Hello!
We are pleased to announce the availability of a new stable GnuPG-1
release: Version 1.4.18. This release fixes a regression introduced
with the 1.4.17 release.
The GNU Privacy Guard (GnuPG) is GNU's tool for secure communication and
data storage. It is a complete and free replacement of PGP and can be
used to encrypt data and to create digital signatures. It includes an
advanced key management facility, smartcard support and is compliant
with the OpenPGP Internet standard as described by RFC-4880. GnuPG is
distributed under the terms of the GNU General Public License (GPLv3+).
Note that this version is from the GnuPG-1 series and thus smaller than
those from the GnuPG-2 series, easier to build, and also better portable
to ancient platforms. In contrast to GnuPG-2 (e.g version 2.0.23) it
comes with no support for S/MIME, Secure Shell, or other tools useful
for desktop environments. Fortunately you may install both versions
alongside on the same system without any conflict.
What's New
==========
* Fix a regression in 1.4.17 if more than one keyid is given
to --recv-keys et al.
* Cap RSA and Elgamal keysize at 4096 bit also for unattended key
generation.
Getting the Software
===================
First of all, decide whether you really need GnuPG version 1.4.x - most
users are better off with the modern GnuPG 2.0.x version. Then follow
the instructions found at https://www.gnupg.org/download/ or read on:
GnuPG 1.4.18 may be downloaded from one of the GnuPG mirror sites or
direct from ftp://ftp.gnupg.org/gcrypt/ . The list of mirrors can be
found at https://www.gnupg.org/mirrors.html . Note, that GnuPG is not
available at ftp.gnu.org.
On ftp.gnupg.org and on its mirrors you should find the following new
files in the *gnupg* directory:
- The GnuPG source code compressed using BZIP2 and its OpenPGP
signature:
gnupg-1.4.18.tar.bz2 (3564k)
gnupg-1.4.18.tar.bz2.sig
- The GnuPG source code compressed using GZIP and its OpenPGP
signature:
gnupg-1.4.18.tar.gz (4930k)
gnupg-1.4.18.tar.gz.sig
- A patch file to upgrade a 1.4.16 GnuPG source tree. This patch does
not include updates of the language files.
gnupg-1.4.17-1.4.18.diff.bz2 (5k)
Select one of them. To shorten the download time, you probably want to
get the BZIP2 compressed file. Please try another mirror if exceptional
your mirror is not yet up to date.
In the *binary* directory, you should find these files:
- GnuPG compiled for Microsoft Windows and its OpenPGP signature.
This is a command line only version; the source files are the same
as above.
gnupg-w32cli-1.4.18.exe (1575k)
gnupg-w32cli-1.4.18.exe.sig
Note, that this is a minimal installer and unless you are only in need
for the simple the gpg binary, you are better off using the full
featured installer at https://www.gpg4win.org .
Checking the Integrity
=====================
In order to check that the version of GnuPG which you are going to
install is an original and unmodified one, you can do it in one of
the following ways:
* If you already have a trusted version of GnuPG installed, you
can simply check the supplied signature. For example to check the
signature of the file gnupg-1.4.18.tar.bz2 you would use this command:
gpg --verify gnupg-1.4.18.tar.bz2.sig
This checks whether the signature file matches the source file.
You should see a message indicating that the signature is good and
made by that signing key. Make sure that you have the right key,
either by checking the fingerprint of that key with other sources
or by checking that the key has been signed by a trustworthy other
key. Note, that you can retrieve the signing key using the command
finger wk ,at' g10code.com | gpg --import
or using a keyserver like
gpg --recv-key 4F25E3B6
The distribution key 4F25E3B6 is signed by the well known key
1E42B367. If you get an key expired message, you should retrieve a
fresh copy as the expiration date might have been prolonged.
NEVER USE A GNUPG VERSION YOU JUST DOWNLOADED TO CHECK THE
INTEGRITY OF THE SOURCE - USE AN EXISTING GNUPG INSTALLATION!
* If you are not able to use an old version of GnuPG, you have to verify
the SHA-1 checksum. Assuming you downloaded the file
gnupg-1.4.18.tar.bz2, you would run the sha1sum command like this:
sha1sum gnupg-1.4.18.tar.bz2
and check that the output matches the first line from the
following list:
41462d1a97f91abc16a0031b5deadc3095ce88ae gnupg-1.4.18.tar.bz2
ea7d66c3de7aaf46de9e8678f4fc4a8c329400b2 gnupg-1.4.18.tar.gz
f30571f855b3ff8becff5378a884638da4c3cc9e gnupg-1.4.17-1.4.18.diff.bz2
579de2464528b436f39c5835e766867a1efa5fee gnupg-w32cli-1.4.18.exe
Internationalization
===================
GnuPG comes with support for 29 languages. The Chinese (Simple and
Traditional), Czech, Danish, Dutch, French, German, Norwegian, Polish,
Romanian, Russian, Spanish, Swedish, Ukrainian, and Turkish translations
are close to be complete.
Support
======
Please consult the archive of the gnupg-users mailing list before
reporting a bug <https://gnupg.org/documentation/mailing-lists.html>.
We suggest to send bug reports for a new release to this list in favor
of filing a bug at <https://bugs.gnupg.org>. We also have a dedicated
service directory at <https://www.gnupg.org/service.html>.
The driving force behind the development of GnuPG is the company of
its principal author, Werner Koch. Maintenance and improvement of
GnuPG and related software takes up most of their resources. To allow
him to continue this work he kindly asks to either purchase a support
contract, engage g10 Code for custom enhancements, or to donate money:
https://gnupg.org/donate/
Thanks
=====
We have to thank all the people who helped with this release, be it
testing, coding, translating, suggesting, auditing, donating money,
spreading the word, or answering questions on the mailing lists.
Jean-Ren? Reinhard, Olivier Levillain, and Florian Maury of ANSSI.fr
found and reported the compression bug we fixed in 2.0.24. Jean-Ren?
should have been mentioned in the original commit message.
Salam-Shalom,
Werner
--
Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 180 bytes
Desc: not available
URL: </pipermail/attachments/20140630/0e35b909/attachment.sig>