Improve error- and password handling:
- Also identify: (ERR_LIB_PROV:PROV_R_BAD_DECRYPT) as password error.
- Do not use the OpenSSL internal bitfield definition (0xff000fff)
but the official API: ERR_GET_LIB(), ERR_GET_REASON()
Especially ERR_LIB_OFFSET changed from 24 to 23 in Openssl 3.0.0
- First check for "Cancel", then for invalid password to avoid
an "Invalid Password" message after aborting the password input dialog.
If a CA certificate is deleted, all issued certificates must be moved to
an other issuer or the top-level list.
The CA cert will be taken from the model together with the issued certs
first. Then the issued certs are re-inserted.
To make this work correctly, the issuer must be erased from the issued certs
to be interpreted as insertion and not as move.
Importing the displayed public key of a certificate during
certificate import resulted in a double free.
The "import" flag of the key-details can now forcefully
disable the import button.
Fixing it was way more complex than simply disabling it.
Also add sanity checks for pointers that are not our childs
when creating the QModelIndex
When XCA started in 2002, there were no C++ initializers.
Drop explicit initializers from the constructors.
- Fix indentations of section declarators.
- Replace NULL by nullptr when feasible.
- Sort private section: properties first, then methods.
The ImportMulti dialog does not show up if there is only
one item to display, but the item is displayed directly.
The displayed items have a new "Import" button to import
directly from the viewed item.
If XCA is called with certs, crls, keys etc. from the commandline
XCA only displays and optionally imports the item if a default
database is given. Afterwards XCA exits.
The password provided on the command line will be used
as automatic input of the first password dialog.
The database will be opened without requiring a password.
This results in the following bevavior:
- crl-gen works with:
o database password
o private password
o PIN
- keygen works with database password
Fix logical error when exporting in PEM format.
The key export part was not reached...
The diff is much smaller when displayed with -b to skip
indentation-only changes....
Drop the unused "F_PLUSKEY" flag and fix the Template export
When using a key with a hash algorithm, check whether
they can be used together. This should have been happened in the GUI.
In case of an error use the largest algorithm
APPSTORE_COMPLIANT = ON:
- Turns off the File menu and moves the language selector to
the "Extra" Menu. "Options" and "Exit" are at the xca-macos
special-menu anyway.
- Switches the signing key from "Developer ID Application" to
"3rd Party Mac Developer Application"
- Sets the database name to "default.xdb"
- Adds "-appstore-compliant" option to macdeployqt
- Picks the "entitlement-appstore-compliant.plist"
- Disables the "Token" menu and "PKCS#11 provider" tab
in the option dialog
Caching solution for 186657fbce
was bad. It always returned "visible" when called with unchanged
pattern instead of the last result. Cache the last result
in "iamvisible": 0=no, 1=yes, 2=one-of-my-children and return
the cached value as long as the search pattern is unchanged.
Evaluate --name argument when generating the CRL.
Add --import-names option. This allows to name the imported items
individually, even if one PEM file contains multiple items.
github actions seem to fail because of iostream.
Do not analyze the details for hours, but drop the
last iostream references and hope it helps.
iostream was not the culprit. Keep this change anyway,
since it makes sense and unifies stdout access.
Extend B64_BLOB from "VARCHAR(8000)" which was a good
common value - until I realized that CRL may become pretty large.
Use "TEXT" for all databases but MariaDB, where LONGTEXT is used.
Add database type check via SQL query to detect the
correct database even behind an ODBC Driver.
A non-empty parent pointer now indicates that this
item is already inserted in the tree-view.
Duplicated templates are not. Do not copy the parent link
in the constructor.
According to the documentation EVP_PKEY_check() may
return -2 if the algorithm is not supported.
This has been observed with OpenSSL-1.1.1
See also b96951fdfd
If the base64 decoding fails these function return a null pointer
without setting an openssl error.
Additionally throw an error if the PEM_read_bio functions return NULL.
Do not interact with the GUI when loading datbase items (beginInsertRows,
beginMoveRows, beginRemoveRows, etc.) by not using
insertChild() / remFromCont() anymore.
Fill and organize the root- tree- and sub-items and call
columnsContentChanged() once when done.
Automatically set "parent" of a pki-item when inserting or removing
as child items.
Unify import functions for some (on_butImport_clicked)
or all (on_butOk_clicked) items.
They both call "importIndexes(const QModelIndexList &indexes)"
containing some or all indexes to import.
db_x509.cpp: Only need to search the treeItem (containing all items
without issuer, not all in the rootItem (containing also certificates
with known issuer)
Re-use "remFromCont()" when stealing items from an other CA.
This fix differs from the proposal in #368 because the signature
of pki_crl::sign() changed after the 2.4.0 release.
However, I was able to increase the bug impact!
Now it crashed instead of only throwing an error! :-)
The signature of the pki_crl::sign() method changed with
commit 61fa66b129, but C++
"outsmarted" me and automatically transformed the EVP_MD == nullptr
into the digest::constructor(EVP_MD) which crashed on the nullptr.
In commit 9767a3dca7
OpenSSL changed sign behavior, that now it calls sign mechanism two
times - first with NULL output buffer, to get size of it, for next call.
This causes two sign operations in token for ED25519, so, let's detect
NULL buffer and return size of signature.
I haven't tested other type of keys - it's possible that they have
the same issue.
The proposed "addAction()" with the KeySequence as 2nd argument
is only available soince Qt6.3 and not compatible with QT5
Change the call in a compatible way and set the shortcut afterwards.
No libraries needed. Just put all files as source to xca
and those needed for xcadoc to the xcadoc target.
Github Action: create deployments for each matrix result
XCA now supports both, Qt6 and Qt5 down to Qt-5.2
Use CMAKE_PREFIX_PATH to point to the QT dompiler directory like
$ cmake -B build -DCMAKE_PREFIX_PATH=$HOME/6.3.1/gcc_64
If the digest name is not empty and not understood by openssl
raise an error immediately.
If the nid id NID_undef make sure no openssl-error is stored
in the error list.
cache the results of visibility check as long as the search text remains.
This function is called many times when displaying the data,
even if the search string does not change.
What works:
- Importing ED25519 Signature key from Yubikey token (OpenSC with openpgp driver, key generated via gpg)
- Creating self-signed certificate for CA, for Signature key from card
- Signing Certificates using new CA
I haven't tested other features, e.g. storing new certificate on card, so, they're probably broken
... when multiple PKCS#11 slots are present
Use the same pkcs11 instance to close the session.
Kudos to Christian Svensson for not only finding and reporting
but also fixing this issue.
For interoprability reason.
To enforce it, set "#define OPENSSL_NO_STDIO 1"
All file access is done by reading/writing from/to BioByteArray()
which is filled by QFile:readAll()
Drop CRYPTO_malloc_debug / CRYPTO_mem_leaks
which is unused and disabled since many years.
- Always build html documentation if sphinx-build is available.
to be installable during install
- Collect "${D}/qthelp/xca.qhc" "${D}/qthelp/xca.qch" in QTHELP_IDX
and use this instead.
- On linux also install the qthelp in an html subdirectory like WIN32
- Don't instanciate QHelpEngine if no help available.
Collect all export formats in pki_export.
Each export format has assigned acouple of flags, indicating,
whether they are text, concatenateable, encrypted, usable for
multiple selections or only for a single item.
This commit also changes the default state of
the "Revoke old certificate" checkbox to unchecked.
The reasoning for this is that by renewing a certificate
its lifetime and subsequently validity are prolonged,
which therefore implies equal trustworthiness
for both new and old certificates, which does not intend
the revocation of the latter.
This also seperates UI from the core.
After calling QLocale::setDefault(), the empty QLocale constructor
returns the current default locale.
This is now used instead of XcaApplication::language()
Correctly create NewKey list items for smart-cards mechanisms.
use the PKCS#11 ID t.mech as parameter for CK_MECHANISM_TYPE
instead of t.type, which is an OpenSSL ID.
Both are numeric, so the compiler didnot complain.
For RSA it worked accidentally, because
type:EVP_PKEY_RSA == mech:CKM_RSA_PKCS_KEY_PAIR_GEN == 0
Bug introduced after 2.3.0 with
77519936e0
Set the mechanism of ED25519 to CKM_VENDOR_DEFINED, because ED25519
is not supported by PKCS#11 and 0 means CKM_RSA_PKCS_KEY_PAIR_GEN.
Rename XCA_SPECIAL to XCA_ARGUMENTS, which is less generic.
and change %1_OPTIONS to XCA_%1_OPTIONS to prefix all
XCA related environment variables with "XCA_".
Why?
- QT will switch from qmake to cmake sooner or later.
- autotools are good for unix-ish systems, cmake also for
macOS and Xcode as well as Windows and VS-code
- Cross compiling the windows-binaries on linux
is not very helpful to attract windows-centric
developers.
Also drop qmake's xca.pro
Generate man-page and sphinx sources of commandline arguments
during build by executing xca (xcadoc.cpp).
Generating Version-patchlevel and git hash is now also
OS independent.
The generic XcaProgress object is used, which dynamically
creates a Cmdline progress object.
The Mainwindow replaces it by a GUI object, which integrates
into the status bar.
the "lastRemote" database is not GUI specific and
has been moved from "OpenDb" to the non-gui class dbhistory,
which in turn becomes independent of OpenDb
After dropping Qt4 support, the Qt5 QStandardPaths class
can be used to replace my implementation of directory discovery.
QStandardPaths follows the XDG specification.
Reduce UI from QDialog to QWidget and display it in the XcaDialog frame.
Also move user interface specific code from the db_x509 class
into the CertTreeView class
