Collect all export formats in pki_export.
Each export format has assigned acouple of flags, indicating,
whether they are text, concatenateable, encrypted, usable for
multiple selections or only for a single item.
This commit also changes the default state of
the "Revoke old certificate" checkbox to unchecked.
The reasoning for this is that by renewing a certificate
its lifetime and subsequently validity are prolonged,
which therefore implies equal trustworthiness
for both new and old certificates, which does not intend
the revocation of the latter.
This also seperates UI from the core.
After calling QLocale::setDefault(), the empty QLocale constructor
returns the current default locale.
This is now used instead of XcaApplication::language()
Correctly create NewKey list items for smart-cards mechanisms.
use the PKCS#11 ID t.mech as parameter for CK_MECHANISM_TYPE
instead of t.type, which is an OpenSSL ID.
Both are numeric, so the compiler didnot complain.
For RSA it worked accidentally, because
type:EVP_PKEY_RSA == mech:CKM_RSA_PKCS_KEY_PAIR_GEN == 0
Bug introduced after 2.3.0 with
77519936e0
Set the mechanism of ED25519 to CKM_VENDOR_DEFINED, because ED25519
is not supported by PKCS#11 and 0 means CKM_RSA_PKCS_KEY_PAIR_GEN.
Rename XCA_SPECIAL to XCA_ARGUMENTS, which is less generic.
and change %1_OPTIONS to XCA_%1_OPTIONS to prefix all
XCA related environment variables with "XCA_".
Why?
- QT will switch from qmake to cmake sooner or later.
- autotools are good for unix-ish systems, cmake also for
macOS and Xcode as well as Windows and VS-code
- Cross compiling the windows-binaries on linux
is not very helpful to attract windows-centric
developers.
Also drop qmake's xca.pro
Generate man-page and sphinx sources of commandline arguments
during build by executing xca (xcadoc.cpp).
Generating Version-patchlevel and git hash is now also
OS independent.
The generic XcaProgress object is used, which dynamically
creates a Cmdline progress object.
The Mainwindow replaces it by a GUI object, which integrates
into the status bar.
the "lastRemote" database is not GUI specific and
has been moved from "OpenDb" to the non-gui class dbhistory,
which in turn becomes independent of OpenDb
After dropping Qt4 support, the Qt5 QStandardPaths class
can be used to replace my implementation of directory discovery.
QStandardPaths follows the XDG specification.
Reduce UI from QDialog to QWidget and display it in the XcaDialog frame.
Also move user interface specific code from the db_x509 class
into the CertTreeView class
Current implementation did not check whether a non-existing
database-file could be created.
Throw an error message if the database file cannot be created.
Simply by using XFile instead of QFile.
Commit e32fce8581
(main.cpp: mainwin must exist for read_cmdline() in GUI mode)
created the Mainwindow before parsing the commandline,
but the MainWindow constructor opened a default database if set.
With this change, the MinWindow constructor does not open a default
database. Now the default database is explicitly opened after parsing
the command line, if no other database is already open.
Rename init_database() to setup_open_database()
It is re-entrant.
For an official release XCA_VERSION == PACKAGE_VERSION.
For any additional commit, XCA_VERSION's path-level is increased.
PACKAGE_VERSION cannot be modified after initially set.
Change any occurance of PACKAGE_VERSION by XCA_VERSION
The patchlevel will be increased by the iteration counter,
which is the number of commits since the most recent annotated tag.
Tagged version 1.2.3 in VERSION will be called "1.2.3"
3 commits later it will be 1.2.6
All dialogs get the "Qt::WindowModal" modality to
operate the Help window in parallel
while also blocking the dialog parent windows.
The manageRevocations() moved from model to view
The Details dialogs become more self-sufficient.
There is a statc start method that shows the dialog and
updates name and comment after accept().
This allows recursive starts of certificate details and
independence of mainwin.
It is necessary to set the current toplevel widget as parent
for the next dialog to not block the application.
linuxdoc is pretty outdated, while sphinx is really cool:
- Sphinx is modern with a broad user base
- The generated documentation is themeable
- The sphinx-source is much more readable than the
SGML-tag scattered linuxdoc.
- The different topics can be splitted into different files
- It can be converted to qt-context sensitive help
- It supports syntax highlighting for the SQL database documentation
- It is supported on MacOSX,because it is python-based.
Drop code2html perl-script, which was used to colorize the SQL schema.
Generate "doc/arguments.rst" with XCA_MAN="rst" ./xca
Support loading OpenSSH ED25519 private key
Improve private key verification in general.
ED25519 does not support EVP_PKEY_sign(), so use
EVP_DigestSign(), which in turn only works since OpenSSL 1.1.1
resulting in a backward compatibility quirk in openssl_compat.
- Export SSH2 Public key
- Detect whether ED25519 key is private key
- Support ED25519 in the KeyDetails dialog
o Display public key
o Curve name
o Fingerprints
o Availability of private key
When analysing and translating the AuthorityKeyIdentifier
extension to OpenSSL syntax, take an existing DirName
as "issuer:always", because openssle otherwise ignores it,
when the keyid succeeds.
[Change Request] Consider changing PKCS12 export
extension from .p12 to .pfx by default,
as p12 is a legacy Netscape holdover,
and PFX is the 'standard' per RFC now.
Also extend the documentation about the password.
Automatically generate the man page from the options.
Call xca as "XCA_MAN=1 ./xca" to print the current man-page options
for certificates create a function returning
a dynamically casted pki_x509 pointer
Add NULL check of dynamically casted pointer,
because it could be a folder...
The global variable "Database" of class xca_db
can be used by any other class to access. No need
to provide it.
The "xca_db" class managed the "database_model" pointer.
Accessing the name of the current database has been unified.
OpenSSL fixed the 2 LN with commit:
648b53b88e
in OpenSSL 1.1.1e.
Follow my own advice and delete them from the oids.txt
together with all other OIDs present in OpenSSL
since at least version 0.9.8
Also do the initOIDs after creating the QApplication to
avoid qAbort() when creating the warning (introduced after 2.2.1)
If we have a QByteArray (ba) and must provide it to
a BIO* expecting OpenSSL function, the following
construct provides it: BioByteArray(ba).ro()
directly providing the QByteArray buffer as BIO
It also supports mixed writes:
BIO_write(bba, buf, size)
bba += QByteArray
We now use QFile or its derivate XFile, who smoothly
handle unicode filenames also on windows.
The lt_dlopen() only handles "char *" not wchar_t.
Try to convert the filename with all known codecs
until we can open it.
filename2QString() remains to differently encode
filenames provided on the commandline on Windows.
Change pkcs11List from QListWidget to QListView
The pkcs11_lib_list holds the data of the loaded libraries.
For the model a QList "model_data" is used to
hold indexes into QList dirs to allow duplicates,
moves and removes.
On windows it now displays the paths with \ separators.
Always only use forward slash /
Drop all "QDir::separator()" and "nativeSeparator()"
functions. Only use it where filenames are displayed for the user.
The plus sign was not compatible with the WIX toolset.
The 4th digist is the number of commits since the last release.
For a tagged release it is not 00, but empty.
in the past it was used to connect the NewX509 dialog
with requests keys and certs.
The NewX509 dialog knows mainwin since some time
and thus can connect itself to models and views
mainwin: use model<T>() instead of models->model<T>()
Fix finding our unassigned certificates when importing a CA
(issuerSqlId may be QVariant(int, 0) depending on the database)
Reassign certs from an older CA to the imported one.
And ImportMulti handles pki_multi sufficiently
and does not need to know about pkcs12 or pkcs7
pkcs12 and pkcs7 don't need: print() getCa() addCaCert() numCa()
it is handled by pki_multi()
Take advantage of the power of dynamic_cast<>() instead of using
typeid()
Passwd::cleanse() also resets the password size
db_base::flushLookup() now deletes all items
and pki_base does not anymore.
Drop TRACE
Colorize pki_base::print()
Set and inherit filename of loaded items
Add print() method to pki_pkcs12
and constify its methods
Use the Passwd class instead of QString
Move password input into the database model
to be available for commandline use.
Repeat in case of wrong password
New classes:
- database_model: Manage the database tables (keys, req, cert, crl, templ)
extracted from widgets/MW_database.cpp
- arguments: parse commandline, dynamically create help text
Use GetModuleFileNameW() and RegGetValueW()
returning the path as UTF-16 encoded unicode.
entropy: Use QFile inherited class for file access
This allows wchar_t encoded file names and paths
on windows.
So glad not having to deal with wchar_t / UTF-16 otherwise,
but using QString and UFT-8. The destiny of early adopters....
Fix finding our unassigned certificates when importing a CA
(issuerSqlId may be QVariant(int, 0) depending on the database)
Reassign certs from an older CA to the imported one.
Reuse HD_key_type, HD_key_size, HD_key_curve IDs from the key tab.
They use the "hd_key" type to put them into a context-submenu.
The certificate either uses the existing or a temporary key
and calls its "column_data()".
Simplify the submenu logic for the context-menu.
-Wstringop-truncation:
Ensure length passed to strncpy() is < size of destination buffer. The last
buffer byte is already nullified afterwards (in db::init_header() and
db::rename()).
-Wdeprecated-copy:
Explicit define of errorEx copy assignment operator.
Explicit define of x509revList copy assignment operator.
Explicit define of slotid copy constructor.
-Wimplicit-fallthrough:
Refactor code to suppress case fallthrough in pki_key::ssh_key_bn2data().
Improve Windows installation xca.wxs
Move documentation to "html" dir and translations to "i18n"
in the portable-app and the MSI installation
Modyfies getDocDir() and Introduces getI18nDir()
Drop Nullsoft installer files
- allow setting a database as default
- Strip xca-app-folder from database and export filenames.
This allows renaming/moving the portable app and open the default DB
and use the working directory inside the folder
- Remember database history and configured language
Add ODBC QSQL Database driver
Column "public" in public_keys table is a keyword in
MSSQL. Double quote it.
Double quotes are invalid on MySQL in non-ANSI mode.
Force ANSI mode for MySQL/MariaDB databases.
MSSQL also has a maximum VARCHAR of 8000
Schema updates are not performed for each new database.
New databases are immediately created conforming to schema:7
Schema 5 and 6 get updated to 7.
Schemas < 5 never have been released officially. (pre 2.0.0)
Switch "Database name" label to "DSN" for ODBC databases.
When transforming certificate or request extensions
into a template, the (e)keyusage critical flags storage
had a typo:
"eKyUseCritical" instead of "ekuCritical" and
"keyUseCritical" instead of "kuCritical"
Also the eKeyUse value was not transformed completely.
If Loading the item results in an openssl error,
even if the item is not empty, discard it.
Otherwise loading it from the database later on will fail.
Improve "autoIntName()"
Only use the public key when searching for
a matching key on the token.
Use token-name and serial to give the user a hint which token
XCA expects to carry the key.
With this commit PKCS#11 libraries may be reordered
and enabled or disabled.
The slot selection dialog iterates over all enabled and successfully
loaded libraries in the configured order and collects the slots
of each of them.
In the options dialog the library info is shown in the tool-tip
Print digest of public keys in the key details in different formats:
Print SHA256 SSH digest as used to by SSH users:
ssh-keygen -l -f ~/.ssh/id_rsa.pub
Print SHA1 X509 key digest as shown in the
Subject key identifier of a certificate
Print SHA256 digest as in:
openssl pkey -pubout -outform DER < key.pem | sha256sum
as requested by this issue.
Refactored digesting functionality by a generic Digest()
function working with QByteArrays.
The function formatHash() now also expects a QByteArray input.
