Noteworthy changes in version 2.2.27 (2021-01-11)
-------------------------------------------------

 * gpg: Fix regression in 2.2.24 for gnupg_remove function under
   Windows.  [#5230]

 * gpgconf: Fix case with neither local nor global gpg.conf.  [9f37d3e6f3]

 * gpgconf: Fix description of two new options.  [#5221]

 * Build Windows installer without timestamps.  Note that the
   Authenticode signatures still carry a timestamp.

  Release-info: https://dev.gnupg.org/T5234
  See-also: gnupg-announce/2021q1/000452.html


Noteworthy changes in version 2.2.26 (2020-12-21)
-------------------------------------------------

  * gpg: New AKL method "ntds".  [559efd23e9]

  * gpg: Fix --trusted-key with fingerprint arg.  [8a2e5025eb]

  * scd: Fix writing of ECC keys to an OpenPGP card.  [#5163]

  * scd: Make an USB error fix specific to SPR532 readers.  [#5167]

  * dirmngr: With new LDAP keyservers store the new attributes.  Never
    store the useless pgpSignerID.  Fix a long standing bug storing
    some keys on an ldap server.  [0e88c73bc9,e47de85382]

  * dirmngr: Support the new Active Direcory LDAP schema for
    keyservers.  [ac8ece9266]

  * dirmngr: Allow LDAP OpenPGP searches via fingerprint.
    [c75fd75532]

  * dirmngr: Do not block other threads during keyserver LDAP calls.
    [15bfd189c0]

  * Support global configuration files.  [#4788,a028f24136]

  * Fix the iconv fallback handling to UTF-8.  [#5038]

  Release-info: https://dev.gnupg.org/T5153
  See-also: gnupg-announce/2020q4/000451.html


Noteworthy changes in version 2.2.25 (2020-11-23)
-------------------------------------------------

  * scd: Fix regression in 2.2.24 requiring gpg --card-status before
    signing or decrypting.  [#5065]

  * gpgsm: Using Libksba 1.5.0 signatures with a rarely used
    combination of attributes can now be verified.  [#5146]

  Release-info: https://dev.gnupg.org/T5140
  See-also: gnupg-announce/2020q4/000450.html


Noteworthy changes in version 2.2.24 (2020-11-17)
-------------------------------------------------

  * Allow Unicode file names on Windows almost everywhere.  Note that
    it is still not possible to use Unicode strings on the command
    line.  This change also fixes a regression in 2.2.22 related to
    non-ascii file names.  [#5098]

  * Fix localized time printing on Windows.  [#5073]

  * gpg: New command --quick-revoke-sig.  [#5093]

  * gpg: Do not use weak digest algos if selected by recipient
    preference during sign+encrypt.  [4c181d51a6]

  * gpg: Switch to AES256 for symmetric encryption in de-vs mode.
    [166e779634]

  * gpg: Silence weak digest warnings with --quiet.  [#4893]

  * gpg: Print new status line CANCELED_BY_USER for a cancel during
    symmetric encryption.  [f05d1772c4]

  * gpg: Fix the encrypt+sign hash algo preference selection for
    ECDSA.  This is in particular needed for keys created from
    existing smartcard based keys.  [aeed0b93ff]

  * agent: Fix secret key import of GnuPG 2.3 generated Ed25519 keys.
    [#5114]

  * agent: Keep some permissions of private-keys-v1.d.  [#2312]

  * dirmngr: Align sks-keyservers.netCA.pem use between ntbtls and
    gnutls builds.  [e4f3b74c91]

  * dirmngr: Fix the pool keyserver case for a single host in the
    pool.  [72e04b03b1a7]

  * scd: Fix the use case of verify_chv2 by CHECKPIN.  [61aea64b3c]

  * scd: Various improvements to the ccid-driver.  [#4616,#5065]

  * scd: Minor fixes for Yubikey [25bec16d0b]

  * gpgconf: New option --show-versions.

  * w32: Install gpg-check-pattern and example profiles.  Install
    Windows subsystem variant of gpgconf (gpgconf-w32).

  * i18n: Complete overhaul and completion of the Italian translation.
    Thanks to Denis Renzi.

  * Require Libgcrypt 1.8 because 1.7 has long reached end-of-life.

  Release-info: https://dev.gnupg.org/T5052
  See-also: gnupg-announce/2020q4/000449.html


Noteworthy changes in version 2.2.23 (2020-09-03)
-------------------------------------------------

  * gpg: Fix AEAD preference list overflow.  [#5050]

  * gpg: Fix a possible segv in the key cleaning code.

  * gpgsm: Fix a minor RFC2253 parser bug.  [#5037]

  * scdaemon: Fix a PIN verify failure on certain OpenPGP card
    implementations.  Regression in 2.2.22.  [#5039]

  * po: Fix bug in the Hungarian translation.  Updates for the Czech,
    Polish, and Ukrainian translations.

  Release-info: https://dev.gnupg.org/T5045
  See-also: gnupg-announce/2020q3/000448.html


Noteworthy changes in version 2.2.22 (2020-08-27)
-------------------------------------------------

  * gpg: Change the default key algorithm to rsa3072.

  * gpg: Add regular expression support for Trust Signatures on all
    platforms.  [#4843]

  * gpg: Fix regression in 2.2.21 with non-default --passphrase-repeat
    option.  [#4991]

  * gpg: Ignore --personal-digest-prefs for ECDSA keys.  [#5021]

  * gpgsm: Make rsaPSS a de-vs compliant scheme.

  * gpgsm: Show also the SHA256 fingerprint in key listings.

  * gpgsm: Do not require a default keyring for --gpgconf-list.  [#4867]

  * gpg-agent: Default to extended key format and record the creation
    time of keys.  Add new option --disable-extended-key-format.

  * gpg-agent: Support the WAYLAND_DISPLAY envvar.  [#5016]

  * gpg-agent: Allow using --gpgconf-list even if HOME does not
    exist.  [#4866]

  * gpg-agent: Make the Pinentry work even if the envvar TERM is set
    to the empty string.  [#4137]

  * scdaemon: Add a workaround for Gnuk tokens <= 2.15 which wrongly
    incremented the error counter when using the "verify" command of
    "gpg --edit-key" with only the signature key being present.

  * dirmngr: Better handle systems with disabled IPv6.  [#4977]

  * gpgpslit: Install tool.  It was not installed in the past to avoid
    conflicts with the version installed by GnuPG 1.4.  [#5023]

  * gpgtar: Handle Unicode file names on Windows correctly (requires
    libgpg-error 1.39).  [#4083]

  * gpgtar: Make --files-from and --null work as documented.  [#5027]

  * Build the Windows installer with the new Ntbtls 0.2.0 so that TLS
    connections succeed for servers demanding GCM.

  Release-info: https://dev.gnupg.org/T5030
  See-also: gnupg-announce/2020q3/000447.html


Noteworthy changes in version 2.2.21 (2020-07-09)
-------------------------------------------------

  * gpg: Improve symmetric decryption speed by about 25%.
    See commit 144b95cc9d.

  * gpg: Support decryption of AEAD encrypted data packets.

  * gpg: Add option --no-include-key-block. [#4856]

  * gpg: Allow for extra padding in ECDH.  [#4908]

  * gpg: Only a single pinentry is shown for symmetric encryption if
    the pinentry supports this.  [#4971]

  * gpg: Print a note if no keys are given to --delete-key.  [#4959]

  * gpg,gpgsm: The ridiculous passphrase quality bar is not anymore
    shown.  [#2103]

  * gpgsm: Certificates without a CRL distribution point are now
    considered valid without looking up a CRL.  The new option
    --enable-issuer-based-crl-check can be used to revert to the
    former behaviour.

  * gpgsm: Support rsaPSS signature verification.  [#4538]

  * gpgsm: Unless CRL checking is disabled lookup a missing issuer
    certificate using the certificate's authorityInfoAccess.  [#4898]

  * gpgsm: Print the certificate's serial number also in decimal
    notation.

  * gpgsm: Fix possible NULL-deref in messages of --gen-key.  [#4895]

  * scd: Support the CardOS 5 based D-Trust Card 3.1.

  * dirmngr: Allow http URLs with "LOOKUP --url".

  * wkd: Take name of sendmail from configure.  Fixes an OpenBSD
    specific bug.  [#4886]

  Release-info: https://dev.gnupg.org/T4897
  See-also: gnupg-announce/2020q3/000446.html


Noteworthy changes in version 2.2.20 (2020-03-20)
-------------------------------------------------

  * Protect the error counter against overflow to guarantee that the
    tools can't be tricked into returning success after an error.

  * gpg: Make really sure that --verify-files always returns an error.

  * gpg: Fix key listing --with-secret if a pattern is given.  [#4061]

  * gpg: Fix detection of certain keys used as default-key.  [#4810]

  * gpg: Fix default-key selection when a card is available.  [#4850]

  * gpg: Fix key expiration and key usage for keys created with a
    creation date of zero.  [4670]

  * gpgsm: Fix import of some CR,LF terminated certificates.  [#4847]

  * gpg: New options --include-key-block and --auto-key-import to
    allow encrypted replies after an initial signed message.  [#4856]

  * gpg: Allow the use of a fingerprint with --trusted-key. [#4855]

  * gpg: New property "fpr" for use by --export-filter.

  * scdaemon: Disable the pinpad if a KDF DO is used.  [#4832]

  * dirmngr: Improve finding OCSP certificates.  [#4536]

  * Avoid build problems with LTO or gcc-10. [#4831]

  Release-info: https://dev.gnupg.org/T4860
  See-also: gnupg-announce/2020q1/000444.html


Noteworthy changes in version 2.2.19 (2019-12-07)
-------------------------------------------------

  * gpg: Fix double free when decrypting for hidden recipients.
    Regression in 2.2.18.  [#4762].

  * gpg: Use auto-key-locate for encryption even for mail addressed
    given with angle brackets.  [#4726]

  * gpgsm: Add special case for certain expired intermediate
    certificates.  [#4696]

  Release-info: https://dev.gnupg.org/T4768
  See-also: gnupg-announce/2019q4/000443.html


Noteworthy changes in version 2.2.18 (2019-11-25)
-------------------------------------------------

  * gpg: Changed the way keys are detected on a smartcards; this
    allows the use of non-OpenPGP cards.  In the case of a not very
    likely regression the new option --use-only-openpgp-card is
    available.  [#4681]

  * gpg: The commands --full-gen-key and --quick-gen-key now allow
    direct key generation from supported cards.  [#4681]

  * gpg: Prepare against chosen-prefix SHA-1 collisions in key
    signatures.  This change removes all SHA-1 based key signature
    newer than 2019-01-19 from the web-of-trust.  Note that this
    includes all key signature created with dsa1024 keys.  The new
    option --allow-weak-key-signatues can be used to override the new
    and safer behaviour.  [#4755,CVE-2019-14855]

  * gpg: Improve performance for import of large keyblocks.  [#4592]

  * gpg: Implement a keybox compression run.  [#4644]

  * gpg: Show warnings from dirmngr about redirect and certificate
    problems (details require --verbose as usual).

  * gpg: Allow to pass the empty string for the passphrase if the
    '--passphase=' syntax is used.  [#4633]

  * gpg: Fix printing of the KDF object attributes.

  * gpg: Avoid surprises with --locate-external-key and certain
    --auto-key-locate settings.  [#4662]

  * gpg: Improve selection of best matching key.  [#4713]

  * gpg: Delete key binding signature when deleting a subkey.
    [#4665,#4457]

  * gpg: Fix a potential loss of key signatures during import with
    self-sigs-only active.  [#4628]

  * gpg: Silence "marked as ultimately trusted" diagnostics if
    option --quiet is used.  [#4634]

  * gpg: Silence some diagnostics during in key listsing even with
    option --verbose.  [#4627]

  * gpg, gpgsm: Change parsing of agent's pkdecrypt results.  [#4652]

  * gpgsm: Support AES-256 keys.

  * gpgsm: Fix a bug in triggering a keybox compression run if
    --faked-system-time is used.

  * dirmngr: System CA certificates are no longer used for the SKS
    pool if GNUTLS instead of NTBTLS is used as TLS library.  [#4594]

  * dirmngr: On Windows detect usability of IPv4 and IPv6 interfaces
    to avoid long timeouts.  [#4165]

  * scd: Fix BWI value for APDU level transfers to make Gemalto Ezio
    Shield and Trustica Cryptoucan work.  [#4654,#4566]

  * wkd: gpg-wks-client --install-key now installs the required policy
    file.

  Release-info: https://dev.gnupg.org/T4684
  See-also: gnupg-announce/2019q4/000442.html


Noteworthy changes in version 2.2.17 (2019-07-09)
-------------------------------------------------

  * gpg: Ignore all key-signatures received from keyservers.  This
    change is required to mitigate a DoS due to keys flooded with
    faked key-signatures.  The old behaviour can be achieved by adding
      keyserver-options no-self-sigs-only,no-import-clean
    to your gpg.conf.  [#4607]

  * gpg: If an imported keyblocks is too large to be stored in the
    keybox (pubring.kbx) do not error out but fallback to an import
    using the options "self-sigs-only,import-clean".  [#4591]

  * gpg: New command --locate-external-key which can be used to
    refresh keys from the Web Key Directory or via other methods
    configured with --auto-key-locate.

  * gpg: New import option "self-sigs-only".

  * gpg: In --auto-key-retrieve prefer WKD over keyservers.  [#4595]

  * dirmngr: Support the "openpgpkey" subdomain feature from
    draft-koch-openpgp-webkey-service-07. [#4590].

  * dirmngr: Add an exception for the "openpgpkey" subdomain to the
    CSRF protection.  [#4603]

  * dirmngr: Fix endless loop due to http errors 503 and 504.  [#4600]

  * dirmngr: Fix TLS bug during redirection of HKP requests.  [#4566]

  * gpgconf: Fix a race condition when killing components.  [#4577]

  Release-info: https://dev.gnupg.org/T4606
  See-also: gnupg-announce/2019q3/000439.html


Noteworthy changes in version 2.2.16 (2019-05-28)
-------------------------------------------------

  * gpg,gpgsm: Fix deadlock on Windows due to a keybox sharing
    violation.  [#4505]

  * gpg: Allow deletion of subkeys with --delete-key.  This finally
    makes the bang-suffix work as expected for that command.  [#4457]

  * gpg: Replace SHA-1 by SHA-256 in self-signatures when updating
    them with --quick-set-expire or --quick-set-primary-uid. [#4508]

  * gpg: Improve the photo image viewer selection.  [#4334]

  * gpg: Fix decryption with --use-embedded-filename.  [#4500]

  * gpg: Remove hints on using the --keyserver option.  [#4512]

  * gpg: Fix export of certain secret keys with comments.  [#4490]

  * gpg: Reject too long user-ids in --quick-gen-key.  [#4532]

  * gpg: Fix a double free in the best key selection code.  [#4462]

  * gpg: Fix the key generation dialog for switching back from EdDSA
    to ECDSA.

  * gpg: Use AES-192 with SHA-384 to comply with RFC-6637.

  * gpg: Use only the addrspec from the Signer's UID subpacket to
    mitigate a problem with another implementation.

  * gpg: Skip invalid packets during a keyring listing and sync
    diagnostics with the output.

  * gpgsm: Avoid confusing diagnostic when signing with the default
    key.  [#4535]

  * agent: Do not delete any secret key in --dry-run mode.

  * agent: Fix failures on 64 bit big-endian boxes related to URIs in
    a keyfile.  [#4501]

  * agent: Stop scdaemon after a reload with disable-scdaemon newly
    configured.  [#4326]

  * dirmngr: Improve caching algorithm for WKD domains.

  * dirmngr: Support other hash algorithms than SHA-1 for OCSP.  [#3966]

  * gpgconf: Make --homedir work for --launch.  [#4496]

  * gpgconf: Before --launch check for a valid config file.  [#4497]

  * wkd: Do not import more than 5 keys from one WKD address.

  * wkd: Accept keys which are stored in armored format in the
    directory.

  * The installer for Windows now comes with signed binaries.

  Release-info: https://dev.gnupg.org/T4509
  See-also: gnupg-announce/2019q2/000438.html


Noteworthy changes in version 2.2.15 (2019-03-26)
-------------------------------------------------

  * sm: Fix --logger-fd and --status-fd on Windows for non-standard
    file descriptors.

  * sm: Allow decryption even if expired keys are configured.  [#4431]

  * agent: Change command KEYINFO to print ssh fingerprints with other
    hash algos.

  * dirmngr: Fix build problems on Solaris due to the use of reserved
    symbol names.  [#4420]

  * wkd: New commands --print-wkd-hash and --print-wkd-url for
    gpg-wks-client.

  Release-info: https://dev.gnupg.org/T4434
  See-also: gnupg-announce/2019q1/000436.html


Noteworthy changes in version 2.2.14 (2019-03-19)
-------------------------------------------------

  * gpg: Allow import of PGP desktop exported secret keys.  Also avoid
   importing secret keys if the secret keyblock is not valid.  [#4392]

  * gpg: Do not error out on version 5 keys in the local keyring.

  * gpg: Make invalid primary key algo obvious in key listings.

  * sm: Do not mark a certificate in a key listing as de-vs compliant
    if its use for a signature will not be possible.

  * sm: Fix certificate creation with key on card.

  * sm: Create rsa3072 bit certificates by default.

  * sm: Print Yubikey attestation extensions with --dump-cert.

  * agent: Fix cancellation handling for scdaemon.

  * agent: Support --mode=ssh option for CLEAR_PASSPHRASE.  [#4340]

  * scd: Fix flushing of the CA-FPR DOs in app-openpgp.

  * scd: Avoid a conflict error with the "undefined" app.

  * dirmngr: Add CSRF protection exception for protonmail.

  * dirmngr: Fix build problems with gcc 9 in libdns.

  * gpgconf: New option --show-socket for use with --launch.

  * gpgtar: Make option -C work for archive creation.

  Release-info: https://dev.gnupg.org/T4412
  See-also: gnupg-announce/2019q1/000435.html


Noteworthy changes in version 2.2.13 (2019-02-12)
-------------------------------------------------

  * gpg: Implement key lookup via keygrip (using the & prefix).

  * gpg: Allow generating Ed25519 key from existing key.

  * gpg: Emit an ERROR status line if no key was found with -k.

  * gpg: Stop early when trying to create a primary Elgamal key.  [#4329]

  * gpgsm: Print the card's key algorithms along with their keygrips
    in interactive key generation.

  * agent: Clear bogus pinentry cache in the error case.  [#4348]

  * scd: Support "acknowledge button" feature.

  * scd: Fix for USB INTERRUPT transfer.  [#4308]

  * wks: Do no use compression for the the encrypted challenge and
    response.

  Release-info: https://dev.gnupg.org/T4290
  See-also: gnupg-announce/2019q1/000434.html


Noteworthy changes in version 2.2.12 (2018-12-14)
-------------------------------------------------

  * tools: New commands --install-key and --remove-key for
    gpg-wks-client.  This allows to prepare a Web Key Directory on a
    local file system for later upload to a web server.

  * gpg: New --list-option "show-only-fpr-mbox".  This makes the use
    of the new gpg-wks-client --install-key command easier on Windows.

  * gpg: Improve processing speed when --skip-verify is used.

  * gpg: Fix a bug where a LF was accidentally written to the console.

  * gpg: --card-status now shows whether a card has the new KDF
    feature enabled.

  * agent: New runtime option --s2k-calibration=MSEC.  New configure
    option --with-agent-s2k-calibration=MSEC.  [#3399]

  * dirmngr: Try another keyserver from the pool on receiving a 502,
    503, or 504 error.  [#4175]

  * dirmngr: Avoid possible CSRF attacks via http redirects.  A HTTP
    query will not anymore follow a 3xx redirect unless the Location
    header gives the same host.  If the host is different only the
    host and port is taken from the Location header and the original
    path and query parts are kept.

  * dirmngr: New command FLUSHCRL to flush all CRLS from disk and
    memory.  [#3967]

  * New simplified Chinese translation (zh_CN).

  Release-info: https://dev.gnupg.org/T4289
  See-also: gnupg-announce/2018q4/000433.html


Noteworthy changes in version 2.2.11 (2018-11-06)
-------------------------------------------------

  * gpgsm: Fix CRL loading when intermediate certicates are not yet
    trusted.

  * gpgsm: Fix an error message about the digest algo.  [#4219]

  * gpg: Fix a wrong warning due to new sign usage check introduced
    with 2.2.9.  [#4014]

  * gpg: Print the "data source" even for an unsuccessful keyserver
    query.

  * gpg: Do not store the TOFU trust model in the trustdb.  This
    allows to enable or disable a TOFO model without triggering a
    trustdb rebuild.  [#4134]

  * scd: Fix cases of "Bad PIN" after using "forcesig".  [#4177]

  * agent: Fix possible hang in the ssh handler.  [#4221]

  * dirmngr: Tack the unmodified mail address to a WKD request.  See
    commit a2bd4a64e5b057f291a60a9499f881dd47745e2f for details.

  * dirmngr: Tweak diagnostic about missing LDAP server file.

  * dirmngr: In verbose mode print the OCSP responder id.

  * dirmngr: Fix parsing of the LDAP port.  [#4230]

  * wks: Add option --directory/-C to the server.  Always build the
    server on Unix systems.

  * wks: Add option --with-colons to the client.  Support sites which
    use the policy file instead of the submission-address file.

  * Fix EBADF when gpg et al. are called by broken CGI scripts.

  * Fix some minor memory leaks and bugs.

  Release-info: https://dev.gnupg.org/T4233
  See-also: gnupg-announce/2018q4/000432.html


Noteworthy changes in version 2.2.10 (2018-08-30)
-------------------------------------------------

  * gpg: Refresh expired keys originating from the WKD.  [#2917]

  * gpg: Use a 256 KiB limit for a WKD imported key.

  * gpg: New option --known-notation.  [#4060]

  * scd: Add support for the Trustica Cryptoucan reader.

  * agent: Speed up starting during on-demand launching.  [#3490]

  * dirmngr: Validate SRV records in WKD queries.

  Release-info: https://dev.gnupg.org/T4112
  See-also: gnupg-announce/2018q3/000428.html


Noteworthy changes in version 2.2.9 (2018-07-12)
------------------------------------------------

  * dirmngr: Fix recursive resolver mode and other bugs in the libdns
    code.  [#3374,#3803,#3610]

  * dirmngr: When using libgpg-error 1.32 or later a GnuPG build with
    NTBTLS support (e.g. the standard Windows installer) does not
    anymore block for dozens of seconds before returning data.

  * gpg: Fix bug in --show-keys which actually imported revocation
    certificates.  [#4017]

  * gpg: Ignore too long user-ID and comment packets.  [#4022]

  * gpg: Fix crash due to bad German translation.  Improved printf
    format compile time check.

  * gpg: Handle missing ISSUER sub packet gracefully in the presence of
    the new ISSUER_FPR.  [#4046]

  * gpg: Allow decryption using several passphrases in most cases.
    [#3795,#4050]

  * gpg: Command --show-keys now enables the list options
    show-unusable-uids, show-unusable-subkeys, show-notations and
    show-policy-urls by default.

  * gpg: Command --show-keys now prints revocation certificates. [#4018]

  * gpg: Add revocation reason to the "rev" and "rvs" records of the
    option --with-colons.  [#1173]

  * gpg: Export option export-clean does now remove certain expired
    subkeys; export-minimal removes all expired subkeys.  [#3622]

  * gpg: New "usage" property for the drop-subkey filters.  [#4019]

  Release-info: https://dev.gnupg.org/T4036
  See-also: gnupg-announce/2018q3/000427.html


Noteworthy changes in version 2.2.8 (2018-06-08)
------------------------------------------------

  * gpg: Decryption of messages not using the MDC mode will now lead
    to a hard failure even if a legacy cipher algorithm was used.  The
    option --ignore-mdc-error can be used to turn this failure into a
    warning.  Take care: Never use that option unconditionally or
    without a prior warning.

  * gpg: The MDC encryption mode is now always used regardless of the
    cipher algorithm or any preferences.  For testing --rfc2440 can be
    used to create a message without an MDC.

  * gpg: Sanitize the diagnostic output of the original file name in
    verbose mode.  [#4012,CVE-2018-12020]

  * gpg: Detect suspicious multiple plaintext packets in a more
    reliable way.  [#4000]

  * gpg: Fix the duplicate key signature detection code.  [#3994]

  * gpg: The options --no-mdc-warn, --force-mdc, --no-force-mdc,
    --disable-mdc and --no-disable-mdc have no more effect.

  * gpg: New command --show-keys.

  * agent: Add DBUS_SESSION_BUS_ADDRESS and a few other envvars to the
    list of startup environment variables.  [#3947]

  See-also: gnupg-announce/2018q2/000425.html


Noteworthy changes in version 2.2.7 (2018-05-02)
------------------------------------------------

  * gpg: New option --no-symkey-cache to disable the passphrase cache
    for symmetrical en- and decryption.

  * gpg: The ERRSIG status now prints the fingerprint if that is part
    of the signature.

  * gpg: Relax emitting of FAILURE status lines

  * gpg: Add a status flag to "sig" lines printed with --list-sigs.

  * gpg: Fix "Too many open files" when using --multifile.  [#3951]

  * ssh: Return an error for unknown ssh-agent flags.  [#3880]

  * dirmngr: Fix a regression since 2.1.16 which caused corrupted CRL
    caches under Windows.  [#2448,#3923]

  * dirmngr: Fix a CNAME problem with pools and TLS.  Also use a fixed
    mapping of keys.gnupg.net to sks-keyservers.net.  [#3755]

  * dirmngr: Try resurrecting dead hosts earlier (from 3 to 1.5 hours).

  * dirmngr: Fallback to CRL if no default OCSP responder is configured.

  * dirmngr: Implement CRL fetching via https.  Here a redirection to
    http is explictly allowed.

  * dirmngr: Make LDAP searching and CRL fetching work under Windows.
    This stopped working with 2.1.  [#3937]

  * agent,dirmngr: New sub-command "getenv" for "getinfo" to ease
    debugging.

  See-also: gnupg-announce/2018q2/000424.html


Noteworthy changes in version 2.2.6 (2018-04-09)
------------------------------------------------

  * gpg,gpgsm: New option --request-origin to pretend requests coming
    from a browser or a remote site.

  * gpg: Fix race condition on trustdb.gpg updates due to too early
    released lock.  [#3839]

  * gpg: Emit FAILURE status lines in almost all cases.  [#3872]

  * gpg: Implement --dry-run for --passwd to make checking a key's
    passphrase straightforward.

  * gpg: Make sure to only accept a certification capable key for key
    signatures.  [#3844]

  * gpg: Better user interaction in --card-edit for the factory-reset
    sub-command.

  * gpg: Improve changing key attributes in --card-edit by adding an
    explicit "key-attr" sub-command.  [#3781]

  * gpg: Print the keygrips in the --card-status.

  * gpg: Improve the OpenPGP card's factory-reset.  [7f765a98fd]

  * scd: Support KDF DO setup.  [#3823]

  * scd: Fix some issues with PC/SC on Windows.  [#3825]

  * scd: Fix suspend/resume handling in the CCID driver.

  * scd: Fix a race condition in the CCID driver leading to a segv for
    some readers.  [#5121]

  * agent: Evict cached passphrases also via a timer.  [#3829]

  * agent: Use separate passphrase caches depending on the request
    origin.  [#3858]

  * ssh: Support signature flags.  [#3880]

  * dirmngr: Handle failures related to missing IPv6 support
    gracefully.  [#3331]

  * Fix corner cases related to specified home directory with
    drive letter on Windows.  [#3720]

  * Allow the use of UNC directory names as homedir.  [#3818]

  See-also: gnupg-announce/2018q2/000421.html


Noteworthy changes in version 2.2.5 (2018-02-22)
------------------------------------------------

  * gpg: Allow the use of the "cv25519" and "ed25519" short names in
    addition to the canonical curve names in --batch --gen-key.

  * gpg: Make sure to print all secret keys with option --list-only
    and --decrypt.  [#3718]

  * gpg: Fix the use of future-default with --quick-add-key for
    signing keys.  [#3747]

  * gpg: Select a secret key by checking availability under gpg-agent.
    [#1967]

  * gpg: Fix reversed prompt texts for --only-sign-text-ids.  [#3787]

  * gpg,gpgsm: Fix detection of bogus keybox blobs on 32 bit systems.
    [#3770]

  * gpgsm: Fix regression since 2.1 in --export-secret-key-raw which
    got $d mod (q-1)$ wrong.  Note that most tools automatically fixup
    that parameter anyway.

  * ssh: Fix a regression in getting the client'd PID on *BSD and
    macOS.

  * scd: Support the KDF Data Object of the OpenPGP card 3.3.  [#3152]

  * scd: Fix a regression in the internal CCID driver for certain card
    readers.  [#3508]

  * scd: Fix a problem on NetBSD killing scdaemon on gpg-agent
    shutdown.  [#3778]

  * dirmngr: Improve returned error description on failure of DNS
    resolving.  [#3756]

  * wks: Implement command --install-key for gpg-wks-server.

  * Add option STATIC=1 to the Speedo build system to allow a build
    with statically linked versions of the core GnuPG libraries.  Also
    use --enable-wks-tools by default by Speedo builds for Unix.

  See-also: gnupg-announce/2018q1/000420.html


Noteworthy changes in version 2.2.4 (2017-12-20)
------------------------------------------------

  * gpg: Change default preferences to prefer SHA512.

  * gpg: Print a warning when more than 150 MiB are encrypted using a
    cipher with 64 bit block size.

  * gpg: Print a warning if the MDC feature has not been used for a
    message.

  * gpg: Fix regular expression of domain addresses in trust
    signatures. [#2923]

  * agent: New option --auto-expand-secmem to help with high numbers
    of concurrent connections.  Requires libgcrypt 1.8.2 for having
    an effect.  [#3530]

  * dirmngr: Cache responses of WKD queries.

  * gpgconf: Add option --status-fd.

  * wks: Add commands --check and --remove-key to gpg-wks-server.

  * Increase the backlog parameter of the daemons to 64 and add
    option --listen-backlog.

  * New configure option --enable-run-gnupg-user-socket to first try a
    socket directory which is not removed by systemd at session end.

  See-also: gnupg-announce/2017q4/000419.html


Noteworthy changes in version 2.2.3 (2017-11-20)
------------------------------------------------

  * gpgsm: Fix initial keybox creation on Windows. [#3507]

  * dirmngr: Fix crash in case of a CRL loading error. [#3510]

  * Fix the name of the Windows registry key. [Git#4f5afaf1fd]

  * gpgtar: Fix wrong behaviour of --set-filename. [#3500]

  * gpg: Silence AKL retrieval messages. [#3504]

  * agent: Use clock or clock_gettime for calibration. [#3056]

  * agent: Improve robustness of the shutdown pending
    state. [Git#7ffedfab89]

  See-also: gnupg-announce/2017q4/000417.html


Noteworthy changes in version 2.2.2 (2017-11-07)
------------------------------------------------

  * gpg: Avoid duplicate key imports by concurrently running gpg
    processes. [#3446]

  * gpg: Fix creating on-disk subkey with on-card primary key. [#3280]

  * gpg: Fix validity retrieval for multiple keyrings. [Debian#878812]

  * gpg: Fix --dry-run and import option show-only for secret keys.

  * gpg: Print "sec" or "sbb" for secret keys with import option
    import-show. [#3431]

  * gpg: Make import less verbose. [#3397]

  * gpg: Add alias "Key-Grip" for parameter "Keygrip" and new
    parameter "Subkey-Grip" to unattended key generation.  [#3478]

  * gpg: Improve "factory-reset" command for OpenPGP cards.  [#3286]

  * gpg: Ease switching Gnuk tokens into ECC mode by using the magic
    keysize value 25519.

  * gpgsm: Fix --with-colon listing in crt records for fields > 12.

  * gpgsm: Do not expect X.509 keyids to be unique.  [#1644]

  * agent: Fix stucked Pinentry when using --max-passphrase-days. [#3190]

  * agent: New option --s2k-count.  [#3276 (workaround)]

  * dirmngr: Do not follow https-to-http redirects. [#3436]

  * dirmngr: Reduce default LDAP timeout from 100 to 15 seconds. [#3487]

  * gpgconf: Ignore non-installed components for commands
    --apply-profile and --apply-defaults. [#3313]

  * Add configure option --enable-werror.  [#2423]

  See-also: gnupg-announce/2017q4/000416.html


Noteworthy changes in version 2.2.1 (2017-09-19)
------------------------------------------------

  * gpg: Fix formatting of the user id in batch mode key generation
    if only "name-email" is given.

  * gpgv: Fix annoying "not suitable for" warnings.

  * wks: Convey only the newest user id to the provider.  This is the
    case if different names are used with the same addr-spec.

  * wks: Create a complying user id for provider policy mailbox-only.

  * wks: Add workaround for posteo.de.

  * scd: Fix the use of large ECC keys with an OpenPGP card.

  * dirmngr: Use system provided root certificates if no specific HKP
    certificates are configured.  If build with GNUTLS, this was
    already the case.

  See-also: gnupg-announce/2017q3/000415.html


Noteworthy changes in version 2.2.0 (2017-08-28)
------------------------------------------------

  This is the new long term stable branch.  This branch will only see
  bug fixes and no new features.

  * gpg: Reverted change in 2.1.23 so that --no-auto-key-retrieve is
    again the default.

  * Fixed a few minor bugs.

  See-also: gnupg-announce/2017q3/000413.html


