--- gnupg-1.4.10.orig/debian/rules
+++ gnupg-1.4.10/debian/rules
@@ -0,0 +1,141 @@
+#!/usr/bin/make -f
+# debian/rules file - for GNUPG (1.4.6)
+# Based on sample debian/rules file - for GNU Hello (1.3).
+# Copyright 1994,1995 by Ian Jackson.
+# Copyright 1998-2006 by James Troup.
+# I hereby give you perpetual unlimited permission to copy,
+# modify and relicense this file, provided that you do not remove
+# my name from the file itself.  (I assert my moral right of
+# paternity under the Copyright, Designs and Patents Act 1988.)
+# This file may have to be extensively modified
+
+include /usr/share/dpatch/dpatch.make
+
+################################## variables #################################
+
+#VERSION := $(shell dpkg-parsechangelog | grep ^Version: | cut -d' ' -f2)
+
+DEB_BUILD_GNU_TYPE = $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
+DEB_HOST_GNU_TYPE  = $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
+DEB_BUILD_ARCH    := $(shell dpkg-architecture -qDEB_BUILD_ARCH)
+
+CONFARGS  = --prefix=/usr --libexecdir=/usr/lib/ \
+            --enable-mailto --with-mailprog=/usr/sbin/sendmail \
+            --enable-noexecstack
+
+ifneq ($(DEB_BUILD_GNU_TYPE),$(DEB_HOST_GNU_TYPE))
+CONFARGS += --host=$(DEB_HOST_GNU_TYPE)
+endif
+
+ifeq ($(DEB_BUILD_ARCH),ppc64)
+CONFARGS += --disable-asm
+endif
+
+LDFLAGS += -Wl,--as-needed
+
+################################### configure ################################
+
+build-deb/config.status:
+	dh_testdir
+	(mkdir -p $(@D); cd $(@D); \
+	    ../configure $(CONFARGS) $(HOSTARG) --without-libcurl)
+
+build-deb-curl/config.status:
+	dh_testdir
+	(mkdir -p $(@D); cd $(@D); \
+	    ../configure $(CONFARGS) $(HOSTARG))
+
+build-udeb/config.status:
+	dh_testdir
+	(mkdir -p $(@D); cd $(@D); CFLAGS="-g -Os" \
+	    ../configure $(CONFARGS) $(HOSTARG) \
+	    --without-bzip2 --without-readline --without-libcurl)
+
+##################################### build ##################################
+
+build-deb-stamp: patch-stamp build-deb/config.status
+	dh_testdir
+	$(MAKE) -C build-deb/
+ifeq (,$(findstring nocheck,$(DEB_BUILD_OPTIONS)))
+	make -C build-deb/checks check || exit 1
+endif
+	touch $@
+
+build-deb-curl-stamp: patch-stamp build-deb-curl/config.status
+	dh_testdir
+	$(MAKE) -C build-deb-curl/
+ifeq (,$(findstring nocheck,$(DEB_BUILD_OPTIONS)))
+	make -C build-deb-curl/checks check || exit 1
+endif
+	touch $@
+
+build-udeb-stamp: patch-stamp build-udeb/config.status
+	dh_testdir
+	$(MAKE) -C build-udeb/
+	touch $@
+
+build: build-deb-stamp build-deb-curl-stamp build-udeb-stamp
+
+##################################### clean ##################################
+
+clean: unpatch
+	dh_testdir
+	dh_testroot
+	rm -rf build-udeb/ build-deb-curl/ build-deb/
+	# find . -name \*~ | xargs rm -vf
+	dh_clean build-deb-stamp build-deb-curl-stamp build-udeb-stamp patch-stamp
+
+#################################### install #################################
+
+install: build
+	dh_testdir
+	dh_testroot
+	dh_prep
+	dh_installdirs
+	$(MAKE) -C build-deb install DESTDIR=$(CURDIR)/debian/gnupg
+	: # Move localized manpages to FHS compliant locations
+	mv debian/gnupg/usr/share/man/man1/gpg.ru.1 debian/gnupg/usr/share/man/ru/man1/gpg.1
+	: # Remove from /usr/share/gnupg what we install into /usr/share/doc/gnupg/
+	$(RM) debian/gnupg/usr/share/gnupg/FAQ \
+	      debian/gnupg/usr/share/gnupg/faq.html
+	$(RM) debian/gnupg/usr/share/info/dir*
+	find debian/gnupg/ -type d -empty | xargs rmdir
+	$(MAKE) -C build-deb-curl/keyserver install DESTDIR=$(CURDIR)/debian/gnupg-curl
+	$(RM) debian/gnupg-curl/usr/lib/gnupg/gpgkeys_finger \
+	      debian/gnupg-curl/usr/lib/gnupg/gpgkeys_ldap \
+	      debian/gnupg-curl/usr/lib/gnupg/gpgkeys_mailto
+
+#################################### binary ##################################
+
+binary-indep: build install
+binary-arch: build install
+	dh_testdir
+	dh_testroot
+	dh_installchangelogs NEWS
+	# Do we want to ship these 100 of kB's changelogs?
+	for i in checks cipher doc g10 include keyserver mpi po tools util; do \
+	    install -m 644 $$i/ChangeLog debian/gnupg/usr/share/doc/gnupg/changelog.$$i; \
+	done
+	install -m 644 ChangeLog debian/gnupg/usr/share/doc/gnupg/changelog.toplevel
+	install -m 644 keyserver/ChangeLog debian/gnupg-curl/usr/share/doc/gnupg-curl/changelog.keyserver
+	dh_installdocs
+	dh_installexamples
+	dh_movefiles -pgpgv --sourcedir=debian/gnupg
+	dh_install
+	dh_installinfo doc/gnupg1.info
+	dh_installman
+	dh_installudev
+	if which dh_bugfiles ; then dh_bugfiles ; fi
+	dh_link
+	dh_strip
+	dh_compress
+	dh_fixperms
+	dh_installdeb
+	dh_shlibdeps -X debian/gnupg/usr/lib/gnupg/gpgkeys_ldap -- -dRecommends $(CURDIR)/debian/gnupg/usr/lib/gnupg/gpgkeys_ldap -dDepends
+	dh_gencontrol
+	dh_md5sums
+	dh_builddeb
+
+binary: binary-indep binary-arch
+
+.PHONY: build binary binary-arch binary-indep clean
--- gnupg-1.4.10.orig/debian/watch
+++ gnupg-1.4.10/debian/watch
@@ -0,0 +1,2 @@
+version=3
+opts=pasv ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-(1\.[\d\.]+)\.tar\.gz
--- gnupg-1.4.10.orig/debian/compat
+++ gnupg-1.4.10/debian/compat
@@ -0,0 +1 @@
+7
--- gnupg-1.4.10.orig/debian/gpg-zip.1
+++ gnupg-1.4.10/debian/gpg-zip.1
@@ -0,0 +1,102 @@
+.TH "GPG\-ZIP" 1 "November 2006"
+
+.SH NAME
+gpg\-zip \- encrypt or sign files into an archive
+
+.SH SYNOPSIS
+.B gpg\-zip
+.RB [ OPTIONS ]
+.IR filename1 " [" "filename2, ..." ]
+.IR directory1 " [" "directory2, ..." ]
+
+.SH DESCRIPTION
+This manual page documents briefly the 
+.B gpg\-zip
+command.
+.PP
+.B gpg\-zip
+encrypts or signs files into an archive. It is an gpg-ized tar using the
+same format as PGP's PGP Zip.
+
+.SH OPTIONS
+.TP
+.BR \-e ", " \-\-encrypt
+Encrypt data. This option may be combined with 
+.B \-\-symmetric
+(for output that may be decrypted via a secret key or a passphrase).
+.TP
+.BR \-d ", " \-\-decrypt
+Decrypt data.
+.TP
+.BR \-c ", " \-\-symmetric
+Encrypt with a symmetric cipher using a passphrase.  The default
+symmetric cipher used is CAST5, but may be chosen with the
+.B \-\-cipher\-algo
+option to
+.BR gpg (1).
+.TP
+.BR \-s ", " \-\-sign
+Make a signature. See
+.BR gpg (1).
+.TP
+.BR \-r ", " \-\-recipient " \fIUSER\fR"
+Encrypt for user id \fIUSER\fR. See
+.BR gpg (1).
+.TP
+.BR \-u ", " \-\-local\-user " \fIUSER\fR"
+Use \fIUSER\fR as the key to sign with. See
+.BR gpg (1).
+.TP
+.B \-\-list\-archive
+List the contents of the specified archive.
+.TP
+.BR \-o ", " \-\-output " " \fIFILE\fR"
+Write output to specified file
+.IR FILE .
+.TP
+.BI \-\-gpg " GPG"
+Use the specified command instead of
+.BR gpg .
+.TP
+.BI \-\-gpg\-args " ARGS"
+Pass the specified options to
+.BR gpg (1).
+.TP
+.BI \-\-tar " TAR"
+Use the specified command instead of
+.BR tar .
+.TP
+.BI \-\-tar\-args " ARGS"
+Pass the specified options to 
+.BR tar (1).
+.TP
+.BR \-h ", " \-\-help
+Output a short usage information.
+.TP
+.B \-\-version
+Output the program version.
+
+.SH DIAGNOSTICS
+The program returns \fB0\fR if everything was fine, \fB1\fR otherwise.
+
+.SH EXAMPLES
+Encrypt the contents of directory \fImydocs\fR for user Bob to file \fItest1\fR:
+.IP
+.B gpg\-zip \-\-encrypt \-\-output test1 \-\-gpg-args ""\-r Bob"" mydocs
+.PP
+List the contents of archive \fItest1\fR:
+.IP
+.B gpg\-zip \-\-list\-archive test1
+
+.SH SEE ALSO
+.BR gpg (1),
+.BR tar (1)
+
+.SH AUTHOR
+Copyright (C) 2005 Free Software Foundation, Inc. Please report bugs to
+<\&bug-gnupg@gnu.org\&>.
+
+This manpage was written by \fBColin Tuckley\fR <\&colin@tuckley.org\&>
+and \fBDaniel Leidert\fR <\&daniel.leidert@wgdd.de\&> for the Debian
+distribution (but may be used by others).
+
--- gnupg-1.4.10.orig/debian/gnupg.docs
+++ gnupg-1.4.10/debian/gnupg.docs
@@ -0,0 +1,10 @@
+README
+THANKS
+TODO
+doc/DETAILS
+doc/FAQ
+doc/faq.html
+doc/highlights-1.4.txt
+doc/OpenPGP
+debian/Upgrading_From_PGP.txt
+debian/README.BUGS.Debian
--- gnupg-1.4.10.orig/debian/gnupg.dirs
+++ gnupg-1.4.10/debian/gnupg.dirs
@@ -0,0 +1,2 @@
+usr/share/doc/gnupg
+usr/share/man/ru/man1
--- gnupg-1.4.10.orig/debian/gnupg.udev
+++ gnupg-1.4.10/debian/gnupg.udev
@@ -0,0 +1,12 @@
+# do not edit this file, it will be overwritten on update
+
+SUBSYSTEM!="usb", GOTO="gnupg_rules_end"
+ACTION!="add", GOTO="gnupg_rules_end"
+
+# USB SmartCard Readers
+## SCM readers (SCR335, SPR532, & Co)
+ATTR{idVendor}=="04e6", ATTR{idProduct}=="e001", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+ATTR{idVendor}=="04e6", ATTR{idProduct}=="e003", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+ATTR{idVendor}=="04e6", ATTR{idProduct}=="5115", ENV{ID_SMARTCARD_READER}="1", ENV{ID_SMARTCARD_READER_DRIVER}="gnupg"
+
+LABEL="gnupg_rules_end"
--- gnupg-1.4.10.orig/debian/gpgsplit.1
+++ gnupg-1.4.10/debian/gpgsplit.1
@@ -0,0 +1,41 @@
+.TH "gpgsplit" 1 "December 2005" 
+
+.SH NAME
+gpgsplit \- Split an OpenPGP message into packets
+
+.SH SYNOPSIS
+.B gpgsplit 
+.RI [ OPTIONS ]
+.RI [ FILES ]
+
+.SH DESCRIPTION
+This manual page documents briefly the 
+.B gpgsplit
+command.
+.PP
+.B gpgsplit
+splits an OpenPGP message into packets.
+
+.SH OPTIONS
+.TP
+.BR \-v , \-\-verbose
+Verbose.
+.TP
+.BR \-p , "\-\-prefix " \fISTRING\fR
+Prepend filenames with \fISTRING\fR.
+.TP
+.B \-\-uncompress
+Uncompress a packet.
+.TP
+.B \-\-secret\-to\-public
+Convert secret keys to public keys.
+.TP
+.B \-\-no\-split
+Write to stdout and don't actually split.
+
+.SH AUTHOR
+Copyright (C) 2002 Free Software Foundation, Inc. Please report bugs to
+<bug-gnupg@gnu.org>.
+
+This manpage was written by Francois Wendling <frwendling@free.fr>.
+
--- gnupg-1.4.10.orig/debian/changelog
+++ gnupg-1.4.10/debian/changelog
@@ -0,0 +1,1220 @@
+gnupg (1.4.10-4+squeeze3) squeeze-security; urgency=high
+
+  * Apply upstream patch to fix infinite recursion in the
+    compressed packet parser (CVE-2013-4402, closes: #725439).
+  * Apply upstream patch to fix treating no-usage-permitted
+    keys as all-usages-permitted (CVE-2013-4351, closes: #722722).
+
+ -- Thijs Kinkhorst <thijs@debian.org>  Wed, 09 Oct 2013 18:14:40 +0200
+
+gnupg (1.4.10-4+squeeze2) squeeze-security; urgency=high
+
+  * Apply upstream patch to fix side channel attack on RSA
+    (CVE-2013-4242, closes: #717880).
+
+ -- Thijs Kinkhorst <thijs@debian.org>  Sun, 28 Jul 2013 13:59:06 +0200
+
+gnupg (1.4.10-4+squeeze1) stable-security; urgency=high
+
+  * Apply upstream patch to fix memory and key database corruption
+    when importing with invalid keys (CVE-2012-6085, closes: #697108).
+
+ -- Thijs Kinkhorst <thijs@debian.org>  Wed, 02 Jan 2013 20:43:39 +0100
+
+gnupg (1.4.10-4) unstable; urgency=high
+
+  * debian/patches/mips_gcc4.4: added to fix build failure on
+    mips(el) due to the removal of the 'h' constraint for MIPS
+    in gcc-4.4.x versions. Urgency high for fixing ftbfs.
+    Thanks Florian Fainelli for the patch.
+
+ -- Thijs Kinkhorst <thijs@debian.org>  Tue, 25 May 2010 20:54:22 +0200
+
+gnupg (1.4.10-3) unstable; urgency=low
+
+  [ Daniel Leidert (dale) ]
+  * debian/control (Description): Added note about gnupg2 (closes: #566081).
+  * debian/patches/489225_catch_expired_primary_key_with_valid_subkey.dpatch:
+    Added.
+    - g10/sig-check.c (do_check_messages): Evaluate the HAS_EXPIRED flag to
+      fix missing status line signature verification done with a subkey while
+      on the main key has expired (closes: #489225).
+  * debian/patches/551709_fix_info_link_entry.dpatch: Added.
+    - doc/gnupg1.texi, gnupg1.info: Fix direntry (closes: #551709).
+  * debian/patches/553175_document_primary_uid_sign.dpatch: Added.
+    - doc/gpg.texi: Document the primary user id sign in --edit-key mode
+      (closes: #553175).
+  * debian/patches/560692_fix_fatal_after_homedir_creation.dpatch: Added.
+    - g10/tdbio.c (tdbio_set_dbname): Fix a mistaken fatal error after homedir
+      creation (closes: #560692).
+  * debian/patches/560995_fix_ftbfs_on_sparc64.dpatch: Added.
+    - mpi/config.links: Fix FTBFS on sparc64, where it tries to use SPARC32
+      assembly code (closes: #560995).
+  * debian/patches/567580_menu_prompt_reflects_program.dpatch: Added.
+    - Use a less ambiguous command prompt (closes: #567580).
+  * debian/patches/567593_improve_info_and_faq.dpatch: Added.
+    - Improve the info/manual pages, fix grammar and add/fix the bug-reporting
+      address (closes: #567593).
+  * debian/patches/fix_infinite_loop_r5264.dpatch: Added.
+    - Avoid infinite loop in case of invalid data.
+  * debian/patches/00list: Adjusted.
+
+  [ Thijs Kinkhorst ]
+  * Checked for policy 3.8.4, no changes.
+
+ -- Thijs Kinkhorst <thijs@debian.org>  Mon, 22 Mar 2010 20:12:42 +0100
+
+gnupg (1.4.10-2) unstable; urgency=low
+
+  [ Thijs Kinkhorst ]
+  * Correct build issue when backporting to lenny, thanks Andreas Metzler
+    (closes: #545268).
+
+  [ Daniel Leidert ]
+  * debian/control: Added gnupg-curl package which ships the keyserver helper
+    tools built with libcurl. gnupg recommends this package.
+    (Build-Depends): Changed to generic libreadline-dev (see pkg-gnupg-maint
+    list 09/2009).
+    (Description): Adjusted for gnupg vs. gnupg-curl.
+  * debian/gnupg.doc-base.faq: Added to register the GnuPG FAQ with doc-base.
+  * debian/gnupg-curl.preinst,
+    debian/gnupg-curl.postrm: Added to add/remove the diversions for
+    gpgkeys_curl and gpgkeys_hkp.
+  * debian/rules: Added targets to build the gnupg binary and helper tools
+    explicitly with libcurl. Move the gpgkeys_curl and gpgkeys_hkp keyserver
+    tools built with libcurl into the gnupg-curl package.
+    (build-deb/config.status): Build the gnupg binary with the "curl shim"
+    variant and without libcurl, so we don't depend on packages with priority
+    lower important (closes: #545275).
+    (install): Delete /usr/share/info/dir.gz (closes: #546552).
+    (binary-arch): Add missing relevant ChangeLog files.
+
+ -- Thijs Kinkhorst <thijs@debian.org>  Fri, 25 Sep 2009 10:34:50 +0200
+
+gnupg (1.4.10-1) unstable; urgency=low
+
+  [ Daniel Leidert (dale) ]
+  * New upstream release GnuPG 1.4.10.
+    - Better cope with unicode characters in any output (closes: #540340).
+    - Output a warning when trying to revoke a signature from a key,
+      that is not signed by any of your keys (closes: #543530).
+
+  For more information please read /usr/share/doc/gnupg/changelog.gz.
+
+  * debian/control (Standards-Version): Bumped to 3.8.3.
+  * debian/gnupg.bug-presubj: Added note about debian/README.BUGS.Debian.
+  * debian/gnupg.docs: Added debian/README.BUGS.Debian.
+  * debian/gnupg.udev: Added udev rules to support several SCM smartcard
+    readers. Thanks to Michael Bienia (closes: #543216).
+  * debian/rules (binary-arch): Install udev rules and bug control files.
+  * debian/README.BUGS.Debian: Added. Collect information about limitations
+    which have been reported to the BTS and might be in the future too. This
+    will replace the open bug reports, so the bug count decreases and
+    readability increases (closes: #44910, #89094, #282061, #359758, #427857,
+    #472642, #485458).
+  * debian/patches/24_gpgv_manpage_cleanup.dpatch: Dropped (applied upstream).
+  * debian/patches/25_fr.po_fixes.dpatch: Ditto.
+  * debian/patches/25_it.po_fixes.dpatch: Ditto.
+
+  [ Thijs Kinkhorst ]
+  * Add misc:depends substvar to facilitate install-info transition.
+
+ -- Thijs Kinkhorst <thijs@debian.org>  Sat, 05 Sep 2009 15:43:18 +0200
+
+gnupg (1.4.10~rc1-1) experimental; urgency=low
+
+  * First release candidate of GnuPG 1.4.10.
+    - Improved lockfile handling (closes: #58260).
+    - Fixes error using the --local-user switch together with the same options
+      string (closes: #130363).
+    - Fixes memory leak importing (large) keyrings (closes: #172115, #345911).
+    - Send HTTP requests with "Pragma: no-cache" (closes: #177716).
+    - Reference to unimplemented --fix-trustdb switch has been replaced by
+      short howto for recovery (closes: #196860).
+    - Resets terminal after SIGINT (LP: #294115; closes: #321871).
+    - Fixes error using the --fingerprint switch together with the
+      with-fingerprint options string (closes: #382794).
+    - Removing some strange old special case code in gpg fixes an error thrown
+      for a special signature (closes: #402600). This needs well testing ...
+      see https://bugs.g10code.com/gnupg/issue931.
+    - Fixes misleading error messages (closes: #205596, #494040).
+    - Fixes building with libcurl (closes: #502558).
+    - Fixes a parsing loop specific to amd64 systems (closes: #503853).
+    - Fixes the non-zero exit status after smartcard insert prompt (closes:
+      #513464).
+    - Fixes/improves documentation (LP: #389694; closes: #496921, #527351).
+    - Fixes several issues in the German (closes: #536827), the Dutch
+      (LP: #397395) and the French (closes: #525404) translation.
+    - Added IDN (Internationalized Domain Names) support (closes: #537122).
+    
+    For more information please read /usr/share/doc/gnupg/changelog.gz.
+
+  [ Thijs Kinkhorst ]
+  * Re-enable build-time tests, accidentally disabled due to false
+    logic in debian/rules. Thanks Neil Williams, closes: #521884.
+  * Checked for policy 3.8.2 and updated to debhelper 7.
+  * Install NEWS as upstream changelog.
+
+  [ Daniel Leidert ]
+  * debian/control (Build-Depends): Added libcurl4-gnutls-dev (LP: #62864).
+  * debian/rules (CONFARGS): Add --enable-noexecstack to build gnupg without
+    executable stack on i386 (LP: #49323; closes: #527630).
+    (binary-arch): Register .info documentation (closes: #527570).
+  * debian/patches/24_gpgv_manpage_cleanup.dpatch: Party dropped (applied
+    upstream).
+  * debian/patches/25_de.po_fixes.dpatch: Dropped (applied upstream).
+  * debian/patches/99_yat2m_fix_samp_handling.dpatch: Ditto.
+  * debian/patches/00list: Adjusted.
+
+ -- Thijs Kinkhorst <thijs@debian.org>  Sat, 15 Aug 2009 18:43:03 +0200
+
+gnupg (1.4.9-4) unstable; urgency=low
+
+  [ Daniel Leidert (dale) ]
+  * debian/compat: Added to define debhelper compat level 5.
+  * debian/control: (Build-Depends): Added debhelper v5.
+  * debian/gnupg.dirs: Added for new debhelper-based debian/rules.
+  * debian/gnupg.docs: Ditto.
+  * debian/gnupg.links: Ditto.
+  * debian/gnupg.manpages: Ditto.
+  * debian/gnupg-udeb.install: Ditto.
+  * debian/gpgv.files: Ditto.
+  * debian/gpgv-udeb.install: Ditto.
+  * debian/rules: Complete rewrite using debhelper (closes: #437050, #430459).
+ 
+  [ Thijs Kinkhorst ]
+  * We don't install setuid root anymore, and have not even built
+    with capability support anyway in recent times. Drop libcap-dev
+    build-dependency and associated patches. (Closes: #492622).
+  * No longer install gpg-convert-from-106 in the path, but ship
+    this script to convert from GnuPG 1.0.6 and earlier as an
+    example.
+  * Add --disable-asm build flag on ppc64 architecture (Closes: #343434).
+  * Rephrase description on the subject of IDEA (Closes: #509853).
+
+ -- Thijs Kinkhorst <thijs@debian.org>  Mon, 16 Feb 2009 18:35:15 +0100
+
+gnupg (1.4.9-3) unstable; urgency=low
+
+  * Add Package-Type: udeb to μdebs.
+  * Properly strip binaries shippped in μdebs.
+  * Disable libusb-dev build-dep on the Hurd (closes: #491864).
+  * Updated debian/copyright to GPLv3.
+  * Checked for policy 3.8.0, added README.source.
+  * Add self to uploaders.
+
+ -- Thijs Kinkhorst <thijs@debian.org>  Thu, 24 Jul 2008 22:25:09 +0200
+
+gnupg (1.4.9-2) unstable; urgency=low
+
+  [ Sune Vuorela ]
+  * Switch maintainer to maillist. This package is now officially team
+    maintained.
+  * Really enable patches added earlier. (Really Closes: #394037, #298699)
+  * Add a seahorse conflicts as the seahorse maintainer likes.
+  * Remove stamp files in clean.
+
+  [ Thijs Kinkhorst ]
+  * Add watch file (Closes: #450670).
+  * Remove ancient (2002 and earlier) Conflicts, Replaces, Provides.
+
+  [ Daniel Leidert ]
+  * debian/control: Added Vcs fields.
+    (Uploaders): Added myself.
+  * debian/gpg-zip.1: Fixed header.
+
+ -- Sune Vuorela <debian@pusling.com>  Sun, 08 Jun 2008 12:27:36 +0200
+
+gnupg (1.4.9-1) unstable; urgency=low
+
+  * New upstream release 1.4.9 (Closes: #452118). Based on Daniel Leiderts work
+    - Removed shutdown code in util/http.c (Closes: #201589).
+    - Limit bytes read for an unknown alogorithm (Closes: #402592).
+    - Build changes to fully evaluate paths (Closes: #402958, #412508, #420613).
+    - Decrypt multiple files and not just the first (Closes: #431828).
+    - Fixes yat2m and gpg.texi to fix formatting in the man-page 
+     (Closes: #445328).
+    - Localizaton update for German locale (closes: #296128).
+  * Remove patch 28_multiple_message.dpatch, implemented upstream
+  * Remove ancient preinst script to support upgrades back in 1998
+  * README.Debian is related to the ancient preinst script, so remove it as
+    well.
+  * debian/patches/99_yat2m_fix_samp_handling.dpatch: Added.
+    - doc/yat2m.c: Backport two fixes from the upstream SVN regarding the
+      correct handling of backslahes and fixing the samples output format
+      avoiding man-db warnings.
+  * Redo patches with dpatch-run instead of big patch blurb in the patches.
+  * Updated and added some tranlations (patch 25*) 
+    (French: Closes: #394037) (Italian: Closes: #298699)
+  * Have gpg suggest libpcsclite1 (Closes: #297253) and a couple of image 
+    viewers (Closes: #381419).
+  * No need to clean up in builddir before removing builddir
+  * if rm -rf fails, we should also fail
+  * Handle DEB_BUILD_OPTIONS=nostrip in debian/rules (Closes: #437050)
+  * add md5sums to package (Closes: 430459)
+  * Don't depend, but recommend libldap, this is only needed in some
+    cases. (Closes: 399167)
+  * Add manpage to gpg-zip. Thanks to Colin Tuckley and Daniel Leidert
+  * Bump standards.
+  * Add Homepage field to debian/control
+  * Run test suites.
+
+ -- Sune Vuorela <debian@pusling.com>  Sun, 01 Jun 2008 21:21:10 +0200
+
+gnupg (1.4.6-3) unstable; urgency=low
+
+  * Adopt package. Thanks to James Troup for his work in the far past.
+    Thanks to NMU'ers Bastian and Thijs. (Closes: #476418)
+  * Co-maintainers wanted.
+  * Don't build-dep on pcap on non-linux-archs. (Closes: #357267)
+
+ -- Sune Vuorela <debian@pusling.com>  Sat, 17 May 2008 15:42:55 +0200
+
+gnupg (1.4.6-2.2) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Do not install gpg setuid root, this is not necessary anymore since
+    Linux kernel 2.6.9. (Closes: #356550, #346597, #453122)
+  * Update priority to match override (Closes: #340846).
+
+ -- Thijs Kinkhorst <thijs@debian.org>  Sat, 03 May 2008 16:20:56 +0200
+
+gnupg (1.4.6-2.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Remove makedev dependency. (closes: #343988)
+
+ -- Bastian Blank <waldi@debian.org>  Sat, 23 Feb 2008 19:59:18 +0100
+
+gnupg (1.4.6-2) unstable; urgency=medium
+
+  * 28_multiple_message.dpatch: new patch from upstream to fix problems
+    handling verification of messages with multiple
+    components. [CVE-2007-1263]
+
+ -- James Troup <james@nocrew.org>  Wed,  7 Mar 2007 21:47:35 +0000
+
+gnupg (1.4.6-1) unstable; urgency=high
+
+  * New upstream release.
+   * Fixes remotely controllable function pointer [CVE-2006-6235]
+
+  * 27_filename_overflow.dpatch: merged upstream, dropped.
+  * 24_gpgv_manpage_cleanup.dpatch: updated and a couple of additional
+    trivial fixes.
+
+  * debian/rules (binary-arch): info copy of manuals moved to
+    /usr/share/info - remove them there instead.  Manuals are now built
+    from texi source, so install them from build tree, not top level.
+
+  * debian/copyright: update to add OpenSSL exemption for keyserver helper
+    tools.
+
+ -- James Troup <james@nocrew.org>  Thu,  7 Dec 2006 02:54:51 +0000
+
+gnupg (1.4.5-3) unstable; urgency=high
+
+  * 27_filename_overflow.dpatch: new patch from upstream to fix buffer
+    overflow in ask_outfile_name(). [CVE-2006-6169]
+
+ -- James Troup <james@nocrew.org>  Mon, 27 Nov 2006 21:23:37 +0000
+
+gnupg (1.4.5-2) unstable; urgency=low
+
+  * debian/control: add gpgv package.  Make gnupg package depend on it.
+  * debian/rules (binary-arch): add support for building gpgv package.
+    Adapt gnupg package creation accordingly.
+  * debian/rules (clean): clean gpgv package temporary directory.
+
+ -- James Troup <james@nocrew.org>  Thu, 26 Oct 2006 02:14:46 +0100
+
+gnupg (1.4.5-1) unstable; urgency=low
+
+  * New upstream release.
+   * 23_getkey_utf8_userid.dpatch: superseded by different fix upstream,
+     dropped.
+   * 26_user_id_overflow.dpatch: merged upstream, dropped.
+   * 25_de.po_fixes.dpatch: updated.
+
+  * debian/copyright: update FSF address.
+  * debian/changelog: convert to UTF-8.
+  * debian/control (Standards-Version): bump to 3.7.2.1.
+
+ -- James Troup <james@nocrew.org>  Tue,  1 Aug 2006 22:50:09 +0100
+
+gnupg (1.4.3-2) unstable; urgency=low
+
+  * 26_user_id_overflow.dpatch: new patch pulled from upstream SVN to fix
+    a crash when processing overly large User ID packets [CVE-2006-3082].
+    Thanks to Alec Berryman <alec@thened.net>. Closes: #375052
+
+ -- James Troup <james@nocrew.org>  Fri, 23 Jun 2006 11:22:31 +0100
+
+gnupg (1.4.3-1) unstable; urgency=low
+
+  * New upstream release.
+   * 22_zero_length_mpi_fix.dpatch: merged upstream, dropped.
+   * debian/rules (test): s/g10.c/gpg.c/.
+   * 16_min_privileges.dpatch: likewise.
+
+  * debian/control, debian/rules: apply patch from Max Vozeler
+    <xam@debian.org> to build gnupg-udeb.  Closes: #321948
+  
+  * Based on discussion with and testing by Martin Pitt
+    <martin.pitt@ubuntu.com>:
+   * debian/rules (build-deb-stamp): don't pass --with-included-gettext to
+     configure.
+   * debian/rules (build-udeb-stamp): likewise.
+   * debian/rules (binary-arch): don't need to remove
+     usr/share/locale/locale.alias anymore as a result.
+
+  * debian/rules (build-deb-stamp): pass --enable-mailto to configure.
+    Closes: #301308
+  * debian/rules (build-udeb-stamp): likewise.
+
+  * debian/control (Build-Depends): drop mail-transport-agent and...
+  * debian/rules (build-deb-stamp): pass
+    --with-mailprog=/usr/sbin/sendmail to configure instead.
+  * debian/rules (build-udeb-stamp): likewise.  Closes: #333218
+
+  * debian/rules: put common configure options into CONFARGS variable and
+    rename the cross-compile-only variable to HOSTARG.
+
+  * debian/rules (clean): also remove debian/gnupg-deb build directory.
+
+  * debian/gpg-convert-from-106.1, debian/gpgsplit.1, debian/lspgpot.1:
+    new manpages from François Wendling <frwendling@free.fr>.  Closes:
+    #344314
+  * debian/rules (binary-arch): install them.
+
+  * The following is a patch from Frans Pop <aragorn@tiscali.nl>.  Closes:
+    #360257
+   * debian/control (Build-Depends): add dpkg-dev (>= 1.13.12).
+   * debian/rules (binary-arch): pass -tudeb when invoking dpkg-shlibdeps
+     for the .udeb builds.
+
+  * 23_getkey_utf8_userid.dpatch: new patch from Fumitoshi UKAI
+    <ukai@debian.or.jp> to fix '[User id not found]' message in non-UTF-8
+    locales.  Closes: #205028
+
+  * 24_gpgv_manpage_cleanup.dpatch: new patch from "Jim W. Jaszewski"
+    <grok@sprint.ca> to fix small errors in the gpgv manpage.  Closes:
+    #177951
+
+  * 25_de.po_fixes.dpatch: new patch from Jens Seidel
+    <jensseidel@users.sf.net> with small fixes to the German translations.
+    Closes: #314069
+
+ -- James Troup <james@nocrew.org>  Wed,  5 Apr 2006 02:45:56 +0100
+
+gnupg (1.4.2.2-1) unstable; urgency=low
+
+  * New upstream release.
+   * Fixes handling of files containing several signed messages.
+     [CVE-2006-0049]
+
+ -- James Troup <james@nocrew.org>  Fri, 10 Mar 2006 04:27:12 +0000
+
+gnupg (1.4.2-2) unstable; urgency=low
+
+  * 22_zero_length_mpi_fix.dpatch: new patch; pull in upstream patch to
+    fix bug in reading a zero-length MPI.  Closes: #330686
+
+ -- James Troup <james@nocrew.org>  Sun,  2 Oct 2005 02:39:51 +0100
+
+gnupg (1.4.2-1) unstable; urgency=low
+
+  * New upstream release.
+   * Fixes extra ) on expired keys.  Closes: #329402
+
+  * debian/control (Standards-Version): updated to 3.6.2.1.
+
+  * debian/rules (binary-arch): drop 'gnupg/' from libexecdir passed to
+    make install.
+
+ -- James Troup <james@nocrew.org>  Sat, 24 Sep 2005 03:31:37 +0100
+
+gnupg (1.4.1-1) unstable; urgency=low
+
+  * New upstream release.  Closes: #307203
+   * Fixes mis-selection of encryption key.  Closes: #299814
+   * Countermeasures against the Mister/Zuccherato CFB attack.  
+     Closes: #300859
+  * 18_ca_po_update.dpatch, 21_strgutil_update.dpatch: dropped - merged
+    upstream.
+  * debian/rules (build-deb-stamp): don't forcefully regenerate po/ca.gmo.
+    (clean): likewise, don't remove po/ca.gmo.
+
+ -- James Troup <james@nocrew.org>  Mon,  9 May 2005 23:41:50 +0100
+
+gnupg (1.4.0-3) unstable; urgency=low
+
+  * debian/rules (binary-arch): move Russian manpage to correct (FHS)
+    location.  Thanks to Uwe Zeisberger
+    <zeisberg@informatik.uni-freiburg.de> for the report.  Closes: #294196
+
+ -- James Troup <james@nocrew.org>  Sun, 20 Feb 2005 22:55:11 +0000
+
+gnupg (1.4.0-2) unstable; urgency=low
+
+  * 18_ca_po_update.dpatch: re-added, updated for new upstream release.
+    Thanks to Jordi Mallach <jordi@debian.org>.
+  * debian/rules (build-deb): force regeneration of ca.gmo.
+
+  * 21_strgutil_update.dpatch: new patch; pull in strgutil.c fixes from
+    1.4.1rc1 to fix warnings about 'Invalid or incomplete multibyte or
+    wide character' with (at least) Latin-1 encoded UIDs.
+
+  * debian/copyright: update year and version number.
+
+  * debian/rules: apply patch to enable cross-build from NIIBE Yutaka
+    <gniibe@fsij.org>. Closes: #285293
+
+  * debian/rules: s/DEB_HOST_ARCH/DEB_BUILD_ARCH/ as the gpgv-udeb should
+    use the build architecture not host.
+  * debian/rules (build-udeb): pass $(CONFARGS) to configure here too.
+  
+ -- James Troup <james@nocrew.org>  Sat,  5 Feb 2005 03:03:06 +0000
+
+gnupg (1.4.0-1) unstable; urgency=low
+
+  * New upstream release.  Closes: #286058
+  
+  * debian/control (Build-Depends): add libusb-dev and libreadline5-dev.
+  * debian/rules (binary): install doc/highlights-1.4.txt to
+    /usr/share/doc/gnupg/ too.
+
+  * 17_ipv6_support.dpatch: removed; a different patch has been applied
+    upstream.
+  * 19_throw_keyid_compat.dpatch, 20_update_pgp8.dpatch: dropped; merged
+    upstream.
+
+  * 16_min_privileges.dpatch: adjusted for new upstream release with
+    wiggle(1).
+
+  * 18_ca_po_update.dpatch: dropped temporarily as it no longer applies.
+
+  * Apply patch from Colin Watson to add gpgv-udeb package.  Closes: #287106
+  * debian/rules (build-udeb): also pass --without-readline to configure.
+
+ -- James Troup <james@nocrew.org>  Thu,  3 Feb 2005 23:52:49 +0000
+
+gnupg (1.2.5-3.1) UNOFFICIAL; urgency=low
+
+  * debian/control, debian/rules: Build gpgv-udeb, containing just
+    /usr/bin/gpgv built without bzip2 support and with -Os, for use in
+    debian-installer.
+
+ -- Colin Watson <cjwatson@debian.org>  Fri, 24 Dec 2004 13:42:23 +0000
+
+gnupg (1.2.5-3) unstable; urgency=low
+
+  * debian/rules (build): drop --with-capabilites for now.
+  * debian/rules (clean): don't remove fi.gmo now that we're no longer
+    patching it.
+  * Merge patch from Peter Palfrader <weasel@debian.org> to fix building
+    without capabilities and idempotency of build process after
+    18_ca_po_update.dpatch.  Closes: #262723
+
+ -- James Troup <james@nocrew.org>  Mon,  2 Aug 2004 00:51:21 +0100
+
+gnupg (1.2.5-2.1) unstable; urgency=low
+
+  * Fix patches/15_free_caps to also build without capabilities.
+  * Remove po/ca.gmo in clean target.
+
+ -- Peter Palfrader <weasel@debian.org>  Sun,  1 Aug 2004 20:13:31 +0200
+
+gnupg (1.2.5-2) unstable; urgency=low
+
+  * 18_ca_po_update.dpatch: new patch from Jordi Mallach
+    <jordi@debian.org> to fix ca.po encoding.  Closes: #237070
+
+  * 19_throw_keyid_compat.dpatch: new patch from Werner Koch
+    <wk@gnupg.org> to add a --throw-keyid option for backwards
+    compatability.
+  
+  * 20_update_pgp8.dpatch: new patch from David Shaw
+    <dshaw@jabberwocky.com> to update --pgp8 to match reality.
+
+ -- James Troup <james@nocrew.org>  Sat, 31 Jul 2004 10:55:30 +0100
+
+gnupg (1.2.5-1) unstable; urgency=low
+
+  * New upstream release.  Closes: #262094
+   * UID merging should now work on initial import.  Closes: #236966
+  
+  * 10_hppa_unaligned_constant.dpatch, 11_fi_po_update.dpatch,
+    12_zero_length_header.dpatch, 13_revoked_keys.dpatch,
+    14_getkey_not_found_fix.dpatch: merged upstream - removed.
+
+  * debian/rules (binary-arch): add
+    'mkinstalldirs=`pwd`/scripts/mkinstalldirs' to make install invocation
+    to work around broken Makefile.
+
+  * debian/control (Standards-Version): bump to 3.6.1.1.
+
+  * Apply patch from Martin Pitt <mpitt@debian.org> to drop privileges as
+    early as possible.  Closes: #260803
+
+  * debian/control (Build-Depends): add mail-transport-agent to ensure
+    gpgkeys_mailto is built.  Thanks to Daniel Schepler
+    <schepler@math.berkeley.edu> for noticing.  Closes: #253681
+
+  * debian/rules, debian/preinst: Patch from David Weinehall
+    <tao@debian.org> to use && in favour of -a as the latter is an XSI
+    extension.  Closes: #257575
+
+  * 17_ipv6_support.dpatch: IPv6 patch from Jun-ichiro itojun Hagino.
+    Thanks to Fabio Massimo Di Nitto <fabbione@fabbione.net>.  
+    Closes: #209242
+
+ -- James Troup <james@nocrew.org>  Thu, 29 Jul 2004 23:57:08 +0100
+
+gnupg (1.2.4-4.1) unstable; urgency=low
+
+  * 15_free_caps.dpatch: free allocated capability contexts when using
+    USE_CAPABILITIES.
+  * 16_min_privileges.dpatch: immediately drop root user to normal user and
+    keep only CAP_IPC_LOCK, which is dropped as well right after it is not
+    needed any more. This ensures minimal privileges.
+  * debian/rules: configure with --with-capabilities to tighten security.
+  * debian/control: this requires build-dependency libcap-dev.
+
+ -- Martin Pitt <mpitt@debian.org>  Thu, 22 Jul 2004 02:08:56 +0200
+
+gnupg (1.2.4-4) unstable; urgency=low
+
+  * 12_zero_length_header.dpatch: update patch from David Shaw
+    <dshaw@jabberwocky.com> to fix the fix of crashing on certain
+    keys. Closes: #234289
+
+ -- James Troup <james@nocrew.org>  Mon, 23 Feb 2004 18:02:20 +0000
+
+gnupg (1.2.4-3) unstable; urgency=low
+
+  * Move to dpatch; existing non-debian/ change split into
+    10_hppa_unaligned_constant.dpatch.
+
+  * debian/rules: include /usr/share/dpatch/dpatch.make.
+  * debian/rules (build): depend on patch-stamp.
+  * debian/rules (clean): depend on unpatch.  Remove debian/patched.
+  * debian/control (Build-Depends): add dpatch.
+
+  * debian/rules: update version number and use install_foo convenience
+    variables.
+  * debian/rules (clean): remove emacs backup files from any directory.
+  
+  * 11_fi_po_update.dpatch: new patch from Tommi Vainikainen
+    <thv+debian@iki.fi> to update Finnish translation as the current one
+    renders gnupg unusable.  Closes: #232030, #222951, #192582
+  * debian/rules (clean): remove po/fi.gmo to avoid dpkg-source errors
+    over unrepresentable changes to source.
+
+  * 12_zero_length_header.dpatch: new patch from David Shaw
+    <dshaw@jabberwocky.com> to fix cases where importing certain keys
+    makes the keyring unuseable.  Closes: #232714
+
+  * 13_revoked_keys.dpatch: new patch from David Shaw
+    <dshaw@jabberwocky.com> to list revoked keys as revoked.  Closes: #231814
+
+  * 14_getkey_not_found_fix.dpatch: new patch from David Shaw
+    <dshaw@jabberwocky.com> to fix --list-sigs incorrectly claiming "User
+    id not found".  Closes: #229549
+
+ -- James Troup <james@nocrew.org>  Fri, 20 Feb 2004 16:38:12 +0000
+  
+gnupg (1.2.4-2) unstable; urgency=low
+
+  * mpi/hppa1.1/udiv-qrnnd.S: patch from LaMont Jones <lamont@debian.org>
+    to fix unaligned constant.  Closes: #228456
+  * debian/copyright: update year and version number.
+
+ -- James Troup <james@nocrew.org>  Tue, 20 Jan 2004 17:19:58 +0000
+
+gnupg (1.2.4-1) unstable; urgency=medium
+
+  * New upstream release.
+   * Most support for ElGamal Sign+Encrypt keys has been removed. Closes: #222293
+   * No longer miss-identifies GNU/KFreeBSD as GNU/Hurd. Closes: #216957
+   * Fixes build error on GNU/KFreeBSD (and Glibc-based GNU/KNetBSD). Closes: #221079
+   * Fixes segmentation fault in prime generator. Closes: #213989
+   * Fixes trustdb not updating without ultimately trusted keys. Closes: #222368
+
+  * debian/control (Build-Depends): add libbz2-dev.
+
+ -- James Troup <james@nocrew.org>  Wed, 31 Dec 2003 17:57:52 +0000
+
+gnupg (1.2.3-1) unstable; urgency=low
+
+  * New upstream release (Closes: #207340).
+   * gpg no longer kills keyrings by importing broken keys.  Closes: #196505
+   * options.skel uses subkeys.pgp.net instead of pgp.mit.edu. Closes: #206092
+   * --import now closes files when it's done. Closes: #196643
+   * A key listing speed regression has been fixed. Closes: #192083
+  * debian/copyright: update URL and date.
+  * debian/rules: update dates and version.
+
+  * debian/control (Standards-Version): bump to 3.6.0.
+
+  * debian/Upgrading_From_PGP.txt: new file from to Richard Braakman
+    <dark@xs4all.nl>.  Closes: #173233
+  * debian/rules (binary-arch): install it.
+
+  * debian/rules (build): correct libexecdir passed to configure; patch
+    from Matthias Cramer <cramer@freestone.net>.  Fixes invocation of
+    gpgkeys_ldap.  Closes: #168486
+
+ -- James Troup <james@nocrew.org>  Thu, 28 Aug 2003 14:08:50 +0100
+
+gnupg (1.2.2-1) unstable; urgency=low
+
+  * New upstream release.
+  * debian/control (Standards-Version): bump to 3.5.9.0.
+  * debian/rules (binary-arch): install convert-from-106 as
+    gpg-convert-from-106 and fix the path to gpg.
+  * debian/control: remove trailing full stop from short description.
+  * debian/control: remove out-dated and contradictory information about
+    RSA.
+
+ -- James Troup <james@nocrew.org>  Mon,  5 May 2003 03:08:58 +0100
+
+gnupg (1.2.1-2) unstable; urgency=low
+
+  * Update config.guess (to 2002-10-21) and config.sub (to 2002-09-05).
+    Thanks to Ryan Murray.  Closes: #166696
+
+ -- James Troup <james@nocrew.org>  Mon, 28 Oct 2002 01:47:26 +0000
+
+gnupg (1.2.1-1) unstable; urgency=low
+
+  * New upstream version.
+   * An inifinte loop in --update-trustdb has been fixed.  Closes: #162039
+   * The polish translation is now correctly specified as UTF-8.  Closes: #162885
+   * --refresh-keys is now documented in the manpage.  Closes: #165566
+  * debian/control (Conflicts): add gpg-idea <= 2.2 since gnupg >= 1.2 is
+    incompatible with that version of gpg-idea.  Closes: #162314
+
+ -- James Troup <james@nocrew.org>  Fri, 25 Oct 2002 18:18:43 +0100
+
+gnupg (1.2.0-1) unstable; urgency=low
+
+  * New upstream version.  Closes: #161817.
+   * --options no longer mis-handles a directory as an argument.  Closes: #151973
+   * gpg now prompts before sending all keys to the keyserver.  Closes: #64607
+   * There is now a gnupg(7) manpage.  Closes: #157750
+   * The permission checking has been sanitized and handles non-home-dir
+     keyrings better.  Closes: #147760
+   * notation data longer than 5 characters is now handled.  Closes: #156871
+   * an abort when setting trust levels in a czech locale has been fixed.
+     Closes: #149212
+  * debian/rules (binary-arch): there are no more modules, adjust
+    accordingly.
+  * debian/postinst, debian/prerm: remove; no longer do /usr/doc symlinks.
+  * debian/rules (binary-arch): don't install obsolete postinst or prerm.
+  * debian/rules (binary-arch): gzip gnupg.7 too.
+  * debian/rules (build): pass --libexecdir=/usr/lib/gnupg to configure.
+  * debian/rules (binary-arch): likewise, pass suitable libexcedir
+    argument to make install.
+  * debian/control (Standards-Version): update to 3.5.7.0.
+  * debian/copyright: update URL and date.
+  * debian/rules: update dates and version.
+
+ -- James Troup <james@nocrew.org>  Sun, 22 Sep 2002 22:26:25 +0100
+
+gnupg (1.0.7-2) unstable; urgency=low
+
+  * debian/control (Suggests): add xloadimage since that's what gpg uses
+    by default to view photo IDs.  Thanks to Julien Danjou
+    <acid@debian.org> for the suggestion.  Closes: #156245
+  * debian/control (Depends): add "hurd" to the alternatives to
+    makedev. Thanks to Michal Suchanek <hramrach_l@centrum.cz> for
+    noticing.  Closes: #158492
+  * po/it.po: patch to fix typos from Marco Bodrato
+    <bodrato@gulp.linux.it.  Closes: #149462
+  * g10/g10.c (main): remove the bogus undef of USE_SHM_COPROCESSING to
+    match upstream and fix gabber and libgnupg-perl.  Closes: #147679, #151969
+
+ -- James Troup <james@nocrew.org>  Thu, 29 Aug 2002 01:42:58 +0100
+
+gnupg (1.0.7-1) unstable; urgency=low
+
+  * New upstream version.  Closes: #145477.
+    * GDBM support has been removed.  Closes: #33009.
+    * Now adds the default keyring when a keyring is specified.
+      Closes: #50616, #65260.
+    * Now does the Right Thing when receiving a key from the keyserver and
+      the key in question is in both a read-only and writable keyring.
+      Closes: #63297.
+    * Automatic key retrieval is now configurable.  Closes: #64940.
+    * --no-options supresses ~/.gnupg creation again.  Closes: #95486.
+    * duplicate trust entries are no longer treated as an error. Closes: #96480.
+    * There's now no comment line in ascii armours. Closes: #100088.
+    * Handle secret keyring given as keyring better.  Closes: #100581, #106670.
+    * It's now documented that --with-colons unconditionally uses UTF8.
+      Closes: #101446, 101454.
+    * s/now/knows/ typo in manpage fixed.  Closes: #107471.
+    * There's now support for a primary UID.  Closes: #106567, #108155.
+    * Handles errors in uncompression layer beter. Closes: #112392.
+    * Key selection has been entirely revamped.  Closes: #136170.
+    * Handles empty encrypt-to. Closes: #138378
+
+  * debian/rules (binary-arch): remove empty /usr/info directory, thanks
+    to Joey Hess <joeyh@debian.org>.  Closes: #121864.
+  * debian/control: remove duplicated word from long description, thanks
+    to Nicolas Boulenguez <nicolas.boulenguez@free.fr>.  Closes: #144786.
+  * README: correct URL to GPH and other docs, thanks to Mark Brown
+    <broonie@sirena.org.uk>.  Closes: #100277.
+  * debian/control (Standards-Version): updated to 3.5.6.1.
+  * debian/rules (binary-arch): only strip ELF binaries.  es_ES -> es hack
+    no longer needed as fixed upstream.
+  * debian/control (Build-Depends): remove libgdbmg1-dev; no longer used.
+  * debian/README.Debian: remove note about gdbm support which was finally
+    removed.  Update note on old versions of gnupg to reflect the
+    pre-historic nature of those versions.
+  * debian/control (Build-Depends): add libldap2-dev.
+  * debian/rules (binary-arch): call dpkg-shlibdeps for all ELF binaries.
+  * debian/control (Build-Depends): add file.
+  * debian/control (Priority): increase to standard to match overrides.
+
+ -- James Troup <james@nocrew.org>  Sat, 11 May 2002 15:08:02 +0100
+
+gnupg (1.0.6-3) unstable; urgency=low
+
+  * moved into main.
+
+ -- James Troup <james@nocrew.org>  Tue, 19 Mar 2002 16:17:09 +0000
+
+gnupg (1.0.6-2) unstable; urgency=high
+
+  * debian/rules (binary-arch): remove the erroneous
+    /usr/share/locale/locale.alias that 'make install' adds; closes:
+    #99293.
+
+ -- James Troup <james@nocrew.org>  Wed, 30 May 2001 20:40:59 +0100
+
+gnupg (1.0.6-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <james@nocrew.org>  Tue, 29 May 2001 20:59:49 +0100
+
+gnupg (1.0.5-4) unstable; urgency=low
+
+  * Patch from Werner.
+
+ -- James Troup <james@nocrew.org>  Sun, 27 May 2001 09:34:50 +0100
+
+gnupg (1.0.5-3) unstable; urgency=low
+
+  * Apply patch from Matthew Wilcox <matthew@wil.cx> to fix assembly on
+    hppa.
+
+ -- James Troup <james@nocrew.org>  Sun, 13 May 2001 02:36:45 +0100
+
+gnupg (1.0.5-2) unstable; urgency=medium
+
+  * util/http.c: patch from Werner that fixes --send-key, closes: #96277.
+  * debian/control (Depends): accept devfsd in place of makedev, closes:
+    #96307.
+
+ -- James Troup <james@nocrew.org>  Mon,  7 May 2001 00:13:51 +0100
+
+gnupg (1.0.5-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/README.Debian: fix spelling and update URL.
+  * debian/rules (binary): remove the new info files.
+  * scripts/config.{guess,sub}: sync with subversions, closes: #95729.
+
+ -- James Troup <james@nocrew.org>  Mon, 30 Apr 2001 02:12:38 +0100
+
+gnupg (1.0.4-4) unstable; urgency=low
+
+  * po/ru.po: patch by Ilya Martynov <m_ilya@agava.com> to replace German
+    entries and add missing translations, closes: #93987.
+  * g10/revoke.c (ask_revocation_reason): typo fix (s/non longer/no
+    longer/g); noticed by Colin Watson <cjw44@flatline.org.uk>, closes:
+    #93664.
+
+  * Deprecated depreciated; noticed by Vincent Broman
+    <broman@spawar.navy.mil>.
+
+  * Following two patches are from Vincent Broman.
+  * g10/mainproc.c (proc_tree): use iobuf_get_real_fname() in preference
+    to iobuf_get_fname().
+  * g10/openfile.c (open_sigfile): handle .sign prefixed files correctly.
+
+ -- James Troup <james@nocrew.org>  Fri, 20 Apr 2001 23:32:44 +0100
+
+gnupg (1.0.4-3) unstable; urgency=medium
+
+  * debian/rules (binary): make gpg binary suid, closes: #86433.
+  * debian/postinst: don't use suidregister.
+  * debian/postrm: removed (only called suidunregister).
+  * debian/control: conflict with suidmanager << 0.50.
+  * mpi/longlong.h: apply fix for ARM long long artimetic from Philip
+    Blundell <philb@gnu.org>, closes: #87487.
+  * debian/preinst: the old GnuPG debs have moved to people.debian.org.
+  * cipher/random.c: #include <time.h> as well as <sys/time.h>
+  * g10/misc.c: likewise.
+  * debian/rules: define a strip alias which removes the .comment and
+    .note sections.
+  * debian/rules (binary-arch): use it.
+  * debian/lintian.override: new file; override the SUID warning from
+    lintian.
+  * debian/rules (binary-arch): install it.
+
+ -- James Troup <james@nocrew.org>  Sun, 25 Feb 2001 05:24:58 +0000
+
+gnupg (1.0.4-2) stable unstable; urgency=high
+
+  * Apply security fix patch from Werner.
+  * Apply another patch from Werner to fix bogus warning on Rijndael
+    usage.
+  * Change section to 'non-US'.
+
+ -- James Troup <james@nocrew.org>  Mon, 12 Feb 2001 07:47:02 +0000
+
+gnupg (1.0.4-1) stable unstable; urgency=high
+
+  * New upstream version.
+  * Fixes a serious bug which could lead to false signature verification
+    results when more than one signature is fed to gpg.
+
+ -- James Troup <james@nocrew.org>  Tue, 17 Oct 2000 17:26:17 +0100
+
+gnupg (1.0.3b-1) unstable; urgency=low
+
+  * New upstream snapshot version.
+
+ -- James Troup <james@nocrew.org>  Fri, 13 Oct 2000 18:08:14 +0100
+
+gnupg (1.0.3-2) unstable; urgency=low
+
+  * debian/control: Conflict, Replace and Provide gpg-rsa & gpg-rsaref.
+    Fix long description to reflect the fact that RSA is no longer
+    patented and now included. [#72177]
+  * debian/rules: move faq.html to /usr/share/doc/gnupg/ and remove FAQ
+    from /usr/share/gnupg/.  Thanks to Robert Luberda
+    <robert@pingu.ii.uj.edu.pl> for noticing. [#72151]
+  * debian/control: Suggest new package gnupg-doc. [#64323, #65560]
+  * utils/secmem.c (lock_pool): don't bomb out if mlock() returns ENOMEM,
+    as Linux will do this if resource limits (or other reasons) prevent
+    memory from being locked, instead treat it like permission was denied
+    and warn but continue.  Thanks to Topi Miettinen
+    <Topi.Miettinen@nic.fi>. [#70446]
+  * g10/hkp.c (not_implemented): s/ist/is/ in error message.
+  * debian/README.Debian: add a note about GDBM support and why it is
+    disabled.  Upstream already fixed the manpage.  [#65913]
+  * debian/rules (binary-arch): fix the Spanish translation to be 'es' not
+    'es_ES' at Nicolás Lichtmaier <nick@debian.org>'s request. [#57314]
+
+ -- James Troup <james@nocrew.org>  Sun,  1 Oct 2000 14:55:03 +0100
+
+gnupg (1.0.3-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <james@nocrew.org>  Mon, 18 Sep 2000 15:56:54 +0100
+
+gnupg (1.0.2-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <james@nocrew.org>  Thu, 13 Jul 2000 20:26:50 +0100
+
+gnupg (1.0.1-2) unstable; urgency=low
+
+  * debian/control (Build-Depends): added.
+  * debian/copyright: corrected location of copyright file.  Removed
+    references to Linux.  Removed warnings about beta nature of GnuPG.
+  * debian/rules (binary-arch): install documentation into
+    /usr/share/doc/gnupg/ and pass mandir to make install to ensure the
+    manpages go to /usr/share/man/.
+  * debian/postinst: create /usr/doc/gnupg symlink.
+  * debian/prerm: new file; remove /usr/doc/gnupg symlink.
+  * debian/rules (binary-arch): install prerm.
+  * debian/control (Standards-Version): updated to 3.1.1.1.
+
+ -- James Troup <james@nocrew.org>  Thu, 30 Dec 1999 16:16:49 +0000
+
+gnupg (1.0.1-1) unstable; urgency=low
+
+  * New upstream version.
+  * doc/gpg.1: updated to something usable from
+    ftp://ftp.gnupg.org/pub/gcrypt/gnupg/gpg.1.gz.
+
+ -- James Troup <james@nocrew.org>  Sun, 19 Dec 1999 23:47:10 +0000
+
+gnupg (1.0.0-3) unstable; urgency=low
+
+  * debian/rules (build): remove the stunningly ill-advised --host option
+    to configure.  [#44698, #48212, #48281]
+
+ -- James Troup <james@nocrew.org>  Tue, 26 Oct 1999 01:12:59 +0100
+
+gnupg (1.0.0-2) unstable; urgency=low
+
+  * debian/rules (binary-arch): fix the permissions on the
+    modules. [#47280]
+  * debian/postinst, debian/postrm: fix the package name passed to
+    suidregister. [#45013]
+  * debian/control: update long description. [#44636]
+  * debian/rules (build): pass the host explicitly to configure to avoid
+    problems on sparc64. [(Should fix) #44698].
+
+ -- James Troup <james@nocrew.org>  Wed, 20 Oct 1999 23:39:05 +0100
+
+gnupg (1.0.0-1) unstable; urgency=low
+
+  * New upstream release. [#44545]
+
+ -- James Troup <james@nocrew.org>  Wed,  8 Sep 1999 00:53:02 +0100
+
+gnupg (0.9.10-2) unstable; urgency=low
+
+  * debian/rules (binary-arch): install lspgpot.  Requested by Kai
+    Henningsen <kai@khms.westfalen.de>. [#42288]
+  * debian/rules (binary-arch): correct the path where modules are looked
+    for.  Reported by Karl M. Hegbloom <karlheg@odin.cc.pdx.edu>. [#40881]
+  * debian/postinst, debian/postrm: under protest, register gpg the
+    package with suidmanager and make it suid by default.
+    [#29780,#32590,#40391]
+
+ -- James Troup <james@nocrew.org>  Tue, 10 Aug 1999 00:12:40 +0100
+
+gnupg (0.9.10-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <james@nocrew.org>  Fri,  6 Aug 1999 01:16:21 +0100
+
+gnupg (0.9.9-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <james@nocrew.org>  Sun, 25 Jul 1999 01:06:31 +0100
+
+gnupg (0.9.8-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/rules (binary-arch): don't create a gpgm manpage as the binary
+    no longer exists.  Noticed by Wichert Akkerman
+    <wichert@cs.leidenuniv.nl>. [#38864]
+
+ -- James Troup <james@nocrew.org>  Sun, 27 Jun 1999 01:07:58 +0100
+
+gnupg (0.9.7-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <james@nocrew.org>  Tue, 25 May 1999 13:23:24 +0100
+
+gnupg (0.9.6-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/copyright: update version number, noticed by Lazarus Long
+    <lazarus@frontiernet.net>.
+  * debian/control (Depends): depend on makedev (>= 2.3.1-13) to ensure
+    that /dev/urandom exists; reported by Steffen Markert
+    <smort@rz.tu-ilmenau.de>. [#32076]
+
+ -- James Troup <james@nocrew.org>  Tue, 11 May 1999 21:06:27 +0100
+
+gnupg (0.9.5-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/control (Description): no tabs.  [Lintian]
+
+ -- James Troup <james@nocrew.org>  Wed, 24 Mar 1999 22:37:40 +0000
+
+gnupg (0.9.4-1) unstable; urgency=low
+
+  * New version.
+  * debian/control: s/GNUPG/GnuPG/
+
+ -- Werner Koch <wk@isil.d.suttle.de>  Mon, 8 Mar 1999 19:58:28 +0100
+
+gnupg (0.9.3-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <james@nocrew.org>  Mon, 22 Feb 1999 22:55:04 +0000
+
+gnupg (0.9.2-1) unstable; urgency=low
+
+  * New version.
+  * debian/rules (build): Removed CFLAGS as the default is now sufficient.
+  * debian/rules (clean): remove special handling cleanup in intl.
+
+ -- Werner Koch <wk@isil.d.suttle.de>  Wed, 20 Jan 1999 21:23:11 +0100
+
+gnupg (0.9.1-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <james@nocrew.org>  Sat,  9 Jan 1999 22:29:11 +0000
+
+gnupg (0.9.0-1) unstable; urgency=low
+
+  * New upstream version.
+  * g10/armor.c (armor_filter): add missing new line in comment string; as
+    noticed by Stainless Steel Rat <ratinox@peorth.gweep.net>.
+
+ -- James Troup <james@nocrew.org>  Tue, 29 Dec 1998 20:22:43 +0000
+
+gnupg (0.4.5-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/rules (clean): force removal of intl/libintl.h which the
+    Makefiles fail to remove properly.
+
+ -- James Troup <james@nocrew.org>  Tue,  8 Dec 1998 22:40:23 +0000
+
+gnupg (0.4.4-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <james@nocrew.org>  Sat, 21 Nov 1998 01:34:29 +0000
+
+gnupg (0.4.3-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/README.Debian: new file; contains same information as is in the
+    preinst.  Suggested by Wichert Akkerman <wichert@cs.leidenuniv.nl>.
+  * debian/rules (binary-arch): install `README.Debian'
+  * debian/control (Standards-Version): updated to 2.5.0.0.
+
+ -- James Troup <james@nocrew.org>  Sun,  8 Nov 1998 19:08:12 +0000
+
+gnupg (0.4.2-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/preinst: improve message about the NEWS file which isn't
+    actually installed when it's referred to, thanks to Martin Mitchell
+    <martin@debian.org>.
+  * debian/rules (binary-arch): don't install the now non-existent `rfcs',
+    but do install `OpenPGP'.
+
+ -- James Troup <james@nocrew.org>  Sun, 18 Oct 1998 22:48:34 +0100
+
+gnupg (0.4.1-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/rules (binary-arch): fix the gpgm manpage symlink now installed
+    by `make install'.
+
+ -- James Troup <james@nocrew.org>  Sun, 11 Oct 1998 17:01:21 +0100
+
+gnupg (0.4.0-1) unstable; urgency=high
+
+  * New upstream version. [#26717]
+  * debian/copyright: tone down warning about alpha nature of gnupg.
+  * debian/copyright: new maintainer address.
+  * debian/control: update extended description.
+  * debian/rules (binary-arch): install FAQ and all ChangeLogs.
+  * debian/preinst: new; check for upgrade from (<= 0.3.2-1) and warn about
+    incompatibilities in keyring format and offer to move old copy out of
+    gpg out of the way for transition strategy and inform the user about
+    the old copies of gnupg available on my web page.
+  * debian/rules (binary-arch) install preinst.
+  * debian/rules (binary-arch): don't depend on the test target as it is
+    now partially interactive (tries to generate a key, which requires
+    someone else to be using the computer).
+
+ -- James Troup <james@nocrew.org>  Thu,  8 Oct 1998 00:47:07 +0100
+
+gnupg (0.3.2-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/control (Maintainer): new address.
+  * debian/copyright: updated list of changes.
+
+ -- James Troup <james@nocrew.org>  Thu,  9 Jul 1998 21:06:07 +0200
+
+gnupg (0.3.1-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <james@nocrew.org>  Tue,  7 Jul 1998 00:26:21 +0200
+
+gnupg (0.3.0-2) unstable; urgency=low
+
+  * Applied bug-fix patch from Werner.
+
+ -- James Troup <jjtroup@comp.brad.ac.uk>  Fri, 26 Jun 1998 12:18:29 +0200
+
+gnupg (0.3.0-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/control: rewrote short and long description.
+  * cipher/Makefile.am: link tiger with -lc.
+  * debian/rules (binary-arch): strip loadable modules.
+  * util/secmem.c (lock_pool): get rid of errant test code; fix from
+    Werner Koch <wk@isil.d.shuttle.de>.
+  * debian/rules (test): new target which runs gnupg's test suite.
+    binary-arch depends on it, to ensure it's run whenever the package is
+    built.
+
+ -- James Troup <jjtroup@comp.brad.ac.uk>  Thu, 25 Jun 1998 16:04:57 +0200
+
+gnupg (0.2.19-1) unstable; urgency=low
+
+  * New upstream version.
+  * debian/control: Updated long description.
+
+ -- James Troup <jjtroup@comp.brad.ac.uk>  Sat, 30 May 1998 12:12:35 +0200
+
+gnupg (0.2.18-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <J.J.Troup@comp.brad.ac.uk>  Sat, 16 May 1998 11:52:47 +0200
+
+gnupg (0.2.17-1) unstable; urgency=high
+
+  * New upstream version.
+  * debian/control (Standards-Version): updated to 2.4.1.0.
+  * debian/control: tone down warning about alpha nature of gnupg, as per
+    README.
+  * debian/copyright: ditto.
+
+ -- James Troup <jjtroup@comp.brad.ac.uk>  Mon,  4 May 1998 22:36:51 +0200
+
+gnupg (0.2.15-1) unstable; urgency=high
+
+  * New upstream version.
+
+ -- James Troup <jjtroup@comp.brad.ac.uk>  Fri, 10 Apr 1998 01:12:20 +0100
+
+gnupg (0.2.13-1) unstable; urgency=high
+
+  * New upstream version.
+
+ -- James Troup <jjtroup@comp.brad.ac.uk>  Wed, 11 Mar 1998 01:52:51 +0000
+
+gnupg (0.2.12-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <jjtroup@comp.brad.ac.uk>  Sat,  7 Mar 1998 13:52:40 +0000
+
+gnupg (0.2.11-1) unstable; urgency=low
+
+  * New upstream version.
+
+ -- James Troup <jjtroup@comp.brad.ac.uk>  Wed,  4 Mar 1998 01:32:12 +0000
+
+gnupg (0.2.10-1) unstable; urgency=low
+
+  * New upstream version.
+  * Name changed upstream.
+
+ -- James Troup <jjtroup@comp.brad.ac.uk>  Mon,  2 Mar 1998 07:32:05 +0000
+
+g10 (0.2.7-1) unstable; urgency=low
+
+  * Initial release.
+
+ -- James Troup <jjtroup@comp.brad.ac.uk>  Fri, 20 Feb 1998 02:05:34 +0000
--- gnupg-1.4.10.orig/debian/gnupg.manpages
+++ gnupg-1.4.10/debian/gnupg.manpages
@@ -0,0 +1,3 @@
+debian/gpgsplit.1
+debian/lspgpot.1
+debian/gpg-zip.1
--- gnupg-1.4.10.orig/debian/gnupg-udeb.install
+++ gnupg-1.4.10/debian/gnupg-udeb.install
@@ -0,0 +1 @@
+build-udeb/g10/gpg usr/bin/
--- gnupg-1.4.10.orig/debian/gpgv.files
+++ gnupg-1.4.10/debian/gpgv.files
@@ -0,0 +1,2 @@
+usr/bin/gpgv
+usr/share/man/man1/gpgv.1
--- gnupg-1.4.10.orig/debian/control
+++ gnupg-1.4.10/debian/control
@@ -0,0 +1,98 @@
+Source: gnupg
+Section: utils
+Priority: important
+Maintainer: Debian GnuPG-Maintainers <pkg-gnupg-maint@lists.alioth.debian.org>
+Uploaders: Sune Vuorela <debian@pusling.com>,
+ Daniel Leidert (dale) <daniel.leidert@wgdd.de>,
+ Thijs Kinkhorst <thijs@debian.org>
+Standards-Version: 3.8.4
+Build-Depends: debhelper (>> 7), libz-dev, libldap2-dev, libbz2-dev,
+ libusb-dev [!hurd-i386],
+ libreadline-dev, file, gettext, dpatch,
+ libcurl4-gnutls-dev
+Homepage: http://www.gnupg.org
+Vcs-Browser: http://svn.debian.org/wsvn/pkg-gnupg/gnupg/
+Vcs-Svn: svn://svn.debian.org/svn/pkg-gnupg/gnupg/trunk/
+
+Package: gnupg
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, gpgv
+Recommends: ${shlibs:Recommends}, gnupg-curl
+Suggests: gnupg-doc, xloadimage | imagemagick | eog, libpcsclite1
+Description: GNU privacy guard - a free PGP replacement
+ GnuPG is GNU's tool for secure communication and data storage.
+ It can be used to encrypt data and to create digital signatures.
+ It includes an advanced key management facility and is compliant
+ with the proposed OpenPGP Internet standard as described in RFC2440.
+ .
+ GnuPG 1.4 is the standalone, non-modularized series. In contrast to
+ the version 2 series, shipped with the gnupg2 package, it comes
+ with no support for S/MIME and some other tools useful for desktop
+ environments, but also with less dependencies.
+ .
+ The gnupg package is built without libcurl. So it does not support
+ HKPS keyservers. Install the gnupg-curl package if you want to use
+ the keyserver helper tools built with libcurl and supporting HKPS.
+ .
+ GnuPG does not use any patented algorithms. This means it cannot be
+ compatible with PGP2, because that uses IDEA (which is patented in
+ a number of countries).
+
+Package: gnupg-curl
+Priority: optional
+Architecture: any
+Depends: ${shlibs:Depends}, ${shlibs:Recommends}, ${misc:Depends}, gnupg
+Description: GNU privacy guard - a free PGP replacement (cURL)
+ GnuPG is GNU's tool for secure communication and data storage.
+ It can be used to encrypt data and to create digital signatures.
+ It includes an advanced key management facility and is compliant
+ with the proposed OpenPGP Internet standard as described in RFC2440.
+ .
+ This package contains the keyserver helper tools built with libcurl,
+ which replace the ones in the gnupg package built with the "curl shim"
+ variant of gnupg. This package provides support for HKPS keyservers.
+ .
+ GnuPG does not use any patented algorithms. This means it cannot be
+ compatible with PGP2, because that uses IDEA (which is patented in
+ a number of countries).
+
+Package: gpgv
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Suggests: gnupg
+Description: GNU privacy guard - signature verification tool
+ GnuPG is GNU's tool for secure communication and data storage.
+ .
+ gpgv is a stripped-down version of gnupg which is only able to check
+ signatures.  It is smaller than the full-blown gnupg and uses a
+ different (and simpler) way to check that the public keys used to
+ make the signature are trustworthy.
+
+Package: gnupg-udeb
+XC-Package-Type: udeb
+Section: debian-installer
+Priority: extra
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: GNU privacy guard - a free PGP replacement
+ GnuPG is GNU's tool for secure communication and data storage.
+ It can be used to encrypt data and to create digital signatures.
+ It includes an advanced key management facility and is compliant
+ with the proposed OpenPGP Internet standard as described in RFC2440.
+ .
+ This is GnuPG packaged in minimal form for use in debian-installer.
+
+Package: gpgv-udeb
+XC-Package-Type: udeb
+Section: debian-installer
+Priority: extra
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: minimal signature verification tool
+ GnuPG is GNU's tool for secure communication and data storage.
+ It can be used to encrypt data and to create digital signatures.
+ It includes an advanced key management facility and is compliant
+ with the proposed OpenPGP Internet standard as described in RFC2440.
+ .
+ This is GnuPG's signature verification tool, gpgv, packaged in minimal
+ form for use in debian-installer.
--- gnupg-1.4.10.orig/debian/TODO
+++ gnupg-1.4.10/debian/TODO
@@ -0,0 +1,45 @@
+TODO
+
+* fixed in older releases and  probably even not relevant in 1.4.x anymore (in
+  braces the upstream tracker item number):
+  
+  #113897: "Oops: lock already hold by us" when using --fast-import (not 100% sure)
+
+  the following I'm not 100% sure:
+  #166794,
+  #172823: --search leads to segfault
+
+
+* Ubuntu patches:
+
+  debian/patches/61_use_agent_default.dpatch: we should decide if used as default
+
+* discuss
+
+  - if gpg should be put into /bin (#477671)
+
+  - if keyserver-options verbose should be default (#474569)
+
+  - why does gnupg depend on gpgv and can this perhaps be made less strong?
+
+general:
+
+
+==============================================================================
+
+
+* Close candidate (upstream rejected change):
+
+ #38857: gnupg: no way to copy a key
+ #61914: gnupg: confusing question in gpg key generation process (I cannot agree)
+ #93656: gnupg; No way to specify multiple keyservers? (#139)
+#162742: gnupg: Please handle "deprecated option honor-http-proxy"
+#173586: gnupg: Suggestion for a better error message
+#185782: `--batch --output existingfile' outputs nothing and exits 0
+#196681: gnupg: gpg says /dev/null@alea isn't a valid email address
+#290980: gnupg: 'gpg -q --verify' should be quiet on success (#919)
+#310805: gnupg: fully exportable armored homedir is completely impossible now!
+#318587: gnupg: should encrypt to all subkeys
+
+#300743: gnupg: Should not depend on libusb
+
--- gnupg-1.4.10.orig/debian/gnupg.examples
+++ gnupg-1.4.10/debian/gnupg.examples
@@ -0,0 +1 @@
+tools/convert-from-106
--- gnupg-1.4.10.orig/debian/README.BUGS.Debian
+++ gnupg-1.4.10/debian/README.BUGS.Debian
@@ -0,0 +1,112 @@
+Frequently Reported Issues for gnupg in Debian
+----------------------------------------------
+
+This file is intended to collect information about issues and limitations in
+gnupg, which have been reported to the Debian bug-tracking system (BTS) for
+gnupg.
+
+    <URL:http://bugs.debian.org/src:gnupg>
+
+Make sure you checked the information here before reporting an issue to the
+Debian BTS. Please note, that most of the reports have been forwarded
+upstream, and that this file just expresses what upstream told us. For many
+of these reports, items in the upstream bug tracker have been opened. So in
+rare cases, a limitation might get fixed in future releases of GnuPG.
+
+
+gnupg: When creating a signature, it does not necessarily preserve the
+       permissions of the signed file.  
+
+    [..] I don't see the problem with this. In same cases we could create a
+         file with the same permissions as the source file but not in all.
+         Often gpg does not work on the file but just reads the content. This
+         common Unix behaviour (cf. cat(1)).  If there are concerns, make sure
+         the umask has ben set properly. 
+         .
+         Sor signing confidential files, a detached signature is anyway a
+         better choice.
+         .
+         Another reason not to change it is that it changes the interface and
+         thus would break myriads of scripts. [..] (Werner Koch)
+
+    Debian #44910 <URL:http://bugs.debian.org/44910>
+
+
+gnupg: I wish I could sign multiple files in one pass.
+
+    [..] IIRC, the sematics of sign are too complicated for --multifile. If
+         the problem is just to avoid entering a passphrase several times,
+         gpg-agent is very helpful and solves the problem nicely. [..]
+         (Werner Koch)
+
+    Debian #89094 <URL:http://bugs.debian.org/89094>
+    GnuPG  #1041  <URL:https://bugs.g10code.com/gnupg/issue1041>
+
+
+gnupg: I want to extract a signature from a signed and encrypted file.
+
+    [..] This is the occasionally-requested "--unwrap" command which would
+         stop processing after a single layer of the file.  I.e. convert
+         Enc(Sign(data)) to Sign(data). [..] (David Shaw)
+
+    Debian #282061 <URL:http://bugs.debian.org/282061>
+    GnuPG  #1060   <URL:https://bugs.g10code.com/gnupg/issue1060>
+    <URL:http://lists.gnupg.org/pipermail/gnupg-users/2001-August/009588.html
+    <URL:http://lists.gnupg.org/pipermail/gnupg-users/2004-April/022352.html
+
+
+gnupg: Piping content to gpg: echo foo | gpg --use-agent ... errors out with
+       `gpg: cancelled by user'
+
+    This might happen when gpg is unable to determine the correct name of the
+    terminal. You can check the terminal given to the agent by running
+    gpg-agent with the --debug-level advanced switch. The output might contain:
+
+        gpg-agent[XXX] DBG: <- OPTION ttyname=/dev/tty
+
+    whereas the output of tty says
+
+        /dev/pts/X
+
+    You'll have to set GPG_TTY to point to the correct terminal (see also
+    gpg-agent(1)).
+
+    Debian #359758 <URL:http://bugs.debian.org/359758>
+    GnuPG  #1047   <URL:https://bugs.g10code.com/gnupg/issue1047>
+
+
+gnupg: I get a passphrase entry window (from pinentry*) although I used
+       the --passphrase switch.
+
+    [..] That is as it should be. [..] (Werner Koch)
+
+    gpg won't send the value of --passphrase given on the command line to the
+    configured agent.
+
+    Debian #427857 <URL:http://bugs.debian.org/427857>
+
+
+gnupg: Sets key expiry date in the past.
+
+    When setting the expiry time to values bigger than 97 years (years
+    >2106), gpg creates a key with expiry date set in the past. This is
+    due to using a 32 bit integer to represent the date. It's currently
+    an unfixable limitation.
+
+    Debian #472642 <URL:http://bugs.debian.org/472642>
+    <URL:http://lists.gnupg.org/pipermail/gnupg-devel/2008-June/024388.html>
+
+
+gnupg: Dies with "Ohhhh jeeeee: ... this is a bug".
+
+    Since gnupg 1.4.6-2.2 we don't install the gpg(1) binary setuid root
+    anymore. If you observe the error message because of this change, then
+    you can use dpkg-statoverride(1) to change the permissions of the binary
+    permanently (for example to set them setuid root):
+
+        dpkg-statoverride --update --add root root 4755 /usr/bin/gpg
+
+    Debian #485458 <URL:http://bugs.debian.org/485458>
+
+
+ -- Daniel Leidert <daniel.leidert@wgdd.de>, 2009
--- gnupg-1.4.10.orig/debian/gnupg.doc-base.faq
+++ gnupg-1.4.10/debian/gnupg.doc-base.faq
@@ -0,0 +1,11 @@
+Document: gnupg-faq
+Title: GnuPG Frequently Asked Questions
+Author: David D. Scribner <faq@gnupg.org>
+Abstract: The GnuPG FAQ contains a list of frequently occuring questions
+ and their answers regarding installation, usage, compatibility,
+ issues, warning and error messages of GnuPG.
+Section: System/Security
+
+Format: HTML
+Index: /usr/share/doc/gnupg/faq.html
+Files: /usr/share/doc/gnupg/faq.html
--- gnupg-1.4.10.orig/debian/Upgrading_From_PGP.txt
+++ gnupg-1.4.10/debian/Upgrading_From_PGP.txt
@@ -0,0 +1,76 @@
+For a long time I have wanted to switch from using PGP 2.x to using GPG
+(because it's Free).  But I didn't want to give up my trusty PGP key,
+which has a long history and has gathered a lot of signatures that
+I would have trouble getting again.
+
+Now that the RSA patent has expired, GPG comes with RSA support
+by default.  This means that it's actually possible to convert
+your PGP key to a GPG key, and use it normally with GPG.  You
+will not need gpg-idea or any other non-free component.
+
+The steps are quite easy.  I wrote them down here, because I expect
+that a number of Debian maintainers are in the same situation
+and can benefit from this advice.
+
+Note that the GPG FAQ contains a section about the same thing,
+but it's aimed at maintaining compatibility with PGP 2.x.
+The procedure I describe here is designed solely to switch
+to GPG without giving up your PGP key.  It will not let you
+exchange encrypted mail with someone who still uses (only) PGP 2.x.
+But if you ever need to do that, you can pull out your old copy
+of PGP for that -- it's the same key!
+
+Here are the steps:
+
+  0. Make sure your version of GPG supports RSA.  You should be
+     okay if you have GPG 1.0.3 or newer.  I used GPG 1.0.4 myself.
+
+  1. Back up your .pgp directory, and your .gnupg directory (if any).
+     Note: I started with an empty .gnupg directory for this.
+     If you already have a GPG ring with a set of keys, you'll
+     end up having two keys with probably the same userids.
+     That won't break anything, but it can be confusing and it
+     is easy to accidentally use the wrong key.
+
+  2. Remove the passphrase from your PGP secret key.  This is necessary
+     because the secret key is protected using the IDEA algorithm, and
+     IDEA is still patented so GPG does not support it.
+     Command:
+     pgp -ke userid
+     where userid is what you use to access your key, usually your name
+     or email address.  Just hit Enter when PGP asks for the new
+     passphrase.
+
+  3. Import your secret and public keys into GPG.
+     Command:
+     gpg --import $HOME/.pgp/secring.pgp $HOME/.pgp/pubring.pgp
+     There doesn't seem to be a way to tell GPG to import only selected
+     keys from those files, so you may want to first use PGP to export
+     your keys to a small keyring.  (Do not use ASCII armor for that.)
+     I simply imported all the keys, because I wanted to convert to using
+     GPG for everything.
+
+  4. Re-protect your secret key with a passphrase.
+     You removed the passphrase in step 2, you can now put it back.
+     Command:
+     gpg --edit-key userid
+     GPG will tell you what key you accessed and prompt you to do
+     something with it.  Tell it "passwd" to change the passphrase.
+
+  5. Check if everything worked.  Sign and encrypt a small file,
+     mail it to a friend, see if you can decrypt something mailed
+     to you, upload a Debian package, that sort of thing.
+
+  6. Clean up the backups.  Remember, you un-protected your PGP key.
+     It's still not protected, and it's the same key you are now using
+     with GPG.  Make sure no one can get at it.  You can restore
+     the backup, or run pgp -ke again, or -- if you don't plan to ever
+     use PGP again -- delete the key.  There is a program in fileutils
+     called "shred" which may help with this.
+
+Well, I hope this helps someone.  I wrote this down after exactly one
+experience with converting keys -- I'd love to have feedback from
+someone else who tried it.
+
+Richard Braakman
+with tips from Adam Rogoyski, Marco d'Itri, and Andrew Pimlott.
--- gnupg-1.4.10.orig/debian/gnupg-curl.postrm
+++ gnupg-1.4.10/debian/gnupg-curl.postrm
@@ -0,0 +1,17 @@
+#!/bin/sh
+# postrm script for gnupg-curl
+#
+# see: dh_installdeb(1)
+
+set -e
+
+if [ "$1" = remove ] ; then
+	dpkg-divert --package gnupg-curl --rename \
+	   --remove /usr/lib/gnupg/gpgkeys_curl
+	dpkg-divert --package gnupg-curl --rename \
+	   --remove /usr/lib/gnupg/gpgkeys_hkp
+fi
+
+#DEBHELPER#
+
+exit 0
--- gnupg-1.4.10.orig/debian/gnupg.bug-presubj
+++ gnupg-1.4.10/debian/gnupg.bug-presubj
@@ -0,0 +1,2 @@
+Please consider reading /usr/share/doc/gnupg/README.BUGS.Debian before
+sending a bug report. Maybe you'll find your problem there.
--- gnupg-1.4.10.orig/debian/copyright
+++ gnupg-1.4.10/debian/copyright
@@ -0,0 +1,41 @@
+This is Debian GNU's prepackaged version of GnuPG, a free PGP
+replacement.
+
+This package was put together by me, James Troup <james@nocrew.org>,
+from the sources, which I obtained from
+ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-1.4.6.tar.gz.  The changes were
+minimal, namely:
+
+- adding support for the Debian package maintenance scheme, by adding
+  various debian/* files.
+
+Program Copyright (C) 1998-2009 Free Software Foundation, Inc.
+Modifications for Debian Copyright (C) 1998-2006 James Troup,
+2008-2009 Daniel Leidert, Sune Vuorela, Thijs Kinkhorst.
+
+GnuPG is free software; you can redistribute it and/or modify it under
+the terms of the GNU General Public License as published by the Free
+Software Foundation; either version 3 of the License, or (at your
+option) any later version.
+
+GnuPG is distributed in the hope that it will be useful, but WITHOUT
+ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+for more details.
+
+You should have received a copy of the GNU General Public License with
+your Debian GNU system, in /usr/share/common-licenses/GPL, or with the
+Debian GNU gnupg source package as the file COPYING.  If not, see
+<http://www.gnu.org/licenses/> or write to the Free Software Foundation,
+Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
+
+In addition, as a special exception, the Free Software Foundation
+gives permission to link the code of the keyserver helper tools:
+gpgkeys_ldap, gpgkeys_curl and gpgkeys_hkp with the OpenSSL project's
+"OpenSSL" library (or with modified versions of it that use the same
+license as the "OpenSSL" library), and distribute the linked
+executables.  You must obey the GNU General Public License in all
+respects for all of the code used other than "OpenSSL".  If you modify
+this file, you may extend this exception to your version of the file,
+but you are not obligated to do so.  If you do not wish to do so,
+delete this exception statement from your version.
--- gnupg-1.4.10.orig/debian/lspgpot.1
+++ gnupg-1.4.10/debian/lspgpot.1
@@ -0,0 +1,22 @@
+.TH "lspgpot" 1 "December 2005" 
+
+.SH NAME
+lspgpot - extracts the ownertrust values from PGP keyrings and list them in
+GnuPG ownertrust format.
+
+
+.SH SYNOPSIS
+.B lspgpot
+
+
+.SH DESCRIPTION
+.B lspgpot
+extracts the ownertrust values from PGP keyrings and list them in
+GnuPG ownertrust format.
+
+.SH AUTHOR
+Copyright (C) 2002 Free Software Foundation, Inc. Please report bugs to
+<bug-gnupg@gnu.org>.
+
+This manpage was written by Francois Wendling <frwendling@free.fr>.
+
--- gnupg-1.4.10.orig/debian/gpgv-udeb.install
+++ gnupg-1.4.10/debian/gpgv-udeb.install
@@ -0,0 +1 @@
+build-udeb/g10/gpgv usr/bin/
--- gnupg-1.4.10.orig/debian/README.source
+++ gnupg-1.4.10/debian/README.source
@@ -0,0 +1,3 @@
+GnuPG's source is managed with dpatch. To get the source ready to be compiled,
+run `debian/rules patch`. For other usage information please refer to the
+dpatch documentation in /usr/share/doc/dpatch.
--- gnupg-1.4.10.orig/debian/gnupg-curl.preinst
+++ gnupg-1.4.10/debian/gnupg-curl.preinst
@@ -0,0 +1,19 @@
+#!/bin/sh
+# preinst script for gnupg-curl
+#
+# see: dh_installdeb(1)
+
+set -e
+
+if [ "$1" = install ] || [ "$1" = upgrade ] ; then
+	dpkg-divert --package gnupg-curl \
+	   --divert /usr/lib/gnupg/gpgkeys_curl.non_curl \
+	   --rename /usr/lib/gnupg/gpgkeys_curl
+	dpkg-divert --package gnupg-curl \
+	   --divert /usr/lib/gnupg/gpgkeys_hkp.non_curl \
+	   --rename /usr/lib/gnupg/gpgkeys_hkp
+fi
+
+#DEBHELPER#
+
+exit 0
--- gnupg-1.4.10.orig/debian/gnupg.install
+++ gnupg-1.4.10/debian/gnupg.install
@@ -0,0 +1 @@
+tools/lspgpot	usr/bin
--- gnupg-1.4.10.orig/debian/patches/560692_fix_fatal_after_homedir_creation.dpatch
+++ gnupg-1.4.10/debian/patches/560692_fix_fatal_after_homedir_creation.dpatch
@@ -0,0 +1,25 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 560692_fix_fatal_after_homedir_creation.dpatch by Daniel Leidert (dale) <daniel.leidert@wgdd.de>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix a mistaken fatal error after creating the home-directory.
+## DP: This can only be seen in a few scenarios.
+## DP:
+## DP: <URL:http://bugs.debian.org/560692>
+## DP: <URL:https://bugs.g10code.com/gnupg/issue1169>
+## DP: <URL:http://lists.gnupg.org/pipermail/gnupg-commits/2009-December/008688.html>
+
+@DPATCH@
+diff -urNad trunk~/g10/tdbio.c trunk/g10/tdbio.c
+--- trunk~/g10/tdbio.c	2009-07-23 08:47:35.000000000 +0200
++++ trunk/g10/tdbio.c	2010-01-22 02:21:03.216141400 +0100
+@@ -508,7 +508,8 @@
+ 	    *p = 0;
+ 	    if( access( fname, F_OK ) ) {
+ 		try_make_homedir( fname );
+-		log_fatal( _("%s: directory does not exist!\n"), fname );
++                if (access (fname, F_OK ))
++                  log_fatal (_("%s: directory does not exist!\n"), fname);
+ 	    }
+ 	    *p = DIRSEP_C;
+ 
--- gnupg-1.4.10.orig/debian/patches/551709_fix_info_link_entry.dpatch
+++ gnupg-1.4.10/debian/patches/551709_fix_info_link_entry.dpatch
@@ -0,0 +1,33 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 551709_fix_info_link_entry.dpatch by Daniel Leidert (dale) <daniel.leidert@wgdd.de>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix 'gpg' link which should be 'gnupg1'.
+## DP:
+## DP: <URL:http://bugs.debian.org/551709>
+
+@DPATCH@
+diff -urNad trunk~/doc/gnupg1.info trunk/doc/gnupg1.info
+--- trunk~/doc/gnupg1.info	2009-09-02 15:50:59.000000000 +0200
++++ trunk/doc/gnupg1.info	2010-01-22 02:49:42.916068194 +0100
+@@ -13,7 +13,7 @@
+ 
+ INFO-DIR-SECTION GNU Utilities
+ START-INFO-DIR-ENTRY
+-* gpg: (gpg).            OpenPGP encryption and signing tool (v1).
++* gpg: (gnupg1).            OpenPGP encryption and signing tool (v1).
+ END-INFO-DIR-ENTRY
+ 
+ 
+diff -urNad trunk~/doc/gnupg1.texi trunk/doc/gnupg1.texi
+--- trunk~/doc/gnupg1.texi	2008-12-11 17:39:51.000000000 +0100
++++ trunk/doc/gnupg1.texi	2010-01-22 02:49:22.005041865 +0100
+@@ -48,7 +48,7 @@
+ 
+ @dircategory GNU Utilities
+ @direntry
+-* gpg: (gpg).            OpenPGP encryption and signing tool (v1).
++* gpg: (gnupg1).            OpenPGP encryption and signing tool (v1).
+ @end direntry
+ 
+ 
--- gnupg-1.4.10.orig/debian/patches/560995_fix_ftbfs_on_sparc64.dpatch
+++ gnupg-1.4.10/debian/patches/560995_fix_ftbfs_on_sparc64.dpatch
@@ -0,0 +1,52 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 560995_fix_ftbfs_on_sparc64.dpatch by Daniel Leidert (dale) <daniel.leidert@wgdd.de>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix an FTBFS failure on sparc64, as it tries to use SPARC32 assembly
+## DP: code on SPARC64.
+## DP:
+## DP: <URL:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560995>
+## DP: <URL:https://bugs.g10code.com/gnupg/issue1171>
+## DP: <URL:http://lists.gnupg.org/pipermail/gnupg-commits/2009-December/008669.html>
+
+@DPATCH@
+diff -urNad trunk~/mpi/config.links trunk/mpi/config.links
+--- trunk~/mpi/config.links	2008-12-11 17:39:43.000000000 +0100
++++ trunk/mpi/config.links	2010-01-22 02:17:22.404037685 +0100
+@@ -124,26 +124,24 @@
+ 	mpi_extra_modules="udiv-qrnnd"
+ 	;;
+     sparc64-*-linux-gnu)
+-	# An extra rule because we have an report for this one only.
+-	# Should be compared against the next GMP version
+-	echo '/* configured for sparc64-*-linux-gnu */' >>./mpi/asm-syntax.h
+-	path="sparc32v8 sparc32"
+-	mpi_extra_modules="udiv"
+-	;;
++       echo '/* No working assembler modules available */' >>./mpi/asm-syntax.h
++       path=""
++       ;;
+     sparc64-sun-solaris2*)
+-	# Got a report that udiv is missing, so we try this one
+-	echo '/* configured for sparc64-sun-solaris2 */' >>./mpi/asm-syntax.h
+-	path="sparc32v8 sparc32"
+-	mpi_extra_modules="udiv"
+-        ;;
++       echo '/* No working assembler modules available */' >>./mpi/asm-syntax.h
++       path=""
++       ;;
+     sparc64-*-netbsd* | sparc64-*-freebsd* | sparc64-*-openbsd*)
+        # There are no sparc64 assembler modules that work on the
+        # *BSDs, so use the generic C functions.
+        echo '/* No working assembler modules available */' >>./mpi/asm-syntax.h
+        path=""
+        ;;
++    sparc64*-*-*)
++       echo '/* No working assembler modules available */' >>./mpi/asm-syntax.h
++       path=""
++       ;;
+     sparc9*-*-*     | \
+-    sparc64*-*-*    | \
+     ultrasparc*-*-* )
+ 	echo '/* configured for sparc9 or higher */' >>./mpi/asm-syntax.h
+ 	path="sparc32v8 sparc32"
--- gnupg-1.4.10.orig/debian/patches/CVE-2013-4242.dpatch
+++ gnupg-1.4.10/debian/patches/CVE-2013-4242.dpatch
@@ -0,0 +1,44 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2013-4242 by Werner Koch
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Mitigate a flush+reload cache attack on RSA secret exponents.
+
+diff --git a/mpi/mpi-pow.c b/mpi/mpi-pow.c
+index beb01f9..2253ea4 100644
+--- a/mpi/mpi-pow.c
++++ b/mpi/mpi-pow.c
+@@ -1,5 +1,6 @@
+ /* mpi-pow.c  -  MPI functions
+- *	Copyright (C) 1994, 1996, 1998, 2000 Free Software Foundation, Inc.
++ * Copyright (C) 1994, 1996, 1998, 2000 Free Software Foundation, Inc.
++ * Copyright (C) 2013 Werner Koch
+  *
+  * This file is part of GnuPG.
+  *
+@@ -209,7 +210,14 @@ mpi_powm( MPI res, MPI base, MPI exponent, MPI mod)
+ 		tp = rp; rp = xp; xp = tp;
+ 		rsize = xsize;
+ 
+-		if( (mpi_limb_signed_t)e < 0 ) {
++                /* To mitigate the Yarom/Falkner flush+reload cache
++                 * side-channel attack on the RSA secret exponent, we
++                 * do the multiplication regardless of the value of
++                 * the high-bit of E.  But to avoid this performance
++                 * penalty we do it only if the exponent has been
++                 * stored in secure memory and we can thus assume it
++                 * is a secret exponent.  */
++                if (esec || (mpi_limb_signed_t)e < 0) {
+ 		    /*mpihelp_mul( xp, rp, rsize, bp, bsize );*/
+ 		    if( bsize < KARATSUBA_THRESHOLD ) {
+ 			mpihelp_mul( xp, rp, rsize, bp, bsize );
+@@ -224,7 +232,8 @@ mpi_powm( MPI res, MPI base, MPI exponent, MPI mod)
+ 			mpihelp_divrem(xp + msize, 0, xp, xsize, mp, msize);
+ 			xsize = msize;
+ 		    }
+-
++                }
++		if ((mpi_limb_signed_t)e < 0) {
+ 		    tp = rp; rp = xp; xp = tp;
+ 		    rsize = xsize;
+ 		}
--- gnupg-1.4.10.orig/debian/patches/CVE-2012-6085.dpatch
+++ gnupg-1.4.10/debian/patches/CVE-2012-6085.dpatch
@@ -0,0 +1,47 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## mips_gcc4.4 by Werner Koch
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix memory and key database corruption on importing invalid keys
+## DP: by rejecting invalid keyblock packet types.
+## DP: <URL:http://bugs.debian.org/697108>
+
+--- a/g10/import.c
++++ b/g10/import.c
+@@ -343,6 +343,27 @@ import_print_stats (void *hd)
+ }
+ 
+ 
++/* Return true if PKTTYPE is valid in a keyblock.  */
++static int
++valid_keyblock_packet (int pkttype)
++{
++  switch (pkttype)
++    {
++    case PKT_PUBLIC_KEY:
++    case PKT_PUBLIC_SUBKEY:
++    case PKT_SECRET_KEY:
++    case PKT_SECRET_SUBKEY:
++    case PKT_SIGNATURE:
++    case PKT_USER_ID:
++    case PKT_ATTRIBUTE:
++    case PKT_RING_TRUST:
++      return 1;
++    default:
++      return 0;
++    }
++}
++
++
+ /****************
+  * Read the next keyblock from stream A.
+  * PENDING_PKT should be initialzed to NULL
+@@ -420,7 +441,7 @@ read_block( IOBUF a, PACKET **pending_pkt, KBNODE *ret_root )
+ 	    }
+ 	    in_cert = 1;
+ 	  default:
+-	    if( in_cert ) {
++	    if (in_cert && valid_keyblock_packet (pkt->pkttype)) {
+ 		if( !root )
+ 		    root = new_kbnode( pkt );
+ 		else
--- gnupg-1.4.10.orig/debian/patches/567580_menu_prompt_reflects_program.dpatch
+++ gnupg-1.4.10/debian/patches/567580_menu_prompt_reflects_program.dpatch
@@ -0,0 +1,36 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 567580_menu_prompt_reflects_program.dpatch by Daniel Leidert (dale) <daniel.leidert@wgdd.de>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: It has been requested, that gnupg shows a less ambiguous prompt than
+## DP: "Command>". Upstream agreed.
+## DP:
+## DP: <URL:http://bugs.debian.org/567580>
+## DP: <URL:https://bugs.g10code.com/gnupg/issue1187>
+## DP: <URL:http://lists.gnupg.org/pipermail/gnupg-commits/2010-February/008766.html>
+
+@DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' trunk~/g10/card-util.c trunk/g10/card-util.c
+--- trunk~/g10/card-util.c	2009-08-13 09:14:37.000000000 +0200
++++ trunk/g10/card-util.c	2010-03-21 14:45:32.355740548 +0100
+@@ -1817,7 +1817,7 @@
+ 	    if (!have_commands)
+               {
+ 		tty_enable_completion (card_edit_completion);
+-		answer = cpr_get_no_help("cardedit.prompt", _("Command> "));
++		answer = cpr_get_no_help("cardedit.prompt", _("gpg/card> "));
+ 		cpr_kill_prompt();
+ 		tty_disable_completion ();
+               }
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' trunk~/g10/keyedit.c trunk/g10/keyedit.c
+--- trunk~/g10/keyedit.c	2009-08-26 07:35:31.000000000 +0200
++++ trunk/g10/keyedit.c	2010-03-21 14:45:32.355740548 +0100
+@@ -1616,7 +1616,7 @@
+ 	    if( !have_commands )
+ 	      {
+ 		tty_enable_completion(keyedit_completion);
+-		answer = cpr_get_no_help("keyedit.prompt", _("Command> "));
++		answer = cpr_get_no_help("keyedit.prompt", "gpg> ");
+ 		cpr_kill_prompt();
+ 		tty_disable_completion();
+ 	      }
--- gnupg-1.4.10.orig/debian/patches/mips_gcc4.4.dpatch
+++ gnupg-1.4.10/debian/patches/mips_gcc4.4.dpatch
@@ -0,0 +1,52 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## mips_gcc4.4 by Florian Fainelli <florian@alphacore.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Build fails on mips(el) due to changes the removal 
+## DP: of the 'h' constraint for MIPS in gcc-4.4.x versions.
+## DP: <URL:http://lists.debian.org/debian-mips/2010/05/msg00032.html>
+## DP: <URL:https://bugs.g10code.com/gnupg/issue1231>
+
+@DPATCH@
+Index: gnupg-1.4.10/mpi/longlong.h
+===================================================================
+--- gnupg-1.4.10.orig/mpi/longlong.h	2008-12-11 17:39:43.000000000 +0100
++++ gnupg-1.4.10/mpi/longlong.h	2010-03-27 14:27:53.000000000 +0100
+@@ -706,18 +706,35 @@
+ #endif /* __m88110__ */
+ #endif /* __m88000__ */
+ 
++/* Test for gcc >= maj.min, as per __GNUC_PREREQ in glibc */
++#if defined (__GNUC__) && defined (__GNUC_MINOR__)
++#define __GNUC_PREREQ(maj, min) \
++	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
++#else
++#define __GNUC_PREREQ(maj, min)  0
++#endif
++
+ /***************************************
+  **************  MIPS  *****************
+  ***************************************/
+ #if defined (__mips__) && W_TYPE_SIZE == 32
+-#if __GNUC__ > 2 || __GNUC_MINOR__ >= 7
++#if __GNUC_PREREQ (4,4)
++#define umul_ppmm(w1, w0, u, v) \
++  do {                                                                 \
++	UDItype __ll = (UDItype)(u) * (v);                                 \
++	w1 = __ll >> 32;                                                   \
++	w0 = __ll;                                                         \
++  } while (0)
++#endif
++#if !defined (umul_ppmm) && __GNUC_PREREQ (2,7)
+ #define umul_ppmm(w1, w0, u, v) \
+   __asm__ ("multu %2,%3"                                                \
+ 	   : "=l" ((USItype)(w0)),                                      \
+ 	     "=h" ((USItype)(w1))                                       \
+ 	   : "d" ((USItype)(u)),                                        \
+ 	     "d" ((USItype)(v)))
+-#else
++#endif
++#if !defined (umul_ppmm)
+ #define umul_ppmm(w1, w0, u, v) \
+   __asm__ ("multu %2,%3 \n" \
+ 	   "mflo %0 \n"     \
--- gnupg-1.4.10.orig/debian/patches/553175_document_primary_uid_sign.dpatch
+++ gnupg-1.4.10/debian/patches/553175_document_primary_uid_sign.dpatch
@@ -0,0 +1,23 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 553175_document_primary_uid_sign.dpatch by Daniel Leidert (dale) <daniel.leidert@wgdd.de>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Document the primary user id sign in --edit-key mode.
+## DP:
+## DP: <URL:http://bugs.debian.org/553175>
+## DP: <URL:https://bugs.g10code.com/gnupg/issue1172>
+
+@DPATCH@
+diff -urNad trunk~/doc/gpg.texi trunk/doc/gpg.texi
+--- trunk~/doc/gpg.texi	2009-09-02 14:31:17.000000000 +0200
++++ trunk/doc/gpg.texi	2010-01-22 02:27:18.888061353 +0100
+@@ -845,7 +845,8 @@
+ 
+ @c man:.RS
+ The listing shows you the key with its secondary keys and all user
+-ids. Selected keys or user ids are indicated by an asterisk. The trust
++ids. The primary user id is indicated by a dot, and selected keys or
++user ids are indicated by an asterisk. The trust
+ value is displayed with the primary key: the first is the assigned owner
+ trust and the second is the calculated trust value. Letters are used for
+ the values:
--- gnupg-1.4.10.orig/debian/patches/567593_improve_info_and_faq.dpatch
+++ gnupg-1.4.10/debian/patches/567593_improve_info_and_faq.dpatch
@@ -0,0 +1,134 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 567593_improve_info_and_faq.dpatch by Daniel Leidert (dale) <daniel.leidert@wgdd.de>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix several grammars, typos, the bug-reporting address.
+## DP:
+## DP: <URL:http://bugs.debian.org/567593>
+## DP: <URL:https://bugs.g10code.com/gnupg/issue1188>
+## DP: <URL:http://cvs.gnupg.org/cgi-bin/viewcvs.cgi?rev=5257&root=GnuPG&view=rev>
+## DP: <URL:http://cvs.gnupg.org/cgi-bin/viewcvs.cgi?rev=5259&root=GnuPG&view=rev>
+
+@DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' trunk~/doc/faq.raw trunk/doc/faq.raw
+--- trunk~/doc/faq.raw	2008-12-11 17:39:51.000000000 +0100
++++ trunk/doc/faq.raw	2010-03-21 14:54:22.631771089 +0100
+@@ -1026,18 +1026,20 @@
+     lists? Did you have a look at the bug list (you'll find a link to
+     the list of reported bugs on the documentation page). If you're not
+     sure about it being a bug, you can send mail to the gnupg-devel
+-    list. Otherwise, use the GUUG bug tracking system 
+-    [H a href=http://bugs.guug.de/Reporting.html]<http://bugs.guug.de/Reporting.html>[H /a].
++    list. Otherwise, use the bug tracking system 
++    [H a href=http://bugs.gnupg.org]<http://bugs.gnupg.org>[H /a].
+ 
+ <Q> Why doesn't GnuPG support X.509 certificates?
+ 
+-    GnuPG, first and foremost, is an implementation of the OpenPGP
++    GnuPG 1.x, first and foremost, is an implementation of the OpenPGP
+     standard (RFC 2440), which is a competing infrastructure, different
+     from X.509.
+ 
+     They are both public-key cryptosystems, but how the public keys are
+     actually handled is different.
+ 
++    Note that GnuPG version 2.x fully supports S/MIME and X.509.
++
+ <Q> Why do national characters in my user ID look funny?
+ 
+     According to OpenPGP, GnuPG encodes user ID strings (and other
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' trunk~/doc/gpg.texi.rej trunk/doc/gpg.texi.rej
+--- trunk~/doc/gpg.texi.rej	1970-01-01 01:00:00.000000000 +0100
++++ trunk/doc/gpg.texi.rej	2010-03-21 14:54:34.256804659 +0100
+@@ -0,0 +1,91 @@
++--- doc/gpg.texi	(Revision 5258)
+++++ doc/gpg.texi	(Revision 5259)
++@@ -586,7 +586,6 @@
++ related tasks.  It expects the specification of a key on the command
++ line.
++ 
++-
++ @c ******** Begin Edit-key Options **********
++ @table @asis
++ 
++@@ -894,7 +893,7 @@
++ @opindex passwd
++ Change the passphrase of the secret key belonging to the certificate
++ specified as @var{user_id}.  This is a shortcut for the sub-command
++-@code{passwd} in the edit key menu.
+++@code{passwd} of the edit key menu.
++ @end ifclear
++ 
++ @end table
++@@ -909,7 +908,7 @@
++ @node GPG Options
++ @section Option Summary
++ 
++-@command{@gpgname} comes features a bunch of options to control the exact
+++@command{@gpgname} features a bunch of options to control the exact
++ behaviour and to change the default configuration.
++ 
++ @menu
++@@ -1530,10 +1529,12 @@
++ ldaps).  Defaults to on.
++ 
++ @item ca-cert-file
++-Provide a certificate file to override the system default.  Only
+++Provide a certificate store to override the system default.  Only
++ necessary if check-cert is enabled, and the keyserver is using a
++ certificate that is not present in a system default certificate list.
++ 
+++Note that depending on the SSL library that the keyserver helper is
+++built with, this may actually be a directory or a file.
++ @end table
++ 
++ @item --completes-needed @code{n}
++@@ -1767,16 +1768,26 @@
++ @option{--default-key}.
++ 
++ @item --try-all-secrets
+++@opindex try-all-secrets
++ Don't look at the key ID as stored in the message but try all secret
++ keys in turn to find the right decryption key. This option forces the
++ behaviour as used by anonymous recipients (created by using
++ @option{--throw-keyids}) and might come handy in case where an encrypted
++ message contains a bogus key ID.
++ 
+++@item --skip-hidden-recipients
+++@itemx --no-skip-hidden-recipients
+++@opindex skip-hidden-recipients
+++@opindex no-skip-hidden-recipients
+++During decryption skip all anonymous recipients.  This option helps in
+++the case that people use the hidden recipients feature to hide there
+++own encrypt-to key from others.  If oneself has many secret keys this
+++may lead to a major annoyance because all keys are tried in turn to
+++decrypt soemthing which was not really intended for it.  The drawback
+++of this option is that it is currently not possible to decrypt a
+++message which includes real anonymous recipients.
++ 
++ 
++-
++-
++ @end table
++ 
++ @c *******************************************
++@@ -2888,7 +2899,7 @@
++ @mansect bugs
++ @chapheading BUGS
++ 
++-On many systems this program should be installed as setuid(root). This
+++On older systems this program should be installed as setuid(root). This
++ is necessary to lock memory pages. Locking memory pages prevents the
++ operating system from writing memory pages (which may contain
++ passphrases or other sensitive material) to disk. If you get no
++@@ -2903,6 +2914,10 @@
++ to protect the saved memory, passphrases or other sensitive material
++ may be recoverable from it later.
++ 
+++Before you report a bug you should first search the mailing list
+++archives for similar problems and second check whether such a bug has
+++already been reported to our bug tracker at http://bugs.gnupg.org .
+++
++ @mansect see also
++ @ifset isman
++ @command{gpgv}(1), 
--- gnupg-1.4.10.orig/debian/patches/489225_catch_expired_primary_key_with_valid_subkey.dpatch
+++ gnupg-1.4.10/debian/patches/489225_catch_expired_primary_key_with_valid_subkey.dpatch
@@ -0,0 +1,28 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 489225_catch_expired_primary_key_with_valid_subkey.dpatch by Daniel Leidert (dale) <daniel.leidert@wgdd.de>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix missing status line signature verification done with a subkey while
+## DP: on the main key has expired.
+## DP:
+## DP: <URL:http://bugs.debian.org/489225>
+## DP: <URL:https://bugs.g10code.com/gnupg/issue1059>
+## DP: <URL:http://lists.gnupg.org/pipermail/gnupg-commits/2009-December/008699.html>
+
+@DPATCH@
+diff -urNad trunk~/g10/sig-check.c trunk/g10/sig-check.c
+--- trunk~/g10/sig-check.c	2009-07-30 13:01:05.000000000 +0200
++++ trunk/g10/sig-check.c	2010-01-22 02:33:27.496061461 +0100
+@@ -209,7 +209,11 @@
+ 	  return G10ERR_TIME_CONFLICT;
+       }
+ 
+-    if( pk->expiredate && pk->expiredate < cur_time ) {
++    /* Check whether the key has expired.  We check the has_expired
++       flag which is set after a full evaluation of the key (getkey.c)
++       as well as a simple compare to the current time in case the
++       merge has for whatever reasons not been done.  */
++    if (pk->has_expired || (pk->expiredate && pk->expiredate < cur_time)) {
+         char buf[11];
+         if (opt.verbose)
+ 	  log_info(_("NOTE: signature key %s expired %s\n"),
--- gnupg-1.4.10.orig/debian/patches/fix_infinite_loop_r5264.dpatch
+++ gnupg-1.4.10/debian/patches/fix_infinite_loop_r5264.dpatch
@@ -0,0 +1,23 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## fix_infinite_loop_r5264.dpatch by Daniel Leidert (dale) <daniel.leidert@wgdd.de>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: * keygen.c (ask_user_id): Avoid infinite loop in case of invalid
+## DP:   data.
+## DP:
+## DP: <URL:https://bugs.g10code.com/gnupg/issue1186>
+## DP: <URL:http://lists.gnupg.org/pipermail/gnupg-commits/2010-February/008776.html>
+
+@DPATCH@
+diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' trunk~/g10/keygen.c trunk/g10/keygen.c
+--- trunk~/g10/keygen.c	2009-07-29 10:42:59.000000000 +0200
++++ trunk/g10/keygen.c	2010-03-21 15:14:33.547740573 +0100
+@@ -1927,7 +1927,7 @@
+ 	    if( strlen(ansstr) != 10 )
+ 		BUG();
+ 	    if( cpr_enabled() ) {
+-		answer = xstrdup(ansstr+6);
++                answer = xstrdup (ansstr + (fail?8:6));
+ 		answer[1] = 0;
+ 	    }
+ 	    else {
--- gnupg-1.4.10.orig/debian/patches/CVE-2013-4351.dpatch
+++ gnupg-1.4.10/debian/patches/CVE-2013-4351.dpatch
@@ -0,0 +1,53 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2013-4351 by Werner Koch
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Distinguish between missing and cleared key flags.
+
+    gpg: Distinguish between missing and cleared key flags.
+    
+    * include/cipher.h (PUBKEY_USAGE_NONE): New.
+    * g10/getkey.c (parse_key_usage): Set new flag.
+    --
+    
+    We do not want to use the default capabilities (derived from the
+    algorithm) if any key flags are given in a signature.  Thus if key
+    flags are used in any way, the default key capabilities are never
+    used.
+    
+    This allows to create a key with key flags set to all zero so it can't
+    be used.  This better reflects common sense.
+
+--- a/g10/getkey.c
++++ b/g10/getkey.c
+@@ -1494,13 +1494,19 @@
+ 
+       if(flags)
+ 	key_usage |= PUBKEY_USAGE_UNKNOWN;
++
++      if (!key_usage)
++	key_usage |= PUBKEY_USAGE_NONE;
+     }
++  else if (p) /* Key flags of length zero.  */
++    key_usage |= PUBKEY_USAGE_NONE;
+ 
+   /* We set PUBKEY_USAGE_UNKNOWN to indicate that this key has a
+      capability that we do not handle.  This serves to distinguish
+      between a zero key usage which we handle as the default
+      capabilities for that algorithm, and a usage that we do not
+-     handle. */
++     handle.  Likewise we use PUBKEY_USAGE_NONE to indicate that
++     key_flags have been given but they do not specify any usage.  */
+ 
+   return key_usage;
+ }
+--- a/include/cipher.h
++++ b/include/cipher.h
+@@ -57,6 +57,7 @@
+ #define PUBKEY_USAGE_CERT    4      /* key is also good to certify other keys*/
+ #define PUBKEY_USAGE_AUTH    8      /* key is good for authentication */
+ #define PUBKEY_USAGE_UNKNOWN 128    /* key has an unknown usage bit */
++#define PUBKEY_USAGE_NONE    256    /* No usage given. */
+ 
+ #define DIGEST_ALGO_MD5       1
+ #define DIGEST_ALGO_SHA1      2
--- gnupg-1.4.10.orig/debian/patches/00list
+++ gnupg-1.4.10/debian/patches/00list
@@ -0,0 +1,13 @@
+489225_catch_expired_primary_key_with_valid_subkey
+551709_fix_info_link_entry
+553175_document_primary_uid_sign
+560692_fix_fatal_after_homedir_creation
+560995_fix_ftbfs_on_sparc64
+567580_menu_prompt_reflects_program
+567593_improve_info_and_faq
+fix_infinite_loop_r5264
+mips_gcc4.4
+CVE-2012-6085
+CVE-2013-4242
+CVE-2013-4402
+CVE-2013-4351
--- gnupg-1.4.10.orig/debian/patches/CVE-2013-4402.dpatch
+++ gnupg-1.4.10/debian/patches/CVE-2013-4402.dpatch
@@ -0,0 +1,401 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2013-4402 by Werner Koch
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Fix bug with deeply nested compressed packets.
+
+From d90a1d23404f482cc4a5a2b2ee0f296d67ff2227 Mon Sep 17 00:00:00 2001
+From: Werner Koch <wk@gnupg.org>
+Date: Wed, 2 Oct 2013 09:11:43 +0200
+Subject: [PATCH 1/2] gpg: Fix bug with deeply nested compressed packets.
+
+* g10/mainproc.c (MAX_NESTING_DEPTH): New.
+(proc_compressed): Return an error code.
+(check_nesting): New.
+(do_proc_packets): Check packet nesting depth.  Handle errors from
+check_compressed.
+
+Signed-off-by: Werner Koch <wk@gnupg.org>
+---
+ NEWS           |    3 +++
+ g10/mainproc.c |   52 +++++++++++++++++++++++++++++++++++++++++++---------
+ 2 files changed, 46 insertions(+), 9 deletions(-)
+
+--- a/g10/mainproc.c
++++ b/g10/mainproc.c
+@@ -1,6 +1,7 @@
+ /* mainproc.c - handle packets
+  * Copyright (C) 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
+  *               2008 Free Software Foundation, Inc.
++ * Copyright (C) 2013 Werner Koch
+  *
+  * This file is part of GnuPG.
+  *
+@@ -41,6 +42,11 @@
+ #include "photoid.h"
+ 
+ 
++/* Put an upper limit on nested packets.  The 32 is an arbitrary
++   value, a much lower should actually be sufficient.  */
++#define MAX_NESTING_DEPTH 32
++
++
+ struct kidlist_item {
+     struct kidlist_item *next;
+     u32 kid[2];
+@@ -784,7 +790,7 @@
+     return proc_encryption_packets( info, a );
+ }
+ 
+-static void
++static int
+ proc_compressed( CTX c, PACKET *pkt )
+ {
+     PKT_compressed *zd = pkt->pkt.compressed;
+@@ -803,6 +809,7 @@
+ 	log_error("uncompressing failed: %s\n", g10_errstr(rc));
+     free_packet(pkt);
+     c->last_was_session_key = 0;
++    return rc;
+ }
+ 
+ /****************
+@@ -1233,14 +1240,37 @@
+ }
+ 
+ 
+-int
++static int
++check_nesting (CTX c)
++{
++  int level;
++
++  for (level = 0; c; c = c->anchor)
++    level++;
++
++  if (level > MAX_NESTING_DEPTH)
++    {
++      log_error ("input data with too deeply nested packets\n");
++      write_status_text (STATUS_UNEXPECTED, "1");
++      return G10ERR_UNEXPECTED;
++    }
++  return 0;
++}
++
++
++static int
+ do_proc_packets( CTX c, IOBUF a )
+ {
+-    PACKET *pkt = xmalloc( sizeof *pkt );
+-    int rc=0;
+-    int any_data=0;
++    PACKET *pkt;
++    int rc = 0;
++    int any_data = 0;
+     int newpkt;
+ 
++    rc = check_nesting (c);
++    if (rc)
++      return rc;
++
++    pkt = xmalloc( sizeof *pkt );
+     c->iobuf = a;
+     init_packet(pkt);
+     while( (rc=parse_packet(a, pkt)) != -1 ) {
+@@ -1260,7 +1290,7 @@
+ 	      case PKT_SYMKEY_ENC:  proc_symkey_enc( c, pkt ); break;
+ 	      case PKT_ENCRYPTED:
+ 	      case PKT_ENCRYPTED_MDC: proc_encrypted( c, pkt ); break;
+-	      case PKT_COMPRESSED:  proc_compressed( c, pkt ); break;
++	      case PKT_COMPRESSED:  rc = proc_compressed( c, pkt ); break;
+ 	      default: newpkt = 0; break;
+ 	    }
+ 	}
+@@ -1278,7 +1308,7 @@
+ 		goto leave;
+ 	      case PKT_SIGNATURE:   newpkt = add_signature( c, pkt ); break;
+ 	      case PKT_PLAINTEXT:   proc_plaintext( c, pkt ); break;
+-	      case PKT_COMPRESSED:  proc_compressed( c, pkt ); break;
++	      case PKT_COMPRESSED:  rc = proc_compressed( c, pkt ); break;
+ 	      case PKT_ONEPASS_SIG: newpkt = add_onepass_sig( c, pkt ); break;
+               case PKT_GPG_CONTROL: newpkt = add_gpg_control(c, pkt); break;
+ 	      default: newpkt = 0; break;
+@@ -1298,7 +1328,7 @@
+ 	      case PKT_ENCRYPTED:
+ 	      case PKT_ENCRYPTED_MDC: proc_encrypted( c, pkt ); break;
+ 	      case PKT_PLAINTEXT:   proc_plaintext( c, pkt ); break;
+-	      case PKT_COMPRESSED:  proc_compressed( c, pkt ); break;
++	      case PKT_COMPRESSED:  rc = proc_compressed( c, pkt ); break;
+ 	      case PKT_ONEPASS_SIG: newpkt = add_onepass_sig( c, pkt ); break;
+ 	      case PKT_GPG_CONTROL: newpkt = add_gpg_control(c, pkt); break;
+ 	      default: newpkt = 0; break;
+@@ -1323,13 +1353,17 @@
+ 	      case PKT_ENCRYPTED:
+ 	      case PKT_ENCRYPTED_MDC: proc_encrypted( c, pkt ); break;
+ 	      case PKT_PLAINTEXT:   proc_plaintext( c, pkt ); break;
+-	      case PKT_COMPRESSED:  proc_compressed( c, pkt ); break;
++	      case PKT_COMPRESSED:  rc = proc_compressed( c, pkt ); break;
+ 	      case PKT_ONEPASS_SIG: newpkt = add_onepass_sig( c, pkt ); break;
+               case PKT_GPG_CONTROL: newpkt = add_gpg_control(c, pkt); break;
+ 	      case PKT_RING_TRUST:  newpkt = add_ring_trust( c, pkt ); break;
+ 	      default: newpkt = 0; break;
+ 	    }
+ 	}
++
++        if (rc)
++          goto leave;
++
+         /* This is a very ugly construct and frankly, I don't remember why
+          * I used it.  Adding the MDC check here is a hack.
+          * The right solution is to initiate another context for encrypted
+--- a/util/iobuf.c
++++ b/util/iobuf.c
+@@ -27,7 +27,7 @@
+ #include <assert.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
+-#include <fcntl.h> 
++#include <fcntl.h>
+ #include <unistd.h>
+ #ifdef HAVE_DOSISH_SYSTEM
+ #include <windows.h>
+@@ -55,6 +55,11 @@
+ 
+ #undef FILE_FILTER_USES_STDIO
+ 
++/* To avoid a potential DoS with compression packets we better limit
++   the number of filters in a chain.  */
++#define MAX_NESTING_FILTER 64
++
++
+ #ifdef HAVE_DOSISH_SYSTEM
+ #define USE_SETMODE 1
+ #endif
+@@ -76,8 +81,8 @@
+  } file_filter_ctx_t ;
+ #else
+ #define my_fileno(a)  (a)
+-#define my_fopen_ro(a,b) fd_cache_open ((a),(b)) 
+-#define my_fopen(a,b) direct_open ((a),(b)) 
++#define my_fopen_ro(a,b) fd_cache_open ((a),(b))
++#define my_fopen(a,b) direct_open ((a),(b))
+ #ifdef HAVE_DOSISH_SYSTEM
+ typedef HANDLE FILEP_OR_FD;
+ #define INVALID_FP  ((HANDLE)-1)
+@@ -99,7 +104,7 @@
+      char fname[1]; /* name of the file */
+  } file_filter_ctx_t ;
+ 
+- struct close_cache_s { 
++ struct close_cache_s {
+     struct close_cache_s *next;
+     FILEP_OR_FD fp;
+     char fname[1];
+@@ -153,7 +158,7 @@
+ #ifdef HAVE_DOSISH_SYSTEM
+   for (; *a && *b; a++, b++)
+     {
+-      if (*a != *b && !((*a == '/' && *b == '\\') 
++      if (*a != *b && !((*a == '/' && *b == '\\')
+                         || (*a == '\\' && *b == '/')) )
+         break;
+     }
+@@ -295,7 +300,7 @@
+     {
+         struct stat buf;
+         int rc = stat( fname, &buf );
+-        
++
+         /* Don't allow iobufs on directories */
+         if( !rc && S_ISDIR(buf.st_mode) && !S_ISREG(buf.st_mode) )
+             return __set_errno( EISDIR );
+@@ -308,7 +313,7 @@
+ 
+ 
+ /*
+- * Instead of closing an FD we keep it open and cache it for later reuse 
++ * Instead of closing an FD we keep it open and cache it for later reuse
+  * Note that this caching strategy only works if the process does not chdir.
+  */
+ static void
+@@ -471,8 +476,8 @@
+     if( control == IOBUFCTRL_UNDERFLOW ) {
+ 	assert( size ); /* need a buffer */
+ 	if ( a->eof_seen) {
+-	    rc = -1;		
+-	    *ret_len = 0;	
++	    rc = -1;
++	    *ret_len = 0;
+ 	}
+ 	else {
+ #ifdef HAVE_DOSISH_SYSTEM
+@@ -606,8 +611,8 @@
+     if( control == IOBUFCTRL_UNDERFLOW ) {
+ 	assert( size ); /* need a buffer */
+ 	if ( a->eof_seen) {
+-	    rc = -1;		
+-	    *ret_len = 0;	
++	    rc = -1;
++	    *ret_len = 0;
+ 	}
+ 	else {
+             int nread;
+@@ -1076,7 +1081,7 @@
+         fname += 2;
+         for (i=0; digitp (fname+i); i++ )
+             ;
+-        if ( !fname[i] ) 
++        if ( !fname[i] )
+             return atoi (fname);
+     }
+     return -1;
+@@ -1189,7 +1194,7 @@
+     sock_filter( scx, IOBUFCTRL_INIT, NULL, NULL, &len );
+     if( DBG_IOBUF )
+ 	log_debug("iobuf-%d.%d: sockopen `%s'\n", a->no, a->subno, scx->fname);
+-    iobuf_ioctl (a,3,1,NULL); /* disable fd caching */ 
++    iobuf_ioctl (a,3,1,NULL); /* disable fd caching */
+ #else
+     a = iobuf_fdopen (fd, mode);
+ #endif
+@@ -1233,7 +1238,7 @@
+     file_filter( fcx, IOBUFCTRL_DESC, NULL, (byte*)&a->desc, &len );
+     file_filter( fcx, IOBUFCTRL_INIT, NULL, NULL, &len );
+     if( DBG_IOBUF )
+-	log_debug("iobuf-%d.%d: create `%s'\n", a->no, a->subno, 
++	log_debug("iobuf-%d.%d: create `%s'\n", a->no, a->subno,
+                   a->desc?a->desc:"?" );
+ 
+     return a;
+@@ -1267,7 +1272,7 @@
+     file_filter( fcx, IOBUFCTRL_DESC, NULL, (byte*)&a->desc, &len );
+     file_filter( fcx, IOBUFCTRL_INIT, NULL, NULL, &len );
+     if( DBG_IOBUF )
+-	log_debug("iobuf-%d.%d: append `%s'\n", a->no, a->subno, 
++	log_debug("iobuf-%d.%d: append `%s'\n", a->no, a->subno,
+                   a->desc?a->desc:"?" );
+ 
+     return a;
+@@ -1296,7 +1301,7 @@
+     file_filter( fcx, IOBUFCTRL_DESC, NULL, (byte*)&a->desc, &len );
+     file_filter( fcx, IOBUFCTRL_INIT, NULL, NULL, &len );
+     if( DBG_IOBUF )
+-	log_debug("iobuf-%d.%d: openrw `%s'\n", a->no, a->subno, 
++	log_debug("iobuf-%d.%d: openrw `%s'\n", a->no, a->subno,
+                   a->desc?a->desc:"?");
+ 
+     return a;
+@@ -1309,7 +1314,7 @@
+     if ( cmd == 1 ) {  /* keep system filepointer/descriptor open */
+         if( DBG_IOBUF )
+             log_debug("iobuf-%d.%d: ioctl `%s' keep=%d\n",
+-                      a? a->no:-1, a?a->subno:-1, 
++                      a? a->no:-1, a?a->subno:-1,
+                       a&&a->desc?a->desc:"?", intval );
+         for( ; a; a = a->chain )
+             if( !a->chain && a->filter == file_filter ) {
+@@ -1339,7 +1344,7 @@
+     else if ( cmd == 3 ) {  /* disallow/allow caching */
+         if( DBG_IOBUF )
+             log_debug("iobuf-%d.%d: ioctl `%s' no_cache=%d\n",
+-                      a? a->no:-1, a?a->subno:-1, 
++                      a? a->no:-1, a?a->subno:-1,
+                       a&&a->desc?a->desc:"?", intval );
+         for( ; a; a = a->chain )
+             if( !a->chain && a->filter == file_filter ) {
+@@ -1403,6 +1408,12 @@
+ 
+     if( a->use == 2 && (rc=iobuf_flush(a)) )
+ 	return rc;
++
++    if (a->subno >= MAX_NESTING_FILTER) {
++        log_error ("i/o filter too deeply nested - corrupted data?\n");
++        return G10ERR_UNEXPECTED;
++    }
++
+     /* make a copy of the current stream, so that
+      * A is the new stream and B the original one.
+      * The contents of the buffers are transferred to the
+@@ -1449,7 +1460,7 @@
+     f( ov, IOBUFCTRL_DESC, NULL, (byte*)&a->desc, &dummy_len );
+ 
+     if( DBG_IOBUF ) {
+-	log_debug("iobuf-%d.%d: push `%s'\n", a->no, a->subno, 
++	log_debug("iobuf-%d.%d: push `%s'\n", a->no, a->subno,
+                   a->desc?a->desc:"?" );
+ 	print_chain( a );
+     }
+@@ -1949,14 +1960,14 @@
+ 
+ #if defined(HAVE_DOSISH_SYSTEM) && !defined(FILE_FILTER_USES_STDIO)
+             ulong size;
+-            static int (* __stdcall get_file_size_ex) 
++            static int (* __stdcall get_file_size_ex)
+               (void *handle, LARGE_INTEGER *size);
+             static int get_file_size_ex_initialized;
+ 
+             if (!get_file_size_ex_initialized)
+               {
+                 void *handle;
+-                
++
+                 handle = dlopen ("kernel32.dll", RTLD_LAZY);
+                 if (handle)
+                   {
+@@ -1974,14 +1985,14 @@
+                    return a proper error in case a file is larger than
+                    4GB. */
+                 LARGE_INTEGER size;
+-                
++
+                 if (get_file_size_ex (fp, &size))
+                   {
+                     if (!size.u.HighPart)
+                       return size.u.LowPart;
+                     if (overflow)
+                       *overflow = 1;
+-                    return 0; 
++                    return 0;
+                   }
+               }
+             else
+@@ -2007,7 +2018,7 @@
+ 
+ /* Return the file descriptor of the underlying file or -1 if it is
+    not available.  */
+-int 
++int
+ iobuf_get_fd (IOBUF a)
+ {
+   if (a->directfp)
+@@ -2260,7 +2271,7 @@
+ #ifdef _WIN32
+     {
+         int x;
+-            
++
+         if  ( fd <= 2 )
+             return fd; /* do not do this for error, stdin, stdout, stderr */
+ 
+@@ -2281,17 +2292,17 @@
+ translate_file_handle ( int fd, int for_write )
+ {
+ #ifdef _WIN32
+-#ifdef FILE_FILTER_USES_STDIO  
++#ifdef FILE_FILTER_USES_STDIO
+     fd = iobuf_translate_file_handle (fd, for_write);
+ #else
+     {
+         int x;
+ 
+-        if  ( fd == 0 ) 
++        if  ( fd == 0 )
+             x = (int)GetStdHandle (STD_INPUT_HANDLE);
+-        else if (fd == 1)    
++        else if (fd == 1)
+             x = (int)GetStdHandle (STD_OUTPUT_HANDLE);
+-        else if (fd == 2)    
++        else if (fd == 2)
+             x = (int)GetStdHandle (STD_ERROR_HANDLE);
+         else
+             x = fd;
