commit: 70a5cc46592ba76ffa08535b1c60f9cc59470e88
Author: Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Thu Jul 14 00:49:29 2022 +0000
Commit: Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Thu Jul 14 00:49:29 2022 +0000
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=70a5cc46
app-crypt/gnupg: backport yubikey fix
Signed-off-by: Sam James <sam <AT> gentoo.org>
.../files/gnupg-2.3.7-yubikey-workaround-fix.patch | 53 ++++++++++++++++++++++
.../{gnupg-2.3.7.ebuild => gnupg-2.3.7-r1.ebuild} | 1 +
2 files changed, 54 insertions(+)
diff --git a/app-crypt/gnupg/files/gnupg-2.3.7-yubikey-workaround-fix.patch
b/app-crypt/gnupg/files/gnupg-2.3.7-yubikey-workaround-fix.patch
new file mode 100644
index 000000000000..94062c885b5b
--- /dev/null
+++ b/app-crypt/gnupg/files/gnupg-2.3.7-yubikey-workaround-fix.patch
@@ -0,0 +1,53 @@
+https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commit;h=f34b9147eb3070bce80d53febaa564164cd6c977
+
+From f34b9147eb3070bce80d53febaa564164cd6c977 Mon Sep 17 00:00:00 2001
+From: NIIBE Yutaka <gni...@fsij.org>
+Date: Wed, 13 Jul 2022 10:40:55 +0900
+Subject: [PATCH] scd:openpgp: Fix workaround for Yubikey heuristics.
+
+* scd/app-openpgp.c (parse_algorithm_attribute): Handle the case
+of firmware 5.4, too.
+
+--
+
+GnuPG-bug-id: 6070
+Signed-off-by: NIIBE Yutaka <gni...@fsij.org>
+--- a/scd/app-openpgp.c
++++ b/scd/app-openpgp.c
+@@ -6259,15 +6259,28 @@ parse_algorithm_attribute (app_t app, int keyno)
+ app->app_local->keyattr[keyno].ecc.algo = *buffer;
+ app->app_local->keyattr[keyno].ecc.flags = 0;
+
+- if (APP_CARD(app)->cardtype == CARDTYPE_YUBIKEY
+- || buffer[buflen-1] == 0x00 || buffer[buflen-1] == 0xff)
+- { /* Found "pubkey required"-byte for private key template. */
+- oidlen--;
+- if (buffer[buflen-1] == 0xff)
+- app->app_local->keyattr[keyno].ecc.flags |= ECC_FLAG_PUBKEY;
++ if (APP_CARD(app)->cardtype == CARDTYPE_YUBIKEY)
++ {
++ /* Yubikey implementations vary.
++ * Firmware version 5.2 returns "pubkey required"-byte with
++ * 0x00, but after removal and second time insertion, it
++ * returns bogus value there.
++ * Firmware version 5.4 returns none.
++ */
++ curve = ecc_curve (buffer + 1, oidlen);
++ if (!curve)
++ curve = ecc_curve (buffer + 1, oidlen - 1);
++ }
++ else
++ {
++ if (buffer[buflen-1] == 0x00 || buffer[buflen-1] == 0xff)
++ { /* Found "pubkey required"-byte for private key template. */
++ oidlen--;
++ if (buffer[buflen-1] == 0xff)
++ app->app_local->keyattr[keyno].ecc.flags |= ECC_FLAG_PUBKEY;
++ }
++ curve = ecc_curve (buffer + 1, oidlen);
+ }
+-
+- curve = ecc_curve (buffer + 1, oidlen);
+
+ if (!curve)
+ {
diff --git a/app-crypt/gnupg/gnupg-2.3.7.ebuild
b/app-crypt/gnupg/gnupg-2.3.7-r1.ebuild
similarity index 99%
rename from app-crypt/gnupg/gnupg-2.3.7.ebuild
rename to app-crypt/gnupg/gnupg-2.3.7-r1.ebuild
index 6f376da7aafd..54821c7edea1 100644
--- a/app-crypt/gnupg/gnupg-2.3.7.ebuild
+++ b/app-crypt/gnupg/gnupg-2.3.7-r1.ebuild
@@ -57,6 +57,7 @@ DOCS=(
PATCHES=(
"${FILESDIR}"/${PN}-2.1.20-gpgscm-Use-shorter-socket-path-lengts-to-improve-tes.patch
+ "${FILESDIR}"/${P}-yubikey-workaround-fix.patch
)
src_prepare() {
