char can be signed or unsigned depending on the arch and compiler flags. Use unsigned char explicitly to behave consistently.
Fixes 7078853573 Consolidate Bignum2ByteArray conversion implementations
Break an endless loop if the size of the encrypted private key is 0
Also add sanity check when updating the private key
that it has a size > 0. This should not happen, but anyway.
This check is performed before the certificate is
issued and signed. Like all the other checks
regarding validity, extensions and other things.
Issuing certificates that violate the Name Constraints
of any CA in the chain is still be possible.
But there will be a warning now with the name of the affected
CA-Certificate and the violated constraint.
The Issuer can then decide whether to issue the
certificate or not.
A new tab on the certificate details dialog
shows the result of the OpenSSL validation process
and the calculated OpenSSL Purpose.
The translation of the OpenSSL X509_V_ERR.... messsages
back to strings is done by grepping them from "openssl/x509_vfy.h"
and wrapping them into a macro-call.
Additionally guard them by an #ifdef (Zombieland rule #2: Double-Tap)
This way:
- I don't need to test and check in which versions of OpenSSL
which errors are available or not
- New errors will be picked up automatically, as long as they
match the "X509_V_ERR_" pattern
Introduced with 7f5bdb7dec
Templates now export again completely and
not only the internal name and comment.
Also protect against an empty internal name
by setting it to "Pasted" as last resort.
Conversion of name constraints from certificate to Template
(Advanced Tab) and using them from there was working since long.
Now there is an additional input line, like (and next to)
SubjectAlternativeName with live validation and edit button
with guided input.
The conversion from cert to template now puts the extension
into the correct LineEdit and not on the Advanced Tab anymore.
However, XCA does NOT follow the constraints, yet.
It is still possible to issue certificates with arbitrary
names, independent of any "Name Constraints" in the CA.
This is what issue #239 asks for.
Use the provided plural mechanisms of QT.
The "PO" translation also works smoothly and
the translation mechanisms between .po <-> .qt
was tested successfully.
The new english translation file translates
the single phrase:
"Delete the %n revocation list(s): '%1'?"
into
"Delete the revocation list: '%1'?" for one item
and
"Delete the %n revocation lists: '%1'?" otherwise
Extend the ExportFile dialog by a checkbox to
switch between "all-in-one-file" or every item in a separate
file. It is only visible if more than one file is selected.
Activating the checkbox will:
- Change the file-input into a directory-input and cut off the
file name
- Disabling all formats that are intended for multiple items.
De-activating the checkbox will:
- Change the directory-input back into a file-input
and append the previously erased file name again.
- Disabling all export-formats that are only useful for single items.
coreApp->setOrganizationDomain() expects the domain
in DNS order (hohnstaedt.de) and not reversed.
Change the WM_CLASS property to "de.hohnstaedt.xca"
via setApplicationName().
While Qt6 prepends the reversed "OrganizationDomain",
Qt5 does not and setting the complete name with
domain-prefix works for both.
Also adopt the ".desktop" file name to follow the application-name
and fix issues found by "desktop-file-validate"
Replace "UPN:" by "otherName:msUPN;UTF8:" when generating
the extension from the Subject- and IssuerAlternativeName.
Extend the Edit dialog of the SAN and IAN by the "UPN" prefix.
Replace "otherName:msUPN;UTF8:" by "UPN:" when creating a template
from an existing certificate or request.
The OpenSSL config file export, the configuration display
and edit on the "Advanced Tab" are not afffected, since
this is an XCA syntax sugar, not supported by OpenSSL.
Update documentation
Use the probably modified internal name of the template
in the template-details dialog before import.
Therefore the name of the qlineedit of the internal name of
all other details dialogs changed from "descr" to "description"
to match the name in the NewX509 dialog and to be found
by the "XcaDetails" class.
When exporting the template data, add the internal name and the comment
to the exported data.
The XCA template data is defined by us and can be modified.
This change is backwards and upwards compatible:
New versions of XCA can read an old Template export and vice-versa.
--no-native-dialogs disables QTs feature to display
OS specific dialogs for message-boxes and file-open dialogs.
This is currently necessary for flatpak, but may be helpful in other
occasions, too.
Allow exporting encrypted ED25519 keys.
The crypt flag was disallowed to support SSH2 export.
But since the SSH2 key is written unencrypted,
this restriction makes no sense anymore.
Move writeSSH2private() and write_SSH2_ed25519_private()
from pki_key.cpp (base class for public keys)
to pki_evp.cpp (derived class for private keys)
Extend the function to write RSA/DSA/EC in traditional
format.
Remove the PEM flag from the export format to not be catched
by (PEM | PRIVATE) selector in db_key::exportItem().
Stay with QT 6.6.3 on Windows, because windeployqt
does not deploy the gcc libs with QT 6.7.2
Stay with QT 6.6.3 on MacOS, because the info/warning
message does not show an icon
Generalize the Clipboard format selection
and extend it to certificates.
Certificates may now be exported as chain
or together with private key.
The clipboard format selection also
affects the Drag&Drop content.
The Export->Clipboard men now also shows the
currently selected format export.
Also look in the directory of the application
if no other translation was found.
Add search path for qt5 or qt6 library translations
depending on the compiletime library version
Use static initializers while at it.
