Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

gnupg: update to 2.4.4 #48419

Closed
wants to merge 1 commit into from
Closed

Conversation

filiprojek
Copy link
Contributor

@filiprojek filiprojek commented Jan 29, 2024

just a version bump
tagging the maintainer @jcgruenhage

Testing the changes

I've done the following regression testing:

  • encrypt/decrypt
  • key import/export
  • keyserver sync
  • symmetric encryption/decryption
  • non-resident key (yubikey gen5)

No regresions found.

Local build testing

  • I built this PR locally for my native architecture, (x86_64-glibc)

@jcgruenhage
Copy link
Contributor

Even if it's just a version bump, don't merge this without checking extensively what they changed upstream.

-----BEGIN ALLEGATIONS-----

GnuPG has allegedly made changes in the past that were inconsistent with the OpenPGP standard in a way that deliberately breaks interoperability with other OpenPGP implementations with the alleged goal of weaponizing they userbase against other implementations to get their way with how the standard is supposed to develop in the future.

-----END ALLEGATIONS-----

We're patching out changes like that already, and we need to be careful with updates to make sure we don't accidentally include updates like that without patching out the unwanted stuff. This is done consistently with other distros as well, with at least Alpine, Arch, Fedora and NixOS shipping a patched version like this. I'm not sure who else also patches GnuPG, but there's going to be a few more I suspect.

@filiprojek
Copy link
Contributor Author

I've added some regression tests to the original PR description. I'm not sure what else to test. The changelog does not have to appear to have any breaking changes listed.

@realcharmer
Copy link
Contributor

We also do quite a bit of patching in SUSE: https://build.opensuse.org/package/show/openSUSE%3AFactory/gpg2

Copy link

github-actions bot commented May 2, 2024

Pull Requests become stale 90 days after last activity and are closed 14 days after that. If this pull request is still relevant bump it or assign it.

@github-actions github-actions bot added the Stale label May 2, 2024
@github-actions github-actions bot closed this May 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants