gnupg2 (2.2.19-3ubuntu2.5) focal-security; urgency=medium

  * debian/patches/fix-key-validity-regression-due-to-CVE-2025-
    30258.patch:
    - Fix a key validity regression following patches for CVE-2025-30258,
      causing trusted "certify-only" primary keys to be ignored when checking
      signature on user IDs and computing key validity. This regression makes
      imported keys signed by a trusted "certify-only" key have an unknown
      validity (LP: #2114775).

 -- dcpi <dcpi@u22vm>  Thu, 26 Jun 2025 16:57:26 +0000

gnupg2 (2.2.19-3ubuntu2.4) focal-security; urgency=medium

  * SECURITY UPDATE: verification DoS via crafted subkey data
    - debian/patches/CVE-2025-30258-1.patch: lookup key for merging/
      inserting only by primary key in g10/getkey.c, g10/import.c,
      g10/keydb.h.
    - debian/patches/CVE-2025-30258-2.patch: remove a signature check
      function wrapper in g10/mainproc.c, g10/packet.h, g10/sig-check.c.
    - debian/patches/CVE-2025-30258-3.patch: fix a verification DoS due to
      a malicious subkey in the keyring in g10/getkey.c, g10/keydb.h,
      g10/mainproc.c, g10/packet.h, g10/sig-check.c, g10/pkclist.c.
    - debian/patches/CVE-2025-30258-4.patch: fix regression for the recent
      malicious subkey DoS fix in g10/getkey.c, g10/packet.h.
    - debian/patches/CVE-2025-30258-5.patch: fix double free of internal
      data in g10/sig-check.c.
    - CVE-2025-30258

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Sat, 29 Mar 2025 12:35:54 -0400

gnupg2 (2.2.19-3ubuntu2.2) focal-security; urgency=medium

  * SECURITY UPDATE: signature forgery via injection into the status line
    - debian/patches/CVE-2022-34903.patch: Fix garbled status messages in
      NOTATION_DATA in g10/cpr.c.
    - CVE-2022-34903

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 04 Jul 2022 12:20:36 -0400

gnupg2 (2.2.19-3ubuntu2.1) focal; urgency=medium

  * d/p/dirmngr-handle-EAFNOSUPPORT-at-connect_server.patch:
    - Fix IPv6 connectivity for dirmngr (LP: #1910432)

 -- Heitor Alves de Siqueira <halves@canonical.com>  Wed, 06 Jan 2021 18:10:35 +0000

gnupg2 (2.2.19-3ubuntu2) focal; urgency=medium

  * Don't declare diffutils as a test dependency, this package is essential
    so always installed; and the dependency declaration breaks
    cross-arch testing.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 10 Mar 2020 11:50:46 -0700

gnupg2 (2.2.19-3ubuntu1) focal; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - Drop the gpgv-win32 test
    - Honor http_proxy= environment variables by default in the systemd
      user session dirmngr service.
      (debian/patches/dirmngr-honor-http-proxy.patch)
    - Export GPG_AGENT_INFO in the systemd-environment-generator too.

 -- Gianfranco Costamagna <locutusofborg@debian.org>  Tue, 10 Mar 2020 10:59:47 +0100

gnupg2 (2.2.19-3) unstable; urgency=medium

  * d/copyright update years
  * Avoid errors in systemd environment generator (Closes: #950836)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Mon, 09 Mar 2020 14:27:42 -0400

gnupg2 (2.2.19-2) unstable; urgency=medium

  * clarify that keys.openpgp.org is a debian-specific
    choice for default keyserver
  * Standards-version: bump to 4.5.0 (no changes needed)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Thu, 27 Feb 2020 17:35:36 -0500

gnupg2 (2.2.19-1) unstable; urgency=medium

  * New upstream release

  [ Roger Shimizu ]
  * d/control: Update Build-Depends: libgpg-error-dev (>= 1.35)

  [ Daniel Kahn Gillmor ]
  * clean up unnecessary whitespace
  * Ship identifiers for Librem Key (Closes: #932474)
  * drop extra systemd user service links (Closes: #931954)
  * update signing key for Werner
  * fixup patch
  * drop patches already upstream
  * refresh patches
  * cherry-pick fix from upstream
  * dirmngr-idling: add some commentary about dns housekeeping
  * bump standards-version to 4.4.1 (no changes needed)
  * sort scdaemon metainfo.xml modalias
  * announce librem key in scdaemon metainfo.xml
  * add lintian overrides for executables shipped by upstream in /usr/lib/gnupg/

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Wed, 08 Jan 2020 10:33:12 -0500

gnupg2 (2.2.17-3ubuntu1) focal; urgency=low

  * Merge from Debian unstable.  Remaining changes:
    - Drop the gpgv-win32 test
    - Honor http_proxy= environment variables by default in the systemd
      user session dirmngr service.
      (debian/patches/dirmngr-honor-http-proxy.patch)
    - Export GPG_AGENT_INFO in the systemd-environment-generator too.

 -- Dimitri John Ledkov <xnox@ubuntu.com>  Wed, 20 Nov 2019 16:26:23 +0000

# For older changelog entries, run 'apt-get changelog gpgv-static'
