Re: [Announce] GnuPG 2.5.21 released (Werner Koch)

--===============0322071120450386801==
Content-Type: multipart/alternative; 
	boundary="----=_Part_1521971_1064357986.1783981831637"
Content-Length: 13349

------=_Part_1521971_1064357986.1783981831637
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

There appears to be a regression from 2.5.20: a decryption filename is pass=
ed when decrypting a file, which doesn't seem to preserve the file mode und=
er some circumstances. The particular circumstance is that I call the decry=
ption twice on the same input. The first time, I provide the entire input t=
o be decrypted, and get a satisfactory response from gpg. The second call, =
to test a failure condition, makes the same call again, but doesn't provide=
 the input data. In this case gpg returns an exit code of 2 (expected) but =
resets the file mode of the output file to 0100644, where it had originally=
 been set to 0100700. Under 2.5.20, the mode of the file wasn't changed. So=
 the behaviour has changed between 2.5.20 and 2.5.21: is there a good reaso=
n for this regression, or should an issue be raised? In case it is helpful,=
 I show below some relevant messages from gpg and the test harness for both=
 cases.
Kind regards,
Vinay Sajip
Results with 2.5.21:

# Issue --list-config to get version
gpg2 --status-fd 2 --no-tty --no-verbose --fixed-list-mode --batch --with-c=
olons --homedir /tmp/keys-o279dt6b --list-config --with-colons
# Chunk read from gpg:
b'cfg:version:2.5.21\ncfg:pubkey:1;8;16;17;18;19;22\ncfg:pubkeyname:RSA;Kyb=
er;ELG;DSA;ECDH;ECDSA;EDDSA\ncfg:cipher:1;2;3;4;7;8;9;10;11;12;13\ncfg:ciph=
ername:IDEA;3DES;CAST5;BLOWFISH;AES;AES192;AES256;TWOFISH;CAMELLIA128;CAMEL=
LIA192;CAMELLIA256\ncfg:digest:2;3;8;9'
# Set mode of output file to 0100700
# Print mode and filename
Setting mode to 0o100700
Decrypting to: '/tmp/pygpg-test-gi5r5i66.dec'
# First decryption call, all data provided
gpg2 --pinentry-mode loopback --status-fd 2 --no-tty --no-verbose --fixed-l=
ist-mode --batch --with-colons --homedir /tmp/keys-o279dt6b --passphrase-fd=
 0 --debug-quick-random --decrypt --yes --output /tmp/pygpg-test-gi5r5i66.d=
ec
[GNUPG:] ENC_TO 5B4383C7F494798C 16 0
[GNUPG:] ENC_TO 855C4BBE6268DE68 16 0
[GNUPG:] KEY_CONSIDERED C374DE3046D96CDB36368AC34EA7B9009176963B 0
gpg: encrypted with elg2048 key, ID 855C4BBE6268DE68, created 2026-07-13
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "Barbara Brown (A test user (insecure!)) <ba=
[email protected]>"
[GNUPG:] KEY_CONSIDERED 2C671107DCCB8D91E3A1D7F42DFD6E3937922755 0
gpg: encrypted with elg2048 key, ID 5B4383C7F494798C, created 2026-07-13
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "Andrew Able (A test user (insecure!)) <andr=
[email protected]>"
[GNUPG:] KEY_CONSIDERED 2C671107DCCB8D91E3A1D7F42DFD6E3937922755 0
[GNUPG:] KEY_CONSIDERED C374DE3046D96CDB36368AC34EA7B9009176963B 0
[GNUPG:] KEY_CONSIDERED C374DE3046D96CDB36368AC34EA7B9009176963B 0
[GNUPG:] DECRYPTION_KEY 493F33691752246E2EB3CA24855C4BBE6268DE68 C374DE3046=
D96CDB36368AC34EA7B9009176963B u
[GNUPG:] NO_SECKEY 5B4383C7F494798C
[GNUPG:] BEGIN_DECRYPTION
[GNUPG:] DECRYPTION_INFO 0 9 2 0
[GNUPG:] PLAINTEXT 62 1783966624
[GNUPG:] PLAINTEXT_LENGTH 13
[GNUPG:] DECRYPTION_OKAY
[GNUPG:] GOODMDC
[GNUPG:] END_DECRYPTION
# Second decryption call, don't provide encrypted data (to test error condi=
tion)
gpg2 --pinentry-mode loopback --status-fd 2 --no-tty --no-verbose --fixed-l=
ist-mode --batch --with-colons --homedir /tmp/keys-o279dt6b --passphrase-fd=
 0 --debug-quick-random --decrypt --yes --output /tmp/pygpg-test-gi5r5i66.d=
ec
[GNUPG:] NODATA 2
[GNUPG:] FAILURE decrypt 4294967295
gpg: decrypt_message failed: Unknown system error
# Message from test harness
gpg returned a non-zero error code: 2
# Mode of decryption output changed!
Mode changed for /tmp/pygpg-test-gi5r5i66.dec: 0o100664 vs. 0o100700

Results with 2.5.20:

# Issue --list-config to get version
gpg2 --status-fd 2 --no-tty --no-verbose --fixed-list-mode --batch --with-c=
olons --homedir /tmp/keys-_cyzu8yh --list-config --with-colons
# Chunk read from gpg:
b'cfg:version:2.5.20\ncfg:pubkey:1;8;16;17;18;19;22\ncfg:pubkeyname:RSA;Kyb=
er;ELG;DSA;ECDH;ECDSA;EDDSA\ncfg:cipher:1;2;3;4;7;8;9;10;11;12;13\ncfg:ciph=
ername:IDEA;3DES;CAST5;BLOWFISH;AES;AES192;AES256;TWOFISH;CAMELLIA128;CAMEL=
LIA192;CAMELLIA256\ncfg:digest:2;3;8;9'
# Set mode of output file to 0100700
# Print mode and filename
Setting mode to 0o100700
Decrypting to: '/tmp/pygpg-test-k9qni_nf.dec'
# First decryption call, all data provided
gpg2 --pinentry-mode loopback --status-fd 2 --no-tty --no-verbose --fixed-l=
ist-mode --batch --with-colons --homedir /tmp/keys-_cyzu8yh --passphrase-fd=
 0 --debug-quick-random --decrypt --yes --output /tmp/pygpg-test-k9qni_nf.d=
ec
[GNUPG:] ENC_TO 7E265E8E78FAABE4 16 0
[GNUPG:] ENC_TO BC4907D9EA72A531 16 0
[GNUPG:] KEY_CONSIDERED 1B20FE90ADACD65EB49B83F92BA447C36E27A956 0
gpg: encrypted with elg2048 key, ID BC4907D9EA72A531, created 2026-07-13
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "Barbara Brown (A test user (insecure!)) <ba=
[email protected]>"
[GNUPG:] KEY_CONSIDERED 5B2F6F9C0E80D37C639FB4669941678A4D185900 0
gpg: encrypted with elg2048 key, ID 7E265E8E78FAABE4, created 2026-07-13
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 "Andrew Able (A test user (insecure!)) <andr=
[email protected]>"
[GNUPG:] KEY_CONSIDERED 5B2F6F9C0E80D37C639FB4669941678A4D185900 0
[GNUPG:] KEY_CONSIDERED 1B20FE90ADACD65EB49B83F92BA447C36E27A956 0
[GNUPG:] KEY_CONSIDERED 1B20FE90ADACD65EB49B83F92BA447C36E27A956 0
[GNUPG:] DECRYPTION_KEY FAA65753EE4B871BCC824B6ABC4907D9EA72A531 1B20FE90AD=
ACD65EB49B83F92BA447C36E27A956 u
[GNUPG:] NO_SECKEY 7E265E8E78FAABE4
[GNUPG:] BEGIN_DECRYPTION
[GNUPG:] DECRYPTION_INFO 0 9 2 0
[GNUPG:] PLAINTEXT 62 1783980806
[GNUPG:] PLAINTEXT_LENGTH 13
[GNUPG:] DECRYPTION_OKAY
[GNUPG:] GOODMDC
[GNUPG:] END_DECRYPTION
# Second decryption call, don't provide encrypted data (to test error condi=
tion)
gpg2 --pinentry-mode loopback --status-fd 2 --no-tty --no-verbose --fixed-l=
ist-mode --batch --with-colons --homedir /tmp/keys-_cyzu8yh --passphrase-fd=
 0 --debug-quick-random --decrypt --yes --output /tmp/pygpg-test-k9qni_nf.d=
ec
[GNUPG:] NODATA 2
[GNUPG:] FAILURE decrypt 4294967295
# Message from test harness
gpg: decrypt_message failed: Unknown system error
# Message from test harness
gpg returned a non-zero error code: 2
# No more output, as mode didn't change.




------=_Part_1521971_1064357986.1783981831637
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<html><head></head><body><div class=3D"yahoo-style-wrap" style=3D"font-fami=
ly:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div>There=
 appears to be a regression from 2.5.20: a decryption filename is passed wh=
en decrypting a file, which doesn't seem to preserve the file mode under so=
me circumstances. The particular circumstance is that I call the decryption=
 twice on the same input. The first time, I provide the entire input to be =
decrypted, and get a satisfactory response from gpg. The second call, to te=
st a failure condition, makes the same call again, but doesn't provide the =
input data. In this case gpg returns an exit code of 2 (expected) but reset=
s the file mode of the output file to 0100644, where it had originally been=
 set to 0100700. Under 2.5.20, the mode of the file wasn't changed. So the =
behaviour has changed between 2.5.20 and 2.5.21: is there a good reason for=
 this regression, or should an issue be raised? In case it is helpful, I sh=
ow below some relevant messages from gpg and the test harness for both case=
s.</div><div><br></div><div dir=3D"ltr" data-setdir=3D"false">Kind regards,=
</div><div dir=3D"ltr" data-setdir=3D"false"><br></div><div dir=3D"ltr" dat=
a-setdir=3D"false">Vinay Sajip</div><div><br></div><div>Results with 2.5.21=
:<br><br><font face=3D"&quot;lucida console&quot;, sans-serif"># Issue --li=
st-config to get version<br>gpg2 --status-fd 2 --no-tty --no-verbose --fixe=
d-list-mode --batch --with-colons --homedir /tmp/keys-o279dt6b --list-confi=
g --with-colons<br># Chunk read from gpg:<br>b'cfg:version:2.5.21\ncfg:pubk=
ey:1;8;16;17;18;19;22\ncfg:pubkeyname:RSA;Kyber;ELG;DSA;ECDH;ECDSA;EDDSA\nc=
fg:cipher:1;2;3;4;7;8;9;10;11;12;13\ncfg:ciphername:IDEA;3DES;CAST5;BLOWFIS=
H;AES;AES192;AES256;TWOFISH;CAMELLIA128;CAMELLIA192;CAMELLIA256\ncfg:digest=
:2;3;8;9'<br># Set mode of output file to 0100700<br># Print mode and filen=
ame<br>Setting mode to 0o100700<br>Decrypting to: '/tmp/pygpg-test-gi5r5i66=
.dec'<br># First decryption call, all data provided<br>gpg2 --pinentry-mode=
 loopback --status-fd 2 --no-tty --no-verbose --fixed-list-mode --batch --w=
ith-colons --homedir /tmp/keys-o279dt6b --passphrase-fd 0 --debug-quick-ran=
dom --decrypt --yes --output /tmp/pygpg-test-gi5r5i66.dec<br>[GNUPG:] ENC_T=
O 5B4383C7F494798C 16 0<br>[GNUPG:] ENC_TO 855C4BBE6268DE68 16 0<br>[GNUPG:=
] KEY_CONSIDERED C374DE3046D96CDB36368AC34EA7B9009176963B 0<br>gpg: encrypt=
ed with elg2048 key, ID 855C4BBE6268DE68, created 2026-07-13<br>&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp; "Barbara Brown (A test user (insecure!)) &lt;barbara.br=
[email protected]&gt;"<br>[GNUPG:] KEY_CONSIDERED 2C671107DCCB8D91E3A1D7F42DFD6E=
3937922755 0<br>gpg: encrypted with elg2048 key, ID 5B4383C7F494798C, creat=
ed 2026-07-13<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; "Andrew Able (A test user (=
insecure!)) &lt;[email protected]&gt;"<br>[GNUPG:] KEY_CONSIDERED 2C671=
107DCCB8D91E3A1D7F42DFD6E3937922755 0<br>[GNUPG:] KEY_CONSIDERED C374DE3046=
D96CDB36368AC34EA7B9009176963B 0<br>[GNUPG:] KEY_CONSIDERED C374DE3046D96CD=
B36368AC34EA7B9009176963B 0<br>[GNUPG:] DECRYPTION_KEY 493F33691752246E2EB3=
CA24855C4BBE6268DE68 C374DE3046D96CDB36368AC34EA7B9009176963B u<br>[GNUPG:]=
 NO_SECKEY 5B4383C7F494798C<br>[GNUPG:] BEGIN_DECRYPTION<br>[GNUPG:] DECRYP=
TION_INFO 0 9 2 0<br>[GNUPG:] PLAINTEXT 62 1783966624<br>[GNUPG:] PLAINTEXT=
_LENGTH 13<br>[GNUPG:] DECRYPTION_OKAY<br>[GNUPG:] GOODMDC<br>[GNUPG:] END_=
DECRYPTION<br># Second decryption call, don't provide encrypted data (to te=
st error condition)<br>gpg2 --pinentry-mode loopback --status-fd 2 --no-tty=
 --no-verbose --fixed-list-mode --batch --with-colons --homedir /tmp/keys-o=
279dt6b --passphrase-fd 0 --debug-quick-random --decrypt --yes --output /tm=
p/pygpg-test-gi5r5i66.dec<br>[GNUPG:] NODATA 2<br>[GNUPG:] FAILURE decrypt =
4294967295<br>gpg: decrypt_message failed: Unknown system error<br># Messag=
e from test harness<br>gpg returned a non-zero error code: 2<br># Mode of d=
ecryption output changed!<br>Mode changed for /tmp/pygpg-test-gi5r5i66.dec:=
 0o100664 vs. 0o100700<br></font><br>Results with 2.5.20:<br><br><font face=
=3D"&quot;lucida console&quot;, sans-serif"># Issue --list-config to get ve=
rsion<br>gpg2 --status-fd 2 --no-tty --no-verbose --fixed-list-mode --batch=
 --with-colons --homedir /tmp/keys-_cyzu8yh --list-config --with-colons<br>=
# Chunk read from gpg:<br>b'cfg:version:2.5.20\ncfg:pubkey:1;8;16;17;18;19;=
22\ncfg:pubkeyname:RSA;Kyber;ELG;DSA;ECDH;ECDSA;EDDSA\ncfg:cipher:1;2;3;4;7=
;8;9;10;11;12;13\ncfg:ciphername:IDEA;3DES;CAST5;BLOWFISH;AES;AES192;AES256=
;TWOFISH;CAMELLIA128;CAMELLIA192;CAMELLIA256\ncfg:digest:2;3;8;9'<br># Set =
mode of output file to 0100700<br># Print mode and filename<br>Setting mode=
 to 0o100700<br>Decrypting to: '/tmp/pygpg-test-k9qni_nf.dec'<br># First de=
cryption call, all data provided<br>gpg2 --pinentry-mode loopback --status-=
fd 2 --no-tty --no-verbose --fixed-list-mode --batch --with-colons --homedi=
r /tmp/keys-_cyzu8yh --passphrase-fd 0 --debug-quick-random --decrypt --yes=
 --output /tmp/pygpg-test-k9qni_nf.dec<br>[GNUPG:] ENC_TO 7E265E8E78FAABE4 =
16 0<br>[GNUPG:] ENC_TO BC4907D9EA72A531 16 0<br>[GNUPG:] KEY_CONSIDERED 1B=
20FE90ADACD65EB49B83F92BA447C36E27A956 0<br>gpg: encrypted with elg2048 key=
, ID BC4907D9EA72A531, created 2026-07-13<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
 "Barbara Brown (A test user (insecure!)) &lt;[email protected]&gt;"<b=
r>[GNUPG:] KEY_CONSIDERED 5B2F6F9C0E80D37C639FB4669941678A4D185900 0<br>gpg=
: encrypted with elg2048 key, ID 7E265E8E78FAABE4, created 2026-07-13<br>&n=
bsp;&nbsp;&nbsp;&nbsp;&nbsp; "Andrew Able (A test user (insecure!)) &lt;and=
[email protected]&gt;"<br>[GNUPG:] KEY_CONSIDERED 5B2F6F9C0E80D37C639FB466=
9941678A4D185900 0<br>[GNUPG:] KEY_CONSIDERED 1B20FE90ADACD65EB49B83F92BA44=
7C36E27A956 0<br>[GNUPG:] KEY_CONSIDERED 1B20FE90ADACD65EB49B83F92BA447C36E=
27A956 0<br>[GNUPG:] DECRYPTION_KEY FAA65753EE4B871BCC824B6ABC4907D9EA72A53=
1 1B20FE90ADACD65EB49B83F92BA447C36E27A956 u<br>[GNUPG:] NO_SECKEY 7E265E8E=
78FAABE4<br>[GNUPG:] BEGIN_DECRYPTION<br>[GNUPG:] DECRYPTION_INFO 0 9 2 0<b=
r>[GNUPG:] PLAINTEXT 62 1783980806<br>[GNUPG:] PLAINTEXT_LENGTH 13<br>[GNUP=
G:] DECRYPTION_OKAY<br>[GNUPG:] GOODMDC<br>[GNUPG:] END_DECRYPTION<br># Sec=
ond decryption call, don't provide encrypted data (to test error condition)=
<br>gpg2 --pinentry-mode loopback --status-fd 2 --no-tty --no-verbose --fix=
ed-list-mode --batch --with-colons --homedir /tmp/keys-_cyzu8yh --passphras=
e-fd 0 --debug-quick-random --decrypt --yes --output /tmp/pygpg-test-k9qni_=
nf.dec<br>[GNUPG:] NODATA 2<br>[GNUPG:] FAILURE decrypt 4294967295<br># Mes=
sage from test harness<br>gpg: decrypt_message failed: Unknown system error=
<br># Message from test harness<br>gpg returned a non-zero error code: 2<br=
># No more output, as mode didn't change.</font><br><br><br><br></div></div=
></body></html>
------=_Part_1521971_1064357986.1783981831637--


--===============0322071120450386801==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Gnupg-devel mailing list
[email protected]
https://lists.gnupg.org/mailman/listinfo/gnupg-devel

--===============0322071120450386801==--