Fixes lintian: public-upstream-key-not-minimal
See https://lintian.debian.org/tags/public-upstream-key-not-minimal.html for more details.

Fixes lintian: uses-debhelper-compat-file
See https://lintian.debian.org/tags/uses-debhelper-compat-file.html for more details.

Fixes lintian: package-uses-old-debhelper-compat-version
See https://lintian.debian.org/tags/package-uses-old-debhelper-compat-version.html for more details.

Update to upstream version '1.4.23'
with Debian dir ae51572bf27effda0b1e920c2c4d66d12f82d93d

--

* g10/mainproc.c (proc_plaintext): Sanitize verbose output.
--

This fixes a forgotten sanitation of user supplied data in a verbose
mode diagnostic.  The mention CVE is about using this to inject
status-fd lines into the stderr output.  Other harm good as well be
done.  Note that GPGME based applications are not affected because
GPGME does not fold status output into stderr.

CVE-id: CVE-2018-12020
GnuPG-bug-id: 4012
(cherry picked from commit 13f135c7a252cc46cff96e75968d92b6dc8dce1b)

* g10/compress.c (handle_compressed): Fix memory leak.

--

(backport from STABLE-BRANCH-2-2 commit:
c31abf84659dbda5503dd9f3aa3449520bcd1b84)

All other calls of push_compress_filter checks ALGO,
so, do it here, too.

GnuPG-bug-id: 3898
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>

--

The French string has an extra %s which would result in garbage output
or segv.

I am not sure about the sk andro and thus better mark them as fuzzy.

GnuPG-bug-id: 3619
Signed-off-by: Werner Koch <wk@gnupg.org>

* po/ja.po: Fix message with no "%s".

--

Backport of master commit from: 77e2fcb4ffbad8577a2cf41f17bf92dec6a93ad8

The wrong message caused segmentation fault for key generation when
no expiration is specified.

GnuPG-bug-id: 3619
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>

* g10/trustdb.c (sanitize_regexp): Only escape operators.

--

Backport from master commit:
	ccf3ba92087e79abdeaa0208795829b431c6f201

To sanitize a regular expression, quoting by backslash should be only
done for defined characters.  POSIX defines 12 characters including
dot and backslash.

Quoting other characters is wrong, in two ways; It may build an
operator like: \b, \s, \w when using GNU library.  Case ignored match
doesn't work, because quoting lower letter means literally and no
much to upper letter.

GnuPG-bug-id: 2923
Co-authored-by: Damien Goutte-Gattat <dgouttegattat@incenp.org>
Signed-off-by: NIIBE Yutaka <gniibe@fsij.org>

--
In https://bugs.debian.org/881393

 , Jonas Smedegaard reports:

> In option number 1, the word "komprimeret" means "compressed".
>
> I am pretty sure it should say "kompromitteret" instead, which means
> "compromised".

Debian-Bug-Id: 881393
Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

* cipher/rsa.c (secret): Move var decl to the beginning.
--

Trivial patch; ChangeLog written by wk.

Signed-off-by: Werner Koch <wk@gnupg.org>

--
All /dev/*random devices have been equivalent since OpenBSD 4.9, on
purpose (/dev/random doesn't block).  /dev/srandom has been removed in
the OpenBSD 6.3 development cycle, /dev/arandom will likely follow.

Signed-off-by: Jeremie Courreges-Anglas <jca@wxcvbn.org>

Frans Spiesschaert authored Sep 06, 2017 and Daniel Kahn Gillmor committed Sep 06, 2017

Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>

doc/gpg.texi: Remove documentation for --faked-system-time.

Signed-off-by: Marcus Brinkmann <mb@g10code.com>
GnuPG-bug-id: 3329

Debian packaging for GnuPG is handled in debian git repositories, and
doesn't belong here in the upstream repository.  The packaging was
significantly out of date anyway.

If you're looking for debian packaging for the 1.4 branch of GnuPG,
please use the following git remote:

    https://anonscm.debian.org/git/pkg-gnupg/gnupg1.git



Signed-off-by: Daniel Kahn Gillmor <dkg@fifthhorseman.net>