[gentoo-dev] gnupg2 only vs gnupg-1 & gnupg-2

[gentoo-dev] gnupg2 only vs gnupg-1 & gnupg-2

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 2745 bytes --]

For some time now those maintaining gnupg have been attempting to go
gnupg-2 only on Gentoo. I have tried to support that effort, despite all
other distros supporting/providing both. Not to mention all gnupg
release notes stating.

"GnuPG-2 has a different architecture than GnuPG-1 (e.g. 1.4.7) in that
it splits up functionality into several modules.  However, both
versions may be installed alongside without any conflict.  In fact,
the gpg version from GnuPG-1 is able to make use of the gpg-agent as
included in GnuPG-2 and allows for seamless passphrase caching.  The
advantage of GnuPG-1 is its smaller size and the lack of dependency on
other modules at run and build time.  We will keep maintaining GnuPG-1
versions because they are very useful for small systems and for server
based applications requiring only OpenPGP support."

http://lists.gnupg.org/pipermail/gnupg-announce/2007q2/000254.html
http://lists.gnupg.org/pipermail/gnupg-announce/2007q1/000252.html
http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000242.html
http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000239.html

Also
"There are no plans to give up development on 1.4 after the 2.0
release."
http://lists.gnupg.org/pipermail/gnupg-announce/2006q4/000236.html


This has sparked the following open bugs, and countless more closed
ones :(

http://bugs.gentoo.org/show_bug.cgi?id=153496
http://bugs.gentoo.org/show_bug.cgi?id=160302
http://bugs.gentoo.org/show_bug.cgi?id=164523
http://bugs.gentoo.org/show_bug.cgi?id=171871

Probably more open bugs, those are just what I stumbled across while
looking for OTHER things :)

I tried to squelsh this early on with.
http://bugs.gentoo.org/show_bug.cgi?id=159623


I am really not effected by this any more. Just concerned that a problem
that showed up in January, still exists to this day :( Bugs keep
stacking up and a resolution, short of slotting and providing both. Is
no where in site :(

For the record I fully support those in their efforts to go gnupg-2 only
on Gentoo. However it's not been practical for some time, and likely
will continue to be such. There is a bit of upstream chaos going on, and
till they rein in the problems. Not much we can do downstream.

Not to mention we deviate from all other distros i their offerings.
Where we have limited offerings, lack of choice :( Which does not seem
to be in Gentoo's nature.

No more from me on this. I have done enough on bugs, and me taking this
to -dev is my final contributions. I leave it up to others to decide and
resolve. I was over my limits months ago on this :)

Thanks to all who have made effort to get this resolved or etc.

-- 
William L. Thomson Jr.
Gentoo/Java

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] gnupg2 only vs gnupg-1 & gnupg-2

[Ulrich Mueller]

>>>>> On Sun, 27 May 2007, William L Thomson wrote:

> For some time now those maintaining gnupg have been attempting to go
> gnupg-2 only on Gentoo. I have tried to support that effort, despite
> all other distros supporting/providing both. Not to mention all
> gnupg release notes stating.

There is also an unresolved issue concerning interoperation with
PGP 2.0 which works with gnupg-1 but not with gnupg-2.

See <http://bugs.gentoo.org/show_bug.cgi?id=159870> for details. This
bug is open since January, upstream is aware of it, but no solution
seems to be in sight.

I would also strongly favor if both gnupg-1 and gnupg-2 could be kept
in different slots.

Ulrich
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] gnupg2 only vs gnupg-1 & gnupg-2

[Graham Murray]

Ulrich Mueller <ulm@gentoo.org> writes:

> I would also strongly favor if both gnupg-1 and gnupg-2 could be kept
> in different slots.

And maybe an eselect (or similar) to select whether external programs
which call use gpg-1 or gpg-2.
-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] gnupg2 only vs gnupg-1 & gnupg-2

[Jakub Moc]

[-- Attachment #1: Type: text/plain, Size: 967 bytes --]

William L. Thomson Jr. napsal(a):
> This has sparked the following open bugs, and countless more closed
> ones :(
> 
> http://bugs.gentoo.org/show_bug.cgi?id=153496
> http://bugs.gentoo.org/show_bug.cgi?id=160302
> http://bugs.gentoo.org/show_bug.cgi?id=164523
> http://bugs.gentoo.org/show_bug.cgi?id=171871
> 
> Probably more open bugs, those are just what I stumbled across while
> looking for OTHER things :)

M'kay... about 3 gnome apps have issues w/ gnupg-2. Seriously, I could
care less; their problem. Maybe upstream will wake up sometimes, or
what's the horrible issue with porting those, beyond 'oh we don't care,
use gnupg-1 because the legacy feeling is oh so great'?

Shrug.


-- 
Best regards,

 Jakub Moc
 mailto:jakub@gentoo.org
 GPG signature:
 http://subkeys.pgp.net:11371/pks/lookup?op=get&search=0xCEBA3D9E
 Primary key fingerprint: D2D7 933C 9BA1 C95B 2C95  B30F 8717 D5FD CEBA 3D9E

 ... still no signature   ;)


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] gnupg2 only vs gnupg-1 & gnupg-2

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 1049 bytes --]

On Sun, 2007-05-27 at 21:02 +0100, Graham Murray wrote:
> Ulrich Mueller <ulm@gentoo.org> writes:
> 
> > I would also strongly favor if both gnupg-1 and gnupg-2 could be kept
> > in different slots.
> 
> And maybe an eselect (or similar) to select whether external programs
> which call use gpg-1 or gpg-2.

That's the beauty of both upstream design and reality.

THERE IS NO NEED FOR ESELECT

Apps will either use and/or be developed for gnupg-1 or gnupg-2. They
are different binaries, versioned by upstream. Have different features
and functionality. Since gnupg-2 is not a full replacement or supports
all of gnupg-1's features.

Think gtk vs gtk2 or apache vs apache2. We quite commonly have two
versions of something in tree during the transition period. Why that is
unacceptable here is beyond me.

Not to mention again, we are limiting choice, and forcing one or the
other. Which is not a complete solution, and makes our offerings less
than all other mainstream distros.

-- 
William L. Thomson Jr.
Gentoo/Java

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-dev] Re: gnupg2 only vs gnupg-1 & gnupg-2

[Steve Long]

William L. Thomson Jr. wrote:
> That's the beauty of both upstream design and reality.
> 
> THERE IS NO NEED FOR ESELECT
>
But eselect makes gentoo so 3l337.. ;)
 
> Apps will either use and/or be developed for gnupg-1 or gnupg-2. They
> are different binaries, versioned by upstream. Have different features
> and functionality. Since gnupg-2 is not a full replacement or supports
> all of gnupg-1's features.
> 
> Think gtk vs gtk2 or apache vs apache2. We quite commonly have two
> versions of something in tree during the transition period. Why that is
> unacceptable here is beyond me.
>
Sounds fine to me; is there any technical reason why that wouldn't work?

> Not to mention again, we are limiting choice, and forcing one or the
> other. Which is not a complete solution, and makes our offerings less
> than all other mainstream distros.
> 
Good points. Imo, you should get some scripts together and do it in your cvs
and prove it; if it works, there'll be one less reason to argue about it.
If not you can roll it back and try again.


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: gnupg2 only vs gnupg-1 & gnupg-2

[Ulrich Mueller]

>>>>> On Fri, 08 Jun 2007, Steve Long wrote:

>> Not to mention again, we are limiting choice, and forcing one or
>> the other. Which is not a complete solution, and makes our
>> offerings less than all other mainstream distros.

> Good points. Imo, you should get some scripts together and do it in
> your cvs and prove it; if it works, there'll be one less reason to
> argue about it.

It works on stable systems, since gnupg is still slotted there:
   1.4.7-r1 in slot 0
   1.9.21 in slot 1.9

Ulrich
-- 
gentoo-dev@gentoo.org mailing list

[gentoo-dev] Re: Re: gnupg2 only vs gnupg-1 & gnupg-2

[Steve Long]

Ulrich Mueller wrote:
>>>>>> On Fri, 08 Jun 2007, Steve Long wrote:
>>> Not to mention again, we are limiting choice, and forcing one or
>>> the other. Which is not a complete solution, and makes our
>>> offerings less than all other mainstream distros.
> 
>> Good points. Imo, you should get some scripts together and do it in
>> your cvs and prove it; if it works, there'll be one less reason to
>> argue about it.
> 
> It works on stable systems, since gnupg is still slotted there:
>    1.4.7-r1 in slot 0
>    1.9.21 in slot 1.9
> 
Er ok, but i'm guessing Mr Thomson wanted to have both available as separate
packages similar to those binary distros gentoo is supposedly able to spit
out (since it is a meta-distro.)


-- 
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] Re: Re: gnupg2 only vs gnupg-1 & gnupg-2

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 1272 bytes --]

On Fri, 2007-06-08 at 09:43 +0100, Steve Long wrote:
>
> > 
> > It works on stable systems, since gnupg is still slotted there:
> >    1.4.7-r1 in slot 0
> >    1.9.21 in slot 1.9
> > 
> Er ok, but i'm guessing Mr Thomson wanted to have both available as separate
> packages similar to those binary distros gentoo is supposedly able to spit
> out (since it is a meta-distro.)

Nope

Slotting accomplishes what is needed to resolve this for now. As
mentioned it was slotted before gnupg-2, and for some reason the slot
was dropped when gnupg-2 was committed to tree. Day one I ran into the
problem, I requested it remain slotted. There has been opposition ever
since.

Not to mention I have never been provided any factual or technical
reasons why we should provide gnupg-2 only. Best I got was personal
preference of the developers managing the gnugp package.

By the way, did I mention this causes depgraph issues, since day one?
Which are only resolved by masking gnupg-2, or etc.

Also we are currently symlinking gpg -> gpg2, and gpg2 doesn't support
all the arguments and etc of gpg2. Since gnugp-2 does not support all
features of gnupg-1. The symlink is a hack to try to avoid needed both.


-- 
William L. Thomson Jr.
Gentoo/Java

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] gnupg2 only vs gnupg-1 & gnupg-2

[William L. Thomson Jr.]

[-- Attachment #1: Type: text/plain, Size: 2779 bytes --]

Since no flames were started over something technical. Let me see if I
can toss in some gasoline and get the bonfire going.

On Sun, 2007-05-27 at 23:30 +0200, Jakub Moc wrote:
> William L. Thomson Jr. napsal(a):
> > This has sparked the following open bugs, and countless more closed
> > ones :(
> > 
> > http://bugs.gentoo.org/show_bug.cgi?id=153496
> > http://bugs.gentoo.org/show_bug.cgi?id=160302
> > http://bugs.gentoo.org/show_bug.cgi?id=164523
> > http://bugs.gentoo.org/show_bug.cgi?id=171871
> > 
> > Probably more open bugs, those are just what I stumbled across while
> > looking for OTHER things :)
> 
> M'kay... about 3 gnome apps have issues w/ gnupg-2.

Question is, is that the root of the problem? If you look into the
situation, you will see it's mostly a problem of gpgme <-> gnupg.

http://bugs.gentoo.org/show_bug.cgi?id=164523
Comment 104
Update:
[1] https://bugs.g10code.com/gnupg/issue772
[2] http://lists.gnupg.org/pipermail/gnupg-devel/2007-February/023676.html

Should have been solved in gnupg-2.0.4, it may help with progress.

Notice should, and that both links deal with gpgme, NOT SEAHORSE or
anything gnome related. Which gpgme and gnupg have basically the same
upstream. Who has made vague comments about it working for them. Despite
reports from others about problems.T here still is not a 100% solution
from upstream between gpgme <-> gnupg.

>  Seriously, I could
> care less; their problem.

Yes, and because of the word Gnome being included, you are overlooking
the important details that matter. In which it's not a Gnome problem at
all :)

The gnome apps like Seahorse talk to gpgme, not gnupg directly. That's
were the problem lies.

>  Maybe upstream will wake up sometimes,

Yes gnupg/gpgme upstream. Not Gnome or other apps that are downstream
from them.

>  or
> what's the horrible issue with porting those,

Port to what?

>  beyond 'oh we don't care,

That should be you don't care. Users do care, if you notice the
different people commenting on the different bugs.

> use gnupg-1 because the legacy feeling is oh so great'?

It's not just about legacy. gnupg-2 is not a COMPLETE replacement. There
are FEATURES of gnupg-1. Upstream is still developing and supporting
gnupg-1. So how is that legacy?

Not to mention clearly stating gnupg-1 has benefits when used with
gnupg-2. Not to mention server side and embedded uses.

None of those features or benefits has anything to do with Gnome. That's
about choice, and we aren't giving the user one.

So here we are going on close to 6 months with no resolution. Which
includes gnupg-2 not being stabilized. I fail to see how any of this is
positive or progress.

-- 
William L. Thomson Jr.
Gentoo/Java

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

[gentoo-dev] Re: Re: Re: gnupg2 only vs gnupg-1 & gnupg-2

[Steve Long]

William L. Thomson Jr. wrote:
<snip> 
I have nfc what any of that really means for users.. ;) Either we need both
packages to keep current with any and all gpg usage, or we don't. Sort it
out amongst yourselves, just keep us users able to mouth off about how
great gentoo is.

BTW thanks for deskzilla ;) That was worth installing java for..


-- 
gentoo-dev@gentoo.org mailing list