Changelog for gnupg: 2.5.21 -> 2.5.22 Source: ChangeLog 2026-08-31 Werner Koch Release 2.5.22. + commit bd253e9fecedd4c0e699530826ee43264581634b 2026-08-26 Philip Le gpgsm: Fix condition for de-vs compliance status line. + commit a09f16f2b17a47b3f215e2d257ef256f3b2b724e * sm/decrypt.c (gpgsm_decrypt): Also check other conditions for de-vs compliance before emitting status line. 2026-08-25 Philip Le gpgsm: Check keyboxd usage in keydb_get_flags. + commit e338ea3de2d151fe718c11d7dcd2a2178b10a22e * sm/keydb.c (keydb_get_flags): Add condition that keyboxd is not used. 2026-08-21 Werner Koch gpgconf: Print a warning on Windows on insufficent /etc permissions. + commit 56eb3148c7b88eb1c0804141b58cb54b9007f48d * README (Securing the global config files on Windows): New. * tools/gpgconf.c [W32]: Include aclapi.h. (enum cmd_and_opt_values): Add oDebug. (opts): Add option --debug. (debug_flags): New. (main): Parse debug flags. (w32_get_file_integrity_level) [W32]: New. (show_configs) [W32]: Check permissions of the gloab sysconfdir * tools/gpgconf.h (opt): Add field 'debug'. (DBG_W32_API): New. 2026-08-18 Philip Le gpg: Emit status line for failed write. + commit 09ac242827c3bd002da2ff9d693a2db646d4e386 * g10/plaintext.c (handle_plaintext): Emit error location and code in failure status. 2026-08-12 Philip Le Werner Koch gpg: Fix regression introduced by partial file guards. + commit 1b8debd65baaa05250ce26079fad15ac7bb16bd5 * g10/main.h (gnupg_rollback_partial_file): New. Removes .part files. (gnupg_commit_partial_file): New. Renames .part files. * g10/misc.c (gnupg_rollback_partial_file): New. (gnupg_commit_partial_file): New. * g10/mainproc.c (proc_encrypted): Use gnupg_commit_partial_file. * g10/gpg.c (g10_exit): Use gnupg_commit_partial_file. (main): Remove .part files if decryption fails. 2026-08-12 NIIBE Yutaka common,gpg: Don't enable the partial file guard if already done. + commit 95ad7f7a5165b96e1a39afe70b1b1092b9ab6f45 * common/stringhelp.c (has_suffix): New. * common/stringhelp.h (has_suffix): New. * g10/plaintext.c (get_output_file): Only enable the partial file guard when it doesn't have ".part" suffix. 2026-08-10 Werner Koch gpg: Fix TOFU trust models to actually check UTK signatures. + commit 08611f5da8ad4b9cc80bb05f0f8610ec6baa6063 * g10/tofu.c (signed_by_utk): Add arg ctrl. Use macros fro the sigclass. Check the signature before returning true. 2026-08-05 Werner Koch g13: Add sanity check on the syntax of the dmsetup algo string. + commit 386c3e63b1cac7f506f974715dbf30c6d40663dd * g13/sh-dmcrypt.c (is_valid_algostr): New (sh_dmcrypt_mount_container): Use here (sh_dmcrypt_resume_container): and here. 2026-08-04 NIIBE Yutaka gpg: Add a comment and minor fix for composing SEXP. + commit e9b40fd1f0c0f6639c16346e895153561be93388 * g10/import.c (internal_skey_object_to_sexp): Add comment. * g10/keyid.c (keygrip_from_pk): Compose correct SEXP with Ed448. 2026-07-30 Philip Le Werner Koch gpgsm: Emit issuer and serial no. when the certificate is not found. + commit 82d5dc7782617cb7683b3769a3267e154ebdb067 * doc/DETAILS: Update NO_PUBKEY for X.509 certificates. * sm/verify.c (gpgsm_verify): Print the issuer and serial no. of the signer's certificate when the certificate is not found. 2026-07-30 Philip Le gpg: Emit signing time as status output for bad signatures. + commit e5acae48015751e21a04bf3113ba42d02c3db3f7 * g10/mainproc.c (print_good_bad_signature): Emit signature creation time with STATUS_SIGINFO for bad signatures. 2026-07-30 Philip Le Werner Koch gpgsm: Emit signing time as status output for bad signatures. + commit 74305fa7d79700eb5ec03ab575260d640430bc71 * common/status.h (enum): Add new STATUS_SIGINFO. * doc/DETAILS: Add description for new STATUS_SIGINFO. * sm/verify.c (gpgsm_verify): Add signature creation time with STATUS_SIGINFO for bad signatures. 2026-07-30 NIIBE Yutaka scd: Allow switching APP when opt.pcsc_shared is enabled. + commit f783c02525c3be9af14e84ec6456d4bde6018c74 * scd/app.c (maybe_switch_app): Add opt.pcsc_shared condition. 2026-07-21 NIIBE Yutaka gpgsm: Fix keydb_get_flags with keyboxd. + commit 766e9773cbc2a03d0392c2a2c94d0fe237741c5b * sm/keydb.c (struct keydb_handle): Add new field of last_is_revoked. (keydb_get_flag): Support keyboxd. (search_status_cb): Fill last_is_revoked field. 2026-07-20 Philip Le gpgsm: Check args for special file names and dashes. + commit 2efb4a6242e25a661eb60adf2cb2c5abf4185d04 * sm/gpgsm.c (main): Use open_es_fread to check input args for special file names and dashes. 2026-07-17 NIIBE Yutaka scd: Put a workaround for buggy CCID device. + commit 481b3dd50e744a6d4213abecd27ac1f497c6e1c5 * scd/ccid-driver.c (bulk_in): Handle ZLP. 2026-07-16 Philip Le gpgsm: Return 0 if decryption of multi recipient file succeeeds. + commit 890d16586beaa185b082a21e6a26b953181da3eb * sm/gpgsm.c (main): Reset error count when decryption succeeds. 2026-07-15 Werner Koch common: Make unix_rootdir work for macOS. + commit 0be940905d70125866622c6f53b8d25bde87c21b * common/homedir.c [APPLE]: Include procinfo.h (macos_myproc_self) [APPLE]: New. (unix_rootdir, gnupg_myproc_self): Call macos specific version. gpg: Add option primary to the --card-edit generate command. + commit a95da9e25362ea9f33c1e0b4441a86d6eca937f0 * g10/card-util.c (generate_card_keys): Add arg arg_string and implement option "primary". * g10/main.h (GENERATE_KEYPAIR_FULL): New. (GENERATE_KEYPAIR_CARDBACKUP): New. (GENERATE_KEYPAIR_CARDPRIMARY): New. * g10/keygen.c (generate_keypair): Remove args full and and card_backup_key and replace by a new genflags args. Implement the new CARDPRIMARY feature. gpg: Fix long standing regression of "bkuptocard" + commit f103eaee63f702278824967365de16b9757ecc83 * g10/card-util.c (card_store_subkey): Add arg r_selected_use to return the selected usage. * g10/keygen.c (append_subkey_to_keyblock): New. * g10/keyedit.c (keyedit_menu) : Also append a corresponding new subkey. 2026-07-14 Werner Koch doc: Improve comment on one function. + commit 204d02da018e8aba0bdbae2b5d0c3151a810bf9f * g10/keygen.c (write_keybinding): Rename a variable. 2026-07-10 Daniel Cerqueira po: Update Portuguese Translation. + commit 3913f7b167394cdf47c8f150247c2823f58966e7 2026-07-09 Philip Le gpgsm: Only display de-vs compliance status in de-vs compliance mode. + commit 4a8f177f390b270df9a86ea47d8eced85420d7d4 * sm/decrypt.c (gpgsm_decrypt): Check cert chain only in de-vs compliance mode. 2026-07-08 NIIBE Yutaka gpg: Fix a memory leak. + commit 6faaeca6b89a64763242cb8b586245085257b066 * g10/trustdb.c (validate_keys): Release KEYBLOCK. 2026-07-07 Philip Le gpg: Fix possible double free in import_revoke_cert. + commit a19534b70e27df101a0ad8f653aee8eefdbe8469 * g10/import.c (import_revoke_cert): Fix possible double free. Use LEAVE label on errors. gpg: Fix assertion. + commit e319d82d7e3ad9cf2eff3642e23b63304eda55f2 * g10/build-packet.c (build_sig_subpkt_from_sig): Fix assertion. Check fingerprint version before creating the signature subpacket. 2026-07-07 NIIBE Yutaka common:dotlock:unix: Don't emit wrong error message. + commit f454e9372ae0e2a2a0ec034dbdbfa9c8c6d68f77 * common/dotlock.c (dotlock_take_unix): It's not an error when it encounters disappeared lockfile. 2026-07-06 Philip Le gpg: Fix using wrong fingerprint length. + commit 42e6677f7ab5617ce605cad08079a48095be09cf g10/build-packet.c (build_sig_subpkt_from_sig): Use the fpr length of the to be revoked key. 2026-07-03 NIIBE Yutaka gpg: Fix trustdb recursive lock problem. + commit 7752c7dcad8942e4227384282e6c8eb85b284d6f * g10/tdbio.c (take_write_lock): It's the callee to handle the recursive lock. (tdbio_sync): Simply use take_write_lock and release_write_lock.