Hello!
=20=20=20=20
We are pleased to announce the availability of a new stable
GnuPG-1
release: Version 1.4.8.
This is GnuPG's 10th birthday celebration release.
The GNU Privacy Guard (GnuPG) is GNU's tool for secure
communication
and data storage. It is a complete and free replacement of
PGP and
can be used to encrypt data and to create digital
signatures. It
includes an advanced key management facility, samrtcard
support and is
compliant with the OpenPGP Internet standard as described by
RFC-4880
(the recently released update of RFC-2440).
Note that this version is from the GnuPG-1 series and thus
smaller
than those from the GnuPG-2 series, easier to build and also
better
portable. In contrast to GnuPG-2 (e.g version 2.0.8) it
comes with no
support for S/MIME or other tools useful for desktop
environments.
Fortunately you may install both versions alongside on the
same system
without any conflict.
Getting the Software
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Please follow the instructions found at http://www.gnupg.org/d
ownload/
or read on:
GnuPG 1.4.8 may be downloaded from one of the GnuPG mirror
sites or
direct from ftp://ftp.gnupg.org/gcrypt/ . The list of
mirrors can be
found at http://www.gnupg.or
g/mirrors.html . Note, that GnuPG is not
available at ftp.gnu.org.
On the mirrors you should find the following files in the
*gnupg*
directory:
gnupg-1.4.8.tar.bz2 (3242k)
gnupg-1.4.8.tar.bz2.sig
GnuPG source compressed using BZIP2 and OpenPGP
signature.
gnupg-1.4.8.tar.gz (4550k)
gnupg-1.4.8.tar.gz.sig
GnuPG source compressed using GZIP and OpenPGP
signature.
gnupg-1.4.7-1.4.8.diff.bz2 (330k)
A patch file to upgrade a 1.4.7 GnuPG source.=20
Select one of them. To shorten the download time, you
probably want to
get the BZIP2 compressed file. Please try another mirror
if
exceptional your mirror is not yet up to date.
In the *binary* directory, you should find these files:
gnupg-w32cli-1.4.8.exe (2117k)
gnupg-w32cli-1.4.8.exe.sig
GnuPG compiled for Microsoft Windows and OpenPGP
signature.
This is a command line only version; the source files
are the
same as given above. Note, that this is a minimal
installer and
unless you are just in need for the gpg binary, you
are better
off using the full featured installer at http://www.gpg4win.org .
A new version of Gpg4win, including this version of
GnuPG will
be available and announced soon.
=20=20
Checking the Integrity
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
=3D=3D
In order to check that the version of GnuPG which you are
going to
install is an original and unmodified one, you can do it in
one of
the following ways:
* If you already have a trusted version of GnuPG installed,
you
can simply check the supplied signature. For example to
check the
signature of the file gnupg-1.4.8.tar.bz2 you would use
this command:
gpg --verify gnupg-1.4.8.tar.bz2.sig
This checks whether the signature file matches the source
file.
You should see a message indicating that the signature is
good and
made by that signing key. Make sure that you have the
right key,
either by checking the fingerprint of that key with other
sources
or by checking that the key has been signed by a
trustworthy other
key. Note, that you can retrieve the signing key using
the command
finger wk ,at' g10code.com
or using a keyserver like
gpg --recv-key 1CE0C630
The distribution key 1CE0C630 is signed by the well known
key
5B0358A2. If you get an key expired message, you should
retrieve a
fresh copy as the expiration date might have been
prolonged.
NEVER USE A GNUPG VERSION YOU JUST DOWNLOADED TO CHECK
THE
INTEGRITY OF THE SOURCE - USE AN EXISTING GNUPG
INSTALLATION!
* If you are not able to use an old version of GnuPG, you
have to verify
the SHA-1 checksum. Assuming you downloaded the file
gnupg-1.4.8.tar.bz2, you would run the sha1sum command
like this:
sha1sum gnupg-1.4.8.tar.bz2
and check that the output matches the second line from
the
following list:
29803a37645493104b239247505418f9c5bedd88
gnupg-1.4.8.tar.gz
4b63267358e5c70f05b48e27d6877bad2636cabd
gnupg-1.4.8.tar.bz2
e69d50a34c9f8d80aca366494228e2be0e8c641b
gnupg-1.4.7-1.4.8.diff.bz2
6ef3f9ba7a36ad1da53a02a8733bf77bc5305587
gnupg-w32cli-1.4.8.exe
What's New
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
* Changed the license to GPLv3.
* Improved detection of keyrings specified multiple
times.
* Changes to better cope with broken keyservers.
* Minor bug fixes.
* The new OpenPGP standard is now complete, and has been
published
as RFC-4880. The GnuPG --openpgp mode (note this is
not the
default) has been updated to match the new standard.
The
--rfc2440 option can be used to return to the older
RFC-2440
behavior. The main differences between the two are
"--enable-dsa2 --no-rfc2440-text
--escape-from-lines
--require-cross-certification".
* By default (i.e. --gnupg mode),
--require-cross-certification is
now on. --rfc2440-text and --force-v3-sigs are now
off.
* Allow encryption using legacy Elgamal sign+encrypt
keys if
option --rfc2440 is used.
* Fixed the auto creation of the key stub for
smartcards.=20=20
* Fixed a rare bug in decryption using the OpenPGP
card.
* Fix RFC-4880 typo in the SHA-224 hash prefix. Old
SHA-224
signatures will continue to work.
Internationalization
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
GnuPG comes with support for 28 languages. Due to a lot of
new and
changed strings some translations are not entirely complete.
The
Chinese (Simple and Traditional), Czech, Dutch, French,
German,
Norwegian, Polish, Romanian, Russian, Spanish, Swedish and
Turkish
translations are close to be complete.
Support
=3D=3D=3D=3D=3D=3D=3D
Improving GnuPG is costly, but you can help! We are looking
for
organizations that find GnuPG useful and wish to contribute
back.=20=20
You can contribute by reporting bugs, improve the software,
order
extensions or support or more general by donating money to
the Free
Software movement (e.g. http://w
ww.fsfeurope.org/help/donate.en.html).
Commercial support contracts for GnuPG are available, and
they help
finance continued maintenance. g10 Code GmbH, a Duesseldorf
based
company owned and headed by gpg's principal author, is
currently
funding GnuPG development. We are always looking for
interesting
development projects.
A service directory is available at:
http://www.gnupg.or
g/service.html
Thanks
=3D=3D=3D=3D=3D=3D
We have to thank all the people who helped with this
release, be it
testing, coding, translating, suggesting, auditing,
administering the
servers, spreading the word or answering questions on the
mailing
lists.=20=20
Happy Hacking,
The GnuPG Team (David, Werner and the other contributors)
=2D-=20
Die Gedanken sind frei. Auschnahme regelt ein
Bundeschgesetz.
_______________________________________________
Gnupg-announce mailing list
Gnupg-announce gnupg.org
http://lists.gnupg.org/mailman/listinfo/gnupg-announce
|