bump needed: GnuPG 1.4.3 released

[rajiv@…]

please bump.

​http://lists.gnupg.org/pipermail/gnupg-announce/2006q2/000222.html

[Announce] GnuPG 1.4.3 released

Werner Koch wk at gnupg.org Mon Apr 3 14:13:15 CEST 2006 Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] Hello! We are pleased to announce the availability of a new stable GnuPG release: Version 1.4.3

The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication and data storage. It is a complete and free replacement of PGP and can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440.

Getting the Software ====================

Please follow the instructions found at ​http://www.gnupg.org/download/ or read on:

GnuPG 1.4.3 may be downloaded from one of the GnuPG mirror sites or direct from ​ftp://ftp.gnupg.org/gcrypt/ . The list of mirrors can be found at ​http://www.gnupg.org/mirrors.html . Note, that GnuPG is not available at ftp.gnu.org.

On the mirrors you should find the following files in the *gnupg* directory:

gnupg-1.4.3.tar.bz2 (3041k) gnupg-1.4.3.tar.bz2.sig

GnuPG source compressed using BZIP2 and OpenPGP signature.

gnupg-1.4.3.tar.gz (4219k) gnupg-1.4.3.tar.gz.sig

GnuPG source compressed using GZIP and OpenPGP signature.

gnupg-1.4.2.2-1.4.3.diff.bz2 (905k)

A patch file to upgrade a 1.4.2.2 GnuPG source.

Select one of them. To shorten the download time, you probably want to get the BZIP2 compressed file. Please try another mirror if exceptional your mirror is not yet up to date.

In the *binary* directory, you should find these files:

gnupg-w32cli-1.4.3.exe (1436k) gnupg-w32cli-1.4.3.exe.sig

GnuPG compiled for Microsoft Windows and OpenPGP signature. Note that this is a command line version and now comes with a graphical installer tool. The source files are the same as given above. Note, that this is a minimal version and unless you are just in need for the gpg binary, you are better off using the full featured installer at ​http://www.gpg4win.org . Version 1.0 will be available in a few days - the currently available release candidate is pretty much up to GnuPG 1.4.3.

Checking the Integrity ======================

In order to check that the version of GnuPG which you are going to install is an original and unmodified one, you can do it in one of the following ways:

• If you already have a trusted version of GnuPG installed, you can simply check the supplied signature. For example to check the signature of the file gnupg-1.4.3.tar.bz2 you would use this command:

gpg --verify gnupg-1.4.3.tar.bz2.sig

This checks whether the signature file matches the source file. You should see a message indicating that the signature is good and made by that signing key. Make sure that you have the right key, either by checking the fingerprint of that key with other sources or by checking that the key has been signed by a trustworthy other key. Note, that you can retrieve the signing key using the command

finger wk ,at' g10code.com

or using a keyserver like

gpg --recv-key 1CE0C630

The distribution key 1CE0C630 is signed by the well known key 5B0358A2. If you get an key expired message, you should retrieve a fresh copy as the expiration date might have been prolonged.

NEVER USE A GNUPG VERSION YOU JUST DOWNLOADED TO CHECK THE INTEGRITY OF THE SOURCE - USE AN EXISTING GNUPG INSTALLATION!

• If you are not able to use an old version of GnuPG, you have to verify the SHA-1 checksum. Assuming you downloaded the file gnupg-1.4.3.tar.bz2, you would run the sha1sum command like this:

sha1sum gnupg-1.4.3.tar.bz2

and check that the output matches the first line from the following list:

9e96b36e4f4d1e8bc5028c99fac674482cbdb370 gnupg-1.4.3.tar.bz2 7c0f5db594bed9a901d9be43c31f6c80c6080141 gnupg-1.4.3.tar.gz 5477211551e96ad689c7618ee39a2b9c186721ef gnupg-1.4.2.2-1.4.3.diff.bz2 abf49fa5dc71e291144780d47f2811d83ae5e1ba gnupg-w32cli-1.4.3.exe

Upgrade Information ===================

If you are upgrading from a version prior to 1.0.7, you should run the script tools/convert-from-106 once. Please note also that due to a bug in versions prior to 1.0.6 it may not be possible to downgrade to such versions unless you apply the patch ​http://www.gnupg.org/developer/gpg-woody-fix.txt .

If you have any problems, please see the FAQ and the mailing list archive at ​http://lists.gnupg.org. Please direct questions to the gnupg-users at gnupg.org mailing list.

What's New ===========

• If available, cURL-based keyserver helpers are built that can retrieve keys using HKP or any protocol that cURL supports (HTTP, HTTPS, FTP, FTPS, etc). If cURL is not available, HKP and HTTP are still supported using a built-in cURL emulator. To force building the old pre-cURL keyserver helpers, use the configure option --enable-old-keyserver-helpers. Note that none of this affects finger or LDAP support, which are unchanged. Note also that a future version of GnuPG will remove the old keyserver helpers altogether.

• Implemented Public Key Association (PKA) signature verification. This uses special DNS records and notation data to associate a mail address with an OpenPGP key to prove that mail coming from that address is legitimate without the need for a full trust path to the signing key.

• When exporting subkeys, those specified with a key ID or fingerpint and the '!' suffix are now merged into one keyblock.

• Added "gpg-zip", a program to create encrypted archives that can interoperate with PGP Zip.

• Added support for signing subkey cross-certification "back signatures". Requiring cross-certification to be present is currently off by default, but will be changed to on by default in the future, once more keys use it. A new "cross-certify" command in the --edit-key menu can be used to update signing subkeys to have cross-certification.

• The key cleaning options for --import-options and --export-options have been further polished. "import-clean" and "export-clean" replace the older import-clean-sigs/import-clean-uids and export-clean-sigs/export-clean-uids option pairs.

• New "minimize" command in the --edit-key menu removes everything that can be removed from a key, rendering it as small as possible. There are corresponding "export-minimal" and "import-minimal" commands for --export-options and --import-options.

• New --fetch-keys command to retrieve keys by specifying a URI. This allows direct key retrieval from a web page or other location that can be specified in a URI. Available protocols are HTTP and finger, plus anything that cURL supplies, if built with cURL support.

• Files containing several signed messages are not allowed any longer as there is no clean way to report the status of such files back to the caller. To partly revert to the old behaviour the new option --allow-multisig-verification may be used.

• The keyserver helpers can now handle keys in either ASCII armor or binary format.

• New auto-key-locate option that takes an ordered list of methods to locate a key if it is not available at encryption time (-r or --recipient). Possible methods include "cert" (use DNS CERT as per RFC2538bis, "pka" (use DNS PKA), "ldap" (consult the LDAP server for the domain in question), "keyserver" (use the currently defined keyserver), as well as arbitrary keyserver URIs that will be contacted for the key.

• Able to retrieve keys using DNS CERT records as per RFC-2538bis (currently in draft): ​http://www.josefsson.org/rfc2538bis

Internationalization ====================

GnuPG comes with support for 28 languages. Due to a lot of new and changed strings the translations are not entirely complete.

Future Directions =================

GnuPG 1.4.x is the current stable branch and will be kept as the easy to use and build single-executable versions. We plan to backport new features from the development series to 1.4.

GnuPG 1.9.x is the new development series of GnuPG. This version merged the code from the Aegypten project and thus it includes the gpg-agent, a smartcard daemon and gpg's S/MIME cousin gpgsm. The design is different to the previous versions and we may not support all ancient systems - thus POSIX compatibility will be an absolute requirement for supported platforms. 1.9 is as of now based on an somewhat older 1.3 code but will peacefully coexist with other GnuPG versions.

IF YOU NEED GNUPG 1.9, IT IS HIGHLY SUGGESTED THAT YOU INSTALL IT IN ADDITION TO GNUPG 1.4! Both versions will peacefully coexist and extend each other.

Support =======

Improving GnuPG is costly, but you can help! We are looking for organizations that find GnuPG useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or by donating money.

Commercial support contracts for GnuPG are available, and they help finance continued maintenance. g10 Code GmbH, a Duesseldorf based company owned and headed by gpg's principal author, is currently funding GnuPG development. We are always looking for interesting development projects.

A service directory has recently been started at:

​http://www.gnupg.org/service.html

Thanks ======

We have to thank all the people who helped with this release, be it testing, coding, translating, suggesting, auditing, administering the servers, spreading the word or answering questions on the mailing lists.

Happy Hacking,

The GnuPG Team (David, Werner and the other contributors)

-- Werner Koch <wk at gnupg.org> The GnuPG Experts ​http://g10code.com Free Software Foundation Europe ​http://fsfeurope.org Join the Fellowship and protect your Freedom! ​http://www.fsfe.org

[markd@…]

The maintainer just committed a version bump to v1.4.3. Closing.