Generalize the Clipboard format selection
and extend it to certificates.
Certificates may now be exported as chain
or together with private key.
The clipboard format selection also
affects the Drag&Drop content.
The Export->Clipboard men now also shows the
currently selected format export.
Also look in the directory of the application
if no other translation was found.
Add search path for qt5 or qt6 library translations
depending on the compiletime library version
Use static initializers while at it.
The "takeys" table was only created for existing databases.
New databases were immediately marked as version "8" databases
and the tykeys table creation was skipped.
Setting in opensc.conf:
reader_driver pcsc {
enable_pinpad = true;
}
Only call login once and return an empty pin
instead of a NULL pin, which indicated a failure
while an empty (non-NULL) return-value
indicates success.
Show the insecure algorithms with the postfix (insecure)
in the dropdown menu.
Since the "insecure" is translateable, put the algorithm NID
into the data field of the combo-box entry to
reliably find the correct entry by NID instead of text.
Put it into the "PlugIns" directory and load it from there.
Show whether the legacy-provider was loaded in the About-Dialog.
CmakeLists.txt: Improve OpenSSL Major version detection
and replace the foreach() loop in misc/CMakeLists.txt
by the simpler list(TRANSFORM ...)
The ta-key will be generated on-demand and assigned to the
issuing CA. All issued certificates of this CA will use the
same ta-key.
It can be exported as single file and will also be part of the
exported openvpn configuration file.
Extend export tests to validate the output of ta-keys
and adapt the OpenVPN conf file export test to also check the ta-key.
It results in CKR_SLOT_ID_INVALID error.
Use CK_SLOT_ID definition (unsigned long)
consistently. It is 64 bit on Linux.
Especially don't mangle it through an 'int'
in line 226 of lib/pkcs11_lib.cpp
Yubikey defines and enforces 4 (NEO) or 24 (YubiKey YK4, YubiKey YK5)
slots with special, fixed names.
Add a dropdown box if "fixed_ids" are present and let the user select
the slot during key generation.
Improve the timer interval maintenance process:
- Do not fire every second,
but at most 1 second after the last run
- Reduce the fired events.
- Every container now only evaluates its own elements
(keys, certs,etc.) instead of each container evaluating all
items and duplicating work
Disable sorting and resizing in the view during initialization,
to speed up opening the database
This actually needs a more sophisticated solution with
schema major.minor version, incrementing the major version
for breaking changes, where old releases should not open newer
databases.
In the past, schema changes were always backward compatible,
i.e. older releases could open newer databases without breaking them.
Before this change, the export format descriptions were created
statically before any translation has been setup.
Now it is created after the translation is setup and after every
language change.
Enable legacy provider to allow loading keys
encrypted with an ancient, insecure
algorithm like "pbeWithSHA1And40BitRC2-CBC" for PKCS#12/PFX
Install the dynamic.dll in the portable app and WIX installer.
Create ovpn file with "ca", "cert" and "key"
Additionally put all intermediate CAs (if any)
tagged as "extra-certs".
"tls-auth" "OpenVPN Static key V1" not supported (yet)
Extend export-test by OpenVPN test case
When opening the database Find legacy encrypted keys and:
- update them automatically when encrypted with the
database password or
- inform the user about a required action when encrypted with an
individual passphrase
Related issues #458#511#503#500#494#484#482#475
Remember a complete transformation of all keys
in the Settings["legacy-keys-updated"]
to avoid analyzing all keys each tim a database is opened.
With 2.5.0 support for decrypting pre 2.0.0 keys was dropped.
However, the database update in 2.0.0 and later did not convert the
keys.
Related issues #458#511#503#500#494#484#482#475
When requesting revocation AND deletion of certificates while renewing
them, revocation occurs after deletion, causing a use-after-free
error/crash.
This commit delays the certificates deletion after they have been
revoked.
Because generally using QString.arg() results in an error for
strings without %1
Also use the static database() function instead of creating
a temporary instance during close.
Improve error- and password handling:
- Also identify: (ERR_LIB_PROV:PROV_R_BAD_DECRYPT) as password error.
- Do not use the OpenSSL internal bitfield definition (0xff000fff)
but the official API: ERR_GET_LIB(), ERR_GET_REASON()
Especially ERR_LIB_OFFSET changed from 24 to 23 in Openssl 3.0.0
- First check for "Cancel", then for invalid password to avoid
an "Invalid Password" message after aborting the password input dialog.
