Unify import functions for some (on_butImport_clicked)
or all (on_butOk_clicked) items.
They both call "importIndexes(const QModelIndexList &indexes)"
containing some or all indexes to import.
db_x509.cpp: Only need to search the treeItem (containing all items
without issuer, not all in the rootItem (containing also certificates
with known issuer)
Re-use "remFromCont()" when stealing items from an other CA.
This fix differs from the proposal in #368 because the signature
of pki_crl::sign() changed after the 2.4.0 release.
However, I was able to increase the bug impact!
Now it crashed instead of only throwing an error! :-)
The signature of the pki_crl::sign() method changed with
commit 61fa66b129, but C++
"outsmarted" me and automatically transformed the EVP_MD == nullptr
into the digest::constructor(EVP_MD) which crashed on the nullptr.
In commit 9767a3dca7
OpenSSL changed sign behavior, that now it calls sign mechanism two
times - first with NULL output buffer, to get size of it, for next call.
This causes two sign operations in token for ED25519, so, let's detect
NULL buffer and return size of signature.
I haven't tested other type of keys - it's possible that they have
the same issue.
The proposed "addAction()" with the KeySequence as 2nd argument
is only available soince Qt6.3 and not compatible with QT5
Change the call in a compatible way and set the shortcut afterwards.
No libraries needed. Just put all files as source to xca
and those needed for xcadoc to the xcadoc target.
Github Action: create deployments for each matrix result
XCA now supports both, Qt6 and Qt5 down to Qt-5.2
Use CMAKE_PREFIX_PATH to point to the QT dompiler directory like
$ cmake -B build -DCMAKE_PREFIX_PATH=$HOME/6.3.1/gcc_64
If the digest name is not empty and not understood by openssl
raise an error immediately.
If the nid id NID_undef make sure no openssl-error is stored
in the error list.
cache the results of visibility check as long as the search text remains.
This function is called many times when displaying the data,
even if the search string does not change.
What works:
- Importing ED25519 Signature key from Yubikey token (OpenSC with openpgp driver, key generated via gpg)
- Creating self-signed certificate for CA, for Signature key from card
- Signing Certificates using new CA
I haven't tested other features, e.g. storing new certificate on card, so, they're probably broken
... when multiple PKCS#11 slots are present
Use the same pkcs11 instance to close the session.
Kudos to Christian Svensson for not only finding and reporting
but also fixing this issue.
For interoprability reason.
To enforce it, set "#define OPENSSL_NO_STDIO 1"
All file access is done by reading/writing from/to BioByteArray()
which is filled by QFile:readAll()
Drop CRYPTO_malloc_debug / CRYPTO_mem_leaks
which is unused and disabled since many years.
- Always build html documentation if sphinx-build is available.
to be installable during install
- Collect "${D}/qthelp/xca.qhc" "${D}/qthelp/xca.qch" in QTHELP_IDX
and use this instead.
- On linux also install the qthelp in an html subdirectory like WIN32
- Don't instanciate QHelpEngine if no help available.
Collect all export formats in pki_export.
Each export format has assigned acouple of flags, indicating,
whether they are text, concatenateable, encrypted, usable for
multiple selections or only for a single item.
This commit also changes the default state of
the "Revoke old certificate" checkbox to unchecked.
The reasoning for this is that by renewing a certificate
its lifetime and subsequently validity are prolonged,
which therefore implies equal trustworthiness
for both new and old certificates, which does not intend
the revocation of the latter.
This also seperates UI from the core.
After calling QLocale::setDefault(), the empty QLocale constructor
returns the current default locale.
This is now used instead of XcaApplication::language()
Correctly create NewKey list items for smart-cards mechanisms.
use the PKCS#11 ID t.mech as parameter for CK_MECHANISM_TYPE
instead of t.type, which is an OpenSSL ID.
Both are numeric, so the compiler didnot complain.
For RSA it worked accidentally, because
type:EVP_PKEY_RSA == mech:CKM_RSA_PKCS_KEY_PAIR_GEN == 0
Bug introduced after 2.3.0 with
77519936e0
Set the mechanism of ED25519 to CKM_VENDOR_DEFINED, because ED25519
is not supported by PKCS#11 and 0 means CKM_RSA_PKCS_KEY_PAIR_GEN.
Rename XCA_SPECIAL to XCA_ARGUMENTS, which is less generic.
and change %1_OPTIONS to XCA_%1_OPTIONS to prefix all
XCA related environment variables with "XCA_".
Why?
- QT will switch from qmake to cmake sooner or later.
- autotools are good for unix-ish systems, cmake also for
macOS and Xcode as well as Windows and VS-code
- Cross compiling the windows-binaries on linux
is not very helpful to attract windows-centric
developers.
Also drop qmake's xca.pro
Generate man-page and sphinx sources of commandline arguments
during build by executing xca (xcadoc.cpp).
Generating Version-patchlevel and git hash is now also
OS independent.
The generic XcaProgress object is used, which dynamically
creates a Cmdline progress object.
The Mainwindow replaces it by a GUI object, which integrates
into the status bar.
the "lastRemote" database is not GUI specific and
has been moved from "OpenDb" to the non-gui class dbhistory,
which in turn becomes independent of OpenDb
After dropping Qt4 support, the Qt5 QStandardPaths class
can be used to replace my implementation of directory discovery.
QStandardPaths follows the XDG specification.
Reduce UI from QDialog to QWidget and display it in the XcaDialog frame.
Also move user interface specific code from the db_x509 class
into the CertTreeView class
Current implementation did not check whether a non-existing
database-file could be created.
Throw an error message if the database file cannot be created.
Simply by using XFile instead of QFile.
Commit e32fce8581
(main.cpp: mainwin must exist for read_cmdline() in GUI mode)
created the Mainwindow before parsing the commandline,
but the MainWindow constructor opened a default database if set.
With this change, the MinWindow constructor does not open a default
database. Now the default database is explicitly opened after parsing
the command line, if no other database is already open.
Rename init_database() to setup_open_database()
It is re-entrant.
For an official release XCA_VERSION == PACKAGE_VERSION.
For any additional commit, XCA_VERSION's path-level is increased.
PACKAGE_VERSION cannot be modified after initially set.
Change any occurance of PACKAGE_VERSION by XCA_VERSION
The patchlevel will be increased by the iteration counter,
which is the number of commits since the most recent annotated tag.
Tagged version 1.2.3 in VERSION will be called "1.2.3"
3 commits later it will be 1.2.6
All dialogs get the "Qt::WindowModal" modality to
operate the Help window in parallel
while also blocking the dialog parent windows.
The manageRevocations() moved from model to view
The Details dialogs become more self-sufficient.
There is a statc start method that shows the dialog and
updates name and comment after accept().
This allows recursive starts of certificate details and
independence of mainwin.
It is necessary to set the current toplevel widget as parent
for the next dialog to not block the application.
linuxdoc is pretty outdated, while sphinx is really cool:
- Sphinx is modern with a broad user base
- The generated documentation is themeable
- The sphinx-source is much more readable than the
SGML-tag scattered linuxdoc.
- The different topics can be splitted into different files
- It can be converted to qt-context sensitive help
- It supports syntax highlighting for the SQL database documentation
- It is supported on MacOSX,because it is python-based.
Drop code2html perl-script, which was used to colorize the SQL schema.
Generate "doc/arguments.rst" with XCA_MAN="rst" ./xca
Support loading OpenSSH ED25519 private key
Improve private key verification in general.
ED25519 does not support EVP_PKEY_sign(), so use
EVP_DigestSign(), which in turn only works since OpenSSL 1.1.1
resulting in a backward compatibility quirk in openssl_compat.
- Export SSH2 Public key
- Detect whether ED25519 key is private key
- Support ED25519 in the KeyDetails dialog
o Display public key
o Curve name
o Fingerprints
o Availability of private key
When analysing and translating the AuthorityKeyIdentifier
extension to OpenSSL syntax, take an existing DirName
as "issuer:always", because openssle otherwise ignores it,
when the keyid succeeds.
[Change Request] Consider changing PKCS12 export
extension from .p12 to .pfx by default,
as p12 is a legacy Netscape holdover,
and PFX is the 'standard' per RFC now.
Also extend the documentation about the password.
Automatically generate the man page from the options.
Call xca as "XCA_MAN=1 ./xca" to print the current man-page options
for certificates create a function returning
a dynamically casted pki_x509 pointer
Add NULL check of dynamically casted pointer,
because it could be a folder...
The global variable "Database" of class xca_db
can be used by any other class to access. No need
to provide it.
The "xca_db" class managed the "database_model" pointer.
Accessing the name of the current database has been unified.
OpenSSL fixed the 2 LN with commit:
648b53b88e
in OpenSSL 1.1.1e.
Follow my own advice and delete them from the oids.txt
together with all other OIDs present in OpenSSL
since at least version 0.9.8
Also do the initOIDs after creating the QApplication to
avoid qAbort() when creating the warning (introduced after 2.2.1)
If we have a QByteArray (ba) and must provide it to
a BIO* expecting OpenSSL function, the following
construct provides it: BioByteArray(ba).ro()
directly providing the QByteArray buffer as BIO
It also supports mixed writes:
BIO_write(bba, buf, size)
bba += QByteArray
We now use QFile or its derivate XFile, who smoothly
handle unicode filenames also on windows.
The lt_dlopen() only handles "char *" not wchar_t.
Try to convert the filename with all known codecs
until we can open it.
filename2QString() remains to differently encode
filenames provided on the commandline on Windows.
Change pkcs11List from QListWidget to QListView
The pkcs11_lib_list holds the data of the loaded libraries.
For the model a QList "model_data" is used to
hold indexes into QList dirs to allow duplicates,
moves and removes.
On windows it now displays the paths with \ separators.
Always only use forward slash /
Drop all "QDir::separator()" and "nativeSeparator()"
functions. Only use it where filenames are displayed for the user.
The plus sign was not compatible with the WIX toolset.
The 4th digist is the number of commits since the last release.
For a tagged release it is not 00, but empty.
