Stay with QT 6.6.3 on Windows, because windeployqt
does not deploy the gcc libs with QT 6.7.2
Stay with QT 6.6.3 on MacOS, because the info/warning
message does not show an icon
Generalize the Clipboard format selection
and extend it to certificates.
Certificates may now be exported as chain
or together with private key.
The clipboard format selection also
affects the Drag&Drop content.
The Export->Clipboard men now also shows the
currently selected format export.
Also look in the directory of the application
if no other translation was found.
Add search path for qt5 or qt6 library translations
depending on the compiletime library version
Use static initializers while at it.
The "takeys" table was only created for existing databases.
New databases were immediately marked as version "8" databases
and the tykeys table creation was skipped.
Setting in opensc.conf:
reader_driver pcsc {
enable_pinpad = true;
}
Only call login once and return an empty pin
instead of a NULL pin, which indicated a failure
while an empty (non-NULL) return-value
indicates success.
Show the insecure algorithms with the postfix (insecure)
in the dropdown menu.
Since the "insecure" is translateable, put the algorithm NID
into the data field of the combo-box entry to
reliably find the correct entry by NID instead of text.
Put it into the "PlugIns" directory and load it from there.
Show whether the legacy-provider was loaded in the About-Dialog.
CmakeLists.txt: Improve OpenSSL Major version detection
and replace the foreach() loop in misc/CMakeLists.txt
by the simpler list(TRANSFORM ...)
The ta-key will be generated on-demand and assigned to the
issuing CA. All issued certificates of this CA will use the
same ta-key.
It can be exported as single file and will also be part of the
exported openvpn configuration file.
Extend export tests to validate the output of ta-keys
and adapt the OpenVPN conf file export test to also check the ta-key.
It results in CKR_SLOT_ID_INVALID error.
Use CK_SLOT_ID definition (unsigned long)
consistently. It is 64 bit on Linux.
Especially don't mangle it through an 'int'
in line 226 of lib/pkcs11_lib.cpp
Yubikey defines and enforces 4 (NEO) or 24 (YubiKey YK4, YubiKey YK5)
slots with special, fixed names.
Add a dropdown box if "fixed_ids" are present and let the user select
the slot during key generation.
Improve the timer interval maintenance process:
- Do not fire every second,
but at most 1 second after the last run
- Reduce the fired events.
- Every container now only evaluates its own elements
(keys, certs,etc.) instead of each container evaluating all
items and duplicating work
Disable sorting and resizing in the view during initialization,
to speed up opening the database
This actually needs a more sophisticated solution with
schema major.minor version, incrementing the major version
for breaking changes, where old releases should not open newer
databases.
In the past, schema changes were always backward compatible,
i.e. older releases could open newer databases without breaking them.
Before this change, the export format descriptions were created
statically before any translation has been setup.
Now it is created after the translation is setup and after every
language change.
Enable legacy provider to allow loading keys
encrypted with an ancient, insecure
algorithm like "pbeWithSHA1And40BitRC2-CBC" for PKCS#12/PFX
Install the dynamic.dll in the portable app and WIX installer.
Create ovpn file with "ca", "cert" and "key"
Additionally put all intermediate CAs (if any)
tagged as "extra-certs".
"tls-auth" "OpenVPN Static key V1" not supported (yet)
Extend export-test by OpenVPN test case
When opening the database Find legacy encrypted keys and:
- update them automatically when encrypted with the
database password or
- inform the user about a required action when encrypted with an
individual passphrase
Related issues #458#511#503#500#494#484#482#475
Remember a complete transformation of all keys
in the Settings["legacy-keys-updated"]
to avoid analyzing all keys each tim a database is opened.
With 2.5.0 support for decrypting pre 2.0.0 keys was dropped.
However, the database update in 2.0.0 and later did not convert the
keys.
Related issues #458#511#503#500#494#484#482#475
When requesting revocation AND deletion of certificates while renewing
them, revocation occurs after deletion, causing a use-after-free
error/crash.
This commit delays the certificates deletion after they have been
revoked.
Because generally using QString.arg() results in an error for
strings without %1
Also use the static database() function instead of creating
a temporary instance during close.
Improve error- and password handling:
- Also identify: (ERR_LIB_PROV:PROV_R_BAD_DECRYPT) as password error.
- Do not use the OpenSSL internal bitfield definition (0xff000fff)
but the official API: ERR_GET_LIB(), ERR_GET_REASON()
Especially ERR_LIB_OFFSET changed from 24 to 23 in Openssl 3.0.0
- First check for "Cancel", then for invalid password to avoid
an "Invalid Password" message after aborting the password input dialog.
If a CA certificate is deleted, all issued certificates must be moved to
an other issuer or the top-level list.
The CA cert will be taken from the model together with the issued certs
first. Then the issued certs are re-inserted.
To make this work correctly, the issuer must be erased from the issued certs
to be interpreted as insertion and not as move.
Importing the displayed public key of a certificate during
certificate import resulted in a double free.
The "import" flag of the key-details can now forcefully
disable the import button.
Fixing it was way more complex than simply disabling it.
Also add sanity checks for pointers that are not our childs
when creating the QModelIndex
When XCA started in 2002, there were no C++ initializers.
Drop explicit initializers from the constructors.
- Fix indentations of section declarators.
- Replace NULL by nullptr when feasible.
- Sort private section: properties first, then methods.
The ImportMulti dialog does not show up if there is only
one item to display, but the item is displayed directly.
The displayed items have a new "Import" button to import
directly from the viewed item.
If XCA is called with certs, crls, keys etc. from the commandline
XCA only displays and optionally imports the item if a default
database is given. Afterwards XCA exits.
The password provided on the command line will be used
as automatic input of the first password dialog.
The database will be opened without requiring a password.
This results in the following bevavior:
- crl-gen works with:
o database password
o private password
o PIN
- keygen works with database password
Fix logical error when exporting in PEM format.
The key export part was not reached...
The diff is much smaller when displayed with -b to skip
indentation-only changes....
Drop the unused "F_PLUSKEY" flag and fix the Template export
When using a key with a hash algorithm, check whether
they can be used together. This should have been happened in the GUI.
In case of an error use the largest algorithm
APPSTORE_COMPLIANT = ON:
- Turns off the File menu and moves the language selector to
the "Extra" Menu. "Options" and "Exit" are at the xca-macos
special-menu anyway.
- Switches the signing key from "Developer ID Application" to
"3rd Party Mac Developer Application"
- Sets the database name to "default.xdb"
- Adds "-appstore-compliant" option to macdeployqt
- Picks the "entitlement-appstore-compliant.plist"
- Disables the "Token" menu and "PKCS#11 provider" tab
in the option dialog
Caching solution for 186657fbce
was bad. It always returned "visible" when called with unchanged
pattern instead of the last result. Cache the last result
in "iamvisible": 0=no, 1=yes, 2=one-of-my-children and return
the cached value as long as the search pattern is unchanged.
Evaluate --name argument when generating the CRL.
Add --import-names option. This allows to name the imported items
individually, even if one PEM file contains multiple items.
github actions seem to fail because of iostream.
Do not analyze the details for hours, but drop the
last iostream references and hope it helps.
iostream was not the culprit. Keep this change anyway,
since it makes sense and unifies stdout access.
Extend B64_BLOB from "VARCHAR(8000)" which was a good
common value - until I realized that CRL may become pretty large.
Use "TEXT" for all databases but MariaDB, where LONGTEXT is used.
Add database type check via SQL query to detect the
correct database even behind an ODBC Driver.
A non-empty parent pointer now indicates that this
item is already inserted in the tree-view.
Duplicated templates are not. Do not copy the parent link
in the constructor.
According to the documentation EVP_PKEY_check() may
return -2 if the algorithm is not supported.
This has been observed with OpenSSL-1.1.1
See also b96951fdfd
If the base64 decoding fails these function return a null pointer
without setting an openssl error.
Additionally throw an error if the PEM_read_bio functions return NULL.
Do not interact with the GUI when loading datbase items (beginInsertRows,
beginMoveRows, beginRemoveRows, etc.) by not using
insertChild() / remFromCont() anymore.
Fill and organize the root- tree- and sub-items and call
columnsContentChanged() once when done.
Automatically set "parent" of a pki-item when inserting or removing
as child items.
