[Announce] GnuPG 1.4.3 released
Werner Koch
wk at gnupg.org
Mon Apr 3 14:13:15 CEST 2006
Hello!
We are pleased to announce the availability of a new stable GnuPG
release: Version 1.4.3
The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication
and data storage. It is a complete and free replacement of PGP and
can be used to encrypt data and to create digital signatures. It
includes an advanced key management facility and is compliant with the
proposed OpenPGP Internet standard as described in RFC2440.
Getting the Software
====================
Please follow the instructions found at http://www.gnupg.org/download/
or read on:
GnuPG 1.4.3 may be downloaded from one of the GnuPG mirror sites or
direct from ftp://ftp.gnupg.org/gcrypt/ . The list of mirrors can be
found at http://www.gnupg.org/mirrors.html . Note, that GnuPG is not
available at ftp.gnu.org.
On the mirrors you should find the following files in the *gnupg*
directory:
gnupg-1.4.3.tar.bz2 (3041k)
gnupg-1.4.3.tar.bz2.sig
GnuPG source compressed using BZIP2 and OpenPGP signature.
gnupg-1.4.3.tar.gz (4219k)
gnupg-1.4.3.tar.gz.sig
GnuPG source compressed using GZIP and OpenPGP signature.
gnupg-1.4.2.2-1.4.3.diff.bz2 (905k)
A patch file to upgrade a 1.4.2.2 GnuPG source.
Select one of them. To shorten the download time, you probably want to
get the BZIP2 compressed file. Please try another mirror if
exceptional your mirror is not yet up to date.
In the *binary* directory, you should find these files:
gnupg-w32cli-1.4.3.exe (1436k)
gnupg-w32cli-1.4.3.exe.sig
GnuPG compiled for Microsoft Windows and OpenPGP signature.
Note that this is a command line version and now comes with a
graphical installer tool. The source files are the same as
given above. Note, that this is a minimal version and unless
you are just in need for the gpg binary, you are better off
using the full featured installer at http://www.gpg4win.org .
Version 1.0 will be available in a few days - the currently
available release candidate is pretty much up to GnuPG 1.4.3.
Checking the Integrity
======================
In order to check that the version of GnuPG which you are going to
install is an original and unmodified one, you can do it in one of
the following ways:
* If you already have a trusted version of GnuPG installed, you
can simply check the supplied signature. For example to check the
signature of the file gnupg-1.4.3.tar.bz2 you would use this command:
gpg --verify gnupg-1.4.3.tar.bz2.sig
This checks whether the signature file matches the source file.
You should see a message indicating that the signature is good and
made by that signing key. Make sure that you have the right key,
either by checking the fingerprint of that key with other sources
or by checking that the key has been signed by a trustworthy other
key. Note, that you can retrieve the signing key using the command
finger wk ,at' g10code.com
or using a keyserver like
gpg --recv-key 1CE0C630
The distribution key 1CE0C630 is signed by the well known key
5B0358A2. If you get an key expired message, you should retrieve a
fresh copy as the expiration date might have been prolonged.
NEVER USE A GNUPG VERSION YOU JUST DOWNLOADED TO CHECK THE
INTEGRITY OF THE SOURCE - USE AN EXISTING GNUPG INSTALLATION!
* If you are not able to use an old version of GnuPG, you have to verify
the SHA-1 checksum. Assuming you downloaded the file
gnupg-1.4.3.tar.bz2, you would run the sha1sum command like this:
sha1sum gnupg-1.4.3.tar.bz2
and check that the output matches the first line from the
following list:
9e96b36e4f4d1e8bc5028c99fac674482cbdb370 gnupg-1.4.3.tar.bz2
7c0f5db594bed9a901d9be43c31f6c80c6080141 gnupg-1.4.3.tar.gz
5477211551e96ad689c7618ee39a2b9c186721ef gnupg-1.4.2.2-1.4.3.diff.bz2
abf49fa5dc71e291144780d47f2811d83ae5e1ba gnupg-w32cli-1.4.3.exe
Upgrade Information
===================
If you are upgrading from a version prior to 1.0.7, you should run the
script tools/convert-from-106 once. Please note also that due to a
bug in versions prior to 1.0.6 it may not be possible to downgrade to
such versions unless you apply the patch
http://www.gnupg.org/developer/gpg-woody-fix.txt .
If you have any problems, please see the FAQ and the mailing list
archive at http://lists.gnupg.org. Please direct questions to the
gnupg-users at gnupg.org mailing list.
What's New
===========
* If available, cURL-based keyserver helpers are built that can
retrieve keys using HKP or any protocol that cURL supports
(HTTP, HTTPS, FTP, FTPS, etc). If cURL is not available, HKP
and HTTP are still supported using a built-in cURL emulator. To
force building the old pre-cURL keyserver helpers, use the
configure option --enable-old-keyserver-helpers. Note that none
of this affects finger or LDAP support, which are unchanged.
Note also that a future version of GnuPG will remove the old
keyserver helpers altogether.
* Implemented Public Key Association (PKA) signature verification.
This uses special DNS records and notation data to associate a
mail address with an OpenPGP key to prove that mail coming from
that address is legitimate without the need for a full trust
path to the signing key.
* When exporting subkeys, those specified with a key ID or
fingerpint and the '!' suffix are now merged into one keyblock.
* Added "gpg-zip", a program to create encrypted archives that can
interoperate with PGP Zip.
* Added support for signing subkey cross-certification "back
signatures". Requiring cross-certification to be present is
currently off by default, but will be changed to on by default
in the future, once more keys use it. A new "cross-certify"
command in the --edit-key menu can be used to update signing
subkeys to have cross-certification.
* The key cleaning options for --import-options and
--export-options have been further polished. "import-clean" and
"export-clean" replace the older
import-clean-sigs/import-clean-uids and
export-clean-sigs/export-clean-uids option pairs.
* New "minimize" command in the --edit-key menu removes everything
that can be removed from a key, rendering it as small as
possible. There are corresponding "export-minimal" and
"import-minimal" commands for --export-options and
--import-options.
* New --fetch-keys command to retrieve keys by specifying a URI.
This allows direct key retrieval from a web page or other
location that can be specified in a URI. Available protocols
are HTTP and finger, plus anything that cURL supplies, if built
with cURL support.
* Files containing several signed messages are not allowed any
longer as there is no clean way to report the status of such
files back to the caller. To partly revert to the old behaviour
the new option --allow-multisig-verification may be used.
* The keyserver helpers can now handle keys in either ASCII armor
or binary format.
* New auto-key-locate option that takes an ordered list of methods
to locate a key if it is not available at encryption time (-r or
--recipient). Possible methods include "cert" (use DNS CERT as
per RFC2538bis, "pka" (use DNS PKA), "ldap" (consult the LDAP
server for the domain in question), "keyserver" (use the
currently defined keyserver), as well as arbitrary keyserver
URIs that will be contacted for the key.
* Able to retrieve keys using DNS CERT records as per RFC-2538bis
(currently in draft): http://www.josefsson.org/rfc2538bis
Internationalization
====================
GnuPG comes with support for 28 languages. Due to a lot of new and
changed strings the translations are not entirely complete.
Future Directions
=================
GnuPG 1.4.x is the current stable branch and will be kept as the easy
to use and build single-executable versions. We plan to backport new
features from the development series to 1.4.
GnuPG 1.9.x is the new development series of GnuPG. This version
merged the code from the Aegypten project and thus it includes the
gpg-agent, a smartcard daemon and gpg's S/MIME cousin gpgsm. The
design is different to the previous versions and we may not support
all ancient systems - thus POSIX compatibility will be an absolute
requirement for supported platforms. 1.9 is as of now based on an
somewhat older 1.3 code but will peacefully coexist with other GnuPG
versions.
IF YOU NEED GNUPG 1.9, IT IS HIGHLY SUGGESTED THAT YOU INSTALL IT IN
ADDITION TO GNUPG 1.4! Both versions will peacefully coexist and
extend each other.
Support
=======
Improving GnuPG is costly, but you can help! We are looking for
organizations that find GnuPG useful and wish to contribute back. You
can contribute by reporting bugs, improve the software, or by donating
money.
Commercial support contracts for GnuPG are available, and they help
finance continued maintenance. g10 Code GmbH, a Duesseldorf based
company owned and headed by gpg's principal author, is currently
funding GnuPG development. We are always looking for interesting
development projects.
A service directory has recently been started at:
http://www.gnupg.org/service.html
Thanks
======
We have to thank all the people who helped with this release, be it
testing, coding, translating, suggesting, auditing, administering the
servers, spreading the word or answering questions on the mailing
lists.
Happy Hacking,
The GnuPG Team (David, Werner and the other contributors)
--
Werner Koch <wk at gnupg.org>
The GnuPG Experts http://g10code.com
Free Software Foundation Europe http://fsfeurope.org
Join the Fellowship and protect your Freedom! http://www.fsfe.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 196 bytes
Desc: not available
Url : /pipermail/attachments/20060403/40f2df9e/attachment.pgp
More information about the Gnupg-announce
mailing list