Noteworthy changes in version 2.5.19 (2026-04-24) ================================================= [compared to version 2.5.18]
* New and extended features: - gpg: New option --use-ocb-sym. [rGccdcdfbb37] - gpg: New options --show-[only-]session-hash. [rGecd0f7afa1] - gpgsm: Allow cipher mode to be part of the algo given to the --cipher-algo option. [T3979] - gpgsm: Emit more details when failing to check a crlDP. [T8221] - agent: Improve pinentry behavior and texts in smartcard context. [T6425] - dirmngr: New keyword "clear" for --keyserver. [rG2ab4cba36c]
* Bug fixes: - gpg: Fix edge case in --refresh-keys. [T8197] - gpg: Don't call gcry_kdf_derive with empty passphrase. [T7739] - gpgsm: Skip the optional PKCS#12 PBES2 keyLength parameter to allow import of recently issued certificates by the German Telekom. [rGc8c9604bba] - gpgsm: Fix a bug so that a certificate can be signed using a different algo. [rG66fdafab3c] - gpgsm: Make GCM fully compliant in de-vs mode. [rG04fd775fce] - gpgsm: Add a certificate chain check for de-vs compliance. [T8188] - gpgsm: Show rsaPSS certificates as de-vs compliant in listings. [T8222] - agent: Rework the trustlist reading code to finally allow a trustlist.txt with a missing trailing LF. [T8078] - ssh: Fix RSA padding in signature handling. [T7882,T8202] - gpgtar: Fix -C (--directory) to check the output directory. [T8159]
* Other changes: - agent: Raise an error when p >= q for RSA keys to detect incorrect generated *PGP keys. [T8171]
Noteworthy changes in version 2.5.20 (2026-05-13) ================================================= [compared to version 2.5.19]
* New and extended features: - gpgsm: Implement GCM encryption. Note that decryption works since version 2.3.2. [T3979] - gpgsm: New option --attribute and server command SETATTR to include arbitrary signed or unsigned attributes into a signature. Enable only with libksba 1.7.0 or later. [T4537] - gpgsm: Introduce system attribute _signingCertificateV2. [rG0335a9cb04]
* Bug fixes: - gpg: Fix wrong assertion failure which could very rarely occur during key signature checking. [rG693f5642f6] - gpg: Consider certify-only keys for revocation signature check. [T8196] - gpgsm: Fix possible double free in the CMS parser. [T8240] - gpgsm: Fix possible too early removal of ephemeral keys. [T8236] - gpgsm: Avoid emitting a final FAILURE status line if --status-fd is not used. [rG69c27fe377] - gpgsm: Fix a regression in 2.5.19 for password encrypted GCM data. [rG60a823c97b] - agent: Fix not using cache for pinentry loopback. [rGd4b608a31f] - agent: Fix command PUT_SECRET by saving input line. [rG1875bc185e] - keyboxd: Mark keys searched but not imported via LDAP correctly as ephemeral. [T8048] - scdaemon: Avoid buffer overflow with SC-HSM cards providing RSA keys > 2k. [T8244] - dirmngr: Fix uninitialized use of the dns_any union in dns_rr_cmp. [T8251]
Noteworthy changes in version 2.5.21 (2026-07-02) ================================================= [compared to version 2.5.20]
* New and extended features: - gpg, gpgsm: Use partial file on decryption, remove on failure. Disable with "--compatibility-flags=no-partial-file-guard". [T7873] - gpg: Use the INT_RCP_FPR subpacket in revocation signatures. [T8252] - Create a pkgversioninfo.txt file when building using the speedo build system.
* Bug fixes: - gpg: Fix potential use-after-free in batch key generation when handling the keyserver URL option. [T8277] - gpgsm: Fix regression in gpgsm_verify with expired certificates. [T8188] - gpgsm: Require a minimum tag length for GCM decryption. [rG4c7e68cf3d, CVE-2026-34182] - scd: Limit the size of returned APDU objects from faulty cards. [T8281] - scd: Fix condition to retrieve ATR. [rGca25a7a61b] - scd:openpgp: Fix regression in CHV1 retry counter byte index. [rG245330ebea] - agent: Make batch import of Kyber keys work. [T8029] - dirmngr: Add a validation check in get_dns_cert_standard. [T8303] - gpgconf: Raise an error on certain parse errors. [T8261] - Fix use of usleep in file remove function on Windows. Regression since 2.5.13. [rGab9ce5f5e7]
Noteworthy changes in version 2.5.22 (2026-08-31) ================================================= [compared to version 2.5.21]
* New and extended features:
- gpg: New option "primary" for the --card-edit "generate" command. This option is useful create only the primary key on the first slot of an OpenPGP card. [T8344] - Make detection of the installation directory work for macOS. [rG0be940905d] - gpgsm: Emit issuer and serial no. when the certificate is not found. [T8363]
* Bug fixes:
- gpg: Fix trustdb recursive lock problem. [T8317] - gpg: Fix using wrong fingerprint length for the intended recipient fingerprint. [T8330] - gpg: Fix wrong assertion edge case in building packets. [rGe319d82d7e] - gpg: Fix possible double free in import_revoke_cert. [T8328] - gpg: Fix long standing regression of "bkuptocard". [T8344,rGf103eaee63] - gpg: Fix TOFU trust models to actually check UTK signatures. [T8404] - gpg: Don't enable the partial file guard if already done. Fix regression introduced by partial file guards. [T8399] - gpgsm: Only display de-vs compliance status in de-vs compliance mode. [T8333] - gpgsm: Return 0 if decryption of multi recipient file succeeds. [T8340] - gpgsm: Check args for special file names and dashes. [T8347] - gpgsm: Fix keydb_get_flags with keyboxd. [T8048] - g13: Add sanity check on the syntax of the dmsetup algo string. [rG386c3e63b1]
* Other changes:
- gpg,gpgsm: Emit signing time as status output also for bad signatures. [T8364] - gpg: Emit status line for failed write. [T8398] - scd: Put a workaround for buggy CCID device. [T8331] - scd: Allow switching APP when --pcsc-shared is enabled. [rGf783c02525] - gpgconf: Print a warning on Windows on insufficent global config directory permissions. [rG56eb3148c7]
Noteworthy changes in version 2.5.24 (2026-09-23) ------------------------------------------------- [compared to version 2.5.22]
Note that version 2.5.23 was released yesterday but had a regression in the smartcard detection code; which is fixed by this release.
* New and extended features:
- gpg: New option --allow-9980 to enable the processing of RFC-9980 specified data structures. The use of this option is only recommended if external policy requirements demand the use of these governmental approved specification. PGP folks requiring some PQC resistance should keep on using the standard LibrePGP Kyber algorithm introduced 2 years ago. [rG6803ce215c] - gpg: In 9980 mode support PQC encryption using ML-KEM (aka Kyber) with X448, X25519, Brainpool, or NIST curves as specified by RFC-9980 et al. - gpg: In 9980 mode support ED25519 and X25519 as specified by RFC-9580 under the names "ietf27" and "ietf27". - gpg: Add experimental support for a --compliance=fips mode to use GCM for bulk encryption. [rG05c271f45a] - scd: Add Nitrokey 3 to pcsc-shared interference detection. [T8331]
* Bug fixes:
- gpgsm: Fix an exploitable printf bug when using the debug option "--debug x509". [rGe6d92ff7af] - dirmngr: Make the LDAP upload flags also work for KS_SEARCH. [T7866] - dirmngr: Fix OOB read in DNS CERT record parser. [T8464] - scd: Fix OOB access in DO parsing of faulty cards. [T8465]
* Other changes:
- dirmngr: Add a mitigation for badly configured web key directories. [rGbc7686ad7c] - New option --debug-no-libgcrypt for gpg, gpgsm, and agent. This debug option is useful to avoid cluttering other debug output with libgcrypt generated debug details. - gpg: New --list-options "debug-show-sexp" to print a secret key as an s-expression. [rG1e0261fe50]
⛔ Warning (files): Missing ‘lexical-binding’ cookie in "~/.navi2ch/init.el". You can add one with ‘M-x elisp-enable-lexical-binding RET’. See ‘(elisp)Selecting Lisp Dialect’ and ‘(elisp)Converting to Lexical Binding’ for more information.
⛔ Warning (files): Missing ‘lexical-binding’ cookie in "/usr/share/emacs/site-lisp/navi2ch/navi2ch-inline.el". You can add one with ‘M-x elisp-enable-lexical-binding RET’. See ‘(elisp)Selecting Lisp Dialect’ and ‘(elisp)Converting to Lexical Binding’ for more information.
And we all have ONE goal.(われわれの もくてきは ただ ひとつ…) To defeat YOU.(きさまを たおすことだ) @. No, WHATEVER you are.(@よ… いや… きさまの しょうたいが なんであろうと…) For the sake of the whole dungeon…(めいきゅうを すくうため…) I, YENDOR, will strike you down!(わたしが かならず きさまを うちたおす!) "You're gonna have to try a little harder than THAT."(さあ きさまの ほんきを みせてみろ)