification policy URL is invalid\n"));
5250 log_error(_("the given signature policy URL is invalid\n"));
5254 sl=add_to_strlist( &opt.cert_policy_url, string );
5256 sl=add_to_strlist( &opt.sig_policy_url, string );
5263 add_keyserver_url( const char *string, int which )
5265 unsigned int i,critical=0;
5274 for(i=0;i<strlen(string);i++)
5275 if( !isascii (string[i]) || iscntrl(string[i]))
5278 if(i==0 || i<strlen(string))
5283 log_error(_("the given preferred keyserver URL is invalid\n"));
5289 sl=add_to_strlist( &opt.sig_keyserver_url, string );
5297 read_sessionkey_from_fd (int fd)
5302 if (! gnupg_fd_valid (fd))
5303 log_fatal ("override-session-key-fd is invalid: %s\n", strerror (errno));
5305 for (line = NULL, i = len = 100; ; i++ )
5311 line = xmalloc_secure (len);
5314 memcpy (line, tmp, i);
5320 if (read (fd, line + i, 1) != 1 || line[i] == '\n')
5324 log_debug ("seskey: %s\n", line);
5325 gpgrt_annotate_leaked_object (line);
5326 opt.override_session_key = line;